Frode99 Skrevet 2. august 2009 Del Skrevet 2. august 2009 (endret) Hei! Kan noen se over disse loggene for å se om de ser greie ut, eller om noe lumskheter fortsatt er igjen.. Takker! CF log ComboFix 09-08-01.06 - Frode 02.08.2009 12:04.2.2 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.47.1044.18.3327.2445 [GMT 2:00] Kjører fra: c:\users\Frode\Desktop\ComboFix.exe SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} * Opprettet nytt gjenopprettingspunkt . ((((((((((((((((((((((((((((((((((((((( Andre slettinger ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\$recycle.bin\S-1-5-21-1669735576-745722746-2175647533-1000 c:\$recycle.bin\S-1-5-21-1796931044-2308778208-1486429884-1000 c:\windows\Installer\92b8dc.msi . ((((((((((((((((((((((((((( Filer Opprettet Fra 2009-07-02 til 2009-08-02 ))))))))))))))))))))))))))))))))) . 2009-08-02 10:08 . 2009-08-02 10:08 -------- d-----w- c:\users\Frode\AppData\Local\temp 2009-08-02 08:32 . 2009-08-02 08:29 102664 ----a-w- c:\windows\system32\drivers\tmcomm.sys 2009-08-02 08:27 . 2009-08-02 08:32 -------- d-----w- c:\users\Frode\.housecall6.6 2009-08-01 19:20 . 2009-08-01 19:20 -------- d-----w- c:\program files\RivaTuner v2.24 2009-07-30 11:50 . 2009-07-30 11:50 -------- d-----w- C:\Windows 7 2009-07-23 08:42 . 2008-02-04 08:27 102400 ----a-w- c:\windows\system32\cttele32.dll 2009-07-23 08:42 . 2009-03-26 12:46 148480 ----a-w- c:\windows\system32\APOMngr.DLL 2009-07-23 08:42 . 2009-02-06 16:52 73728 ----a-w- c:\windows\system32\CmdRtr.DLL 2009-07-22 10:08 . 2009-07-22 10:08 -------- d-----w- c:\program files\NVIDIA Corporation 2009-07-22 09:53 . 2009-07-14 18:54 485920 ----a-w- c:\windows\system32\nvudisp.exe 2009-07-22 09:53 . 2009-07-14 18:54 9557216 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys 2009-07-22 09:53 . 2009-07-14 18:54 3287040 ----a-w- c:\windows\system32\nvwgf2um.dll 2009-07-22 09:53 . 2009-07-14 18:54 2169376 ----a-w- c:\windows\system32\nvcuvid.dll 2009-07-22 09:53 . 2009-07-14 18:54 10854400 ----a-w- c:\windows\system32\nvoglv32.dll 2009-07-22 09:53 . 2009-07-14 18:54 1983488 ----a-w- c:\windows\system32\nvcuda.dll 2009-07-22 09:53 . 2009-07-14 18:54 1706528 ----a-w- c:\windows\system32\nvcuvenc.dll 2009-07-22 09:53 . 2009-07-14 18:54 151552 ----a-w- c:\windows\system32\nvcod157.dll 2009-07-22 09:53 . 2009-07-14 18:54 151552 ----a-w- c:\windows\system32\nvcod.dll 2009-07-21 22:10 . 2009-07-21 22:10 4096 ----a-w- c:\windows\d3dx.dat 2009-07-21 21:55 . 2009-07-21 21:55 -------- d-----w- c:\windows\Java 2009-07-21 21:31 . 2009-07-21 21:55 -------- d-----w- c:\program files\CPUID 2009-07-15 08:45 . 2009-06-15 15:24 156672 ----a-w- c:\windows\system32\t2embed.dll 2009-07-15 08:45 . 2009-06-15 15:20 72704 ----a-w- c:\windows\system32\fontsub.dll 2009-07-15 08:45 . 2009-06-15 15:20 10240 ----a-w- c:\windows\system32\dciman32.dll 2009-07-15 08:45 . 2009-06-15 12:52 289792 ----a-w- c:\windows\system32\atmfd.dll 2009-07-10 18:36 . 2009-07-10 18:36 -------- d-----w- c:\users\Frode\AppData\Roaming\Ubisoft 2009-07-10 18:16 . 2009-03-09 13:27 453456 ----a-w- c:\windows\system32\d3dx10_41.dll 2009-07-10 18:16 . 2009-03-09 13:27 4178264 ----a-w- c:\windows\system32\D3DX9_41.dll 2009-07-10 18:16 . 2009-03-09 13:27 1846632 ----a-w- c:\windows\system32\D3DCompiler_41.dll 2009-07-10 18:16 . 2009-03-16 12:18 69448 ----a-w- c:\windows\system32\XAPOFX1_3.dll 2009-07-10 18:16 . 2009-03-16 12:18 517448 ----a-w- c:\windows\system32\XAudio2_4.dll 2009-07-10 18:16 . 2009-03-16 12:18 235352 ----a-w- c:\windows\system32\xactengine3_4.dll 2009-07-10 18:16 . 2009-03-16 12:18 22360 ----a-w- c:\windows\system32\X3DAudio1_6.dll 2009-07-10 18:16 . 2008-10-15 04:22 452440 ----a-w- c:\windows\system32\d3dx10_40.dll 2009-07-10 18:16 . 2008-10-15 04:22 2036576 ----a-w- c:\windows\system32\D3DCompiler_40.dll 2009-07-10 18:15 . 2008-10-15 04:22 4379984 ----a-w- c:\windows\system32\D3DX9_40.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-08-02 10:02 . 2009-06-30 11:55 -------- d-----w- c:\program files\Mozilla Firefox 3.5 2009-08-02 10:00 . 2009-05-11 17:23 32879 ----a-w- c:\programdata\nvModes.dat 2009-08-02 10:00 . 2008-05-26 18:39 -------- d-----w- c:\programdata\NVIDIA 2009-08-02 09:07 . 2008-05-26 19:24 -------- d-----w- c:\users\Frode\AppData\Roaming\uTorrent 2009-08-02 09:04 . 2008-05-26 18:27 1356 ----a-w- c:\users\Frode\AppData\Local\d3d9caps.dat 2009-08-02 08:56 . 2008-11-19 17:37 -------- d-----w- c:\program files\TortoiseSVN 2009-08-02 03:02 . 2008-08-03 10:18 -------- d-----w- c:\program files\Electronic Arts 2009-08-02 03:02 . 2008-08-04 14:59 -------- d-----w- c:\users\Frode\AppData\Roaming\My Battle for Middle-earth II Files 2009-07-31 18:41 . 2008-06-29 09:12 -------- d-----w- c:\program files\Free Hide Folder 2009-07-31 13:58 . 2008-05-26 20:26 -------- d-----w- c:\program files\Microsoft Silverlight 2009-07-27 20:46 . 2009-04-25 13:13 5 ----a-w- c:\windows\sbacknt.bin 2009-07-26 20:42 . 2009-01-31 14:56 -------- d-----w- c:\program files\AdiIRC 2009-07-25 21:47 . 2008-10-18 09:02 -------- d-----w- c:\program files\Curse 2009-07-25 21:47 . 2008-08-29 13:31 -------- d-----w- c:\program files\Runes of Magic 2009-07-23 08:43 . 2008-05-26 18:34 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-07-23 08:42 . 2008-05-26 18:36 444952 ----a-w- c:\windows\system32\wrap_oal.dll 2009-07-23 08:42 . 2008-05-26 18:36 109080 ----a-w- c:\windows\system32\OpenAL32.dll 2009-07-22 09:51 . 2008-05-26 18:37 -------- d-----w- c:\programdata\Creative 2009-07-21 21:52 . 2009-07-29 08:45 915456 ----a-w- c:\windows\system32\wininet.dll 2009-07-21 21:47 . 2009-07-29 08:45 109056 ----a-w- c:\windows\system32\iesysprep.dll 2009-07-21 21:47 . 2009-07-29 08:45 71680 ----a-w- c:\windows\system32\iesetup.dll 2009-07-21 20:13 . 2009-07-29 08:45 133632 ----a-w- c:\windows\system32\ieUnatt.exe 2009-07-20 20:11 . 2008-05-26 18:34 -------- d-----w- c:\program files\Creative 2009-07-18 08:54 . 2008-05-26 19:43 -------- d-----w- c:\users\Frode\AppData\Roaming\FileZilla 2009-07-15 08:46 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail 2009-07-14 22:20 . 2009-06-25 11:34 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-07-14 18:55 . 2009-03-29 14:34 -------- d-----w- c:\program files\K-Lite Codec Pack 2009-07-14 18:54 . 2009-07-22 09:53 4224 ----a-w- c:\windows\system32\drivers\nvBridge.kmd 2009-07-14 18:54 . 2007-12-11 15:06 7565824 ----a-w- c:\windows\system32\nvd3dum.dll 2009-07-14 18:54 . 2007-12-11 15:06 1044992 ----a-w- c:\windows\system32\nvapi.dll 2009-07-13 11:36 . 2009-06-25 11:34 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-07-13 11:36 . 2009-06-25 11:34 19096 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-07-10 18:22 . 2009-02-03 22:32 -------- d-----w- c:\programdata\Tages 2009-07-10 18:16 . 2008-08-03 20:26 281760 ----a-w- c:\windows\system32\drivers\atksgt.sys 2009-07-10 18:16 . 2008-08-03 20:26 25888 ----a-w- c:\windows\system32\drivers\lirsgt.sys 2009-07-10 05:01 . 2008-05-26 18:30 485920 ----a-w- c:\windows\system32\NVUNINST.EXE 2009-07-09 13:16 . 2006-11-21 05:16 76272 ----a-w- c:\windows\system32\perfc014.dat 2009-07-09 13:16 . 2006-11-21 05:16 452096 ----a-w- c:\windows\system32\perfh014.dat 2009-07-08 09:00 . 2008-05-27 15:53 -------- d-----w- c:\program files\cpuz_146 2009-06-30 21:27 . 2008-07-07 11:07 -------- d-----w- c:\program files\Java 2009-06-25 11:34 . 2009-06-25 11:34 -------- d-----w- c:\users\Frode\AppData\Roaming\Malwarebytes 2009-06-25 11:34 . 2009-06-25 11:34 -------- d-----w- c:\programdata\Malwarebytes 2009-06-25 11:29 . 2008-05-26 19:21 -------- d-----w- c:\program files\CCleaner 2009-06-25 10:58 . 2009-06-25 10:58 220600 ----a-w- c:\users\Frode\FileZilla_3.2.6-rc1_win32-setup.exe 2009-06-20 21:57 . 2009-06-20 21:42 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys 2009-06-20 21:56 . 2009-06-20 21:42 103736 ----a-w- c:\windows\system32\PnkBstrB.exe 2009-06-20 21:53 . 2009-06-20 21:42 66872 ----a-w- c:\windows\system32\PnkBstrA.exe 2009-06-20 21:42 . 2009-06-20 21:42 22328 ----a-w- c:\users\Frode\AppData\Roaming\PnkBstrK.sys 2009-06-20 21:42 . 2009-06-20 21:42 22328 ----a-w- c:\users\Frode\AppData\Roaming\PnkBstrK.sys 2009-06-20 21:29 . 2009-06-20 21:29 -------- d-----w- c:\program files\id Software 2009-06-20 21:29 . 2008-06-29 17:24 -------- d-----w- c:\programdata\Codemasters 2009-06-19 11:15 . 2008-06-28 19:01 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard 2009-06-19 11:14 . 2008-06-28 19:01 -------- d-----w- c:\program files\AGEIA Technologies 2009-06-17 20:22 . 2009-06-17 20:22 -------- d-----w- c:\program files\Monte Cristo 2009-06-16 17:18 . 2009-06-16 17:18 -------- d-----w- c:\users\Frode\AppData\Roaming\dvdcss 2009-06-10 16:33 . 2009-06-10 16:33 151552 ----a-w- c:\windows\system32\nvcod155.dll 2009-06-10 11:27 . 2008-05-29 19:37 -------- d-----w- c:\programdata\Microsoft Help 2009-06-10 06:34 . 2009-06-10 06:34 143360 ----a-w- c:\windows\system32\nvshext.dll 2009-06-07 14:07 . 2009-06-07 14:03 -------- d-----w- c:\users\Frode\AppData\Roaming\CrystalButton 2009-06-07 14:02 . 2009-06-07 14:02 -------- d-----w- c:\program files\Crystal Button 2008 2009-06-07 13:49 . 2009-06-07 13:49 -------- d-----w- c:\program files\Web Button Menu Maker 2009-06-04 20:40 . 2009-06-04 20:39 -------- d-----w- c:\program files\NCSoft 2009-06-04 20:39 . 2008-08-13 19:49 -------- d-----w- c:\users\Frode\AppData\Roaming\GetRightToGo 2009-06-04 13:20 . 2008-08-14 07:14 -------- d-----w- c:\program files\Perfect World Entertainment 2009-06-03 22:55 . 2009-06-03 22:55 2560 ----a-w- c:\windows\CTXFIRES.DLL 2009-06-03 22:40 . 2009-06-03 22:40 56509 ----a-w- c:\windows\system32\SETE4EB.tmp 2009-06-03 22:40 . 2009-06-03 22:40 56509 ----a-w- c:\windows\system32\SET25DA.tmp 2009-06-03 22:40 . 2009-06-03 22:40 56509 ------w- c:\windows\system32\ctdnlstr.dat 2009-06-03 22:40 . 2009-06-03 22:40 321512 ----a-w- c:\windows\system32\SETE469.tmp 2009-06-03 22:40 . 2009-06-03 22:40 321512 ----a-w- c:\windows\system32\SET24ED.tmp 2009-06-03 22:40 . 2009-06-03 22:40 321512 ------w- c:\windows\system32\ctdlang.dat 2009-06-02 16:11 . 2009-03-29 14:34 85504 ----a-w- c:\windows\system32\ff_vfw.dll 2009-05-29 21:37 . 2009-03-29 14:34 205824 ----a-w- c:\windows\system32\xvidvfw.dll 2009-05-29 21:31 . 2009-03-29 14:34 881664 ----a-w- c:\windows\system32\xvidcore.dll 2009-05-21 09:33 . 2008-11-26 20:21 410984 ----a-w- c:\windows\system32\deploytk.dll 2009-05-12 10:25 . 2009-05-12 10:25 47104 ----a-w- c:\windows\system32\UDAPLD32.dll 2009-05-12 10:24 . 2009-05-12 10:24 511488 ----a-w- c:\windows\system32\UDAAPO32.dll 2009-05-04 19:52 . 2009-05-04 18:34 62059520 ----a-w- c:\programdata\Creative\Software Update\cache\Creative Console Launcher 2.60.35__\CSL_PCAPP_LB_2_60_35A.exe 2009-06-15 18:11 . 2008-05-26 19:00 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll 1999-04-23 22:22 . 1999-04-23 22:22 12 --sha-w- c:\windows\system\WININETICMP32.drv . (((((((((((((((((((((((((((((((( Oppstartspunkter I Registeret ))))))))))))))))))))))))))))))))))))))))))))) . . *Merk* tomme oppføringer & gyldige standardoppføringer vises ikke REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal] @="{C5994560-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}] 2008-01-16 16:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified] @="{C5994561-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}] 2008-01-16 16:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict] @="{C5994562-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}] 2008-01-16 16:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked] @="{C5994563-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}] 2008-01-16 16:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly] @="{C5994564-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}] 2008-01-16 16:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted] @="{C5994565-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}] 2008-01-16 16:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded] @="{C5994566-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}] 2008-01-16 16:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored] @="{C5994567-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}] 2008-01-16 16:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned] @="{C5994568-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}] 2008-01-16 16:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "amd_dc_opt"="c:\program files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824] "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153] "VolPanel"="c:\program files\Creative\Volume Panel\VolPanlu.exe" [2008-08-06 233576] "CTXFIREG"="CTxfiReg.exe" - c:\windows\System32\CTxfiReg.exe [2008-10-07 47104] "CTxfiHlp"="CTXFIHLP.EXE" - c:\windows\System32\Ctxfihlp.exe [2008-10-07 23552] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "DevconDefaultDB"="c:\windows\system32\READREG" [X] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "SynchronousMachineGroupPolicy"= 0 (0x0) "SynchronousUserGroupPolicy"= 0 (0x0) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UACDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{C81F4159-FE9C-45A0-B25A-F11463F97550}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In) "{5858AB44-4BE1-43CB-B7CD-31E9A8AEE203}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In) "TCP Query User{2A786937-1241-4A2C-8D5C-136B9B0BFB28}d:\\teamspeak2_server\\server_windows.exe"= UDP:d:\teamspeak2_server\server_windows.exe:server_windows "UDP Query User{AA6B3A06-89AE-4300-AC17-3523C19324B3}d:\\teamspeak2_server\\server_windows.exe"= TCP:d:\teamspeak2_server\server_windows.exe:server_windows "TCP Query User{D3D0084F-2773-4306-842A-8E739BB753C1}d:\\div stuff\\screamer040-prerelease\\screamer.exe"= UDP:d:\div stuff\screamer040-prerelease\screamer.exe:Screamer Radio "UDP Query User{544CC1CA-A8F5-4D88-AAE6-970D7D7B7931}d:\\div stuff\\screamer040-prerelease\\screamer.exe"= TCP:d:\div stuff\screamer040-prerelease\screamer.exe:Screamer Radio "TCP Query User{CFFDC117-C18B-4E77-86BB-25BC3429B73D}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox "UDP Query User{84952F8B-C40A-4185-B2AE-F1956805F9E2}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox "TCP Query User{9AFA406D-C807-4188-85F4-1E25EF005E69}d:\\rohan\\rohanclient.exe"= UDP:d:\rohan\rohanclient.exe:Rohan Online Game "UDP Query User{9C910D04-C07B-4D77-AC6B-2D23746D1E90}d:\\rohan\\rohanclient.exe"= TCP:d:\rohan\rohanclient.exe:Rohan Online Game "TCP Query User{E19618DA-952C-4319-A5E0-96F15F41324B}c:\\program files\\teamspeak2_server\\server_windows.exe"= UDP:c:\program files\teamspeak2_server\server_windows.exe:server_windows "UDP Query User{6ACF6DD8-7B2D-4975-A0B9-40A319E474F2}c:\\program files\\teamspeak2_server\\server_windows.exe"= TCP:c:\program files\teamspeak2_server\server_windows.exe:server_windows "TCP Query User{9C2F5524-B215-4314-8ECC-58D77CE53EDC}c:\\program files\\teamspeak2_server\\server_windows.exe"= UDP:c:\program files\teamspeak2_server\server_windows.exe:server_windows "UDP Query User{086EDE18-77EB-4680-88E4-E522B8EFFBCF}c:\\program files\\teamspeak2_server\\server_windows.exe"= TCP:c:\program files\teamspeak2_server\server_windows.exe:server_windows "TCP Query User{21988B1E-4F01-4864-A3B6-5F20D913A355}c:\\program files\\xfire\\xfire.exe"= UDP:c:\program files\xfire\xfire.exe:Xfire "UDP Query User{588F5F4B-6C3A-42E3-9A21-DEB2334FBB44}c:\\program files\\xfire\\xfire.exe"= TCP:c:\program files\xfire\xfire.exe:Xfire "{A602DCD1-3B8D-4FF6-905D-88047C712F34}"= UDP:48759:48759 "{7B6C92B4-60FC-4E70-9E54-5A7DA56BE75F}"= TCP:48759:48759 "TCP Query User{17E18DA7-83CB-4288-85F6-A157FD2585F0}c:\\program files\\microsoft games\\rise of nations\\patriots.exe"= UDP:c:\program files\microsoft games\rise of nations\patriots.exe:Rise of Nations "UDP Query User{74DC7DBC-83A0-4C4B-9464-F25185C35084}c:\\program files\\microsoft games\\rise of nations\\patriots.exe"= TCP:c:\program files\microsoft games\rise of nations\patriots.exe:Rise of Nations "{F1E9CE95-13C4-408F-81BA-DDCE9B034000}"= UDP:d:\div stuff\utorrent-1.8-beta-10770.upx.exe:µTorrent (TCP-In) "{5DF2594A-8B20-45E2-8ECA-ADD6A95DC8D7}"= TCP:d:\div stuff\utorrent-1.8-beta-10770.upx.exe:µTorrent (UDP-In) "TCP Query User{506907AC-4BEE-4292-AB5E-38BFB6DBF83C}d:\\div stuff\\screamer-beta-20070222(2)\\screamer.exe"= UDP:d:\div stuff\screamer-beta-20070222(2)\screamer.exe:Screamer Radio "UDP Query User{A8C3131A-275E-4622-8C99-2289FA974D09}d:\\div stuff\\screamer-beta-20070222(2)\\screamer.exe"= TCP:d:\div stuff\screamer-beta-20070222(2)\screamer.exe:Screamer Radio "{412B2B8C-25EE-4D64-BF74-69CB4C04E0BD}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In) "{C8492A5A-8C70-42BE-B9C4-CC693AEDBDE3}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In) "{BC6915A1-4A25-46C1-AFCE-2B48ED54CFC4}"= UDP:c:\program files\Unreal Tournament 3\Binaries\UT3.exe:Unreal Tournament 3 "{10E05AA1-AEBD-490B-8E01-8AE24F351DFF}"= TCP:c:\program files\Unreal Tournament 3\Binaries\UT3.exe:Unreal Tournament 3 "{BC7D1AD7-4F30-468F-9A3E-50F311707D77}"= UDP:c:\program files\Microsoft Games\Dungeon Siege 2\DungeonSiege2.exe:Dungeon Siege 2 Game Executable "{79FF9434-1A23-4357-83C8-AA85D5C8F124}"= TCP:c:\program files\Microsoft Games\Dungeon Siege 2\DungeonSiege2.exe:Dungeon Siege 2 Game Executable "TCP Query User{519D0773-71E7-4C9C-96F6-FBF282907EFD}c:\\program files\\filezilla ftp client\\filezilla.exe"= UDP:c:\program files\filezilla ftp client\filezilla.exe:FileZilla FTP Client "UDP Query User{250F1D1C-B926-45F0-9AF9-7D788D5E2EEF}c:\\program files\\filezilla ftp client\\filezilla.exe"= TCP:c:\program files\filezilla ftp client\filezilla.exe:FileZilla FTP Client "TCP Query User{117848A3-F839-4A4A-A591-072C7AE8C794}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:µTorrent "UDP Query User{08DE904E-EFBA-478A-BF66-AC16F4B5B3C7}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:µTorrent "{43DD3125-B457-4050-8B1D-15311F40ACAD}"= UDP:c:\windows\System32\dpnsvr.exe:Microsoft DirectPlay8 Server "{DD72C328-6E48-49EA-A75F-576C49A4AAB4}"= TCP:c:\windows\System32\dpnsvr.exe:Microsoft DirectPlay8 Server "{CEEF30A1-C368-4545-8626-76EAF90B3F7B}"= UDP:c:\program files\Hamachi\hamachi.exe:Hamachi "{DF920171-E160-44C6-9735-C23A618CA61E}"= TCP:c:\program files\Hamachi\hamachi.exe:Hamachi "{2FB4ADA8-8A43-440A-B6ED-9F75D92CD62A}"= UDP:c:\program files\Codemasters\Archlord\Archlord.exe:Archlord "{C4D3FC91-A0A5-45BA-A2EC-F7682D12DB17}"= TCP:c:\program files\Codemasters\Archlord\Archlord.exe:Archlord "{44C1A799-1E57-41A1-B53E-E54045F98996}"= UDP:c:\program files\GameTribe\Dekaron\minilauncher.exe:Dekaron "{CA73F0E9-B8D6-4BCD-9FA3-DC5A929FD23E}"= TCP:c:\program files\GameTribe\Dekaron\minilauncher.exe:Dekaron "TCP Query User{8844FF43-5765-4AA4-9C56-AA423D073FA6}c:\\program files\\flashget\\flashget.exe"= UDP:c:\program files\flashget\flashget.exe:FlashGet "UDP Query User{CDB75EBA-84E9-4F9C-B8C7-A9E40502FADA}c:\\program files\\flashget\\flashget.exe"= TCP:c:\program files\flashget\flashget.exe:FlashGet "TCP Query User{B07F99CD-2DCE-4CA2-A286-E9ABA75CA382}d:\\div stuff\\screamer040-prerelease\\screamer.exe"= UDP:d:\div stuff\screamer040-prerelease\screamer.exe:Screamer Radio "UDP Query User{6CF671D4-90C0-4F00-BC3F-440CC6F95215}d:\\div stuff\\screamer040-prerelease\\screamer.exe"= TCP:d:\div stuff\screamer040-prerelease\screamer.exe:Screamer Radio "TCP Query User{53E48C5C-2866-41F2-8AFF-09BCEDE0DB51}c:\\program files\\goftp\\goftp.exe"= UDP:c:\program files\goftp\goftp.exe:GoFTP "UDP Query User{2146818A-0FBB-406A-B949-1F818EDCC6D8}c:\\program files\\goftp\\goftp.exe"= TCP:c:\program files\goftp\goftp.exe:GoFTP "TCP Query User{6AC14A78-05F3-4516-8ED2-94E20CF3F4B4}c:\\program files\\zattoo\\zattood.exe"= UDP:c:\program files\zattoo\zattood.exe:zattood "UDP Query User{F46B02EC-1574-43DD-AE92-06E8BEA0F245}c:\\program files\\zattoo\\zattood.exe"= TCP:c:\program files\zattoo\zattood.exe:zattood "TCP Query User{6A13CD88-50A5-41F4-98B6-87474ACAB1B0}c:\\program files\\zattoo\\zattoo.exe"= UDP:c:\program files\zattoo\zattoo.exe: "UDP Query User{C7E77F1B-140E-4A7D-88FE-B592EB59AE04}c:\\program files\\zattoo\\zattoo.exe"= TCP:c:\program files\zattoo\zattoo.exe: "TCP Query User{7BA1BC25-10F5-4111-83A2-0E7888F043F9}c:\\program files\\jlc's software\\internet tv\\internet tv.exe"= UDP:c:\program files\jlc's software\internet tv\internet tv.exe:Internet TV "UDP Query User{F3EBC17E-F06A-4F2E-9827-91D6409CCC34}c:\\program files\\jlc's software\\internet tv\\internet tv.exe"= TCP:c:\program files\jlc's software\internet tv\internet tv.exe:Internet TV "TCP Query User{2775F308-2758-422F-AF12-505D7452D3E4}d:\\div stuff\\viviplay.exe"= UDP:d:\div stuff\viviplay.exe:ViViMediaPlay "UDP Query User{3E54F163-F0FE-4D49-B08F-6A878FE55CF7}d:\\div stuff\\viviplay.exe"= TCP:d:\div stuff\viviplay.exe:ViViMediaPlay "{0D41088C-6E69-4618-9F0E-7D53C2639A74}"= UDP:c:\program files\Electronic Arts\The Battle for Middle-earth II\game.dat:The Battle for Middle-earth II "{1031BA43-3CC6-4980-90D6-A85CF7D69224}"= TCP:c:\program files\Electronic Arts\The Battle for Middle-earth II\game.dat:The Battle for Middle-earth II "TCP Query User{FB0E0FDE-EA03-4C85-9696-27C8D071CE88}c:\\program files\\anno 1701\\anno1701.exe"= UDP:c:\program files\anno 1701\anno1701.exe:Anno 1701 "UDP Query User{BF5BA93F-C35C-4CB6-8C29-F67A0541A2FA}c:\\program files\\anno 1701\\anno1701.exe"= TCP:c:\program files\anno 1701\anno1701.exe:Anno 1701 "{AB7E0BFE-2F08-43C4-AEA1-529127F6FA4B}"= UDP:d:\div stuff\utorrent-1.8-rc7.upx.exe:µTorrent (TCP-In) "{2CF441DA-4EA6-4F35-B81C-9227D242CF5F}"= TCP:d:\div stuff\utorrent-1.8-rc7.upx.exe:µTorrent (UDP-In) "TCP Query User{B2A3C2A6-2FAE-410C-A804-BB2489FC039B}c:\\program files\\screamer radio\\screamer.exe"= UDP:c:\program files\screamer radio\screamer.exe:Screamer Radio "UDP Query User{39269975-A6B9-439C-A9E7-9727EE967EA2}c:\\program files\\screamer radio\\screamer.exe"= TCP:c:\program files\screamer radio\screamer.exe:Screamer Radio "TCP Query User{8986C729-70FC-406B-BD8F-79229C9B7381}c:\\program files\\d-link\\pc agent\\nica.exe"= UDP:c:\program files\d-link\pc agent\nica.exe:NICA "UDP Query User{39B2EDD2-2950-4CC1-A342-6418F9BA3CF5}c:\\program files\\d-link\\pc agent\\nica.exe"= TCP:c:\program files\d-link\pc agent\nica.exe:NICA "TCP Query User{3CD39075-64A9-4012-B576-755A0E94E39A}c:\\users\\frode\\appdata\\local\\temp\\rar$ex00.560\\yuleech-runes_of_magic_en-en.exe"= UDP:c:\users\frode\appdata\local\temp\rar$ex00.560\yuleech-runes_of_magic_en-en.exe:yuleech-runes_of_magic_en-en.exe "UDP Query User{0E40CFD3-9D50-4467-88AF-C4AB8826588C}c:\\users\\frode\\appdata\\local\\temp\\rar$ex00.560\\yuleech-runes_of_magic_en-en.exe"= TCP:c:\users\frode\appdata\local\temp\rar$ex00.560\yuleech-runes_of_magic_en-en.exe:yuleech-runes_of_magic_en-en.exe "TCP Query User{5A357DFC-F67B-4102-BEB1-4C45882DAE64}d:\\div stuff\\war europe downloader.exe"= UDP:d:\div stuff\war europe downloader.exe:Warhammer Downloader "UDP Query User{CBFA7A66-2A30-4E8D-A861-57515E8ED425}d:\\div stuff\\war europe downloader.exe"= TCP:d:\div stuff\war europe downloader.exe:Warhammer Downloader "TCP Query User{4056AC3A-2335-4604-9099-182E65617880}c:\\program files\\ventsrv\\ventrilo_srv.exe"= UDP:c:\program files\ventsrv\ventrilo_srv.exe:ventrilo_srv "UDP Query User{8F5EA64C-FC9E-494A-A1E4-26E76D630487}c:\\program files\\ventsrv\\ventrilo_srv.exe"= TCP:c:\program files\ventsrv\ventrilo_srv.exe:ventrilo_srv "TCP Query User{08E48EEA-60F8-458D-B31F-F496E6FA50D6}c:\\program files\\screamer radio\\screamer.exe"= UDP:c:\program files\screamer radio\screamer.exe:Screamer Radio "UDP Query User{8AB321CA-53D0-4B27-A4FB-B3BDA4220CCA}c:\\program files\\screamer radio\\screamer.exe"= TCP:c:\program files\screamer radio\screamer.exe:Screamer Radio "{D85098A1-4AEE-4C7E-A035-7624306B2C50}"= UDP:c:\program files\Runes of Magic\Runes of Magic.exe:Runes of Magic "{1E365E9E-D9A3-4466-9819-E25A245BB71A}"= TCP:c:\program files\Runes of Magic\Runes of Magic.exe:Runes of Magic "TCP Query User{63235411-CBD5-4346-A656-2FC645EFE049}c:\\program files\\novalogic\\joint operations typhoon rising\\update.exe"= UDP:c:\program files\novalogic\joint operations typhoon rising\update.exe:UPDATE "UDP Query User{7789C157-E628-4929-9799-3DBC552F1FE7}c:\\program files\\novalogic\\joint operations typhoon rising\\update.exe"= TCP:c:\program files\novalogic\joint operations typhoon rising\update.exe:UPDATE "TCP Query User{6C260882-44BF-4DD5-BE2A-00701F127207}c:\\program files\\novalogic\\joint operations typhoon rising\\jointops.exe"= UDP:c:\program files\novalogic\joint operations typhoon rising\jointops.exe:Jointops "UDP Query User{47AE5B4D-730E-47AF-976A-344EE4A4956E}c:\\program files\\novalogic\\joint operations typhoon rising\\jointops.exe"= TCP:c:\program files\novalogic\joint operations typhoon rising\jointops.exe:Jointops "TCP Query User{4D54EF26-A9C3-4C07-9792-8044F210AE21}c:\\program files\\cs 1.6\\hl.exe"= UDP:c:\program files\cs 1.6\hl.exe:Half-Life Launcher "UDP Query User{7C4C5C92-04A4-46BF-AB20-C537B3C42122}c:\\program files\\cs 1.6\\hl.exe"= TCP:c:\program files\cs 1.6\hl.exe:Half-Life Launcher "TCP Query User{8937E84B-9DF8-47A6-9F47-707DCF09A1BB}c:\\program files\\warcraft 3 fr\\war3.exe"= UDP:c:\program files\warcraft 3 fr\war3.exe:Warcraft III "UDP Query User{C6BD895A-0B7C-44CD-8882-C2B198E40A2D}c:\\program files\\warcraft 3 fr\\war3.exe"= TCP:c:\program files\warcraft 3 fr\war3.exe:Warcraft III "TCP Query User{9F43FCEF-C7B0-4906-831B-2B7F0A2EA820}c:\\program files\\filezilla ftp client\\filezilla.exe"= UDP:c:\program files\filezilla ftp client\filezilla.exe:FileZilla FTP Client "UDP Query User{96F8587D-9427-448D-94A3-C02EADBD24EF}c:\\program files\\filezilla ftp client\\filezilla.exe"= TCP:c:\program files\filezilla ftp client\filezilla.exe:FileZilla FTP Client "TCP Query User{26C4630C-C3E0-44EC-A33D-C8A4EFB5B2F3}c:\\program files\\trellian\\trellian ftp\\ftp.exe"= UDP:c:\program files\trellian\trellian ftp\ftp.exe:Multithreaded FTP client "UDP Query User{EFFED92A-3E6E-4E98-B30C-9F0AAE91D40F}c:\\program files\\trellian\\trellian ftp\\ftp.exe"= TCP:c:\program files\trellian\trellian ftp\ftp.exe:Multithreaded FTP client "{64C6E384-0ABE-40A5-966D-2F7C1CEC9286}"= UDP:28900:28900 "{E4F55478-D1C7-456E-A7A7-B36494E65438}"= TCP:28900:28900 "{1B161D43-6AF3-4F60-B933-17D22F6EB643}"= UDP:d:\warhammer online age of reckoning\WAR.exe:WAR "{F944BF59-ACA3-437B-990A-E3969BD5CC4D}"= TCP:d:\warhammer online age of reckoning\WAR.exe:WAR "{7C8F8540-CB33-4CAD-8297-1C0046CA52A6}"= UDP:d:\warhammer online age of reckoning\warpatch.exe:warpatch "{5194C546-CAEE-45FE-A280-96CBF0DBB1E2}"= TCP:d:\warhammer online age of reckoning\warpatch.exe:warpatch "{FF61FBBF-FC77-4294-BBFF-20F997C9A2AB}"= UDP:1380:1380 "{E81F6500-ADD6-4D4F-BBB6-FCF30732F994}"= UDP:10622:10622 "{45467F3A-3296-4B1A-89F9-D7706E3F3490}"= Disabled:UDP:c:\program files\Electronic Arts\Red Alert 3\RA3.exe:RA3 "{DAA44B3B-3FF5-4D95-8380-60F06DF9545D}"= Disabled:TCP:c:\program files\Electronic Arts\Red Alert 3\RA3.exe:RA3 "TCP Query User{FB64CF26-B3A0-4D85-A26B-119F4C73B817}c:\\program files\\electronic arts\\red alert 3\\data\\ra3_1.4.game"= UDP:c:\program files\electronic arts\red alert 3\data\ra3_1.4.game:Command & Conquer™ Red Alert™ 3 "UDP Query User{1A1DF8B4-C550-4914-B0D2-DEE52B083BFA}c:\\program files\\electronic arts\\red alert 3\\data\\ra3_1.4.game"= TCP:c:\program files\electronic arts\red alert 3\data\ra3_1.4.game:Command & Conquer™ Red Alert™ 3 "TCP Query User{8ABEF425-473D-4369-8477-72057F2C0587}c:\\xampp\\apache\\bin\\apache.exe"= UDP:c:\xampp\apache\bin\apache.exe:Apache HTTP Server "UDP Query User{3F0EEA2D-B875-4A10-AB80-1C6D1AC186C6}c:\\xampp\\apache\\bin\\apache.exe"= TCP:c:\xampp\apache\bin\apache.exe:Apache HTTP Server "TCP Query User{78FBB444-47D9-48B1-8BF7-643B6508147D}c:\\program files\\mirc\\mirc.exe"= UDP:c:\program files\mirc\mirc.exe:mIRC "UDP Query User{80B24EC2-D69B-4892-95F1-B95AE5F04C7F}c:\\program files\\mirc\\mirc.exe"= TCP:c:\program files\mirc\mirc.exe:mIRC "{20E73440-EC25-48C8-B878-694F39AFDF4B}"= UDP:c:\program files\VentSrv\ventrilo_svc.exe:ventrilo_svc "{6ADA6B88-0333-4D1E-9F72-FCB24DAE5535}"= TCP:c:\program files\VentSrv\ventrilo_svc.exe:ventrilo_svc "TCP Query User{E89D81C2-C27B-428A-8046-35B4A0F480F2}c:\\program files\\ventsrv\\ventrilo_old.exe"= UDP:c:\program files\ventsrv\ventrilo_old.exe:ventrilo_old "UDP Query User{5865CE31-4FE7-4F92-96BF-9153E772FF80}c:\\program files\\ventsrv\\ventrilo_old.exe"= TCP:c:\program files\ventsrv\ventrilo_old.exe:ventrilo_old "TCP Query User{9F5310D0-9912-463E-A460-7FB1F62CA4BB}c:\\program files\\ventsrv\\ventrilo_svr.exe"= UDP:c:\program files\ventsrv\ventrilo_svr.exe:ventrilo_svr "UDP Query User{82B2B13B-F0D5-4FDA-BA61-28A7FA38F6D2}c:\\program files\\ventsrv\\ventrilo_svr.exe"= TCP:c:\program files\ventsrv\ventrilo_svr.exe:ventrilo_svr "TCP Query User{AC707C6A-8B10-4C39-9D28-5120C580462D}c:\\program files\\java\\jre6\\bin\\java.exe"= UDP:c:\program files\java\jre6\bin\java.exe:Java Platform SE binary "UDP Query User{BD7EDFF7-587A-45D9-893A-21FA5750CE51}c:\\program files\\java\\jre6\\bin\\java.exe"= TCP:c:\program files\java\jre6\bin\java.exe:Java Platform SE binary "{F9C6742C-A6C8-4062-A742-92D0C4070127}"= UDP:c:\program files\Runes of Magic\ClientUpdate.exe:ClientUpdate "{423E37ED-3523-4F39-9EBA-A2DB9E4214F5}"= TCP:c:\program files\Runes of Magic\ClientUpdate.exe:ClientUpdate "{406974E6-FF00-4095-ABE1-69F5E63ECA47}"= UDP:c:\program files\Runes of Magic\Client.exe:Client "{17313F7E-4E17-44A9-A8CB-C298C9EE1210}"= TCP:c:\program files\Runes of Magic\Client.exe:Client "{DB60A4AC-58F4-4327-ADE1-E281267012BE}"= UDP:c:\program files\Runes of Magic\Launcher.exe:Launcher "{3AFF87F5-D939-4B38-A246-E90D6409E753}"= TCP:c:\program files\Runes of Magic\Launcher.exe:Launcher "TCP Query User{5278D08E-FD00-41C3-9418-E1AED6D65A88}c:\\users\\frode\\appdata\\local\\screamer radio\\screamer.exe"= UDP:c:\users\frode\appdata\local\screamer radio\screamer.exe:screamer.exe "UDP Query User{DE680AA2-C1A7-4E88-873A-D82CE958E9CD}c:\\users\\frode\\appdata\\local\\screamer radio\\screamer.exe"= TCP:c:\users\frode\appdata\local\screamer radio\screamer.exe:screamer.exe "TCP Query User{3953A86F-D3DA-4252-BD29-58CF8F423255}c:\\program files\\adiirc\\adiirc.exe"= UDP:c:\program files\adiirc\adiirc.exe:AdiIRC "UDP Query User{05AE59E4-E8AA-4FF7-B59B-EE8E9923A1F1}c:\\program files\\adiirc\\adiirc.exe"= TCP:c:\program files\adiirc\adiirc.exe:AdiIRC "TCP Query User{A9D345DA-CB62-4B6A-BF0C-66929B9D527A}c:\\users\\frode\\appdata\\local\\temp\\blizzard launcher temporary - 73d34b58\\launcher.exe"= UDP:c:\users\frode\appdata\local\temp\blizzard launcher temporary - 73d34b58\launcher.exe:launcher.exe "UDP Query User{814F1176-5DEA-499E-9296-E26DEBAEB2D1}c:\\users\\frode\\appdata\\local\\temp\\blizzard launcher temporary - 73d34b58\\launcher.exe"= TCP:c:\users\frode\appdata\local\temp\blizzard launcher temporary - 73d34b58\launcher.exe:launcher.exe "TCP Query User{585305A7-F546-41FE-8817-276F9538EEA8}d:\\flashget\\flashget.exe"= UDP:d:\flashget\flashget.exe:FlashGet "UDP Query User{2FBE982A-37F3-4499-9170-8F04EFC141A8}d:\\flashget\\flashget.exe"= TCP:d:\flashget\flashget.exe:FlashGet "{3609C22B-05CA-43AA-870B-E50121B34A03}"= UDP:c:\program files\Curse\CurseClient.exe:Curse Client "{5A488C1F-D47E-497D-B87F-43A88EE9467F}"= TCP:c:\program files\Curse\CurseClient.exe:Curse Client "{F7939D7B-C646-4977-A768-32F3DC6699F7}"= UDP:1100:Anno 1404 CB "TCP Query User{A994621A-86A6-47FE-904E-1DC29CF653B0}i:\\screamer radio\\screamer.exe"= UDP:i:\screamer radio\screamer.exe:Screamer Radio "UDP Query User{0E66D303-197D-434A-91FC-E8BE8A4E8B5A}i:\\screamer radio\\screamer.exe"= TCP:i:\screamer radio\screamer.exe:Screamer Radio "{C14BE224-84AD-4C21-BCD5-F880C52C81EC}"= UDP:c:\wow\BackgroundDownloader.exe:Blizzard Downloader "{06B587F3-4C00-492A-8226-9031A5ED0266}"= TCP:c:\wow\BackgroundDownloader.exe:Blizzard Downloader "{6C0E82F2-79A4-419A-A325-6BEBAA49E86C}"= UDP:3724:Blizzard Downloader: 3724 "TCP Query User{B2540D08-C670-4E30-B322-B02DF3E5B7AD}d:\\div stuff\\viviplay(2).exe"= UDP:d:\div stuff\viviplay(2).exe:ViViMediaPlay "UDP Query User{28E5D459-6460-4B6A-A734-6B52A11D7A02}d:\\div stuff\\viviplay(2).exe"= TCP:d:\div stuff\viviplay(2).exe:ViViMediaPlay "{041E9E0D-1362-4271-8AD1-84484F0B9354}"= UDP:80:rom "{64114107-84BC-4D4C-9029-7E22085B14D9}"= UDP:21002:rom2 "{06DCD101-F3EF-4404-9306-89BB23ED5AC4}"= UDP:c:\program files\Ventrilo\Ventrilo.exe:Ventrilo.exe "{1AC2BFE6-87E2-44EE-A4B1-2690FB6901FF}"= TCP:c:\program files\Ventrilo\Ventrilo.exe:Ventrilo.exe "{93521945-6A90-47C5-A99C-2ADA664FAFF7}"= UDP:c:\program files\uTorrent\uTorrent.exe:uTorrent "{CCB06324-3941-4585-845A-5F06E13AA9CA}"= TCP:c:\program files\uTorrent\uTorrent.exe:uTorrent "TCP Query User{9E2E035F-5FD3-4F16-8E62-3E6B53920638}c:\\wow\\launcher.exe"= UDP:c:\wow\launcher.exe:Blizzard Launcher "UDP Query User{56388026-7669-47D5-9D09-03DA2488A56F}c:\\wow\\launcher.exe"= TCP:c:\wow\launcher.exe:Blizzard Launcher "{FDA64C6A-7F41-4E85-9515-25AAA74BEF35}"= UDP:c:\program files\TVersity\Media Server\MediaServer.exe:TVersity Media Server "{BE0135C2-2ABD-4F7C-8010-5D76E1CAC097}"= TCP:c:\program files\TVersity\Media Server\MediaServer.exe:TVersity Media Server "{1BEB61CA-34C2-4CE9-99C8-CEC85DDE95B5}"= UDP:c:\program files\THQ\Company of Heroes\RelicCOH.exe:Company of Heroes "{7957CE6E-75E0-42AF-9F3F-CFB49A5A7D33}"= TCP:c:\program files\THQ\Company of Heroes\RelicCOH.exe:Company of Heroes "{0D4889AF-5C0D-49B4-86E0-A0767ECE7E6F}"= UDP:c:\program files\THQ\Company of Heroes\RelicDownloader\RelicDownloader.exe:Relic Downloader "{C7AF4474-D8E6-4147-B768-DBB9E3DE90AA}"= TCP:c:\program files\THQ\Company of Heroes\RelicDownloader\RelicDownloader.exe:Relic Downloader "{4810DDFA-67D0-4D46-A755-36A2D2031837}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In) "{6369554C-73FB-4EE1-AE2A-0B61F6649DA9}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In) "{FF2B2D95-1228-4406-BA4F-612F2032ABE1}"= UDP:c:\program files\Perfect World Entertainment\Jade Dynasty\launcher\Launcher.exe:Launcher "{1D0DD600-14DC-4742-B855-EDF5DF50F8AC}"= TCP:c:\program files\Perfect World Entertainment\Jade Dynasty\launcher\Launcher.exe:Launcher "{14E33593-5CE2-4383-BD06-69E2D1B4A407}"= UDP:c:\program files\Perfect World Entertainment\Jade Dynasty\patcher\patcher.exe:Jade Dynasty "{8244E7CF-67AF-446B-A0E9-A89C0AD14F48}"= TCP:c:\program files\Perfect World Entertainment\Jade Dynasty\patcher\patcher.exe:Jade Dynasty "TCP Query User{B68681C4-9575-415F-84E9-E449E412BEED}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox "UDP Query User{B4A14587-5265-4B12-A311-2F8ECC8E3767}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox "{176FD458-476D-416B-85F3-1BFEFE95FB27}"= UDP:c:\program files\NCSoft\Launcher\NCLauncher.exe:NCsoft Launcher "{B27755B1-D410-4DAE-A1A6-6FF405C1D329}"= TCP:c:\program files\NCSoft\Launcher\NCLauncher.exe:NCsoft Launcher "TCP Query User{AB74F799-F6F3-455D-B1D4-2939CBDA3896}d:\\div stuff\\citiesxl_downloader.exe"= UDP:d:\div stuff\citiesxl_downloader.exe:citiesxl_downloader.exe "UDP Query User{F9ED8792-8BFA-4B09-B61F-345D16D56FA9}d:\\div stuff\\citiesxl_downloader.exe"= TCP:d:\div stuff\citiesxl_downloader.exe:citiesxl_downloader.exe "TCP Query User{3CC2A21C-54FF-44A9-80D9-8CF632375249}c:\\program files\\monte cristo\\cities xl\\cds\\citiesxl_http.exe"= UDP:c:\program files\monte cristo\cities xl\cds\citiesxl_http.exe:CitiesXL_http "UDP Query User{C42F846D-70BE-469F-84EF-A86E895FBFDE}c:\\program files\\monte cristo\\cities xl\\cds\\citiesxl_http.exe"= TCP:c:\program files\monte cristo\cities xl\cds\citiesxl_http.exe:CitiesXL_http "{2727E7A1-FD20-4BCA-B259-DAF5F26359F9}"= UDP:c:\windows\System32\PnkBstrA.exe:PnkBstrA "{F7EF3F26-5EEC-4A21-9423-6818F68232A2}"= TCP:c:\windows\System32\PnkBstrA.exe:PnkBstrA "{963F02E8-A1A8-41DC-9225-C63E5529ECF4}"= UDP:c:\windows\System32\PnkBstrB.exe:PnkBstrB "{33AA3D15-38B1-4D99-974D-AA0A28D2ACC9}"= TCP:c:\windows\System32\PnkBstrB.exe:PnkBstrB "{3B9A7C26-7402-42E4-B9CD-7C514AB31498}"= UDP:c:\program files\id Software\Enemy Territory - QUAKE Wars\etqw.exe:Enemy Territory - QUAKE Wars "{F16B61A7-AF82-4287-B51A-F5A9ED497EEE}"= TCP:c:\program files\id Software\Enemy Territory - QUAKE Wars\etqw.exe:Enemy Territory - QUAKE Wars "{709737C3-1E5D-4DCD-A109-C30F1354C3C5}"= UDP:c:\program files\id Software\Enemy Territory - QUAKE Wars\etqwded.exe:etqwded.exe "{2BFBF0CC-2546-418E-A50D-522BEEF0BE22}"= TCP:c:\program files\id Software\Enemy Territory - QUAKE Wars\etqwded.exe:etqwded.exe "TCP Query User{4519DA58-5FAD-43B6-AAAE-D52AF3BB45B7}c:\\program files\\mozilla firefox 3.5\\firefox.exe"= UDP:c:\program files\mozilla firefox 3.5\firefox.exe:Firefox "UDP Query User{411A714F-B9C8-4385-BD4A-05D7790C7720}c:\\program files\\mozilla firefox 3.5\\firefox.exe"= TCP:c:\program files\mozilla firefox 3.5\firefox.exe:Firefox "{2E481B7D-8E05-4D76-80FE-C61DFA1E7A76}"= UDP:c:\program files\Ubisoft\Related Designs\ANNO 1404\Anno4.exe:ANNO 1404 "{9A3C1B00-A27B-42D4-A562-89A701EED90F}"= TCP:c:\program files\Ubisoft\Related Designs\ANNO 1404\Anno4.exe:ANNO 1404 "{D2BBF1B8-439C-42B4-9777-6F326A6051D9}"= UDP:c:\program files\Ubisoft\Related Designs\ANNO 1404\tools\Anno4Web.exe:ANNO 1404 Web "{433178F7-6E01-420D-B2BD-E8372B1FA324}"= TCP:c:\program files\Ubisoft\Related Designs\ANNO 1404\tools\Anno4Web.exe:ANNO 1404 Web "TCP Query User{31A2724E-16CE-441E-AC85-C92C6E677C3A}c:\\program files\\ea sports\\fifa 09\\fifa09.exe"= UDP:c:\program files\ea sports\fifa 09\fifa09.exe:FIFA09 "UDP Query User{99B47B72-87D6-455D-965A-76F4D0544499}c:\\program files\\ea sports\\fifa 09\\fifa09.exe"= TCP:c:\program files\ea sports\fifa 09\fifa09.exe:FIFA09 "TCP Query User{6FB08E1B-13EE-44A4-80D7-41A1E554FF0B}c:\\program files\\thq\\company of heroes\\relicdownloader\\relicdownloader.exe"= UDP:c:\program files\thq\company of heroes\relicdownloader\relicdownloader.exe:Relic Patch Download Manager "UDP Query User{1F3C3CC8-BA27-406C-8310-9F8B0282834B}c:\\program files\\thq\\company of heroes\\relicdownloader\\relicdownloader.exe"= TCP:c:\program files\thq\company of heroes\relicdownloader\relicdownloader.exe:Relic Patch Download Manager "TCP Query User{77A942AF-6773-4C2B-AF5C-F3594AFC4A0F}c:\\program files\\thq\\company of heroes\\reliccoh.exe"= UDP:c:\program files\thq\company of heroes\reliccoh.exe:RelicCOH "UDP Query User{CA483B62-011C-4EE6-8DD1-FE9B9E0DA3BC}c:\\program files\\thq\\company of heroes\\reliccoh.exe"= TCP:c:\program files\thq\company of heroes\reliccoh.exe:RelicCOH [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile] "EnableFirewall"= 0 (0x0) R1 ElRawDisk;ElRawDisk;c:\windows\System32\drivers\elrawdsk.sys [25.07.2008 10:51 12800] R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [11.04.2009 13:01 108289] R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [29.01.2009 13:50 206096] R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [14.07.2009 12:28 239648] R3 CT20XUT.SYS;CT20XUT.SYS;c:\windows\System32\drivers\CT20XUT.sys [08.10.2008 01:21 171032] R3 CTEXFIFX.SYS;CTEXFIFX.SYS;c:\windows\System32\drivers\CTEXFIFX.sys [08.10.2008 01:21 1324056] R3 CTHWIUT.SYS;CTHWIUT.SYS;c:\windows\System32\drivers\CTHWIUT.sys [08.10.2008 01:21 72728] R3 m4cxvista;NDIS6.0 Miniport Driver for D-Link Gigabit Ethernet Controller;c:\windows\System32\drivers\m4cxvista.sys [10.01.2007 09:15 196096] S2 ioloFileInfoList;iolo FileInfoList Service;c:\program files\iolo\common\lib\ioloServiceManager.exe --> c:\program files\iolo\common\lib\ioloServiceManager.exe [?] S2 ioloSystemService;iolo System Service;c:\program files\iolo\common\lib\ioloServiceManager.exe --> c:\program files\iolo\common\lib\ioloServiceManager.exe [?] S3 cpuz132;cpuz132;c:\windows\System32\drivers\cpuz132_x32.sys [16.05.2009 10:58 12672] S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [27.09.2008 18:33 79360] S3 CT20XUT;CT20XUT;c:\windows\System32\drivers\CT20XUT.sys [08.10.2008 01:21 171032] S3 CTEXFIFX;CTEXFIFX;c:\windows\System32\drivers\CTEXFIFX.sys [08.10.2008 01:21 1324056] S3 CTHWIUT;CTHWIUT;c:\windows\System32\drivers\CTHWIUT.sys [08.10.2008 01:21 72728] S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?] S3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\System32\drivers\s0016bus.sys [30.11.2008 23:29 89256] S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\System32\drivers\s0016mdfl.sys [30.11.2008 23:29 15016] S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\System32\drivers\s0016mdm.sys [30.11.2008 23:29 120744] S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\System32\drivers\s0016mgmt.sys [30.11.2008 23:29 114216] S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\System32\drivers\s0016nd5.sys [30.11.2008 23:29 25512] S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\System32\drivers\s0016obex.sys [30.11.2008 23:29 110632] S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\System32\drivers\s0016unic.sys [30.11.2008 23:29 115752] S3 s0017bus;Sony Ericsson Device 0017 driver (WDM);c:\windows\System32\drivers\s0017bus.sys [30.11.2008 23:29 90536] S3 s0017mdfl;Sony Ericsson Device 0017 USB WMC Modem Filter;c:\windows\System32\drivers\s0017mdfl.sys [30.11.2008 23:29 15016] S3 s0017mdm;Sony Ericsson Device 0017 USB WMC Modem Driver;c:\windows\System32\drivers\s0017mdm.sys [30.11.2008 23:29 122152] S3 s0017mgmt;Sony Ericsson Device 0017 USB WMC Device Management Drivers (WDM);c:\windows\System32\drivers\s0017mgmt.sys [30.11.2008 23:29 115496] S3 s0017nd5;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (NDIS);c:\windows\System32\drivers\s0017nd5.sys [30.11.2008 23:29 25768] S3 s0017obex;Sony Ericsson Device 0017 USB WMC OBEX Interface;c:\windows\System32\drivers\s0017obex.sys [30.11.2008 23:29 111912] S3 s0017unic;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (WDM);c:\windows\System32\drivers\s0017unic.sys [30.11.2008 23:29 117672] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] "c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP . . ------- Tilleggsskanning ------- . uInternet Settings,ProxyOverride = *.local IE: &Last ned alle med FlashGet - d:\flashget\jc_all.htm IE: &Last ned med FlashGet - d:\flashget\jc_link.htm IE: &NeoTrace It! - c:\progra~1\NEOTRA~1\NTXcontext.htm FF - ProfilePath - c:\users\Frode\AppData\Roaming\Mozilla\Firefox\Profiles\bs9cdtkw.default\ FF - prefs.js: browser.startup.homepage - hxxp://nb-NO.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:nb-NO:official FF - plugin: c:\program files\Mozilla Firefox 3.5\plugins\np-mswmp.dll FF - plugin: c:\users\Frode\AppData\Roaming\Mozilla\Firefox\Profiles\bs9cdtkw.default\extensions\[email protected]\platform\WINNT_x86-msvc\plugins\npmnqmp071303000006.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ ---- FIREFOX POLICIES ---- c:\program files\Mozilla Firefox 3.5\greprefs\all.js - pref("media.enforce_same_site_origin", false); c:\program files\Mozilla Firefox 3.5\greprefs\all.js - pref("media.cache_size", 51200); c:\program files\Mozilla Firefox 3.5\greprefs\all.js - pref("media.ogg.enabled", true); c:\program files\Mozilla Firefox 3.5\greprefs\all.js - pref("media.wave.enabled", true); c:\program files\Mozilla Firefox 3.5\greprefs\all.js - pref("media.autoplay.enabled", true); c:\program files\Mozilla Firefox 3.5\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true); c:\program files\Mozilla Firefox 3.5\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess"); c:\program files\Mozilla Firefox 3.5\greprefs\all.js - pref("dom.storage.default_quota", 5120); c:\program files\Mozilla Firefox 3.5\greprefs\all.js - pref("content.sink.event_probe_rate", 3); c:\program files\Mozilla Firefox 3.5\greprefs\all.js - pref("network.http.prompt-temp-redirect", true); c:\program files\Mozilla Firefox 3.5\greprefs\all.js - pref("layout.css.dpi", -1); c:\program files\Mozilla Firefox 3.5\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1); c:\program files\Mozilla Firefox 3.5\greprefs\all.js - pref("gestures.enable_single_finger_input", true); c:\program files\Mozilla Firefox 3.5\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0); c:\program files\Mozilla Firefox 3.5\greprefs\all.js - pref("network.tcp.sendbuffer", 131072); c:\program files\Mozilla Firefox 3.5\greprefs\all.js - pref("geo.enabled", true); c:\program files\Mozilla Firefox 3.5\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true); c:\program files\Mozilla Firefox 3.5\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35"); c:\program files\Mozilla Firefox 3.5\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35"); c:\program files\Mozilla Firefox 3.5\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".no"); c:\program files\Mozilla Firefox 3.5\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2); c:\program files\Mozilla Firefox 3.5\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~"); c:\program files\Mozilla Firefox 3.5\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0); c:\program files\Mozilla Firefox 3.5\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true); c:\program files\Mozilla Firefox 3.5\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true); c:\program files\Mozilla Firefox 3.5\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false); c:\program files\Mozilla Firefox 3.5\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true); c:\program files\Mozilla Firefox 3.5\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true); c:\program files\Mozilla Firefox 3.5\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true); c:\program files\Mozilla Firefox 3.5\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true); c:\program files\Mozilla Firefox 3.5\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false); c:\program files\Mozilla Firefox 3.5\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false); c:\program files\Mozilla Firefox 3.5\defaults\pref\firefox.js - pref("privacy.cpd.history", true); c:\program files\Mozilla Firefox 3.5\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true); c:\program files\Mozilla Firefox 3.5\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false); c:\program files\Mozilla Firefox 3.5\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true); c:\program files\Mozilla Firefox 3.5\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true); c:\program files\Mozilla Firefox 3.5\defaults\pref\firefox.js - pref("privacy.cpd.cache", true); c:\program files\Mozilla Firefox 3.5\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true); c:\program files\Mozilla Firefox 3.5\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false); c:\program files\Mozilla Firefox 3.5\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false); c:\program files\Mozilla Firefox 3.5\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false); c:\program files\Mozilla Firefox 3.5\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2); c:\program files\Mozilla Firefox 3.5\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror"); c:\program files\Mozilla Firefox 3.5\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false); c:\program files\Mozilla Firefox 3.5\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false); c:\program files\Mozilla Firefox 3.5\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json"); . . ------- Filassosiasjoner ------- . VBEFile=NOTEPAD.EXE %1 VBSFile=NOTEPAD.EXE %1 . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-08-02 12:08 Windows 6.0.6001 Service Pack 1 NTFS skanner skjulte prosesser ... skanner skjulte autostart-oppføringer ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run CTxfiHlp = CTXFIHLP.EXE? skanner skjulte filer ... skanning vellykket skjulte filer: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\npggsvc] "ImagePath"="c:\windows\system32\GameMon.des -service" . --------------------- LÅSTE REGISTERNØKLER --------------------- [HKEY_USERS\S-1-5-21-1987112767-1190121641-504785011-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*] "??"=hex:88,bf,66,08,cd,72,99,b5,81,21,82,82,f2,df,e8,10,56,ca,75,10,e6,78,08, 00,d9,9e,8f,dc,bf,bc,eb,1f,0b,38,1d,d2,ee,0d,99,a9,1f,98,38,d8,03,5d,73,6e,\ "??"=hex:2e,50,ea,c9,19,92,5a,18,8b,5c,da,3c,6f,fd,4e,1c [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}003\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . Tidspunkt ferdig: 2009-08-02 12:10 ComboFix-quarantined-files.txt 2009-08-02 10:10 ComboFix2.txt 2009-06-25 22:32 Pre-Run: 81 166 544 896 byte ledig Post-Run: 82 125 238 272 byte ledig 527 --- E O F --- 2009-07-31 13:58 HJT log Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:01:13, on 02.08.2009 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v8.00 (8.00.6001.18813) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\SYSTEM32\CTXFISPI.EXE C:\Program Files\Avira\AntiVir Desktop\avgnt.exe C:\Program Files\Creative\Volume Panel\VolPanlu.exe C:\Windows\System32\Ctxfihlp.exe C:\Windows\ehome\ehtray.exe C:\Windows\ehome\ehmsas.exe C:\Windows\system32\wbem\unsecapp.exe C:\HJT\testing.exe.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - D:\FlashGet\jccatch.dll (file missing) O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll O2 - BHO: Påloggingshjelp for Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - D:\FlashGet\getflash.dll (file missing) O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll O4 - HKLM\..\Run: [CTXFIREG] CTxfiReg.exe O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min /nosplash O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Volume Panel\VolPanlu.exe" /r O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKUS\S-1-5-18\..\Run: [DevconDefaultDB] C:\Windows\system32\READREG /SILENT /FAIL=1 (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [DevconDefaultDB] C:\Windows\system32\READREG /SILENT /FAIL=1 (User 'Default user') O8 - Extra context menu item: &Last ned alle med FlashGet - D:\FlashGet\jc_all.htm O8 - Extra context menu item: &Last ned med FlashGet - D:\FlashGet\jc_link.htm O8 - Extra context menu item: &NeoTrace It! - C:\PROGRA~1\NEOTRA~1\NTXcontext.htm O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\FlashGet\FlashGet.exe (file missing) O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\FlashGet\FlashGet.exe (file missing) O9 - Extra button: NeoTrace It! - {9885224C-1217-4c5f-83C2-00002E6CEF2B} - C:\PROGRA~1\NEOTRA~1\NTXtoolbar.htm (HKCU) O13 - Gopher Prefix: O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://ccfiles.creative.com/Web/softwareup...15108/CTPID.cab O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iolo FileInfoList Service (ioloFileInfoList) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe (file missing) O23 - Service: iolo System Service (ioloSystemService) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe (file missing) O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\BurnAware Free\nmsaccessu.exe O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing) O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- End of file - 6158 bytes MBAM fant ingenting. AVIRA fant ingenting ved nytt søk. Endret 2. august 2009 av Frode789 Lenke til kommentar https://www.diskusjon.no/topic/1137777-malware-fjerning-logger/
snippsat Skrevet 2. august 2009 Del Skrevet 2. august 2009 (endret) Ser rimlig greit ut,tar og rydder litt. Med vista kjør cmd som administrator. Skriv inn 1 og 1 linje eller kopiere og lim inn går også. --- sc stop ioloFileInfoList sc delete ioloFileInfoList sc stop ioloSystemService sc delete ioloSystemService sc stop npggsvc sc delete npggsvc --- Start HijackThis "scan" finn disse linjene merk dem,så trykk fix checked. O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - D:\FlashGet\jccatch.dll (file missing) O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - D:\FlashGet\getflash.dll (file missing) O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\FlashGet\FlashGet.exe (file missing) O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\FlashGet\FlashGet.exe (file missing) O23 - Service: iolo FileInfoList Service (ioloFileInfoList) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe (file missing) O23 - Service: iolo System Service (ioloSystemService) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe (file missing) O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing) --- Du kan fjerne combofix ved å skrive combofix /u fra kjør-vinduet. Denne kommandoen gjør at filer i karantene og backups blir slette. Systemgjenopprettingsmappa nullstilt etc. --- Sjekk om software er oppdatert Secunia --- Surf trygt Endret 2. august 2009 av SNIPPSAT Lenke til kommentar https://www.diskusjon.no/topic/1137777-malware-fjerning-logger/#findComment-14143003
Frode99 Skrevet 2. august 2009 Forfatter Del Skrevet 2. august 2009 Ok. Takker for svar og hjelpen! Lenke til kommentar https://www.diskusjon.no/topic/1137777-malware-fjerning-logger/#findComment-14143161
Anbefalte innlegg
Opprett en konto eller logg inn for å kommentere
Du må være et medlem for å kunne skrive en kommentar
Opprett konto
Det er enkelt å melde seg inn for å starte en ny konto!
Start en kontoLogg inn
Har du allerede en konto? Logg inn her.
Logg inn nå