Turvapc on ja pysyy, kuinka poistaa? Mitä sanoo HjT?

Viestiketju Virukset ja haittaohjelmat - HijackThis -logit -osiossa. Ketjun avasi Hadassa 29.02.2008.

  1. Hadassa

    Hadassa Member

    Liittynyt:
    29.02.2008
    Viestejä:
    15
    Kiitokset:
    0
    Pisteet:
    11
    Luin erään aiemman neuvon turvapc-häirikön poistamiseksi (SDFix:in ajaminen), enkä onnistunut. Spybot S&D ei reagoi, kuten ei myöskään Normanin virustorjuntakaan. Pyytäisinkin nyt apua minulle upouuden ohjelman lokin tulkkaamisessa ja sitkeän prötön poistamisessa:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 18:27:35, on 29.2.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Belkin\Bluetooth-ohjelmisto\bin\btwdins.exe
    C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    C:\Norman\Npf\BIN\NPFSVICE.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\system32\fxssvc.exe
    C:\WINDOWS\system32\slrundll.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\alg.exe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
    C:\Norman\bin\ZLH.EXE
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
    C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\ALCWZRD.EXE
    C:\WINDOWS\ALCMTR.EXE
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\WINDOWS\system32\RunDLL32.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\system32\sgp71xedew.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\Belkin\Bluetooth-ohjelmisto\BTTray.exe
    C:\Program Files\Nikon\NkView6\NkvMon.exe
    C:\Program Files\Nokia\PC Suite for N-Gage QD\connmngmntbox.exe
    C:\Program Files\Nokia\PC Suite for N-Gage QD\ectaskscheduler.exe
    C:\Program Files\Intuwave\Shared\mRouterRunTime\mRouterRuntime.exe
    C:\PROGRA~1\Nokia\PCSUIT~1\Elogerr.exe
    C:\PROGRA~1\Nokia\PCSUIT~1\BROADC~1.EXE
    C:\PROGRA~1\Nokia\PCSUIT~1\SCRFS.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Norman\Npf\Bin\Npfc.exe
    C:\Norman\Npf\Bin\npfmsg2.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\WINDOWS\System32\wbem\wmiprvse.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://haku.soneraplaza.fi/haku/queryie5.jsp
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.soneraplaza.fi
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja Sonera Internet
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.dial.inet.fi:800
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;*.*.fi;*.*.*.fi;<local>
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {186962BB-D1BA-47CE-8CB8-8E55D6341058} - C:\WINDOWS\system32\certmgrn.dll
    O2 - BHO: Need2Find Bar BHO - {4D1C4E81-A32A-416b-BCDB-33B3EF3617D3} - C:\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLL (file missing)
    O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: RXResultTracker Class - {59879FA4-4790-461c-A1CC-4EC4DE4CA483} - C:\Program Files\RXToolBar\sfcont.dll (file missing)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O2 - BHO: (no name) - {DDFDDBE4-7934-482D-A359-926B5CA42AFB} - c:\windows\system32\6to4svcc.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
    O4 - HKLM\..\Run: [High Definition Audio -ominaisuussivun pikakuvake] HDAudPropShortcut.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [TVTray] C:\PROGRA~1\TVAV~1\TVAV~1\TVTray.exe
    O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    O4 - HKLM\..\Run: [EPSON Stylus C62 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C62 Series" /O3 "USB" /M "Stylus C62"
    O4 - HKLM\..\Run: [EPSON Stylus C62 Series (Kopioi 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P34 "EPSON Stylus C62 Series (Kopioi 1)" /O6 "USB001" /M "Stylus C62"
    O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
    O4 - HKLM\..\Run: [AceGain LiveUpdate] C:\Games\AceGain\LiveUpdate\LiveUpdate.exe
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
    O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [Mirabilis ICQ] C:\PROGRA~1\ICQ\ICQNet.exe
    O4 - HKLM\..\Run: [PD0630 STISvc] RunDLL32.exe P0630Pin.dll,RunDLL32EP 513
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [YeppStudioAgent] C:\Program Files\Samsung\SamsungMediaStudio4.1\SamsungMediaStudioAgent.exe
    O4 - HKLM\..\Run: [TalkAndWrite] C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\1163D2B46CC742E5A3CC9E4157887751\TalkAndWrite.exe /run
    O4 - HKLM\..\Run: [sgp71xedew] C:\WINDOWS\system32\sgp71xedew.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
    O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
    O4 - HKCU\..\Run: [sgp71xedew] C:\WINDOWS\system32\sgp71xedew.exe
    O4 - HKCU\..\Policies\Explorer\Run: [{302316AF-0C81-1035-0407-050906040166}] "C:\Program Files\Common Files\{302316AF-0C81-1035-0407-050906040166}\Update.exe" mc-110-12-0000904
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: BTTray.lnk = ?
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
    O4 - Global Startup: PCSuiteForNokiaN-Gage QD Detect.lnk = ?
    O4 - Global Startup: PCSuiteForNokiaN-Gage QD TS.lnk = ?
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
    O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth-ohjelmisto\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth-ohjelmisto\btsendto_ie.htm
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
    O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} -
    O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
    O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safety.live.com/resource/download/scanner/wlscbase8460.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O18 - Filter hijack: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - C:\Program Files\RXToolBar\sfcont.dll
    O20 - Winlogon Notify: zifczjrn - C:\WINDOWS\SYSTEM32\6to4svcc.dll
    O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\Belkin\Bluetooth-ohjelmisto\bin\btwdins.exe
    O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\NORMAN\Nvc\BIN\nipsvc.exe
    O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE
    O23 - Service: Norman Type-R - Unknown owner - C:\Norman\Npf\BIN\NPFSVICE.EXE
    O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\bin\ZANDA.EXE
    O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\NORMAN\Nvc\BIN\nvcoas.exe
    O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

    --
    End of file - 12447 bytes
     
    Hadassa, 29.02.2008
    #1
  2.  
  3. Hujo

    Hujo Guest

    Poista lisää poista sovelutuksesta

    Need2Find
    Megaupload Toolbar
    RXToolBar

    Poista kansiot vikasiedossa

    C:\Program Files\Need2Find
    C:\Program Files\RXToolBar
    C:\PROGRA~1\MEGAUP~1

    Scannaa hjt:llä merkkaa paina Fix checked

    O2 - BHO: Need2Find Bar BHO - {4D1C4E81-A32A-416b-BCDB-33B3EF3617D3} - C:\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLL (file missing)
    O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
    O2 - BHO: RXResultTracker Class - {59879FA4-4790-461c-A1CC-4EC4DE4CA483} - C:\Program Files\RXToolBar\sfcont.dll (file missing)
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE


    =====================

    1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
    combofix1
    combofix2

    2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

    ===============

    Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

    Käynnistä koneesi vikasietotilaan:

    sammuta ja käynnistä
    käynnistyksen yhteydessä hakkaa F8 nappia
    valitse nuolinäppäimellä vikasietotila
    paina enter ja enter
    valitse käyttäjätilisi
    paina kyllä

    Jossakin koneissa hakataan F8:sin sijasta F5:tä

    " Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
    " Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
    " Paina Y käynnistääksesi skriptin.
    " Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
    " Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
    " Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
    " Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
    " Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
    " Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.
     
    Moderaattorin viimeksi muokkaama: 29.02.2008
    Hujo, 29.02.2008
    #2
  4. Hadassa

    Hadassa Member

    Liittynyt:
    29.02.2008
    Viestejä:
    15
    Kiitokset:
    0
    Pisteet:
    11
    ComboFix 08-02-25.3 - Jesse 2008-02-29 20:54:57.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.179 [GMT 2:00]
    Running from: C:\DOCUMENTS AND SETTINGS\JESSE\OMAT TIEDOSTOT\Omat lataukset\ComboFix.exe
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Program Files\Common Files\{30231~1
    C:\Program Files\Common Files\{30231~1\Uninst.exe
    C:\WINDOWS\Fonts\acrsecB.fon
    C:\WINDOWS\Fonts\acrsecI.fon
    C:\WINDOWS\smdat32m.sys
    C:\WINDOWS\system32\6to4svcc.dll . . . . poisto epäonnistui

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

    .
    -------\LEGACY_QFXSEKWX
    -------\nm
    -------\qfxsekwx


    ((((( Tiedostot, jotka on luotu seuraavalla aikav„lill„: 2008-01-28 to 2008-02-29 )))))))))))))))))
    .

    2008-02-29 18:26 . 2008-02-29 18:26 <KANSIO> d-------- C:\Program Files\Trend Micro
    2008-02-28 19:39 . 2008-02-28 20:33 <KANSIO> d-------- C:\Documents and Settings\Jesse\Application Data\My The Lord of the Rings, The Rise of the Witch-king Files
    2008-02-27 21:40 . 2008-02-27 22:17 <KANSIO> d-------- C:\Documents and Settings\Jesse\.scorched3d
    2008-02-26 20:43 . 2008-02-26 20:43 <KANSIO> d-------- C:\Program Files\Spybot - Search & Destroy
    2008-02-24 15:48 . 2008-02-24 15:48 <KANSIO> d-------- C:\WINDOWS\ERUNT
    2008-02-24 15:47 . 2008-02-24 16:06 <KANSIO> d-------- C:\SDFix
    2008-02-21 20:44 . 2008-02-21 20:44 230 --a------ C:\WINDOWS\system32\spupdsvc.inf
    2008-02-21 03:57 . 2008-02-21 03:57 54,608 --a------ C:\WINDOWS\system32\xfcodec.dll
    2008-02-13 20:16 . 2008-02-13 20:16 1,188,375 --a------ C:\WINDOWS\system32\libeay32.dll
    2008-02-13 20:16 . 2008-02-13 20:16 741,632 --a------ C:\WINDOWS\system32\piteecjf.dat
    2008-02-13 20:16 . 2008-02-13 20:16 246,545 --a------ C:\WINDOWS\system32\libssl32.dll
    2008-02-13 20:16 . 2008-02-28 17:01 42,752 --a------ C:\WINDOWS\system32\qqtsiokb.dat
    2008-02-13 20:16 . 2008-02-19 21:29 36,608 --a------ C:\WINDOWS\system32\cptxhyyk.dat
    2008-02-13 20:16 . 2008-02-13 20:16 35,072 --a------ C:\WINDOWS\system32\omybzore.dat
    2008-02-12 21:32 . 19,712 C:\WINDOWS\system32\drivers\yanfikuf.dat
    2008-02-12 20:07 . 2008-02-12 20:07 120,576 --a------ C:\WINDOWS\system32\wgkblftv.dat
    2008-02-12 20:00 . 2008-02-20 18:23 <KANSIO> d-------- C:\WINDOWS\system32\AppCert
    2008-02-12 20:00 . 2008-02-29 20:57 86,528 --a------ C:\WINDOWS\system32\6to4svcc.dll
    2008-02-12 20:00 . 2006-08-16 13:58 86,016 --a------ C:\WINDOWS\system32\6to4svcc.dll.bak
    2008-02-12 20:00 . 2006-11-28 17:56 17,920 --a------ C:\WINDOWS\system32\sgp71xedew.exe
    2008-02-12 19:59 . 2008-02-24 10:44 104,192 --a------ C:\WINDOWS\system32\certmgrn.dll
    2008-02-08 19:19 . 2008-02-28 11:35 43,520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-02-29 19:02 --------- d-----w C:\Program Files\Steam
    2008-02-29 18:51 5 ----a-w C:\NPF_USER.DAT
    2008-02-29 15:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\NPF
    2008-02-29 15:49 --------- d-----w C:\Program Files\ICQ
    2008-02-29 11:22 --------- d-----w C:\Documents and Settings\Jesse\Application Data\Skype
    2008-02-29 05:56 --------- d-----w C:\Documents and Settings\Kari\Application Data\MEGAUPLOADTOOLBAR
    2008-02-29 05:53 --------- d-----w C:\Documents and Settings\Kari\Application Data\Skype
    2008-02-28 19:32 --------- d-----w C:\Documents and Settings\Jesse\Application Data\Xfire
    2008-02-26 22:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-02-21 18:07 45,034 ----a-w C:\Documents and Settings\Kari\Application Data\wklnhst.dat
    2008-02-20 21:09 --------- d-----w C:\Program Files\WinMX
    2008-01-29 11:23 --------- d-----w C:\Documents and Settings\Kari\Application Data\Nokia
    2008-01-20 20:14 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-01-06 18:33 4,264 ----a-w C:\Documents and Settings\Jesse\Application Data\wklnhst.dat
    2008-01-04 11:43 --------- d-----w C:\Program Files\Java
    2008-01-01 22:47 --------- d-----w C:\Documents and Settings\Kari\Application Data\MSN6
    2007-10-16 16:50 86,488 ----a-w C:\Documents and Settings\Kari\Application Data\GDIPFONTCACHEV1.DAT
    2007-10-06 03:56 116 ----a-w C:\Program Files\Part.002
    2006-05-30 10:01 32 ----a-r C:\Documents and Settings\All Users\hash.dat
    2006-04-08 18:27 4,402 -c--a-w C:\Documents and Settings\fusi\Application Data\wklnhst.dat
    2006-04-04 16:17 10,046,792 ----a-w C:\Program Files\SkypeSetup.exe
    2005-12-28 19:20 4,577,316 ----a-w C:\Program Files\eMule_v0.46c-Installer.exe
    2005-11-01 13:32 6,279,168 ----a-w C:\Program Files\epson1179eu.exe
    2005-10-04 16:44 38,747 ----a-w C:\Program Files\PIEPatch2.5.exe
    2005-09-29 16:46 457 -c--a-w C:\Program Files\INSTALL.LOG
    2005-09-26 10:36 47,466 ----a-w C:\Program Files\WinMX_patch_for_win_2k_and_xp.exe
    2005-09-26 10:28 799,471 ----a-w C:\Program Files\winmx354beta4.zip
    2005-09-22 15:04 598,984 ----a-w C:\Program Files\kazaa_setup.exe
    2005-09-05 14:06 195,909,104 ----a-w C:\Program Files\CGS12_TBYB_EN.exe
    2005-09-02 12:38 1,362,517 ----a-w C:\Program Files\mdraw.zip
    2005-04-27 06:45 823,296 ----a-w C:\Program Files\winmx353.exe
    2005-04-18 18:08 3,130,340 ----a-w C:\Program Files\DCPlusPlus-0.674.exe
    2005-03-22 11:30 10,511,904 ----a-w C:\Program Files\RealPlayer10-5GOLD.exe
    2005-01-27 16:46 153,517 ----a-w C:\Program Files\code39.zip
    2005-01-20 13:47 3,156,389 ----a-w C:\Program Files\KaraWinStd.exe
    .

    (((((((((((((((((((((((((((((( Rekisterin k„ynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhji„ arvoja ja laillisia oletusarvoja ei n„ytet„

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{186962BB-D1BA-47CE-8CB8-8E55D6341058}]
    2008-02-24 10:44 104192 --a------ C:\WINDOWS\system32\certmgrn.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DDFDDBE4-7934-482D-A359-926B5CA42AFB}]
    2008-02-29 20:57 86528 --a------ c:\windows\system32\6to4svcc.dll

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 01:12 15360]
    "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55 5674352]
    "googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-01 23:22 3739648]
    "Steam"="C:\Program Files\Steam\Steam.exe" [2007-12-22 16:04 1266936]
    "sgp71xedew"="C:\WINDOWS\system32\sgp71xedew.exe" [2006-11-28 17:56 17920]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Wizard"="" []
    "High Definition Audio -ominaisuussivun pikakuvake"="HDAudPropShortcut.exe" [2004-03-18 01:10 61952 C:\WINDOWS\system32\Hdaudpropshortcut.exe]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-05-07 00:14 5562368]
    "nwiz"="nwiz.exe" [2005-05-07 00:14 1495040 C:\WINDOWS\system32\nwiz.exe]
    "TVTray"="C:\PROGRA~1\TVAV~1\TVAV~1\TVTray.exe" [2004-09-10 10:14 245760]
    "Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2003-06-10 02:11 50688]
    "EPSON Stylus C62 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.exe" [2002-07-01 05:05 74752]
    "EPSON Stylus C62 Series (Kopioi 1)"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.exe" [2002-07-01 05:05 74752]
    "Norman ZANDA"="C:\Norman\bin\ZLH.exe" [2006-05-31 10:22 135168]
    "AceGain LiveUpdate"="C:\Games\AceGain\LiveUpdate\LiveUpdate.exe" [ ]
    "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-09-15 01:12 110592 C:\WINDOWS\system32\bthprops.cpl]
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-05-03 17:12 98304]
    "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
    "PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2005-03-22 08:39 167936]
    "DataLayer"="C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe" [2005-03-31 08:30 1106944]
    "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2005-08-30 19:43 180269]
    "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-05-07 00:14 86016]
    "SoundMan"="SOUNDMAN.EXE" [2005-04-06 11:57 90112 C:\WINDOWS\SOUNDMAN.EXE]
    "AlcWzrd"="ALCWZRD.EXE" [2005-04-06 11:53 2805248 C:\WINDOWS\ALCWZRD.EXE]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
    "Mirabilis ICQ"="C:\PROGRA~1\ICQ\ICQNet.exe" [2003-10-14 18:36 38984]
    "PD0630 STISvc"="P0630Pin.dll" [2005-06-05 19:01 36864 C:\WINDOWS\system32\P0630Pin.dll]
    "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-02-23 15:45 278528]
    "YeppStudioAgent"="C:\Program Files\Samsung\SamsungMediaStudio4.1\SamsungMediaStudioAgent.exe" [ ]
    "TalkAndWrite"="C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\1163D2B46CC742E5A3CC9E4157887751\TalkAndWrite.exe" [2007-07-26 00:18 2664448]
    "sgp71xedew"="C:\WINDOWS\system32\sgp71xedew.exe" [2006-11-28 17:56 17920]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-15 01:12 15360]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run]
    "{302316AF-0C81-1035-0407-050906040166}"= "C:\Program Files\Common Files\{302316AF-0C81-1035-0407-050906040166}\Update.exe" mc-110-12-0000904

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\appcertdlls]
    appsecdll REG_EXPAND_SZ C:\WINDOWS\system32\AppCert\wsil32.dll

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\Intuwave\\Shared\\mRouterRunTime\\mRouterRuntime.exe"=
    "C:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "C:\\Program Files\\iTunes\\iTunes.exe"=
    "C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\MSN Messenger\\livecall.exe"=
    "C:\\Games\\Electronic Arts\\The Battle for Middle-earth (tm) II\\game.dat"=
    "C:\\Games\\Electronic Arts\\The Lord of the Rings, The Rise of the Witch-king\\game.dat"=
    "C:\\Program Files\\Skype\\Phone\\Skype.exe"=

    R0 cetscehi;cetscehi;C:\WINDOWS\system32\drivers\yanfikuf.dat []
    R0 NDIS_RD;Firewall Engine Type-R2;C:\WINDOWS\system32\drivers\NDIS_RD.sys [2004-12-06 10:18]
    R1 TDI_RD;Firewall Engine Type-R;C:\WINDOWS\system32\drivers\tdi_rd.sys [2004-10-13 22:01]
    R2 Ndiskio;Ndiskio;c:\norman\nse\bin\ndiskio.sys [2003-05-13 10:38]
    R2 nvcap;nVidia WDM Video Capture (universal);C:\WINDOWS\system32\DRIVERS\nvcap.sys [2004-09-20 08:59]
    R2 NVXBAR;nVidia WDM A/V Crossbar;C:\WINDOWS\system32\DRIVERS\NVxbar.sys [2004-09-20 08:59]
    R3 Cap7134;713x TV Card Capture;C:\WINDOWS\system32\DRIVERS\Cap7134.sys [2004-06-22 03:57]
    R3 P0630VID;Creative WebCam Live!;C:\WINDOWS\system32\DRIVERS\P0630Vid.sys [2005-06-06 03:44]
    R3 PCnetHL;AMD PCnet-Home Adapter Driver;C:\WINDOWS\system32\DRIVERS\pcntn5hl.sys [2001-08-17 20:11]
    R3 PhTVTune;TV AV WDM TVTuner (FM1216ME);C:\WINDOWS\system32\DRIVERS\PhTVTune.sys [2004-10-09 07:10]
    S3 AN983;ADMtek AN983/AN985/ADM951X 10/100Mbps Fast Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\AN983.sys [2005-01-13 10:28]
    S3 nvcfsr;nvcfsr;C:\NORMAN\Nvc\BIN\nvcfsr.sys [2004-11-05 09:47]
    S3 nvcoafl51;nvcoafl51;C:\NORMAN\Nvc\BIN\nvcoafl51.sys [2005-05-13 14:20]
    S3 nvcoaft51;nvcoaft51;C:\NORMAN\Nvc\BIN\nvcoaft51.sys [2006-06-14 13:39]
    S3 nvcoarc51;nvcoarc51;C:\NORMAN\Nvc\BIN\nvcoarc51.sys [2005-05-13 14:10]
    S3 nvcoas;Norman Virus Control on-access component;C:\NORMAN\Nvc\BIN\nvcoas.exe [2006-06-15 11:42]
    S3 NVCScheduler;Norman Virus Control Scheduler;C:\NORMAN\Nvc\BIN\NVCSCHED.EXE [2005-01-12 10:22]

    .
    'Ajoitetut teht„v„t'-kansion sis„lt”
    "2008-02-29 19:03:02 C:\WINDOWS\Tasks\Tarkistetaan Windows Live -työkalurivin päivitykset.job"
     
    Hadassa, 29.02.2008
    #3
  5. Hadassa

    Hadassa Member

    Liittynyt:
    29.02.2008
    Viestejä:
    15
    Kiitokset:
    0
    Pisteet:
    11

    SDFix: Version 1.146

    Run by J„rjestelm„nvalvoja on pe 29.02.2008 at 21:27

    Microsoft Windows XP [versio 5.1.2600]
    Running From: C:\SDFix

    Checking Services :


    Restoring Windows Registry Values
    Restoring Windows Default Hosts File

    Rebooting


    Checking Files :

    No Trojan Files Found






    Removing Temp Files

    ADS Check :



    Final Check :

    catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-02-29 21:34:38
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden services & system hive ...

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000a3a5bfecc]
    "000e6d43b813"=hex:3f,96,a9,52,44,da,cf,47,15,85,91,76,ca,eb,8f,26
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\000a3a5bfecc]
    "000e6d43b813"=hex:3f,96,a9,52,44,da,cf,47,15,85,91,76,ca,eb,8f,26
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Control\Session Manager]
    "PendingFileRenameOperations"=str(7):"\x6264\2\x55a0\v\0\0\xffc8\xffff\x6b76\e\4\x8000\x258\0\4\0\1\n\x6544\x6166\x6c75\x5374\x7465\x6974\x676e\x2e73\x5259\x7365\x6c6f\x7475\x6f69n%S\xffe0\xffffnvdisp.nvu\0\0\0\0\xffe0\xffff\x6b76\4,\0\x4fd0\v\1\0\1\0\x614e\x656d\0\0\xffd0\xffffNVIDIA Display Driver\0\x6268\x6e69\x5000\v\x1000\0\0\0\0\0\0\0\0\0\0\0\xffc0\xffff\x6b76"\4\x8000\4\0\4\0\1,\x6f5f\x696e\x652e\x6578\x4f3a\x4c47\x455f\x7478\x6e65\x6973\x6e6f\x7453\x6972\x676e\x564e\x7241\x6863SC2\xffc8\xffff\x6828\n\x66e0\n\x6858\n\x6888\n\x65f0\n\x6a08\n\x6a58\n\x4f58\v\x6a38\n\x5520\v\x6260\v\x5890\vF.\xffc0\xffff\x6b76#\4\x8000\1\0\3\0\0013\x585f\x3932\x452e\x4558\x4f3a\x6c67\x455f\x7478\x6e65\x6973\x6e6f\x7453\x6972\x676e\x6556\x7372\x6f69n&T\xffa8\xffff\x6b6e \x158e\xd021\xafbc\x1c5\0\0\x56c0Y\1\0\0\0\x60a0\v\xffff\xffff\0\0\xffff\xffff\x68c8\n\xffff\xffff\16\0\0\0\0\0\0\0\0\0\a\0\x6944\x7073\x616cy\xffa8\xffff\x6b6e \x158e\xd021\xafbc\x1c5\0\0\x50d8\v\1\0\0\0\x62e0\v\xffff\xffff\0\0\xffff\xffff\x68c8\n\xffff\xffff*\0\0\0\0\0\0\0\0\0\a\0\x6873\x6c65\x656cx\xff98\xffff\x6b6e \x158e\xd021\xafbc\x1c5\0\0\x5130\v\1\0\0\0\x6660\v\xffff\xffff\0\0\xffff\xffff\x68c8\n\xffff\xffff(\0\0\0\0\0\0\0\0\0\25\0\x7250\x706f\x7265\x7974\x6853\x6565\x4874\x6e61\x6c64\x7265s,\xff98\xffff\x6b6e \x158e\xd021\xafbc\x1c5\0\0\x5188\v\0\0\0\0\xffff\xffff\xffff\xffff\1\0\xb340\2\x68c8\n\xffff\xffff\0\0\0\0\0\0N\0\0\0\24\0\x564e\x4449\x4149\x4320\x4c50\x4520\x7478\x6e65\x6973\x6e6f0,\xffa8\xffff{FFB699E0-306A-11d3-8BD1-00104B6F7516}\0NQ7\xffe0\xffff\x6b76\a\b\0\x6a18\v\1\0\1R\x6553\x7672\x6369e\xfe60\xffffR&T0000=*,*,*,*,*,IBM251F.VSC2F0C.VSC3411.VSC3E19,HDLK\0R&T0001=1920,1080,*,30,*,CRTX,OEM,7425,2200,48,56,562,2,5,++I\0R&T0002=1920,1080,*,60,*,BNQ766A,ADD,CVTRB\0R&T0003=1920,1200,*,60,*,BNQ766A,ADD,CVTRB\0\0lp\xffc0\xffff\x6b76"\4\x8000\4\0\4\0\1N\x6f5f\x696e\x652e\x6578\x4f3a\x4c47\x455f\x7478\x6e65\x6973\x6e6f\x7453\x6972\x676e\x564e\x7241\x6863sel\xffd0\xffff\x6b76\25\4\x8000\a\0\4\0\1\0\x6544\x5376\x6977\x6374\x5368\x7075\x7270\x7365\x4d73\x7361\x466b\v\xffe0\xffff\x6b76\b\xade\0 !\a\0\1\0\x564e\x4d5f\x646f\x7365\b\0\x6174\0\xffe8\xffff\x7678\v\x7258\v\x9b78\v\x9b78\vm\0\xffc0\xffff\x6b76"\4\x8000\4\0\4\0\1\0\x6f5f\x696e\x652e\x6578\x4f3a\x4c47\x455f\x7478\x6e65\x6973\x6e6f\x7453\x6972\x676e\x564e\x7241\x6863\x6166\x6c75\x5374\xffe8\xffffisapnp\0n00\xffd8\xffff\x6b76\v\30\0\x62c0\v\1\0\1\0\x6e55\x6e69\x7473\x6c61\x656cr\0\0\xfff0\xffff\x7020A\xf020@\0\0\xffd8\xffff\x6b76\16\b\0\x6148\v\3\0\1\0\x7244\x7669\x7265\x6144\x6574\x6144\x6174\0\xffd8\xffff\x6b76\20,\0\x56a0\v\1\0\1,\x614d\x6374\x6968\x676e\x6544\x6976\x6563\x6449\xffd8\xffff\x6b76\n\24\0\x3fb8\v\1\0\1\0\x7244\x7669\x7265\x6144\x6574\0\0\0\xffd8\xffff\x6b76\r\26\0\x5650\v\1\0\1\0\x7244\x7669\x7265\x6556\x7372\x6f69n\0\xffe0\xffff7.0.0.1011\0\0\0\0\xffe0\xffff\x6b76\5\f\0\x5690\v\1\0\1\0\x6c43\x7361s\0\xfff0\xffffMEDIA\0\xffd0\xffffpci\ven_8086&dev_266f\0\xffd8\xffff\x6b76\nt\0\x56f8\v\1\0\1\0\x7244\x7669\x7265\x6544\x6373\0\0\0\xff88\xffffIntel(R) 82801FB/FBM Ultra ATA Storage Controllers - 266F\0\xffc8\xffff\x3e58\v\x3ef0\v\x3f20\v\x3f48\v\x61e8\v\x3f78\v\x3fd8\v\x55b0\v\x5600\v\x5628\v\x55d8\v\x56d0\vt\0\xffe8\xffff\x6b76\0<\0\x57c0\v\1\0\0\0\xffc0\xffff\xc4\xe4ni-, video- ja peliohjaimet\0\xfff0\xffff3004\0\a\xffd8\xffff\x6b76\v<\0\x5838\v\1\0\1\0\x6e49\x7473\x6c61\x656c\x33722\0\0\xffc0\xffffMmSys.Cpl,MediaClassInstaller\0\xffe8\xffff\x9358\v\x6d70\30\x6d98\30\x2190\31\x9688\v\xffd0\xffff\x6b76\22(\0\x58c0\v\1\0\1,\x6544\x6976\x6563\x4420\x7365\x7263\x7069\x6974\x6e6f\x7365\x6c6f\x7475\xffd0\xffffNVIDIA GeForce 6600\0\x455f\x7478\xfff0\xffffpci\0\x564e\x7241\b\0,O\xffe8\xffff\3\0\1\0\2\0\3\0\x9aa8\0\xfe60\xffffR&T0000=*,*,*,*,*,IBM251F.VSC2F0C.VSC3411.VSC3E19,HDLK\0R&T0001=1920,1080,*,30,*,CRTX,OEM,7425,2200,48,56,562,2,5,++I\0R&T0002=1920,1080,*,60,*,BNQ766A,ADD,CVTRB\0R&T0003=1920,1200,*,60,*,BNQ766A,ADD,CVTRB\0\00019\xfe60\xffffR&T0000=*,*,*,*,*,IBM251F.VSC2F0C.VSC3411.VSC3E19,HDLK\0R&T0001=1920,1080,*,30,*,CRTX,OEM,7425,2200,48,56,562,2,5,++I\0R&T0002=1920,1080,*,60,*,BNQ766A,ADD,CVTRB\0R&T0003=1920,1200,*,60,*,BNQ766A,ADD,CVTRB\0\00019\xffe0\xffff\x6b76\a\16\0\x5560\v\1\0\0014\x6553\x7672\x6369e\xffe0\xffff\x6b76\a\b\0\x6dd0\v\1\0\0010\x6553\x7672\x6369e\xffe0\xffff\x6b76\a\b\0\x58f0\v\1\0\0010\x6553\x7672\x6369e\xffe0\xffff\x6b76\a\b\0\x6f98\v\1\0\0012\x6553\x7672\x6369e\xffe0\xffff\x6b76\a\b\0\x5d00\v\1\0\1S\x6553\x7672\x6369e\xfff0\xffffpci\00036\xffe0\xffff\x6b76\a\22\0\x5d30\v\1\0\0011\x6553\x7672\x6369e\xffe8\xffffintelide\0000\xffe0\xffff\x6b76\a\22\0\x5d68\v\1\0\0010\x6553\x7672\x6369e\xffe8\xffffintelide\0002\xffd8\xffff\x6b76\0162\0\x5da8\v\a\0\0017\x6f43\x6e69\x7473\x6c61\x656c\x7372\x3233x\xffc8\xffffcoinst.dll,_MyCoInst@16\0\0000\xffd8\xffff\x6b76\f*\0\x5e08\v\1\0\0013\x7246\x6569\x646e\x796c\x614e\x656dx1\xffd0\xffffSmart Link 56K Modem\0;\xffe0\xffff\x6b76\b\4\x8000\1\0\4\0\1,\x4955\x754e\x626d\x7265\xffd8\xffff\x6b76\f"\0\xa6d8\r\a\0\0010\x6f4c\x6577\x4672\x6c69\x6574\x737232\xffe8\xffff<\0\0\0\0\0\1\0\x393\0\xffd8\xffff\x6b76\17F\0\x5ec0\v\1\0\0013\x6e45\x6d75\x7250\x706f\x6150\x6567\x33732\xffb0\xffffmodemui.dll,ModemPropPagesProvider\000600\xffe0\xffff\x6b76\3\34\0\x5f30\v\3\0\18\x4344B1D\xffe0\xffff\34\0\x800\a\x2015\0\0\n\n\b\x1100\23\0\0\xffa8\xffff\x6b6e \xe210\x3d8c\xafbd\x1c5\0\0\x7580\v\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x6ee0\2\x28d0\n\xffff\xffff\0\0\0\0\2\0L\0\6\0\4\0\x6e49\x7469 1\xffe0\xffff\x6b76\1\16\0\x5fc8\v\1\0\00121x14\xffe8\xffffAT<cr>\000536\xffe0\xffff\x6b76\1L\0\xde20\v\1\0\1\v2\0\x6361\x7363\x6268\x6e69\x6000\v\x1000\0\0\0\0\0\0\0\0\0\0\0\xffe0\xffff\x6b76\6\26\0\x4f90\v\1\0\1\0\x6353\x6972\x7470\0\xfff0\xffffIntel\0\xffc8\xffff\x6b76\e\4\x8000\1\0\3\0\1\n\x764e\x7043\x446c\x7369\x6c70\x7961\x7654\x6f4c\x6163\x656c\x6956\x6973\x6574d*,\xffe8\xffff\x6b76\08\0\x3b28\v\1\0\0\6\xfff0\xffff\x686c\1\x5130\v\x461\xc6a9\xffe0\xffffintelide\0st\0\0\0\xffd8\xffff\x6b76\f\f\0\x60f8\v\1\0\1\0\x7250\x766f\x6469\x7265\x614e\x656d\0\0\xffe8\xffffIntel\0oft\0\xffd8\xffff\x6b76\16\b\0\x6138\v\3\0\1\0\x7244\x7669\x7265\x6144\x6574\x6144\x6174\0\xfff0\xffff\x4000\x53da\xf6a7\x1c4\0\0\xfff0\xffff\x4000\x53da\xf6a7\x1c4\0\0\b\0\x61e8\v\xffd8\xffff\x6b76\n\24\0\x6188\v\1\0\1\0\x7244\x7669\x7265\x6144\x6574\0\0\0\xffe8\xffff1-10-2005\0\xffd8\xffff\x6b76\r\26\0\x61c8\v\1\0\1\0\x7244\x7669\x7265\x6556\x7372\x6f69n\0\xffe0\xffff7.0.0.1011\00006\0\xffe0\xffff\x6b76\a\24\0\x6230\v\1\0\1\0\x6e49\x5066\x7461h\xffd8\xffff\x6b76\20<\0\x3d00\v\1\0\1\4\x614d\x6374\x6968\x676e\x6544\x6976\x6563\x6449\xffe8\xffffoem25.inf\0\xffe8\xffff3,6,2,5\0\x3938\v\xffc8\xffff\x6b76\32\4\x8000\20\0\4\0\0012\x6544\x6166\x6c75\x5374\x7465\x6974\x676e\x2e73\x6942\x7374\x6550\x5072\x6c65\0NV\xffe0\xffff\x6b76\a\b\0\x6da8\v\1\0\1e\x6553\x7672\x6369e\b\092\xffe0\xffffnvudisp.exe\0\0\0\xfff0\xffff\x686c\1\x5188\v\x6b07\x78bb\xffd8\xffff\x6b76\t\xb28\0\xb1e0\v\a\0\1\0\x6f43\x7970\x6946\x656cs\0\0\0\xffd8\xffff\x6b76\n\4\x8000#\0\4\0\1\0\x6544\x6976\x6563\x7954\x6570\0\0\0\xffd0\xffff\x6b76\25\4\x8000\x100\0\4\0\1\0\x6544\x6976\x6563\x6843\x7261\x6361\x6574\x6972\x7473\x6369s\0\xffe0\xffff\x6b76\b0\0\x6390\v\3\0\1\0\x6553\x7563\x6972\x7974\xffc8\xffff\1\x9004\0\0\0\0\0\0\24\0\2\34\1\0\0\24\0\x1000\x101\0\0\x500\22\0\0\0\xffe8\xffff\x686c\2\xe248\v\x1b18\x933b\xe398\v\x1b19\x933b\xffd8\xffff\x6b76\17@\0\x6408\v\1\0\1\0\x6e45\x6d75\x7250\x706f\x6150\x6567\x33732\xffb8\xffffMmSys.Cpl,MediaPropPageProvider\0\0\0\xfff0\xffff\xc000\x39fc\x46ce\x1c5\xe588\36\b\0\x6468\v\xffd8\xffff\x6b76\20<\0\x6490\v\1\0\1\0\x7254\x756f\x6c62\x5365\x6f68\x746f\x7265\x302d\xffc0\xffffhcp://help/tshoot/tssound.htm\0\xffe0\xffff\x6b76\4\n\0\x5800\v\1\0\1\0\x6349\x6e6f\0\0\xffe0\xffff\x5670\v\x57a8\v\x5810\v\x63e0\v\x6468\v\x64d0\v\x6510\v\xffc8\xffff\x6b76\31\4\x8000\0\0\3\0\1\0\x6944\x6173\x6c62\x5365\x7465\x7075\x6944\x6843\x6e61\x6567\x7453\x7461e\0\0\0\xffe0\xffff\x6b76\a\24\0\x6568\v\1\0\1\0\x6e49\x5066\x7461h\xffe0\xffffoem27.inf\0f\0\0\0\xffd8\xffff\x6b76\n\36\0\x65b0\v\1\0\1\0\x6e49\x5366\x6365\x6974\x6e6f\0\0\0\xffd8\xffffIntcAzAudModel\0\0\0\0\xffd8\xffff\x6b76\f8\0\x6600\v\1\0\1\0\x7250\x766f\x6469\x7265\x614e\x656d\0\0\xffc0\xffffRealtek Semiconductor Corp.\0\0\0\xffe0\xffff5.10.0.5124\0\x79e\0\xfff0\xffff\x686c\1\x51f0\v\x3463\xc6c4\xffd8\xffff\x6b76\16\b\0\x6450\v\3\0\1\0\x7244\x7669\x7265\x6144\x6574\x6144\x6174\0\xffd8\xffff\x6b76\n\24\0\x66c0\v\1\0\1\0\x7244\x7669\x7265\x6144\x6574\0\0\0\xffe8\xffff4-22-2005\0\xffe8\xffff.NTx86\0\0\0\0\b\0\x66f8\v\xffd8\xffff\x6b76\r\30\0\x6640\v\1\0\1\36\x7244\x7669\x7265\x6556\x7372\x6f69\x796e\37\xffd8\xffff\x6b76\20d\0\x6748\v\1\0\1\36\x614d\x6374\x6968\x676e\x6544\x6976\x6563\x6449\xff98\xffffhdaudio\func_01&ven_10ec&dev_0880&subsys_08800000\0\xffd8\xffff\x6b76\r\16\0\x66d8\v\1\0\1\0\x6e49\x5366\x6365\x6974\x6e6f\x7845t\0\xffd8\xffff\x6b76\n<\0\x6800\v\1\0\1\0\x7244\x7669\x7265\x6544\x6373\0\0\0\xff70\xffffRealtek High Definition Audio\0 (High Definition Audio) - Realtek 880\0\0\xffc8\xffff\x6b76\37\4\x8000\1\0\4\0\1\0\x6553\x7574\x5070\x6572\x6566\x7272\x6465\x7541\x6964\x446f\x7665\x6369\x7365\x6f43\x6e75t\xffd0\xffffwdmaud,swmidi,redbook\0\xffe0\xffffRtkHDAud.sys\0\x7461\xffd0\xffffwave,midi,mixer,aux\0i,\xfff0\xffff\x686c\1\x6b88\v\xa530\x30c\xffe0\xffff\x6b76\a(\0\x89f8\30\1\0\1\v\x6553\x7672\x6369e\xffe8\xffffIntel\0oft\0\xffa8\xffff\x6b6e \xdda2\x51ef\xafbd\x1c5\0\0\xad90Y\4\0\0\0\x6c80\v\xffff\xffff\1\0\x3060\v\x28d0\n\xffff\xffff\n\0\0\0\24\0(\0\1\0\a\0\x7244\x7669\x7265s\xffd8\xffff\x6b76\n(\0\x6918\v\1\0\1u\x7553\x4362\x616c\x7373\x7365\0au\b\0\xffff\xffff\xfff0\xffffpci\0E\0\xffa8\xffff\x6b6e \xdda2\x51ef\xafbd\x1c5\0\0\x6990\v\1\0\0\0\x6ae0\v\xffff\xffff\0\0\xffff\xffff\x28d0\n\xffff\xffff\24\0\0\0\0\0\0\0\3\0\4\0\x6177\x6576\1\5\xffa0\xffff\x6b6e \x75b8\x5e12\xafbd\x1c5\0\0\x6a28\v\0\0\0\0\xffff\xffff\xffff\xffff\3\0\x8618\3\x28d0\n\xffff\xffff\0\0\0\0\26\0<\0\0\0\n\0\x6477\x616d\x6475\x642e\x7672\0\x6a08\v\xfff0\xffff\x686c\1\x6a80\v\xa530\x30c\xffe0\xffff\x6b76\6\26\0\x6b10\v\1\0\1\0\x7244\x7669\x7265\0\xffe0\xffffwdmaud.drv\0\0\xbf70\t\xffa8\xffff\x6b6e \xdda2\x51ef\xafbd\x1c5\0\0\x6990\v\1\0\0\0\x6948\v\xffff\xffff\0\0\xffff\xffff\x28d0\n\xffff\xffff\24\0\0\0\0\0\0\0\1\0\4\0\x696d\x6964io\xffa0\xffff\x6b6e \x75b8\x5e12\xafbd\x1c5\0\0\x6b30\v\0\0\0\0\xffff\xffff\xffff\xffff\3\0\xce40\3\x28d0\n\xffff\xffff\0\0\0\0\26\0<\0\0\0\n\0\x6477\x616d\x6475\x642e\x7672\0\x6bf8\v\xffe0\xffff\x6b76\6\26\0\x6c08\v\1\0\1d\x7244\x7669\x7265d\xffe0\xffffwdmaud.drv\0\0\x6c40\v\xffa8\xffff\x6b6e \xdda2\x51ef\xafbd\x1c5\0\0\x6990\v\1\0\0\0\x6d08\v\xffff\xffff\0\0\xffff\xffff\x28d0\n\xffff\xffff\24\0\0\0\0\0\0\0\2\0\5\0\x696d\x6578r\0\xffd8\xffff\x686c\4\x2208\30\x683a\1\x6b30\v\x13f7=\x6c28\v\x4d65\x8d4\x6a28\v\xa667D\xffa0\xffff\x6b6e \x75b8\x5e12\xafbd\x1c5\0\0\x6c28\v\0\0\0\0\xffff\xffff\xffff\xffff\3\0\x4f80\4\x28d0\n\xffff\xffff\0\0\0\0\26\0<\0\0\0\n\0\x6477\x616d\x6475\x642e\x7672\0\x6b76\v\xfff0\xffff\x686c\1\x6ca8\v\xa530\x30c\xffe0\xffff\x6b76\6\26\0\x6d38\v\1\0\1e\x7244\x7669\x7265e\xffe0\xffffwdmaud.drv\0tio\xffe0\xffff\x6b76\6\26\0\x6d78\v\1\0\1\v\x7244\x7669\x7265\v\xffe0\xffffwdmaud.drv\0\x6169s\\xfff0\xffff.NT\0\0\0\xfff0\xffffpci\0\x1c30\30\xffe8\xffff\x6de0\v\x6e18\v\x6e50\v\x6e78\v\x6ea8\v\xfff0\xffffpci\0\0\0\xffc8\xffff\x6b76\e\4\x8000\0\0\3\0\1\0\x6f46\x7772\x7261\x5364\x6570\x6b61\x7265\x6f43\x666e\x6769\x7275\x7461\x6f69n\0\0\xffc8\xffff\x6b76\34\4\x8000\1\0\3\0\1\0\x6749\x6f6e\x6572\x5344\x7053\x6165\x656b\x4372\x6e6f\x6966\x7567\x6172\x6974\x6e6f\0\0\xffd8\xffff\x6b76\n\4\x8000\0\0\4\0\1\3\x7753\x7061\x6543\x4c6e\x6566\0\0011\xffd0\xffff\x6b76\24\2\x8000\2\0\3\0\1D\x7053\x6165\x656b\x4372\x6e6f\x6966\x7567\x6172\x6974\x6e6fcc\xffd8\xffff\x6b76\17\4\x8000\24\0\4\0\1\v\x7053\x6165\x656b\x4772\x6f65\x656d\x7274y\xffd0\xffff\x6b76\22\4\x8000\1\0\3\0\1\0\x6344\x664f\x7366\x7465\x6f57\x6b72\x7261\x756f\x646e\0\0\0\xffd0\xffff\x6b76\23\4\x8000\1\0\3\0\1\0\x6552\x6573\x4174\x6475\x6f69\x6746\x6e4f\x7453\x7261t\0\0\xffc8\xffff\x6b76\36\4\x8000\1\0\3\0\1\0\x7953\x4173\x6475\x6f69\x6f54\x6f70\x694d\x696e\x6f70\x7472\x6f57\x6b72\x7261\x756f\x646e\0\xffd0\xffff\x6b76\23\4\x8000\0\0\3\0\1\0\x6156\x696c\x6164\x6574\x6f43\x6564\x5763\x6972\x6574s\0\0\xfff0\xffffpci\0ER\b\0Mg\xffd0\xffff\x6b76\26\4\x8000\0\0\3\0\1\0\x6553\x646e\x6146\x656b\x6350\x4378\x6766\x6544\x5666\x7265\x7362\0\xffe0\xffff\x6b76\6\x198\0\x44c0\v\a\0\1\0\x564e\x525f\x5426\v\x6268\x6e69\x7000\v\x1000\0\0\0\0\0\0\0\0\0\0\0\xffd8\xffff\x6b76\20\4\x8000\0\0\4\0\1k\x6e45\x6261\x656c\x6f46\x5272\x756f\x6974\x676e\xfff8\xffff\x8520\v\xfff0\xffffCOM3\0\0\xfff0\xffff\x79c0\v\x3f00\32\x9a38\v\xfee8\xffffPCI\VEN_163C&DEV_3052&REV_04\0PCI\VEN_163C&DEV_3052\0PCI\VEN_163C&CC_070300\0PCI\VEN_163C&CC_0703\0PCI\VEN_163C\0PCI\CC_070300\0PCI\CC_0703\0\0\0\x7758\v\xffe8\xffffINTEL_USB\0\xfff8\xffff\x9a38\v\xffe0\xffff\x6b76\5\f\0\x7918\v\1\0\1\0\x6c43\x7361\x6973\x676e\xfff8\xffff\x73a0\v\xfff8\xffff\x9a88\v\xfff0\xffff\x7560\v\x7a68\v\x6174\0\xffc0\xffffSmart Link (www.smlink.com)\0006,\xffd0\xffffSmart Link 56K Modem\0\x796c\xffd8\xffff\x6b76\r\20\0\x75d8\v\3\0\1\v\x6550\x6d72\x6e61\x6e65\x4774\x6975\x7864\v\xffc8\xffffslcpappl.cpl,ConfigProc\0\xffff\xffff\xffe0\xffff\x6b76\3\4\x8000\1\0\3\0\1\0\x3237\x3030\0\x6e6f\xffe0\xffff\x6b76\4\4\x8000\2\0\3\0\1\v\x6853\x776f\x7738\v\xffe8\xffff1-10-2005\0\xffd8\xffff\x6b76\r\20\0\x7998\v\3\0\1'\x6550\x6d72\x6e61\x6e65\x4774\x6975\x7364\x6f70\xff98\xffff\x6b6e \x13b0\x9a35\x70ad\x1c5\0\0\x7580\v\4\0\0\0\x9230\v\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff"\0\0\0\0\0\0\0\5\0\22\0\x6f48\x7473\x6142\x6573\x4d64\x646f\x6d65\x6144\x6174\0\1\x4c4f\xffd8\xffff\x6b76\r.\0\x9cc0\v\1\0\1'\x6e49\x7473\x6c61\x536c\x756f\x6372e\0\xffd8\xffff\x6b76\f\30\0\x9cf8\v\1\0\1\x706d\x6f43\x666e\x6769\x6944\x6c61\x676f\xf465\27\xfff8\xffff\x9ab0\v\xfff0\xffff\x6264\4\x7b20\v\0\0\xffd0\xffffSmart Link 56K Modem\0001\xffd8\xffff\x6b76\n\1\x8000\2\0\3\0\1\v\x6544\x6976\x6563\x7954\x6570\v\x4d68\v\b\0\xae98\v\xffa0\xffffC:\WINDOWS\ModemLog_Smart Link 56K Modem.txt\0'\xfff0\xffffModem\0\xfff0\xffff\0\0\0\0\0\0\xff98\xffff\x6b6e \x5aa6\x9ade\x70ad\x1c5\0\0\x4e40\v\0\0\0\0\xffff\xffff\xffff\xffff\3\0\x5508\v\x6db8\6\xffff\xffff\0\0\0\0\32\0*\0\0\0\21\0\x6544\x6976\x6563\x5020\x7261\x6d61\x7465\x7265\x6573\x7073\x6e6f\x6573\xfff8\xffff\x7e40\v\xfff8\xffff\x78a0\v\xffe0\xffff\x6b76\5L\0\x6f88\32\1\0\1\x326d\x4c43\x4953\x7944\0\xffa8\xffff\x6b6e \xcc64\x3db7\xafbd\x1c5\0\0\x5848Z\16\0\0\0\x6c20\30\xffff\xffff/\0\x94a8\v\x1e8\0\xffff\xffff$\0\0\0.\0\x9e\0\0\0\4\0\x3030\x3030\x6b76\b\xffe8\xffff\x3e01\x6f02\xf2b9\x4fcb\x3cb5\x2e11\x7490\x386f\x6976\x6563\xfff8\xffff\x96a8\v\xfff8\xffff\x90c8\v\xff88\xffff\x6b73\0\x3330\t\xd240\v\6\0`\0\1\x9404H\0T\0\0\0\24\0\0024\2\0\0\30?\17\x201\0\0\x500 \0\x220\0\0\24?\17\x101\0\0\x500\22\0\x101\0\0\x500\22\0\x101\0\0\x500\22\0\xffe0\xffff\x6b76\b\n\0\x7050\v\1\0\0016\x6f50\x7472\x614e\x656d\xffd8\xffff\x6b76\n\n\0\x7890\v\1\0\1s\x7441\x6174\x6863\x6465\x6f54521\xffe0\xffff\x6b76\3\4\x8000\1\0\3\0\1\v\x3638\x3e32\x6c3c\x3e66\xfff0\xffff\x8000\xc562\x1c0\x1c1\1e\xfff0\xffff\xbf20\27\x6b58\32\x7700\v\xffd8\xffff\x6b76\vZ\0\x7468\v\1\0\1\v\x6f4c\x6767\x6e69\x5067\x7461h\x4d68\v\xfff0\xffffIntel\0\xffd8\xffff\x6b76\20\32\0\x9bd0\v\1\0\1S\x6f50\x7472\x6f43\x666e\x6769\x6944\x6c61\x676f\xffd8\xffff\x6b76\20T\0\x7788\v\1\0\1\x5754\x6441\x6176\x636e\x6465\x6553\x7474\x6e69\x7367\xffa8\xffffmsports.dll,SerialDisplayAdvancedSettings\0\xffd8\xffff0,1,3,4,6,7,256\0\x76c0\v\xffd8\xffff\x6b76\f8\0\x71e8\v\1\0\1\0\x614d\x756e\x6166\x7463\x7275\x7265\x7a90\v\xffe0\xffff\x6b76\2\4\x8000\x6b3e\3\3\0\1L\x4449900\b\0\x99b8\v\xfff0\xffff\x6980\xff67\xffff\xffff\0\0\xffd8\xffff\x6b76\f\4\x8000\0\0\4\0\1\0\x6e45\x6261\x656c\x6f46\x5272\x7361cT\xfff0\xffffCOM3\0\0\xffe0\xffff\x6b76\4\b\0\x4db8\v\3\0\1\35\x6954\x656d\xec20\35\xffa8\xffff{4D36E96D-E325-11CE-BFC1-08002BE10318}\00056K\xfff0\xffffModem\0\xffe8\xffffPosix\0\0\2\x201\0\xffd8\xffff\x6b76\16\xa2\0\x6958\32\1\0\1\0\x6544\x6976\x6563\x6e49\x7473\x6e61\x6563\0\xfff8\xffff\x7940\v\xffd8\xffff\x6b76\17\4\x80000\0\1\0\1\0\x6552\x6461\x6e4f\x796c\x6f43\x6e75\x7274y\xffe8\xffff\x3e01\x6f02\xf2b9\x4fcb\x3cb5\x2e11\x7490\x386f\xe158'\xfff0\xffffPorts\0\xffe0\xffff\x6b76\5L\0\x4840\32\1\0\1a\x4c43\x4953\x3344\x3731\xfff0\xfffffdc\0\0\0\xffc8\xffff\x3938\v\x3958\v\x39a8\v\x39d8\v\x3a38\v\x3a60\v\x9ad8\v\x9d18\v\x9770\v\x9798\v\x97c8\v\x97e8\v\x6b76\b\xffe8\xffffIntel\0oft\0\xffd8\xffff\x6b76\f*\0\x7408\v\1\0\1-\x7246\x6569\x646e\x796c\x614e\x656d3\0\xffd8\xffff\x6b76\f6\0\xb800\21\1\0\1\x505f\x7246\x6569\x646e\x796c\x614e\x656dlp\xffa0\xffff{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\0nt\xfff0\xffffMO\0\v\x40a1\xbeaf\xfff8\xffff\x89a8\v\xfff0\xffff\xf200\xf8d8\xffff\xffff\x1a38\36\xfff8\xffff\x8b70\v\xffe8\xffff\x1020v\x5020v\x9020v\xd020v\x72c8\24\xffd8\xffff\x6b76\v\22\0\x7b60\v\1\0\1\v\x4c53\x6953\x6e67\x7461\x7275e\x7808\v\xffe8\xffffSLAMR2KO\0\v\xffd8\xffff\x6b76\r8\0\x7ba0\v\1\0\1\v\x6f4d\x6564\x506d\x6f72\x6976\x6564\x7672\v\xffc0\xffffSmart Link (www.smlink.com)\0\x9e00\v\xfff0\xffff.NT\0\xe918\xb548\xffe0\xffff\x6b76\b\6\0\x7af0\v\1\0\1\x5ad0\x4c53\x6544\x6976\x6563\xff98\xffff\x6b6e \xcdd2\x3d98\xafbd\x1c5\0\0\x9300\v\0\0\0\0\xffff\xffff\xffff\xffffI\0\x1c48\31\x28d0\n\xffff\xffff\0\0\0\0.\0\xc1\0\1\0\26\0\x6f48\x6f6d\x6f6c\x6167\x6974\x6e6f\x6150\x6172\x656d\x6574\x7372\v\xffa8\xffff\x6b6e \xe210\x3d8c\xafbd\x1c5\0\0\x9c08\v\1\0\0\0\x8240\v\xffff\xffff\f\0\xee00\v\x1e8\0\xffff\xffff\16\0\0\0002\0\4\0\0\0\b\0\x5044\x7244\x7669\x7265\xffe0\xffff\x6b76\b\4\x8000\n\0\3\0\1\xc24f\x6441\x4464\x6c65\x7961\b\0\x9568\v\xffd0\xffff\x6b76\22\4\x8000\0\0\4\0\1\31\x6350\x556d\x7370\x7274\x6165\x456d\x616e\x6c62\x6465\0\0\0\xffd0\xffff\x6b76\23\4\x8000\1\0\4\0\1\x801\x7551\x6369\x436b\x6e6f\x656e\x7463\x6e45\x6261\x656cd\x104\x100\xffd8\xffff\x6b76\t\4\x8000\1\0\4\0\1\xff01\x3456\x4334\x6e6f\x6966\x1e67\x2b07\x2b32\x2b00\xffa8\xffff\x6b6e \x760a\x9a37\x70ad\x1c5\0\0\x7338\v\2\0\0\0\xeea0\v\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff*\0\0\0\0\0\0\0\3\0\b\0\x6553\x7672\x6369\x7365\xff98\xffff\x6b6e \x109a\x98cd\x70ad\x1c5\0\0\x7d80\v\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x7550\v\x1e8\0\xffff\xffff\0\0\0\0\n\0\4\0\0\0\21\0\x4c53\x7845\x5374\x6b70\x5340\x474c\x6e65\x7053\x196b\x201\0\x2b05\xffe0\xffff\x6b76\5\4\x8000\1\0\4\0\1\0\x7453\x7461\x1365\x6400\xffa0\xffff\x6b6e \xd54e\x98d1\x70ad\x1c5\0\0\x9c08\v\0\0\0\0\xffff\xffff\xffff\xffff\4\0\x1f88\v\x1e8\0\xffff\xffff\0\0\0\0\16\0\4\0\1\0\t\0\x4148\x444c\x6972\x6576r\0\0\0\xffe0\xffff\x6b76\6\4\x8000\x2580\0\3\0\1\xf01\x6152\x6574\x6e49\x2a04\xffe0\xffff\x6b76\a\4\x8000\x2580\0\3\0\1\x4102\x6152\x6574\x754f\xff74\xffe0\xffff\x6b76\4\4\x8000\1\0\3\0\1\x1904\x5345\x4d53\x202\1\xffa8\xffff\x6b6e \x109a\x98cd\x70ad\x1c5\0\0\x9c08\v\0\0\0\0\xffff\xffff\xffff\xffff\t\0\x91b0\v\x1e8\0\xffff\xffff\0\0\0\0*\0\4\0\2\0\b\0\x5748\x7244\x7669\x7265\xffc0\xffff\x686c\a\x7c78\v\xd640\xeead\x7e60\v\x2b3d\xc24f\x7f20\v\xeff3\x86b4\xe4b8\v\x1bf\x4280\xd0c0\v\x62ae\x8a5e\x9c68\v\xb881\x97c\x9d58\v\x552b\xe7b1\xffe0\xffff\x6b76\b\4\x8000\0\0\3\0\1\v\x6552\x4464\x6c65\x7961\xffd8\xffff\x6b76\v\4\x8000\1\0\3\0\1\v\x704f\x2e74\x6349\x4268\x6f69s\x7d02\xc41b\x6268\x6e69\x8000\v\x1000\0\0\0\0\0\0\0\0\0\0\0\xffa0\xffff\x6b6e \x305c\xa5db\xfeff\x1c4\0\0\x6d70(\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x8100\v\xfbc0/\xffff\xffff\0\0\0\0L\0\4\0,\0\t\0\x6553\x7672\x6369\x6e69g1A.\xffc0\xffff\x6b76&\4\x8000\1\0\4\0\1a\x397b\x6538\x3937\x3163\x2d35\x6236\x3333\x342d\x6463\x2d33\x3338\x6162\x302d\x6334\x6433\x3234\x6236\x3538\x7d34e\xffc0\xffff\x6b76&\4\x8000\1\0\4\0\1/\x617b\x3739\x3262\x6438\x2d37\x3635\x3135\x342d\x6134\x2d61\x3362\x3730\x332d\x3039\x6538\x3633\x3130\x6430\x7d663\xfff0\xffff\x8080\v\x80c0\v\x6b76\a\xffa0\xffff\x6b6e \x5536\x64ca\x7b05\x1c8\0\0\x6d70(\16\0\0\0\xfde8\n\xffff\xffff\20\0\xfa68\25\x1e8\0\xffff\xffff*\0\0\0<\0\xd288\0-\0\17\0\x6553\x7373\x6f69\x206e\x614d\x616e\x6567r\xffd8\xffff\x6b76\t\4\x8000\0\0\4\0\1\17\x6e45\x6261\x656c\x434dE\0\0\30\xffd0\xffff\x6b76\24\2\x8000\0\0\a\0\1\0\x7845\x6c63\x6475\x4665\x6f72\x4b6d\x6f6e\x6e77\x6c44\x736c\D\xffe0\xffff\x1668\3\x5e30\t\xf478\n\xf9f8\n\xfb38\n\xfa80\n\x776fs\xffd8\xffff\x6b76\v*\0\x8558\v\a\0\1\0\x6f42\x746f\x7845\x6365\x7475e\0\0\xffd0\xffff\x6b76\30\4\x8000\1\x800\3\0\1\xffff\x615f\x6d6f\x652e\x6578\x443a\x4433\x474f\x5f4c\x3736\x3032\x3537\x3635\xfff0\xffff\x686c\1\x9300\v\xfb18\x5684\xffd0\xffff\x6b76\26\4\x8000\x8d00'\4\0\1\0\x7243\x7469\x6369\x6c61\x6553\x7463\x6f69\x546e\x6d69\x6f65\x7475\x7153\xffe0\xffffLocalSystem\0\0\0\xffe8\xffffSL1900 PCI\xffd8\xffff\x6b76\n\4\x8000\0\0\4\0\1A\x6c47\x626f\x6c61\x6c46\x6761ati\xffd0\xffff\x6b76\21\4\x8000\0\0\4\0\1\0\x6548\x7061\x6553\x6d67\x6e65\x4374\x6d6f\x696dt\0\0\0\xffe8\xffffUSBSTOR\0\xfcdd\x1c4\xfff8\xffff\x8d28\v\xffc8\xffff\x6b76\36\4\x8000\0\0\4\0\0013\x6548\x7061\x6544\x6f43\x6d6d\x7469\x7246\x6565\x6c42\x636f\x546b\x7268\x7365\x6f68\x646c\0\xffc8\xffff\x6b76\36\4\x8000\0\0\4\0\1\0\x6548\x7061\x6544\x6f43\x6d6d\x7469\x6f54\x6174\x466c\x6572\x5465\x7268\x7365\x6f68\x646c\0\xffd8\xffff\x6b76\16\4\x8000\1\0\4\0\1\1\x7250\x746f\x6365\x6974\x6e6f\x6f4d\x6564\1\xffd0\xffff\x6b76\22\4\x8000\0\0\4\0\1\0\x6548\x7061\x6553\x6d67\x6e65\x5274\x7365\x7265\x6576\0\0\0\xffd0\xffff\x6b76\24\4\x8000\xe340\t\4\0\1\1\x6552\x6f73\x7275\x6563\x6954\x656d\x756f\x4374\x756f\x746e\x9dd8\1\xffd0\xffff\x6b76\21.\0\x8458\v\a\0\1\0\x624f\x656a\x7463\x6944\x6572\x7463\x726f\x6569s\0\0\0\xffc8\xffff\Windows\0\RPC Control\0\0\0\0\x500\xffe0\xffff\x8150\3\x8428\3\x8100\3\x8488\3\x8818\3\x9928\3\xa310\24\xffd8\xffff\x6b76\tN\0\xdaf8\24\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffe8\xffff\4\0\1\0\2\0\3\0\4\0\xfff8\xffff\x8ed8\v\xffd8\xffff\x6b76\t\4\x8000\1\0\4\0\1\0\x6e45\x6261\x656c\x434d\x241\0\x101\0\xffd8\xffff\x6b76\16\xd090\0\x73f8\v\3\0\1\5\x7041\x4370\x6d6f\x6170\x4374\x6361\x6568\5\xfff0\xffff\x686c\1\x88e0\v\xa8dd\xcd7d\xff88\xffffautocheck autochk *\0\0precovr \SystemRoot\sprecovr.txt\0\0\0\0\0\b\0\x7d60\v\xffa0\xffff\x6b6e \xed28\xe74c\x7b07\x1c8\0\0\x8110\v\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x7048\v\x28d0\n\xffff\xffff\0\0\0\0\34\0\xd090\0\1\0\20\0\x7041\x4370\x6d6f\x6170\x6974\x6962\x696c\x7974\xffa0\xffff\x6b6e \xf496\x38dd\x1d7\x1c5\0\0\x8110\v\17\0\0\0\x17b8\v\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff\22\0\0\0\0\0\0\0\2\0\n\0\x7041\x5070\x7461\x6863\x7365XE3\xffa8\xffff\x6b6e \xf496\x38dd\x1d7\x1c5\0\0\x8638\v\1\0\0\0\x8760\v\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff:\0\0\0\0\0\0\0\0\0\3\0\x5743\x544\22\0\xff90\xffff\x6b6e \xf496\x38dd\x1d7\x1c5\0\0\x8698\v\1\0\0\0\x8860\v\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff\4\0\0\0\0\0\0\0\0\0\34\0\x6666\x3630\x3130\x3230\x3234\x6433\x3061\x3030\x3430\x3730\x3031\x6538\x3530\x3030\0\0\xfff0\xffff\x686c\1\x86f0\v\x827d\x7a8c\xffa8\xffff\x6b6e \xb7b2\xdf56\xc826\x1c4\0\0\x86f0\v\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x8850\v\x1e8\0\xffff\xffff\0\0\0\0\16\0\35\0\0\0\1\0001\x500\22\0\xffe0\xffff\x6b76\4\25\0\x87e8\v\3\0\1\0\x6441\x3164\0\0\xffe0\xffff\x1502\xa040\x1e10\x23b8\x8e00\x8bd8\x140e\x8107\xe1\x1f02\xc3\0\0\0\xffe0\xffff\x6b76\a\35\0\x8828\v\3\0\1\x500\x6843\x6e61\x65671\xffd8\xffff\x1d01\x4850\x550c\xec8b\xb8\x9c00\x8159\xe1\x5502\xec8b\xb8\xe800\x57e7\x9090\x90\0 \0\xfff0\xffff\x87c8\v\x8808\v\x8790\v\xfff0\xffff\x686c\1\x8770\v1\0\xffa8\xffff\x6b6e \xf496\x38dd\x1d7\x1c5\0\0\x8638\v\1\0\0\0\x8548\v\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff:\0\0\0\0\0\0\0\1\0\b\0\x4e49\x5453\x4942\x3130\xfff0\xffff\x686c\1\x8aa8\v\xfaf3\x6286\b\0\x9892\x7eec\xff90\xffff\x6b6e \xf496\x38dd\x1d7\x1c5\0\0\x8870\v\1\0\0\0\x8a18\v\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff\4\0\0\0\0\0\0\0\0\0\34\0\x6666\x3630\x3130\x3230\x3234\x3339\x3135\x3030\x3430\x3730\x3032\x3337\x3530\x3030\2\0\xffa8\xffff\x6b6e \xb7b2\xdf56\xc826\x1c4\0\0\x88e0\v\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x7b00\v\x1e8\0\xffff\xffff\0\0\0\0\16\0I\0\0\0\1\0001\0\0\0\xffe0\xffff\x6b76\aI\0\x89c8\v\3\0\1\0\x6843\x6e61\x65671\xffb0\xffff\x4901\x18d0\x4522\x8b55\x1eec\x43b4\xc032\x56c5\xcd06\x1f21\xa72\x5ec4\x260a\xf89\xc033\x4eb\xe850\x2fa\x4d5d\x55cb\xec8b\xb81e\x4300\x56c5\xcd06\x1f21\xd72\x5ec4\x800a\x1fe1\x8926\x330f\xebc0\x5004\xfae8\x5d02\xcb\0\xfff0\xffff\x686c\1\x8950\v1\0\xffa8\xffff\x6b6e \xf496\x38dd\x1d7\x1c5\0\0\x8638\v\1\0\0\0\x88c8\v\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff:\0\0\0\0\0\0\0\2\0\b\0\x4e49\x5453\x4942\x3230\xfff0\xffff\x686c\1\x8e10\v\xa7a3\x9c77\xffe8\xffff\x1301\x1e84\x4507\x8b55\x68ec\x2000\x5545\xec8b\x268 \xff90\xffff\x6b6e \xf496\x38dd\x1d7\x1c5\0\0\x8a28\v\1\0\0\0\x8be8\v\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff\4\0\0\0\0\0\0\0\0\0\34\0\x6666\x3630\x3130\x3230\x3234\x3634\x3338\x3030\x3430\x3730\x3039\x3863\x3430\x3030\0\0\xffa8\xffff\x6b6e \xb7b2\xdf56\xc826\x1c4\0\0\x8aa8\v\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x7b18\v\x1e8\0\xffff\xffff\0\0\0\0\16\0Q\0\0\0\1\0001\2\x201\0\xffe0\xffff\x6b76\aQ\0\x8b90\v\3\0\1\0\x6843\x6e61\x65671\xffa8\xffff\x5101\x4612\x4526\x8b55\x56ec\x1e57\x43b4\xc032\x56c5\xcd06\x1f21\xa72\x5ec4\x260a\xf89\xc033\x4eb\xe850\x34b\x5e5f\x4d5d\x45cb\x8b55\x1eec\x43b4\xc032\x56c5\xcd06\x1f21\xa72\x5ec4\x800a\x1fe1\x8926\x330f\xebc0\x5004\x4be8\x5d03\xcb4d\x90\0\xfff0\xffff\x686c\1\x8b18\v1\0\xffa8\xffff\x6b6e \xf496\x38dd\x1d7\x1c5\0\0\x8638\v\1\0\0\0\x8cc0\v\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff:\0\0\0\0\0\0\0\3\0\a\0\x4e49\x5453\x4942N\xff90\xffff\x6b6e \xf496\x38dd\x1d7\x1c5\0\0\x8bf8\v\1\0\0\0\x8d68\v\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff\4\0\0\0\0\0\0\0\0\0\34\0\x6666\x3630\x3130\x3230\x6334\x6261\x6237\x3030\x3430\x3730\x3062\x6165\x3430\x3030\0\0\xfff0\xffff\x686c\1\x8c50\v\x5f5b\xa886\xffa8\xffff\x6b6e \xb7b2\xdf56\xc826\x1c4\0\0\x8c50\v\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x8328\v\x1e8\0\xffff\xffff\0\0\0\0\16\0\25\0\0\0\1\0\x5d32\xe1d2\24\0\xffe0\xffff\x6b76\a\25\0\x8d48\v\3\0\1\0\x6843\x6e61\x65671\xffe0\xffff\x1501\x3bf0\x3d08\x5f03\x374\x6e9\x3d00\x5f03\x9090\x6e9\0\2\x201\0\xfff0\xffff\x686c\1\x8cd0\v2\0\xffa8\xffff\x6b6e \xf496\x38dd\x1d7\x1c5\0\0\x8638\v\1\0\0\0\x8a80\v\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff:\0\0\0\0\0\0\0\4\0\a\0\x4e49\x5453\x4353R\xffe0\xffff\x6b76\3\30\0\x8df0\v\1\0\1\0\x4e55C\0\0\xffe0\xffff\Device\Mup\0\0\0\xff90\xffff\x6b6e \xf496\x38dd\x1d7\x1c5\0\0\x8d78\v\1\0\0\0\x8ef8\v\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff\4\0\0\0\0\0\0\0\0\0\34\0\x6666\x3630\x3130\x3230\x3463\x6237\x6631\x3030\x3430\x3730\x3035\x6264\x3130\x3030 \0\xffa8\xffff\x6b6e \xb7b2\xdf56\xc826\x1c4\0\0\x8e10\v\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x84f0\v\x1e8\0\xffff\xffff\0\0\0\0\16\0\23\0\0\0\1\0e\0\0\0\xffe0\xffff\x6b76\a\23\0\x8a90\v\3\0\1\0\x6843\x6e61\x65671\xfff0\xffff\x686c\1\x8e80\vE\0\xffa8\xffff\x6b6e \xf496\x38dd\x1d7\x1c5\0\0\x8638\v\1\0\0\0\x8fd0\v\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff6\0\0\0\0\0\0\0\5\0\b\0\x544c\x5053\x4952\x544e\xff90\xffff\x6b6e \xf496\x38dd\x1d7\x1c5\0\0\x8f08\v\1\0\0\0\x8fe0\v\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff\4\0\0\0\0\0\0\0\0\0\32\0\x6666\x3630\x3130\x3230\x3234\x6634\x6633\x3030\x3330\x3630\x3037\x3636\x3030\0\0\0\xfff0\xffff\x686c\1\x8f60\v\x75d2\xc26f\xfff0\xffff\x686c\1\x2020\v1\0\xfff0\xffffdisk\0\0\x6268\x6e69\x9000\v\x1000\0\0\0\0\0\0\0\0\0\0\0\xffd8\xffff\x6b76\t\4\x8000\2\0\3\0\1\x2304\x704f\x2e74\x7541\x6964o\x100\1\1\xffa8\xffff\x6b6e \xd54e\x98d1\x70ad\x1c5\0\0\x7580\v\1\0\0\0\x9a20\v\xffff\xffff\1\0\x75f8\v\x1e8\0\xffff\xffff\f\0\0\0\34\0\2\0\3\0\3\0\x6146x\0d\xffd8\xffff\x6b76\20\4\x8000\1\0\4\0\1\0\x3456\x4334\x6e6f\x6966\x4567\x616e\x6c62\x6465\xffd8\xffff\x6b76\16\2\x8000\0\0\1\0\1\0\x7250\x4465\x6169\x436c\x6d6f\x616d\x646e\x801\xffd8\xffff\x6b76\r\4\x8000\0\0\3\0\1\x101\x704f\x2e74\x694d\x6578\x4d64\x646f\x3c65\x804\xffd8\xffff\x6b76\f\4\x8000\1\0\3\0\1\x2b00\x704f\x2e74\x6f4e\x3344\x6f43\x646c\x101\1\xffe0\xffffSLIOLights\0\v\x9160\v\xffd8\xffff\x6b76\r\4\x8000\0\0\3\0\1d\x704f\x2e74\x654b\x7065\x7453\x7461e\31\xffd8\xffff\x6b76\f\4\x8000\1\0\3\0\1\0\x704f\x2e74\x4d50\x4143\x6177\x6572\0004\xffd8\xffff\x7cd0\v\x7fb8\v\x7fd8\v\x9020\v\x90f0\v\x9118\v\x9160\v\x9188\v\x92d0\v\xffa8\xffff\x6b6e \x109a\x98cd\x70ad\x1c5\0\0\x7338\v\0\0\0\0\xffff\xffff\xffff\xffff\3\0\x6c58\2\x1e8\0\xffff\xffff\0\0\0\0\32\0\36\0\1\0\a\0\x7244\x7669\x7265s\xffd8\xffff\x686c\4\xbf90\v\xab62\xb44b\x91d8\v\xdfbf\xfa87\x9c08\v\xea98\x6e7f\x7d80\v\xf730\x227a\xffd8\xffff\x6b76\r\36\0\x9280\v\1\0\1\x600\x7053\x6165\x656b\x4472\x6972\x6576\x3572\n\xffd8\xffffSlnthalDevice0\0\x3c3c\x6428d\xffd8\xffff\x6b76\r\26\0\x9140\v\1\0\1\0\x4c53\x694c\x6867\x4474\x6972\x6576r\0\xffd0\xffff\x6b76\25\4\x8000\1\0\3\0\1\x601\x704f\x2e74\x7355\x4265\x6f69\x5373\x656c\x7065\x7453\x7461\x165\x100\xffa8\xffff\x6b6e \xcc64\x3db7\xafbd\x1c5\0\0\x7c78\v\3\0\0\0\xd2d8\v\xffff\xffff\5\0\x5878\v\x1e8\0\xffff\xffff,\0\0\0 \0d\0\0\0\a\0\x6f43\x6e75\x7274\xa179\xffe0\xffff\x6b76\6\4\x80000\0\1\0\1d\x7541\x6f74\x5058\0\xffe0\xffff\x6b76\b\20\0\x9398\v\1\0\1\0\x5044\x7244\x7669\x7265\xffe8\xffffMTLSTRM\0\x4321\x801\xffe0\xffff\x6b76\3\4\x8000\1\0\3\0\1\0\x35390\0\v\xffd0\xffff\x6b76\22\4\x8000\1\0\4\0\1V\x6f4d\x6564\x4f6d\x486e\x6c6f\x4564\x616e\x6c62\x6465\0\x9498\v\xffe8\xffffINTEL_USB\0\xffd8\xffff\x6b76\17\4\x8000<\0\3\0\1\xa52\x6e49\x6361\x6974\x6976\x7974\x6353\x6c61e\xffc8\xffff\x6b76\31\4\x8000\0\0\3\0\1\v\x6341\x6563\x656c\x6172\x6574\x5264\x7365\x6f70\x736e\x7669\x6e65\x7365\x7873\v\x7310\v\xffe0\xffff\x6b76\3\4\x8000\0\0\3\0\1\v\x6f4cg\x9fb8\v\xfff0\xffff\x8000\xc562\x1c0\x1c1\x6f69n\xff38\xffff\x7698\v\x7700\v\x7438\v\x7738\v\x7760\v\x7808\v\x9bb0\v\x7830\v\x7310\v\x73c8\v\x9db0\v\x9dd8\v\x9ec0\v\x9e00\v\x9e20\v\x9fb8\v\x9fd8\v\x7b38\v\x7bf0\v\x7b78\v\x9418\v\x9650\v\x1298\f\x6ea8\30\x12e8\f\x1310\f\x1338\f\x77d0\30\x7fb0\30\x72a8\30\x72d0\30\xa2a8\30\x8638\30\x87c0\30\x8358\30\x83a8\30\x83d0\30\x2378\31\xae8\31\xbe70\v\x5d80\v\x5de0\v\x5e38\v\x5e98\v\x5f10\v\x3878\v\x3aa8\v\x3a10\v\1\0\xff38\xffff\x4024\x601\x9632+\x41ff\xff01\x500a\x230f\x3c12\x1204<\n\x105\x100x\x100\1\1\x3205\x4102\xff01\x4102\xff01\n\3\xff01\x1901\x201\0\x2b05\xff00\x2b0a\x2b32\x2b00\0\0\x100\x1e04\x3219\xfafa\x101\x600\x5000\x202\x1300\x6400\x53c\0\x3500\n\0\0\0\0\0\0\x4206\xa100\x424\x81\0d\x3c0f\x5016\x100\xab5\x5578\x3c3c\x6428d\a\x155\0\0\x101\f\0\31\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x2e00\x3233\xffe8\xffffINTEL_USB\0\xffe0\xffff\x6b76\5\20\0\x9670\v\1\0\1\0\x6552\x6573t\0\xffe8\xffffATZ<cr>\0\x4132\x401\xffe0\xffff\x6b76\3\4\x8000\0\0\3\0\1\v\x4250\x3e58\x6c3c\x3e66\xffd8\xffff\x6b76\n\4\x8000"\0\4\0\1\xffff\x6553\x4274\x7469\x616d\x6b73\0\x77f0\v\xffd8\xffff\x6b76\n\4\x8000\1\0\4\0\1\x4954\x6553\x4274\x7469\x616d\x6b73\0\x6b76\30\xffd8\xffff\x6b76\f\4\x8000\xfffe\xffff\4\0\1\x3e66\x6552\x6573\x4274\x7469\x616d\x6b73\x3242\x3231\xffd8\xffff\x6b76\n\4\x8000\2\0\4\0\1\v\x6553\x4274\x7469\x616d\x6b73\x5544\x414c\x4954\xffd8\xffff\x6b76\f\4\x8000\xfffd\xffff\4\0\1\0\x6552\x6573\x4274\x7469\x616d\x6b73\1\0\xffd8\xffff\x6b76\t\4\x8000\1\0\4\0\1\v\x6341\x6974\x6e6f\x6553\x6374\x3e72\x6c3c\x3e66\xffd0\xffff\x6b76\22\4\x8000\1\0\4\0\1\30\x6f43\x6e75\x4674\x726f\x6341\x6974\x6176\x6974\x6e6f\x3e72\x6c3c\x3e66\xffe0\xffff\x6b76\a\4\x8000\2\0\4\0\1\30\x6954\x656d\x756ft\xffd0\xffff\x6b76\30\4\x8000\1\0\4\0\1\x4954\x7041\x7270\x786f\x6d69\x7461\x5365\x6165\x6372\x4568\x616e\x6c62\x6465\xffd8\xffff\x6b76\20\4\x8000\2\0\4\0\1\x4954\x6544\x6166\x6c75\x4174\x7463\x6f69\x536e\x7465\xffc8\xffff\x6b76\31\4\x8000\1\0\4\0\1\x3e66\x6544\x6166\x6c75\x4374\x756f\x746e\x6f46\x4172\x7463\x7669\x7461\x6f69n\0\0\v\xffc8\xffff\x6b76\e\4\x8000\n\0\4\0\1\v\x6544\x6166\x6c75\x4374\x756f\x746e\x6f46\x4472\x6165\x7463\x7669\x7461\x6f69n\x7c10\v\xffb8\xffff\x6b76)\4\x8000\1\0\4\0\1\v\x6544\x6166\x6c75\x5474\x6572\x7461\x6f43\x6e6e\x6365\x6974\x6e6f\x7341\x614c\x6b63\x664f\x6553\x736e\x7469\x7669\x7469y\0\0\v\xffd8\xffff\x6b76\20\4\x8000\3\0\4\0\1\v\x6544\x6166\x6c75\x4174\x7463\x6f69\x536e\x7465\xffc8\xffff\x6b76\31\4\x8000\1\0\4\0\1\34\x6544\x6166\x6c75\x4374\x756f\x746e\x6f46\x4172\x7463\x7669\x7461\x6f69\x4f6e\x4e4e\x4345\x2054\xffc8\xffff\x6b76\e\4\x8000\5\0\4\0\1\x4b0\x6544\x6166\x6c75\x4374\x756f\x746e\x6f46\x4472\x6165\x7463\x7669\x7461\x6f69n\1\v\xffd8\xffff\x6b76\n\4\x8000\6\0\4\0\1\x3e72\x3956\x4d30\x6e69\x7854\x5250\0\2\x960\xffd8\xffff\x6b76\v\4\x8000\xfb\0\4\0\1\v\x6150\x656e\x4c6c\x6769\x7468\x3e73\x6c3c\x3e66\xffd8\xffff\x6b76\17\4\x8000\0\0\4\0\1\v\x6e45\x6261\x656c\x5453\x7553\x7070\x726ft\xffe8\xffff1-10-2005\0\xfff0\xffff\x686c\1\xd650\v\x7273\x1d9e\b\0\0\0\xffd8\xffff\x6b76\16"\0\x9a60\v\1\0\1\0\x6544\x6976\x6563\x6e49\x7473\x6e61\x6563\0\xffd8\xffffRoot\SYSTEM\0000\0\0\xffd8\xffff\x6b76\f\xd4\0\x4428\f\1\0\1\0\x7953\x626d\x6c6f\x6369\x694c\x6b6e\0\0\xffd8\xffff\x6b76\f\xd4\0\x4500\f\1\0\1\0\x7953\x626d\x6c6f\x6369\x694c\x6b6e\0\0\xffb8\xffff\x6b76)\4\x8000\0\0\4\0\1l\x6e49\x6573\x736e\x7469\x7669\x7469\x4d79\x7365\x6173\x6567\x6552\x6573\x7374\x6341\x6974\x6176\x6974\x6e6f\x6f43\x6e75t\0\0\x97c\xfff0\xffff\x16ea\xb465\xaf96\x1c5\xff\xff\xffd8\xffff\x6b76\0170\0\x7280\v\1\0\1\x258\x6553\x656c\x7463\x6f43\x6e75\x7274\x33792\xffe0\xffff\x6b76\a\f\0\x74c8\v\1\0\1\xffff\x6553\x7672\x6369e\xffd8\xffff\x6b76\n\4\x8000\0\0\4\0\1\v\x6157\x656b\x6e4f\x6952\x676e\v\x4d68\v\xfff0\xffff.NT\0\x7828\35\xffe0\xffff\x6b76\5*\0\x7228\v\1\0\1\v\x6f4d\x6564\x776c\v\xffe0\xffffserialui.dll\0'\xffe8\xffffPrefetch\0\36\xffa0\xffff\x6b6e \x13b0\x9a35\x70ad\x1c5\0\0\x7338\v\a\0\0\0\x7f78\v\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff\22\0\0\0\0\0\0\0\2\0\n\0\x6150\x6172\x656d\x6574\x7372\x6564\x486d\x6c65\xffa8\xffff\x6b6e \x924c\x3bf7\xafbd\x1c5\0\0\x9c08\v\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x71c8\v\x1e8\0\xffff\xffff\0\0\0\0\32\0.\0\5\0\5\0\x6553\x7574\x6170\x6c62\xffc8\xffffc:\windows\pack17739\o\0\0\x9cf8\v\xffe0\xffffmodemui.dll\0\x616e\x6c62\xffc0\xffff\x6b76"\4\x8000\0\0\4\0\1\v\x7254\x6165\x4374\x6e6f\x656e\x7463\x6f69\x416e\x4c73\x6361\x4f6b\x5366\x6e65\x6973\x6974\x6976\x7974\0\0\0\xffa8\xffff\x6b6e \xe210\x3d8c\xafbd\x1c5\0\0\x9c08\v\0\0\0\0\xffff\xffff\xffff\xffff\4\0\xeef8\v\x1e8\0\xffff\xffff\0\0\0\0\20\0\4\0\6\0\a\0\x7053\x6165\x656br\xffd8\xffff\x6b76\f\1\x8000\2\0\3\0\1\v\x6f50\x7472\x7553\x4362\x616c\x7373\x6b76\v\xffd8\xffff\x6b76\n\4\x8000\x317\x8219\3\0\1\x4e79\x6f43\x746e\x6f72\x536c\x6d75\0FI\xffe0\xffff\x6b76\b8\0\x9f58\v\1\0\1\v\x5753\x6556\x646e\x726f\xffd8\xffff\x6b76\t\32\0\x9f98\v\1\0\1\v\x5753\x6556\x7372\x6f69\x9d6e\v\x9d18\v\xffd0\xffff\x6b76\25\4\x8000\1\0\4\0\1\v\x4f4d\x4548\x616e\x6c62\x4f65\x7475\x6f47\x6e69\x4367\x6c61\x566c\x342e\xffd0\xffff\x6b76\23\4\x8000\4\0\4\0\1\v\x6157\x7469\x6e69\x4367\x6c61\x526c\x7365\x6f70\x736e\x5465\x434f\x4c4f\xffe8\xffffIntel\0oft\0\xffd8\xffff\x6b76\f\32\0\x9ee8\v\1\0\1\v\x6f4d\x6564\x566c\x7265\x6973\x6e6f\xa330\0\xffe0\xffffVer3.40.03FA\0\x100\xffc0\xffffSmart Link (www.smlink.com)\0\x9db0\v\xfff0\xffff\x8000\xc562\x1c0\x1c1\1\0\xffc0\xffffSmart Link (www.smlink.com)\0\0\0\xffe0\xffffVer3.40.03FA\0o\xffe0\xffff\x6b76\b8\0\x9f08\v\1\0\1a\x5748\x6556\x646e\x726f\xffd8\xffff\x6b76\t\24\0\x82a0\v\1\0\1\v\x5748\x6556\x7372\x6f69\xd56e\v\xd618\v\x6268\x6e69\xa000\v\x1000\0\0\0\0\0\0\0\0\0\0\0\xffa8\xffff\x6b6e \x6f80\xde05\xc87a\x1c4\0\0\xd020/\0\0\0\0\xffff\xffff\xffff\xffff\2\0\xa110\v\x1e8\0\xffff\xffff\0\0\0\0 \0D\0G\0\a\0\x5049\x4f42\x544fP\xffd8\xffff\x6b76\20D\0\xa0a0\v\2\0\1\0\x7645\x6e65\x4d74\x7365\x6173\x6567\x6946\x656c\xffb8\xffff%SystemRoot%\System32\ipbootp.dll\0\xffd8\xffff\x6b76\16\4\x8000\a\0\4\0\1\0\x7954\x6570\x5373\x7075\x6f70\x7472\x6465\0\xfff0\xffff\xa078\v\xa0e8\v\3\xff01\xffa8\xffff\x6b6e \x6f80\xde05\xc87a\x1c4\0\0\xd020/\0\0\0\0\xffff\xffff\xffff\xffff\2\0\xa208\v\x1e8\0\xffff\xffff\0\0\0\0 \0<\0H\0\5\0\x5049\x474dMP\xffd8\xffff\x6b76\20<\0\xa1a0\v\2\0\1e\x7645\x6e65\x4d74\x7365\x6173\x6567\x6946\x656c\xffc0\xffff%SystemRoot%\System32\rtm.dll\0\xffd8\xffff\x6b76\16\4\x8000\a\0\4\0\1r\x7954\x6570\x5373\x7075\x6f70\x7472\x6465A\xfff0\xffff\xa178\v\xa1e0\v\xff01\x4102\xffa8\xffff\x6b6e \x6f80\xde05\xc87a\x1c4\0\0\xd020/\0\0\0\0\xffff\xffff\xffff\xffff\2\0\xa310\v\x1e8\0\xffff\xffff\0\0\0\0 \0F\0I\0\b\0\x5049\x414e\x4854\x504c\xffd8\xffff\x6b76\20F\0\xa298\v\2\0\1\0\x7645\x6e65\x4d74\x7365\x6173\x6567\x6946\x656c\xffb0\xffff%SystemRoot%\System32\ipnathlp.dll\0\0\0\0\xffd8\xffff\x6b76\16\4\x8000\a\0\4\0\1\0\x7954\x6570\x5373\x7075\x6f70\x7472\x6465\0\xfff0\xffff\xa270\v\xa2e8\v\x110\x1e04\xffa8\xffff\x6b6e \x6f80\xde05\xc87a\x1c4\0\0\xd020/\0\0\0\0\xffff\xffff\xffff\xffff\2\0\xa410\v\x1e8\0\xffff\xffff\0\0\0\0 \0B\0J\0\6\0\x5049\x4952\x3250\0\xffd8\xffff\x6b76\20B\0\xa3a0\v\2\0\1\0\x7645\x6e65\x4d74\x7365\x6173\x6567\x6946\x656c\xffb8\xffff%SystemRoot%\System32\iprip2.dll\0\0\xffd8\xffff\x6b76\16\4\x8000\a\0\4\0\1\0\x7954\x6570\x5373\x7075\x6f70\x7472\x6465\0\xfff0\xffff\xa378\v\xa3e8\v\x2b32\x2b00\xffa0\xffff\x6b6e \x6f80\xde05\xc87a\x1c4\0\0\xd020/\0\0\0\0\xffff\xffff\xffff\xffff\2\0\xa518\v\x1e8\0\xffff\xffff\0\0\0\0 \0B\0K\0\17\0\x5049\x6f52\x7475\x7265\x614d\x616e\x6567r\xffd8\xffff\x6b76\20B\0\xa4a8\v\2\0\1\0\x7645\x6e65\x4d74\x7365\x6173\x6567\x6946\x656c\xffb8\xffff%SystemRoot%\System32\mprmsg.dll\0\0\xffd8\xffff\x6b76\16\4\x8000\a\0\4\0\1\0\x7954\x6570\x5373\x7075\x6f70\x7472\x6465\0\xfff0\xffff\xa480\v\xa4f0\v\x5241K\xffa8\xffff\x6b6e \xc5f6\xdbb3\xc87a\x1c4\0\0\xd020/\0\0\0\0\xffff\xffff\xffff\xffff\2\0\xa620\v\x1e8\0\xffff\xffff\0\0\0\0 \0F\0L\0\5\0\x5049\x6553c\0\xffd8\xffff\x6b76\20F\0\xa5a8\v\2\0\1\0\x7645\x6e65\x4d74\x7365\x6173\x6567\x6946\x656c\xffb0\xffff%SystemRoot%\System32\netevent.dll\0\0\0\0\xffd8\xffff\x6b76\16\4\x8000\a\0\4\0\1\0\x7954\x6570\x5373\x7075\x6f70\x7472\x6465\0\xfff0\xffff\xa580\v\xa5f8\v\0\0\xffa8\xffff\x6b6e \x6f80\xde05\xc87a\x1c4\0\0\xd020/\0\0\0\0\xffff\xffff\xffff\xffff\2\0\xa720\v\x1e8\0\xffff\xffff\0\0\0\0 \0B\0M\0\5\0\x5049\x4358P\0\xffd8\xffff\x6b76\20B\0\xa6b0\v\2\0\1\0\x7645\x6e65\x4d74\x7365\x6173\x6567\x6946\x656c\xffb8\xffff%SystemRoot%\System32\mprmsg.dll\0\0\xffd8\xffff\x6b76\16\4\x8000\a\0\4\0\1\0\x7954\x6570\x5373\x7075\x6f70\x7472\x6465\0\xfff0\xffff\xa688\v\xa6f8\v\x3c1e\x1402\xffa8\xffff\x6b6e \x6f80\xde05\xc87a\x1c4\0\0\xd020/\0\0\0\0\xffff\xffff\xffff\xffff\2\0\xa820\v\x1e8\0\xffff\xffff\0\0\0\0 \0B\0N\0\6\0\x5049\x5258\x5049\0\xffd8\xffff\x6b76\20B\0\xa7b0\v\2\0\1\0\x7645\x6e65\x4d74\x7365\x6173\x6567\x6946\x656c\xffb8\xffff%SystemRoot%\System32\mprmsg.dll\0\0\xffd8\xffff\x6b76\16\4\x8000\a\0\4\0\1\0\x7954\x6570\x5373\x7075\x6f70\x7472\x6465\0\xfff0\xffff\xa788\v\xa7f8\v\0\4\xffa0\xffff\x6b6e \x6f80\xde05\xc87a\x1c4\0\0\xd020/\0\0\0\0\xffff\xffff\xffff\xffff\2\0\xa928\v\x1e8\0\xffff\xffff\0\0\0\0 \0B\0O\0\20\0\x5049\x5258\x756f\x6574\x4d72\x6e61\x6761\x7265\xffd8\xffff\x6b76\20B\0\xa8b8\v\2\0\1\0\x7645\x6e65\x4d74\x7365\x6173\x6567\x6946\x656c\xffb8\xffff%SystemRoot%\System32\mprmsg.dll\0\0\xffd8\xffff\x6b76\16\4\x8000\a\0\4\0\1\0\x7954\x6570\x5373\x7075\x6f70\x7472\x6465\0\xfff0\xffff\xa890\v\xa900\v\x101\1\xffa8\xffff\x6b6e \x6f80\xde05\xc87a\x1c4\0\0\xd020/\0\0\0\0\xffff\xffff\xffff\xffff\2\0\xaa28\v\x1e8\0\xffff\xffff\0\0\0\0 \0B\0P\0\6\0\x5049\x5358\x5041\0\xffd8\xffff\x6b76\20B\0\xa9b8\v\2\0\1\0\x7645\x6e65\x4d74\x7365\x6173\x6567\x6946\x656c\xffb8\xffff%SystemRoot%\System32\mprmsg.dll\0\0\xffd8\xffff\x6b76\16\4\x8000\a\0\4\0\1\0\x7954\x6570\x5373\x7075\x6f70\x7472\x6465\0\xfff0\xffff\xa990\v\xaa00\v\3\xff01\xffa8\xffff\x6b6e \xe48e\xf48d\xc826\x1c4\0\0\xd020/\0\0\0\0\xffff\xffff\xffff\xffff\2\0\xab80\v\x1e8\0\xffff\xffff\0\0\0\0 \0\x98\0Q\0\6\0\x7369\x7061\x706e\0\xffd8\xffff\x6b76\20\x98\0\xaab8\v\2\0\1\0\x7645\x6e65\x4d74\x7365\x6173\x6567\x6946\x656c\xff60\xffff%SystemRoot%\System32\IoLogMsg.dll;%SystemRoot%\System32\drivers\isapnp.sys\0\0\0\xffd8\xffff\x6b76\16\4\x8000\a\0\4\0\1\0\x7954\x6570\x5373\x7075\x6f70\x7472\x6465\0\xfff0\xffff\xaa90\v\xab58\v\08\xffa8\xffff\x6b6e \xb4da\xff43\xc826\x1c4\0\0\xd020/\0\0\0\0\xffff\xffff\xffff\xffff\2\0\xacd8\v\x1e8\0\xffff\xffff\0\0\0\0 \0\x9c\0T\0\b\0\x626b\x6364\x616c\x7373\xffd8\xffff\x6b76\20\x9c\0\xac10\v\2\0\1\0\x7645\x6e65\x4d74\x7365\x6173\x6567\x6946\x656c\xff60\xffff%SystemRoot%\System32\IoLogMsg.dll;%SystemRoot%\System32\drivers\kbdclass.sys\0\xffd8\xffff\x6b76\16\4\x8000\a\0\4\0\1\0\x7954\x6570\x5373\x7075\x6f70\x7472\x6465\0\xfff0\xffff\xabe8\v\xacb0\v\0\0\xffa8\xffff\x6b6e \x5280\xff41\xc826\x1c4\0\0\xd020/\0\0\0\0\xffff\xffff\xffff\xffff\2\0\xae30\v\x1e8\0\xffff\xffff\0\0\0\0 \0\x98\0U\0\6\0\x626b\x6864\x6469\0\xffd8\xffff\x6b76\20\x98\0\xad68\v\2\0\1\0\x7645\x6e65\x4d74\x7365\x6173\x6567\x6946\x656c\xff60\xffff%SystemRoot%\System32\IoLogMsg.dll;%SystemRoot%\System32\drivers\kbdhid.sys\0\0\0\xffd8\xffff\x6b76\16\4\x8000\a\0\4\0\1\0\x7954\x6570\x5373\x7075\x6f70\x7472\x6465\0\xfff0\xffff\xad40\v\xae08\v\xae58\v\xffa8\xffff\x6b6e \x2810\xdcf0\x1d7\x1c5\0\0\xd020/\0\0\0\0\xffff\xffff\xffff\xffff\2\0\xaf78\v\x1e8\0\xffff\xffff\0\0\0\0 \0\x8c\0V\0\b\0\x654b\x6272\x7265\x736f\xffd8\xffff\x6b76\20\x8c\0\xaec0\v\2\0\1\0\x7645\x6e65\x4d74\x7365\x6173\x6567\x6946\x656c\xff70\xffff%SystemRoot%\System32\kerberos.dll;%SystemRoot%\System32\xpsp2res.dll\0\xffd8\xffff\x6b76\16\4\x8000\a\0\4\0\1\0\x7954\x6570\x5373\x7075\x6f70\x7472\x6465\0\xfff0\xffff\xae98\v\xaf50\v\x6b76\a\xffa8\xffff\x6b6e \x2cdc\xdf6c\xc826\x1c4\0\0\xd020/\0\0\0\0\xffff\xffff\xffff\xffff\2\0\xafe0\v\x1e8\0\xffff\xffff\0\0\0\0 \0\x9a\0W\0\a\0\x626c\x7472\x6466c\xfff0\xffff\xbe50/\x9fc04AT\xfff0\xffff\x3118\x81\x3190\x0081av\x6268\x6e69\xb000\v\x1000\0\0\0\0\0\0\0\0\0\0\0\xff38\xffff\x4322\x801\x5a5a\x52b\x4628\x301\xc80a\x2312\x3f28\x2502?\x12d\x106\x100\xff\x100\x201\0\x1b05\x404\x3c1e\x202\xff01\x109\3\xff00\x1001\x200\0\x2b01\x1e00\x200a\x2b0a\x2b00\0\x100\x110\x1204\x3219\xfafa\x101\1\x5000\x204\x1300\x5a41\x53c\0\x2f00\n\0\0\0\0\0\0\x4206\xa100\x424\x81\0\0\0\0\x100\xa02\x5578\x3c3c\x6428d\a\x155\0\0\x101\f\0\31\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x6c00\x3e66\xffd8\xffff\x6b76\t\xc1\0\xb110\v\3\0\1\v\x5241\x4547\x544e\x4e49A\0\xe0a0\v\xff38\xffff\x4024\x601\x9632+\x41ff\xff01\x500a\x230f\x3c12\x1204<\n\x105\x100x\x100\1\1\x3205\x4102\xff01\x4102\xff01\n\3\xff01\x1901\x201\0\x2b05\xff00\x2b0a\x2b32\x2b00\0\0\x100\x1e04\x3219\xfafa\x101\x600\x5000\x202\x1300\x6400\x53c\0\x3500\n\0\0\0\0\0\0\x4206\xa100\x424\x81\0d\x3c0f\x5016\x100\xa07\x5578\x3c3c\x6428d\a\x155\0\0\x101\f\0\31\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x6e00\x7274\b\0\xcb38\v\xf4d0\xffffdefault.tvp,keystone.exe,nvappbar.exe,nvapps.xml,nvcolor.exe,nvdspsch.exe,nview.dll,nvshell.dll,nvtuicpl.cpl,nvwdmcpl.dll,nvwimg.dll,nwiz.exe\0nvrsar.dll,nvwrsar.dll,nvcpar.hlp,nvwcpar.hlp\0nvrscs.dll,nvwrscs.dll,nvcpcs.hlp,nvwcpcs.hlp\0nvrsda.dll,nvwrsda.dll,nvcpda.hlp,nvwcpda.hlp\0nvrsde.dll,nvwrsde.dll,nvcpde.hlp,nvwcpde.hlp\0nvrsel.dll,nvwrsel.dll,nvcpel.hlp,nvwcpel.hlp\0nvrseng.dll,nvwrseng.dll,nvcpeng.hlp,nvwcpeng.hlp\0nvrses.dll,nvwrses.dll,nvcpes.hlp,nvwcpes.hlp\0nvrsesm.dll,nvwrsesm.dll,nvcpesm.hlp,nvwcpesm.hlp\0nvrsfi.dll,nvwrsfi.dll,nvcpfi.hlp,nvwcpfi."
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\BTHPORT\Parameters\Keys\000a3a5bfecc]
    "000e6d43b813"=hex:3f,96,a9,52,44,da,cf,47,15,85,91,76,ca,eb,8f,26

    scanning hidden registry entries ...

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\\x00ffc\xd3w\2]
    "b049C053C7D38EE4AB9A00CB3B5D2472"="C?\Program Files\Common Files\Microsoft Shared\Web Folders\PUBPLACE.HTT"

    scanning hidden files ...


    scan completed successfully
    hidden processes: 0
    hidden services: 0
    hidden files: 15


    Remaining Services :



    Authorized Application Key Export:

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\\Program Files\\Intuwave\\Shared\\mRouterRunTime\\mRouterRuntime.exe"="C:\\Program Files\\Intuwave\\Shared\\mRouterRunTime\\mRouterRuntime.exe:*:Enabled:mRouterRuntime"
    "C:\\Program Files\\Google\\Google Talk\\googletalk.exe"="C:\\Program Files\\Google\\Google Talk\\googletalk.exe:*:Enabled:Google Talk"
    "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
    "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
    "C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"="C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe:*:Enabled:Sid Meier's Civilization 4"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
    "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
    "C:\\Games\\Electronic Arts\\The Battle for Middle-earth (tm) II\\game.dat"="C:\\Games\\Electronic Arts\\The Battle for Middle-earth (tm) II\\game.dat:*:Enabled:The Battle for Middle-earth(tm) II"
    "C:\\Games\\Electronic Arts\\The Lord of the Rings, The Rise of the Witch-king\\game.dat"="C:\\Games\\Electronic Arts\\The Lord of the Rings, The Rise of the Witch-king\\game.dat:*:Enabled:The Lord of the Rings, The Rise of the Witch-king"
    "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
    "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

    Remaining Files :



    Files with Hidden Attributes :

    Mon 28 Jan 2008 1,404,240 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"
    Mon 28 Jan 2008 5,146,448 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
    Mon 28 Jan 2008 2,097,488 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
    Thu 28 Apr 2005 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
    Tue 10 Jun 2003 77,824 A..H. --- "C:\Works\cd3\PIP\launcher.exe"
    Sat 14 Jul 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp"
    Thu 21 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\b7e6c7771d289926881287eb0ecc2a85\BIT1D4.tmp"
    Thu 3 Nov 2005 68,096 ...H. --- "C:\Documents and Settings\Jesse\Application Data\Microsoft\Word\~WRL0076.tmp"
    Wed 29 Mar 2006 20,480 ...H. --- "C:\Documents and Settings\Jesse\Application Data\Microsoft\Word\~WRL0893.tmp"
    Thu 24 Aug 2006 101,888 ...H. --- "C:\Documents and Settings\Kari\Application Data\Microsoft\Mallit\~WRL3450.tmp"

    Finished!


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 21:46, on 2008-02-29
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Belkin\Bluetooth-ohjelmisto\bin\btwdins.exe
    C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    C:\Norman\Npf\BIN\NPFSVICE.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\system32\fxssvc.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\notepad.exe
    C:\PROGRA~1\TVAV~1\TVAV~1\TVTray.exe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
    C:\Norman\bin\ZLH.EXE
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
    C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\ALCWZRD.EXE
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\WINDOWS\system32\RunDLL32.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\system32\sgp71xedew.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Belkin\Bluetooth-ohjelmisto\BTTray.exe
    C:\Program Files\Nikon\NkView6\NkvMon.exe
    C:\Program Files\Nokia\PC Suite for N-Gage QD\connmngmntbox.exe
    C:\Program Files\Intuwave\Shared\mRouterRunTime\mRouterRuntime.exe
    C:\Program Files\Nokia\PC Suite for N-Gage QD\ectaskscheduler.exe
    C:\PROGRA~1\Nokia\PCSUIT~1\Elogerr.exe
    C:\PROGRA~1\Nokia\PCSUIT~1\BROADC~1.EXE
    C:\PROGRA~1\Nokia\PCSUIT~1\SCRFS.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\WINDOWS\System32\wbem\wmiprvse.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.soneraplaza.fi
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.dial.inet.fi:800
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;*.*.fi;*.*.*.fi;<local>
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {186962BB-D1BA-47CE-8CB8-8E55D6341058} - C:\WINDOWS\system32\certmgrn.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O2 - BHO: (no name) - {DDFDDBE4-7934-482D-A359-926B5CA42AFB} - c:\windows\system32\6to4svcc.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [High Definition Audio -ominaisuussivun pikakuvake] HDAudPropShortcut.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [TVTray] C:\PROGRA~1\TVAV~1\TVAV~1\TVTray.exe
    O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    O4 - HKLM\..\Run: [EPSON Stylus C62 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C62 Series" /O3 "USB" /M "Stylus C62"
    O4 - HKLM\..\Run: [EPSON Stylus C62 Series (Kopioi 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P34 "EPSON Stylus C62 Series (Kopioi 1)" /O6 "USB001" /M "Stylus C62"
    O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
    O4 - HKLM\..\Run: [AceGain LiveUpdate] C:\Games\AceGain\LiveUpdate\LiveUpdate.exe
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
    O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [Mirabilis ICQ] C:\PROGRA~1\ICQ\ICQNet.exe
    O4 - HKLM\..\Run: [PD0630 STISvc] RunDLL32.exe P0630Pin.dll,RunDLL32EP 513
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [YeppStudioAgent] C:\Program Files\Samsung\SamsungMediaStudio4.1\SamsungMediaStudioAgent.exe
    O4 - HKLM\..\Run: [TalkAndWrite] C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\1163D2B46CC742E5A3CC9E4157887751\TalkAndWrite.exe /run
    O4 - HKLM\..\Run: [sgp71xedew] C:\WINDOWS\system32\sgp71xedew.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
    O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
    O4 - HKCU\..\Run: [sgp71xedew] C:\WINDOWS\system32\sgp71xedew.exe
    O4 - HKCU\..\Policies\Explorer\Run: [{302316AF-0C81-1035-0407-050906040166}] "C:\Program Files\Common Files\{302316AF-0C81-1035-0407-050906040166}\Update.exe" mc-110-12-0000904
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: BTTray.lnk = ?
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
    O4 - Global Startup: PCSuiteForNokiaN-Gage QD Detect.lnk = ?
    O4 - Global Startup: PCSuiteForNokiaN-Gage QD TS.lnk = ?
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
    O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth-ohjelmisto\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth-ohjelmisto\btsendto_ie.htm
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
    O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} -
    O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
    O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safety.live.com/resource/download/scanner/wlscbase8460.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - Winlogon Notify: zifczjrn - C:\WINDOWS\SYSTEM32\6to4svcc.dll
    O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\Belkin\Bluetooth-ohjelmisto\bin\btwdins.exe
    O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\NORMAN\Nvc\BIN\nipsvc.exe
    O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE
    O23 - Service: Norman Type-R - Unknown owner - C:\Norman\Npf\BIN\NPFSVICE.EXE
    O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\bin\ZANDA.EXE
    O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\NORMAN\Nvc\BIN\nvcoas.exe
    O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

    --
    End of file - 11248 bytes
     
    Hadassa, 29.02.2008
    #4
  6. Hadassa

    Hadassa Member

    Liittynyt:
    29.02.2008
    Viestejä:
    15
    Kiitokset:
    0
    Pisteet:
    11

    SDFix: Version 1.146

    Run by J„rjestelm„nvalvoja on pe 29.02.2008 at 21:27

    Microsoft Windows XP [versio 5.1.2600]
    Running From: C:\SDFix

    Checking Services :


    Restoring Windows Registry Values
    Restoring Windows Default Hosts File

    Rebooting


    Checking Files :

    No Trojan Files Found






    Removing Temp Files

    ADS Check :



    Final Check :

    catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-02-29 21:34:38
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden services & system hive ...

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000a3a5bfecc]
    "000e6d43b813"=hex:3f,96,a9,52,44,da,cf,47,15,85,91,76,ca,eb,8f,26
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\000a3a5bfecc]
    "000e6d43b813"=hex:3f,96,a9,52,44,da,cf,47,15,85,91,76,ca,eb,8f,26
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Control\Session Manager]
    "PendingFileRenameOperations"=str(7):"\x6264\2\x55a0\v\0\0\xffc8\xffff\x6b76\e\4\x8000\x258\0\4\0\1\n\x6544\x6166\x6c75\x5374\x7465\x6974\x676e\x2e73\x5259\x7365\x6c6f\x7475\x6f69n%S\xffe0\xffffnvdisp.nvu\0\0\0\0\xffe0\xffff\x6b76\4,\0\x4fd0\v\1\0\1\0\x614e\x656d\0\0\xffd0\xffffNVIDIA Display Driver\0\x6268\x6e69\x5000\v\x1000\0\0\0\0\0\0\0\0\0\0\0\xffc0\xffff\x6b76"\4\x8000\4\0\4\0\1,\x6f5f\x696e\x652e\x6578\x4f3a\x4c47\x455f\x7478\x6e65\x6973\x6e6f\x7453\x6972\x676e\x564e\x7241\x6863SC2\xffc8\xffff\x6828\n\x66e0\n\x6858\n\x6888\n\x65f0\n\x6a08\n\x6a58\n\x4f58\v\x6a38\n\x5520\v\x6260\v\x5890\vF.\xffc0\xffff\x6b76#\4\x8000\1\0\3\0\0013\x585f\x3932\x452e\x4558\x4f3a\x6c67\x455f\x7478\x6e65\x6973\x6e6f\x7453\x6972\x676e\x6556\x7372\x6f69n&T\xffa8\xffff\x6b6e \x158e\xd021\xafbc\x1c5\0\0\x56c0Y\1\0\0\0\x60a0\v\xffff\xffff\0\0\xffff\xffff\x68c8\n\xffff\xffff\16\0\0\0\0\0\0\0\0\0\a\0\x6944\x7073\x616cy\xffa8\xffff\x6b6e \x158e\xd021\xafbc\x1c5\0\0\x50d8\v\1\0\0\0\x62e0\v\xffff\xffff\0\0\xffff\xffff\x68c8\n\xffff\xffff*\0\0\0\0\0\0\0\0\0\a\0\x6873\x6c65\x656cx\xff98\xffff\x6b6e \x158e\xd021\xafbc\x1c5\0\0\x5130\v\1\0\0\0\x6660\v\xffff\xffff\0\0\xffff\xffff\x68c8\n\xffff\xffff(\0\0\0\0\0\0\0\0\0\25\0\x7250\x706f\x7265\x7974\x6853\x6565\x4874\x6e61\x6c64\x7265s,\xff98\xffff\x6b6e \x158e\xd021\xafbc\x1c5\0\0\x5188\v\0\0\0\0\xffff\xffff\xffff\xffff\1\0\xb340\2\x68c8\n\xffff\xffff\0\0\0\0\0\0N\0\0\0\24\0\x564e\x4449\x4149\x4320\x4c50\x4520\x7478\x6e65\x6973\x6e6f0,\xffa8\xffff{FFB699E0-306A-11d3-8BD1-00104B6F7516}\0NQ7\xffe0\xffff\x6b76\a\b\0\x6a18\v\1\0\1R\x6553\x7672\x6369e\xfe60\xffffR&T0000=*,*,*,*,*,IBM251F.VSC2F0C.VSC3411.VSC3E19,HDLK\0R&T0001=1920,1080,*,30,*,CRTX,OEM,7425,2200,48,56,562,2,5,++I\0R&T0002=1920,1080,*,60,*,BNQ766A,ADD,CVTRB\0R&T0003=1920,1200,*,60,*,BNQ766A,ADD,CVTRB\0\0lp\xffc0\xffff\x6b76"\4\x8000\4\0\4\0\1N\x6f5f\x696e\x652e\x6578\x4f3a\x4c47\x455f\x7478\x6e65\x6973\x6e6f\x7453\x6972\x676e\x564e\x7241\x6863sel\xffd0\xffff\x6b76\25\4\x8000\a\0\4\0\1\0\x6544\x5376\x6977\x6374\x5368\x7075\x7270\x7365\x4d73\x7361\x466b\v\xffe0\xffff\x6b76\b\xade\0 !\a\0\1\0\x564e\x4d5f\x646f\x7365\b\0\x6174\0\xffe8\xffff\x7678\v\x7258\v\x9b78\v\x9b78\vm\0\xffc0\xffff\x6b76"\4\x8000\4\0\4\0\1\0\x6f5f\x696e\x652e\x6578\x4f3a\x4c47\x455f\x7478\x6e65\x6973\x6e6f\x7453\x6972\x676e\x564e\x7241\x6863\x6166\x6c75\x5374\xffe8\xffffisapnp\0n00\xffd8\xffff\x6b76\v\30\0\x62c0\v\1\0\1\0\x6e55\x6e69\x7473\x6c61\x656cr\0\0\xfff0\xffff\x7020A\xf020@\0\0\xffd8\xffff\x6b76\16\b\0\x6148\v\3\0\1\0\x7244\x7669\x7265\x6144\x6574\x6144\x6174\0\xffd8\xffff\x6b76\20,\0\x56a0\v\1\0\1,\x614d\x6374\x6968\x676e\x6544\x6976\x6563\x6449\xffd8\xffff\x6b76\n\24\0\x3fb8\v\1\0\1\0\x7244\x7669\x7265\x6144\x6574\0\0\0\xffd8\xffff\x6b76\r\26\0\x5650\v\1\0\1\0\x7244\x7669\x7265\x6556\x7372\x6f69n\0\xffe0\xffff7.0.0.1011\0\0\0\0\xffe0\xffff\x6b76\5\f\0\x5690\v\1\0\1\0\x6c43\x7361s\0\xfff0\xffffMEDIA\0\xffd0\xffffpci\ven_8086&dev_266f\0\xffd8\xffff\x6b76\nt\0\x56f8\v\1\0\1\0\x7244\x7669\x7265\x6544\x6373\0\0\0\xff88\xffffIntel(R) 82801FB/FBM Ultra ATA Storage Controllers - 266F\0\xffc8\xffff\x3e58\v\x3ef0\v\x3f20\v\x3f48\v\x61e8\v\x3f78\v\x3fd8\v\x55b0\v\x5600\v\x5628\v\x55d8\v\x56d0\vt\0\xffe8\xffff\x6b76\0<\0\x57c0\v\1\0\0\0\xffc0\xffff\xc4\xe4ni-, video- ja peliohjaimet\0\xfff0\xffff3004\0\a\xffd8\xffff\x6b76\v<\0\x5838\v\1\0\1\0\x6e49\x7473\x6c61\x656c\x33722\0\0\xffc0\xffffMmSys.Cpl,MediaClassInstaller\0\xffe8\xffff\x9358\v\x6d70\30\x6d98\30\x2190\31\x9688\v\xffd0\xffff\x6b76\22(\0\x58c0\v\1\0\1,\x6544\x6976\x6563\x4420\x7365\x7263\x7069\x6974\x6e6f\x7365\x6c6f\x7475\xffd0\xffffNVIDIA GeForce 6600\0\x455f\x7478\xfff0\xffffpci\0\x564e\x7241\b\0,O\xffe8\xffff\3\0\1\0\2\0\3\0\x9aa8\0\xfe60\xffffR&T0000=*,*,*,*,*,IBM251F.VSC2F0C.VSC3411.VSC3E19,HDLK\0R&T0001=1920,1080,*,30,*,CRTX,OEM,7425,2200,48,56,562,2,5,++I\0R&T0002=1920,1080,*,60,*,BNQ766A,ADD,CVTRB\0R&T0003=1920,1200,*,60,*,BNQ766A,ADD,CVTRB\0\00019\xfe60\xffffR&T0000=*,*,*,*,*,IBM251F.VSC2F0C.VSC3411.VSC3E19,HDLK\0R&T0001=1920,1080,*,30,*,CRTX,OEM,7425,2200,48,56,562,2,5,++I\0R&T0002=1920,1080,*,60,*,BNQ766A,ADD,CVTRB\0R&T0003=1920,1200,*,60,*,BNQ766A,ADD,CVTRB\0\00019\xffe0\xffff\x6b76\a\16\0\x5560\v\1\0\0014\x6553\x7672\x6369e\xffe0\xffff\x6b76\a\b\0\x6dd0\v\1\0\0010\x6553\x7672\x6369e\xffe0\xffff\x6b76\a\b\0\x58f0\v\1\0\0010\x6553\x7672\x6369e\xffe0\xffff\x6b76\a\b\0\x6f98\v\1\0\0012\x6553\x7672\x6369e\xffe0\xffff\x6b76\a\b\0\x5d00\v\1\0\1S\x6553\x7672\x6369e\xfff0\xffffpci\00036\xffe0\xffff\x6b76\a\22\0\x5d30\v\1\0\0011\x6553\x7672\x6369e\xffe8\xffffintelide\0000\xffe0\xffff\x6b76\a\22\0\x5d68\v\1\0\0010\x6553\x7672\x6369e\xffe8\xffffintelide\0002\xffd8\xffff\x6b76\0162\0\x5da8\v\a\0\0017\x6f43\x6e69\x7473\x6c61\x656c\x7372\x3233x\xffc8\xffffcoinst.dll,_MyCoInst@16\0\0000\xffd8\xffff\x6b76\f*\0\x5e08\v\1\0\0013\x7246\x6569\x646e\x796c\x614e\x656dx1\xffd0\xffffSmart Link 56K Modem\0;\xffe0\xffff\x6b76\b\4\x8000\1\0\4\0\1,\x4955\x754e\x626d\x7265\xffd8\xffff\x6b76\f"\0\xa6d8\r\a\0\0010\x6f4c\x6577\x4672\x6c69\x6574\x737232\xffe8\xffff<\0\0\0\0\0\1\0\x393\0\xffd8\xffff\x6b76\17F\0\x5ec0\v\1\0\0013\x6e45\x6d75\x7250\x706f\x6150\x6567\x33732\xffb0\xffffmodemui.dll,ModemPropPagesProvider\000600\xffe0\xffff\x6b76\3\34\0\x5f30\v\3\0\18\x4344B1D\xffe0\xffff\34\0\x800\a\x2015\0\0\n\n\b\x1100\23\0\0\xffa8\xffff\x6b6e \xe210\x3d8c\xafbd\x1c5\0\0\x7580\v\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x6ee0\2\x28d0\n\xffff\xffff\0\0\0\0\2\0L\0\6\0\4\0\x6e49\x7469 1\xffe0\xffff\x6b76\1\16\0\x5fc8\v\1\0\00121x14\xffe8\xffffAT<cr>\000536\xffe0\xffff\x6b76\1L\0\xde20\v\1\0\1\v2\0\x6361\x7363\x6268\x6e69\x6000\v\x1000\0\0\0\0\0\0\0\0\0\0\0\xffe0\xffff\x6b76\6\26\0\x4f90\v\1\0\1\0\x6353\x6972\x7470\0\xfff0\xffffIntel\0\xffc8\xffff\x6b76\e\4\x8000\1\0\3\0\1\n\x764e\x7043\x446c\x7369\x6c70\x7961\x7654\x6f4c\x6163\x656c\x6956\x6973\x6574d*,\xffe8\xffff\x6b76\08\0\x3b28\v\1\0\0\6\xfff0\xffff\x686c\1\x5130\v\x461\xc6a9\xffe0\xffffintelide\0st\0\0\0\xffd8\xffff\x6b76\f\f\0\x60f8\v\1\0\1\0\x7250\x766f\x6469\x7265\x614e\x656d\0\0\xffe8\xffffIntel\0oft\0\xffd8\xffff\x6b76\16\b\0\x6138\v\3\0\1\0\x7244\x7669\x7265\x6144\x6574\x6144\x6174\0\xfff0\xffff\x4000\x53da\xf6a7\x1c4\0\0\xfff0\xffff\x4000\x53da\xf6a7\x1c4\0\0\b\0\x61e8\v\xffd8\xffff\x6b76\n\24\0\x6188\v\1\0\1\0\x7244\x7669\x7265\x6144\x6574\0\0\0\xffe8\xffff1-10-2005\0\xffd8\xffff\x6b76\r\26\0\x61c8\v\1\0\1\0\x7244\x7669\x7265\x6556\x7372\x6f69n\0\xffe0\xffff7.0.0.1011\00006\0\xffe0\xffff\x6b76\a\24\0\x6230\v\1\0\1\0\x6e49\x5066\x7461h\xffd8\xffff\x6b76\20<\0\x3d00\v\1\0\1\4\x614d\x6374\x6968\x676e\x6544\x6976\x6563\x6449\xffe8\xffffoem25.inf\0\xffe8\xffff3,6,2,5\0\x3938\v\xffc8\xffff\x6b76\32\4\x8000\20\0\4\0\0012\x6544\x6166\x6c75\x5374\x7465\x6974\x676e\x2e73\x6942\x7374\x6550\x5072\x6c65\0NV\xffe0\xffff\x6b76\a\b\0\x6da8\v\1\0\1e\x6553\x7672\x6369e\b\092\xffe0\xffffnvudisp.exe\0\0\0\xfff0\xffff\x686c\1\x5188\v\x6b07\x78bb\xffd8\xffff\x6b76\t\xb28\0\xb1e0\v\a\0\1\0\x6f43\x7970\x6946\x656cs\0\0\0\xffd8\xffff\x6b76\n\4\x8000#\0\4\0\1\0\x6544\x6976\x6563\x7954\x6570\0\0\0\xffd0\xffff\x6b76\25\4\x8000\x100\0\4\0\1\0\x6544\x6976\x6563\x6843\x7261\x6361\x6574\x6972\x7473\x6369s\0\xffe0\xffff\x6b76\b0\0\x6390\v\3\0\1\0\x6553\x7563\x6972\x7974\xffc8\xffff\1\x9004\0\0\0\0\0\0\24\0\2\34\1\0\0\24\0\x1000\x101\0\0\x500\22\0\0\0\xffe8\xffff\x686c\2\xe248\v\x1b18\x933b\xe398\v\x1b19\x933b\xffd8\xffff\x6b76\17@\0\x6408\v\1\0\1\0\x6e45\x6d75\x7250\x706f\x6150\x6567\x33732\xffb8\xffffMmSys.Cpl,MediaPropPageProvider\0\0\0\xfff0\xffff\xc000\x39fc\x46ce\x1c5\xe588\36\b\0\x6468\v\xffd8\xffff\x6b76\20<\0\x6490\v\1\0\1\0\x7254\x756f\x6c62\x5365\x6f68\x746f\x7265\x302d\xffc0\xffffhcp://help/tshoot/tssound.htm\0\xffe0\xffff\x6b76\4\n\0\x5800\v\1\0\1\0\x6349\x6e6f\0\0\xffe0\xffff\x5670\v\x57a8\v\x5810\v\x63e0\v\x6468\v\x64d0\v\x6510\v\xffc8\xffff\x6b76\31\4\x8000\0\0\3\0\1\0\x6944\x6173\x6c62\x5365\x7465\x7075\x6944\x6843\x6e61\x6567\x7453\x7461e\0\0\0\xffe0\xffff\x6b76\a\24\0\x6568\v\1\0\1\0\x6e49\x5066\x7461h\xffe0\xffffoem27.inf\0f\0\0\0\xffd8\xffff\x6b76\n\36\0\x65b0\v\1\0\1\0\x6e49\x5366\x6365\x6974\x6e6f\0\0\0\xffd8\xffffIntcAzAudModel\0\0\0\0\xffd8\xffff\x6b76\f8\0\x6600\v\1\0\1\0\x7250\x766f\x6469\x7265\x614e\x656d\0\0\xffc0\xffffRealtek Semiconductor Corp.\0\0\0\xffe0\xffff5.10.0.5124\0\x79e\0\xfff0\xffff\x686c\1\x51f0\v\x3463\xc6c4\xffd8\xffff\x6b76\16\b\0\x6450\v\3\0\1\0\x7244\x7669\x7265\x6144\x6574\x6144\x6174\0\xffd8\xffff\x6b76\n\24\0\x66c0\v\1\0\1\0\x7244\x7669\x7265\x6144\x6574\0\0\0\xffe8\xffff4-22-2005\0\xffe8\xffff.NTx86\0\0\0\0\b\0\x66f8\v\xffd8\xffff\x6b76\r\30\0\x6640\v\1\0\1\36\x7244\x7669\x7265\x6556\x7372\x6f69\x796e\37\xffd8\xffff\x6b76\20d\0\x6748\v\1\0\1\36\x614d\x6374\x6968\x676e\x6544\x6976\x6563\x6449\xff98\xffffhdaudio\func_01&ven_10ec&dev_0880&subsys_08800000\0\xffd8\xffff\x6b76\r\16\0\x66d8\v\1\0\1\0\x6e49\x5366\x6365\x6974\x6e6f\x7845t\0\xffd8\xffff\x6b76\n<\0\x6800\v\1\0\1\0\x7244\x7669\x7265\x6544\x6373\0\0\0\xff70\xffffRealtek High Definition Audio\0 (High Definition Audio) - Realtek 880\0\0\xffc8\xffff\x6b76\37\4\x8000\1\0\4\0\1\0\x6553\x7574\x5070\x6572\x6566\x7272\x6465\x7541\x6964\x446f\x7665\x6369\x7365\x6f43\x6e75t\xffd0\xffffwdmaud,swmidi,redbook\0\xffe0\xffffRtkHDAud.sys\0\x7461\xffd0\xffffwave,midi,mixer,aux\0i,\xfff0\xffff\x686c\1\x6b88\v\xa530\x30c\xffe0\xffff\x6b76\a(\0\x89f8\30\1\0\1\v\x6553\x7672\x6369e\xffe8\xffffIntel\0oft\0\xffa8\xffff\x6b6e \xdda2\x51ef\xafbd\x1c5\0\0\xad90Y\4\0\0\0\x6c80\v\xffff\xffff\1\0\x3060\v\x28d0\n\xffff\xffff\n\0\0\0\24\0(\0\1\0\a\0\x7244\x7669\x7265s\xffd8\xffff\x6b76\n(\0\x6918\v\1\0\1u\x7553\x4362\x616c\x7373\x7365\0au\b\0\xffff\xffff\xfff0\xffffpci\0E\0\xffa8\xffff\x6b6e \xdda2\x51ef\xafbd\x1c5\0\0\x6990\v\1\0\0\0\x6ae0\v\xffff\xffff\0\0\xffff\xffff\x28d0\n\xffff\xffff\24\0\0\0\0\0\0\0\3\0\4\0\x6177\x6576\1\5\xffa0\xffff\x6b6e \x75b8\x5e12\xafbd\x1c5\0\0\x6a28\v\0\0\0\0\xffff\xffff\xffff\xffff\3\0\x8618\3\x28d0\n\xffff\xffff\0\0\0\0\26\0<\0\0\0\n\0\x6477\x616d\x6475\x642e\x7672\0\x6a08\v\xfff0\xffff\x686c\1\x6a80\v\xa530\x30c\xffe0\xffff\x6b76\6\26\0\x6b10\v\1\0\1\0\x7244\x7669\x7265\0\xffe0\xffffwdmaud.drv\0\0\xbf70\t\xffa8\xffff\x6b6e \xdda2\x51ef\xafbd\x1c5\0\0\x6990\v\1\0\0\0\x6948\v\xffff\xffff\0\0\xffff\xffff\x28d0\n\xffff\xffff\24\0\0\0\0\0\0\0\1\0\4\0\x696d\x6964io\xffa0\xffff\x6b6e \x75b8\x5e12\xafbd\x1c5\0\0\x6b30\v\0\0\0\0\xffff\xffff\xffff\xffff\3\0\xce40\3\x28d0\n\xffff\xffff\0\0\0\0\26\0<\0\0\0\n\0\x6477\x616d\x6475\x642e\x7672\0\x6bf8\v\xffe0\xffff\x6b76\6\26\0\x6c08\v\1\0\1d\x7244\x7669\x7265d\xffe0\xffffwdmaud.drv\0\0\x6c40\v\xffa8\xffff\x6b6e \xdda2\x51ef\xafbd\x1c5\0\0\x6990\v\1\0\0\0\x6d08\v\xffff\xffff\0\0\xffff\xffff\x28d0\n\xffff\xffff\24\0\0\0\0\0\0\0\2\0\5\0\x696d\x6578r\0\xffd8\xffff\x686c\4\x2208\30\x683a\1\x6b30\v\x13f7=\x6c28\v\x4d65\x8d4\x6a28\v\xa667D\xffa0\xffff\x6b6e \x75b8\x5e12\xafbd\x1c5\0\0\x6c28\v\0\0\0\0\xffff\xffff\xffff\xffff\3\0\x4f80\4\x28d0\n\xffff\xffff\0\0\0\0\26\0<\0\0\0\n\0\x6477\x616d\x6475\x642e\x7672\0\x6b76\v\xfff0\xffff\x686c\1\x6ca8\v\xa530\x30c\xffe0\xffff\x6b76\6\26\0\x6d38\v\1\0\1e\x7244\x7669\x7265e\xffe0\xffffwdmaud.drv\0tio\xffe0\xffff\x6b76\6\26\0\x6d78\v\1\0\1\v\x7244\x7669\x7265\v\xffe0\xffffwdmaud.drv\0\x6169s\\xfff0\xffff.NT\0\0\0\xfff0\xffffpci\0\x1c30\30\xffe8\xffff\x6de0\v\x6e18\v\x6e50\v\x6e78\v\x6ea8\v\xfff0\xffffpci\0\0\0\xffc8\xffff\x6b76\e\4\x8000\0\0\3\0\1\0\x6f46\x7772\x7261\x5364\x6570\x6b61\x7265\x6f43\x666e\x6769\x7275\x7461\x6f69n\0\0\xffc8\xffff\x6b76\34\4\x8000\1\0\3\0\1\0\x6749\x6f6e\x6572\x5344\x7053\x6165\x656b\x4372\x6e6f\x6966\x7567\x6172\x6974\x6e6f\0\0\xffd8\xffff\x6b76\n\4\x8000\0\0\4\0\1\3\x7753\x7061\x6543\x4c6e\x6566\0\0011\xffd0\xffff\x6b76\24\2\x8000\2\0\3\0\1D\x7053\x6165\x656b\x4372\x6e6f\x6966\x7567\x6172\x6974\x6e6fcc\xffd8\xffff\x6b76\17\4\x8000\24\0\4\0\1\v\x7053\x6165\x656b\x4772\x6f65\x656d\x7274y\xffd0\xffff\x6b76\22\4\x8000\1\0\3\0\1\0\x6344\x664f\x7366\x7465\x6f57\x6b72\x7261\x756f\x646e\0\0\0\xffd0\xffff\x6b76\23\4\x8000\1\0\3\0\1\0\x6552\x6573\x4174\x6475\x6f69\x6746\x6e4f\x7453\x7261t\0\0\xffc8\xffff\x6b76\36\4\x8000\1\0\3\0\1\0\x7953\x4173\x6475\x6f69\x6f54\x6f70\x694d\x696e\x6f70\x7472\x6f57\x6b72\x7261\x756f\x646e\0\xffd0\xffff\x6b76\23\4\x8000\0\0\3\0\1\0\x6156\x696c\x6164\x6574\x6f43\x6564\x5763\x6972\x6574s\0\0\xfff0\xffffpci\0ER\b\0Mg\xffd0\xffff\x6b76\26\4\x8000\0\0\3\0\1\0\x6553\x646e\x6146\x656b\x6350\x4378\x6766\x6544\x5666\x7265\x7362\0\xffe0\xffff\x6b76\6\x198\0\x44c0\v\a\0\1\0\x564e\x525f\x5426\v\x6268\x6e69\x7000\v\x1000\0\0\0\0\0\0\0\0\0\0\0\xffd8\xffff\x6b76\20\4\x8000\0\0\4\0\1k\x6e45\x6261\x656c\x6f46\x5272\x756f\x6974\x676e\xfff8\xffff\x8520\v\xfff0\xffffCOM3\0\0\xfff0\xffff\x79c0\v\x3f00\32\x9a38\v\xfee8\xffffPCI\VEN_163C&DEV_3052&REV_04\0PCI\VEN_163C&DEV_3052\0PCI\VEN_163C&CC_070300\0PCI\VEN_163C&CC_0703\0PCI\VEN_163C\0PCI\CC_070300\0PCI\CC_0703\0\0\0\x7758\v\xffe8\xffffINTEL_USB\0\xfff8\xffff\x9a38\v\xffe0\xffff\x6b76\5\f\0\x7918\v\1\0\1\0\x6c43\x7361\x6973\x676e\xfff8\xffff\x73a0\v\xfff8\xffff\x9a88\v\xfff0\xffff\x7560\v\x7a68\v\x6174\0\xffc0\xffffSmart Link (www.smlink.com)\0006,\xffd0\xffffSmart Link 56K Modem\0\x796c\xffd8\xffff\x6b76\r\20\0\x75d8\v\3\0\1\v\x6550\x6d72\x6e61\x6e65\x4774\x6975\x7864\v\xffc8\xffffslcpappl.cpl,ConfigProc\0\xffff\xffff\xffe0\xffff\x6b76\3\4\x8000\1\0\3\0\1\0\x3237\x3030\0\x6e6f\xffe0\xffff\x6b76\4\4\x8000\2\0\3\0\1\v\x6853\x776f\x7738\v\xffe8\xffff1-10-2005\0\xffd8\xffff\x6b76\r\20\0\x7998\v\3\0\1'\x6550\x6d72\x6e61\x6e65\x4774\x6975\x7364\x6f70\xff98\xffff\x6b6e \x13b0\x9a35\x70ad\x1c5\0\0\x7580\v\4\0\0\0\x9230\v\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff"\0\0\0\0\0\0\0\5\0\22\0\x6f48\x7473\x6142\x6573\x4d64\x646f\x6d65\x6144\x6174\0\1\x4c4f\xffd8\xffff\x6b76\r.\0\x9cc0\v\1\0\1'\x6e49\x7473\x6c61\x536c\x756f\x6372e\0\xffd8\xffff\x6b76\f\30\0\x9cf8\v\1\0\1\x706d\x6f43\x666e\x6769\x6944\x6c61\x676f\xf465\27\xfff8\xffff\x9ab0\v\xfff0\xffff\x6264\4\x7b20\v\0\0\xffd0\xffffSmart Link 56K Modem\0001\xffd8\xffff\x6b76\n\1\x8000\2\0\3\0\1\v\x6544\x6976\x6563\x7954\x6570\v\x4d68\v\b\0\xae98\v\xffa0\xffffC:\WINDOWS\ModemLog_Smart Link 56K Modem.txt\0'\xfff0\xffffModem\0\xfff0\xffff\0\0\0\0\0\0\xff98\xffff\x6b6e \x5aa6\x9ade\x70ad\x1c5\0\0\x4e40\v\0\0\0\0\xffff\xffff\xffff\xffff\3\0\x5508\v\x6db8\6\xffff\xffff\0\0\0\0\32\0*\0\0\0\21\0\x6544\x6976\x6563\x5020\x7261\x6d61\x7465\x7265\x6573\x7073\x6e6f\x6573\xfff8\xffff\x7e40\v\xfff8\xffff\x78a0\v\xffe0\xffff\x6b76\5L\0\x6f88\32\1\0\1\x326d\x4c43\x4953\x7944\0\xffa8\xffff\x6b6e \xcc64\x3db7\xafbd\x1c5\0\0\x5848Z\16\0\0\0\x6c20\30\xffff\xffff/\0\x94a8\v\x1e8\0\xffff\xffff$\0\0\0.\0\x9e\0\0\0\4\0\x3030\x3030\x6b76\b\xffe8\xffff\x3e01\x6f02\xf2b9\x4fcb\x3cb5\x2e11\x7490\x386f\x6976\x6563\xfff8\xffff\x96a8\v\xfff8\xffff\x90c8\v\xff88\xffff\x6b73\0\x3330\t\xd240\v\6\0`\0\1\x9404H\0T\0\0\0\24\0\0024\2\0\0\30?\17\x201\0\0\x500 \0\x220\0\0\24?\17\x101\0\0\x500\22\0\x101\0\0\x500\22\0\x101\0\0\x500\22\0\xffe0\xffff\x6b76\b\n\0\x7050\v\1\0\0016\x6f50\x7472\x614e\x656d\xffd8\xffff\x6b76\n\n\0\x7890\v\1\0\1s\x7441\x6174\x6863\x6465\x6f54521\xffe0\xffff\x6b76\3\4\x8000\1\0\3\0\1\v\x3638\x3e32\x6c3c\x3e66\xfff0\xffff\x8000\xc562\x1c0\x1c1\1e\xfff0\xffff\xbf20\27\x6b58\32\x7700\v\xffd8\xffff\x6b76\vZ\0\x7468\v\1\0\1\v\x6f4c\x6767\x6e69\x5067\x7461h\x4d68\v\xfff0\xffffIntel\0\xffd8\xffff\x6b76\20\32\0\x9bd0\v\1\0\1S\x6f50\x7472\x6f43\x666e\x6769\x6944\x6c61\x676f\xffd8\xffff\x6b76\20T\0\x7788\v\1\0\1\x5754\x6441\x6176\x636e\x6465\x6553\x7474\x6e69\x7367\xffa8\xffffmsports.dll,SerialDisplayAdvancedSettings\0\xffd8\xffff0,1,3,4,6,7,256\0\x76c0\v\xffd8\xffff\x6b76\f8\0\x71e8\v\1\0\1\0\x614d\x756e\x6166\x7463\x7275\x7265\x7a90\v\xffe0\xffff\x6b76\2\4\x8000\x6b3e\3\3\0\1L\x4449900\b\0\x99b8\v\xfff0\xffff\x6980\xff67\xffff\xffff\0\0\xffd8\xffff\x6b76\f\4\x8000\0\0\4\0\1\0\x6e45\x6261\x656c\x6f46\x5272\x7361cT\xfff0\xffffCOM3\0\0\xffe0\xffff\x6b76\4\b\0\x4db8\v\3\0\1\35\x6954\x656d\xec20\35\xffa8\xffff{4D36E96D-E325-11CE-BFC1-08002BE10318}\00056K\xfff0\xffffModem\0\xffe8\xffffPosix\0\0\2\x201\0\xffd8\xffff\x6b76\16\xa2\0\x6958\32\1\0\1\0\x6544\x6976\x6563\x6e49\x7473\x6e61\x6563\0\xfff8\xffff\x7940\v\xffd8\xffff\x6b76\17\4\x80000\0\1\0\1\0\x6552\x6461\x6e4f\x796c\x6f43\x6e75\x7274y\xffe8\xffff\x3e01\x6f02\xf2b9\x4fcb\x3cb5\x2e11\x7490\x386f\xe158'\xfff0\xffffPorts\0\xffe0\xffff\x6b76\5L\0\x4840\32\1\0\1a\x4c43\x4953\x3344\x3731\xfff0\xfffffdc\0\0\0\xffc8\xffff\x3938\v\x3958\v\x39a8\v\x39d8\v\x3a38\v\x3a60\v\x9ad8\v\x9d18\v\x9770\v\x9798\v\x97c8\v\x97e8\v\x6b76\b\xffe8\xffffIntel\0oft\0\xffd8\xffff\x6b76\f*\0\x7408\v\1\0\1-\x7246\x6569\x646e\x796c\x614e\x656d3\0\xffd8\xffff\x6b76\f6\0\xb800\21\1\0\1\x505f\x7246\x6569\x646e\x796c\x614e\x656dlp\xffa0\xffff{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\0nt\xfff0\xffffMO\0\v\x40a1\xbeaf\xfff8\xffff\x89a8\v\xfff0\xffff\xf200\xf8d8\xffff\xffff\x1a38\36\xfff8\xffff\x8b70\v\xffe8\xffff\x1020v\x5020v\x9020v\xd020v\x72c8\24\xffd8\xffff\x6b76\v\22\0\x7b60\v\1\0\1\v\x4c53\x6953\x6e67\x7461\x7275e\x7808\v\xffe8\xffffSLAMR2KO\0\v\xffd8\xffff\x6b76\r8\0\x7ba0\v\1\0\1\v\x6f4d\x6564\x506d\x6f72\x6976\x6564\x7672\v\xffc0\xffffSmart Link (www.smlink.com)\0\x9e00\v\xfff0\xffff.NT\0\xe918\xb548\xffe0\xffff\x6b76\b\6\0\x7af0\v\1\0\1\x5ad0\x4c53\x6544\x6976\x6563\xff98\xffff\x6b6e \xcdd2\x3d98\xafbd\x1c5\0\0\x9300\v\0\0\0\0\xffff\xffff\xffff\xffffI\0\x1c48\31\x28d0\n\xffff\xffff\0\0\0\0.\0\xc1\0\1\0\26\0\x6f48\x6f6d\x6f6c\x6167\x6974\x6e6f\x6150\x6172\x656d\x6574\x7372\v\xffa8\xffff\x6b6e \xe210\x3d8c\xafbd\x1c5\0\0\x9c08\v\1\0\0\0\x8240\v\xffff\xffff\f\0\xee00\v\x1e8\0\xffff\xffff\16\0\0\0002\0\4\0\0\0\b\0\x5044\x7244\x7669\x7265\xffe0\xffff\x6b76\b\4\x8000\n\0\3\0\1\xc24f\x6441\x4464\x6c65\x7961\b\0\x9568\v\xffd0\xffff\x6b76\22\4\x8000\0\0\4\0\1\31\x6350\x556d\x7370\x7274\x6165\x456d\x616e\x6c62\x6465\0\0\0\xffd0\xffff\x6b76\23\4\x8000\1\0\4\0\1\x801\x7551\x6369\x436b\x6e6f\x656e\x7463\x6e45\x6261\x656cd\x104\x100\xffd8\xffff\x6b76\t\4\x8000\1\0\4\0\1\xff01\x3456\x4334\x6e6f\x6966\x1e67\x2b07\x2b32\x2b00\xffa8\xffff\x6b6e \x760a\x9a37\x70ad\x1c5\0\0\x7338\v\2\0\0\0\xeea0\v\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff*\0\0\0\0\0\0\0\3\0\b\0\x6553\x7672\x6369\x7365\xff98\xffff\x6b6e \x109a\x98cd\x70ad\x1c5\0\0\x7d80\v\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x7550\v\x1e8\0\xffff\xffff\0\0\0\0\n\0\4\0\0\0\21\0\x4c53\x7845\x5374\x6b70\x5340\x474c\x6e65\x7053\x196b\x201\0\x2b05\xffe0\xffff\x6b76\5\4\x8000\1\0\4\0\1\0\x7453\x7461\x1365\x6400\xffa0\xffff\x6b6e \xd54e\x98d1\x70ad\x1c5\0\0\x9c08\v\0\0\0\0\xffff\xffff\xffff\xffff\4\0\x1f88\v\x1e8\0\xffff\xffff\0\0\0\0\16\0\4\0\1\0\t\0\x4148\x444c\x6972\x6576r\0\0\0\xffe0\xffff\x6b76\6\4\x8000\x2580\0\3\0\1\xf01\x6152\x6574\x6e49\x2a04\xffe0\xffff\x6b76\a\4\x8000\x2580\0\3\0\1\x4102\x6152\x6574\x754f\xff74\xffe0\xffff\x6b76\4\4\x8000\1\0\3\0\1\x1904\x5345\x4d53\x202\1\xffa8\xffff\x6b6e \x109a\x98cd\x70ad\x1c5\0\0\x9c08\v\0\0\0\0\xffff\xffff\xffff\xffff\t\0\x91b0\v\x1e8\0\xffff\xffff\0\0\0\0*\0\4\0\2\0\b\0\x5748\x7244\x7669\x7265\xffc0\xffff\x686c\a\x7c78\v\xd640\xeead\x7e60\v\x2b3d\xc24f\x7f20\v\xeff3\x86b4\xe4b8\v\x1bf\x4280\xd0c0\v\x62ae\x8a5e\x9c68\v\xb881\x97c\x9d58\v\x552b\xe7b1\xffe0\xffff\x6b76\b\4\x8000\0\0\3\0\1\v\x6552\x4464\x6c65\x7961\xffd8\xffff\x6b76\v\4\x8000\1\0\3\0\1\v\x704f\x2e74\x6349\x4268\x6f69s\x7d02\xc41b\x6268\x6e69\x8000\v\x1000\0\0\0\0\0\0\0\0\0\0\0\xffa0\xffff\x6b6e \x305c\xa5db\xfeff\x1c4\0\0\x6d70(\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x8100\v\xfbc0/\xffff\xffff\0\0\0\0L\0\4\0,\0\t\0\x6553\x7672\x6369\x6e69g1A.\xffc0\xffff\x6b76&\4\x8000\1\0\4\0\1a\x397b\x6538\x3937\x3163\x2d35\x6236\x3333\x342d\x6463\x2d33\x3338\x6162\x302d\x6334\x6433\x3234\x6236\x3538\x7d34e\xffc0\xffff\x6b76&\4\x8000\1\0\4\0\1/\x617b\x3739\x3262\x6438\x2d37\x3635\x3135\x342d\x6134\x2d61\x3362\x3730\x332d\x3039\x6538\x3633\x3130\x6430\x7d663\xfff0\xffff\x8080\v\x80c0\v\x6b76\a\xffa0\xffff\x6b6e \x5536\x64ca\x7b05\x1c8\0\0\x6d70(\16\0\0\0\xfde8\n\xffff\xffff\20\0\xfa68\25\x1e8\0\xffff\xffff*\0\0\0<\0\xd288\0-\0\17\0\x6553\x7373\x6f69\x206e\x614d\x616e\x6567r\xffd8\xffff\x6b76\t\4\x8000\0\0\4\0\1\17\x6e45\x6261\x656c\x434dE\0\0\30\xffd0\xffff\x6b76\24\2\x8000\0\0\a\0\1\0\x7845\x6c63\x6475\x4665\x6f72\x4b6d\x6f6e\x6e77\x6c44\x736c\D\xffe0\xffff\x1668\3\x5e30\t\xf478\n\xf9f8\n\xfb38\n\xfa80\n\x776fs\xffd8\xffff\x6b76\v*\0\x8558\v\a\0\1\0\x6f42\x746f\x7845\x6365\x7475e\0\0\xffd0\xffff\x6b76\30\4\x8000\1\x800\3\0\1\xffff\x615f\x6d6f\x652e\x6578\x443a\x4433\x474f\x5f4c\x3736\x3032\x3537\x3635\xfff0\xffff\x686c\1\x9300\v\xfb18\x5684\xffd0\xffff\x6b76\26\4\x8000\x8d00'\4\0\1\0\x7243\x7469\x6369\x6c61\x6553\x7463\x6f69\x546e\x6d69\x6f65\x7475\x7153\xffe0\xffffLocalSystem\0\0\0\xffe8\xffffSL1900 PCI\xffd8\xffff\x6b76\n\4\x8000\0\0\4\0\1A\x6c47\x626f\x6c61\x6c46\x6761ati\xffd0\xffff\x6b76\21\4\x8000\0\0\4\0\1\0\x6548\x7061\x6553\x6d67\x6e65\x4374\x6d6f\x696dt\0\0\0\xffe8\xffffUSBSTOR\0\xfcdd\x1c4\xfff8\xffff\x8d28\v\xffc8\xffff\x6b76\36\4\x8000\0\0\4\0\0013\x6548\x7061\x6544\x6f43\x6d6d\x7469\x7246\x6565\x6c42\x636f\x546b\x7268\x7365\x6f68\x646c\0\xffc8\xffff\x6b76\36\4\x8000\0\0\4\0\1\0\x6548\x7061\x6544\x6f43\x6d6d\x7469\x6f54\x6174\x466c\x6572\x5465\x7268\x7365\x6f68\x646c\0\xffd8\xffff\x6b76\16\4\x8000\1\0\4\0\1\1\x7250\x746f\x6365\x6974\x6e6f\x6f4d\x6564\1\xffd0\xffff\x6b76\22\4\x8000\0\0\4\0\1\0\x6548\x7061\x6553\x6d67\x6e65\x5274\x7365\x7265\x6576\0\0\0\xffd0\xffff\x6b76\24\4\x8000\xe340\t\4\0\1\1\x6552\x6f73\x7275\x6563\x6954\x656d\x756f\x4374\x756f\x746e\x9dd8\1\xffd0\xffff\x6b76\21.\0\x8458\v\a\0\1\0\x624f\x656a\x7463\x6944\x6572\x7463\x726f\x6569s\0\0\0\xffc8\xffff\Windows\0\RPC Control\0\0\0\0\x500\xffe0\xffff\x8150\3\x8428\3\x8100\3\x8488\3\x8818\3\x9928\3\xa310\24\xffd8\xffff\x6b76\tN\0\xdaf8\24\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffe8\xffff\4\0\1\0\2\0\3\0\4\0\xfff8\xffff\x8ed8\v\xffd8\xffff\x6b76\t\4\x8000\1\0\4\0\1\0\x6e45\x6261\x656c\x434d\x241\0\x101\0\xffd8\xffff\x6b76\16\xd090\0\x73f8\v\3\0\1\5\x7041\x4370\x6d6f\x6170\x4374\x6361\x6568\5\xfff0\xffff\x686c\1\x88e0\v\xa8dd\xcd7d\xff88\xffffautocheck autochk *\0\0precovr \SystemRoot\sprecovr.txt\0\0\0\0\0\b\0\x7d60\v\xffa0\xffff\x6b6e \xed28\xe74c\x7b07\x1c8\0\0\x8110\v\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x7048\v\x28d0\n\xffff\xffff\0\0\0\0\34\0\xd090\0\1\0\20\0\x7041\x4370\x6d6f\x6170\x6974\x6962\x696c\x7974\xffa0\xffff\x6b6e \xf496\x38dd\x1d7\x1c5\0\0\x8110\v\17\0\0\0\x17b8\v\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff\22\0\0\0\0\0\0\0\2\0\n\0\x7041\x5070\x7461\x6863\x7365XE3\xffa8\xffff\x6b6e \xf496\x38dd\x1d7\x1c5\0\0\x8638\v\1\0\0\0\x8760\v\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff:\0\0\0\0\0\0\0\0\0\3\0\x5743\x544\22\0\xff90\xffff\x6b6e \xf496\x38dd\x1d7\x1c5\0\0\x8698\v\1\0\0\0\x8860\v\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff\4\0\0\0\0\0\0\0\0\0\34\0\x6666\x3630\x3130\x3230\x3234\x6433\x3061\x3030\x3430\x3730\x3031\x6538\x3530\x3030\0\0\xfff0\xffff\x686c\1\x86f0\v\x827d\x7a8c\xffa8\xffff\x6b6e \xb7b2\xdf56\xc826\x1c4\0\0\x86f0\v\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x8850\v\x1e8\0\xffff\xffff\0\0\0\0\16\0\35\0\0\0\1\0001\x500\22\0\xffe0\xffff\x6b76\4\25\0\x87e8\v\3\0\1\0\x6441\x3164\0\0\xffe0\xffff\x1502\xa040\x1e10\x23b8\x8e00\x8bd8\x140e\x8107\xe1\x1f02\xc3\0\0\0\xffe0\xffff\x6b76\a\35\0\x8828\v\3\0\1\x500\x6843\x6e61\x65671\xffd8\xffff\x1d01\x4850\x550c\xec8b\xb8\x9c00\x8159\xe1\x5502\xec8b\xb8\xe800\x57e7\x9090\x90\0 \0\xfff0\xffff\x87c8\v\x8808\v\x8790\v\xfff0\xffff\x686c\1\x8770\v1\0\xffa8\xffff\x6b6e \xf496\x38dd\x1d7\x1c5\0\0\x8638\v\1\0\0\0\x8548\v\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff:\0\0\0\0\0\0\0\1\0\b\0\x4e49\x5453\x4942\x3130\xfff0\xffff\x686c\1\x8aa8\v\xfaf3\x6286\b\0\x9892\x7eec\xff90\xffff\x6b6e \xf496\x38dd\x1d7\x1c5\0\0\x8870\v\1\0\0\0\x8a18\v\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff\4\0\0\0\0\0\0\0\0\0\34\0\x6666\x3630\x3130\x3230\x3234\x3339\x3135\x3030\x3430\x3730\x3032\x3337\x3530\x3030\2\0\xffa8\xffff\x6b6e \xb7b2\xdf56\xc826\x1c4\0\0\x88e0\v\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x7b00\v\x1e8\0\xffff\xffff\0\0\0\0\16\0I\0\0\0\1\0001\0\0\0\xffe0\xffff\x6b76\aI\0\x89c8\v\3\0\1\0\x6843\x6e61\x65671\xffb0\xffff\x4901\x18d0\x4522\x8b55\x1eec\x43b4\xc032\x56c5\xcd06\x1f21\xa72\x5ec4\x260a\xf89\xc033\x4eb\xe850\x2fa\x4d5d\x55cb\xec8b\xb81e\x4300\x56c5\xcd06\x1f21\xd72\x5ec4\x800a\x1fe1\x8926\x330f\xebc0\x5004\xfae8\x5d02\xcb\0\xfff0\xffff\x686c\1\x8950\v1\0\xffa8\xffff\x6b6e \xf496\x38dd\x1d7\x1c5\0\0\x8638\v\1\0\0\0\x88c8\v\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff:\0\0\0\0\0\0\0\2\0\b\0\x4e49\x5453\x4942\x3230\xfff0\xffff\x686c\1\x8e10\v\xa7a3\x9c77\xffe8\xffff\x1301\x1e84\x4507\x8b55\x68ec\x2000\x5545\xec8b\x268 \xff90\xffff\x6b6e \xf496\x38dd\x1d7\x1c5\0\0\x8a28\v\1\0\0\0\x8be8\v\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff\4\0\0\0\0\0\0\0\0\0\34\0\x6666\x3630\x3130\x3230\x3234\x3634\x3338\x3030\x3430\x3730\x3039\x3863\x3430\x3030\0\0\xffa8\xffff\x6b6e \xb7b2\xdf56\xc826\x1c4\0\0\x8aa8\v\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x7b18\v\x1e8\0\xffff\xffff\0\0\0\0\16\0Q\0\0\0\1\0001\2\x201\0\xffe0\xffff\x6b76\aQ\0\x8b90\v\3\0\1\0\x6843\x6e61\x65671\xffa8\xffff\x5101\x4612\x4526\x8b55\x56ec\x1e57\x43b4\xc032\x56c5\xcd06\x1f21\xa72\x5ec4\x260a\xf89\xc033\x4eb\xe850\x34b\x5e5f\x4d5d\x45cb\x8b55\x1eec\x43b4\xc032\x56c5\xcd06\x1f21\xa72\x5ec4\x800a\x1fe1\x8926\x330f\xebc0\x5004\x4be8\x5d03\xcb4d\x90\0\xfff0\xffff\x686c\1\x8b18\v1\0\xffa8\xffff\x6b6e \xf496\x38dd\x1d7\x1c5\0\0\x8638\v\1\0\0\0\x8cc0\v\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff:\0\0\0\0\0\0\0\3\0\a\0\x4e49\x5453\x4942N\xff90\xffff\x6b6e \xf496\x38dd\x1d7\x1c5\0\0\x8bf8\v\1\0\0\0\x8d68\v\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff\4\0\0\0\0\0\0\0\0\0\34\0\x6666\x3630\x3130\x3230\x6334\x6261\x6237\x3030\x3430\x3730\x3062\x6165\x3430\x3030\0\0\xfff0\xffff\x686c\1\x8c50\v\x5f5b\xa886\xffa8\xffff\x6b6e \xb7b2\xdf56\xc826\x1c4\0\0\x8c50\v\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x8328\v\x1e8\0\xffff\xffff\0\0\0\0\16\0\25\0\0\0\1\0\x5d32\xe1d2\24\0\xffe0\xffff\x6b76\a\25\0\x8d48\v\3\0\1\0\x6843\x6e61\x65671\xffe0\xffff\x1501\x3bf0\x3d08\x5f03\x374\x6e9\x3d00\x5f03\x9090\x6e9\0\2\x201\0\xfff0\xffff\x686c\1\x8cd0\v2\0\xffa8\xffff\x6b6e \xf496\x38dd\x1d7\x1c5\0\0\x8638\v\1\0\0\0\x8a80\v\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff:\0\0\0\0\0\0\0\4\0\a\0\x4e49\x5453\x4353R\xffe0\xffff\x6b76\3\30\0\x8df0\v\1\0\1\0\x4e55C\0\0\xffe0\xffff\Device\Mup\0\0\0\xff90\xffff\x6b6e \xf496\x38dd\x1d7\x1c5\0\0\x8d78\v\1\0\0\0\x8ef8\v\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff\4\0\0\0\0\0\0\0\0\0\34\0\x6666\x3630\x3130\x3230\x3463\x6237\x6631\x3030\x3430\x3730\x3035\x6264\x3130\x3030 \0\xffa8\xffff\x6b6e \xb7b2\xdf56\xc826\x1c4\0\0\x8e10\v\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x84f0\v\x1e8\0\xffff\xffff\0\0\0\0\16\0\23\0\0\0\1\0e\0\0\0\xffe0\xffff\x6b76\a\23\0\x8a90\v\3\0\1\0\x6843\x6e61\x65671\xfff0\xffff\x686c\1\x8e80\vE\0\xffa8\xffff\x6b6e \xf496\x38dd\x1d7\x1c5\0\0\x8638\v\1\0\0\0\x8fd0\v\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff6\0\0\0\0\0\0\0\5\0\b\0\x544c\x5053\x4952\x544e\xff90\xffff\x6b6e \xf496\x38dd\x1d7\x1c5\0\0\x8f08\v\1\0\0\0\x8fe0\v\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff\4\0\0\0\0\0\0\0\0\0\32\0\x6666\x3630\x3130\x3230\x3234\x6634\x6633\x3030\x3330\x3630\x3037\x3636\x3030\0\0\0\xfff0\xffff\x686c\1\x8f60\v\x75d2\xc26f\xfff0\xffff\x686c\1\x2020\v1\0\xfff0\xffffdisk\0\0\x6268\x6e69\x9000\v\x1000\0\0\0\0\0\0\0\0\0\0\0\xffd8\xffff\x6b76\t\4\x8000\2\0\3\0\1\x2304\x704f\x2e74\x7541\x6964o\x100\1\1\xffa8\xffff\x6b6e \xd54e\x98d1\x70ad\x1c5\0\0\x7580\v\1\0\0\0\x9a20\v\xffff\xffff\1\0\x75f8\v\x1e8\0\xffff\xffff\f\0\0\0\34\0\2\0\3\0\3\0\x6146x\0d\xffd8\xffff\x6b76\20\4\x8000\1\0\4\0\1\0\x3456\x4334\x6e6f\x6966\x4567\x616e\x6c62\x6465\xffd8\xffff\x6b76\16\2\x8000\0\0\1\0\1\0\x7250\x4465\x6169\x436c\x6d6f\x616d\x646e\x801\xffd8\xffff\x6b76\r\4\x8000\0\0\3\0\1\x101\x704f\x2e74\x694d\x6578\x4d64\x646f\x3c65\x804\xffd8\xffff\x6b76\f\4\x8000\1\0\3\0\1\x2b00\x704f\x2e74\x6f4e\x3344\x6f43\x646c\x101\1\xffe0\xffffSLIOLights\0\v\x9160\v\xffd8\xffff\x6b76\r\4\x8000\0\0\3\0\1d\x704f\x2e74\x654b\x7065\x7453\x7461e\31\xffd8\xffff\x6b76\f\4\x8000\1\0\3\0\1\0\x704f\x2e74\x4d50\x4143\x6177\x6572\0004\xffd8\xffff\x7cd0\v\x7fb8\v\x7fd8\v\x9020\v\x90f0\v\x9118\v\x9160\v\x9188\v\x92d0\v\xffa8\xffff\x6b6e \x109a\x98cd\x70ad\x1c5\0\0\x7338\v\0\0\0\0\xffff\xffff\xffff\xffff\3\0\x6c58\2\x1e8\0\xffff\xffff\0\0\0\0\32\0\36\0\1\0\a\0\x7244\x7669\x7265s\xffd8\xffff\x686c\4\xbf90\v\xab62\xb44b\x91d8\v\xdfbf\xfa87\x9c08\v\xea98\x6e7f\x7d80\v\xf730\x227a\xffd8\xffff\x6b76\r\36\0\x9280\v\1\0\1\x600\x7053\x6165\x656b\x4472\x6972\x6576\x3572\n\xffd8\xffffSlnthalDevice0\0\x3c3c\x6428d\xffd8\xffff\x6b76\r\26\0\x9140\v\1\0\1\0\x4c53\x694c\x6867\x4474\x6972\x6576r\0\xffd0\xffff\x6b76\25\4\x8000\1\0\3\0\1\x601\x704f\x2e74\x7355\x4265\x6f69\x5373\x656c\x7065\x7453\x7461\x165\x100\xffa8\xffff\x6b6e \xcc64\x3db7\xafbd\x1c5\0\0\x7c78\v\3\0\0\0\xd2d8\v\xffff\xffff\5\0\x5878\v\x1e8\0\xffff\xffff,\0\0\0 \0d\0\0\0\a\0\x6f43\x6e75\x7274\xa179\xffe0\xffff\x6b76\6\4\x80000\0\1\0\1d\x7541\x6f74\x5058\0\xffe0\xffff\x6b76\b\20\0\x9398\v\1\0\1\0\x5044\x7244\x7669\x7265\xffe8\xffffMTLSTRM\0\x4321\x801\xffe0\xffff\x6b76\3\4\x8000\1\0\3\0\1\0\x35390\0\v\xffd0\xffff\x6b76\22\4\x8000\1\0\4\0\1V\x6f4d\x6564\x4f6d\x486e\x6c6f\x4564\x616e\x6c62\x6465\0\x9498\v\xffe8\xffffINTEL_USB\0\xffd8\xffff\x6b76\17\4\x8000<\0\3\0\1\xa52\x6e49\x6361\x6974\x6976\x7974\x6353\x6c61e\xffc8\xffff\x6b76\31\4\x8000\0\0\3\0\1\v\x6341\x6563\x656c\x6172\x6574\x5264\x7365\x6f70\x736e\x7669\x6e65\x7365\x7873\v\x7310\v\xffe0\xffff\x6b76\3\4\x8000\0\0\3\0\1\v\x6f4cg\x9fb8\v\xfff0\xffff\x8000\xc562\x1c0\x1c1\x6f69n\xff38\xffff\x7698\v\x7700\v\x7438\v\x7738\v\x7760\v\x7808\v\x9bb0\v\x7830\v\x7310\v\x73c8\v\x9db0\v\x9dd8\v\x9ec0\v\x9e00\v\x9e20\v\x9fb8\v\x9fd8\v\x7b38\v\x7bf0\v\x7b78\v\x9418\v\x9650\v\x1298\f\x6ea8\30\x12e8\f\x1310\f\x1338\f\x77d0\30\x7fb0\30\x72a8\30\x72d0\30\xa2a8\30\x8638\30\x87c0\30\x8358\30\x83a8\30\x83d0\30\x2378\31\xae8\31\xbe70\v\x5d80\v\x5de0\v\x5e38\v\x5e98\v\x5f10\v\x3878\v\x3aa8\v\x3a10\v\1\0\xff38\xffff\x4024\x601\x9632+\x41ff\xff01\x500a\x230f\x3c12\x1204<\n\x105\x100x\x100\1\1\x3205\x4102\xff01\x4102\xff01\n\3\xff01\x1901\x201\0\x2b05\xff00\x2b0a\x2b32\x2b00\0\0\x100\x1e04\x3219\xfafa\x101\x600\x5000\x202\x1300\x6400\x53c\0\x3500\n\0\0\0\0\0\0\x4206\xa100\x424\x81\0d\x3c0f\x5016\x100\xab5\x5578\x3c3c\x6428d\a\x155\0\0\x101\f\0\31\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x2e00\x3233\xffe8\xffffINTEL_USB\0\xffe0\xffff\x6b76\5\20\0\x9670\v\1\0\1\0\x6552\x6573t\0\xffe8\xffffATZ<cr>\0\x4132\x401\xffe0\xffff\x6b76\3\4\x8000\0\0\3\0\1\v\x4250\x3e58\x6c3c\x3e66\xffd8\xffff\x6b76\n\4\x8000"\0\4\0\1\xffff\x6553\x4274\x7469\x616d\x6b73\0\x77f0\v\xffd8\xffff\x6b76\n\4\x8000\1\0\4\0\1\x4954\x6553\x4274\x7469\x616d\x6b73\0\x6b76\30\xffd8\xffff\x6b76\f\4\x8000\xfffe\xffff\4\0\1\x3e66\x6552\x6573\x4274\x7469\x616d\x6b73\x3242\x3231\xffd8\xffff\x6b76\n\4\x8000\2\0\4\0\1\v\x6553\x4274\x7469\x616d\x6b73\x5544\x414c\x4954\xffd8\xffff\x6b76\f\4\x8000\xfffd\xffff\4\0\1\0\x6552\x6573\x4274\x7469\x616d\x6b73\1\0\xffd8\xffff\x6b76\t\4\x8000\1\0\4\0\1\v\x6341\x6974\x6e6f\x6553\x6374\x3e72\x6c3c\x3e66\xffd0\xffff\x6b76\22\4\x8000\1\0\4\0\1\30\x6f43\x6e75\x4674\x726f\x6341\x6974\x6176\x6974\x6e6f\x3e72\x6c3c\x3e66\xffe0\xffff\x6b76\a\4\x8000\2\0\4\0\1\30\x6954\x656d\x756ft\xffd0\xffff\x6b76\30\4\x8000\1\0\4\0\1\x4954\x7041\x7270\x786f\x6d69\x7461\x5365\x6165\x6372\x4568\x616e\x6c62\x6465\xffd8\xffff\x6b76\20\4\x8000\2\0\4\0\1\x4954\x6544\x6166\x6c75\x4174\x7463\x6f69\x536e\x7465\xffc8\xffff\x6b76\31\4\x8000\1\0\4\0\1\x3e66\x6544\x6166\x6c75\x4374\x756f\x746e\x6f46\x4172\x7463\x7669\x7461\x6f69n\0\0\v\xffc8\xffff\x6b76\e\4\x8000\n\0\4\0\1\v\x6544\x6166\x6c75\x4374\x756f\x746e\x6f46\x4472\x6165\x7463\x7669\x7461\x6f69n\x7c10\v\xffb8\xffff\x6b76)\4\x8000\1\0\4\0\1\v\x6544\x6166\x6c75\x5474\x6572\x7461\x6f43\x6e6e\x6365\x6974\x6e6f\x7341\x614c\x6b63\x664f\x6553\x736e\x7469\x7669\x7469y\0\0\v\xffd8\xffff\x6b76\20\4\x8000\3\0\4\0\1\v\x6544\x6166\x6c75\x4174\x7463\x6f69\x536e\x7465\xffc8\xffff\x6b76\31\4\x8000\1\0\4\0\1\34\x6544\x6166\x6c75\x4374\x756f\x746e\x6f46\x4172\x7463\x7669\x7461\x6f69\x4f6e\x4e4e\x4345\x2054\xffc8\xffff\x6b76\e\4\x8000\5\0\4\0\1\x4b0\x6544\x6166\x6c75\x4374\x756f\x746e\x6f46\x4472\x6165\x7463\x7669\x7461\x6f69n\1\v\xffd8\xffff\x6b76\n\4\x8000\6\0\4\0\1\x3e72\x3956\x4d30\x6e69\x7854\x5250\0\2\x960\xffd8\xffff\x6b76\v\4\x8000\xfb\0\4\0\1\v\x6150\x656e\x4c6c\x6769\x7468\x3e73\x6c3c\x3e66\xffd8\xffff\x6b76\17\4\x8000\0\0\4\0\1\v\x6e45\x6261\x656c\x5453\x7553\x7070\x726ft\xffe8\xffff1-10-2005\0\xfff0\xffff\x686c\1\xd650\v\x7273\x1d9e\b\0\0\0\xffd8\xffff\x6b76\16"\0\x9a60\v\1\0\1\0\x6544\x6976\x6563\x6e49\x7473\x6e61\x6563\0\xffd8\xffffRoot\SYSTEM\0000\0\0\xffd8\xffff\x6b76\f\xd4\0\x4428\f\1\0\1\0\x7953\x626d\x6c6f\x6369\x694c\x6b6e\0\0\xffd8\xffff\x6b76\f\xd4\0\x4500\f\1\0\1\0\x7953\x626d\x6c6f\x6369\x694c\x6b6e\0\0\xffb8\xffff\x6b76)\4\x8000\0\0\4\0\1l\x6e49\x6573\x736e\x7469\x7669\x7469\x4d79\x7365\x6173\x6567\x6552\x6573\x7374\x6341\x6974\x6176\x6974\x6e6f\x6f43\x6e75t\0\0\x97c\xfff0\xffff\x16ea\xb465\xaf96\x1c5\xff\xff\xffd8\xffff\x6b76\0170\0\x7280\v\1\0\1\x258\x6553\x656c\x7463\x6f43\x6e75\x7274\x33792\xffe0\xffff\x6b76\a\f\0\x74c8\v\1\0\1\xffff\x6553\x7672\x6369e\xffd8\xffff\x6b76\n\4\x8000\0\0\4\0\1\v\x6157\x656b\x6e4f\x6952\x676e\v\x4d68\v\xfff0\xffff.NT\0\x7828\35\xffe0\xffff\x6b76\5*\0\x7228\v\1\0\1\v\x6f4d\x6564\x776c\v\xffe0\xffffserialui.dll\0'\xffe8\xffffPrefetch\0\36\xffa0\xffff\x6b6e \x13b0\x9a35\x70ad\x1c5\0\0\x7338\v\a\0\0\0\x7f78\v\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff\22\0\0\0\0\0\0\0\2\0\n\0\x6150\x6172\x656d\x6574\x7372\x6564\x486d\x6c65\xffa8\xffff\x6b6e \x924c\x3bf7\xafbd\x1c5\0\0\x9c08\v\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x71c8\v\x1e8\0\xffff\xffff\0\0\0\0\32\0.\0\5\0\5\0\x6553\x7574\x6170\x6c62\xffc8\xffffc:\windows\pack17739\o\0\0\x9cf8\v\xffe0\xffffmodemui.dll\0\x616e\x6c62\xffc0\xffff\x6b76"\4\x8000\0\0\4\0\1\v\x7254\x6165\x4374\x6e6f\x656e\x7463\x6f69\x416e\x4c73\x6361\x4f6b\x5366\x6e65\x6973\x6974\x6976\x7974\0\0\0\xffa8\xffff\x6b6e \xe210\x3d8c\xafbd\x1c5\0\0\x9c08\v\0\0\0\0\xffff\xffff\xffff\xffff\4\0\xeef8\v\x1e8\0\xffff\xffff\0\0\0\0\20\0\4\0\6\0\a\0\x7053\x6165\x656br\xffd8\xffff\x6b76\f\1\x8000\2\0\3\0\1\v\x6f50\x7472\x7553\x4362\x616c\x7373\x6b76\v\xffd8\xffff\x6b76\n\4\x8000\x317\x8219\3\0\1\x4e79\x6f43\x746e\x6f72\x536c\x6d75\0FI\xffe0\xffff\x6b76\b8\0\x9f58\v\1\0\1\v\x5753\x6556\x646e\x726f\xffd8\xffff\x6b76\t\32\0\x9f98\v\1\0\1\v\x5753\x6556\x7372\x6f69\x9d6e\v\x9d18\v\xffd0\xffff\x6b76\25\4\x8000\1\0\4\0\1\v\x4f4d\x4548\x616e\x6c62\x4f65\x7475\x6f47\x6e69\x4367\x6c61\x566c\x342e\xffd0\xffff\x6b76\23\4\x8000\4\0\4\0\1\v\x6157\x7469\x6e69\x4367\x6c61\x526c\x7365\x6f70\x736e\x5465\x434f\x4c4f\xffe8\xffffIntel\0oft\0\xffd8\xffff\x6b76\f\32\0\x9ee8\v\1\0\1\v\x6f4d\x6564\x566c\x7265\x6973\x6e6f\xa330\0\xffe0\xffffVer3.40.03FA\0\x100\xffc0\xffffSmart Link (www.smlink.com)\0\x9db0\v\xfff0\xffff\x8000\xc562\x1c0\x1c1\1\0\xffc0\xffffSmart Link (www.smlink.com)\0\0\0\xffe0\xffffVer3.40.03FA\0o\xffe0\xffff\x6b76\b8\0\x9f08\v\1\0\1a\x5748\x6556\x646e\x726f\xffd8\xffff\x6b76\t\24\0\x82a0\v\1\0\1\v\x5748\x6556\x7372\x6f69\xd56e\v\xd618\v\x6268\x6e69\xa000\v\x1000\0\0\0\0\0\0\0\0\0\0\0\xffa8\xffff\x6b6e \x6f80\xde05\xc87a\x1c4\0\0\xd020/\0\0\0\0\xffff\xffff\xffff\xffff\2\0\xa110\v\x1e8\0\xffff\xffff\0\0\0\0 \0D\0G\0\a\0\x5049\x4f42\x544fP\xffd8\xffff\x6b76\20D\0\xa0a0\v\2\0\1\0\x7645\x6e65\x4d74\x7365\x6173\x6567\x6946\x656c\xffb8\xffff%SystemRoot%\System32\ipbootp.dll\0\xffd8\xffff\x6b76\16\4\x8000\a\0\4\0\1\0\x7954\x6570\x5373\x7075\x6f70\x7472\x6465\0\xfff0\xffff\xa078\v\xa0e8\v\3\xff01\xffa8\xffff\x6b6e \x6f80\xde05\xc87a\x1c4\0\0\xd020/\0\0\0\0\xffff\xffff\xffff\xffff\2\0\xa208\v\x1e8\0\xffff\xffff\0\0\0\0 \0<\0H\0\5\0\x5049\x474dMP\xffd8\xffff\x6b76\20<\0\xa1a0\v\2\0\1e\x7645\x6e65\x4d74\x7365\x6173\x6567\x6946\x656c\xffc0\xffff%SystemRoot%\System32\rtm.dll\0\xffd8\xffff\x6b76\16\4\x8000\a\0\4\0\1r\x7954\x6570\x5373\x7075\x6f70\x7472\x6465A\xfff0\xffff\xa178\v\xa1e0\v\xff01\x4102\xffa8\xffff\x6b6e \x6f80\xde05\xc87a\x1c4\0\0\xd020/\0\0\0\0\xffff\xffff\xffff\xffff\2\0\xa310\v\x1e8\0\xffff\xffff\0\0\0\0 \0F\0I\0\b\0\x5049\x414e\x4854\x504c\xffd8\xffff\x6b76\20F\0\xa298\v\2\0\1\0\x7645\x6e65\x4d74\x7365\x6173\x6567\x6946\x656c\xffb0\xffff%SystemRoot%\System32\ipnathlp.dll\0\0\0\0\xffd8\xffff\x6b76\16\4\x8000\a\0\4\0\1\0\x7954\x6570\x5373\x7075\x6f70\x7472\x6465\0\xfff0\xffff\xa270\v\xa2e8\v\x110\x1e04\xffa8\xffff\x6b6e \x6f80\xde05\xc87a\x1c4\0\0\xd020/\0\0\0\0\xffff\xffff\xffff\xffff\2\0\xa410\v\x1e8\0\xffff\xffff\0\0\0\0 \0B\0J\0\6\0\x5049\x4952\x3250\0\xffd8\xffff\x6b76\20B\0\xa3a0\v\2\0\1\0\x7645\x6e65\x4d74\x7365\x6173\x6567\x6946\x656c\xffb8\xffff%SystemRoot%\System32\iprip2.dll\0\0\xffd8\xffff\x6b76\16\4\x8000\a\0\4\0\1\0\x7954\x6570\x5373\x7075\x6f70\x7472\x6465\0\xfff0\xffff\xa378\v\xa3e8\v\x2b32\x2b00\xffa0\xffff\x6b6e \x6f80\xde05\xc87a\x1c4\0\0\xd020/\0\0\0\0\xffff\xffff\xffff\xffff\2\0\xa518\v\x1e8\0\xffff\xffff\0\0\0\0 \0B\0K\0\17\0\x5049\x6f52\x7475\x7265\x614d\x616e\x6567r\xffd8\xffff\x6b76\20B\0\xa4a8\v\2\0\1\0\x7645\x6e65\x4d74\x7365\x6173\x6567\x6946\x656c\xffb8\xffff%SystemRoot%\System32\mprmsg.dll\0\0\xffd8\xffff\x6b76\16\4\x8000\a\0\4\0\1\0\x7954\x6570\x5373\x7075\x6f70\x7472\x6465\0\xfff0\xffff\xa480\v\xa4f0\v\x5241K\xffa8\xffff\x6b6e \xc5f6\xdbb3\xc87a\x1c4\0\0\xd020/\0\0\0\0\xffff\xffff\xffff\xffff\2\0\xa620\v\x1e8\0\xffff\xffff\0\0\0\0 \0F\0L\0\5\0\x5049\x6553c\0\xffd8\xffff\x6b76\20F\0\xa5a8\v\2\0\1\0\x7645\x6e65\x4d74\x7365\x6173\x6567\x6946\x656c\xffb0\xffff%SystemRoot%\System32\netevent.dll\0\0\0\0\xffd8\xffff\x6b76\16\4\x8000\a\0\4\0\1\0\x7954\x6570\x5373\x7075\x6f70\x7472\x6465\0\xfff0\xffff\xa580\v\xa5f8\v\0\0\xffa8\xffff\x6b6e \x6f80\xde05\xc87a\x1c4\0\0\xd020/\0\0\0\0\xffff\xffff\xffff\xffff\2\0\xa720\v\x1e8\0\xffff\xffff\0\0\0\0 \0B\0M\0\5\0\x5049\x4358P\0\xffd8\xffff\x6b76\20B\0\xa6b0\v\2\0\1\0\x7645\x6e65\x4d74\x7365\x6173\x6567\x6946\x656c\xffb8\xffff%SystemRoot%\System32\mprmsg.dll\0\0\xffd8\xffff\x6b76\16\4\x8000\a\0\4\0\1\0\x7954\x6570\x5373\x7075\x6f70\x7472\x6465\0\xfff0\xffff\xa688\v\xa6f8\v\x3c1e\x1402\xffa8\xffff\x6b6e \x6f80\xde05\xc87a\x1c4\0\0\xd020/\0\0\0\0\xffff\xffff\xffff\xffff\2\0\xa820\v\x1e8\0\xffff\xffff\0\0\0\0 \0B\0N\0\6\0\x5049\x5258\x5049\0\xffd8\xffff\x6b76\20B\0\xa7b0\v\2\0\1\0\x7645\x6e65\x4d74\x7365\x6173\x6567\x6946\x656c\xffb8\xffff%SystemRoot%\System32\mprmsg.dll\0\0\xffd8\xffff\x6b76\16\4\x8000\a\0\4\0\1\0\x7954\x6570\x5373\x7075\x6f70\x7472\x6465\0\xfff0\xffff\xa788\v\xa7f8\v\0\4\xffa0\xffff\x6b6e \x6f80\xde05\xc87a\x1c4\0\0\xd020/\0\0\0\0\xffff\xffff\xffff\xffff\2\0\xa928\v\x1e8\0\xffff\xffff\0\0\0\0 \0B\0O\0\20\0\x5049\x5258\x756f\x6574\x4d72\x6e61\x6761\x7265\xffd8\xffff\x6b76\20B\0\xa8b8\v\2\0\1\0\x7645\x6e65\x4d74\x7365\x6173\x6567\x6946\x656c\xffb8\xffff%SystemRoot%\System32\mprmsg.dll\0\0\xffd8\xffff\x6b76\16\4\x8000\a\0\4\0\1\0\x7954\x6570\x5373\x7075\x6f70\x7472\x6465\0\xfff0\xffff\xa890\v\xa900\v\x101\1\xffa8\xffff\x6b6e \x6f80\xde05\xc87a\x1c4\0\0\xd020/\0\0\0\0\xffff\xffff\xffff\xffff\2\0\xaa28\v\x1e8\0\xffff\xffff\0\0\0\0 \0B\0P\0\6\0\x5049\x5358\x5041\0\xffd8\xffff\x6b76\20B\0\xa9b8\v\2\0\1\0\x7645\x6e65\x4d74\x7365\x6173\x6567\x6946\x656c\xffb8\xffff%SystemRoot%\System32\mprmsg.dll\0\0\xffd8\xffff\x6b76\16\4\x8000\a\0\4\0\1\0\x7954\x6570\x5373\x7075\x6f70\x7472\x6465\0\xfff0\xffff\xa990\v\xaa00\v\3\xff01\xffa8\xffff\x6b6e \xe48e\xf48d\xc826\x1c4\0\0\xd020/\0\0\0\0\xffff\xffff\xffff\xffff\2\0\xab80\v\x1e8\0\xffff\xffff\0\0\0\0 \0\x98\0Q\0\6\0\x7369\x7061\x706e\0\xffd8\xffff\x6b76\20\x98\0\xaab8\v\2\0\1\0\x7645\x6e65\x4d74\x7365\x6173\x6567\x6946\x656c\xff60\xffff%SystemRoot%\System32\IoLogMsg.dll;%SystemRoot%\System32\drivers\isapnp.sys\0\0\0\xffd8\xffff\x6b76\16\4\x8000\a\0\4\0\1\0\x7954\x6570\x5373\x7075\x6f70\x7472\x6465\0\xfff0\xffff\xaa90\v\xab58\v\08\xffa8\xffff\x6b6e \xb4da\xff43\xc826\x1c4\0\0\xd020/\0\0\0\0\xffff\xffff\xffff\xffff\2\0\xacd8\v\x1e8\0\xffff\xffff\0\0\0\0 \0\x9c\0T\0\b\0\x626b\x6364\x616c\x7373\xffd8\xffff\x6b76\20\x9c\0\xac10\v\2\0\1\0\x7645\x6e65\x4d74\x7365\x6173\x6567\x6946\x656c\xff60\xffff%SystemRoot%\System32\IoLogMsg.dll;%SystemRoot%\System32\drivers\kbdclass.sys\0\xffd8\xffff\x6b76\16\4\x8000\a\0\4\0\1\0\x7954\x6570\x5373\x7075\x6f70\x7472\x6465\0\xfff0\xffff\xabe8\v\xacb0\v\0\0\xffa8\xffff\x6b6e \x5280\xff41\xc826\x1c4\0\0\xd020/\0\0\0\0\xffff\xffff\xffff\xffff\2\0\xae30\v\x1e8\0\xffff\xffff\0\0\0\0 \0\x98\0U\0\6\0\x626b\x6864\x6469\0\xffd8\xffff\x6b76\20\x98\0\xad68\v\2\0\1\0\x7645\x6e65\x4d74\x7365\x6173\x6567\x6946\x656c\xff60\xffff%SystemRoot%\System32\IoLogMsg.dll;%SystemRoot%\System32\drivers\kbdhid.sys\0\0\0\xffd8\xffff\x6b76\16\4\x8000\a\0\4\0\1\0\x7954\x6570\x5373\x7075\x6f70\x7472\x6465\0\xfff0\xffff\xad40\v\xae08\v\xae58\v\xffa8\xffff\x6b6e \x2810\xdcf0\x1d7\x1c5\0\0\xd020/\0\0\0\0\xffff\xffff\xffff\xffff\2\0\xaf78\v\x1e8\0\xffff\xffff\0\0\0\0 \0\x8c\0V\0\b\0\x654b\x6272\x7265\x736f\xffd8\xffff\x6b76\20\x8c\0\xaec0\v\2\0\1\0\x7645\x6e65\x4d74\x7365\x6173\x6567\x6946\x656c\xff70\xffff%SystemRoot%\System32\kerberos.dll;%SystemRoot%\System32\xpsp2res.dll\0\xffd8\xffff\x6b76\16\4\x8000\a\0\4\0\1\0\x7954\x6570\x5373\x7075\x6f70\x7472\x6465\0\xfff0\xffff\xae98\v\xaf50\v\x6b76\a\xffa8\xffff\x6b6e \x2cdc\xdf6c\xc826\x1c4\0\0\xd020/\0\0\0\0\xffff\xffff\xffff\xffff\2\0\xafe0\v\x1e8\0\xffff\xffff\0\0\0\0 \0\x9a\0W\0\a\0\x626c\x7472\x6466c\xfff0\xffff\xbe50/\x9fc04AT\xfff0\xffff\x3118\x81\x3190\x0081av\x6268\x6e69\xb000\v\x1000\0\0\0\0\0\0\0\0\0\0\0\xff38\xffff\x4322\x801\x5a5a\x52b\x4628\x301\xc80a\x2312\x3f28\x2502?\x12d\x106\x100\xff\x100\x201\0\x1b05\x404\x3c1e\x202\xff01\x109\3\xff00\x1001\x200\0\x2b01\x1e00\x200a\x2b0a\x2b00\0\x100\x110\x1204\x3219\xfafa\x101\1\x5000\x204\x1300\x5a41\x53c\0\x2f00\n\0\0\0\0\0\0\x4206\xa100\x424\x81\0\0\0\0\x100\xa02\x5578\x3c3c\x6428d\a\x155\0\0\x101\f\0\31\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x6c00\x3e66\xffd8\xffff\x6b76\t\xc1\0\xb110\v\3\0\1\v\x5241\x4547\x544e\x4e49A\0\xe0a0\v\xff38\xffff\x4024\x601\x9632+\x41ff\xff01\x500a\x230f\x3c12\x1204<\n\x105\x100x\x100\1\1\x3205\x4102\xff01\x4102\xff01\n\3\xff01\x1901\x201\0\x2b05\xff00\x2b0a\x2b32\x2b00\0\0\x100\x1e04\x3219\xfafa\x101\x600\x5000\x202\x1300\x6400\x53c\0\x3500\n\0\0\0\0\0\0\x4206\xa100\x424\x81\0d\x3c0f\x5016\x100\xa07\x5578\x3c3c\x6428d\a\x155\0\0\x101\f\0\31\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x6e00\x7274\b\0\xcb38\v\xf4d0\xffffdefault.tvp,keystone.exe,nvappbar.exe,nvapps.xml,nvcolor.exe,nvdspsch.exe,nview.dll,nvshell.dll,nvtuicpl.cpl,nvwdmcpl.dll,nvwimg.dll,nwiz.exe\0nvrsar.dll,nvwrsar.dll,nvcpar.hlp,nvwcpar.hlp\0nvrscs.dll,nvwrscs.dll,nvcpcs.hlp,nvwcpcs.hlp\0nvrsda.dll,nvwrsda.dll,nvcpda.hlp,nvwcpda.hlp\0nvrsde.dll,nvwrsde.dll,nvcpde.hlp,nvwcpde.hlp\0nvrsel.dll,nvwrsel.dll,nvcpel.hlp,nvwcpel.hlp\0nvrseng.dll,nvwrseng.dll,nvcpeng.hlp,nvwcpeng.hlp\0nvrses.dll,nvwrses.dll,nvcpes.hlp,nvwcpes.hlp\0nvrsesm.dll,nvwrsesm.dll,nvcpesm.hlp,nvwcpesm.hlp\0nvrsfi.dll,nvwrsfi.dll,nvcpfi.hlp,nvwcpfi."
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\BTHPORT\Parameters\Keys\000a3a5bfecc]
    "000e6d43b813"=hex:3f,96,a9,52,44,da,cf,47,15,85,91,76,ca,eb,8f,26

    scanning hidden registry entries ...

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\\x00ffc\xd3w\2]
    "b049C053C7D38EE4AB9A00CB3B5D2472"="C?\Program Files\Common Files\Microsoft Shared\Web Folders\PUBPLACE.HTT"

    scanning hidden files ...


    scan completed successfully
    hidden processes: 0
    hidden services: 0
    hidden files: 15


    Remaining Services :



    Authorized Application Key Export:

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\\Program Files\\Intuwave\\Shared\\mRouterRunTime\\mRouterRuntime.exe"="C:\\Program Files\\Intuwave\\Shared\\mRouterRunTime\\mRouterRuntime.exe:*:Enabled:mRouterRuntime"
    "C:\\Program Files\\Google\\Google Talk\\googletalk.exe"="C:\\Program Files\\Google\\Google Talk\\googletalk.exe:*:Enabled:Google Talk"
    "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
    "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
    "C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"="C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe:*:Enabled:Sid Meier's Civilization 4"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
    "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
    "C:\\Games\\Electronic Arts\\The Battle for Middle-earth (tm) II\\game.dat"="C:\\Games\\Electronic Arts\\The Battle for Middle-earth (tm) II\\game.dat:*:Enabled:The Battle for Middle-earth(tm) II"
    "C:\\Games\\Electronic Arts\\The Lord of the Rings, The Rise of the Witch-king\\game.dat"="C:\\Games\\Electronic Arts\\The Lord of the Rings, The Rise of the Witch-king\\game.dat:*:Enabled:The Lord of the Rings, The Rise of the Witch-king"
    "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
    "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

    Remaining Files :



    Files with Hidden Attributes :

    Mon 28 Jan 2008 1,404,240 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"
    Mon 28 Jan 2008 5,146,448 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
    Mon 28 Jan 2008 2,097,488 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
    Thu 28 Apr 2005 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
    Tue 10 Jun 2003 77,824 A..H. --- "C:\Works\cd3\PIP\launcher.exe"
    Sat 14 Jul 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp"
    Thu 21 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\b7e6c7771d289926881287eb0ecc2a85\BIT1D4.tmp"
    Thu 3 Nov 2005 68,096 ...H. --- "C:\Documents and Settings\Jesse\Application Data\Microsoft\Word\~WRL0076.tmp"
    Wed 29 Mar 2006 20,480 ...H. --- "C:\Documents and Settings\Jesse\Application Data\Microsoft\Word\~WRL0893.tmp"
    Thu 24 Aug 2006 101,888 ...H. --- "C:\Documents and Settings\Kari\Application Data\Microsoft\Mallit\~WRL3450.tmp"

    Finished!




    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 21:46, on 2008-02-29
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Belkin\Bluetooth-ohjelmisto\bin\btwdins.exe
    C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    C:\Norman\Npf\BIN\NPFSVICE.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\system32\fxssvc.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\notepad.exe
    C:\PROGRA~1\TVAV~1\TVAV~1\TVTray.exe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
    C:\Norman\bin\ZLH.EXE
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
    C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\ALCWZRD.EXE
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\WINDOWS\system32\RunDLL32.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\system32\sgp71xedew.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Belkin\Bluetooth-ohjelmisto\BTTray.exe
    C:\Program Files\Nikon\NkView6\NkvMon.exe
    C:\Program Files\Nokia\PC Suite for N-Gage QD\connmngmntbox.exe
    C:\Program Files\Intuwave\Shared\mRouterRunTime\mRouterRuntime.exe
    C:\Program Files\Nokia\PC Suite for N-Gage QD\ectaskscheduler.exe
    C:\PROGRA~1\Nokia\PCSUIT~1\Elogerr.exe
    C:\PROGRA~1\Nokia\PCSUIT~1\BROADC~1.EXE
    C:\PROGRA~1\Nokia\PCSUIT~1\SCRFS.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\WINDOWS\System32\wbem\wmiprvse.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.soneraplaza.fi
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.dial.inet.fi:800
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;*.*.fi;*.*.*.fi;<local>
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {186962BB-D1BA-47CE-8CB8-8E55D6341058} - C:\WINDOWS\system32\certmgrn.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O2 - BHO: (no name) - {DDFDDBE4-7934-482D-A359-926B5CA42AFB} - c:\windows\system32\6to4svcc.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [High Definition Audio -ominaisuussivun pikakuvake] HDAudPropShortcut.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [TVTray] C:\PROGRA~1\TVAV~1\TVAV~1\TVTray.exe
    O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    O4 - HKLM\..\Run: [EPSON Stylus C62 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C62 Series" /O3 "USB" /M "Stylus C62"
    O4 - HKLM\..\Run: [EPSON Stylus C62 Series (Kopioi 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P34 "EPSON Stylus C62 Series (Kopioi 1)" /O6 "USB001" /M "Stylus C62"
    O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
    O4 - HKLM\..\Run: [AceGain LiveUpdate] C:\Games\AceGain\LiveUpdate\LiveUpdate.exe
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
    O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [Mirabilis ICQ] C:\PROGRA~1\ICQ\ICQNet.exe
    O4 - HKLM\..\Run: [PD0630 STISvc] RunDLL32.exe P0630Pin.dll,RunDLL32EP 513
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [YeppStudioAgent] C:\Program Files\Samsung\SamsungMediaStudio4.1\SamsungMediaStudioAgent.exe
    O4 - HKLM\..\Run: [TalkAndWrite] C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\1163D2B46CC742E5A3CC9E4157887751\TalkAndWrite.exe /run
    O4 - HKLM\..\Run: [sgp71xedew] C:\WINDOWS\system32\sgp71xedew.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
    O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
    O4 - HKCU\..\Run: [sgp71xedew] C:\WINDOWS\system32\sgp71xedew.exe
    O4 - HKCU\..\Policies\Explorer\Run: [{302316AF-0C81-1035-0407-050906040166}] "C:\Program Files\Common Files\{302316AF-0C81-1035-0407-050906040166}\Update.exe" mc-110-12-0000904
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: BTTray.lnk = ?
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
    O4 - Global Startup: PCSuiteForNokiaN-Gage QD Detect.lnk = ?
    O4 - Global Startup: PCSuiteForNokiaN-Gage QD TS.lnk = ?
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
    O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth-ohjelmisto\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth-ohjelmisto\btsendto_ie.htm
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
    O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} -
    O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
    O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safety.live.com/resource/download/scanner/wlscbase8460.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - Winlogon Notify: zifczjrn - C:\WINDOWS\SYSTEM32\6to4svcc.dll
    O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\Belkin\Bluetooth-ohjelmisto\bin\btwdins.exe
    O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\NORMAN\Nvc\BIN\nipsvc.exe
    O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE
    O23 - Service: Norman Type-R - Unknown owner - C:\Norman\Npf\BIN\NPFSVICE.EXE
    O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\bin\ZANDA.EXE
    O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\NORMAN\Nvc\BIN\nvcoas.exe
    O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

    --
    End of file - 11248 bytes
     
    Hadassa, 29.02.2008
    #5
  7. Hujo

    Hujo Guest

    aja Combofix vikasiedossa.
     
    Hujo, 29.02.2008
    #6
  8. Hadassa

    Hadassa Member

    Liittynyt:
    29.02.2008
    Viestejä:
    15
    Kiitokset:
    0
    Pisteet:
    11
    ComboFix 08-02-25.3 - Järjestelmänvalvoja 2008-03-01 18:47:03.2 - NTFSx86 MINIMAL
    Running from: C:\Documents and Settings\Jesse\Omat tiedostot\Omat lataukset\ComboFix.exe

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\system32\6to4svcc.dll . . . . poisto epäonnistui
    .
    ---- Previous Run -------
    .
    C:\Program Files\Common Files\{30231~1
    C:\Program Files\Common Files\{30231~1\Uninst.exe
    C:\WINDOWS\Fonts\acrsecB.fon
    C:\WINDOWS\Fonts\acrsecI.fon
    C:\WINDOWS\smdat32m.sys
    C:\WINDOWS\system32\6to4svcc.dll . . . . poisto epäonnistui

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

    .
    -------\LEGACY_QFXSEKWX
    -------\nm
    -------\qfxsekwx


    -------\LEGACY_QFXSEKWX
    -------\qfxsekwx


    ((((( Tiedostot, jotka on luotu seuraavalla aikav„lill„: 2008-02-01 to 2008-03-01 )))))))))))))))))
    .

    2008-02-29 18:26 . 2008-02-29 18:26 <KANSIO> d-------- C:\Program Files\Trend Micro
    2008-02-28 19:39 . 2008-02-28 20:33 <KANSIO> d-------- C:\Documents and Settings\Jesse\Application Data\My The Lord of the Rings, The Rise of the Witch-king Files
    2008-02-27 21:40 . 2008-02-27 22:17 <KANSIO> d-------- C:\Documents and Settings\Jesse\.scorched3d
    2008-02-26 20:43 . 2008-02-26 20:43 <KANSIO> d-------- C:\Program Files\Spybot - Search & Destroy
    2008-02-24 15:48 . 2008-02-24 15:48 <KANSIO> d-------- C:\WINDOWS\ERUNT
    2008-02-24 15:47 . 2008-02-29 21:39 <KANSIO> d-------- C:\SDFix
    2008-02-21 20:44 . 2008-02-21 20:44 230 --a------ C:\WINDOWS\system32\spupdsvc.inf
    2008-02-21 03:57 . 2008-02-21 03:57 54,608 --a------ C:\WINDOWS\system32\xfcodec.dll
    2008-02-13 20:16 . 2008-02-13 20:16 1,188,375 --a------ C:\WINDOWS\system32\libeay32.dll
    2008-02-13 20:16 . 2008-02-13 20:16 741,632 --a------ C:\WINDOWS\system32\piteecjf.dat
    2008-02-13 20:16 . 2008-02-13 20:16 246,545 --a------ C:\WINDOWS\system32\libssl32.dll
    2008-02-13 20:16 . 2008-02-28 17:01 42,752 --a------ C:\WINDOWS\system32\qqtsiokb.dat
    2008-02-13 20:16 . 2008-02-19 21:29 36,608 --a------ C:\WINDOWS\system32\cptxhyyk.dat
    2008-02-13 20:16 . 2008-02-13 20:16 35,072 --a------ C:\WINDOWS\system32\omybzore.dat
    2008-02-12 21:32 . 19,712 C:\WINDOWS\system32\drivers\yanfikuf.dat
    2008-02-12 20:07 . 2008-02-12 20:07 120,576 --a------ C:\WINDOWS\system32\wgkblftv.dat
    2008-02-12 20:00 . 2008-02-20 18:23 <KANSIO> d-------- C:\WINDOWS\system32\AppCert
    2008-02-12 20:00 . 2008-02-29 20:57 86,528 --a------ C:\WINDOWS\system32\6to4svcc.dll
    2008-02-12 20:00 . 2006-08-16 13:58 86,016 --a------ C:\WINDOWS\system32\6to4svcc.dll.bak
    2008-02-12 20:00 . 2006-11-28 17:56 17,920 --a------ C:\WINDOWS\system32\sgp71xedew.exe
    2008-02-12 19:59 . 2008-02-24 10:44 104,192 --a------ C:\WINDOWS\system32\certmgrn.dll
    2008-02-08 19:19 . 2008-02-28 11:35 43,520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-03-01 16:59 --------- d-----w C:\Program Files\Steam
    2008-03-01 16:35 5 ----a-w C:\NPF_USER.DAT
    2008-03-01 16:33 --------- d-----w C:\Program Files\ICQ
    2008-03-01 14:48 --------- d-----w C:\Documents and Settings\Kari\Application Data\Skype
    2008-02-29 15:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\NPF
    2008-02-29 11:22 --------- d-----w C:\Documents and Settings\Jesse\Application Data\Skype
    2008-02-29 05:56 --------- d-----w C:\Documents and Settings\Kari\Application Data\MEGAUPLOADTOOLBAR
    2008-02-28 19:32 --------- d-----w C:\Documents and Settings\Jesse\Application Data\Xfire
    2008-02-26 22:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-02-21 18:07 45,034 ----a-w C:\Documents and Settings\Kari\Application Data\wklnhst.dat
    2008-02-20 21:09 --------- d-----w C:\Program Files\WinMX
    2008-01-29 11:23 --------- d-----w C:\Documents and Settings\Kari\Application Data\Nokia
    2008-01-20 20:14 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-01-06 18:33 4,264 ----a-w C:\Documents and Settings\Jesse\Application Data\wklnhst.dat
    2008-01-04 11:43 --------- d-----w C:\Program Files\Java
    2008-01-01 22:47 --------- d-----w C:\Documents and Settings\Kari\Application Data\MSN6
    2007-10-16 16:50 86,488 ----a-w C:\Documents and Settings\Kari\Application Data\GDIPFONTCACHEV1.DAT
    2007-10-06 03:56 116 ----a-w C:\Program Files\Part.002
    2006-05-30 10:01 32 ----a-r C:\Documents and Settings\All Users\hash.dat
    2006-04-08 18:27 4,402 -c--a-w C:\Documents and Settings\fusi\Application Data\wklnhst.dat
    2006-04-04 16:17 10,046,792 ----a-w C:\Program Files\SkypeSetup.exe
    2005-12-28 19:20 4,577,316 ----a-w C:\Program Files\eMule_v0.46c-Installer.exe
    2005-11-01 13:32 6,279,168 ----a-w C:\Program Files\epson1179eu.exe
    2005-10-04 16:44 38,747 ----a-w C:\Program Files\PIEPatch2.5.exe
    2005-09-29 16:46 457 -c--a-w C:\Program Files\INSTALL.LOG
    2005-09-26 10:36 47,466 ----a-w C:\Program Files\WinMX_patch_for_win_2k_and_xp.exe
    2005-09-26 10:28 799,471 ----a-w C:\Program Files\winmx354beta4.zip
    2005-09-22 15:04 598,984 ----a-w C:\Program Files\kazaa_setup.exe
    2005-09-05 14:06 195,909,104 ----a-w C:\Program Files\CGS12_TBYB_EN.exe
    2005-09-02 12:38 1,362,517 ----a-w C:\Program Files\mdraw.zip
    2005-04-27 06:45 823,296 ----a-w C:\Program Files\winmx353.exe
    2005-04-18 18:08 3,130,340 ----a-w C:\Program Files\DCPlusPlus-0.674.exe
    2005-03-22 11:30 10,511,904 ----a-w C:\Program Files\RealPlayer10-5GOLD.exe
    2005-01-27 16:46 153,517 ----a-w C:\Program Files\code39.zip
    2005-01-20 13:47 3,156,389 ----a-w C:\Program Files\KaraWinStd.exe
    .

    (((((((((((((((((((((((((((((( Rekisterin k„ynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhji„ arvoja ja laillisia oletusarvoja ei n„ytet„

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{186962BB-D1BA-47CE-8CB8-8E55D6341058}]
    2008-02-24 10:44 104192 --a------ C:\WINDOWS\system32\certmgrn.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DDFDDBE4-7934-482D-A359-926B5CA42AFB}]
    2008-02-29 20:57 86528 --a------ c:\windows\system32\6to4svcc.dll

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 01:12 15360]
    "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55 5674352]
    "googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-01 23:22 3739648]
    "Steam"="C:\Program Files\Steam\Steam.exe" [2007-12-22 16:04 1266936]
    "sgp71xedew"="C:\WINDOWS\system32\sgp71xedew.exe" [2006-11-28 17:56 17920]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Wizard"="" []
    "High Definition Audio -ominaisuussivun pikakuvake"="HDAudPropShortcut.exe" [2004-03-18 01:10 61952 C:\WINDOWS\system32\Hdaudpropshortcut.exe]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-05-07 00:14 5562368]
    "nwiz"="nwiz.exe" [2005-05-07 00:14 1495040 C:\WINDOWS\system32\nwiz.exe]
    "TVTray"="C:\PROGRA~1\TVAV~1\TVAV~1\TVTray.exe" [2004-09-10 10:14 245760]
    "Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2003-06-10 02:11 50688]
    "EPSON Stylus C62 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.exe" [2002-07-01 05:05 74752]
    "EPSON Stylus C62 Series (Kopioi 1)"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.exe" [2002-07-01 05:05 74752]
    "Norman ZANDA"="C:\Norman\bin\ZLH.exe" [2006-05-31 10:22 135168]
    "AceGain LiveUpdate"="C:\Games\AceGain\LiveUpdate\LiveUpdate.exe" [ ]
    "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-09-15 01:12 110592 C:\WINDOWS\system32\bthprops.cpl]
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-05-03 17:12 98304]
    "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
    "PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2005-03-22 08:39 167936]
    "DataLayer"="C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe" [2005-03-31 08:30 1106944]
    "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2005-08-30 19:43 180269]
    "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-05-07 00:14 86016]
    "SoundMan"="SOUNDMAN.EXE" [2005-04-06 11:57 90112 C:\WINDOWS\SOUNDMAN.EXE]
    "AlcWzrd"="ALCWZRD.EXE" [2005-04-06 11:53 2805248 C:\WINDOWS\ALCWZRD.EXE]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
    "Mirabilis ICQ"="C:\PROGRA~1\ICQ\ICQNet.exe" [2003-10-14 18:36 38984]
    "PD0630 STISvc"="P0630Pin.dll" [2005-06-05 19:01 36864 C:\WINDOWS\system32\P0630Pin.dll]
    "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-02-23 15:45 278528]
    "YeppStudioAgent"="C:\Program Files\Samsung\SamsungMediaStudio4.1\SamsungMediaStudioAgent.exe" [ ]
    "TalkAndWrite"="C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\1163D2B46CC742E5A3CC9E4157887751\TalkAndWrite.exe" [2007-07-26 00:18 2664448]
    "sgp71xedew"="C:\WINDOWS\system32\sgp71xedew.exe" [2006-11-28 17:56 17920]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-15 01:12 15360]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run]
    "{302316AF-0C81-1035-0407-050906040166}"= "C:\Program Files\Common Files\{302316AF-0C81-1035-0407-050906040166}\Update.exe" mc-110-12-0000904

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\zifczjrn]
    6to4svcc.dll 2008-02-29 20:57 86528 C:\WINDOWS\system32\6to4svcc.dll

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\appcertdlls]
    appsecdll REG_EXPAND_SZ C:\WINDOWS\system32\AppCert\wsil32.dll

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\Intuwave\\Shared\\mRouterRunTime\\mRouterRuntime.exe"=
    "C:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "C:\\Program Files\\iTunes\\iTunes.exe"=
    "C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\MSN Messenger\\livecall.exe"=
    "C:\\Games\\Electronic Arts\\The Battle for Middle-earth (tm) II\\game.dat"=
    "C:\\Games\\Electronic Arts\\The Lord of the Rings, The Rise of the Witch-king\\game.dat"=
    "C:\\Program Files\\Skype\\Phone\\Skype.exe"=

    R0 cetscehi;cetscehi;C:\WINDOWS\system32\drivers\yanfikuf.dat []
    R0 NDIS_RD;Firewall Engine Type-R2;C:\WINDOWS\system32\drivers\NDIS_RD.sys [2004-12-06 10:18]
    R1 TDI_RD;Firewall Engine Type-R;C:\WINDOWS\system32\drivers\tdi_rd.sys [2004-10-13 22:01]
    R2 Ndiskio;Ndiskio;c:\norman\nse\bin\ndiskio.sys [2003-05-13 10:38]
    R2 nvcap;nVidia WDM Video Capture (universal);C:\WINDOWS\system32\DRIVERS\nvcap.sys [2004-09-20 08:59]
    R2 NVXBAR;nVidia WDM A/V Crossbar;C:\WINDOWS\system32\DRIVERS\NVxbar.sys [2004-09-20 08:59]
    R3 Cap7134;713x TV Card Capture;C:\WINDOWS\system32\DRIVERS\Cap7134.sys [2004-06-22 03:57]
    R3 P0630VID;Creative WebCam Live!;C:\WINDOWS\system32\DRIVERS\P0630Vid.sys [2005-06-06 03:44]
    R3 PCnetHL;AMD PCnet-Home Adapter Driver;C:\WINDOWS\system32\DRIVERS\pcntn5hl.sys [2001-08-17 20:11]
    R3 PhTVTune;TV AV WDM TVTuner (FM1216ME);C:\WINDOWS\system32\DRIVERS\PhTVTune.sys [2004-10-09 07:10]
    S3 AN983;ADMtek AN983/AN985/ADM951X 10/100Mbps Fast Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\AN983.sys [2005-01-13 10:28]
    S3 nvcfsr;nvcfsr;C:\NORMAN\Nvc\BIN\nvcfsr.sys [2004-11-05 09:47]
    S3 nvcoafl51;nvcoafl51;C:\NORMAN\Nvc\BIN\nvcoafl51.sys [2005-05-13 14:20]
    S3 nvcoaft51;nvcoaft51;C:\NORMAN\Nvc\BIN\nvcoaft51.sys [2006-06-14 13:39]
    S3 nvcoarc51;nvcoarc51;C:\NORMAN\Nvc\BIN\nvcoarc51.sys [2005-05-13 14:10]
    S3 nvcoas;Norman Virus Control on-access component;C:\NORMAN\Nvc\BIN\nvcoas.exe [2006-06-15 11:42]
    S3 NVCScheduler;Norman Virus Control Scheduler;C:\NORMAN\Nvc\BIN\NVCSCHED.EXE [2005-01-12 10:22]

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
    qfxsekwx

    .
    'Ajoitetut teht„v„t'-kansion sis„lt”
    "2008-03-01 15:03:01 C:\WINDOWS\Tasks\Tarkistetaan Windows Live -työkalurivin päivitykset.job"
     
    Hadassa, 01.03.2008
    #7
  9. Hujo

    Hujo Guest

    Lataa SmitfraudFix (c) S!Ri
    Pura sisältö (kansio nimeltä SmitfraudFix) työpöydällesi:

    Avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
    Valitse optio #1 - Search kirjoittamalla 1 ja painamalla "Enter"; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa).
    Postita tämän tekstitiedoston sisältö viestiketjuusi.

    Huomaa : process.exe filun tunnistaa jotkut Anti-virus ohjelmat (AntiVir, Dr.Web, Kaspersky) "Haittakaluna"; se ei ole virus, vaan ohjelma joka pysäyttää prosesseja. A/V ohjelmat eivät pysty tunnistamaan hyvän ja pahan käytön tälläisten ohjelmian väliltä, silloin ne saattavat varoittaa käyttäjää.
     
    Hujo, 01.03.2008
    #8
  10. Hadassa

    Hadassa Member

    Liittynyt:
    29.02.2008
    Viestejä:
    15
    Kiitokset:
    0
    Pisteet:
    11
    SmitFraudFix v2.299

    Scan done at 22:49:22.51, 2008-03-01
    Run from C:\Documents and Settings\Jesse\Työpöytä\SmitfraudFix\SmitfraudFix
    OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT
    The filesystem type is NTFS
    Fix run in safe mode

    »»»»»»»»»»»»»»»»»»»»»»»» Process

    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\cmd.exe

    »»»»»»»»»»»»»»»»»»»»»»»» hosts


    »»»»»»»»»»»»»»»»»»»»»»»» C:\


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Järjestelmänvalvoja


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Järjestelmänvalvoja\Application Data


    »»»»»»»»»»»»»»»»»»»»»»»» Start Menu


    »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\JRJEST~1\Suosikit


    »»»»»»»»»»»»»»»»»»»»»»»» Desktop


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


    »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


    »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
    "Source"="About:Home"
    "SubscribedURL"="About:Home"
    "FriendlyName"="Nykyinen kotisivu"


    »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
    !!!Attention, following keys are not inevitably infected!!!

    IEDFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri


    »»»»»»»»»»»»»»»»»»»»»»»» VACFix
    !!!Attention, following keys are not inevitably infected!!!

    VACFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri


    »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll


    »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "AppInit_DLLs"=""


    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "System"=""


    »»»»»»»»»»»»»»»»»»»»»»»» Rustock



    »»»»»»»»»»»»»»»»»»»»»»»» DNS


     
    Hadassa, 01.03.2008
    #9
  11. Hujo

    Hujo Guest

    Lataa Look2Me-Destroyer.exe työpöydällesi.
    http://www.atribune.org/ccount/click.php?id=7

    * Sulje kaikki ikkunat ennen jatkamista.
    * Tupla-klikkaa Look2Me-Destroyer.exe ajaaksesi ohjelman.
    * Rastita Run this program as a task.
    * Saat viestin joka sanoo; "Look2Me-Destroyer will close and re-open in approximately 10 seconds". Klikkaa OK
    * Kun Look2Me-Destroyer uudelleen avautuu, klikkaa Scan for L2M valintaa, työpöytäsi pikakuvakkeet katoavat hetkeksi, tämä on normaalia.
    * Kun skannaus on valmis, klikkaa Remove L2M valintaa.
    * Saat Done Scanning viestin, klikkaa OK.
    * Kun valmis, saat tämän viestin: Done removing infected files! Look2Me-Destroyer will now shutdown your computer, klikkaa OK.
    * Tietokoneesi sammuttaa itsensä.
    * Käynnistä koneesi uudelleen.
    * Postita C:\Look2Me-Destroyer.txt tiedoston sisältö uuden HijackThis login kera postiisi.

    Jos palomuurisi varoittaa nettiyhteyksistä tähän ohjelmaan - salli ne.

    =================

    Lataa NoLop työpöydällesi yhdestä seuraavista linkeistä...
    Linkki1
    Linkki2
    Linkki3

    1.Sulje kaikki ohjelmat, koska tämä vaihe vaatii uudelleenkäynnistyksen
    2.Tuplaklikkaa NoLop.exe ajaaksesi sen
    3.Klikkaa nappulaa "Search and Destroy"
    <<Tietokoneesi skannataan saastuneiden tiedostojen osalta>>
    4, Kun skannaus on valmis, sinua pyydetään käynnistämään kone uudestaan, jos infektio löytyy. Klikkaa OK
    5. Klikkaa "REBOOT"-painiketta.
    6. NoLopin pitäisi antaa viesti. Jos ei, tuplaklikkaa ohjelmaa ja se valmistuu. Lähetä C:\NoLop.log-tiedoston sisältö uuden HijackThis-lokin kera.
    -- Jos saat seuraavan virheen, "mscomctl.ocx or one of its dependencies are not correctly registered," lataa mscomctl.ocx ja tallenna se system32-hakemistoosi (yleensä c:\Windows\system32). Tämän jälkeen aja ohjelma uudestaan.
     
    Moderaattorin viimeksi muokkaama: 02.03.2008
    Hujo, 02.03.2008
    #10
  12. Hadassa

    Hadassa Member

    Liittynyt:
    29.02.2008
    Viestejä:
    15
    Kiitokset:
    0
    Pisteet:
    11

    Look2Me-Destroyer V1.0.12

    Scanning for infected files.....
    Scan started at 2008-03-02 16:21:28


    Attempting to delete infected files...

    Making registry repairs.


    Restoring Windows certificates.

    Replaced hosts file with default windows hosts file


    Restoring SeDebugPrivilege for Järjestelmänvalvojat - Succeeded


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 16:28, on 2008-03-02
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Belkin\Bluetooth-ohjelmisto\bin\btwdins.exe
    C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    C:\Norman\Npf\BIN\NPFSVICE.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\system32\fxssvc.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\TVAV~1\TVAV~1\TVTray.exe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
    C:\Norman\bin\ZLH.EXE
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
    C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\ALCWZRD.EXE
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\WINDOWS\system32\RunDLL32.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\system32\sgp71xedew.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Steam\Steam.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Belkin\Bluetooth-ohjelmisto\BTTray.exe
    C:\Program Files\Nikon\NkView6\NkvMon.exe
    C:\Program Files\Nokia\PC Suite for N-Gage QD\connmngmntbox.exe
    C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
    C:\Program Files\Nokia\PC Suite for N-Gage QD\ectaskscheduler.exe
    C:\PROGRA~1\Nokia\PCSUIT~1\Elogerr.exe
    C:\Program Files\Intuwave\Shared\mRouterRunTime\mRouterRuntime.exe
    C:\PROGRA~1\Nokia\PCSUIT~1\BROADC~1.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\PROGRA~1\Nokia\PCSUIT~1\SCRFS.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.soneraplaza.fi
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.dial.inet.fi:800
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;*.*.fi;*.*.*.fi;<local>
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {186962BB-D1BA-47CE-8CB8-8E55D6341058} - C:\WINDOWS\system32\certmgrn.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O2 - BHO: (no name) - {DDFDDBE4-7934-482D-A359-926B5CA42AFB} - c:\windows\system32\6to4svcc.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [High Definition Audio -ominaisuussivun pikakuvake] HDAudPropShortcut.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [TVTray] C:\PROGRA~1\TVAV~1\TVAV~1\TVTray.exe
    O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    O4 - HKLM\..\Run: [EPSON Stylus C62 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C62 Series" /O3 "USB" /M "Stylus C62"
    O4 - HKLM\..\Run: [EPSON Stylus C62 Series (Kopioi 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P34 "EPSON Stylus C62 Series (Kopioi 1)" /O6 "USB001" /M "Stylus C62"
    O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
    O4 - HKLM\..\Run: [AceGain LiveUpdate] C:\Games\AceGain\LiveUpdate\LiveUpdate.exe
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
    O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [Mirabilis ICQ] C:\PROGRA~1\ICQ\ICQNet.exe
    O4 - HKLM\..\Run: [PD0630 STISvc] RunDLL32.exe P0630Pin.dll,RunDLL32EP 513
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [YeppStudioAgent] C:\Program Files\Samsung\SamsungMediaStudio4.1\SamsungMediaStudioAgent.exe
    O4 - HKLM\..\Run: [TalkAndWrite] C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\1163D2B46CC742E5A3CC9E4157887751\TalkAndWrite.exe /run
    O4 - HKLM\..\Run: [sgp71xedew] C:\WINDOWS\system32\sgp71xedew.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
    O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
    O4 - HKCU\..\Run: [sgp71xedew] C:\WINDOWS\system32\sgp71xedew.exe
    O4 - HKCU\..\Policies\Explorer\Run: [{302316AF-0C81-1035-0407-050906040166}] "C:\Program Files\Common Files\{302316AF-0C81-1035-0407-050906040166}\Update.exe" mc-110-12-0000904
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: BTTray.lnk = ?
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
    O4 - Global Startup: PCSuiteForNokiaN-Gage QD Detect.lnk = ?
    O4 - Global Startup: PCSuiteForNokiaN-Gage QD TS.lnk = ?
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
    O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth-ohjelmisto\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth-ohjelmisto\btsendto_ie.htm
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
    O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} -
    O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
    O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safety.live.com/resource/download/scanner/wlscbase8460.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - Winlogon Notify: zifczjrn - C:\WINDOWS\SYSTEM32\6to4svcc.dll
    O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\Belkin\Bluetooth-ohjelmisto\bin\btwdins.exe
    O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\NORMAN\Nvc\BIN\nipsvc.exe
    O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE
    O23 - Service: Norman Type-R - Unknown owner - C:\Norman\Npf\BIN\NPFSVICE.EXE
    O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\bin\ZANDA.EXE
    O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\NORMAN\Nvc\BIN\nvcoas.exe
    O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

    --
    End of file - 11018 bytes
     
    Hadassa, 02.03.2008
    #11
  13. Hujo

    Hujo Guest

    scannaa hjt:llä merkkaa paina Fix checked

    O2 - BHO: (no name) - {186962BB-D1BA-47CE-8CB8-8E55D6341058} - C:\WINDOWS\system32\certmgrn.dll
    O2 - BHO: (no name) - {DDFDDBE4-7934-482D-A359-926B5CA42AFB} - c:\windows\system32\6to4svcc.dll
    O4 - HKLM\..\Run: [sgp71xedew] C:\WINDOWS\system32\sgp71xedew.exe
    O4 - HKCU\..\Run: [sgp71xedew] C:\WINDOWS\system32\sgp71xedew.exe
    O4 - HKCU\..\Policies\Explorer\Run: [{302316AF-0C81-1035-0407-050906040166}] "C:\Program Files\Common Files\{302316AF-0C81-1035-0407-050906040166}\Update.exe" mc-110-12-0000904
    O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} -
    O20 - Winlogon Notify: zifczjrn - C:\WINDOWS\SYSTEM32\6to4svcc.dll
     
    Hujo, 02.03.2008
    #12
  14. Hadassa

    Hadassa Member

    Liittynyt:
    29.02.2008
    Viestejä:
    15
    Kiitokset:
    0
    Pisteet:
    11
    Tässä vielä NoLop:n loki ennen äskeisten HjT-merkkausten poistoa.


    NoLop! Log by Skate_Punk_21

    Fix running from: C:\Documents and Settings\Jesse\Työpöytä
    [2008-03-02]
    [16:57:21]

    ---Infection Files Found/Removed---
    NO INFECTION FILES FOUND - Cleaning Aborted.

    ---Listing AppData sub directories---

    C:\Documents and Settings\All Users\Application Data\Adobe
    C:\Documents and Settings\All Users\Application Data\Adobe(2)
    C:\Documents and Settings\All Users\Application Data\Ahead
    C:\Documents and Settings\All Users\Application Data\Apple Computer
    C:\Documents and Settings\All Users\Application Data\Microsoft
    C:\Documents and Settings\All Users\Application Data\Msn6
    C:\Documents and Settings\All Users\Application Data\Npf
    C:\Documents and Settings\All Users\Application Data\Nview_profiles -- EMPTY Directory
    C:\Documents and Settings\All Users\Application Data\Pdf995
    C:\Documents and Settings\All Users\Application Data\Pdf995(2)
    C:\Documents and Settings\All Users\Application Data\Pixelstorm
    C:\Documents and Settings\All Users\Application Data\Quicktime
    C:\Documents and Settings\All Users\Application Data\Sbt
    C:\Documents and Settings\All Users\Application Data\Skype
    C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
    C:\Documents and Settings\All Users\Application Data\Windows Live Toolbar
    C:\Documents and Settings\Default User\Application Data\Identities
    C:\Documents and Settings\Default User\Application Data\Microsoft
    C:\Documents and Settings\Fusi\Application Data\Adobe
    C:\Documents and Settings\Fusi\Application Data\Help -- EMPTY Directory
    C:\Documents and Settings\Fusi\Application Data\Icq
    C:\Documents and Settings\Fusi\Application Data\Identities
    C:\Documents and Settings\Fusi\Application Data\Intertrust
    C:\Documents and Settings\Fusi\Application Data\Intervideo
    C:\Documents and Settings\Fusi\Application Data\Macromedia
    C:\Documents and Settings\Fusi\Application Data\Megauploadtoolbar
    C:\Documents and Settings\Fusi\Application Data\Microsoft
    C:\Documents and Settings\Fusi\Application Data\Microsoft Web Folders -- EMPTY Directory
    C:\Documents and Settings\Fusi\Application Data\Mozilla
    C:\Documents and Settings\Fusi\Application Data\Msn6 -- EMPTY Directory
    C:\Documents and Settings\Fusi\Application Data\My Games
    C:\Documents and Settings\Fusi\Application Data\Pc Suite
    C:\Documents and Settings\Fusi\Application Data\Real
    C:\Documents and Settings\Fusi\Application Data\Sun
    C:\Documents and Settings\Fusi\Application Data\Talkback
    C:\Documents and Settings\Jesse\Application Data\Adobe
    C:\Documents and Settings\Jesse\Application Data\Apple Computer
    C:\Documents and Settings\Jesse\Application Data\Azureus
    C:\Documents and Settings\Jesse\Application Data\Creative
    C:\Documents and Settings\Jesse\Application Data\Google
    C:\Documents and Settings\Jesse\Application Data\Icq
    C:\Documents and Settings\Jesse\Application Data\Identities
    C:\Documents and Settings\Jesse\Application Data\Intervideo
    C:\Documents and Settings\Jesse\Application Data\Macromedia
    C:\Documents and Settings\Jesse\Application Data\Media Player Classic
    C:\Documents and Settings\Jesse\Application Data\Microsoft
    C:\Documents and Settings\Jesse\Application Data\Mount&blade
    C:\Documents and Settings\Jesse\Application Data\Mozilla
    C:\Documents and Settings\Jesse\Application Data\Msn6
    C:\Documents and Settings\Jesse\Application Data\My Games
    C:\Documents and Settings\Jesse\Application Data\My The Lord Of The Rings, The Rise Of The Witch-king Files
    C:\Documents and Settings\Jesse\Application Data\Nikon
    C:\Documents and Settings\Jesse\Application Data\Pc Suite
    C:\Documents and Settings\Jesse\Application Data\Real
    C:\Documents and Settings\Jesse\Application Data\Skype
    C:\Documents and Settings\Jesse\Application Data\Sun
    C:\Documents and Settings\Jesse\Application Data\Talkback
    C:\Documents and Settings\Jesse\Application Data\Teamspeak2
    C:\Documents and Settings\Jesse\Application Data\Xfire
    C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Identities
    C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Microsoft
    C:\Documents and Settings\Kari\Application Data\Adobe
    C:\Documents and Settings\Kari\Application Data\Adobeum -- EMPTY Directory
    C:\Documents and Settings\Kari\Application Data\Ahead
    C:\Documents and Settings\Kari\Application Data\Apple Computer
    C:\Documents and Settings\Kari\Application Data\Beomediadatabase
    C:\Documents and Settings\Kari\Application Data\Creative
    C:\Documents and Settings\Kari\Application Data\Datalayer
    C:\Documents and Settings\Kari\Application Data\Help -- EMPTY Directory
    C:\Documents and Settings\Kari\Application Data\Icq
    C:\Documents and Settings\Kari\Application Data\Identities
    C:\Documents and Settings\Kari\Application Data\Intervideo
    C:\Documents and Settings\Kari\Application Data\Macromedia
    C:\Documents and Settings\Kari\Application Data\Megauploadtoolbar
    C:\Documents and Settings\Kari\Application Data\Microsoft
    C:\Documents and Settings\Kari\Application Data\Mozilla
    C:\Documents and Settings\Kari\Application Data\Msn6
    C:\Documents and Settings\Kari\Application Data\Nikon
    C:\Documents and Settings\Kari\Application Data\Nokia
    C:\Documents and Settings\Kari\Application Data\Nokia Multimedia Player
    C:\Documents and Settings\Kari\Application Data\Pc Suite
    C:\Documents and Settings\Kari\Application Data\Pdf995
    C:\Documents and Settings\Kari\Application Data\Real
    C:\Documents and Settings\Kari\Application Data\Skype
    C:\Documents and Settings\Kari\Application Data\Sun
    C:\Documents and Settings\Kari\Application Data\Talkback
    C:\Documents and Settings\Kari\Application Data\Xnview -- EMPTY Directory
    C:\Documents and Settings\Localservice\Application Data\Microsoft
    C:\Documents and Settings\Localservice\Application Data\Xfire -- EMPTY Directory
    C:\Documents and Settings\Networkservice\Application Data\Microsoft
    C:\Documents and Settings\Networkservice\Application Data\Xfire -- EMPTY Directory
     
    Hadassa, 02.03.2008
    #13
  15. Hadassa

    Hadassa Member

    Liittynyt:
    29.02.2008
    Viestejä:
    15
    Kiitokset:
    0
    Pisteet:
    11
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 17:20, on 2008-03-02
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Belkin\Bluetooth-ohjelmisto\bin\btwdins.exe
    C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    C:\Norman\Npf\BIN\NPFSVICE.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\system32\fxssvc.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\TVAV~1\TVAV~1\TVTray.exe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
    C:\Norman\bin\ZLH.EXE
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
    C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\ALCWZRD.EXE
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\WINDOWS\system32\RunDLL32.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Belkin\Bluetooth-ohjelmisto\BTTray.exe
    C:\Program Files\Nikon\NkView6\NkvMon.exe
    C:\Program Files\Nokia\PC Suite for N-Gage QD\connmngmntbox.exe
    C:\Program Files\Nokia\PC Suite for N-Gage QD\ectaskscheduler.exe
    C:\Program Files\Intuwave\Shared\mRouterRunTime\mRouterRuntime.exe
    C:\PROGRA~1\Nokia\PCSUIT~1\Elogerr.exe
    C:\WINDOWS\System32\svchost.exe
    C:\PROGRA~1\Nokia\PCSUIT~1\BROADC~1.EXE
    C:\PROGRA~1\Nokia\PCSUIT~1\SCRFS.exe
    C:\Norman\Npf\Bin\Npfc.exe
    C:\Norman\Npf\Bin\npfmsg2.exe
    C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
    C:\Program Files\Real\RealPlayer\RealPlay.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.soneraplaza.fi
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.dial.inet.fi:800
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;*.*.fi;*.*.*.fi;<local>
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {186962BB-D1BA-47CE-8CB8-8E55D6341058} - C:\WINDOWS\system32\certmgrn.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O2 - BHO: (no name) - {DDFDDBE4-7934-482D-A359-926B5CA42AFB} - c:\windows\system32\6to4svcc.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [High Definition Audio -ominaisuussivun pikakuvake] HDAudPropShortcut.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [TVTray] C:\PROGRA~1\TVAV~1\TVAV~1\TVTray.exe
    O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    O4 - HKLM\..\Run: [EPSON Stylus C62 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C62 Series" /O3 "USB" /M "Stylus C62"
    O4 - HKLM\..\Run: [EPSON Stylus C62 Series (Kopioi 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P34 "EPSON Stylus C62 Series (Kopioi 1)" /O6 "USB001" /M "Stylus C62"
    O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
    O4 - HKLM\..\Run: [AceGain LiveUpdate] C:\Games\AceGain\LiveUpdate\LiveUpdate.exe
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
    O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [Mirabilis ICQ] C:\PROGRA~1\ICQ\ICQNet.exe
    O4 - HKLM\..\Run: [PD0630 STISvc] RunDLL32.exe P0630Pin.dll,RunDLL32EP 513
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [YeppStudioAgent] C:\Program Files\Samsung\SamsungMediaStudio4.1\SamsungMediaStudioAgent.exe
    O4 - HKLM\..\Run: [TalkAndWrite] C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\1163D2B46CC742E5A3CC9E4157887751\TalkAndWrite.exe /run
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
    O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: BTTray.lnk = ?
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
    O4 - Global Startup: PCSuiteForNokiaN-Gage QD Detect.lnk = ?
    O4 - Global Startup: PCSuiteForNokiaN-Gage QD TS.lnk = ?
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
    O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth-ohjelmisto\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth-ohjelmisto\btsendto_ie.htm
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
    O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
    O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safety.live.com/resource/download/scanner/wlscbase8460.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - Winlogon Notify: zifczjrn - C:\WINDOWS\SYSTEM32\6to4svcc.dll
    O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\Belkin\Bluetooth-ohjelmisto\bin\btwdins.exe
    O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\NORMAN\Nvc\BIN\nipsvc.exe
    O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE
    O23 - Service: Norman Type-R - Unknown owner - C:\Norman\Npf\BIN\NPFSVICE.EXE
    O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\bin\ZANDA.EXE
    O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\NORMAN\Nvc\BIN\nvcoas.exe
    O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

    --
    End of file - 10652 bytes
     
    Hadassa, 02.03.2008
    #14
  16. Hujo

    Hujo Guest

    Lataa Killbox Option^Explicitiltä
    Huomaa: Jos sinulla on jo Killbox, tämä on uusi versio joka sinun tulee asentaa. Poista aikaisempi.

    Tallenna työpöydällesi.
    Tupla-klikkaa Killbox.exe ajaaksesi ohjelman.
    Valitse:
    Delete on Reboot sitten klikkaa All Files valintaa.
    Kopioi ja liitä alapuolella olevat tiedostopolut leikepöydälle mustaamalla KAIKKI ne ja painamalla CTRL + C (tai, mustaamisen jälkeen, oikea klikki hiirellä ja valitse kopioi):

    C:\WINDOWS\system32\certmgrn.dll
    C:\WINDOWS\SYSTEM32\6to4svcc.dll

    Palaa Killboxiin, mene File valikkoon, ja valitse Paste from Clipboard.

    Klikkaa puna-valkoista Delete File valintaa. Klikkaa Yes "Delete on Reboot" pyyntöön. Klikkaa OK mihin vain PendingFileRenameOperations pyyntöön.
    Käynnistä koneesi itse jos se ei sitä automaattisesti tee.
     
    Hujo, 02.03.2008
    #15
  17. Hadassa

    Hadassa Member

    Liittynyt:
    29.02.2008
    Viestejä:
    15
    Kiitokset:
    0
    Pisteet:
    11
    Toivottavasti onnistui.

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 19:40, on 2008-03-02
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Belkin\Bluetooth-ohjelmisto\bin\btwdins.exe
    C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    C:\Norman\Npf\BIN\NPFSVICE.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\system32\fxssvc.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\TVAV~1\TVAV~1\TVTray.exe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
    C:\Norman\bin\ZLH.EXE
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
    C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\ALCWZRD.EXE
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\WINDOWS\system32\RunDLL32.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Belkin\Bluetooth-ohjelmisto\BTTray.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Nikon\NkView6\NkvMon.exe
    C:\Program Files\Nokia\PC Suite for N-Gage QD\connmngmntbox.exe
    C:\Program Files\Nokia\PC Suite for N-Gage QD\ectaskscheduler.exe
    C:\Program Files\Intuwave\Shared\mRouterRunTime\mRouterRuntime.exe
    C:\PROGRA~1\Nokia\PCSUIT~1\Elogerr.exe
    C:\PROGRA~1\Nokia\PCSUIT~1\BROADC~1.EXE
    C:\PROGRA~1\Nokia\PCSUIT~1\SCRFS.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Norman\Npf\Bin\Npfc.exe
    C:\Norman\Npf\Bin\npfmsg2.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Real\RealPlayer\RealPlay.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.soneraplaza.fi
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.dial.inet.fi:800
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;*.*.fi;*.*.*.fi;<local>
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {186962BB-D1BA-47CE-8CB8-8E55D6341058} - C:\WINDOWS\system32\certmgrn.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O2 - BHO: (no name) - {DDFDDBE4-7934-482D-A359-926B5CA42AFB} - c:\windows\system32\6to4svcc.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [High Definition Audio -ominaisuussivun pikakuvake] HDAudPropShortcut.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [TVTray] C:\PROGRA~1\TVAV~1\TVAV~1\TVTray.exe
    O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    O4 - HKLM\..\Run: [EPSON Stylus C62 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C62 Series" /O3 "USB" /M "Stylus C62"
    O4 - HKLM\..\Run: [EPSON Stylus C62 Series (Kopioi 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P34 "EPSON Stylus C62 Series (Kopioi 1)" /O6 "USB001" /M "Stylus C62"
    O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
    O4 - HKLM\..\Run: [AceGain LiveUpdate] C:\Games\AceGain\LiveUpdate\LiveUpdate.exe
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
    O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [Mirabilis ICQ] C:\PROGRA~1\ICQ\ICQNet.exe
    O4 - HKLM\..\Run: [PD0630 STISvc] RunDLL32.exe P0630Pin.dll,RunDLL32EP 513
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [YeppStudioAgent] C:\Program Files\Samsung\SamsungMediaStudio4.1\SamsungMediaStudioAgent.exe
    O4 - HKLM\..\Run: [TalkAndWrite] C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\1163D2B46CC742E5A3CC9E4157887751\TalkAndWrite.exe /run
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
    O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: BTTray.lnk = ?
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
    O4 - Global Startup: PCSuiteForNokiaN-Gage QD Detect.lnk = ?
    O4 - Global Startup: PCSuiteForNokiaN-Gage QD TS.lnk = ?
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
    O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth-ohjelmisto\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth-ohjelmisto\btsendto_ie.htm
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
    O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
    O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safety.live.com/resource/download/scanner/wlscbase8460.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - Winlogon Notify: zifczjrn - C:\WINDOWS\SYSTEM32\6to4svcc.dll
    O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\Belkin\Bluetooth-ohjelmisto\bin\btwdins.exe
    O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\NORMAN\Nvc\BIN\nipsvc.exe
    O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE
    O23 - Service: Norman Type-R - Unknown owner - C:\Norman\Npf\BIN\NPFSVICE.EXE
    O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\bin\ZANDA.EXE
    O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\NORMAN\Nvc\BIN\nvcoas.exe
    O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

    --
    End of file - 10618 bytes
     
    Hadassa, 02.03.2008
    #16
  18. Hadassa

    Hadassa Member

    Liittynyt:
    29.02.2008
    Viestejä:
    15
    Kiitokset:
    0
    Pisteet:
    11
    Kone sanoo melko pian käynnistyksen jälkeen:

    SysFader: Explorer.EXE -vedos ei kelpaa

    Sovellus tai DLL c:\windows\system32\6to4svcc.dll ei ole
    kelvollinen Windows NT -vedos. Tarkista tämä asennuslevykkeeltä.

    Tarkoittaako tämä ettei Killboxilla poisto onnistunut?
     
    Hadassa, 03.03.2008
    #17
  19. Hujo

    Hujo Guest

    scannaa hjt:llä merkkaa paina Fix checked

    O2 - BHO: (no name) - {186962BB-D1BA-47CE-8CB8-8E55D6341058} - C:\WINDOWS\system32\certmgrn.dll
    O2 - BHO: (no name) - {DDFDDBE4-7934-482D-A359-926B5CA42AFB} - c:\windows\system32\6to4svcc.dll
    O20 - Winlogon Notify: zifczjrn - C:\WINDOWS\SYSTEM32\6to4svcc.dll

    Tupla-klikkaa Killbox.exe ajaaksesi ohjelman.
    Valitse:
    Delete on Reboot sitten klikkaa All Files valintaa.
    Kopioi ja liitä alapuolella olevat tiedostopolut leikepöydälle mustaamalla KAIKKI ne ja painamalla CTRL + C (tai, mustaamisen jälkeen, oikea klikki hiirellä ja valitse kopioi):

    C:\WINDOWS\system32\certmgrn.dll
    c:\windows\system32\6to4svcc.dll
    C:\WINDOWS\SYSTEM32\6to4svcc.dll

    Palaa Killboxiin, mene File valikkoon, ja valitse Paste from Clipboard.

    Klikkaa puna-valkoista Delete File valintaa. Klikkaa Yes "Delete on Reboot" pyyntöön. Klikkaa OK mihin vain PendingFileRenameOperations pyyntöön.
    Käynnistä koneesi itse jos se ei sitä automaattisesti tee.

    =============

    • Avaa HiJackThis
    • Klikkaa "Configure" valintaa oikealla alhaalla
    • Klikkaa "Misc Tools"
    • Klikkaa boxia joka sanoo "Uninstall Manager"
    • Klikkaa valintaa "Save list"
    • Kopioi ja liitä kyseinen lista muistiosta postiisi
     
    Moderaattorin viimeksi muokkaama: 03.03.2008
    Hujo, 03.03.2008
    #18

Jaa tämä sivu