HJT-logi täällä on joku........

C:\Program Files\Trend Micro\HijackThis\

sieltä tekstitiedosto pois

 

Nyt se valittaa ku on skannannu nii se sanoo että sitä tiedostoa ei löydy.
Pitääkö mul poistaa toi Hijackthis ja asentaa uudelleen?

 

näämmä jos poistit jonkun muun kun sen tekstitiedoston.

 

Siel oli vaan 1 tekstitiedosto.
Mitä nyt teen?

 

poista se ja scannaa uusi hjt:n loki

 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:37:50, on 14.12.2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Norman\Npm\Bin\eLogsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Norman\Npm\Bin\Zanda.exe
C:\Program Files\Norman\npm\bin\nvoy.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\svchost.exe
C:\Program Files\BUFFALO\clientmgrv\bin\BWH32S.exe
C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
C:\Program Files\Norman\Npm\bin\NVCSCHED.EXE
C:\Program Files\Norman\nse\bin\NSESVC.EXE
C:\Program Files\Norman\Nvc\bin\nvcoas.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Norman\Npm\Bin\Zlh.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\BUFFALO\clientmgrv\bin\cmvMain.exe
C:\Windows\System32\rundll32.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Norman\Nvc\Bin\Nip.exe
C:\Program Files\Norman\Nvc\Bin\cclaw.exe
C:\Windows\ehome\ehsched.exe
C:\Windows\ehome\ehRecvr.exe
C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Winamp\winamp.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FI_FI&c=73&bd=Pavilion&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [Norman ZANDA] "C:\Program Files\Norman\Npm\Bin\ZLH.EXE" /LOAD /SPLASH
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu')
O4 - Global Startup: ClientManagerV.lnk = C:\Program Files\BUFFALO\clientmgrv\bin\cmvMain.exe
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O20 - AppInit_DLLs:
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - Unknown owner - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (file missing)
O23 - Service: Automaattinen LiveUpdate-ajastustoiminto - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: BWH32S - BUFFALO INC. - C:\Program Files\BUFFALO\clientmgrv\bin\BWH32S.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - C:\Program Files\Norman\Npm\Bin\eLogsvc.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Norman NJeeves - Norman ASA - C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Norman ASA - C:\Program Files\Norman\Npm\Bin\Zanda.exe
O23 - Service: Norman Scanner Engine Service (nsesvc) - Norman ASA - C:\Program Files\Norman\nse\bin\NSESVC.EXE
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Program Files\Norman\Nvc\bin\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - C:\Program Files\Norman\Npm\bin\NVCSCHED.EXE
O23 - Service: Norman's Very Own supplY of resources (NVOY) - Norman ASA - C:\Program Files\Norman\npm\bin\nvoy.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 9993 bytes

 

scannaa hjt:llä merkkaa paina Fix checked

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
O20 - AppInit_DLLs:
O23 - Service: Automaattinen LiveUpdate-ajastustoiminto - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)

===============

Mene käynnistä -> suorita -> services.msc -> ok
etsi alla oleva servise

O23 - Service: Automaattinen LiveUpdate-ajastustoiminto - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)

tuplaklikkaa sitä
laita seis
alasvetovalikosta ei käytössä
käytä ja ok

==============

Lataa Tästä Ccleaner
CCleaner v 2.14.750.- Standard Build, ÄLÄ aseenna Yahoo toolbaria!
Asennuksessa poista merkki/rasti kohdasta "asenna Yahoo! toolbar/työkalupalkki".
Asennuksen jälkeen aukaise CCleaneri.
Valitse vasemmalta pystyrivistä Options.
Valitse viereisestä pystyrivistä Settings.
Language kohtaan valitse Suomi.

Puhdistaja
Valitse vasemmalta pystyrivistä Puhdistaja.
Paina alhaalta Tutki.
Nyt CCleaneri tutkii, mitä voidaan poistaa (tempit, cookiessit jne.).
Kun tutkiminen on valmis, paina Aja CCleaner.
Nyt CCleaneri poistaa löydetyt tempit, cookiessit jne.

Rekisterin virheiden korjaus
Valitse vasemmalta pystyrivistä Rekisteri.
Paina alhaalta Etsi rekisterin virheitä.
Kun etsintä on valmis ja olet varma, että haluat korjata ne rivit jotka ovat merkattuja, niin paina Korjaa valitut rekisterin virheet.
Sinulta kysytään "haluatko varmuuskopioida muutokset rekisteriin", paina Kyllä. Tallenna varmuuskopio vaikka "Omat tiedostot" -kansioon.
Klikkaa uudesta aukeavasta ikkunasta Korjaa kaikki valitut virheet.
Saat vielä varmistus kysymyksen, paina Ok.
Kun virheet on korjattu, paina Sulje.
Nyt voit sulkea CCleanerin painamalla oikealta ylhäältä punaista rastia.

 

Juu mitä seuraavaksi?

 

Malwarebytes' Anti-Malware <-- päivitä ja aja täysi scannaus

 

Huomenna tarkistan.
Nyt alan nukkuu.
Huomenna skannaan Malware bytesil.

 

Malwarebytes' Anti-Malware 1.31
Tietokantaversio: 1501
Windows 6.0.6001 Service Pack 1

15.12.2008 14:51:57
mbam-log-2008-12-15 (14-51-57).txt

Tarkistustyyppi: Täysi tarkistus (C:\|)
Tarkistetut kohteet: 175940
Kulunut aika: 1 hour(s), 19 minute(s), 16 second(s)

Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 0
Saastuneita rekisteriarvoja: 0
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 0

Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)

Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)

Saastuneita rekisteriavaimia:
(Haitallisia kohteita ei löydetty)

Saastuneita rekisteriarvoja:
(Haitallisia kohteita ei löydetty)

Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)

Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)

Saastuneita tiedostoja:
(Haitallisia kohteita ei löydetty)

 

combofix loki

scannaa viimsenä uusi hjt:n loki

 

Combofix ohjelmaa en oikein uskalla käyttää ku siinä kuuluu se iso piippaus ääni kun se on mennyt pois jostain komentorivi ikkunasta.

Kertoisitko tarkat combofix ohjeet?

 

kirjoita suorita luukkuun

Combofix /u

paina Ok

=============

aja tuo sdfix

 

mikä ihmeen SDfix ja ai windowsin suorita kohtaan combofix /u?

 

juu näin ja klikkaat OK

=====================

juu ei mitään sdfixsiä täähän on vista

====================

Scannaa koneesi Kaspersky Online Scannerin

Ohjelman käynnistyessä kysytään sallitaanko ActiveX -komponentin asentamisen Kasperskyltä, klikkaa Kyllä.
" Ohjelma käynnistyy ja aloittaa viimeisimpien tunnistetiedostojen lataamisen.
" Kun skanneri on asennettu ja tunnistetiedot ladattu, klikkaa Next.
" Klikkaa nyt asetuksia, Scan Settings
" Tarkista asetuksista, että seuraavat ovat valittuina:
o Scan using the following Anti-Virus database:
+ Extended (Jos valittavissa, muuten valitse Standard)
o Scan Options:
+ Scan Archives
+ Scan Mail Bases
" Klikkaa OK
" Nyt valitse "select a target to scan" otsikon alta Oma Tietokone, My Computer
" Skannaus vie aikaa, joten ole kärsivällinen. Kun skannaus on valmis saat ilmoituksen, jos koneesi on saastunut.
" Klikkaa nyt Save as Text-painiketta.
" Tallenna tiedosto työpöydällesi.
" Mikäli haluat jatkaa asian käsittelyä foorumissa niin kopioi tiedoston sisältö viestiisi.

 

http://www.youtube.com/watch?v=P4OlfpTz6-8 teenkö tuossa vähgän niinkuin tuo ihminen? ja sitte laitan tänne sen login.

 

suorita. kyllä. jes. älä kiellä.

 

ok

 

ComboFix 08-12-15.01 - Toni Kokko 2008-12-15 22:16:56.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1035.18.1982.850 [GMT 2:00]
Sijainti: c:\users\Toni Kokko\Desktop\ComboFix.exe
* Uusi palautuspiste luotu
* Resident AV is active

.

((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-11-15 to 2008-12-15 )))))))))))))))))
.

2008-12-14 20:48 . 2008-12-14 20:48 <KANSIO> d-------- c:\program files\Java
2008-12-14 20:48 . 2008-12-14 20:48 410,984 --a------ c:\windows\System32\deploytk.dll
2008-12-14 17:41 . 2008-12-14 17:42 <KANSIO> d-------- c:\users\Toni Kokko\AppData\Roaming\U3
2008-12-11 23:08 . 2008-12-14 17:56 <KANSIO> d-------- c:\users\Toni Kokko\.SunDownloadManager
2008-12-11 15:00 . 2008-12-11 15:00 249,592 --a------ c:\windows\System32\cssdll32.dll
2008-12-11 14:56 . 2008-12-14 20:24 <KANSIO> d-------- c:\users\Toni Kokko\AppData\Roaming\Comodo
2008-12-11 14:55 . 2008-12-14 20:24 <KANSIO> d-------- c:\users\All Users\comodo
2008-12-11 14:55 . 2008-12-14 20:24 <KANSIO> d-------- c:\programdata\comodo
2008-12-11 14:55 . 2008-12-14 20:24 <KANSIO> d-------- c:\program files\COMODO
2008-12-10 23:23 . 2008-12-10 23:23 <KANSIO> d-------- c:\users\Toni Kokko\AppData\Roaming\ImgBurn
2008-12-10 23:19 . 2008-12-10 23:19 <KANSIO> d-------- c:\program files\ImgBurn
2008-12-10 20:52 . 2008-12-10 20:52 <KANSIO> d-------- c:\temp\Windows XP Professional (English)
2008-12-10 16:01 . 2008-10-22 03:22 2,048 --a------ c:\windows\System32\tzres.dll
2008-12-10 14:55 . 2008-12-10 18:41 <KANSIO> d-------- c:\users\Toni Kokko\AppData\Roaming\SUPERAntiSpyware.com
2008-12-10 14:55 . 2008-12-10 14:55 <KANSIO> d-------- c:\users\All Users\SUPERAntiSpyware.com
2008-12-10 14:55 . 2008-12-10 14:55 <KANSIO> d-------- c:\programdata\SUPERAntiSpyware.com
2008-12-10 14:55 . 2008-12-10 18:41 <KANSIO> d-------- c:\program files\SUPERAntiSpyware
2008-12-09 21:05 . 2008-12-09 21:05 <KANSIO> d-------- c:\program files\Trend Micro
2008-12-08 20:36 . 2008-12-10 14:13 <KANSIO> d--h----- C:\$AVG8.VAULT$
2008-12-08 19:25 . 2008-12-10 19:06 <KANSIO> d-------- c:\users\All Users\avg8
2008-12-08 19:25 . 2008-12-10 19:06 <KANSIO> d-------- c:\programdata\avg8
2008-12-08 18:53 . 2008-12-08 18:53 <KANSIO> d-------- c:\users\All Users\Kaspersky Lab Setup Files
2008-12-08 18:53 . 2008-12-08 18:53 <KANSIO> d-------- c:\programdata\Kaspersky Lab Setup Files
2008-12-07 23:57 . 2008-12-07 23:57 <KANSIO> d-------- c:\windows\Sun
2008-12-02 21:43 . 2008-12-02 21:43 <KANSIO> d-------- c:\users\Toni Kokko\AppData\Roaming\Malwarebytes
2008-12-02 21:43 . 2008-12-02 21:43 <KANSIO> d-------- c:\users\All Users\Malwarebytes
2008-12-02 21:43 . 2008-12-02 21:43 <KANSIO> d-------- c:\programdata\Malwarebytes
2008-12-02 21:43 . 2008-12-14 22:54 <KANSIO> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-02 21:43 . 2008-12-03 19:52 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys
2008-12-02 21:43 . 2008-12-03 19:52 15,504 --a------ c:\windows\System32\drivers\mbam.sys
2008-11-26 19:39 . 2008-10-21 07:25 1,645,568 --a------ c:\windows\System32\connect.dll
2008-11-26 19:39 . 2008-08-28 05:40 712,704 --a------ c:\windows\System32\WindowsCodecs.dll
2008-11-26 19:39 . 2008-08-28 05:40 425,472 --a------ c:\windows\System32\PhotoMetadataHandler.dll
2008-11-26 19:39 . 2008-08-28 05:40 347,136 --a------ c:\windows\System32\WindowsCodecsExt.dll
2008-11-26 19:39 . 2008-10-22 05:57 241,152 --a------ c:\windows\System32\PortableDeviceApi.dll
2008-11-24 22:36 . 2008-11-24 22:37 <KANSIO> d-------- c:\users\All Users\Lavasoft
2008-11-24 22:36 . 2008-11-24 22:37 <KANSIO> d-------- c:\programdata\Lavasoft
2008-11-24 22:36 . 2008-11-24 22:36 <KANSIO> d-------- c:\program files\Lavasoft
2008-11-24 22:35 . 2008-12-10 18:41 <KANSIO> d-------- c:\program files\Common Files\Wise Installation Wizard
2008-11-23 22:55 . 2008-11-23 22:55 <KANSIO> d-------- c:\users\All Users\Grisoft
2008-11-23 22:55 . 2008-11-23 22:55 <KANSIO> d-------- c:\programdata\Grisoft
2008-11-23 22:44 . 2008-11-23 22:44 <KANSIO> dr------- c:\windows\System32\config\systemprofile\Videos
2008-11-23 22:44 . 2008-11-23 22:44 <KANSIO> dr------- c:\windows\System32\config\systemprofile\Pictures
2008-11-23 22:44 . 2008-11-23 22:44 <KANSIO> dr------- c:\windows\System32\config\systemprofile\Downloads
2008-11-23 22:44 . 2008-11-23 22:44 <KANSIO> dr------- c:\windows\System32\config\systemprofile\Documents
2008-11-23 20:15 . 2008-11-23 20:15 52,736 --a------ c:\windows\ipuninst.exe
2008-11-23 19:50 . 2008-11-23 19:50 <KANSIO> d-------- c:\program files\Alcohol Soft
2008-11-20 22:44 . 2008-11-20 22:44 42,320 --a------ c:\windows\System32\xfcodec.dll
2008-11-17 16:27 . 2008-11-17 16:27 <KANSIO> d-------- c:\program files\CCleaner
2008-11-15 11:39 . 2008-10-16 23:13 1,809,944 --a------ c:\windows\System32\wuaueng.dll
2008-11-15 11:39 . 2008-10-16 22:56 1,524,736 --a------ c:\windows\System32\wucltux.dll
2008-11-15 11:39 . 2008-10-16 23:09 51,224 --a------ c:\windows\System32\wuauclt.exe
2008-11-15 11:39 . 2008-10-16 23:09 43,544 --a------ c:\windows\System32\wups2.dll
2008-11-15 11:38 . 2008-10-16 23:12 561,688 --a------ c:\windows\System32\wuapi.dll
2008-11-15 11:38 . 2008-10-16 14:08 162,064 --a------ c:\windows\System32\wuwebv.dll
2008-11-15 11:38 . 2008-10-16 22:55 83,456 --a------ c:\windows\System32\wudriver.dll
2008-11-15 11:38 . 2008-10-16 23:08 34,328 --a------ c:\windows\System32\wups.dll
2008-11-15 11:38 . 2008-10-16 13:56 31,232 --a------ c:\windows\System32\wuapp.exe

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-15 19:24 28,314 ----a-w c:\users\Toni Kokko\AppData\Roaming\nvModes.dat
2008-12-15 18:35 --------- d-----w c:\program files\Steam
2008-12-15 18:01 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\Xfire
2008-12-15 05:19 --------- d-----w c:\programdata\Xfire
2008-12-15 05:12 --------- d-----w c:\program files\World of Warcraft
2008-12-14 20:19 --------- d-----w c:\program files\Norman
2008-12-14 18:21 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\uTorrent
2008-12-14 18:05 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-14 16:33 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\mIRC
2008-12-10 14:50 --------- d-----w c:\program files\Windows Mail
2008-12-10 13:35 --------- d-----w c:\program files\mIRC
2008-12-08 17:06 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-12-08 17:03 --------- d-----w c:\programdata\Symantec
2008-12-08 07:23 --------- d-----w c:\program files\MSN Messenger
2008-12-07 17:31 --------- d-----w c:\program files\RevConnect
2008-12-03 20:31 --------- d-----w c:\program files\WhatPulse
2008-11-27 18:33 --------- d-----w c:\program files\Xfire
2008-11-24 09:59 --------- d-----w c:\program files\Google
2008-11-23 21:22 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\BSplayer
2008-11-23 21:22 --------- d-----w c:\program files\Webteh
2008-11-23 20:27 --------- d-----w c:\programdata\Team MediaPortal
2008-11-23 20:27 --------- d-----w c:\program files\Team MediaPortal
2008-11-23 19:15 --------- d-----w c:\program files\Common Files\ArcSoft
2008-11-23 17:18 717,296 ----a-w c:\windows\system32\drivers\sptd.sys
2008-11-22 18:33 --------- d-----w c:\program files\SystemRequirementsLab
2008-11-22 18:31 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\SystemRequirementsLab
2008-11-15 20:11 --------- d-----w c:\program files\Common Files\Steam
2008-11-13 16:21 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\Skype
2008-11-03 14:00 --------- d-----w c:\programdata\Blizzard
2008-11-02 18:36 --------- d-----w c:\program files\Common Files\Blizzard Entertainment
2008-11-01 19:22 --------- d-----w c:\programdata\ArcSoft
2008-11-01 16:15 --------- d-----w c:\program files\Microsoft SQL Server
2008-11-01 07:40 30 ----a-w c:\users\Toni Kokko\jagex_runescape_preferences.dat
2008-11-01 03:44 541,696 ----a-w c:\windows\AppPatch\AcLayers.dll
2008-11-01 03:44 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll
2008-11-01 03:44 460,288 ----a-w c:\windows\AppPatch\AcSpecfc.dll
2008-11-01 03:44 28,672 ----a-w c:\windows\System32\Apphlpdm.dll
2008-11-01 03:44 2,154,496 ----a-w c:\windows\AppPatch\AcGenral.dll
2008-11-01 03:44 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll
2008-11-01 01:21 4,240,384 ----a-w c:\windows\System32\GameUXLegacyGDFs.dll
2008-10-31 20:12 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\Ventrilo
2008-10-31 19:17 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\ArcSoft
2008-10-31 16:40 --------- d-----w c:\program files\mpgconv
2008-10-31 16:12 --------- d-----w c:\program files\Microsoft.NET
2008-10-31 15:08 --------- d-----w c:\program files\ProgDVB
2008-10-29 06:29 2,927,104 ----a-w c:\windows\explorer.exe
2008-10-22 15:44 --------- d-----w c:\program files\Microsoft Silverlight
2008-10-21 05:25 296,960 ----a-w c:\windows\System32\gdi32.dll
2008-10-20 13:27 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\fretsonfire
2008-10-17 17:20 --------- d-----w c:\program files\uTorrent
2008-10-17 11:15 --------- d-----w c:\program files\xchat
2008-10-17 11:14 --------- d-----w c:\program files\Frets on Fire
2008-10-17 11:10 --------- d-----w c:\program files\Audacity
2008-10-16 04:47 827,392 ----a-w c:\windows\System32\wininet.dll
2008-10-09 16:54 28,672 ----a-w c:\windows\System32\AF15BDAEX.dll
2008-09-30 14:43 1,286,152 ----a-w c:\windows\System32\msxml4.dll
2008-09-18 05:09 3,601,464 ----a-w c:\windows\System32\ntkrnlpa.exe
2008-09-18 05:09 3,549,240 ----a-w c:\windows\System32\ntoskrnl.exe
2008-09-18 04:56 147,456 ----a-w c:\windows\System32\Faultrep.dll
2008-09-18 04:56 125,952 ----a-w c:\windows\System32\wersvc.dll
2008-09-18 02:16 2,032,640 ----a-w c:\windows\System32\win32k.sys
2008-05-24 06:35 174 --sha-w c:\program files\desktop.ini
2007-11-12 15:12 856 ----a-w c:\users\Toni Kokko\AppData\Roaming\wklnhst.dat
2005-07-05 14:47 777 ----a-w c:\program files\trial_setup.ini
2005-07-05 14:47 5,133,312 ----a-w c:\program files\trial_setup.msi
2005-07-05 14:47 40,448 ----a-w c:\program files\trial_setup.exe
2007-10-28 17:48 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2007-10-28 17:48 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2007-10-28 17:48 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
2007-08-30 15:12 16 --sha-w c:\windows\SMINST\HPCD.sys
.

(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-18 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-18 125952]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]
"Google Update"="c:\users\Toni Kokko\AppData\Local\Google\Update\GoogleUpdate.exe" [2008-12-15 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-28 1045800]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-04-23 176128]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-02-13 159744]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-03-12 50696]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]
"Norman ZANDA"="c:\program files\Norman\Npm\Bin\ZLH.EXE" [2008-06-02 277616]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-11-07 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-11-07 8534560]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-11-07 81920]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-14 136600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-07 44128]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
ClientManagerV.lnk - c:\program files\BUFFALO\clientmgrv\bin\cmvMain.exe [2008-10-07 138808]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= c:\program files\ffdshow\ffdshow.ax
"VIDC.XFR1"= xfcodec.dll

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^TMMonitor.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\TMMonitor.lnk
backup=c:\windows\pss\TMMonitor.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^Toni Kokko^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Xfire.lnk]
path=c:\users\Toni Kokko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xfire.lnk
backup=c:\windows\pss\Xfire.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 21:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
--a------ 2007-01-19 11:55 5674352 c:\program files\MSN Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
--a------ 2006-07-13 23:41 20034600 c:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhatPulse]
--a------ 2006-08-21 19:48 665600 c:\program files\WhatPulse\WhatPulse.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2008-08-04 01:02 36352 c:\program files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"TCP Query User{0E60E5F2-C916-49E0-95D4-2E627F9B6584}c:\\program files\\msn messenger\\msnmsgr.exe"= UDP:c:\program files\msn messenger\msnmsgr.exe:Messenger
"UDP Query User{4C2E6A0D-F273-4BDA-83C8-F765026B7793}c:\\program files\\msn messenger\\msnmsgr.exe"= TCP:c:\program files\msn messenger\msnmsgr.exe:Messenger
"{D544B387-58C0-408C-A260-FD2D4E311490}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2main.exe:Neverwinter Nights 2 Main
"{8EA83D06-8F05-4EF9-80CA-755B77E5AFF8}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2main.exe:Neverwinter Nights 2 Main
"{AFD50BC0-ADB8-48FD-89BA-EB04869FB04A}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2main_amdxp.exe:Neverwinter Nights 2 AMD
"{BE23AB97-F9AB-4DE6-A39D-6E559FC93900}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2main_amdxp.exe:Neverwinter Nights 2 AMD
"{D66B4CF5-C554-4AEB-A86E-AD7DB85A46A8}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwupdate.exe:Neverwinter Nights 2 Updater
"{CE2B4A9D-8D3E-493A-85E2-75A59E58922D}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwupdate.exe:Neverwinter Nights 2 Updater
"{9963DB7F-22C2-473D-9917-DC1D1E408B72}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2server.exe:Neverwinter Nights 2 Server
"{244AD98B-9023-47F0-AD1E-29BC7685E96A}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2server.exe:Neverwinter Nights 2 Server
"TCP Query User{F489A6A9-FE85-4FA6-85CF-E59E6DAF3156}c:\\program files\\xfire\\xfire.exe"= UDP:c:\program files\xfire\xfire.exe:Xfire
"UDP Query User{7D9956B7-71D1-4FC4-9CE6-832F85DAB2F3}c:\\program files\\xfire\\xfire.exe"= TCP:c:\program files\xfire\xfire.exe:Xfire
"TCP Query User{C1771924-088B-4479-9E4F-08E43FFECB97}c:\\program files\\msn messenger\\livecall.exe"= UDP:c:\program files\msn messenger\livecall.exe:Windows Live Call
"UDP Query User{F792272E-B764-4CFD-B2F1-C8B157A42A87}c:\\program files\\msn messenger\\livecall.exe"= TCP:c:\program files\msn messenger\livecall.exe:Windows Live Call
"TCP Query User{FF66BB09-91AA-4DE6-AF98-A53FD47C99A4}c:\\program files\\emule\\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule
"UDP Query User{331EAEE3-D7AB-4DFB-B4A2-144FCF3159A8}c:\\program files\\emule\\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule
"TCP Query User{9A954996-511F-4135-8468-ECB0BCE6021C}c:\\users\\toni kokko\\desktop\\nes\\nestc042\\nestcl95.exe"= UDP:c:\users\toni kokko\desktop\nes\nestc042\nestcl95.exe:nestcl95.exe
"UDP Query User{F76BA4B4-2BB9-409B-AE4E-4EB7BB4117F2}c:\\users\\toni kokko\\desktop\\nes\\nestc042\\nestcl95.exe"= TCP:c:\users\toni kokko\desktop\nes\nestc042\nestcl95.exe:nestcl95.exe
"TCP Query User{CCCA7D9E-957F-41C2-9E95-BF5A9D165A8B}c:\\users\\toni kokko\\desktop\\utorrent.exe"= UDP:c:\users\toni kokko\desktop\utorrent.exe:utorrent.exe
"UDP Query User{A5D6125A-F900-48E3-B961-6D3FEC8C95E5}c:\\users\\toni kokko\\desktop\\utorrent.exe"= TCP:c:\users\toni kokko\desktop\utorrent.exe:utorrent.exe
"TCP Query User{74C37976-832D-4749-804A-AD0500E05A5A}c:\\neverwinternights\\nwn\\nwmain.exe"= UDP:c:\neverwinternights\nwn\nwmain.exe:Neverwinter Nights
"UDP Query User{800E3D01-47D1-4313-BFD1-B33D07152FC3}c:\\neverwinternights\\nwn\\nwmain.exe"= TCP:c:\neverwinternights\nwn\nwmain.exe:Neverwinter Nights
"TCP Query User{E34D9D43-0DBD-438C-9399-F8EFF49FE563}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{5801BA1E-24E1-4DAA-B511-AFB0979D09E9}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox
"{4DEA1078-B4EF-46F8-8AE7-B438930E46EF}"= UDP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent
"{FDBCB264-4CDB-4991-AD93-DE1FADBEE8BF}"= TCP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent
"TCP Query User{450ACF7E-B1DD-4791-8D62-03446A1DCE2A}c:\\program files\\byond\\bin\\byond.exe"= UDP:c:\program files\byond\bin\byond.exe:byond
"UDP Query User{D1B4E27F-BC0E-4084-A91F-84E9117CC3A0}c:\\program files\\byond\\bin\\byond.exe"= TCP:c:\program files\byond\bin\byond.exe:byond
"TCP Query User{30F015A4-F3E8-4A45-BAA0-C14ACA1208CB}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{DB869AB6-C57A-45A4-9C81-A6635D2B3780}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:uTorrent
"TCP Query User{6D1C176D-F5CB-4456-9837-7333E5D352A9}c:\\program files\\counter-strike 1.6\\hl.exe"= UDP:c:\program files\counter-strike 1.6\hl.exe:Half-Life Launcher
"UDP Query User{0F745B67-F537-4EAD-B14E-6597D2C8D17E}c:\\program files\\counter-strike 1.6\\hl.exe"= TCP:c:\program files\counter-strike 1.6\hl.exe:Half-Life Launcher
"TCP Query User{D677DB5E-40A0-43E1-8D41-7D2419599383}c:\\program files\\ea games\\medal of honor pacific assault(tm) mpdemo2\\mohpa_mpdemo.exe"= UDP:c:\program files\ea games\medal of honor pacific assault(tm) mpdemo2\mohpa_mpdemo.exe:Medal of Honor Pacific Assault(tm)
"UDP Query User{458AC2B1-2FAC-4B4B-84F5-583EB41A645D}c:\\program files\\ea games\\medal of honor pacific assault(tm) mpdemo2\\mohpa_mpdemo.exe"= TCP:c:\program files\ea games\medal of honor pacific assault(tm) mpdemo2\mohpa_mpdemo.exe:Medal of Honor Pacific Assault(tm)
"TCP Query User{5EFC87C6-F824-46C0-B522-289B9521117F}c:\\program files\\ea games\\medal of honor pacific assault(tm) mpdemo2\\mohpa_mpdemo_server.exe"= UDP:c:\program files\ea games\medal of honor pacific assault(tm) mpdemo2\mohpa_mpdemo_server.exe:Medal of Honor Pacific Assault(tm)
"UDP Query User{5170532E-4D95-4AC3-8CB3-43BDD42DF486}c:\\program files\\ea games\\medal of honor pacific assault(tm) mpdemo2\\mohpa_mpdemo_server.exe"= TCP:c:\program files\ea games\medal of honor pacific assault(tm) mpdemo2\mohpa_mpdemo_server.exe:Medal of Honor Pacific Assault(tm)
"TCP Query User{C3BEF026-E9E6-49AF-8692-82BA32F08404}c:\\program files\\wolfenstein - enemy territory\\et.exe"= UDP:c:\program files\wolfenstein - enemy territory\et.exe:ET
"UDP Query User{5D2F2AEB-CEDA-4639-A9D0-F0C577D93D08}c:\\program files\\wolfenstein - enemy territory\\et.exe"= TCP:c:\program files\wolfenstein - enemy territory\et.exe:ET
"TCP Query User{13F890DE-490E-4B0B-A087-A1602366A068}c:\\program files\\wolfenstein - enemy territory\\etded.exe"= UDP:c:\program files\wolfenstein - enemy territory\etded.exe:ETDED
"UDP Query User{B91B82C8-9DF3-4DD9-944C-FE795C320114}c:\\program files\\wolfenstein - enemy territory\\etded.exe"= TCP:c:\program files\wolfenstein - enemy territory\etded.exe:ETDED
"{28350A57-E35F-4F9C-B726-7B3C68A588E3}"= UDP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-2.3.0.7561-to-2.3.2.7741-enGB-downloader.exe:Blizzard Downloader
"{76E61FE2-B81C-4A09-983A-D667AD863C44}"= TCP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-2.3.0.7561-to-2.3.2.7741-enGB-downloader.exe:Blizzard Downloader
"TCP Query User{6F5B6C21-B17E-4BA6-BACF-63340EF3162E}c:\\program files\\microsoft games\\halo\\halo.exe"= UDP:c:\program files\microsoft games\halo\halo.exe:Halo
"UDP Query User{47B278DD-D9A1-41DF-BA07-E2CA5916589E}c:\\program files\\microsoft games\\halo\\halo.exe"= TCP:c:\program files\microsoft games\halo\halo.exe:Halo
"TCP Query User{84C8EEEE-5646-45A6-9B3E-7BB1B421C0B7}c:\\users\\toni kokko\\desktop\\installer-22999-864-counter-strike.exe"= UDP:c:\users\toni kokko\desktop\installer-22999-864-counter-strike.exe:installer-22999-864-counter-strike.exe
"UDP Query User{96AF4C29-27B9-470A-898F-C74BDE0FA4B5}c:\\users\\toni kokko\\desktop\\installer-22999-864-counter-strike.exe"= TCP:c:\users\toni kokko\desktop\installer-22999-864-counter-strike.exe:installer-22999-864-counter-strike.exe
"TCP Query User{619080D8-8BD2-43BE-9D6D-20EF595F124B}c:\\program files\\jazz jackrabbit 2\\jazz2.exe"= UDP:c:\program files\jazz jackrabbit 2\jazz2.exe:Jazz Jackrabbit 2
"UDP Query User{E21B1754-AC24-4590-A3EC-7AD436050300}c:\\program files\\jazz jackrabbit 2\\jazz2.exe"= TCP:c:\program files\jazz jackrabbit 2\jazz2.exe:Jazz Jackrabbit 2
"{C430DAF0-70C6-4A09-9149-FE39258CC3E7}"= UDP:94:VRS Recording System Web Control Panel
"{5E1865ED-1E02-40B5-BD48-464808564702}"= TCP:8000:Axon Virtual PBX RTP Incoming Audio (UDP)
"{48B844C8-8091-454D-A500-3829598B8619}"= TCP:8001:Axon Virtual PBX RTP Incoming Audio (UDP)
"{D5122966-424E-4973-B4E8-621466F124FA}"= TCP:8002:Axon Virtual PBX RTP Incoming Audio (UDP)
"{14CA1EB7-06AF-4992-8F33-CA8A2A6907A1}"= TCP:8003:Axon Virtual PBX RTP Incoming Audio (UDP)
"{07144F0D-652E-4938-A4A6-7AB816714FFA}"= TCP:8004:Axon Virtual PBX RTP Incoming Audio (UDP)
"{10771593-3459-4E97-946D-393D93FCBD84}"= UDP:81:Axon Virtual PBX Web Server
"TCP Query User{DC46209A-4D4D-424A-8B56-2D92080081FA}c:\\program files\\condition zero\\hlds.exe"= UDP:c:\program files\condition zero\hlds.exe:HLDS Launcher
"UDP Query User{34072C27-AA45-49B3-938D-BE4BC547EAA6}c:\\program files\\condition zero\\hlds.exe"= TCP:c:\program files\condition zero\hlds.exe:HLDS Launcher
"TCP Query User{3C767F74-CB7D-4D9F-8EE2-50E472BA6FA5}c:\\program files\\skype\\phone\\skype.exe"= UDP:c:\program files\skype\phone\skype.exe:Skype. The whole world can talk for free.
"UDP Query User{DC78D1AA-837C-46A6-96FD-5D6B2A1BBECA}c:\\program files\\skype\\phone\\skype.exe"= TCP:c:\program files\skype\phone\skype.exe:Skype. The whole world can talk for free.
"TCP Query User{AA2D2F5E-039A-4DD4-885B-C2D14B1A31A2}c:\\program files\\condition zero\\hlds.exe"= UDP:c:\program files\condition zero\hlds.exe:HLDS Launcher
"UDP Query User{0DBC3F9B-298F-4C44-8502-7B0DAA696F75}c:\\program files\\condition zero\\hlds.exe"= TCP:c:\program files\condition zero\hlds.exe:HLDS Launcher
"TCP Query User{D7AD1479-5F64-4930-83C8-2927AB9E0F13}c:\\program files\\steam\\steamapps\\tonikokko\\dedicated server\\hlds.exe"= UDP:c:\program files\steam\steamapps\tonikokko\dedicated server\hlds.exe:HLDS Launcher
"UDP Query User{F3C82F4E-374B-44B6-97CB-56D0293C4BA9}c:\\program files\\steam\\steamapps\\tonikokko\\dedicated server\\hlds.exe"= TCP:c:\program files\steam\steamapps\tonikokko\dedicated server\hlds.exe:HLDS Launcher
"TCP Query User{1EC6E41B-CDBA-49BF-B50B-42CDDB39E83D}c:\\program files\\css\\hl2.exe"= UDP:c:\program files\css\hl2.exe:hl2
"UDP Query User{A7391A47-23E6-4F58-ACEC-DD126FFE456F}c:\\program files\\css\\hl2.exe"= TCP:c:\program files\css\hl2.exe:hl2
"TCP Query User{5B91D1B4-4D0D-4392-B877-7605B8FE1A0C}c:\\program files\\css\\srcds.exe"= UDP:c:\program files\css\srcds.exe:srcds
"UDP Query User{B0D44996-1DFD-4C13-9FB0-FB239079A96A}c:\\program files\\css\\srcds.exe"= TCP:c:\program files\css\srcds.exe:srcds
"TCP Query User{A9F96E00-45E6-49C4-A318-F1A387CFC15E}c:\\program files\\steam\\steamapps\\tonikokko\\counter-strike\\hl.exe"= UDP:c:\program files\steam\steamapps\tonikokko\counter-strike\hl.exe:Half-Life Launcher
"UDP Query User{52B86BB3-139B-41C0-9A76-7E0ACD830A9F}c:\\program files\\steam\\steamapps\\tonikokko\\counter-strike\\hl.exe"= TCP:c:\program files\steam\steamapps\tonikokko\counter-strike\hl.exe:Half-Life Launcher
"TCP Query User{352C5FB1-A302-4D84-A303-94FC6280B1D8}c:\\program files\\steam\\steamapps\\tonikokko\\condition zero deleted scenes\\hl.exe"= UDP:c:\program files\steam\steamapps\tonikokko\condition zero deleted scenes\hl.exe:Half-Life Launcher
"UDP Query User{B5482BF4-55AD-420C-A6AB-F7B0D353C806}c:\\program files\\steam\\steamapps\\tonikokko\\condition zero deleted scenes\\hl.exe"= TCP:c:\program files\steam\steamapps\tonikokko\condition zero deleted scenes\hl.exe:Half-Life Launcher
"TCP Query User{8F8E66C1-9816-4E0E-95E3-78DC8B2BD9FD}c:\\program files\\steam\\steamapps\\tonikokko\\deathmatch classic\\hl.exe"= UDP:c:\program files\steam\steamapps\tonikokko\deathmatch classic\hl.exe:Half-Life Launcher
"UDP Query User{C4018428-4558-4595-A0C3-49A90D49A7B9}c:\\program files\\steam\\steamapps\\tonikokko\\deathmatch classic\\hl.exe"= TCP:c:\program files\steam\steamapps\tonikokko\deathmatch classic\hl.exe:Half-Life Launcher
"TCP Query User{DCFA1FCE-D408-47CD-8571-0105ACFA2916}c:\\program files\\steam\\steamapps\\tonikokko\\day of defeat\\hl.exe"= UDP:c:\program files\steam\steamapps\tonikokko\day of defeat\hl.exe:Half-Life Launcher
"UDP Query User{62519076-C4D5-4189-AFA3-FB99447E71D0}c:\\program files\\steam\\steamapps\\tonikokko\\day of defeat\\hl.exe"= TCP:c:\program files\steam\steamapps\tonikokko\day of defeat\hl.exe:Half-Life Launcher
"TCP Query User{0036597C-6744-46E1-87AB-B5DA7022EA80}c:\\program files\\steam\\steamapps\\tonikokko\\counter-strike\\hl.exe"= UDP:c:\program files\steam\steamapps\tonikokko\counter-strike\hl.exe:Half-Life Launcher
"UDP Query User{663FFDC6-AE4E-48C0-A372-E2D9606A88CA}c:\\program files\\steam\\steamapps\\tonikokko\\counter-strike\\hl.exe"= TCP:c:\program files\steam\steamapps\tonikokko\counter-strike\hl.exe:Half-Life Launcher
"TCP Query User{CA0AAE20-34D5-4F87-9E3A-BDFB0BDB4D71}c:\\program files\\steam\\steamapps\\tonikokko\\ricochet\\hl.exe"= UDP:c:\program files\steam\steamapps\tonikokko\ricochet\hl.exe:Half-Life Launcher
"UDP Query User{0CD7D344-BF25-4DBC-BB9F-A077320A0F5C}c:\\program files\\steam\\steamapps\\tonikokko\\ricochet\\hl.exe"= TCP:c:\program files\steam\steamapps\tonikokko\ricochet\hl.exe:Half-Life Launcher
"TCP Query User{A91F8163-967F-4925-AADE-F07576322012}c:\\program files\\steam\\steamapps\\tonikokko\\condition zero deleted scenes\\hl.exe"= UDP:c:\program files\steam\steamapps\tonikokko\condition zero deleted scenes\hl.exe:Half-Life Launcher
"UDP Query User{28567FE8-4FFA-485F-9801-A152048863F2}c:\\program files\\steam\\steamapps\\tonikokko\\condition zero deleted scenes\\hl.exe"= TCP:c:\program files\steam\steamapps\tonikokko\condition zero deleted scenes\hl.exe:Half-Life Launcher
"TCP Query User{E9852CC0-029E-4A0C-8096-FD6ECFAB0A90}c:\\program files\\steam\\steamapps\\tonikokko\\dedicated server\\hlds.exe"= UDP:c:\program files\steam\steamapps\tonikokko\dedicated server\hlds.exe:HLDS Launcher
"UDP Query User{0C665345-3CA8-457E-81C9-6BC344EC98A4}c:\\program files\\steam\\steamapps\\tonikokko\\dedicated server\\hlds.exe"= TCP:c:\program files\steam\steamapps\tonikokko\dedicated server\hlds.exe:HLDS Launcher
"TCP Query User{687C75CE-4F7D-40F5-8C14-87714F9F9416}c:\\program files\\warcraft iii\\war3.exe"= UDP:c:\program files\warcraft iii\war3.exe:war3
"UDP Query User{7D83C4AA-B864-4BB7-8ECA-0879524333EC}c:\\program files\\warcraft iii\\war3.exe"= TCP:c:\program files\warcraft iii\war3.exe:war3
"TCP Query User{01937352-B3E0-4023-A301-3C31B8535E5D}c:\\program files\\free internet tv\\internettv.exe"= UDP:c:\program files\free internet tv\internettv.exe:Free Internet TV
"UDP Query User{1BD9AA70-B7FD-479B-B7F9-B827DD9D7ECB}c:\\program files\\free internet tv\\internettv.exe"= TCP:c:\program files\free internet tv\internettv.exe:Free Internet TV
"TCP Query User{CC790F40-F1A4-425E-9896-B90D44EA42DB}c:\\program files\\imesh applications\\imesh\\imesh.exe"= UDP:c:\program files\imesh applications\imesh\imesh.exe:iMesh
"UDP Query User{5FA2CC62-D1E6-48F4-A379-97881541C956}c:\\program files\\imesh applications\\imesh\\imesh.exe"= TCP:c:\program files\imesh applications\imesh\imesh.exe:iMesh
"{8D434BBF-7B9D-4766-95C6-6BB933BFB15D}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"TCP Query User{424FA59B-44ED-4B85-90AA-433062FB3C35}c:\\program files\\steam\\steamapps\\tonikokko\\half-life 2 deathmatch\\hl2.exe"= UDP:c:\program files\steam\steamapps\tonikokko\half-life 2 deathmatch\hl2.exe:hl2
"UDP Query User{3F7F8D91-AF39-4FB4-918E-106C2CDCCC38}c:\\program files\\steam\\steamapps\\tonikokko\\half-life 2 deathmatch\\hl2.exe"= TCP:c:\program files\steam\steamapps\tonikokko\half-life 2 deathmatch\hl2.exe:hl2
"TCP Query User{B96D695D-8CC8-4D07-A5DD-791BD6310D28}c:\\program files\\steam\\steamapps\\tonikokko\\source dedicated server\\srcds.exe"= UDP:c:\program files\steam\steamapps\tonikokko\source dedicated server\srcds.exe:srcds
"UDP Query User{19313382-DAC4-4AA3-8867-F5146EA31C8D}c:\\program files\\steam\\steamapps\\tonikokko\\source dedicated server\\srcds.exe"= TCP:c:\program files\steam\steamapps\tonikokko\source dedicated server\srcds.exe:srcds
"TCP Query User{91DC95F0-E22E-4614-9B14-F6BEAD27C789}c:\\program files\\steam\\steamapps\\tonikokko\\team fortress 2\\hl2.exe"= UDP:c:\program files\steam\steamapps\tonikokko\team fortress 2\hl2.exe:hl2
"UDP Query User{C105F45B-E023-42E8-8B91-3CC995C607C8}c:\\program files\\steam\\steamapps\\tonikokko\\team fortress 2\\hl2.exe"= TCP:c:\program files\steam\steamapps\tonikokko\team fortress 2\hl2.exe:hl2
"TCP Query User{44BB0EE4-F377-469A-B4D6-D80175D9CECA}c:\\program files\\steam\\steamapps\\common\\trackmania nations forever\\tmforever.exe"= UDP:c:\program files\steam\steamapps\common\trackmania nations forever\tmforever.exe:TmForever
"UDP Query User{91B64548-43FD-4AED-B58F-8FBC4770020B}c:\\program files\\steam\\steamapps\\common\\trackmania nations forever\\tmforever.exe"= TCP:c:\program files\steam\steamapps\common\trackmania nations forever\tmforever.exe:TmForever
"TCP Query User{4BC51E23-3733-41AC-9162-923CB1A596DB}c:\\program files\\gamespy arcade\\aphex.exe"= UDP:c:\program files\gamespy arcade\aphex.exe:GameSpy Arcade
"UDP Query User{6C88CB19-9F83-4819-BA76-DC7374CC48B2}c:\\program files\\gamespy arcade\\aphex.exe"= TCP:c:\program files\gamespy arcade\aphex.exe:GameSpy Arcade
"TCP Query User{756DFC95-D7CB-480C-8032-848E784C0710}c:\\program files\\steam\\steamapps\\tonikokko\\day of defeat source\\hl2.exe"= UDP:c:\program files\steam\steamapps\tonikokko\day of defeat source\hl2.exe:hl2
"UDP Query User{0554D116-1219-42FC-9796-E62DB27BBDAE}c:\\program files\\steam\\steamapps\\tonikokko\\day of defeat source\\hl2.exe"= TCP:c:\program files\steam\steamapps\tonikokko\day of defeat source\hl2.exe:hl2
"TCP Query User{79DA9B44-7689-4B4E-8547-36F63DFCC028}c:\\users\\toni kokko\\appdata\\local\\temp\\wzse1.tmp\\symnrt.exe"= UDP:c:\users\toni kokko\appdata\local\temp\wzse1.tmp\symnrt.exe:symnrt.exe
"UDP Query User{C3336B92-104F-40A9-872B-0AAE6917CC4E}c:\\users\\toni kokko\\appdata\\local\\temp\\wzse1.tmp\\symnrt.exe"= TCP:c:\users\toni kokko\appdata\local\temp\wzse1.tmp\symnrt.exe:symnrt.exe
"TCP Query User{3F2C2531-6397-40DC-BBD1-7DE0D99FD42A}c:\\program files\\xchat\\xchat.exe"= UDP:c:\program files\xchat\xchat.exe:XChat IRC Client
"UDP Query User{48B44EDE-07F6-4F3F-9219-93D4073BD322}c:\\program files\\xchat\\xchat.exe"= TCP:c:\program files\xchat\xchat.exe:XChat IRC Client
"TCP Query User{1807DC00-4740-4285-BAEB-7A470FA25F6A}c:\\program files\\steam\\steamapps\\avigga\\source dedicated server\\srcds.exe"= UDP:c:\program files\steam\steamapps\avigga\source dedicated server\srcds.exe:srcds
"UDP Query User{BD3881C9-8577-4878-AE50-71EA1E2F7981}c:\\program files\\steam\\steamapps\\avigga\\source dedicated server\\srcds.exe"= TCP:c:\program files\steam\steamapps\avigga\source dedicated server\srcds.exe:srcds
"TCP Query User{632A9822-2366-4C5F-9946-BCF45217B019}c:\\program files\\swarmplayer\\swarmplayer.exe"= UDP:c:\program files\swarmplayer\swarmplayer.exe:swarmplayer
"UDP Query User{D770F340-9627-4C5A-BC38-EE624EC0EF76}c:\\program files\\swarmplayer\\swarmplayer.exe"= TCP:c:\program files\swarmplayer\swarmplayer.exe:swarmplayer
"TCP Query User{7025C92C-326F-4C80-9A40-235F04872E01}c:\\program files\\mirc\\mirc.exe"= UDP:c:\program files\mirc\mirc.exe:mIRC
"UDP Query User{0B0B6EFB-3F50-4C76-B1BB-5FA2C9C64DBE}c:\\program files\\mirc\\mirc.exe"= TCP:c:\program files\mirc\mirc.exe:mIRC
"{F22F34CA-F474-47F7-833D-8C7E3F512871}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{85F9CF5B-1363-454B-BDA0-88D6D5BCE2BF}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"TCP Query User{D0677DA9-934F-4B03-A63A-71F8AD9CE7F5}c:\\program files\\steam\\steamapps\\avigga\\team fortress 2\\hl2.exe"= UDP:c:\program files\steam\steamapps\avigga\team fortress 2\hl2.exe:hl2
"UDP Query User{C6A4E485-9C63-46C1-9603-D10E6AFC14BB}c:\\program files\\steam\\steamapps\\avigga\\team fortress 2\\hl2.exe"= TCP:c:\program files\steam\steamapps\avigga\team fortress 2\hl2.exe:hl2
"TCP Query User{8BA66BAE-D314-44B6-A811-C5A824532414}c:\\program files\\steam\\steamapps\\avigga\\half-life 2\\hl2.exe"= UDP:c:\program files\steam\steamapps\avigga\half-life 2\hl2.exe:hl2
"UDP Query User{6C2708B7-E72C-41D1-A6DD-E8C1D4D866D5}c:\\program files\\steam\\steamapps\\avigga\\half-life 2\\hl2.exe"= TCP:c:\program files\steam\steamapps\avigga\half-life 2\hl2.exe:hl2
"{C59E32F3-0600-4929-83DD-328BB51CC2C4}"= UDP:c:\program files\World of Warcraft\WoW-2.3.3.7799-to-2.4.0.8089-enGB-downloader.exe:Blizzard Downloader
"{F92C8592-E8E1-4274-ADC1-E04D4EDDA2BB}"= TCP:c:\program files\World of Warcraft\WoW-2.3.3.7799-to-2.4.0.8089-enGB-downloader.exe:Blizzard Downloader
"{228A0F0F-7A6F-4DE6-863A-0C6800D88497}"= UDP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-2.4.3-to-3.0.2-enGB-Win-Final-downloader.exe:Blizzard Downloader
"{A5049911-5EDC-493D-95BF-668F714F538B}"= TCP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-2.4.3-to-3.0.2-enGB-Win-Final-downloader.exe:Blizzard Downloader
"TCP Query User{EFF679D8-A571-41C8-9097-6D009425FFF8}c:\\program files\\world of warcraft\\world of warcraft\\world of warcraft\\repair.exe"= UDP:c:\program files\world of warcraft\world of warcraft\world of warcraft\repair.exe:Blizzard Repair Utility
"UDP Query User{C6DD3040-93B6-4B22-9AA3-AC0041DF3E95}c:\\program files\\world of warcraft\\world of warcraft\\world of warcraft\\repair.exe"= TCP:c:\program files\world of warcraft\world of warcraft\world of warcraft\repair.exe:Blizzard Repair Utility
"{8F16C087-9E09-476E-9653-28B6D03710FB}"= UDP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-3.0.2.9056-to-3.0.3.9183-enGB-downloader.exe:Blizzard Downloader
"{30D23163-90AF-455E-BBFB-2A7A9D8A6950}"= TCP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-3.0.2.9056-to-3.0.3.9183-enGB-downloader.exe:Blizzard Downloader
"{4ED71020-8DAB-461E-A011-FF9054A4F98F}"= UDP:3724:Blizzard Downloader: 3724
"TCP Query User{A48F3969-7B98-4FEF-A123-7729F99FB69C}c:\\users\\toni kokko\\desktop\\lierox_v0.56_pack_1.9\\lierox v0.56 pack 1.9\\lierox.exe"= UDP:c:\users\toni kokko\desktop\lierox_v0.56_pack_1.9\lierox v0.56 pack 1.9\lierox.exe:lierox.exe
"UDP Query User{9FDDD62B-6350-4110-AF53-4737FD530DBF}c:\\users\\toni kokko\\desktop\\lierox_v0.56_pack_1.9\\lierox v0.56 pack 1.9\\lierox.exe"= TCP:c:\users\toni kokko\desktop\lierox_v0.56_pack_1.9\lierox v0.56 pack 1.9\lierox.exe:lierox.exe
"TCP Query User{D5ECF7FC-3CA4-4EBF-94E6-CE7E719C438D}c:\\users\\toni kokko\\desktop\\lierox_v0.56_pack_1.9\\lierox v0.56 pack 1.9\\lierox.exe"= UDP:c:\users\toni kokko\desktop\lierox_v0.56_pack_1.9\lierox v0.56 pack 1.9\lierox.exe:lierox.exe
"UDP Query User{CEC1032E-1DF7-4CF6-B0BD-4B9ECFB8A640}c:\\users\\toni kokko\\desktop\\lierox_v0.56_pack_1.9\\lierox v0.56 pack 1.9\\lierox.exe"= TCP:c:\users\toni kokko\desktop\lierox_v0.56_pack_1.9\lierox v0.56 pack 1.9\lierox.exe:lierox.exe
"{77FAE065-C5AB-4851-A183-EE612AF46CC8}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{25634C9B-2C05-450D-B0AA-03952E3E3D3D}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{66E0E986-796C-4553-8F29-3580DF0903B8}"= UDP:c:\program files\Malwarebytes' Anti-Malware\mbam.exe:Malwarebytes' Anti-Malware
"{A052AC37-EA62-4011-B0FD-D1A0946168DA}"= TCP:c:\program files\Malwarebytes' Anti-Malware\mbam.exe:Malwarebytes' Anti-Malware
"TCP Query User{C415CF1E-6660-4D46-80CE-899F0502C701}c:\\program files\\emule\\emule.exe"= Disabled:UDP:c:\program files\emule\emule.exe:eMule
"UDP Query User{BCA21BF4-4166-4BB1-B95C-DA5C6CFDA864}c:\\program files\\emule\\emule.exe"= Disabled:TCP:c:\program files\emule\emule.exe:eMule
"TCP Query User{26751923-DEFB-4A76-B360-5EE6BD2F1E8C}c:\\program files\\imesh applications\\imesh\\imesh.exe"= Disabled:UDP:c:\program files\imesh applications\imesh\imesh.exe:iMesh
"UDP Query User{19B221A2-173E-4CE8-A4F5-DAD2A22BA0C5}c:\\program files\\imesh applications\\imesh\\imesh.exe"= Disabled:TCP:c:\program files\imesh applications\imesh\imesh.exe:iMesh
"{4A3E76A5-F956-422C-A8B5-78D8DCE2B678}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{42161E04-D772-488E-A978-0F12110F6EF8}"= UDP:c:\users\Toni Kokko\AppData\Local\Temp\WZSE0.TMP\SymNRT.exe:Norton Removal Tool
"{C468BB28-F1EE-41BE-ADB4-0BCE04554273}"= TCP:c:\users\Toni Kokko\AppData\Local\Temp\WZSE0.TMP\SymNRT.exe:Norton Removal Tool
"{633A8E51-2411-4FDE-B3CC-9DC01825D5C2}"= UDP:c:\windows\System32\WindowsAnytimeUpgrade.exe:Windows Anytime Upgrade
"{2C14C3C3-87EE-41D3-A496-4AA3D1483D3F}"= TCP:c:\windows\System32\WindowsAnytimeUpgrade.exe:Windows Anytime Upgrade

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\BitTorrent\\bittorrent.exe"= c:\program files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent
"c:\\Program Files\\xchat\\xchat.exe"= c:\program files\xchat\xchat.exe:*:Enabled:XChat IRC Client

R2 BWH32S;BWH32S;"c:\program files\BUFFALO\clientmgrv\bin\BWH32S.exe" [2008-10-07 57912]
R2 Ndiskio;Ndiskio;\??\c:\program files\Norman\Nse\bin\NDISKIO.SYS [2007-09-30 20448]
R2 NVOY;Norman's Very Own supplY of resources;"c:\program files\Norman\npm\bin\nvoy.exe" [2008-03-24 121912]
R3 nsesvc;Norman Scanner Engine Service;"c:\program files\Norman\nse\bin\NSESVC.EXE" -daemon [2008-06-26 322616]
R3 NvcMFlt;NvcMFlt;c:\windows\system32\DRIVERS\nvcv32mf.sys [2008-09-04 19512]
R3 nvcoas;Norman Virus Control on-access component;"c:\program files\Norman\Nvc\bin\nvcoas.exe" [2008-03-24 191544]
R3 NVCScheduler;Norman Virus Control Scheduler;"c:\program files\Norman\Npm\bin\NVCSCHED.EXE" [2008-03-24 154680]
R3 WLIU2KG125S;BUFFALO WLI-U2-KG125S Wireless LAN Adapter Driver;c:\windows\system32\DRIVERS\usb8023.sys [2008-05-24 15872]
S3 Bufeap;BUFFALO EAP Driver;c:\windows\system32\DRIVERS\bufeap.sys [2008-10-07 14848]
S3 netr73;RT73 USB Wireless LAN Card Driver for Vista;c:\windows\system32\DRIVERS\netr73.sys [2007-05-11 329728]
S3 StickCap;Digital TV DVB-T USB Stick adapter service;c:\windows\system32\Drivers\stickcap.sys [2008-10-22 15744]
S3 stickload;Digital TV stick firmware loader service;c:\windows\system32\DRIVERS\stickload.sys [2008-10-22 17024]
S4 Automaattinen LiveUpdate-ajastustoiminto;Automaattinen LiveUpdate-ajastustoiminto;"c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\shell\AutoRun\command - G:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{222a7df5-b2c2-11dc-9225-001b247c1e44}]
\shell\AutoRun\command - E:\Setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7c0e6525-c9f4-11dd-9cb1-001601cfc4c2}]
\shell\AutoRun\command - G:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{96238bad-7562-11dc-93fe-001b247c1e44}]
\shell\AutoRun\command - E:\setup.exe /autorun
\shell\directx\command - e:\directx\dxsetup.exe
\shell\setup\command - E:\setup.exe

*Newly Created Service* - MBAMSWISSARMY
.
'Ajoitetut tehtävät'-kansion sisältö

2008-12-15 c:\windows\Tasks\GoogleUpdateTaskUser.job
- c:\users\Toni Kokko\AppData\Local\Google\Update\GoogleUpdate.exe [2008-12-15 21:39]

2008-12-15 c:\windows\Tasks\User_Feed_Synchronization-{C68C7EA6-5ACB-42EA-BD75-B52875D630F3}.job
- c:\windows\system32\msfeedssync.exe [2008-01-18 22:33]
.
- - - - POISTETUT JÄMÄRIVIT - - - -

MSConfigStartUp-ArcSoft Connection Service - c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
MSConfigStartUp-SweetIM - c:\program files\Macrogaming\SweetIM\SweetIM.exe



**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-15 22:22:33
Windows 6.0.6001 Service Pack 1 NTFS

tarkistaa piilotettuja prosesseja ...

tarkistaa piilotettuja käynnistysarvoja ...

tarkistaa piilotettuja tiedostoja ...

tarkistus on valmis
piilotetut tiedostot: 0

**************************************************************************
.
--------------------- Prosesseihin ladatut DLLt ---------------------

- - - - - - - > 'Explorer.exe'(2360)
c:\program files\Norman\nvc\bin\Niphk.dll
.
Valmistumisajankohta: 2008-12-15 22:29:46
ComboFix-quarantined-files.txt 2008-12-15 20:29:38

Ennen ajoa: 39 070 318 592 tavua vapaana
Ajon jälkeen: 42,293,612,544 tavua vapaana

402 --- E O F --- 2008-12-15 20:08:06