1. Tämä sivusto käyttää keksejä (cookie). Jatkamalla sivuston käyttämistä hyväksyt keksien käyttämisen. Lue lisää.

HJT-logi täällä on joku........

Viestiketju Virukset ja haittaohjelmat - HijackThis -logit -osiossa. Ketjun avasi tonikokko 09.12.2008.

Sivu 3 / 4
  1. Hujo

    Hujo Guest

    Avaa Muistio ja kopioi/liitä lainauksen sisältö sinne:

    Tallenna se nimellä CFScript.txt

    Sitten raahaa CFScript ComboFix.exeen kuten alla.
    [​IMG]

    Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.

    =================

    Luo poistolista:
    • Avaa HiJackThis
    • Klikkaa "Configure" valintaa oikealla alhaalla
    • Klikkaa "Misc Tools"
    • Klikkaa boxia joka sanoo "Uninstall Manager"
    • Klikkaa valintaa "Save list"
    • Kopioi ja liitä kyseinen lista muistiosta ketjuusi
     
    Hujo, 15.12.2008
    #41
  2.  
  3. tonikokko

    tonikokko Regular member

    Liittynyt:
    09.12.2008
    Viestejä:
    109
    Kiitokset:
    0
    Pisteet:
    26
    Tässä on Combofix logi.

    ComboFix 08-12-15.01 - Toni Kokko 2008-12-16 16:00:02.2 - NTFSx86
    Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1035.18.1982.1006 [GMT 2:00]
    Sijainti: c:\users\Toni Kokko\Desktop\ComboFix.exe
    Käytetyt komentorivivalitsimet :: c:\users\Toni Kokko\Desktop\CFScript.txt
    * Uusi palautuspiste luotu
    * Resident AV is active

    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\$AVG8.VAULT$
    c:\$avg8.vault$\V_00000001.fil
    c:\$avg8.vault$\V_00000002.fil
    c:\$avg8.vault$\V_00000003.fil
    c:\$avg8.vault$\V_00000004.fil
    c:\$avg8.vault$\V_00000005.fil
    c:\$avg8.vault$\V_00000006.fil
    c:\$avg8.vault$\vvfolder.idx
    c:\program files\Common Files\Symantec Shared
    c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll
    c:\program files\SUPERAntiSpyware
    c:\programdata\avg8
    c:\programdata\avg8\Cfg\krnl.cfg
    c:\programdata\avg8\Cfg\mail.cfg
    c:\programdata\avg8\Cfg\scan.cfg
    c:\programdata\avg8\Cfg\sched.cfg
    c:\programdata\avg8\Cfg\update.cfg
    c:\programdata\avg8\Cfg\user.cfg
    c:\programdata\avg8\Log\avgcfg.log.lock
    c:\programdata\avg8\Log\avgcore.log
    c:\programdata\avg8\Log\avgcore.log.1
    c:\programdata\avg8\Log\avgcore.log.2
    c:\programdata\avg8\Log\avgcore.log.3
    c:\programdata\avg8\Log\avgcore.log.4
    c:\programdata\avg8\Log\avgcore.log.5
    c:\programdata\avg8\Log\avgcore.log.6
    c:\programdata\avg8\Log\avgcore.log.lock
    c:\programdata\avg8\Log\avglng.log
    c:\programdata\avg8\Log\avglng.log.lock
    c:\programdata\avg8\Log\avgrs.log
    c:\programdata\avg8\Log\avgrs.log.lock
    c:\programdata\avg8\Log\avgscan.log
    c:\programdata\avg8\Log\avgscan.log.lock
    c:\programdata\avg8\Log\avgsched.log.lock
    c:\programdata\avg8\Log\avgsrm.log
    c:\programdata\avg8\Log\avgsrm.log.lock
    c:\programdata\avg8\Log\avgui.log
    c:\programdata\avg8\Log\avgui.log.lock
    c:\programdata\avg8\Log\avgupd.log
    c:\programdata\avg8\Log\avgupd.log.lock
    c:\programdata\avg8\Log\avgwd.log.lock
    c:\programdata\avg8\Log\avgwdsvc.log
    c:\programdata\avg8\Log\avgwdsvc.log.lock
    c:\programdata\avg8\Log\avildr.log
    c:\programdata\avg8\Log\commonpriv.log
    c:\programdata\avg8\Log\commonpriv.log.lock
    c:\programdata\avg8\Log\history.xml
    c:\programdata\avg8\scanlogs\I_00000001.log
    c:\programdata\avg8\scanlogs\I_00000005.log
    c:\programdata\avg8\scanlogs\I_00000006.log
    c:\programdata\avg8\scanlogs\I_00000007.log
    c:\programdata\avg8\scanlogs\I_00000008.log
    c:\programdata\avg8\scanlogs\I_00000009.log
    c:\programdata\avg8\scanlogs\I_00000010.log
    c:\programdata\avg8\scanlogs\I_00000011.log
    c:\programdata\avg8\scanlogs\I_00000012.log
    c:\programdata\avg8\scanlogs\srm.idx
    c:\programdata\avg8\update\backup\incavi.avm
    c:\programdata\avg8\update\backup\microavi.avg
    c:\programdata\avg8\update\backup\sb2.dat
    c:\programdata\avg8\update\backup\sc.dat
    c:\programdata\avg8\update\prepare\sc.dat.prepare
    c:\programdata\Grisoft
    c:\programdata\Grisoft\AVG Anti-Spyware 7.5\Downloads\help.dll
    c:\programdata\SUPERAntiSpyware.com
    c:\programdata\Symantec
    c:\programdata\Symantec\ErrLogs\{830D8CBD-C668-49e2-A969-C2C2106332E0}18f726fd.zip
    c:\programdata\Symantec\ErrLogs\{830D8CBD-C668-49e2-A969-C2C2106332E0}1e46ccf9.zip
    c:\programdata\Symantec\ErrLogs\{830D8CBD-C668-49e2-A969-C2C2106332E0}77ef3ed6.zip
    c:\programdata\Symantec\ErrLogs\{830D8CBD-C668-49e2-A969-C2C2106332E0}cea97e10.zip
    c:\programdata\Symantec\ErrLogs\{830D8CBD-C668-49e2-A969-C2C2106332E0}d31c070.zip
    c:\programdata\Symantec\ErrLogs\{830D8CBD-C668-49e2-A969-C2C2106332E0}ecdfe384.zip
    c:\programdata\Symantec\ErrLogs\{830D8CBD-C668-49e2-A969-C2C2106332E0}fd71ca00.zip
    c:\users\All Users\avg8\Cfg\krnl.cfg
    c:\users\All Users\avg8\Cfg\mail.cfg
    c:\users\All Users\avg8\Cfg\scan.cfg
    c:\users\All Users\avg8\Cfg\sched.cfg
    c:\users\All Users\avg8\Cfg\update.cfg
    c:\users\All Users\avg8\Cfg\user.cfg
    c:\users\All Users\avg8\Log\avgcfg.log.lock
    c:\users\All Users\avg8\Log\avgcore.log
    c:\users\All Users\avg8\Log\avgcore.log.1
    c:\users\All Users\avg8\Log\avgcore.log.2
    c:\users\All Users\avg8\Log\avgcore.log.3
    c:\users\All Users\avg8\Log\avgcore.log.4
    c:\users\All Users\avg8\Log\avgcore.log.5
    c:\users\All Users\avg8\Log\avgcore.log.6
    c:\users\All Users\avg8\Log\avgcore.log.lock
    c:\users\All Users\avg8\Log\avglng.log
    c:\users\All Users\avg8\Log\avglng.log.lock
    c:\users\All Users\avg8\Log\avgrs.log
    c:\users\All Users\avg8\Log\avgrs.log.lock
    c:\users\All Users\avg8\Log\avgscan.log
    c:\users\All Users\avg8\Log\avgscan.log.lock
    c:\users\All Users\avg8\Log\avgsched.log.lock
    c:\users\All Users\avg8\Log\avgsrm.log
    c:\users\All Users\avg8\Log\avgsrm.log.lock
    c:\users\All Users\avg8\Log\avgui.log
    c:\users\All Users\avg8\Log\avgui.log.lock
    c:\users\All Users\avg8\Log\avgupd.log
    c:\users\All Users\avg8\Log\avgupd.log.lock
    c:\users\All Users\avg8\Log\avgwd.log.lock
    c:\users\All Users\avg8\Log\avgwdsvc.log
    c:\users\All Users\avg8\Log\avgwdsvc.log.lock
    c:\users\All Users\avg8\Log\avildr.log
    c:\users\All Users\avg8\Log\commonpriv.log
    c:\users\All Users\avg8\Log\commonpriv.log.lock
    c:\users\All Users\avg8\Log\history.xml
    c:\users\All Users\avg8\scanlogs\I_00000001.log
    c:\users\All Users\avg8\scanlogs\I_00000005.log
    c:\users\All Users\avg8\scanlogs\I_00000006.log
    c:\users\All Users\avg8\scanlogs\I_00000007.log
    c:\users\All Users\avg8\scanlogs\I_00000008.log
    c:\users\All Users\avg8\scanlogs\I_00000009.log
    c:\users\All Users\avg8\scanlogs\I_00000010.log
    c:\users\All Users\avg8\scanlogs\I_00000011.log
    c:\users\All Users\avg8\scanlogs\I_00000012.log
    c:\users\All Users\avg8\scanlogs\srm.idx
    c:\users\All Users\avg8\update\backup\incavi.avm
    c:\users\All Users\avg8\update\backup\microavi.avg
    c:\users\All Users\avg8\update\backup\sb2.dat
    c:\users\All Users\avg8\update\backup\sc.dat
    c:\users\All Users\avg8\update\prepare\sc.dat.prepare
    c:\users\All Users\Grisoft\AVG Anti-Spyware 7.5\Downloads\help.dll
    c:\users\Toni Kokko\AppData\Roaming\SUPERAntiSpyware.com

    .
    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-11-16 to 2008-12-16 )))))))))))))))))
    .

    2008-12-14 20:48 . 2008-12-14 20:48 <KANSIO> d-------- c:\program files\Java
    2008-12-14 20:48 . 2008-12-14 20:48 410,984 --a------ c:\windows\System32\deploytk.dll
    2008-12-14 17:41 . 2008-12-14 17:42 <KANSIO> d-------- c:\users\Toni Kokko\AppData\Roaming\U3
    2008-12-11 23:08 . 2008-12-14 17:56 <KANSIO> d-------- c:\users\Toni Kokko\.SunDownloadManager
    2008-12-11 22:37 . 2008-12-11 22:37 42,320 --a------ c:\windows\System32\xfcodec.dll
    2008-12-11 15:00 . 2008-12-11 15:00 249,592 --a------ c:\windows\System32\cssdll32.dll
    2008-12-11 14:56 . 2008-12-14 20:24 <KANSIO> d-------- c:\users\Toni Kokko\AppData\Roaming\Comodo
    2008-12-11 14:55 . 2008-12-14 20:24 <KANSIO> d-------- c:\users\All Users\comodo
    2008-12-11 14:55 . 2008-12-14 20:24 <KANSIO> d-------- c:\programdata\comodo
    2008-12-11 14:55 . 2008-12-14 20:24 <KANSIO> d-------- c:\program files\COMODO
    2008-12-10 23:23 . 2008-12-10 23:23 <KANSIO> d-------- c:\users\Toni Kokko\AppData\Roaming\ImgBurn
    2008-12-10 23:19 . 2008-12-10 23:19 <KANSIO> d-------- c:\program files\ImgBurn
    2008-12-10 20:52 . 2008-12-10 20:52 <KANSIO> d-------- c:\temp\Windows XP Professional (English)
    2008-12-10 16:01 . 2008-10-22 03:22 2,048 --a------ c:\windows\System32\tzres.dll
    2008-12-09 21:05 . 2008-12-09 21:05 <KANSIO> d-------- c:\program files\Trend Micro
    2008-12-08 18:53 . 2008-12-08 18:53 <KANSIO> d-------- c:\users\All Users\Kaspersky Lab Setup Files
    2008-12-08 18:53 . 2008-12-08 18:53 <KANSIO> d-------- c:\programdata\Kaspersky Lab Setup Files
    2008-12-07 23:57 . 2008-12-07 23:57 <KANSIO> d-------- c:\windows\Sun
    2008-12-02 21:43 . 2008-12-02 21:43 <KANSIO> d-------- c:\users\Toni Kokko\AppData\Roaming\Malwarebytes
    2008-12-02 21:43 . 2008-12-02 21:43 <KANSIO> d-------- c:\users\All Users\Malwarebytes
    2008-12-02 21:43 . 2008-12-02 21:43 <KANSIO> d-------- c:\programdata\Malwarebytes
    2008-12-02 21:43 . 2008-12-14 22:54 <KANSIO> d-------- c:\program files\Malwarebytes' Anti-Malware
    2008-12-02 21:43 . 2008-12-03 19:52 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys
    2008-12-02 21:43 . 2008-12-03 19:52 15,504 --a------ c:\windows\System32\drivers\mbam.sys
    2008-11-26 19:39 . 2008-10-21 07:25 1,645,568 --a------ c:\windows\System32\connect.dll
    2008-11-26 19:39 . 2008-08-28 05:40 712,704 --a------ c:\windows\System32\WindowsCodecs.dll
    2008-11-26 19:39 . 2008-08-28 05:40 425,472 --a------ c:\windows\System32\PhotoMetadataHandler.dll
    2008-11-26 19:39 . 2008-08-28 05:40 347,136 --a------ c:\windows\System32\WindowsCodecsExt.dll
    2008-11-26 19:39 . 2008-10-22 05:57 241,152 --a------ c:\windows\System32\PortableDeviceApi.dll
    2008-11-24 22:36 . 2008-11-24 22:37 <KANSIO> d-------- c:\users\All Users\Lavasoft
    2008-11-24 22:36 . 2008-11-24 22:37 <KANSIO> d-------- c:\programdata\Lavasoft
    2008-11-24 22:36 . 2008-11-24 22:36 <KANSIO> d-------- c:\program files\Lavasoft
    2008-11-24 22:35 . 2008-12-10 18:41 <KANSIO> d-------- c:\program files\Common Files\Wise Installation Wizard
    2008-11-23 22:44 . 2008-11-23 22:44 <KANSIO> dr------- c:\windows\System32\config\systemprofile\Videos
    2008-11-23 22:44 . 2008-11-23 22:44 <KANSIO> dr------- c:\windows\System32\config\systemprofile\Pictures
    2008-11-23 22:44 . 2008-11-23 22:44 <KANSIO> dr------- c:\windows\System32\config\systemprofile\Downloads
    2008-11-23 22:44 . 2008-11-23 22:44 <KANSIO> dr------- c:\windows\System32\config\systemprofile\Documents
    2008-11-23 20:15 . 2008-11-23 20:15 52,736 --a------ c:\windows\ipuninst.exe
    2008-11-23 19:50 . 2008-11-23 19:50 <KANSIO> d-------- c:\program files\Alcohol Soft
    2008-11-17 16:27 . 2008-11-17 16:27 <KANSIO> d-------- c:\program files\CCleaner

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-12-16 09:14 28,314 ----a-w c:\users\Toni Kokko\AppData\Roaming\nvModes.dat
    2008-12-16 09:05 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\Xfire
    2008-12-16 09:05 --------- d-----w c:\programdata\Xfire
    2008-12-16 09:05 --------- d-----w c:\program files\Xfire
    2008-12-16 09:02 --------- d-----w c:\program files\Steam
    2008-12-15 05:12 --------- d-----w c:\program files\World of Warcraft
    2008-12-14 20:19 --------- d-----w c:\program files\Norman
    2008-12-14 18:21 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\uTorrent
    2008-12-14 18:05 --------- d--h--w c:\program files\InstallShield Installation Information
    2008-12-14 16:33 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\mIRC
    2008-12-10 14:50 --------- d-----w c:\program files\Windows Mail
    2008-12-10 13:35 --------- d-----w c:\program files\mIRC
    2008-12-08 07:23 --------- d-----w c:\program files\MSN Messenger
    2008-12-07 17:31 --------- d-----w c:\program files\RevConnect
    2008-12-03 20:31 --------- d-----w c:\program files\WhatPulse
    2008-11-24 09:59 --------- d-----w c:\program files\Google
    2008-11-23 21:22 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\BSplayer
    2008-11-23 21:22 --------- d-----w c:\program files\Webteh
    2008-11-23 20:27 --------- d-----w c:\programdata\Team MediaPortal
    2008-11-23 20:27 --------- d-----w c:\program files\Team MediaPortal
    2008-11-23 19:15 --------- d-----w c:\program files\Common Files\ArcSoft
    2008-11-23 17:18 717,296 ----a-w c:\windows\system32\drivers\sptd.sys
    2008-11-22 18:33 --------- d-----w c:\program files\SystemRequirementsLab
    2008-11-22 18:31 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\SystemRequirementsLab
    2008-11-15 20:11 --------- d-----w c:\program files\Common Files\Steam
    2008-11-13 16:21 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\Skype
    2008-11-03 14:00 --------- d-----w c:\programdata\Blizzard
    2008-11-02 18:36 --------- d-----w c:\program files\Common Files\Blizzard Entertainment
    2008-11-01 19:22 --------- d-----w c:\programdata\ArcSoft
    2008-11-01 16:15 --------- d-----w c:\program files\Microsoft SQL Server
    2008-11-01 07:40 30 ----a-w c:\users\Toni Kokko\jagex_runescape_preferences.dat
    2008-11-01 03:44 541,696 ----a-w c:\windows\AppPatch\AcLayers.dll
    2008-11-01 03:44 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll
    2008-11-01 03:44 460,288 ----a-w c:\windows\AppPatch\AcSpecfc.dll
    2008-11-01 03:44 28,672 ----a-w c:\windows\System32\Apphlpdm.dll
    2008-11-01 03:44 2,154,496 ----a-w c:\windows\AppPatch\AcGenral.dll
    2008-11-01 03:44 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll
    2008-11-01 01:21 4,240,384 ----a-w c:\windows\System32\GameUXLegacyGDFs.dll
    2008-10-31 20:12 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\Ventrilo
    2008-10-31 19:17 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\ArcSoft
    2008-10-31 16:40 --------- d-----w c:\program files\mpgconv
    2008-10-31 16:12 --------- d-----w c:\program files\Microsoft.NET
    2008-10-31 15:08 --------- d-----w c:\program files\ProgDVB
    2008-10-29 06:29 2,927,104 ----a-w c:\windows\explorer.exe
    2008-10-22 15:44 --------- d-----w c:\program files\Microsoft Silverlight
    2008-10-21 05:25 296,960 ----a-w c:\windows\System32\gdi32.dll
    2008-10-20 13:27 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\fretsonfire
    2008-10-17 17:20 --------- d-----w c:\program files\uTorrent
    2008-10-17 11:15 --------- d-----w c:\program files\xchat
    2008-10-17 11:14 --------- d-----w c:\program files\Frets on Fire
    2008-10-17 11:10 --------- d-----w c:\program files\Audacity
    2008-10-16 21:13 1,809,944 ----a-w c:\windows\System32\wuaueng.dll
    2008-10-16 21:12 561,688 ----a-w c:\windows\System32\wuapi.dll
    2008-10-16 21:09 51,224 ----a-w c:\windows\System32\wuauclt.exe
    2008-10-16 21:09 43,544 ----a-w c:\windows\System32\wups2.dll
    2008-10-16 21:08 34,328 ----a-w c:\windows\System32\wups.dll
    2008-10-16 20:56 1,524,736 ----a-w c:\windows\System32\wucltux.dll
    2008-10-16 20:55 83,456 ----a-w c:\windows\System32\wudriver.dll
    2008-10-16 12:08 162,064 ----a-w c:\windows\System32\wuwebv.dll
    2008-10-16 11:56 31,232 ----a-w c:\windows\System32\wuapp.exe
    2008-10-16 04:47 827,392 ----a-w c:\windows\System32\wininet.dll
    2008-10-09 16:54 28,672 ----a-w c:\windows\System32\AF15BDAEX.dll
    2008-09-30 14:43 1,286,152 ----a-w c:\windows\System32\msxml4.dll
    2008-09-18 05:09 3,601,464 ----a-w c:\windows\System32\ntkrnlpa.exe
    2008-09-18 05:09 3,549,240 ----a-w c:\windows\System32\ntoskrnl.exe
    2008-09-18 04:56 147,456 ----a-w c:\windows\System32\Faultrep.dll
    2008-09-18 04:56 125,952 ----a-w c:\windows\System32\wersvc.dll
    2008-09-18 02:16 2,032,640 ----a-w c:\windows\System32\win32k.sys
    2008-05-24 06:35 174 --sha-w c:\program files\desktop.ini
    2007-11-12 15:12 856 ----a-w c:\users\Toni Kokko\AppData\Roaming\wklnhst.dat
    2005-07-05 14:47 777 ----a-w c:\program files\trial_setup.ini
    2005-07-05 14:47 5,133,312 ----a-w c:\program files\trial_setup.msi
    2005-07-05 14:47 40,448 ----a-w c:\program files\trial_setup.exe
    2007-10-28 17:48 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    2007-10-28 17:48 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    2007-10-28 17:48 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    2007-08-30 15:12 16 --sha-w c:\windows\SMINST\HPCD.sys
    .

    ((((((((((((((((((((((((((((( snapshot@2008-12-15_22.23.28,00 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2008-12-15 17:36:07 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
    + 2008-12-15 20:22:47 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
    + 2008-12-15 20:22:47 262,144 ---ha-w c:\windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
    - 2008-12-15 14:21:23 489,176 ----a-w c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
    + 2008-12-16 13:07:15 492,322 ----a-w c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
    .
    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-18 1233920]
    "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-18 125952]
    "msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]
    "Google Update"="c:\users\Toni Kokko\AppData\Local\Google\Update\GoogleUpdate.exe" [2008-12-15 133104]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-28 1045800]
    "QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-04-23 176128]
    "QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-02-13 159744]
    "HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-03-12 50696]
    "hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776]
    "WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]
    "Norman ZANDA"="c:\program files\Norman\Npm\Bin\ZLH.EXE" [2008-06-02 277616]
    "NvSvc"="c:\windows\system32\nvsvc.dll" [2007-11-07 86016]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-11-07 8534560]
    "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-11-07 81920]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-14 136600]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
    "Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-07 44128]

    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    ClientManagerV.lnk - c:\program files\BUFFALO\clientmgrv\bin\cmvMain.exe [2008-10-07 138808]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableUIADesktopToggle"= 0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "vidc.ffds"= c:\program files\ffdshow\ffdshow.ax
    "VIDC.XFR1"= xfcodec.dll

    [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
    path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
    backup=c:\windows\pss\Adobe Gamma Loader.lnk.CommonStartup
    backupExtension=.CommonStartup

    [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^TMMonitor.lnk]
    path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\TMMonitor.lnk
    backup=c:\windows\pss\TMMonitor.lnk.CommonStartup
    backupExtension=.CommonStartup

    [HKLM\~\startupfolder\C:^Users^Toni Kokko^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Xfire.lnk]
    path=c:\users\Toni Kokko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xfire.lnk
    backup=c:\windows\pss\Xfire.lnk.Startup
    backupExtension=.Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
    --a------ 2008-01-11 21:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
    --a------ 2007-01-19 11:55 5674352 c:\program files\MSN Messenger\msnmsgr.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
    --a------ 2006-07-13 23:41 20034600 c:\program files\Skype\Phone\Skype.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhatPulse]
    --a------ 2006-08-21 19:48 665600 c:\program files\WhatPulse\WhatPulse.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
    --a------ 2008-08-04 01:02 36352 c:\program files\Winamp\winampa.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
    "TCP Query User{0E60E5F2-C916-49E0-95D4-2E627F9B6584}c:\\program files\\msn messenger\\msnmsgr.exe"= UDP:c:\program files\msn messenger\msnmsgr.exe:Messenger
    "UDP Query User{4C2E6A0D-F273-4BDA-83C8-F765026B7793}c:\\program files\\msn messenger\\msnmsgr.exe"= TCP:c:\program files\msn messenger\msnmsgr.exe:Messenger
    "{D544B387-58C0-408C-A260-FD2D4E311490}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2main.exe:Neverwinter Nights 2 Main
    "{8EA83D06-8F05-4EF9-80CA-755B77E5AFF8}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2main.exe:Neverwinter Nights 2 Main
    "{AFD50BC0-ADB8-48FD-89BA-EB04869FB04A}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2main_amdxp.exe:Neverwinter Nights 2 AMD
    "{BE23AB97-F9AB-4DE6-A39D-6E559FC93900}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2main_amdxp.exe:Neverwinter Nights 2 AMD
    "{D66B4CF5-C554-4AEB-A86E-AD7DB85A46A8}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwupdate.exe:Neverwinter Nights 2 Updater
    "{CE2B4A9D-8D3E-493A-85E2-75A59E58922D}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwupdate.exe:Neverwinter Nights 2 Updater
    "{9963DB7F-22C2-473D-9917-DC1D1E408B72}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2server.exe:Neverwinter Nights 2 Server
    "{244AD98B-9023-47F0-AD1E-29BC7685E96A}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2server.exe:Neverwinter Nights 2 Server
    "TCP Query User{F489A6A9-FE85-4FA6-85CF-E59E6DAF3156}c:\\program files\\xfire\\xfire.exe"= UDP:c:\program files\xfire\xfire.exe:Xfire
    "UDP Query User{7D9956B7-71D1-4FC4-9CE6-832F85DAB2F3}c:\\program files\\xfire\\xfire.exe"= TCP:c:\program files\xfire\xfire.exe:Xfire
    "TCP Query User{C1771924-088B-4479-9E4F-08E43FFECB97}c:\\program files\\msn messenger\\livecall.exe"= UDP:c:\program files\msn messenger\livecall.exe:Windows Live Call
    "UDP Query User{F792272E-B764-4CFD-B2F1-C8B157A42A87}c:\\program files\\msn messenger\\livecall.exe"= TCP:c:\program files\msn messenger\livecall.exe:Windows Live Call
    "TCP Query User{FF66BB09-91AA-4DE6-AF98-A53FD47C99A4}c:\\program files\\emule\\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule
    "UDP Query User{331EAEE3-D7AB-4DFB-B4A2-144FCF3159A8}c:\\program files\\emule\\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule
    "TCP Query User{9A954996-511F-4135-8468-ECB0BCE6021C}c:\\users\\toni kokko\\desktop\\nes\\nestc042\\nestcl95.exe"= UDP:c:\users\toni kokko\desktop\nes\nestc042\nestcl95.exe:nestcl95.exe
    "UDP Query User{F76BA4B4-2BB9-409B-AE4E-4EB7BB4117F2}c:\\users\\toni kokko\\desktop\\nes\\nestc042\\nestcl95.exe"= TCP:c:\users\toni kokko\desktop\nes\nestc042\nestcl95.exe:nestcl95.exe
    "TCP Query User{CCCA7D9E-957F-41C2-9E95-BF5A9D165A8B}c:\\users\\toni kokko\\desktop\\utorrent.exe"= UDP:c:\users\toni kokko\desktop\utorrent.exe:utorrent.exe
    "UDP Query User{A5D6125A-F900-48E3-B961-6D3FEC8C95E5}c:\\users\\toni kokko\\desktop\\utorrent.exe"= TCP:c:\users\toni kokko\desktop\utorrent.exe:utorrent.exe
    "TCP Query User{74C37976-832D-4749-804A-AD0500E05A5A}c:\\neverwinternights\\nwn\\nwmain.exe"= UDP:c:\neverwinternights\nwn\nwmain.exe:Neverwinter Nights
    "UDP Query User{800E3D01-47D1-4313-BFD1-B33D07152FC3}c:\\neverwinternights\\nwn\\nwmain.exe"= TCP:c:\neverwinternights\nwn\nwmain.exe:Neverwinter Nights
    "TCP Query User{E34D9D43-0DBD-438C-9399-F8EFF49FE563}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox
    "UDP Query User{5801BA1E-24E1-4DAA-B511-AFB0979D09E9}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox
    "{4DEA1078-B4EF-46F8-8AE7-B438930E46EF}"= UDP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent
    "{FDBCB264-4CDB-4991-AD93-DE1FADBEE8BF}"= TCP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent
    "TCP Query User{450ACF7E-B1DD-4791-8D62-03446A1DCE2A}c:\\program files\\byond\\bin\\byond.exe"= UDP:c:\program files\byond\bin\byond.exe:byond
    "UDP Query User{D1B4E27F-BC0E-4084-A91F-84E9117CC3A0}c:\\program files\\byond\\bin\\byond.exe"= TCP:c:\program files\byond\bin\byond.exe:byond
    "TCP Query User{30F015A4-F3E8-4A45-BAA0-C14ACA1208CB}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:uTorrent
    "UDP Query User{DB869AB6-C57A-45A4-9C81-A6635D2B3780}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:uTorrent
    "TCP Query User{6D1C176D-F5CB-4456-9837-7333E5D352A9}c:\\program files\\counter-strike 1.6\\hl.exe"= UDP:c:\program files\counter-strike 1.6\hl.exe:Half-Life Launcher
    "UDP Query User{0F745B67-F537-4EAD-B14E-6597D2C8D17E}c:\\program files\\counter-strike 1.6\\hl.exe"= TCP:c:\program files\counter-strike 1.6\hl.exe:Half-Life Launcher
    "TCP Query User{D677DB5E-40A0-43E1-8D41-7D2419599383}c:\\program files\\ea games\\medal of honor pacific assault(tm) mpdemo2\\mohpa_mpdemo.exe"= UDP:c:\program files\ea games\medal of honor pacific assault(tm) mpdemo2\mohpa_mpdemo.exe:Medal of Honor Pacific Assault(tm)
    "UDP Query User{458AC2B1-2FAC-4B4B-84F5-583EB41A645D}c:\\program files\\ea games\\medal of honor pacific assault(tm) mpdemo2\\mohpa_mpdemo.exe"= TCP:c:\program files\ea games\medal of honor pacific assault(tm) mpdemo2\mohpa_mpdemo.exe:Medal of Honor Pacific Assault(tm)
    "TCP Query User{5EFC87C6-F824-46C0-B522-289B9521117F}c:\\program files\\ea games\\medal of honor pacific assault(tm) mpdemo2\\mohpa_mpdemo_server.exe"= UDP:c:\program files\ea games\medal of honor pacific assault(tm) mpdemo2\mohpa_mpdemo_server.exe:Medal of Honor Pacific Assault(tm)
    "UDP Query User{5170532E-4D95-4AC3-8CB3-43BDD42DF486}c:\\program files\\ea games\\medal of honor pacific assault(tm) mpdemo2\\mohpa_mpdemo_server.exe"= TCP:c:\program files\ea games\medal of honor pacific assault(tm) mpdemo2\mohpa_mpdemo_server.exe:Medal of Honor Pacific Assault(tm)
    "TCP Query User{C3BEF026-E9E6-49AF-8692-82BA32F08404}c:\\program files\\wolfenstein - enemy territory\\et.exe"= UDP:c:\program files\wolfenstein - enemy territory\et.exe:ET
    "UDP Query User{5D2F2AEB-CEDA-4639-A9D0-F0C577D93D08}c:\\program files\\wolfenstein - enemy territory\\et.exe"= TCP:c:\program files\wolfenstein - enemy territory\et.exe:ET
    "TCP Query User{13F890DE-490E-4B0B-A087-A1602366A068}c:\\program files\\wolfenstein - enemy territory\\etded.exe"= UDP:c:\program files\wolfenstein - enemy territory\etded.exe:ETDED
    "UDP Query User{B91B82C8-9DF3-4DD9-944C-FE795C320114}c:\\program files\\wolfenstein - enemy territory\\etded.exe"= TCP:c:\program files\wolfenstein - enemy territory\etded.exe:ETDED
    "{28350A57-E35F-4F9C-B726-7B3C68A588E3}"= UDP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-2.3.0.7561-to-2.3.2.7741-enGB-downloader.exe:Blizzard Downloader
    "{76E61FE2-B81C-4A09-983A-D667AD863C44}"= TCP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-2.3.0.7561-to-2.3.2.7741-enGB-downloader.exe:Blizzard Downloader
    "TCP Query User{6F5B6C21-B17E-4BA6-BACF-63340EF3162E}c:\\program files\\microsoft games\\halo\\halo.exe"= UDP:c:\program files\microsoft games\halo\halo.exe:Halo
    "UDP Query User{47B278DD-D9A1-41DF-BA07-E2CA5916589E}c:\\program files\\microsoft games\\halo\\halo.exe"= TCP:c:\program files\microsoft games\halo\halo.exe:Halo
    "TCP Query User{84C8EEEE-5646-45A6-9B3E-7BB1B421C0B7}c:\\users\\toni kokko\\desktop\\installer-22999-864-counter-strike.exe"= UDP:c:\users\toni kokko\desktop\installer-22999-864-counter-strike.exe:installer-22999-864-counter-strike.exe
    "UDP Query User{96AF4C29-27B9-470A-898F-C74BDE0FA4B5}c:\\users\\toni kokko\\desktop\\installer-22999-864-counter-strike.exe"= TCP:c:\users\toni kokko\desktop\installer-22999-864-counter-strike.exe:installer-22999-864-counter-strike.exe
    "TCP Query User{619080D8-8BD2-43BE-9D6D-20EF595F124B}c:\\program files\\jazz jackrabbit 2\\jazz2.exe"= UDP:c:\program files\jazz jackrabbit 2\jazz2.exe:Jazz Jackrabbit 2
    "UDP Query User{E21B1754-AC24-4590-A3EC-7AD436050300}c:\\program files\\jazz jackrabbit 2\\jazz2.exe"= TCP:c:\program files\jazz jackrabbit 2\jazz2.exe:Jazz Jackrabbit 2
    "{C430DAF0-70C6-4A09-9149-FE39258CC3E7}"= UDP:94:VRS Recording System Web Control Panel
    "{5E1865ED-1E02-40B5-BD48-464808564702}"= TCP:8000:Axon Virtual PBX RTP Incoming Audio (UDP)
    "{48B844C8-8091-454D-A500-3829598B8619}"= TCP:8001:Axon Virtual PBX RTP Incoming Audio (UDP)
    "{D5122966-424E-4973-B4E8-621466F124FA}"= TCP:8002:Axon Virtual PBX RTP Incoming Audio (UDP)
    "{14CA1EB7-06AF-4992-8F33-CA8A2A6907A1}"= TCP:8003:Axon Virtual PBX RTP Incoming Audio (UDP)
    "{07144F0D-652E-4938-A4A6-7AB816714FFA}"= TCP:8004:Axon Virtual PBX RTP Incoming Audio (UDP)
    "{10771593-3459-4E97-946D-393D93FCBD84}"= UDP:81:Axon Virtual PBX Web Server
    "TCP Query User{DC46209A-4D4D-424A-8B56-2D92080081FA}c:\\program files\\condition zero\\hlds.exe"= UDP:c:\program files\condition zero\hlds.exe:HLDS Launcher
    "UDP Query User{34072C27-AA45-49B3-938D-BE4BC547EAA6}c:\\program files\\condition zero\\hlds.exe"= TCP:c:\program files\condition zero\hlds.exe:HLDS Launcher
    "TCP Query User{3C767F74-CB7D-4D9F-8EE2-50E472BA6FA5}c:\\program files\\skype\\phone\\skype.exe"= UDP:c:\program files\skype\phone\skype.exe:Skype. The whole world can talk for free.
    "UDP Query User{DC78D1AA-837C-46A6-96FD-5D6B2A1BBECA}c:\\program files\\skype\\phone\\skype.exe"= TCP:c:\program files\skype\phone\skype.exe:Skype. The whole world can talk for free.
    "TCP Query User{AA2D2F5E-039A-4DD4-885B-C2D14B1A31A2}c:\\program files\\condition zero\\hlds.exe"= UDP:c:\program files\condition zero\hlds.exe:HLDS Launcher
    "UDP Query User{0DBC3F9B-298F-4C44-8502-7B0DAA696F75}c:\\program files\\condition zero\\hlds.exe"= TCP:c:\program files\condition zero\hlds.exe:HLDS Launcher
    "TCP Query User{D7AD1479-5F64-4930-83C8-2927AB9E0F13}c:\\program files\\steam\\steamapps\\tonikokko\\dedicated server\\hlds.exe"= UDP:c:\program files\steam\steamapps\tonikokko\dedicated server\hlds.exe:HLDS Launcher
    "UDP Query User{F3C82F4E-374B-44B6-97CB-56D0293C4BA9}c:\\program files\\steam\\steamapps\\tonikokko\\dedicated server\\hlds.exe"= TCP:c:\program files\steam\steamapps\tonikokko\dedicated server\hlds.exe:HLDS Launcher
    "TCP Query User{1EC6E41B-CDBA-49BF-B50B-42CDDB39E83D}c:\\program files\\css\\hl2.exe"= UDP:c:\program files\css\hl2.exe:hl2
    "UDP Query User{A7391A47-23E6-4F58-ACEC-DD126FFE456F}c:\\program files\\css\\hl2.exe"= TCP:c:\program files\css\hl2.exe:hl2
    "TCP Query User{5B91D1B4-4D0D-4392-B877-7605B8FE1A0C}c:\\program files\\css\\srcds.exe"= UDP:c:\program files\css\srcds.exe:srcds
    "UDP Query User{B0D44996-1DFD-4C13-9FB0-FB239079A96A}c:\\program files\\css\\srcds.exe"= TCP:c:\program files\css\srcds.exe:srcds
    "TCP Query User{A9F96E00-45E6-49C4-A318-F1A387CFC15E}c:\\program files\\steam\\steamapps\\tonikokko\\counter-strike\\hl.exe"= UDP:c:\program files\steam\steamapps\tonikokko\counter-strike\hl.exe:Half-Life Launcher
    "UDP Query User{52B86BB3-139B-41C0-9A76-7E0ACD830A9F}c:\\program files\\steam\\steamapps\\tonikokko\\counter-strike\\hl.exe"= TCP:c:\program files\steam\steamapps\tonikokko\counter-strike\hl.exe:Half-Life Launcher
    "TCP Query User{352C5FB1-A302-4D84-A303-94FC6280B1D8}c:\\program files\\steam\\steamapps\\tonikokko\\condition zero deleted scenes\\hl.exe"= UDP:c:\program files\steam\steamapps\tonikokko\condition zero deleted scenes\hl.exe:Half-Life Launcher
    "UDP Query User{B5482BF4-55AD-420C-A6AB-F7B0D353C806}c:\\program files\\steam\\steamapps\\tonikokko\\condition zero deleted scenes\\hl.exe"= TCP:c:\program files\steam\steamapps\tonikokko\condition zero deleted scenes\hl.exe:Half-Life Launcher
    "TCP Query User{8F8E66C1-9816-4E0E-95E3-78DC8B2BD9FD}c:\\program files\\steam\\steamapps\\tonikokko\\deathmatch classic\\hl.exe"= UDP:c:\program files\steam\steamapps\tonikokko\deathmatch classic\hl.exe:Half-Life Launcher
    "UDP Query User{C4018428-4558-4595-A0C3-49A90D49A7B9}c:\\program files\\steam\\steamapps\\tonikokko\\deathmatch classic\\hl.exe"= TCP:c:\program files\steam\steamapps\tonikokko\deathmatch classic\hl.exe:Half-Life Launcher
    "TCP Query User{DCFA1FCE-D408-47CD-8571-0105ACFA2916}c:\\program files\\steam\\steamapps\\tonikokko\\day of defeat\\hl.exe"= UDP:c:\program files\steam\steamapps\tonikokko\day of defeat\hl.exe:Half-Life Launcher
    "UDP Query User{62519076-C4D5-4189-AFA3-FB99447E71D0}c:\\program files\\steam\\steamapps\\tonikokko\\day of defeat\\hl.exe"= TCP:c:\program files\steam\steamapps\tonikokko\day of defeat\hl.exe:Half-Life Launcher
    "TCP Query User{0036597C-6744-46E1-87AB-B5DA7022EA80}c:\\program files\\steam\\steamapps\\tonikokko\\counter-strike\\hl.exe"= UDP:c:\program files\steam\steamapps\tonikokko\counter-strike\hl.exe:Half-Life Launcher
    "UDP Query User{663FFDC6-AE4E-48C0-A372-E2D9606A88CA}c:\\program files\\steam\\steamapps\\tonikokko\\counter-strike\\hl.exe"= TCP:c:\program files\steam\steamapps\tonikokko\counter-strike\hl.exe:Half-Life Launcher
    "TCP Query User{CA0AAE20-34D5-4F87-9E3A-BDFB0BDB4D71}c:\\program files\\steam\\steamapps\\tonikokko\\ricochet\\hl.exe"= UDP:c:\program files\steam\steamapps\tonikokko\ricochet\hl.exe:Half-Life Launcher
    "UDP Query User{0CD7D344-BF25-4DBC-BB9F-A077320A0F5C}c:\\program files\\steam\\steamapps\\tonikokko\\ricochet\\hl.exe"= TCP:c:\program files\steam\steamapps\tonikokko\ricochet\hl.exe:Half-Life Launcher
    "TCP Query User{A91F8163-967F-4925-AADE-F07576322012}c:\\program files\\steam\\steamapps\\tonikokko\\condition zero deleted scenes\\hl.exe"= UDP:c:\program files\steam\steamapps\tonikokko\condition zero deleted scenes\hl.exe:Half-Life Launcher
    "UDP Query User{28567FE8-4FFA-485F-9801-A152048863F2}c:\\program files\\steam\\steamapps\\tonikokko\\condition zero deleted scenes\\hl.exe"= TCP:c:\program files\steam\steamapps\tonikokko\condition zero deleted scenes\hl.exe:Half-Life Launcher
    "TCP Query User{E9852CC0-029E-4A0C-8096-FD6ECFAB0A90}c:\\program files\\steam\\steamapps\\tonikokko\\dedicated server\\hlds.exe"= UDP:c:\program files\steam\steamapps\tonikokko\dedicated server\hlds.exe:HLDS Launcher
    "UDP Query User{0C665345-3CA8-457E-81C9-6BC344EC98A4}c:\\program files\\steam\\steamapps\\tonikokko\\dedicated server\\hlds.exe"= TCP:c:\program files\steam\steamapps\tonikokko\dedicated server\hlds.exe:HLDS Launcher
    "TCP Query User{687C75CE-4F7D-40F5-8C14-87714F9F9416}c:\\program files\\warcraft iii\\war3.exe"= UDP:c:\program files\warcraft iii\war3.exe:war3
    "UDP Query User{7D83C4AA-B864-4BB7-8ECA-0879524333EC}c:\\program files\\warcraft iii\\war3.exe"= TCP:c:\program files\warcraft iii\war3.exe:war3
    "TCP Query User{01937352-B3E0-4023-A301-3C31B8535E5D}c:\\program files\\free internet tv\\internettv.exe"= UDP:c:\program files\free internet tv\internettv.exe:Free Internet TV
    "UDP Query User{1BD9AA70-B7FD-479B-B7F9-B827DD9D7ECB}c:\\program files\\free internet tv\\internettv.exe"= TCP:c:\program files\free internet tv\internettv.exe:Free Internet TV
    "TCP Query User{CC790F40-F1A4-425E-9896-B90D44EA42DB}c:\\program files\\imesh applications\\imesh\\imesh.exe"= UDP:c:\program files\imesh applications\imesh\imesh.exe:iMesh
    "UDP Query User{5FA2CC62-D1E6-48F4-A379-97881541C956}c:\\program files\\imesh applications\\imesh\\imesh.exe"= TCP:c:\program files\imesh applications\imesh\imesh.exe:iMesh
    "{8D434BBF-7B9D-4766-95C6-6BB933BFB15D}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
    "TCP Query User{424FA59B-44ED-4B85-90AA-433062FB3C35}c:\\program files\\steam\\steamapps\\tonikokko\\half-life 2 deathmatch\\hl2.exe"= UDP:c:\program files\steam\steamapps\tonikokko\half-life 2 deathmatch\hl2.exe:hl2
    "UDP Query User{3F7F8D91-AF39-4FB4-918E-106C2CDCCC38}c:\\program files\\steam\\steamapps\\tonikokko\\half-life 2 deathmatch\\hl2.exe"= TCP:c:\program files\steam\steamapps\tonikokko\half-life 2 deathmatch\hl2.exe:hl2
    "TCP Query User{B96D695D-8CC8-4D07-A5DD-791BD6310D28}c:\\program files\\steam\\steamapps\\tonikokko\\source dedicated server\\srcds.exe"= UDP:c:\program files\steam\steamapps\tonikokko\source dedicated server\srcds.exe:srcds
    "UDP Query User{19313382-DAC4-4AA3-8867-F5146EA31C8D}c:\\program files\\steam\\steamapps\\tonikokko\\source dedicated server\\srcds.exe"= TCP:c:\program files\steam\steamapps\tonikokko\source dedicated server\srcds.exe:srcds
    "TCP Query User{91DC95F0-E22E-4614-9B14-F6BEAD27C789}c:\\program files\\steam\\steamapps\\tonikokko\\team fortress 2\\hl2.exe"= UDP:c:\program files\steam\steamapps\tonikokko\team fortress 2\hl2.exe:hl2
    "UDP Query User{C105F45B-E023-42E8-8B91-3CC995C607C8}c:\\program files\\steam\\steamapps\\tonikokko\\team fortress 2\\hl2.exe"= TCP:c:\program files\steam\steamapps\tonikokko\team fortress 2\hl2.exe:hl2
    "TCP Query User{44BB0EE4-F377-469A-B4D6-D80175D9CECA}c:\\program files\\steam\\steamapps\\common\\trackmania nations forever\\tmforever.exe"= UDP:c:\program files\steam\steamapps\common\trackmania nations forever\tmforever.exe:TmForever
    "UDP Query User{91B64548-43FD-4AED-B58F-8FBC4770020B}c:\\program files\\steam\\steamapps\\common\\trackmania nations forever\\tmforever.exe"= TCP:c:\program files\steam\steamapps\common\trackmania nations forever\tmforever.exe:TmForever
    "TCP Query User{4BC51E23-3733-41AC-9162-923CB1A596DB}c:\\program files\\gamespy arcade\\aphex.exe"= UDP:c:\program files\gamespy arcade\aphex.exe:GameSpy Arcade
    "UDP Query User{6C88CB19-9F83-4819-BA76-DC7374CC48B2}c:\\program files\\gamespy arcade\\aphex.exe"= TCP:c:\program files\gamespy arcade\aphex.exe:GameSpy Arcade
    "TCP Query User{756DFC95-D7CB-480C-8032-848E784C0710}c:\\program files\\steam\\steamapps\\tonikokko\\day of defeat source\\hl2.exe"= UDP:c:\program files\steam\steamapps\tonikokko\day of defeat source\hl2.exe:hl2
    "UDP Query User{0554D116-1219-42FC-9796-E62DB27BBDAE}c:\\program files\\steam\\steamapps\\tonikokko\\day of defeat source\\hl2.exe"= TCP:c:\program files\steam\steamapps\tonikokko\day of defeat source\hl2.exe:hl2
    "TCP Query User{79DA9B44-7689-4B4E-8547-36F63DFCC028}c:\\users\\toni kokko\\appdata\\local\\temp\\wzse1.tmp\\symnrt.exe"= UDP:c:\users\toni kokko\appdata\local\temp\wzse1.tmp\symnrt.exe:symnrt.exe
    "UDP Query User{C3336B92-104F-40A9-872B-0AAE6917CC4E}c:\\users\\toni kokko\\appdata\\local\\temp\\wzse1.tmp\\symnrt.exe"= TCP:c:\users\toni kokko\appdata\local\temp\wzse1.tmp\symnrt.exe:symnrt.exe
    "TCP Query User{3F2C2531-6397-40DC-BBD1-7DE0D99FD42A}c:\\program files\\xchat\\xchat.exe"= UDP:c:\program files\xchat\xchat.exe:XChat IRC Client
    "UDP Query User{48B44EDE-07F6-4F3F-9219-93D4073BD322}c:\\program files\\xchat\\xchat.exe"= TCP:c:\program files\xchat\xchat.exe:XChat IRC Client
    "TCP Query User{1807DC00-4740-4285-BAEB-7A470FA25F6A}c:\\program files\\steam\\steamapps\\avigga\\source dedicated server\\srcds.exe"= UDP:c:\program files\steam\steamapps\avigga\source dedicated server\srcds.exe:srcds
    "UDP Query User{BD3881C9-8577-4878-AE50-71EA1E2F7981}c:\\program files\\steam\\steamapps\\avigga\\source dedicated server\\srcds.exe"= TCP:c:\program files\steam\steamapps\avigga\source dedicated server\srcds.exe:srcds
    "TCP Query User{632A9822-2366-4C5F-9946-BCF45217B019}c:\\program files\\swarmplayer\\swarmplayer.exe"= UDP:c:\program files\swarmplayer\swarmplayer.exe:swarmplayer
    "UDP Query User{D770F340-9627-4C5A-BC38-EE624EC0EF76}c:\\program files\\swarmplayer\\swarmplayer.exe"= TCP:c:\program files\swarmplayer\swarmplayer.exe:swarmplayer
    "TCP Query User{7025C92C-326F-4C80-9A40-235F04872E01}c:\\program files\\mirc\\mirc.exe"= UDP:c:\program files\mirc\mirc.exe:mIRC
    "UDP Query User{0B0B6EFB-3F50-4C76-B1BB-5FA2C9C64DBE}c:\\program files\\mirc\\mirc.exe"= TCP:c:\program files\mirc\mirc.exe:mIRC
    "{F22F34CA-F474-47F7-833D-8C7E3F512871}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
    "{85F9CF5B-1363-454B-BDA0-88D6D5BCE2BF}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
    "TCP Query User{D0677DA9-934F-4B03-A63A-71F8AD9CE7F5}c:\\program files\\steam\\steamapps\\avigga\\team fortress 2\\hl2.exe"= UDP:c:\program files\steam\steamapps\avigga\team fortress 2\hl2.exe:hl2
    "UDP Query User{C6A4E485-9C63-46C1-9603-D10E6AFC14BB}c:\\program files\\steam\\steamapps\\avigga\\team fortress 2\\hl2.exe"= TCP:c:\program files\steam\steamapps\avigga\team fortress 2\hl2.exe:hl2
    "TCP Query User{8BA66BAE-D314-44B6-A811-C5A824532414}c:\\program files\\steam\\steamapps\\avigga\\half-life 2\\hl2.exe"= UDP:c:\program files\steam\steamapps\avigga\half-life 2\hl2.exe:hl2
    "UDP Query User{6C2708B7-E72C-41D1-A6DD-E8C1D4D866D5}c:\\program files\\steam\\steamapps\\avigga\\half-life 2\\hl2.exe"= TCP:c:\program files\steam\steamapps\avigga\half-life 2\hl2.exe:hl2
    "{C59E32F3-0600-4929-83DD-328BB51CC2C4}"= UDP:c:\program files\World of Warcraft\WoW-2.3.3.7799-to-2.4.0.8089-enGB-downloader.exe:Blizzard Downloader
    "{F92C8592-E8E1-4274-ADC1-E04D4EDDA2BB}"= TCP:c:\program files\World of Warcraft\WoW-2.3.3.7799-to-2.4.0.8089-enGB-downloader.exe:Blizzard Downloader
    "{228A0F0F-7A6F-4DE6-863A-0C6800D88497}"= UDP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-2.4.3-to-3.0.2-enGB-Win-Final-downloader.exe:Blizzard Downloader
    "{A5049911-5EDC-493D-95BF-668F714F538B}"= TCP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-2.4.3-to-3.0.2-enGB-Win-Final-downloader.exe:Blizzard Downloader
    "TCP Query User{EFF679D8-A571-41C8-9097-6D009425FFF8}c:\\program files\\world of warcraft\\world of warcraft\\world of warcraft\\repair.exe"= UDP:c:\program files\world of warcraft\world of warcraft\world of warcraft\repair.exe:Blizzard Repair Utility
    "UDP Query User{C6DD3040-93B6-4B22-9AA3-AC0041DF3E95}c:\\program files\\world of warcraft\\world of warcraft\\world of warcraft\\repair.exe"= TCP:c:\program files\world of warcraft\world of warcraft\world of warcraft\repair.exe:Blizzard Repair Utility
    "{8F16C087-9E09-476E-9653-28B6D03710FB}"= UDP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-3.0.2.9056-to-3.0.3.9183-enGB-downloader.exe:Blizzard Downloader
    "{30D23163-90AF-455E-BBFB-2A7A9D8A6950}"= TCP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-3.0.2.9056-to-3.0.3.9183-enGB-downloader.exe:Blizzard Downloader
    "{4ED71020-8DAB-461E-A011-FF9054A4F98F}"= UDP:3724:Blizzard Downloader: 3724
    "TCP Query User{A48F3969-7B98-4FEF-A123-7729F99FB69C}c:\\users\\toni kokko\\desktop\\lierox_v0.56_pack_1.9\\lierox v0.56 pack 1.9\\lierox.exe"= UDP:c:\users\toni kokko\desktop\lierox_v0.56_pack_1.9\lierox v0.56 pack 1.9\lierox.exe:lierox.exe
    "UDP Query User{9FDDD62B-6350-4110-AF53-4737FD530DBF}c:\\users\\toni kokko\\desktop\\lierox_v0.56_pack_1.9\\lierox v0.56 pack 1.9\\lierox.exe"= TCP:c:\users\toni kokko\desktop\lierox_v0.56_pack_1.9\lierox v0.56 pack 1.9\lierox.exe:lierox.exe
    "TCP Query User{D5ECF7FC-3CA4-4EBF-94E6-CE7E719C438D}c:\\users\\toni kokko\\desktop\\lierox_v0.56_pack_1.9\\lierox v0.56 pack 1.9\\lierox.exe"= UDP:c:\users\toni kokko\desktop\lierox_v0.56_pack_1.9\lierox v0.56 pack 1.9\lierox.exe:lierox.exe
    "UDP Query User{CEC1032E-1DF7-4CF6-B0BD-4B9ECFB8A640}c:\\users\\toni kokko\\desktop\\lierox_v0.56_pack_1.9\\lierox v0.56 pack 1.9\\lierox.exe"= TCP:c:\users\toni kokko\desktop\lierox_v0.56_pack_1.9\lierox v0.56 pack 1.9\lierox.exe:lierox.exe
    "{77FAE065-C5AB-4851-A183-EE612AF46CC8}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
    "{25634C9B-2C05-450D-B0AA-03952E3E3D3D}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
    "{66E0E986-796C-4553-8F29-3580DF0903B8}"= UDP:c:\program files\Malwarebytes' Anti-Malware\mbam.exe:Malwarebytes' Anti-Malware
    "{A052AC37-EA62-4011-B0FD-D1A0946168DA}"= TCP:c:\program files\Malwarebytes' Anti-Malware\mbam.exe:Malwarebytes' Anti-Malware
    "TCP Query User{C415CF1E-6660-4D46-80CE-899F0502C701}c:\\program files\\emule\\emule.exe"= Disabled:UDP:c:\program files\emule\emule.exe:eMule
    "UDP Query User{BCA21BF4-4166-4BB1-B95C-DA5C6CFDA864}c:\\program files\\emule\\emule.exe"= Disabled:TCP:c:\program files\emule\emule.exe:eMule
    "TCP Query User{26751923-DEFB-4A76-B360-5EE6BD2F1E8C}c:\\program files\\imesh applications\\imesh\\imesh.exe"= Disabled:UDP:c:\program files\imesh applications\imesh\imesh.exe:iMesh
    "UDP Query User{19B221A2-173E-4CE8-A4F5-DAD2A22BA0C5}c:\\program files\\imesh applications\\imesh\\imesh.exe"= Disabled:TCP:c:\program files\imesh applications\imesh\imesh.exe:iMesh
    "{4A3E76A5-F956-422C-A8B5-78D8DCE2B678}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
    "{42161E04-D772-488E-A978-0F12110F6EF8}"= UDP:c:\users\Toni Kokko\AppData\Local\Temp\WZSE0.TMP\SymNRT.exe:Norton Removal Tool
    "{C468BB28-F1EE-41BE-ADB4-0BCE04554273}"= TCP:c:\users\Toni Kokko\AppData\Local\Temp\WZSE0.TMP\SymNRT.exe:Norton Removal Tool
    "{633A8E51-2411-4FDE-B3CC-9DC01825D5C2}"= UDP:c:\windows\System32\WindowsAnytimeUpgrade.exe:Windows Anytime Upgrade
    "{2C14C3C3-87EE-41D3-A496-4AA3D1483D3F}"= TCP:c:\windows\System32\WindowsAnytimeUpgrade.exe:Windows Anytime Upgrade

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
    "c:\\Program Files\\BitTorrent\\bittorrent.exe"= c:\program files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent
    "c:\\Program Files\\xchat\\xchat.exe"= c:\program files\xchat\xchat.exe:*:Enabled:XChat IRC Client

    R2 BWH32S;BWH32S;"c:\program files\BUFFALO\clientmgrv\bin\BWH32S.exe" [2008-10-07 57912]
    R2 Ndiskio;Ndiskio;\??\c:\program files\Norman\Nse\bin\NDISKIO.SYS [2007-09-30 20448]
    R2 NVOY;Norman's Very Own supplY of resources;"c:\program files\Norman\npm\bin\nvoy.exe" [2008-03-24 121912]
    R3 nsesvc;Norman Scanner Engine Service;"c:\program files\Norman\nse\bin\NSESVC.EXE" -daemon [2008-06-26 322616]
    R3 NvcMFlt;NvcMFlt;c:\windows\system32\DRIVERS\nvcv32mf.sys [2008-09-04 19512]
    R3 nvcoas;Norman Virus Control on-access component;"c:\program files\Norman\Nvc\bin\nvcoas.exe" [2008-03-24 191544]
    R3 NVCScheduler;Norman Virus Control Scheduler;"c:\program files\Norman\Npm\bin\NVCSCHED.EXE" [2008-03-24 154680]
    R3 WLIU2KG125S;BUFFALO WLI-U2-KG125S Wireless LAN Adapter Driver;c:\windows\system32\DRIVERS\usb8023.sys [2008-05-24 15872]
    S3 Bufeap;BUFFALO EAP Driver;c:\windows\system32\DRIVERS\bufeap.sys [2008-10-07 14848]
    S3 netr73;RT73 USB Wireless LAN Card Driver for Vista;c:\windows\system32\DRIVERS\netr73.sys [2007-05-11 329728]
    S3 StickCap;Digital TV DVB-T USB Stick adapter service;c:\windows\system32\Drivers\stickcap.sys [2008-10-22 15744]
    S3 stickload;Digital TV stick firmware loader service;c:\windows\system32\DRIVERS\stickload.sys [2008-10-22 17024]
    S4 Automaattinen LiveUpdate-ajastustoiminto;Automaattinen LiveUpdate-ajastustoiminto;"c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" []

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
    \shell\AutoRun\command - G:\LaunchU3.exe -a

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{222a7df5-b2c2-11dc-9225-001b247c1e44}]
    \shell\AutoRun\command - E:\Setup.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7c0e6525-c9f4-11dd-9cb1-001601cfc4c2}]
    \shell\AutoRun\command - G:\LaunchU3.exe -a

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{96238bad-7562-11dc-93fe-001b247c1e44}]
    \shell\AutoRun\command - E:\setup.exe /autorun
    \shell\directx\command - e:\directx\dxsetup.exe
    \shell\setup\command - E:\setup.exe

    *Newly Created Service* - CATCHME
    *Newly Created Service* - MBAMSWISSARMY
    .
    'Ajoitetut tehtävät'-kansion sisältö

    2008-12-16 c:\windows\Tasks\GoogleUpdateTaskUser.job
    - c:\users\Toni Kokko\AppData\Local\Google\Update\GoogleUpdate.exe [2008-12-15 21:39]

    2008-12-15 c:\windows\Tasks\User_Feed_Synchronization-{C68C7EA6-5ACB-42EA-BD75-B52875D630F3}.job
    - c:\windows\system32\msfeedssync.exe [2008-01-18 22:33]
    .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-12-16 16:06:21
    Windows 6.0.6001 Service Pack 1 NTFS

    tarkistaa piilotettuja prosesseja ...

    tarkistaa piilotettuja käynnistysarvoja ...

    tarkistaa piilotettuja tiedostoja ...

    tarkistus on valmis
    piilotetut tiedostot: 0

    **************************************************************************
    .
    Valmistumisajankohta: 2008-12-16 16:13:15
    ComboFix-quarantined-files.txt 2008-12-16 14:13:10
    ComboFix2.txt 2008-12-15 20:29:49

    Ennen ajoa: 42 238 464 000 tavua vapaana
    Ajon jälkeen: 41,562,828,800 tavua vapaana

    519 --- E O F --- 2008-12-15 20:08:06

     
    tonikokko, 16.12.2008
    #42
  4. Hujo

    Hujo Guest

    scannaa uusi hjt:n loki
     
    Hujo, 16.12.2008
    #43
  5. tonikokko

    tonikokko Regular member

    Liittynyt:
    09.12.2008
    Viestejä:
    109
    Kiitokset:
    0
    Pisteet:
    26
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 21:37:50, on 14.12.2008
    Platform: Windows Vista SP1 (WinNT 6.00.1905)
    MSIE: Internet Explorer v7.00 (7.00.6001.18000)
    Boot mode: Normal

    Running processes:
    C:\Windows\System32\smss.exe
    C:\Windows\system32\csrss.exe
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\csrss.exe
    C:\Windows\system32\services.exe
    C:\Windows\system32\lsass.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\winlogon.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Norman\Npm\Bin\eLogsvc.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\SLsvc.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Norman\Npm\Bin\Zanda.exe
    C:\Program Files\Norman\npm\bin\nvoy.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Windows\system32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\BUFFALO\clientmgrv\bin\BWH32S.exe
    C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
    C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\DRIVERS\xaudio.exe
    C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
    C:\Windows\system32\WUDFHost.exe
    C:\Windows\system32\taskeng.exe
    C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
    C:\Program Files\Norman\Npm\bin\NVCSCHED.EXE
    C:\Program Files\Norman\nse\bin\NSESVC.EXE
    C:\Program Files\Norman\Nvc\bin\nvcoas.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\HP\QuickPlay\QPService.exe
    C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
    C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
    C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
    C:\Program Files\Norman\Npm\Bin\Zlh.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Windows\ehome\ehtray.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\BUFFALO\clientmgrv\bin\cmvMain.exe
    C:\Windows\System32\rundll32.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Program Files\Norman\Nvc\Bin\Nip.exe
    C:\Program Files\Norman\Nvc\Bin\cclaw.exe
    C:\Windows\ehome\ehsched.exe
    C:\Windows\ehome\ehRecvr.exe
    C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
    C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Winamp\winamp.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\Windows\system32\wbem\wmiprvse.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FI_FI&c=73&bd=Pavilion&pf=laptop
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
    O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O3 - Toolbar: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
    O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
    O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
    O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
    O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
    O4 - HKLM\..\Run: [Norman ZANDA] "C:\Program Files\Norman\Npm\Bin\ZLH.EXE" /LOAD /SPLASH
    O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu')
    O4 - Global Startup: ClientManagerV.lnk = C:\Program Files\BUFFALO\clientmgrv\bin\cmvMain.exe
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
    O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O20 - AppInit_DLLs:
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: ArcSoft Connect Daemon (ACDaemon) - Unknown owner - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (file missing)
    O23 - Service: Automaattinen LiveUpdate-ajastustoiminto - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
    O23 - Service: BWH32S - BUFFALO INC. - C:\Program Files\BUFFALO\clientmgrv\bin\BWH32S.exe
    O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
    O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
    O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - C:\Program Files\Norman\Npm\Bin\eLogsvc.exe
    O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
    O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: Norman NJeeves - Norman ASA - C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
    O23 - Service: Norman ZANDA - Norman ASA - C:\Program Files\Norman\Npm\Bin\Zanda.exe
    O23 - Service: Norman Scanner Engine Service (nsesvc) - Norman ASA - C:\Program Files\Norman\nse\bin\NSESVC.EXE
    O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Program Files\Norman\Nvc\bin\nvcoas.exe
    O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - C:\Program Files\Norman\Npm\bin\NVCSCHED.EXE
    O23 - Service: Norman's Very Own supplY of resources (NVOY) - Norman ASA - C:\Program Files\Norman\npm\bin\nvoy.exe
    O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
    O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
    O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

    --
    End of file - 9993 bytes

     
    tonikokko, 16.12.2008
    #44
  6. Hujo

    Hujo Guest

    sama loki kuin yllä poista vanhat lokit ennen uuden ottoa.
     
    Hujo, 16.12.2008
    #45
  7. tonikokko

    tonikokko Regular member

    Liittynyt:
    09.12.2008
    Viestejä:
    109
    Kiitokset:
    0
    Pisteet:
    26
    Tässä HJT logi ja poisto logi.

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 19:12:36, on 16.12.2008
    Platform: Windows Vista SP1 (WinNT 6.00.1905)
    MSIE: Internet Explorer v7.00 (7.00.6001.18000)
    Boot mode: Normal

    Running processes:
    C:\Windows\System32\smss.exe
    C:\Windows\system32\csrss.exe
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\csrss.exe
    C:\Windows\system32\services.exe
    C:\Windows\system32\lsass.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\winlogon.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Norman\Npm\Bin\eLogsvc.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\SLsvc.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Norman\Npm\Bin\Zanda.exe
    C:\Program Files\Norman\npm\bin\nvoy.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\BUFFALO\clientmgrv\bin\BWH32S.exe
    C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
    C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\DRIVERS\xaudio.exe
    C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
    C:\Windows\system32\taskeng.exe
    C:\Program Files\Norman\Npm\bin\NVCSCHED.EXE
    C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\HP\QuickPlay\QPService.exe
    C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
    C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
    C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
    C:\Program Files\Norman\Npm\Bin\Zlh.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Windows\ehome\ehtray.exe
    C:\Program Files\BUFFALO\clientmgrv\bin\cmvMain.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Windows\ehome\ehsched.exe
    C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
    C:\Windows\ehome\ehRecvr.exe
    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
    C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
    C:\Program Files\Windows Media Player\wmplayer.exe
    C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
    C:\Windows\system32\WUDFHost.exe
    C:\Users\Toni Kokko\AppData\Local\Google\Update\GoogleUpdate.exe
    C:\Program Files\Norman\nse\bin\NSESVC.EXE
    C:\Program Files\Norman\Nvc\Bin\Nip.exe
    C:\Program Files\Norman\Nvc\bin\nvcoas.exe
    C:\Program Files\Norman\Nvc\Bin\cclaw.exe
    C:\Program Files\Xfire\Xfire.exe
    C:\Program Files\Xfire\Xfire.exe
    C:\Windows\system32\conime.exe
    C:\Windows\Explorer.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Users\Toni Kokko\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Toni Kokko\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Toni Kokko\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Windows\system32\wbem\wmiprvse.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
    O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O3 - Toolbar: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
    O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
    O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
    O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
    O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
    O4 - HKLM\..\Run: [Norman ZANDA] "C:\Program Files\Norman\Npm\Bin\ZLH.EXE" /LOAD /SPLASH
    O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [Google Update] "C:\Users\Toni Kokko\AppData\Local\Google\Update\GoogleUpdate.exe" /c
    O4 - Global Startup: ClientManagerV.lnk = C:\Program Files\BUFFALO\clientmgrv\bin\cmvMain.exe
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
    O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O20 - AppInit_DLLs:
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: ArcSoft Connect Daemon (ACDaemon) - Unknown owner - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (file missing)
    O23 - Service: BWH32S - BUFFALO INC. - C:\Program Files\BUFFALO\clientmgrv\bin\BWH32S.exe
    O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
    O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
    O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - C:\Program Files\Norman\Npm\Bin\eLogsvc.exe
    O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
    O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: Norman NJeeves - Norman ASA - C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
    O23 - Service: Norman ZANDA - Norman ASA - C:\Program Files\Norman\Npm\Bin\Zanda.exe
    O23 - Service: Norman Scanner Engine Service (nsesvc) - Norman ASA - C:\Program Files\Norman\nse\bin\NSESVC.EXE
    O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Program Files\Norman\Nvc\bin\nvcoas.exe
    O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - C:\Program Files\Norman\Npm\bin\NVCSCHED.EXE
    O23 - Service: Norman's Very Own supplY of resources (NVOY) - Norman ASA - C:\Program Files\Norman\npm\bin\nvoy.exe
    O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
    O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
    O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

    --
    End of file - 9444 bytes

    Tässä unistall list

    AC3Filter (remove only)
    Ad-Aware
    Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
    Adobe Flash Player 9 ActiveX
    Adobe Flash Player Plugin
    Adobe Reader 8.1.2 - Suomi
    Adobe Shockwave Player 11
    Alarm 2.0.4
    ASIO4ALL
    BUFFALO Client Manager V
    CCleaner (remove only)
    Condition Zero
    Conexant HD Audio
    Counter-Strike
    Counter-Strike: Source
    Counter-Strike: Source
    Day of Defeat
    Dedicated Server
    ESU for Microsoft Vista
    ffdshow (remove only)
    GDR 3068 for SQL Server Database Services 2005 ENU (KB948109)
    Half-Life 2
    Half-Life 2: Deathmatch
    Half-Life 2: Episode One
    Half-Life 2: Episode Two
    HDAUDIO Soft Data Fax Modem with SmartCP
    Heroes II Gold
    Heroes of Might and Magic IV
    Heroes of Might and Magic® III Complete
    Hewlett-Packard Active Check
    Hewlett-Packard Asset Agent
    HijackThis 2.0.2
    HP Active Support Library
    HP Active Support Library 32 bit components
    HP Customer Experience Enhancements
    HP Doc Viewer
    HP Easy Setup - Frontend
    HP Help and Support
    HP Photosmart Essential 2.0
    HP Quick Launch Buttons 6.20 B1
    HP QuickPlay 3.2
    HP Update
    HP User Guides 0057
    HP Wireless Assistant
    IL Download Manager
    ImgBurn
    Insurgency
    InterVideo FilterSDK for AMT
    Java 2 SDK, SE v1.4.1_01
    Java(TM) 6 Update 11
    Malwarebytes' Anti-Malware
    Microsoft MSDN 2005 Express Edition - ENU
    Microsoft Office Professional Edition 2003
    Microsoft SAPI 5.1 Voices for Windows XP
    Microsoft Silverlight
    Microsoft SQL Server 2005
    Microsoft SQL Server 2005 Express Edition (SQLEXPRESS)
    Microsoft SQL Server Native Client
    Microsoft SQL Server Setup Support Files (English)
    Microsoft SQL Server VSS Writer
    Microsoft Visual Basic 2005 Express Edition - ENU
    Microsoft Visual Basic 2005 Express Edition - ENU
    Microsoft Visual Basic 2005 Express Edition - ENU Service Pack 1 (KB926747)
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Works
    mIRC
    Mozilla Firefox (3.0.4)
    MSCU for Microsoft Vista
    MSXML 4.0 SP2 (KB936181)
    MSXML 4.0 SP2 (KB941833)
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 Parser and SDK
    Network Play System (Patching)
    Norman Virus Control
    NVIDIA Drivers
    Peggle Deluxe Demo
    Peggle Extreme
    RevConnect
    Roxio Activation Module
    Roxio Creator Audio
    Roxio Creator Basic v9
    Roxio Creator Copy
    Roxio Creator Data
    Roxio Creator EasyArchive
    Roxio Creator Tools
    Roxio Express Labeler 3
    Roxio MyDVD Basic v9
    Security Update for CAPICOM (KB931906)
    Security Update for CAPICOM (KB931906)
    Skype 2.5
    SmartAudio
    Source Dedicated Server
    Steam
    Synaptics Pointing Device Driver
    System Requirements Lab
    The Sims
    The Sims Deluxe Edition
    Uninstall 1.0.0.0
    Update for Microsoft Visual Basic 2005 Express Edition - ENU (KB932232)
    VCRedistSetup
    Winamp
    Windows Live Messenger
    Windows Media Player Firefox Plugin
    WinRAR-pakkausohjelma
    Visual Basic 4 (32 bit) Runtime Modules
    VobSub v2.23 (Remove Only)
    Xfire (remove only)


     
    tonikokko, 16.12.2008
    #46
  8. Hujo

    Hujo Guest

    poista lisää poista sovelutuksesta

    scannaa hjt:llä merkkaa paina Fix checked

    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O3 - Toolbar: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O20 - AppInit_DLLs:

    ====================

    Lataa Atribunen ATF Cleaner

    Ohjeet;

    Tupla-klikkaa ATF-Cleaner.exe käynnistääksesi ohjelman.Main:n alla valitse: Select All
    Klikkaa Empty Selected valintaa.
    Jos käytät FireFoxia selaimenasi Klikkaa Firefox yläpuolelta ja valitse: Select All
    Klikkaa Empty Selected valintaa.
    HUOMIO: Jos haluaisit pitää tallennetut salasanasi, klikkaa No kun se sitä kysyy.
    Jos käytät Operaa selaimenasiKlikkaa Opera yläpuolelta ja valitse: Select All
    Klikkaa Empty Selected valintaa taas.
    HUOMIO: Jos haluaisit pitää tallennetut salasanasi, klikkaa No kun se sitä kysyy.
    Klikkaa Exit päävalikosta sulkeaksesi ohjelman.
    Teknistä tukea tulee jos tupla-klikkaat sähköpostiosoitetta joka sijaitsee jokaisen menun alapuolella kyseisessä työkalussa. (Huomatkaa että se tuki on sitten englanniksi)

    =================

    scannaa hjt:llä merkkaa paina Fix checked

    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O3 - Toolbar: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O20 - AppInit_DLLs:

    ================

    Avaa Muistio ja kopioi/liitä lainauksen sisältö sinne:

    Tallenna se nimellä CFScript.txt

    Sitten raahaa CFScript ComboFix.exeen kuten alla.
    [​IMG]

    Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.
     
    Hujo, 16.12.2008
    #47
  9. tonikokko

    tonikokko Regular member

    Liittynyt:
    09.12.2008
    Viestejä:
    109
    Kiitokset:
    0
    Pisteet:
    26
    ComboFix 08-12-15.01 - Toni Kokko 2008-12-17 12:38:12.3 - NTFSx86
    Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1035.18.1982.907 [GMT 2:00]
    Sijainti: c:\users\Toni Kokko\Desktop\ComboFix.exe
    Käytetyt komentorivivalitsimet :: c:\users\Toni Kokko\Desktop\CFScript.txt
    * Uusi palautuspiste luotu
    * Resident AV is active

    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\program files\COMODO
    c:\program files\COMODO\SafeSurf\cssurf.exe
    c:\programdata\comodo
    c:\programdata\comodo\common\Pending\PendingList.txt
    c:\users\All Users\comodo\common\Pending\PendingList.txt
    c:\users\Toni Kokko\AppData\Roaming\Comodo

    .
    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-11-17 to 2008-12-17 )))))))))))))))))
    .

    2008-12-14 20:48 . 2008-12-14 20:48 <KANSIO> d-------- c:\program files\Java
    2008-12-14 20:48 . 2008-12-14 20:48 410,984 --a------ c:\windows\System32\deploytk.dll
    2008-12-14 17:41 . 2008-12-14 17:42 <KANSIO> d-------- c:\users\Toni Kokko\AppData\Roaming\U3
    2008-12-11 23:08 . 2008-12-14 17:56 <KANSIO> d-------- c:\users\Toni Kokko\.SunDownloadManager
    2008-12-11 22:37 . 2008-12-11 22:37 42,320 --a------ c:\windows\System32\xfcodec.dll
    2008-12-11 15:00 . 2008-12-11 15:00 249,592 --a------ c:\windows\System32\cssdll32.dll
    2008-12-10 23:23 . 2008-12-10 23:23 <KANSIO> d-------- c:\users\Toni Kokko\AppData\Roaming\ImgBurn
    2008-12-10 23:19 . 2008-12-10 23:19 <KANSIO> d-------- c:\program files\ImgBurn
    2008-12-10 20:52 . 2008-12-10 20:52 <KANSIO> d-------- c:\temp\Windows XP Professional (English)
    2008-12-10 16:01 . 2008-10-22 03:22 2,048 --a------ c:\windows\System32\tzres.dll
    2008-12-09 21:05 . 2008-12-09 21:05 <KANSIO> d-------- c:\program files\Trend Micro
    2008-12-08 18:53 . 2008-12-08 18:53 <KANSIO> d-------- c:\users\All Users\Kaspersky Lab Setup Files
    2008-12-08 18:53 . 2008-12-08 18:53 <KANSIO> d-------- c:\programdata\Kaspersky Lab Setup Files
    2008-12-07 23:57 . 2008-12-07 23:57 <KANSIO> d-------- c:\windows\Sun
    2008-12-02 21:43 . 2008-12-02 21:43 <KANSIO> d-------- c:\users\Toni Kokko\AppData\Roaming\Malwarebytes
    2008-12-02 21:43 . 2008-12-02 21:43 <KANSIO> d-------- c:\users\All Users\Malwarebytes
    2008-12-02 21:43 . 2008-12-02 21:43 <KANSIO> d-------- c:\programdata\Malwarebytes
    2008-12-02 21:43 . 2008-12-14 22:54 <KANSIO> d-------- c:\program files\Malwarebytes' Anti-Malware
    2008-12-02 21:43 . 2008-12-03 19:52 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys
    2008-12-02 21:43 . 2008-12-03 19:52 15,504 --a------ c:\windows\System32\drivers\mbam.sys
    2008-11-26 19:39 . 2008-10-21 07:25 1,645,568 --a------ c:\windows\System32\connect.dll
    2008-11-26 19:39 . 2008-08-28 05:40 712,704 --a------ c:\windows\System32\WindowsCodecs.dll
    2008-11-26 19:39 . 2008-08-28 05:40 425,472 --a------ c:\windows\System32\PhotoMetadataHandler.dll
    2008-11-26 19:39 . 2008-08-28 05:40 347,136 --a------ c:\windows\System32\WindowsCodecsExt.dll
    2008-11-26 19:39 . 2008-10-22 05:57 241,152 --a------ c:\windows\System32\PortableDeviceApi.dll
    2008-11-24 22:36 . 2008-11-24 22:37 <KANSIO> d-------- c:\users\All Users\Lavasoft
    2008-11-24 22:36 . 2008-11-24 22:37 <KANSIO> d-------- c:\programdata\Lavasoft
    2008-11-24 22:36 . 2008-11-24 22:36 <KANSIO> d-------- c:\program files\Lavasoft
    2008-11-24 22:35 . 2008-12-10 18:41 <KANSIO> d-------- c:\program files\Common Files\Wise Installation Wizard
    2008-11-23 22:44 . 2008-11-23 22:44 <KANSIO> dr------- c:\windows\System32\config\systemprofile\Videos
    2008-11-23 22:44 . 2008-11-23 22:44 <KANSIO> dr------- c:\windows\System32\config\systemprofile\Pictures
    2008-11-23 22:44 . 2008-11-23 22:44 <KANSIO> dr------- c:\windows\System32\config\systemprofile\Downloads
    2008-11-23 22:44 . 2008-11-23 22:44 <KANSIO> dr------- c:\windows\System32\config\systemprofile\Documents
    2008-11-23 20:15 . 2008-11-23 20:15 52,736 --a------ c:\windows\ipuninst.exe
    2008-11-23 19:50 . 2008-11-23 19:50 <KANSIO> d-------- c:\program files\Alcohol Soft
    2008-11-17 16:27 . 2008-11-17 16:27 <KANSIO> d-------- c:\program files\CCleaner

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-12-17 05:45 --------- d-----w c:\programdata\Xfire
    2008-12-17 04:49 --------- d-----w c:\program files\Steam
    2008-12-16 09:14 28,314 ----a-w c:\users\Toni Kokko\AppData\Roaming\nvModes.dat
    2008-12-16 09:05 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\Xfire
    2008-12-16 09:05 --------- d-----w c:\program files\Xfire
    2008-12-15 05:12 --------- d-----w c:\program files\World of Warcraft
    2008-12-14 20:19 --------- d-----w c:\program files\Norman
    2008-12-14 18:21 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\uTorrent
    2008-12-14 18:05 --------- d--h--w c:\program files\InstallShield Installation Information
    2008-12-14 16:33 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\mIRC
    2008-12-10 14:50 --------- d-----w c:\program files\Windows Mail
    2008-12-10 13:35 --------- d-----w c:\program files\mIRC
    2008-12-08 07:23 --------- d-----w c:\program files\MSN Messenger
    2008-12-07 17:31 --------- d-----w c:\program files\RevConnect
    2008-12-03 20:31 --------- d-----w c:\program files\WhatPulse
    2008-11-24 09:59 --------- d-----w c:\program files\Google
    2008-11-23 21:22 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\BSplayer
    2008-11-23 21:22 --------- d-----w c:\program files\Webteh
    2008-11-23 20:27 --------- d-----w c:\programdata\Team MediaPortal
    2008-11-23 20:27 --------- d-----w c:\program files\Team MediaPortal
    2008-11-23 19:15 --------- d-----w c:\program files\Common Files\ArcSoft
    2008-11-23 17:18 717,296 ----a-w c:\windows\system32\drivers\sptd.sys
    2008-11-22 18:33 --------- d-----w c:\program files\SystemRequirementsLab
    2008-11-22 18:31 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\SystemRequirementsLab
    2008-11-15 20:11 --------- d-----w c:\program files\Common Files\Steam
    2008-11-13 16:21 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\Skype
    2008-11-03 14:00 --------- d-----w c:\programdata\Blizzard
    2008-11-02 18:36 --------- d-----w c:\program files\Common Files\Blizzard Entertainment
    2008-11-01 19:22 --------- d-----w c:\programdata\ArcSoft
    2008-11-01 16:15 --------- d-----w c:\program files\Microsoft SQL Server
    2008-11-01 07:40 30 ----a-w c:\users\Toni Kokko\jagex_runescape_preferences.dat
    2008-11-01 03:44 541,696 ----a-w c:\windows\AppPatch\AcLayers.dll
    2008-11-01 03:44 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll
    2008-11-01 03:44 460,288 ----a-w c:\windows\AppPatch\AcSpecfc.dll
    2008-11-01 03:44 28,672 ----a-w c:\windows\System32\Apphlpdm.dll
    2008-11-01 03:44 2,154,496 ----a-w c:\windows\AppPatch\AcGenral.dll
    2008-11-01 03:44 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll
    2008-11-01 01:21 4,240,384 ----a-w c:\windows\System32\GameUXLegacyGDFs.dll
    2008-10-31 20:12 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\Ventrilo
    2008-10-31 19:17 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\ArcSoft
    2008-10-31 16:40 --------- d-----w c:\program files\mpgconv
    2008-10-31 16:12 --------- d-----w c:\program files\Microsoft.NET
    2008-10-31 15:08 --------- d-----w c:\program files\ProgDVB
    2008-10-29 06:29 2,927,104 ----a-w c:\windows\explorer.exe
    2008-10-22 15:44 --------- d-----w c:\program files\Microsoft Silverlight
    2008-10-21 05:25 296,960 ----a-w c:\windows\System32\gdi32.dll
    2008-10-20 13:27 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\fretsonfire
    2008-10-17 17:20 --------- d-----w c:\program files\uTorrent
    2008-10-17 11:15 --------- d-----w c:\program files\xchat
    2008-10-17 11:14 --------- d-----w c:\program files\Frets on Fire
    2008-10-17 11:10 --------- d-----w c:\program files\Audacity
    2008-10-16 21:13 1,809,944 ----a-w c:\windows\System32\wuaueng.dll
    2008-10-16 21:12 561,688 ----a-w c:\windows\System32\wuapi.dll
    2008-10-16 21:09 51,224 ----a-w c:\windows\System32\wuauclt.exe
    2008-10-16 21:09 43,544 ----a-w c:\windows\System32\wups2.dll
    2008-10-16 21:08 34,328 ----a-w c:\windows\System32\wups.dll
    2008-10-16 20:56 1,524,736 ----a-w c:\windows\System32\wucltux.dll
    2008-10-16 20:55 83,456 ----a-w c:\windows\System32\wudriver.dll
    2008-10-16 12:08 162,064 ----a-w c:\windows\System32\wuwebv.dll
    2008-10-16 11:56 31,232 ----a-w c:\windows\System32\wuapp.exe
    2008-10-16 04:47 827,392 ----a-w c:\windows\System32\wininet.dll
    2008-10-09 16:54 28,672 ----a-w c:\windows\System32\AF15BDAEX.dll
    2008-09-30 14:43 1,286,152 ----a-w c:\windows\System32\msxml4.dll
    2008-09-18 05:09 3,601,464 ----a-w c:\windows\System32\ntkrnlpa.exe
    2008-09-18 05:09 3,549,240 ----a-w c:\windows\System32\ntoskrnl.exe
    2008-09-18 04:56 147,456 ----a-w c:\windows\System32\Faultrep.dll
    2008-09-18 04:56 125,952 ----a-w c:\windows\System32\wersvc.dll
    2008-09-18 02:16 2,032,640 ----a-w c:\windows\System32\win32k.sys
    2008-05-24 06:35 174 --sha-w c:\program files\desktop.ini
    2007-11-12 15:12 856 ----a-w c:\users\Toni Kokko\AppData\Roaming\wklnhst.dat
    2005-07-05 14:47 777 ----a-w c:\program files\trial_setup.ini
    2005-07-05 14:47 5,133,312 ----a-w c:\program files\trial_setup.msi
    2005-07-05 14:47 40,448 ----a-w c:\program files\trial_setup.exe
    2007-10-28 17:48 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    2007-10-28 17:48 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    2007-10-28 17:48 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    2007-08-30 15:12 16 --sha-w c:\windows\SMINST\HPCD.sys
    .

    ((((((((((((((((((((((((((((( snapshot@2008-12-15_22.23.28,00 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2008-12-15 17:36:07 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
    + 2008-12-15 20:22:47 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
    + 2008-12-15 20:22:47 262,144 ---ha-w c:\windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
    - 2008-12-11 14:30:51 430,472 ----a-w c:\windows\SoftwareDistribution\Download\Install\mpas-d.exe
    + 2008-12-17 10:28:44 2,456 ----a-w c:\windows\System32\networklist\icons\{A19B1C67-A399-4F4C-816A-2C34D3E3760F}_24.bin
    + 2008-12-17 10:28:44 4,280 ----a-w c:\windows\System32\networklist\icons\{A19B1C67-A399-4F4C-816A-2C34D3E3760F}_32.bin
    + 2008-12-17 10:28:44 9,560 ----a-w c:\windows\System32\networklist\icons\{A19B1C67-A399-4F4C-816A-2C34D3E3760F}_48.bin
    - 2008-12-15 14:21:23 489,176 ----a-w c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
    + 2008-12-16 16:19:52 493,682 ----a-w c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
    .
    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-18 1233920]
    "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-18 125952]
    "msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]
    "Google Update"="c:\users\Toni Kokko\AppData\Local\Google\Update\GoogleUpdate.exe" [2008-12-15 133104]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-28 1045800]
    "QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-04-23 176128]
    "QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-02-13 159744]
    "HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-03-12 50696]
    "hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776]
    "WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]
    "Norman ZANDA"="c:\program files\Norman\Npm\Bin\ZLH.EXE" [2008-06-02 277616]
    "NvSvc"="c:\windows\system32\nvsvc.dll" [2007-11-07 86016]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-11-07 8534560]
    "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-11-07 81920]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-14 136600]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
    "Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-07 44128]

    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    ClientManagerV.lnk - c:\program files\BUFFALO\clientmgrv\bin\cmvMain.exe [2008-10-07 138808]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableUIADesktopToggle"= 0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "vidc.ffds"= c:\program files\ffdshow\ffdshow.ax
    "VIDC.XFR1"= xfcodec.dll

    [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
    path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
    backup=c:\windows\pss\Adobe Gamma Loader.lnk.CommonStartup
    backupExtension=.CommonStartup

    [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^TMMonitor.lnk]
    path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\TMMonitor.lnk
    backup=c:\windows\pss\TMMonitor.lnk.CommonStartup
    backupExtension=.CommonStartup

    [HKLM\~\startupfolder\C:^Users^Toni Kokko^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Xfire.lnk]
    path=c:\users\Toni Kokko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xfire.lnk
    backup=c:\windows\pss\Xfire.lnk.Startup
    backupExtension=.Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
    --a------ 2008-01-11 21:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
    --a------ 2007-01-19 11:55 5674352 c:\program files\MSN Messenger\msnmsgr.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
    --a------ 2006-07-13 23:41 20034600 c:\program files\Skype\Phone\Skype.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhatPulse]
    --a------ 2006-08-21 19:48 665600 c:\program files\WhatPulse\WhatPulse.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
    --a------ 2008-08-04 01:02 36352 c:\program files\Winamp\winampa.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
    "TCP Query User{0E60E5F2-C916-49E0-95D4-2E627F9B6584}c:\\program files\\msn messenger\\msnmsgr.exe"= UDP:c:\program files\msn messenger\msnmsgr.exe:Messenger
    "UDP Query User{4C2E6A0D-F273-4BDA-83C8-F765026B7793}c:\\program files\\msn messenger\\msnmsgr.exe"= TCP:c:\program files\msn messenger\msnmsgr.exe:Messenger
    "{D544B387-58C0-408C-A260-FD2D4E311490}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2main.exe:Neverwinter Nights 2 Main
    "{8EA83D06-8F05-4EF9-80CA-755B77E5AFF8}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2main.exe:Neverwinter Nights 2 Main
    "{AFD50BC0-ADB8-48FD-89BA-EB04869FB04A}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2main_amdxp.exe:Neverwinter Nights 2 AMD
    "{BE23AB97-F9AB-4DE6-A39D-6E559FC93900}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2main_amdxp.exe:Neverwinter Nights 2 AMD
    "{D66B4CF5-C554-4AEB-A86E-AD7DB85A46A8}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwupdate.exe:Neverwinter Nights 2 Updater
    "{CE2B4A9D-8D3E-493A-85E2-75A59E58922D}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwupdate.exe:Neverwinter Nights 2 Updater
    "{9963DB7F-22C2-473D-9917-DC1D1E408B72}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2server.exe:Neverwinter Nights 2 Server
    "{244AD98B-9023-47F0-AD1E-29BC7685E96A}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2server.exe:Neverwinter Nights 2 Server
    "TCP Query User{F489A6A9-FE85-4FA6-85CF-E59E6DAF3156}c:\\program files\\xfire\\xfire.exe"= UDP:c:\program files\xfire\xfire.exe:Xfire
    "UDP Query User{7D9956B7-71D1-4FC4-9CE6-832F85DAB2F3}c:\\program files\\xfire\\xfire.exe"= TCP:c:\program files\xfire\xfire.exe:Xfire
    "TCP Query User{C1771924-088B-4479-9E4F-08E43FFECB97}c:\\program files\\msn messenger\\livecall.exe"= UDP:c:\program files\msn messenger\livecall.exe:Windows Live Call
    "UDP Query User{F792272E-B764-4CFD-B2F1-C8B157A42A87}c:\\program files\\msn messenger\\livecall.exe"= TCP:c:\program files\msn messenger\livecall.exe:Windows Live Call
    "TCP Query User{FF66BB09-91AA-4DE6-AF98-A53FD47C99A4}c:\\program files\\emule\\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule
    "UDP Query User{331EAEE3-D7AB-4DFB-B4A2-144FCF3159A8}c:\\program files\\emule\\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule
    "TCP Query User{9A954996-511F-4135-8468-ECB0BCE6021C}c:\\users\\toni kokko\\desktop\\nes\\nestc042\\nestcl95.exe"= UDP:c:\users\toni kokko\desktop\nes\nestc042\nestcl95.exe:nestcl95.exe
    "UDP Query User{F76BA4B4-2BB9-409B-AE4E-4EB7BB4117F2}c:\\users\\toni kokko\\desktop\\nes\\nestc042\\nestcl95.exe"= TCP:c:\users\toni kokko\desktop\nes\nestc042\nestcl95.exe:nestcl95.exe
    "TCP Query User{CCCA7D9E-957F-41C2-9E95-BF5A9D165A8B}c:\\users\\toni kokko\\desktop\\utorrent.exe"= UDP:c:\users\toni kokko\desktop\utorrent.exe:utorrent.exe
    "UDP Query User{A5D6125A-F900-48E3-B961-6D3FEC8C95E5}c:\\users\\toni kokko\\desktop\\utorrent.exe"= TCP:c:\users\toni kokko\desktop\utorrent.exe:utorrent.exe
    "TCP Query User{74C37976-832D-4749-804A-AD0500E05A5A}c:\\neverwinternights\\nwn\\nwmain.exe"= UDP:c:\neverwinternights\nwn\nwmain.exe:Neverwinter Nights
    "UDP Query User{800E3D01-47D1-4313-BFD1-B33D07152FC3}c:\\neverwinternights\\nwn\\nwmain.exe"= TCP:c:\neverwinternights\nwn\nwmain.exe:Neverwinter Nights
    "TCP Query User{E34D9D43-0DBD-438C-9399-F8EFF49FE563}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox
    "UDP Query User{5801BA1E-24E1-4DAA-B511-AFB0979D09E9}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox
    "{4DEA1078-B4EF-46F8-8AE7-B438930E46EF}"= UDP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent
    "{FDBCB264-4CDB-4991-AD93-DE1FADBEE8BF}"= TCP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent
    "TCP Query User{450ACF7E-B1DD-4791-8D62-03446A1DCE2A}c:\\program files\\byond\\bin\\byond.exe"= UDP:c:\program files\byond\bin\byond.exe:byond
    "UDP Query User{D1B4E27F-BC0E-4084-A91F-84E9117CC3A0}c:\\program files\\byond\\bin\\byond.exe"= TCP:c:\program files\byond\bin\byond.exe:byond
    "TCP Query User{30F015A4-F3E8-4A45-BAA0-C14ACA1208CB}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:uTorrent
    "UDP Query User{DB869AB6-C57A-45A4-9C81-A6635D2B3780}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:uTorrent
    "TCP Query User{6D1C176D-F5CB-4456-9837-7333E5D352A9}c:\\program files\\counter-strike 1.6\\hl.exe"= UDP:c:\program files\counter-strike 1.6\hl.exe:Half-Life Launcher
    "UDP Query User{0F745B67-F537-4EAD-B14E-6597D2C8D17E}c:\\program files\\counter-strike 1.6\\hl.exe"= TCP:c:\program files\counter-strike 1.6\hl.exe:Half-Life Launcher
    "TCP Query User{D677DB5E-40A0-43E1-8D41-7D2419599383}c:\\program files\\ea games\\medal of honor pacific assault(tm) mpdemo2\\mohpa_mpdemo.exe"= UDP:c:\program files\ea games\medal of honor pacific assault(tm) mpdemo2\mohpa_mpdemo.exe:Medal of Honor Pacific Assault(tm)
    "UDP Query User{458AC2B1-2FAC-4B4B-84F5-583EB41A645D}c:\\program files\\ea games\\medal of honor pacific assault(tm) mpdemo2\\mohpa_mpdemo.exe"= TCP:c:\program files\ea games\medal of honor pacific assault(tm) mpdemo2\mohpa_mpdemo.exe:Medal of Honor Pacific Assault(tm)
    "TCP Query User{5EFC87C6-F824-46C0-B522-289B9521117F}c:\\program files\\ea games\\medal of honor pacific assault(tm) mpdemo2\\mohpa_mpdemo_server.exe"= UDP:c:\program files\ea games\medal of honor pacific assault(tm) mpdemo2\mohpa_mpdemo_server.exe:Medal of Honor Pacific Assault(tm)
    "UDP Query User{5170532E-4D95-4AC3-8CB3-43BDD42DF486}c:\\program files\\ea games\\medal of honor pacific assault(tm) mpdemo2\\mohpa_mpdemo_server.exe"= TCP:c:\program files\ea games\medal of honor pacific assault(tm) mpdemo2\mohpa_mpdemo_server.exe:Medal of Honor Pacific Assault(tm)
    "TCP Query User{C3BEF026-E9E6-49AF-8692-82BA32F08404}c:\\program files\\wolfenstein - enemy territory\\et.exe"= UDP:c:\program files\wolfenstein - enemy territory\et.exe:ET
    "UDP Query User{5D2F2AEB-CEDA-4639-A9D0-F0C577D93D08}c:\\program files\\wolfenstein - enemy territory\\et.exe"= TCP:c:\program files\wolfenstein - enemy territory\et.exe:ET
    "TCP Query User{13F890DE-490E-4B0B-A087-A1602366A068}c:\\program files\\wolfenstein - enemy territory\\etded.exe"= UDP:c:\program files\wolfenstein - enemy territory\etded.exe:ETDED
    "UDP Query User{B91B82C8-9DF3-4DD9-944C-FE795C320114}c:\\program files\\wolfenstein - enemy territory\\etded.exe"= TCP:c:\program files\wolfenstein - enemy territory\etded.exe:ETDED
    "{28350A57-E35F-4F9C-B726-7B3C68A588E3}"= UDP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-2.3.0.7561-to-2.3.2.7741-enGB-downloader.exe:Blizzard Downloader
    "{76E61FE2-B81C-4A09-983A-D667AD863C44}"= TCP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-2.3.0.7561-to-2.3.2.7741-enGB-downloader.exe:Blizzard Downloader
    "TCP Query User{6F5B6C21-B17E-4BA6-BACF-63340EF3162E}c:\\program files\\microsoft games\\halo\\halo.exe"= UDP:c:\program files\microsoft games\halo\halo.exe:Halo
    "UDP Query User{47B278DD-D9A1-41DF-BA07-E2CA5916589E}c:\\program files\\microsoft games\\halo\\halo.exe"= TCP:c:\program files\microsoft games\halo\halo.exe:Halo
    "TCP Query User{84C8EEEE-5646-45A6-9B3E-7BB1B421C0B7}c:\\users\\toni kokko\\desktop\\installer-22999-864-counter-strike.exe"= UDP:c:\users\toni kokko\desktop\installer-22999-864-counter-strike.exe:installer-22999-864-counter-strike.exe
    "UDP Query User{96AF4C29-27B9-470A-898F-C74BDE0FA4B5}c:\\users\\toni kokko\\desktop\\installer-22999-864-counter-strike.exe"= TCP:c:\users\toni kokko\desktop\installer-22999-864-counter-strike.exe:installer-22999-864-counter-strike.exe
    "TCP Query User{619080D8-8BD2-43BE-9D6D-20EF595F124B}c:\\program files\\jazz jackrabbit 2\\jazz2.exe"= UDP:c:\program files\jazz jackrabbit 2\jazz2.exe:Jazz Jackrabbit 2
    "UDP Query User{E21B1754-AC24-4590-A3EC-7AD436050300}c:\\program files\\jazz jackrabbit 2\\jazz2.exe"= TCP:c:\program files\jazz jackrabbit 2\jazz2.exe:Jazz Jackrabbit 2
    "{C430DAF0-70C6-4A09-9149-FE39258CC3E7}"= UDP:94:VRS Recording System Web Control Panel
    "{5E1865ED-1E02-40B5-BD48-464808564702}"= TCP:8000:Axon Virtual PBX RTP Incoming Audio (UDP)
    "{48B844C8-8091-454D-A500-3829598B8619}"= TCP:8001:Axon Virtual PBX RTP Incoming Audio (UDP)
    "{D5122966-424E-4973-B4E8-621466F124FA}"= TCP:8002:Axon Virtual PBX RTP Incoming Audio (UDP)
    "{14CA1EB7-06AF-4992-8F33-CA8A2A6907A1}"= TCP:8003:Axon Virtual PBX RTP Incoming Audio (UDP)
    "{07144F0D-652E-4938-A4A6-7AB816714FFA}"= TCP:8004:Axon Virtual PBX RTP Incoming Audio (UDP)
    "{10771593-3459-4E97-946D-393D93FCBD84}"= UDP:81:Axon Virtual PBX Web Server
    "TCP Query User{DC46209A-4D4D-424A-8B56-2D92080081FA}c:\\program files\\condition zero\\hlds.exe"= UDP:c:\program files\condition zero\hlds.exe:HLDS Launcher
    "UDP Query User{34072C27-AA45-49B3-938D-BE4BC547EAA6}c:\\program files\\condition zero\\hlds.exe"= TCP:c:\program files\condition zero\hlds.exe:HLDS Launcher
    "TCP Query User{3C767F74-CB7D-4D9F-8EE2-50E472BA6FA5}c:\\program files\\skype\\phone\\skype.exe"= UDP:c:\program files\skype\phone\skype.exe:Skype. The whole world can talk for free.
    "UDP Query User{DC78D1AA-837C-46A6-96FD-5D6B2A1BBECA}c:\\program files\\skype\\phone\\skype.exe"= TCP:c:\program files\skype\phone\skype.exe:Skype. The whole world can talk for free.
    "TCP Query User{AA2D2F5E-039A-4DD4-885B-C2D14B1A31A2}c:\\program files\\condition zero\\hlds.exe"= UDP:c:\program files\condition zero\hlds.exe:HLDS Launcher
    "UDP Query User{0DBC3F9B-298F-4C44-8502-7B0DAA696F75}c:\\program files\\condition zero\\hlds.exe"= TCP:c:\program files\condition zero\hlds.exe:HLDS Launcher
    "TCP Query User{D7AD1479-5F64-4930-83C8-2927AB9E0F13}c:\\program files\\steam\\steamapps\\tonikokko\\dedicated server\\hlds.exe"= UDP:c:\program files\steam\steamapps\tonikokko\dedicated server\hlds.exe:HLDS Launcher
    "UDP Query User{F3C82F4E-374B-44B6-97CB-56D0293C4BA9}c:\\program files\\steam\\steamapps\\tonikokko\\dedicated server\\hlds.exe"= TCP:c:\program files\steam\steamapps\tonikokko\dedicated server\hlds.exe:HLDS Launcher
    "TCP Query User{1EC6E41B-CDBA-49BF-B50B-42CDDB39E83D}c:\\program files\\css\\hl2.exe"= UDP:c:\program files\css\hl2.exe:hl2
    "UDP Query User{A7391A47-23E6-4F58-ACEC-DD126FFE456F}c:\\program files\\css\\hl2.exe"= TCP:c:\program files\css\hl2.exe:hl2
    "TCP Query User{5B91D1B4-4D0D-4392-B877-7605B8FE1A0C}c:\\program files\\css\\srcds.exe"= UDP:c:\program files\css\srcds.exe:srcds
    "UDP Query User{B0D44996-1DFD-4C13-9FB0-FB239079A96A}c:\\program files\\css\\srcds.exe"= TCP:c:\program files\css\srcds.exe:srcds
    "TCP Query User{A9F96E00-45E6-49C4-A318-F1A387CFC15E}c:\\program files\\steam\\steamapps\\tonikokko\\counter-strike\\hl.exe"= UDP:c:\program files\steam\steamapps\tonikokko\counter-strike\hl.exe:Half-Life Launcher
    "UDP Query User{52B86BB3-139B-41C0-9A76-7E0ACD830A9F}c:\\program files\\steam\\steamapps\\tonikokko\\counter-strike\\hl.exe"= TCP:c:\program files\steam\steamapps\tonikokko\counter-strike\hl.exe:Half-Life Launcher
    "TCP Query User{352C5FB1-A302-4D84-A303-94FC6280B1D8}c:\\program files\\steam\\steamapps\\tonikokko\\condition zero deleted scenes\\hl.exe"= UDP:c:\program files\steam\steamapps\tonikokko\condition zero deleted scenes\hl.exe:Half-Life Launcher
    "UDP Query User{B5482BF4-55AD-420C-A6AB-F7B0D353C806}c:\\program files\\steam\\steamapps\\tonikokko\\condition zero deleted scenes\\hl.exe"= TCP:c:\program files\steam\steamapps\tonikokko\condition zero deleted scenes\hl.exe:Half-Life Launcher
    "TCP Query User{8F8E66C1-9816-4E0E-95E3-78DC8B2BD9FD}c:\\program files\\steam\\steamapps\\tonikokko\\deathmatch classic\\hl.exe"= UDP:c:\program files\steam\steamapps\tonikokko\deathmatch classic\hl.exe:Half-Life Launcher
    "UDP Query User{C4018428-4558-4595-A0C3-49A90D49A7B9}c:\\program files\\steam\\steamapps\\tonikokko\\deathmatch classic\\hl.exe"= TCP:c:\program files\steam\steamapps\tonikokko\deathmatch classic\hl.exe:Half-Life Launcher
    "TCP Query User{DCFA1FCE-D408-47CD-8571-0105ACFA2916}c:\\program files\\steam\\steamapps\\tonikokko\\day of defeat\\hl.exe"= UDP:c:\program files\steam\steamapps\tonikokko\day of defeat\hl.exe:Half-Life Launcher
    "UDP Query User{62519076-C4D5-4189-AFA3-FB99447E71D0}c:\\program files\\steam\\steamapps\\tonikokko\\day of defeat\\hl.exe"= TCP:c:\program files\steam\steamapps\tonikokko\day of defeat\hl.exe:Half-Life Launcher
    "TCP Query User{0036597C-6744-46E1-87AB-B5DA7022EA80}c:\\program files\\steam\\steamapps\\tonikokko\\counter-strike\\hl.exe"= UDP:c:\program files\steam\steamapps\tonikokko\counter-strike\hl.exe:Half-Life Launcher
    "UDP Query User{663FFDC6-AE4E-48C0-A372-E2D9606A88CA}c:\\program files\\steam\\steamapps\\tonikokko\\counter-strike\\hl.exe"= TCP:c:\program files\steam\steamapps\tonikokko\counter-strike\hl.exe:Half-Life Launcher
    "TCP Query User{CA0AAE20-34D5-4F87-9E3A-BDFB0BDB4D71}c:\\program files\\steam\\steamapps\\tonikokko\\ricochet\\hl.exe"= UDP:c:\program files\steam\steamapps\tonikokko\ricochet\hl.exe:Half-Life Launcher
    "UDP Query User{0CD7D344-BF25-4DBC-BB9F-A077320A0F5C}c:\\program files\\steam\\steamapps\\tonikokko\\ricochet\\hl.exe"= TCP:c:\program files\steam\steamapps\tonikokko\ricochet\hl.exe:Half-Life Launcher
    "TCP Query User{A91F8163-967F-4925-AADE-F07576322012}c:\\program files\\steam\\steamapps\\tonikokko\\condition zero deleted scenes\\hl.exe"= UDP:c:\program files\steam\steamapps\tonikokko\condition zero deleted scenes\hl.exe:Half-Life Launcher
    "UDP Query User{28567FE8-4FFA-485F-9801-A152048863F2}c:\\program files\\steam\\steamapps\\tonikokko\\condition zero deleted scenes\\hl.exe"= TCP:c:\program files\steam\steamapps\tonikokko\condition zero deleted scenes\hl.exe:Half-Life Launcher
    "TCP Query User{E9852CC0-029E-4A0C-8096-FD6ECFAB0A90}c:\\program files\\steam\\steamapps\\tonikokko\\dedicated server\\hlds.exe"= UDP:c:\program files\steam\steamapps\tonikokko\dedicated server\hlds.exe:HLDS Launcher
    "UDP Query User{0C665345-3CA8-457E-81C9-6BC344EC98A4}c:\\program files\\steam\\steamapps\\tonikokko\\dedicated server\\hlds.exe"= TCP:c:\program files\steam\steamapps\tonikokko\dedicated server\hlds.exe:HLDS Launcher
    "TCP Query User{687C75CE-4F7D-40F5-8C14-87714F9F9416}c:\\program files\\warcraft iii\\war3.exe"= UDP:c:\program files\warcraft iii\war3.exe:war3
    "UDP Query User{7D83C4AA-B864-4BB7-8ECA-0879524333EC}c:\\program files\\warcraft iii\\war3.exe"= TCP:c:\program files\warcraft iii\war3.exe:war3
    "TCP Query User{01937352-B3E0-4023-A301-3C31B8535E5D}c:\\program files\\free internet tv\\internettv.exe"= UDP:c:\program files\free internet tv\internettv.exe:Free Internet TV
    "UDP Query User{1BD9AA70-B7FD-479B-B7F9-B827DD9D7ECB}c:\\program files\\free internet tv\\internettv.exe"= TCP:c:\program files\free internet tv\internettv.exe:Free Internet TV
    "TCP Query User{CC790F40-F1A4-425E-9896-B90D44EA42DB}c:\\program files\\imesh applications\\imesh\\imesh.exe"= UDP:c:\program files\imesh applications\imesh\imesh.exe:iMesh
    "UDP Query User{5FA2CC62-D1E6-48F4-A379-97881541C956}c:\\program files\\imesh applications\\imesh\\imesh.exe"= TCP:c:\program files\imesh applications\imesh\imesh.exe:iMesh
    "{8D434BBF-7B9D-4766-95C6-6BB933BFB15D}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
    "TCP Query User{424FA59B-44ED-4B85-90AA-433062FB3C35}c:\\program files\\steam\\steamapps\\tonikokko\\half-life 2 deathmatch\\hl2.exe"= UDP:c:\program files\steam\steamapps\tonikokko\half-life 2 deathmatch\hl2.exe:hl2
    "UDP Query User{3F7F8D91-AF39-4FB4-918E-106C2CDCCC38}c:\\program files\\steam\\steamapps\\tonikokko\\half-life 2 deathmatch\\hl2.exe"= TCP:c:\program files\steam\steamapps\tonikokko\half-life 2 deathmatch\hl2.exe:hl2
    "TCP Query User{B96D695D-8CC8-4D07-A5DD-791BD6310D28}c:\\program files\\steam\\steamapps\\tonikokko\\source dedicated server\\srcds.exe"= UDP:c:\program files\steam\steamapps\tonikokko\source dedicated server\srcds.exe:srcds
    "UDP Query User{19313382-DAC4-4AA3-8867-F5146EA31C8D}c:\\program files\\steam\\steamapps\\tonikokko\\source dedicated server\\srcds.exe"= TCP:c:\program files\steam\steamapps\tonikokko\source dedicated server\srcds.exe:srcds
    "TCP Query User{91DC95F0-E22E-4614-9B14-F6BEAD27C789}c:\\program files\\steam\\steamapps\\tonikokko\\team fortress 2\\hl2.exe"= UDP:c:\program files\steam\steamapps\tonikokko\team fortress 2\hl2.exe:hl2
    "UDP Query User{C105F45B-E023-42E8-8B91-3CC995C607C8}c:\\program files\\steam\\steamapps\\tonikokko\\team fortress 2\\hl2.exe"= TCP:c:\program files\steam\steamapps\tonikokko\team fortress 2\hl2.exe:hl2
    "TCP Query User{44BB0EE4-F377-469A-B4D6-D80175D9CECA}c:\\program files\\steam\\steamapps\\common\\trackmania nations forever\\tmforever.exe"= UDP:c:\program files\steam\steamapps\common\trackmania nations forever\tmforever.exe:TmForever
    "UDP Query User{91B64548-43FD-4AED-B58F-8FBC4770020B}c:\\program files\\steam\\steamapps\\common\\trackmania nations forever\\tmforever.exe"= TCP:c:\program files\steam\steamapps\common\trackmania nations forever\tmforever.exe:TmForever
    "TCP Query User{4BC51E23-3733-41AC-9162-923CB1A596DB}c:\\program files\\gamespy arcade\\aphex.exe"= UDP:c:\program files\gamespy arcade\aphex.exe:GameSpy Arcade
    "UDP Query User{6C88CB19-9F83-4819-BA76-DC7374CC48B2}c:\\program files\\gamespy arcade\\aphex.exe"= TCP:c:\program files\gamespy arcade\aphex.exe:GameSpy Arcade
    "TCP Query User{756DFC95-D7CB-480C-8032-848E784C0710}c:\\program files\\steam\\steamapps\\tonikokko\\day of defeat source\\hl2.exe"= UDP:c:\program files\steam\steamapps\tonikokko\day of defeat source\hl2.exe:hl2
    "UDP Query User{0554D116-1219-42FC-9796-E62DB27BBDAE}c:\\program files\\steam\\steamapps\\tonikokko\\day of defeat source\\hl2.exe"= TCP:c:\program files\steam\steamapps\tonikokko\day of defeat source\hl2.exe:hl2
    "TCP Query User{79DA9B44-7689-4B4E-8547-36F63DFCC028}c:\\users\\toni kokko\\appdata\\local\\temp\\wzse1.tmp\\symnrt.exe"= UDP:c:\users\toni kokko\appdata\local\temp\wzse1.tmp\symnrt.exe:symnrt.exe
    "UDP Query User{C3336B92-104F-40A9-872B-0AAE6917CC4E}c:\\users\\toni kokko\\appdata\\local\\temp\\wzse1.tmp\\symnrt.exe"= TCP:c:\users\toni kokko\appdata\local\temp\wzse1.tmp\symnrt.exe:symnrt.exe
    "TCP Query User{3F2C2531-6397-40DC-BBD1-7DE0D99FD42A}c:\\program files\\xchat\\xchat.exe"= UDP:c:\program files\xchat\xchat.exe:XChat IRC Client
    "UDP Query User{48B44EDE-07F6-4F3F-9219-93D4073BD322}c:\\program files\\xchat\\xchat.exe"= TCP:c:\program files\xchat\xchat.exe:XChat IRC Client
    "TCP Query User{1807DC00-4740-4285-BAEB-7A470FA25F6A}c:\\program files\\steam\\steamapps\\avigga\\source dedicated server\\srcds.exe"= UDP:c:\program files\steam\steamapps\avigga\source dedicated server\srcds.exe:srcds
    "UDP Query User{BD3881C9-8577-4878-AE50-71EA1E2F7981}c:\\program files\\steam\\steamapps\\avigga\\source dedicated server\\srcds.exe"= TCP:c:\program files\steam\steamapps\avigga\source dedicated server\srcds.exe:srcds
    "TCP Query User{632A9822-2366-4C5F-9946-BCF45217B019}c:\\program files\\swarmplayer\\swarmplayer.exe"= UDP:c:\program files\swarmplayer\swarmplayer.exe:swarmplayer
    "UDP Query User{D770F340-9627-4C5A-BC38-EE624EC0EF76}c:\\program files\\swarmplayer\\swarmplayer.exe"= TCP:c:\program files\swarmplayer\swarmplayer.exe:swarmplayer
    "TCP Query User{7025C92C-326F-4C80-9A40-235F04872E01}c:\\program files\\mirc\\mirc.exe"= UDP:c:\program files\mirc\mirc.exe:mIRC
    "UDP Query User{0B0B6EFB-3F50-4C76-B1BB-5FA2C9C64DBE}c:\\program files\\mirc\\mirc.exe"= TCP:c:\program files\mirc\mirc.exe:mIRC
    "{F22F34CA-F474-47F7-833D-8C7E3F512871}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
    "{85F9CF5B-1363-454B-BDA0-88D6D5BCE2BF}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
    "TCP Query User{D0677DA9-934F-4B03-A63A-71F8AD9CE7F5}c:\\program files\\steam\\steamapps\\avigga\\team fortress 2\\hl2.exe"= UDP:c:\program files\steam\steamapps\avigga\team fortress 2\hl2.exe:hl2
    "UDP Query User{C6A4E485-9C63-46C1-9603-D10E6AFC14BB}c:\\program files\\steam\\steamapps\\avigga\\team fortress 2\\hl2.exe"= TCP:c:\program files\steam\steamapps\avigga\team fortress 2\hl2.exe:hl2
    "TCP Query User{8BA66BAE-D314-44B6-A811-C5A824532414}c:\\program files\\steam\\steamapps\\avigga\\half-life 2\\hl2.exe"= UDP:c:\program files\steam\steamapps\avigga\half-life 2\hl2.exe:hl2
    "UDP Query User{6C2708B7-E72C-41D1-A6DD-E8C1D4D866D5}c:\\program files\\steam\\steamapps\\avigga\\half-life 2\\hl2.exe"= TCP:c:\program files\steam\steamapps\avigga\half-life 2\hl2.exe:hl2
    "{C59E32F3-0600-4929-83DD-328BB51CC2C4}"= UDP:c:\program files\World of Warcraft\WoW-2.3.3.7799-to-2.4.0.8089-enGB-downloader.exe:Blizzard Downloader
    "{F92C8592-E8E1-4274-ADC1-E04D4EDDA2BB}"= TCP:c:\program files\World of Warcraft\WoW-2.3.3.7799-to-2.4.0.8089-enGB-downloader.exe:Blizzard Downloader
    "{228A0F0F-7A6F-4DE6-863A-0C6800D88497}"= UDP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-2.4.3-to-3.0.2-enGB-Win-Final-downloader.exe:Blizzard Downloader
    "{A5049911-5EDC-493D-95BF-668F714F538B}"= TCP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-2.4.3-to-3.0.2-enGB-Win-Final-downloader.exe:Blizzard Downloader
    "TCP Query User{EFF679D8-A571-41C8-9097-6D009425FFF8}c:\\program files\\world of warcraft\\world of warcraft\\world of warcraft\\repair.exe"= UDP:c:\program files\world of warcraft\world of warcraft\world of warcraft\repair.exe:Blizzard Repair Utility
    "UDP Query User{C6DD3040-93B6-4B22-9AA3-AC0041DF3E95}c:\\program files\\world of warcraft\\world of warcraft\\world of warcraft\\repair.exe"= TCP:c:\program files\world of warcraft\world of warcraft\world of warcraft\repair.exe:Blizzard Repair Utility
    "{8F16C087-9E09-476E-9653-28B6D03710FB}"= UDP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-3.0.2.9056-to-3.0.3.9183-enGB-downloader.exe:Blizzard Downloader
    "{30D23163-90AF-455E-BBFB-2A7A9D8A6950}"= TCP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-3.0.2.9056-to-3.0.3.9183-enGB-downloader.exe:Blizzard Downloader
    "{4ED71020-8DAB-461E-A011-FF9054A4F98F}"= UDP:3724:Blizzard Downloader: 3724
    "TCP Query User{A48F3969-7B98-4FEF-A123-7729F99FB69C}c:\\users\\toni kokko\\desktop\\lierox_v0.56_pack_1.9\\lierox v0.56 pack 1.9\\lierox.exe"= UDP:c:\users\toni kokko\desktop\lierox_v0.56_pack_1.9\lierox v0.56 pack 1.9\lierox.exe:lierox.exe
    "UDP Query User{9FDDD62B-6350-4110-AF53-4737FD530DBF}c:\\users\\toni kokko\\desktop\\lierox_v0.56_pack_1.9\\lierox v0.56 pack 1.9\\lierox.exe"= TCP:c:\users\toni kokko\desktop\lierox_v0.56_pack_1.9\lierox v0.56 pack 1.9\lierox.exe:lierox.exe
    "TCP Query User{D5ECF7FC-3CA4-4EBF-94E6-CE7E719C438D}c:\\users\\toni kokko\\desktop\\lierox_v0.56_pack_1.9\\lierox v0.56 pack 1.9\\lierox.exe"= UDP:c:\users\toni kokko\desktop\lierox_v0.56_pack_1.9\lierox v0.56 pack 1.9\lierox.exe:lierox.exe
    "UDP Query User{CEC1032E-1DF7-4CF6-B0BD-4B9ECFB8A640}c:\\users\\toni kokko\\desktop\\lierox_v0.56_pack_1.9\\lierox v0.56 pack 1.9\\lierox.exe"= TCP:c:\users\toni kokko\desktop\lierox_v0.56_pack_1.9\lierox v0.56 pack 1.9\lierox.exe:lierox.exe
    "{77FAE065-C5AB-4851-A183-EE612AF46CC8}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
    "{25634C9B-2C05-450D-B0AA-03952E3E3D3D}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
    "{66E0E986-796C-4553-8F29-3580DF0903B8}"= UDP:c:\program files\Malwarebytes' Anti-Malware\mbam.exe:Malwarebytes' Anti-Malware
    "{A052AC37-EA62-4011-B0FD-D1A0946168DA}"= TCP:c:\program files\Malwarebytes' Anti-Malware\mbam.exe:Malwarebytes' Anti-Malware
    "TCP Query User{C415CF1E-6660-4D46-80CE-899F0502C701}c:\\program files\\emule\\emule.exe"= Disabled:UDP:c:\program files\emule\emule.exe:eMule
    "UDP Query User{BCA21BF4-4166-4BB1-B95C-DA5C6CFDA864}c:\\program files\\emule\\emule.exe"= Disabled:TCP:c:\program files\emule\emule.exe:eMule
    "TCP Query User{26751923-DEFB-4A76-B360-5EE6BD2F1E8C}c:\\program files\\imesh applications\\imesh\\imesh.exe"= Disabled:UDP:c:\program files\imesh applications\imesh\imesh.exe:iMesh
    "UDP Query User{19B221A2-173E-4CE8-A4F5-DAD2A22BA0C5}c:\\program files\\imesh applications\\imesh\\imesh.exe"= Disabled:TCP:c:\program files\imesh applications\imesh\imesh.exe:iMesh
    "{4A3E76A5-F956-422C-A8B5-78D8DCE2B678}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
    "{42161E04-D772-488E-A978-0F12110F6EF8}"= UDP:c:\users\Toni Kokko\AppData\Local\Temp\WZSE0.TMP\SymNRT.exe:Norton Removal Tool
    "{C468BB28-F1EE-41BE-ADB4-0BCE04554273}"= TCP:c:\users\Toni Kokko\AppData\Local\Temp\WZSE0.TMP\SymNRT.exe:Norton Removal Tool
    "{633A8E51-2411-4FDE-B3CC-9DC01825D5C2}"= UDP:c:\windows\System32\WindowsAnytimeUpgrade.exe:Windows Anytime Upgrade
    "{2C14C3C3-87EE-41D3-A496-4AA3D1483D3F}"= TCP:c:\windows\System32\WindowsAnytimeUpgrade.exe:Windows Anytime Upgrade

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
    "c:\\Program Files\\BitTorrent\\bittorrent.exe"= c:\program files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent
    "c:\\Program Files\\xchat\\xchat.exe"= c:\program files\xchat\xchat.exe:*:Enabled:XChat IRC Client

    R2 BWH32S;BWH32S;"c:\program files\BUFFALO\clientmgrv\bin\BWH32S.exe" [2008-10-07 57912]
    R2 Ndiskio;Ndiskio;\??\c:\program files\Norman\Nse\bin\NDISKIO.SYS [2007-09-30 20448]
    R2 NVOY;Norman's Very Own supplY of resources;"c:\program files\Norman\npm\bin\nvoy.exe" [2008-03-24 121912]
    R3 nsesvc;Norman Scanner Engine Service;"c:\program files\Norman\nse\bin\NSESVC.EXE" -daemon [2008-06-26 322616]
    R3 NvcMFlt;NvcMFlt;c:\windows\system32\DRIVERS\nvcv32mf.sys [2008-09-04 19512]
    R3 nvcoas;Norman Virus Control on-access component;"c:\program files\Norman\Nvc\bin\nvcoas.exe" [2008-03-24 191544]
    R3 NVCScheduler;Norman Virus Control Scheduler;"c:\program files\Norman\Npm\bin\NVCSCHED.EXE" [2008-03-24 154680]
    R3 WLIU2KG125S;BUFFALO WLI-U2-KG125S Wireless LAN Adapter Driver;c:\windows\system32\DRIVERS\usb8023.sys [2008-05-24 15872]
    S3 Bufeap;BUFFALO EAP Driver;c:\windows\system32\DRIVERS\bufeap.sys [2008-10-07 14848]
    S3 netr73;RT73 USB Wireless LAN Card Driver for Vista;c:\windows\system32\DRIVERS\netr73.sys [2007-05-11 329728]
    S3 StickCap;Digital TV DVB-T USB Stick adapter service;c:\windows\system32\Drivers\stickcap.sys [2008-10-22 15744]
    S3 stickload;Digital TV stick firmware loader service;c:\windows\system32\DRIVERS\stickload.sys [2008-10-22 17024]
    S4 Automaattinen LiveUpdate-ajastustoiminto;Automaattinen LiveUpdate-ajastustoiminto;"c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" []

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
    \shell\AutoRun\command - G:\LaunchU3.exe -a

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{222a7df5-b2c2-11dc-9225-001b247c1e44}]
    \shell\AutoRun\command - E:\Setup.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7c0e6525-c9f4-11dd-9cb1-001601cfc4c2}]
    \shell\AutoRun\command - G:\LaunchU3.exe -a

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{96238bad-7562-11dc-93fe-001b247c1e44}]
    \shell\AutoRun\command - E:\setup.exe /autorun
    \shell\directx\command - e:\directx\dxsetup.exe
    \shell\setup\command - E:\setup.exe

    *Newly Created Service* - CATCHME
    *Newly Created Service* - MBAMSWISSARMY
    .
    'Ajoitetut tehtävät'-kansion sisältö

    2008-12-16 c:\windows\Tasks\GoogleUpdateTaskUser.job
    - c:\users\Toni Kokko\AppData\Local\Google\Update\GoogleUpdate.exe [2008-12-15 21:39]

    2008-12-16 c:\windows\Tasks\User_Feed_Synchronization-{C68C7EA6-5ACB-42EA-BD75-B52875D630F3}.job
    - c:\windows\system32\msfeedssync.exe [2008-01-18 22:33]
    .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-12-17 12:44:10
    Windows 6.0.6001 Service Pack 1 NTFS

    tarkistaa piilotettuja prosesseja ...

    tarkistaa piilotettuja käynnistysarvoja ...

    tarkistaa piilotettuja tiedostoja ...

    tarkistus on valmis
    piilotetut tiedostot: 0

    **************************************************************************
    .
    Valmistumisajankohta: 2008-12-17 13:08:10
    ComboFix-quarantined-files.txt 2008-12-17 11:08:04
    ComboFix2.txt 2008-12-16 14:13:18
    ComboFix3.txt 2008-12-15 20:29:49

    Ennen ajoa: 40 766 910 464 tavua vapaana
    Ajon jälkeen: 40,290,422,784 tavua vapaana

    401 --- E O F --- 2008-12-17 10:12:03

     
    tonikokko, 17.12.2008
    #48
  10. Hujo

    Hujo Guest

    Kirjoita suorita luukkuun

    ComboFix /u

    Paina OK

    ===============

    scannaa uusi hjt:n loki
     
    Hujo, 17.12.2008
    #49
  11. tonikokko

    tonikokko Regular member

    Liittynyt:
    09.12.2008
    Viestejä:
    109
    Kiitokset:
    0
    Pisteet:
    26
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 14:36:06, on 17.12.2008
    Platform: Windows Vista SP1 (WinNT 6.00.1905)
    MSIE: Internet Explorer v7.00 (7.00.6001.18000)
    Boot mode: Normal

    Running processes:
    C:\Windows\System32\smss.exe
    C:\Windows\system32\csrss.exe
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\csrss.exe
    C:\Windows\system32\services.exe
    C:\Windows\system32\lsass.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\winlogon.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Norman\Npm\Bin\eLogsvc.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\SLsvc.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Norman\Npm\Bin\Zanda.exe
    C:\Program Files\Norman\npm\bin\nvoy.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\BUFFALO\clientmgrv\bin\BWH32S.exe
    C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
    C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\DRIVERS\xaudio.exe
    C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
    C:\Windows\system32\taskeng.exe
    C:\Program Files\Norman\Npm\bin\NVCSCHED.EXE
    C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\HP\QuickPlay\QPService.exe
    C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
    C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
    C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
    C:\Program Files\Norman\Npm\Bin\Zlh.exe
    C:\Windows\ehome\ehtray.exe
    C:\Program Files\BUFFALO\clientmgrv\bin\cmvMain.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Windows\ehome\ehsched.exe
    C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
    C:\Windows\ehome\ehRecvr.exe
    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
    C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
    C:\Program Files\Windows Media Player\wmplayer.exe
    C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
    C:\Users\Toni Kokko\AppData\Local\Google\Update\GoogleUpdate.exe
    C:\Program Files\Xfire\Xfire.exe
    C:\Program Files\Xfire\Xfire.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\WUDFHost.exe
    C:\Program Files\Norman\nse\bin\NSESVC.EXE
    C:\Program Files\Norman\Nvc\Bin\Nip.exe
    C:\Program Files\Norman\Nvc\bin\nvcoas.exe
    C:\Program Files\Norman\Nvc\Bin\cclaw.exe
    C:\Windows\system32\conime.exe
    C:\Windows\Explorer.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Program Files\Steam\Steam.exe
    C:\Users\Toni Kokko\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Toni Kokko\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Toni Kokko\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Windows\system32\wbem\wmiprvse.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
    O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O3 - Toolbar: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
    O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
    O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
    O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
    O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
    O4 - HKLM\..\Run: [Norman ZANDA] "C:\Program Files\Norman\Npm\Bin\ZLH.EXE" /LOAD /SPLASH
    O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [Google Update] "C:\Users\Toni Kokko\AppData\Local\Google\Update\GoogleUpdate.exe" /c
    O4 - Global Startup: ClientManagerV.lnk = C:\Program Files\BUFFALO\clientmgrv\bin\cmvMain.exe
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
    O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O20 - AppInit_DLLs:
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: ArcSoft Connect Daemon (ACDaemon) - Unknown owner - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (file missing)
    O23 - Service: BWH32S - BUFFALO INC. - C:\Program Files\BUFFALO\clientmgrv\bin\BWH32S.exe
    O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
    O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
    O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - C:\Program Files\Norman\Npm\Bin\eLogsvc.exe
    O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
    O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: Norman NJeeves - Norman ASA - C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
    O23 - Service: Norman ZANDA - Norman ASA - C:\Program Files\Norman\Npm\Bin\Zanda.exe
    O23 - Service: Norman Scanner Engine Service (nsesvc) - Norman ASA - C:\Program Files\Norman\nse\bin\NSESVC.EXE
    O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Program Files\Norman\Nvc\bin\nvcoas.exe
    O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - C:\Program Files\Norman\Npm\bin\NVCSCHED.EXE
    O23 - Service: Norman's Very Own supplY of resources (NVOY) - Norman ASA - C:\Program Files\Norman\npm\bin\nvoy.exe
    O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
    O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
    O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

    --
    End of file - 9421 bytes

     
    tonikokko, 17.12.2008
    #50
  12. Hujo

    Hujo Guest

    Okos koneella järjestelmän valvojan oikeuksilla?
     
    Hujo, 17.12.2008
    #51
  13. tonikokko

    tonikokko Regular member

    Liittynyt:
    09.12.2008
    Viestejä:
    109
    Kiitokset:
    0
    Pisteet:
    26
    Se ei toimi se Suorita kohtaan Combofix /u
     
    tonikokko, 17.12.2008
    #52
  14. Hujo

    Hujo Guest

    Sitten poistat kuvakkeen työpöydältä

    resusinhalinasta
    CompoFix kansion
    c:asemlta CompoFix tekstitiedostot
    Qoobox kansio

     
    Hujo, 17.12.2008
    #53
  15. tonikokko

    tonikokko Regular member

    Liittynyt:
    09.12.2008
    Viestejä:
    109
    Kiitokset:
    0
    Pisteet:
    26
    nyt toimi se suorita homma sinne piti kirjoittaa ComboFix /u
    Nii sitte se poisti sen.
     
    tonikokko, 17.12.2008
    #54
  16. Hujo

    Hujo Guest

    Scannaa koneesi Kaspersky Online Scannerin

    Ohjelman käynnistyessä kysytään sallitaanko ActiveX -komponentin asentamisen Kasperskyltä, klikkaa Kyllä.
    " Ohjelma käynnistyy ja aloittaa viimeisimpien tunnistetiedostojen lataamisen.
    " Kun skanneri on asennettu ja tunnistetiedot ladattu, klikkaa Next.
    " Klikkaa nyt asetuksia, Scan Settings
    " Tarkista asetuksista, että seuraavat ovat valittuina:
    o Scan using the following Anti-Virus database:
    + Extended (Jos valittavissa, muuten valitse Standard)
    o Scan Options:
    + Scan Archives
    + Scan Mail Bases
    " Klikkaa OK
    " Nyt valitse "select a target to scan" otsikon alta Oma Tietokone, My Computer
    " Skannaus vie aikaa, joten ole kärsivällinen. Kun skannaus on valmis saat ilmoituksen, jos koneesi on saastunut.
    " Klikkaa nyt Save as Text-painiketta.
    " Tallenna tiedosto työpöydällesi.
    " Mikäli haluat jatkaa asian käsittelyä foorumissa niin kopioi tiedoston sisältö viestiisi.
     
    Hujo, 17.12.2008
    #55
  17. tonikokko

    tonikokko Regular member

    Liittynyt:
    09.12.2008
    Viestejä:
    109
    Kiitokset:
    0
    Pisteet:
    26
    Mitä sit teen jos on viruksii?
     
    tonikokko, 17.12.2008
    #56
  18. Hujo

    Hujo Guest

    pistä tuo loki tänne
     
    Hujo, 17.12.2008
    #57
  19. tonikokko

    tonikokko Regular member

    Liittynyt:
    09.12.2008
    Viestejä:
    109
    Kiitokset:
    0
    Pisteet:
    26
    Skaannannu on 5% ja aikaa kulunu päälle 20min mitäs veikkaat moneen ko asti tässä menee?

     
    tonikokko, 17.12.2008
    #58
  20. Hujo

    Hujo Guest

    riipuu kaman määrästä koneella
     
    Hujo, 18.12.2008
    #59
  21. tonikokko

    tonikokko Regular member

    Liittynyt:
    09.12.2008
    Viestejä:
    109
    Kiitokset:
    0
    Pisteet:
    26
    No täällähän on paljon ohjelmia koneel.
     
    tonikokko, 19.12.2008
    #60
Sivu 3 / 4

Jaa tämä sivu