[Løst]Hjelp jeg har fått en trojansk hest !

lordbeiken · 22. januar 2009

Logfile of Trend Micro HijackThis v2.0.2

Klikk for å se/fjerne innholdet nedenfor

Scan saved at 23:26:25, on 22.01.2009

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Boot mode: Normal

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Windows Defender\MSASCui.exe

C:\Windows\RtHDVCpl.exe

C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Windows\System32\rundll32.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Windows\ehome\ehmsas.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\Program Files\Steam\Steam.exe

C:\program files\avira\antivir personaledition classic\avcenter.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.bearshare.com/no/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O1 - Hosts: ::1 localhost

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)

O2 - BHO: UrlHelper Class - {74322BF9-DF26-493f-B0DA-6D2FC5E6429E} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareIEHelper.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareMediaBar.dll

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [iSUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [1438816404] "C:\ProgramData\2131496019\1438816404.exe"

O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter

O4 - HKCU\..\Run: [iSUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETTVERKSTJENESTE')

O4 - Startup: Ubisoft register.lnk = C:\Program Files\Ubisoft\Register\schedule.exe

O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Send til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O13 - Gopher Prefix:

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL

O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Google Desktop Manager 5.8.809.23506 (GoogleDesktopManager-092308-165331) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

--

End of file - 7296 bytes

Endret 22. januar 2009 av lordbeiken

r2d290 · 23. januar 2009

Du har (eller rester av) 2 antivirusprogram: AVG og Avira. Avinstaller ett av dem.

Avinstaller bearshare. Det kan du gjøre fra kontrollpanel->legg til/fjern programmer. (du kan eventuelt installere det igjen når vi er ferdig med opprensingen.

Ellers kan du følge veiledningen som er linket til øverst i signaturen min, og poste loggene her i tråden din. Samtidig forteller du hvilket program som forteller at du har en trojansk hest, hva fila heter, hvor fila ligger, og hva programmet har gjort med trojaneren (slettet, karantene osv.).

Endret 23. januar 2009 av r2d290

lordbeiken · 23. januar 2009

tidligere idag da jeg skulle støvsuge rommet, kortsluttet sikringen på rommet mitt...

senere da jeg fikset sikringen, slo jeg på dataen og det stod at "dette er en midlertidig profil"

alt så ut som om at det hadde blitt restartet eller noe (bakgrunn var borte, mapper var borte osv.)

heldigvis er ikke filene mine slettet, bare lagt tilbake i programfiler

føler meg litt tilbakestående på data...

BTW finner ikke AVG filer på dataen

likte ikke AVG så jeg bytta til Avira AntiVir Personal

burde jeg bytte til noe annet ??

Endret 23. januar 2009 av lordbeiken

lordbeiken · 23. januar 2009

har installert Malwarebytes' Anti-Malware 1.3 og gjort en scan dette ble resultatet

Klikk for å se/fjerne innholdet nedenfor

Malwarebytes' Anti-Malware 1.33

Database version: 1682

Windows 6.0.6001 Service Pack 1

23.01.2009 19:21:18

mbam-log-2009-01-23 (19-21-18).txt

Scan type: Quick Scan

Objects scanned: 50669

Time elapsed: 1 minute(s), 32 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 1

Registry Values Infected: 1

Registry Data Items Infected: 0

Folders Infected: 1

Files Infected: 3

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CLASSES_ROOT\xml.xml.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1438816404 (Rogue.SystemSecurity) -> Quarantined and deleted successfully.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

C:\Users\Lordbeiken\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Security (Rogue.SystemSecurity) -> Quarantined and deleted successfully.

Files Infected:

C:\ProgramData\2131496019\1438816404.exe (Rogue.SystemSecurity) -> Quarantined and deleted successfully.

C:\Users\Lordbeiken\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Security\System Security.lnk (Rogue.SystemSecurity) -> Quarantined and deleted successfully.

C:\Users\Lordbeiken\AppData\Local\Temp\~tmpa.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

er problemet løst da ??

avira tror at det er ennå malware på dataen

Endret 23. januar 2009 av lordbeiken

snippsat · 23. januar 2009

likte ikke AVG så jeg bytta til Avira AntiVir Personal

Avira er bra.

Last Combofix ned ,legg på skrivebordet.

Ikke klikk på vindu mens programmet kjører.

post logg C:\combofix.txt

lordbeiken · 23. januar 2009

likte ikke AVG så jeg bytta til Avira AntiVir Personal

Avira er bra.

Last Combofix ned ,legg på skrivebordet.

Ikke klikk på vindu mens programmet kjører.

post logg C:\combofix.txt

et lite problem med combofix er at jeg må restarte pc'en

da forsvinner vanligvis alt arbeidet jeg har gjort :thumbdown:

men skal prøve igjen ;D

Endret 23. januar 2009 av lordbeiken

lordbeiken · 23. januar 2009

dataen overlevde skannen :!: her er ComboFix loggen

Klikk for å se/fjerne innholdet nedenfor

ComboFix 09-01-21.04 - Lordbeiken 2009-01-23 21:18:05.3 - NTFSx86

Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1044.18.3326.2098 [GMT 1:00]

Kjører fra: c:\users\TEMP\Downloads\ComboFix.exe

.

((((((((((((((((((((((((((( Filer Opprettet Fra 2008-12-23 til 2009-01-23 )))))))))))))))))))))))))))))))))

.

2009-01-23 19:19 . 2009-01-23 19:19 <DIR> d-------- c:\users\TEMP\AppData\Roaming\Malwarebytes

2009-01-23 19:00 . 2009-01-23 19:00 <DIR> dr------- c:\users\TEMP\Searches

2009-01-23 19:00 . 2009-01-23 19:00 <DIR> dr------- c:\users\TEMP\Contacts

2009-01-23 18:59 . 2009-01-23 19:00 <DIR> dr------- c:\users\TEMP\Videos

2009-01-23 18:59 . 2009-01-23 19:00 <DIR> dr------- c:\users\TEMP\Saved Games

2009-01-23 18:59 . 2009-01-23 19:00 <DIR> dr------- c:\users\TEMP\Pictures

2009-01-23 18:59 . 2009-01-23 19:00 <DIR> dr------- c:\users\TEMP\Music

2009-01-23 18:59 . 2009-01-23 19:00 <DIR> dr------- c:\users\TEMP\Links

2009-01-23 18:59 . 2009-01-23 21:17 <DIR> dr------- c:\users\TEMP\Downloads

2009-01-23 18:59 . 2009-01-23 19:00 <DIR> dr------- c:\users\TEMP\Documents

2009-01-23 18:59 . 2006-11-02 13:37 <DIR> d-------- c:\users\TEMP\AppData\Roaming\Media Center Programs

2009-01-23 18:59 . 2009-01-23 19:00 <DIR> d--h----- c:\users\TEMP\AppData

2009-01-23 18:59 . 2009-01-23 19:00 <DIR> d-------- c:\users\TEMP

2009-01-23 18:58 . 2009-01-23 18:59 292,701,422 --a------ c:\windows\MEMORY.DMP

2009-01-23 17:52 . 2009-01-23 17:52 <DIR> d-------- c:\users\Gjest\AppData\Roaming\Skype

2009-01-23 14:30 . 2009-01-23 14:30 <DIR> d-------- c:\users\All Users\SUPERAntiSpyware.com

2009-01-23 14:30 . 2009-01-23 14:30 <DIR> d-------- c:\programdata\SUPERAntiSpyware.com

2009-01-23 14:30 . 2009-01-23 14:30 <DIR> d-------- c:\program files\SUPERAntiSpyware

2009-01-23 14:24 . 2008-04-17 13:12 107,368 --a------ c:\windows\System32\GEARAspi.dll

2009-01-23 14:24 . 2008-04-17 13:12 15,464 --a------ c:\windows\System32\drivers\GEARAspiWDM.sys

2009-01-23 14:23 . 2009-01-23 14:24 <DIR> d-------- c:\users\All Users\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}

2009-01-23 14:23 . 2009-01-23 14:24 <DIR> d-------- c:\programdata\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}

2009-01-23 14:23 . 2009-01-23 14:24 <DIR> d-------- c:\program files\iTunes

2009-01-23 14:23 . 2009-01-23 14:23 <DIR> d-------- c:\program files\iPod

2009-01-23 14:23 . 2009-01-23 14:23 <DIR> d-------- c:\program files\Bonjour

2009-01-23 14:22 . 2009-01-23 14:23 <DIR> d-------- c:\program files\Common Files\Apple

2009-01-23 14:20 . 2009-01-23 14:20 <DIR> d-------- c:\users\All Users\Malwarebytes

2009-01-23 14:20 . 2009-01-23 14:23 <DIR> d-------- c:\users\All Users\Apple Computer

2009-01-23 14:20 . 2009-01-23 14:20 <DIR> d-------- c:\programdata\Malwarebytes

2009-01-23 14:20 . 2009-01-23 14:23 <DIR> d-------- c:\programdata\Apple Computer

2009-01-23 14:20 . 2009-01-23 14:20 <DIR> d-------- c:\program files\QuickTime

2009-01-23 14:20 . 2009-01-23 14:20 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware

2009-01-23 14:20 . 2009-01-14 16:11 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys

2009-01-23 14:20 . 2009-01-14 16:11 15,504 --a------ c:\windows\System32\drivers\mbam.sys

2009-01-22 23:25 . 2009-01-22 23:25 <DIR> d-------- c:\program files\Trend Micro

2009-01-22 16:11 . 2009-01-22 16:11 <DIR> d-------- c:\program files\CCleaner

2009-01-22 16:02 . 2009-01-23 19:21 <DIR> d-------- c:\users\All Users\2131496019

2009-01-22 16:02 . 2009-01-23 19:21 <DIR> d-------- c:\programdata\2131496019

2009-01-21 23:35 . 2009-01-21 23:35 <DIR> d-------- c:\users\All Users\33E7

2009-01-21 23:35 . 2009-01-21 23:35 <DIR> d-------- c:\programdata\33E7

2009-01-21 17:07 . 2009-01-21 17:07 <DIR> d-------- c:\users\All Users\12303

2009-01-21 17:07 . 2009-01-21 17:07 <DIR> d-------- c:\programdata\12303

2009-01-21 16:47 . 2009-01-21 16:47 <DIR> d-------- c:\users\All Users\18B3

2009-01-21 16:47 . 2009-01-21 16:47 <DIR> d-------- c:\programdata\18B3

2009-01-21 00:25 . 2009-01-21 00:25 <DIR> d-------- c:\users\All Users\331A6

2009-01-21 00:25 . 2009-01-21 00:25 <DIR> d-------- c:\programdata\331A6

2009-01-21 00:24 . 2009-01-21 00:24 <DIR> d-------- c:\users\All Users\121D4

2009-01-21 00:24 . 2009-01-21 00:24 <DIR> d-------- c:\programdata\121D4

2009-01-19 19:03 . 2009-01-19 19:03 <DIR> d-------- c:\program files\Ventrilo

2009-01-19 19:03 . 2009-01-19 19:03 262 --a------ c:\windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini

2009-01-19 19:02 . 2009-01-23 14:30 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard

2009-01-17 13:22 . 2009-01-17 13:22 <DIR> d-------- c:\users\All Users\Avira

2009-01-17 13:22 . 2009-01-17 13:22 <DIR> d-------- c:\programdata\Avira

2009-01-17 13:22 . 2009-01-17 13:22 <DIR> d-------- c:\program files\Avira

2009-01-13 21:23 . 2008-09-17 23:55 1,108,512 --a------ c:\windows\System32\nvcpluir.dll

2009-01-13 21:01 . 2008-12-16 03:42 288,768 --a------ c:\windows\System32\drivers\srv.sys

2009-01-10 18:39 . 2009-01-10 18:39 107,888 --a------ c:\windows\System32\CmdLineExt.dll

2009-01-05 16:18 . 2009-01-05 16:18 90,112 --a------ c:\windows\System32\QuickTimeVR.qtx

2009-01-05 16:18 . 2009-01-05 16:18 57,344 --a------ c:\windows\System32\QuickTime.qts

.

(((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-01-23 19:39 --------- d-----w c:\program files\Steam

2009-01-23 13:34 --------- d-----w c:\program files\BearShare Applications

2009-01-17 12:23 --------- d-----w c:\program files\Common Files\Steam

2009-01-17 11:42 --------- d-----w c:\program files\Google

2009-01-13 22:12 --------- d-----w c:\programdata\NVIDIA

2009-01-13 20:12 --------- d-----w c:\program files\Windows Mail

2009-01-10 18:00 --------- d--h--w c:\program files\InstallShield Installation Information

2009-01-10 17:47 --------- d-----w c:\programdata\Electronic Arts

2009-01-06 22:42 --------- d-----w c:\program files\Electronic Arts

2008-12-20 14:23 --------- d-----w c:\program files\CabalOnline

2008-12-18 13:05 --------- d-----w c:\programdata\Sports Interactive

2008-12-14 22:33 --------- d-----w c:\program files\GameSpy Arcade

2008-12-14 12:05 410,984 ----a-w c:\windows\System32\deploytk.dll

2008-12-14 12:05 --------- d-----w c:\program files\Java

2008-12-13 16:09 --------- d-----w c:\programdata\PopCap Games

2008-12-13 16:08 --------- d-----w c:\programdata\Steam

2008-12-13 02:03 --------- d-----w c:\programdata\Microsoft Help

2008-12-11 20:37 42,320 ----a-w c:\windows\System32\xfcodec.dll

2008-12-09 18:24 --------- d-----w c:\program files\Alwil Software

2008-12-09 18:10 --------- d-----w c:\programdata\avg8

2008-12-06 16:59 --------- d-----w c:\program files\Belkin CorporationBelkin

2008-11-28 17:34 --------- d-----w c:\program files\Games-Masters.com

2008-11-28 16:56 --------- d-----w c:\programdata\NOS

2008-11-28 16:56 --------- d-----w c:\program files\NOS

2008-11-26 22:21 --------- d-----w c:\program files\Common Files\Adobe AIR

2008-11-26 22:20 --------- d-----w c:\program files\Common Files\Adobe

2008-11-01 03:44 541,696 ----a-w c:\windows\AppPatch\AcLayers.dll

2008-11-01 03:44 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll

2008-11-01 03:44 460,288 ----a-w c:\windows\AppPatch\AcSpecfc.dll

2008-11-01 03:44 28,672 ----a-w c:\windows\System32\Apphlpdm.dll

2008-11-01 03:44 2,154,496 ----a-w c:\windows\AppPatch\AcGenral.dll

2008-11-01 03:44 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll

2008-11-01 01:21 4,240,384 ----a-w c:\windows\System32\GameUXLegacyGDFs.dll

2008-10-29 06:29 2,927,104 ----a-w c:\windows\explorer.exe

2008-07-15 15:40 951 ----a-w c:\program files\Get OpenOffice.org.lnk

2008-07-14 16:10 56 ---ha-w c:\users\All Users\ezsidmv.dat

2008-07-14 16:10 56 ---ha-w c:\programdata\ezsidmv.dat

2008-01-21 02:43 174 --sha-w c:\program files\desktop.ini

2009-01-11 21:25 122,880 ----a-w c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll

.

((((((((((((((((((((((((((((( snapshot_2009-01-23_18.56.08,75 )))))))))))))))))))))))))))))))))))))))))

.

- 2009-01-23 17:25:08 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat

+ 2009-01-23 17:59:12 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat

- 2009-01-23 17:25:08 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat

+ 2009-01-23 17:59:12 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat

- 2009-01-23 17:26:30 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT

+ 2009-01-23 18:01:05 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT

+ 2009-01-23 18:01:05 262,144 ---ha-w c:\windows\ServiceProfiles\LocalService\ntuser.dat.LOG1

- 2009-01-23 17:55:50 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT

+ 2009-01-23 20:19:11 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT

+ 2009-01-23 20:19:11 262,144 ---ha-w c:\windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1

- 2009-01-23 17:27:14 49,152 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

+ 2009-01-23 18:34:09 49,152 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

- 2009-01-23 17:27:14 2,080,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

+ 2009-01-23 18:34:09 2,080,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

- 2009-01-23 17:27:14 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

+ 2009-01-23 18:34:09 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

- 2009-01-23 17:30:13 101,052 ----a-w c:\windows\System32\perfc009.dat

+ 2009-01-23 18:04:58 101,052 ----a-w c:\windows\System32\perfc009.dat

- 2009-01-23 17:30:13 76,272 ----a-w c:\windows\System32\perfc014.dat

+ 2009-01-23 18:04:58 76,272 ----a-w c:\windows\System32\perfc014.dat

- 2009-01-23 17:30:13 586,980 ----a-w c:\windows\System32\perfh009.dat

+ 2009-01-23 18:04:58 586,980 ----a-w c:\windows\System32\perfh009.dat

- 2009-01-23 17:30:13 452,088 ----a-w c:\windows\System32\perfh014.dat

+ 2009-01-23 18:04:58 452,088 ----a-w c:\windows\System32\perfh014.dat

- 2009-01-23 17:27:23 6,630 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3313641878-1417431046-2429296989-1000_UserData.bin

+ 2009-01-23 18:01:24 6,646 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3313641878-1417431046-2429296989-1000_UserData.bin

- 2009-01-23 17:27:23 82,536 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin

+ 2009-01-23 18:01:24 82,750 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin

.

(((((((((((((((((((((((((((((((( Oppstartspunkter I Registeret )))))))))))))))))))))))))))))))))))))))))))))

.

*Merk* tomme oppføringer & gyldige standardoppføringer vises ikke

REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{74322BF9-DF26-493f-B0DA-6D2FC5E6429E}]

2008-09-02 15:05 398776 --a------ c:\program files\BearShare Applications\BearShare MediaBar\BearShareIEHelper.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]

"WindowsWelcomeCenter"="oobefldr.dll" [2008-01-21 c:\windows\System32\oobefldr.dll]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-06-16 81920]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-14 136600]

"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-10-19 185872]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]

"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2009-01-11 30192]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-17 13580832]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-17 92704]

"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088]

"RtHDVCpl"="RtHDVCpl.exe" [2007-08-09 c:\windows\RtHDVCpl.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=G

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"VIDC.XFR1"= xfcodec.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]

"{BBF4D8AF-831D-462E-9233-175C1DFA7F29}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote

"{2EAD67E1-76E3-4E02-951B-5D88E2ACA5DB}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote

"TCP Query User{4C88D6F4-327E-439E-807F-C7A0E5AAA79B}c:\\program files\\steam\\steamapps\\lordbeiken\\counter-strike source\\hl2.exe"= UDP:c:\program files\steam\steamapps\lordbeiken\counter-strike source\hl2.exe:hl2

"UDP Query User{EA177C2D-0CF0-4C65-A2AC-8873C812FE8A}c:\\program files\\steam\\steamapps\\lordbeiken\\counter-strike source\\hl2.exe"= TCP:c:\program files\steam\steamapps\lordbeiken\counter-strike source\hl2.exe:hl2

"{75FC5B14-F89B-438F-A7EF-F05AC54535A0}"= Disabled:UDP:c:\windows\Installer\{048298C9-A4D3-490B-9FF9-AB023A9238F3}\Icon048298C91.exe:Icon048298C91

"{03F545CA-FEC3-41BC-A76B-D3D1FE0B65F0}"= Disabled:TCP:c:\windows\Installer\{048298C9-A4D3-490B-9FF9-AB023A9238F3}\Icon048298C91.exe:Icon048298C91

"TCP Query User{0F21EA0A-705B-4AA6-B6DD-F81C70B4CA3D}c:\\program files\\steam\\steamapps\\lordbeiken\\source dedicated server\\srcds.exe"= UDP:c:\program files\steam\steamapps\lordbeiken\source dedicated server\srcds.exe:srcds

"UDP Query User{71746B54-8AA0-44CF-9AF4-A20A3621E521}c:\\program files\\steam\\steamapps\\lordbeiken\\source dedicated server\\srcds.exe"= TCP:c:\program files\steam\steamapps\lordbeiken\source dedicated server\srcds.exe:srcds

"TCP Query User{2F128A8C-8DE8-4C60-87F6-8B892C5155C2}c:\\program files\\steam\\steamapps\\lordbeiken\\source 2007 dedicated server\\srcds.exe"= UDP:c:\program files\steam\steamapps\lordbeiken\source 2007 dedicated server\srcds.exe:srcds

"UDP Query User{4F08A351-36CC-4CB2-9171-FB06FEEA370F}c:\\program files\\steam\\steamapps\\lordbeiken\\source 2007 dedicated server\\srcds.exe"= TCP:c:\program files\steam\steamapps\lordbeiken\source 2007 dedicated server\srcds.exe:srcds

"TCP Query User{0200E0AB-F10B-402D-BB27-B47FDB486C8C}c:\\program files\\limewire\\limewire.exe"= UDP:c:\program files\limewire\limewire.exe:LimeWire

"UDP Query User{0050D2D8-48A6-4999-A68F-1A3C06E40D7B}c:\\program files\\limewire\\limewire.exe"= TCP:c:\program files\limewire\limewire.exe:LimeWire

"TCP Query User{FDDA0775-D226-49F2-B003-6566E2A27386}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer

"UDP Query User{8FD632A2-C7EA-4079-B55E-F96F5D904EFC}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer

"TCP Query User{BB8022AE-29F4-4871-8227-1B140C160354}c:\\program files\\thq\\titan quest\\titan quest.exe"= UDP:c:\program files\thq\titan quest\titan quest.exe:Titan Quest

"UDP Query User{AC6D2B88-FE3E-4E70-AB25-BF39F5B38D9E}c:\\program files\\thq\\titan quest\\titan quest.exe"= TCP:c:\program files\thq\titan quest\titan quest.exe:Titan Quest

"TCP Query User{E2B62790-715C-46D3-A405-E61B279C97F3}c:\\program files\\electronic arts\\eadm\\core.exe"= UDP:c:\program files\electronic arts\eadm\core.exe:EA Download Manager

"UDP Query User{6B53FE3D-414F-4C6C-A4DC-AD15B9FE8B57}c:\\program files\\electronic arts\\eadm\\core.exe"= TCP:c:\program files\electronic arts\eadm\core.exe:EA Download Manager

"TCP Query User{21A3F195-1ACB-4211-99C3-73B8986A8376}c:\\program files\\real\\realplayer\\realplay.exe"= UDP:c:\program files\real\realplayer\realplay.exe:RealPlayer

"UDP Query User{AFF33EA2-B6B7-4A5C-8F2D-EE8D61552F91}c:\\program files\\real\\realplayer\\realplay.exe"= TCP:c:\program files\real\realplayer\realplay.exe:RealPlayer

"TCP Query User{BE9E5D94-3A3C-4969-81BE-E3DF39848EDE}c:\\program files\\electronic arts\\eadm\\core.exe"= UDP:c:\program files\electronic arts\eadm\core.exe:EA Download Manager

"UDP Query User{AD1CB6B5-B98C-45A7-96CD-CB385CBDAAE3}c:\\program files\\electronic arts\\eadm\\core.exe"= TCP:c:\program files\electronic arts\eadm\core.exe:EA Download Manager

"TCP Query User{5AA2CF25-9509-4989-8C46-F138D11054F5}c:\\program files\\real\\realplayer\\recordingmanager.exe"= UDP:c:\program files\real\realplayer\recordingmanager.exe:RealNetworks Download and Record Manager

"UDP Query User{052BC555-9AAB-43B3-8CE7-187779CA6570}c:\\program files\\real\\realplayer\\recordingmanager.exe"= TCP:c:\program files\real\realplayer\recordingmanager.exe:RealNetworks Download and Record Manager

"{1E69F73A-3067-4B5C-A7F9-7ADA161DBBA6}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)

"{D140331C-5C26-4870-A67C-3C1327E0880E}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)

"{C7DC6BEE-FD81-4F8D-A8E4-FFA48357EEA4}"= UDP:c:\program files\Electronic Arts\The Battle for Middle-earth II\game.dat:The Battle for Middle-earth II

"{38D5D627-DB03-44E6-99A7-0DFC470D7A2E}"= TCP:c:\program files\Electronic Arts\The Battle for Middle-earth II\game.dat:The Battle for Middle-earth II

"{7C908BC8-79BC-4630-A9FF-626BDB1C0D4A}"= c:\program files\Skype\Phone\Skype.exe:Skype

"TCP Query User{58DE634F-2972-41AC-86C1-71B9C1532500}c:\\program files\\steam\\steamapps\\common\\left 4 dead demo\\srcds.exe"= UDP:c:\program files\steam\steamapps\common\left 4 dead demo\srcds.exe:srcds

"UDP Query User{F205E688-5491-4D43-A627-1E1039B2D7EF}c:\\program files\\steam\\steamapps\\common\\left 4 dead demo\\srcds.exe"= TCP:c:\program files\steam\steamapps\common\left 4 dead demo\srcds.exe:srcds

"TCP Query User{7ADFD4AE-E2ED-43EB-B06C-61F0E8F61C56}c:\\program files\\xfire\\xfire.exe"= UDP:c:\program files\xfire\xfire.exe:Xfire

"UDP Query User{C80AE4DD-731C-4FEB-A018-A9ECE7DC80B1}c:\\program files\\xfire\\xfire.exe"= TCP:c:\program files\xfire\xfire.exe:Xfire

"TCP Query User{6BFFB302-EBD3-496E-9197-DA8C43F4282D}c:\\users\\lordbeiken\\downloads\\cabaltemp\\estsetuploader.exe"= UDP:c:\users\lordbeiken\downloads\cabaltemp\estsetuploader.exe:estsetuploader.exe

"UDP Query User{584B2871-7886-4D39-B749-7CBC92BFAF15}c:\\users\\lordbeiken\\downloads\\cabaltemp\\estsetuploader.exe"= TCP:c:\users\lordbeiken\downloads\cabaltemp\estsetuploader.exe:estsetuploader.exe

"TCP Query User{02B6EFD3-2E96-41F8-8EE0-87191DF1A5E9}c:\\program files\\games-masters.com\\cabal online (europe)\\launcher\\update\\estdnheadless.exe"= UDP:c:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe:EST! download engine

"UDP Query User{AB40FF91-92C0-4546-8E7A-7A9D5555F29D}c:\\program files\\games-masters.com\\cabal online (europe)\\launcher\\update\\estdnheadless.exe"= TCP:c:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe:EST! download engine

"TCP Query User{3313528A-9823-47C2-81FC-822D93D11D2D}c:\\users\\lordbeiken\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\u0vtse2h\\cabaltemp\\estsetuploader.exe"= UDP:c:\users\lordbeiken\appdata\local\microsoft\windows\temporary internet files\content.ie5\u0vtse2h\cabaltemp\estsetuploader.exe:estsetuploader.exe

"UDP Query User{788E6DC4-ED5B-45CF-9412-86557924E280}c:\\users\\lordbeiken\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\u0vtse2h\\cabaltemp\\estsetuploader.exe"= TCP:c:\users\lordbeiken\appdata\local\microsoft\windows\temporary internet files\content.ie5\u0vtse2h\cabaltemp\estsetuploader.exe:estsetuploader.exe

"TCP Query User{DDD3B1EC-2D96-44E9-B030-071F054D969D}c:\\users\\lordbeiken\\desktop\\launcher65\\launcher\\update\\estdnheadless.exe"= UDP:c:\users\lordbeiken\desktop\launcher65\launcher\update\estdnheadless.exe:estdnheadless.exe

"UDP Query User{6F56B63E-294A-4F58-830E-5F54FA435BBE}c:\\users\\lordbeiken\\desktop\\launcher65\\launcher\\update\\estdnheadless.exe"= TCP:c:\users\lordbeiken\desktop\launcher65\launcher\update\estdnheadless.exe:estdnheadless.exe

"TCP Query User{DD097A5D-1BB9-4906-9703-CED946727F7A}c:\\users\\lordbeiken\\desktop\\launcher656\\launcher\\update\\estdnheadless.exe"= UDP:c:\users\lordbeiken\desktop\launcher656\launcher\update\estdnheadless.exe:estdnheadless.exe

"UDP Query User{58C89BF8-1340-47F3-BABA-5EE0AAFE1A74}c:\\users\\lordbeiken\\desktop\\launcher656\\launcher\\update\\estdnheadless.exe"= TCP:c:\users\lordbeiken\desktop\launcher656\launcher\update\estdnheadless.exe:estdnheadless.exe

"TCP Query User{704DC3F7-8CAB-4917-AB12-FB5E5E2CC27C}c:\\users\\lordbeiken\\appdata\\local\\temp\\launcher65\\launcher\\update\\estdnheadless.exe"= UDP:c:\users\lordbeiken\appdata\local\temp\launcher65\launcher\update\estdnheadless.exe:estdnheadless.exe

"UDP Query User{4C0B62EC-DF86-444F-AA12-3EFB3C65013C}c:\\users\\lordbeiken\\appdata\\local\\temp\\launcher65\\launcher\\update\\estdnheadless.exe"= TCP:c:\users\lordbeiken\appdata\local\temp\launcher65\launcher\update\estdnheadless.exe:estdnheadless.exe

"TCP Query User{991E154D-7E33-4400-9E33-286D0C4D3572}c:\\users\\lordbeiken\\desktop\\launcher\\update\\estdnheadless.exe"= UDP:c:\users\lordbeiken\desktop\launcher\update\estdnheadless.exe:estdnheadless.exe

"UDP Query User{43119E78-FC12-4D28-B03C-8EEB22AC449F}c:\\users\\lordbeiken\\desktop\\launcher\\update\\estdnheadless.exe"= TCP:c:\users\lordbeiken\desktop\launcher\update\estdnheadless.exe:estdnheadless.exe

"TCP Query User{CC0A6D1A-6069-48B0-91F0-5229DCFE6E04}c:\\program files\\steam\\steamapps\\wannabegamer93\\counter-strike source\\hl2.exe"= UDP:c:\program files\steam\steamapps\wannabegamer93\counter-strike source\hl2.exe:hl2

"UDP Query User{69768982-EAFE-4024-B63F-68C6B3C9792F}c:\\program files\\steam\\steamapps\\wannabegamer93\\counter-strike source\\hl2.exe"= TCP:c:\program files\steam\steamapps\wannabegamer93\counter-strike source\hl2.exe:hl2

"TCP Query User{41984F4A-9404-4C96-BE10-D03EA9A72A22}c:\\program files\\games-masters.com\\cabal online (europe)\\launcher\\update\\estdnheadless.exe"= UDP:c:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe:EST! download engine

"UDP Query User{7F7664D9-55F3-43DD-8836-1C1D3EF53BCE}c:\\program files\\games-masters.com\\cabal online (europe)\\launcher\\update\\estdnheadless.exe"= TCP:c:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe:EST! download engine

"{83EC3D9D-D8A0-4342-8E88-AED7B55E6BAC}"= UDP:c:\program files\Games-Masters.com\CABAL Online (Europe)\cabal.exe:Cabal

"{08F55FAE-09E1-4220-B12C-1A139009380E}"= TCP:c:\program files\Games-Masters.com\CABAL Online (Europe)\cabal.exe:Cabal

"{C3FF65F8-A3E9-484E-B5FA-28715568F41F}"= UDP:c:\program files\Alwil Software\Avast4\ashAvast.exe:avast! Antivirus

"{7FBEC108-BC44-4200-84AA-427E63904528}"= TCP:c:\program files\Alwil Software\Avast4\ashAvast.exe:avast! Antivirus

"TCP Query User{76744178-77B5-4176-AA03-E5EA526DCDE9}c:\\program files\\steam\\steamapps\\lordbeiken\\counter-strike source\\hl2.exe"= UDP:c:\program files\steam\steamapps\lordbeiken\counter-strike source\hl2.exe:hl2

"UDP Query User{91C854BD-6C31-4121-B806-1C2F9714A153}c:\\program files\\steam\\steamapps\\lordbeiken\\counter-strike source\\hl2.exe"= TCP:c:\program files\steam\steamapps\lordbeiken\counter-strike source\hl2.exe:hl2

"TCP Query User{2E1F5903-2FCA-45A2-8651-95844A0FCC8D}c:\\program files\\steam\\steamapps\\lordbeiken\\team fortress 2\\hl2.exe"= UDP:c:\program files\steam\steamapps\lordbeiken\team fortress 2\hl2.exe:hl2

"UDP Query User{4A01CCB1-F6A7-4FBA-9AF1-E4A68A948F27}c:\\program files\\steam\\steamapps\\lordbeiken\\team fortress 2\\hl2.exe"= TCP:c:\program files\steam\steamapps\lordbeiken\team fortress 2\hl2.exe:hl2

"TCP Query User{5F511399-C687-4CB2-8A67-00480535CCC6}c:\\program files\\steam\\steamapps\\lordbeiken\\day of defeat source beta\\hl2.exe"= UDP:c:\program files\steam\steamapps\lordbeiken\day of defeat source beta\hl2.exe:hl2

"UDP Query User{6DAA1B8A-4F7A-4F47-A7E0-3BE84B693D3D}c:\\program files\\steam\\steamapps\\lordbeiken\\day of defeat source beta\\hl2.exe"= TCP:c:\program files\steam\steamapps\lordbeiken\day of defeat source beta\hl2.exe:hl2

"TCP Query User{05A167A3-34D3-4A8C-8CB5-33A7052784F9}c:\\program files\\steam\\steamapps\\lordbeiken\\day of defeat source\\hl2.exe"= UDP:c:\program files\steam\steamapps\lordbeiken\day of defeat source\hl2.exe:hl2

"UDP Query User{C0E413F3-228F-47AC-B943-8F6586C2CE4E}c:\\program files\\steam\\steamapps\\lordbeiken\\day of defeat source\\hl2.exe"= TCP:c:\program files\steam\steamapps\lordbeiken\day of defeat source\hl2.exe:hl2

"TCP Query User{53931830-EE6C-4122-9B21-204457B7AB8A}c:\\program files\\steam\\steamapps\\mxxxh\\half-life 2 deathmatch\\hl2.exe"= UDP:c:\program files\steam\steamapps\mxxxh\half-life 2 deathmatch\hl2.exe:hl2

"UDP Query User{8BD0D7D9-848D-4D11-BB73-1826E51B8F40}c:\\program files\\steam\\steamapps\\mxxxh\\half-life 2 deathmatch\\hl2.exe"= TCP:c:\program files\steam\steamapps\mxxxh\half-life 2 deathmatch\hl2.exe:hl2

"TCP Query User{9717DEE4-D013-49A5-A483-918DD741053F}c:\\program files\\steam\\steamapps\\mxxxh\\counter-strike source\\hl2.exe"= UDP:c:\program files\steam\steamapps\mxxxh\counter-strike source\hl2.exe:hl2

"UDP Query User{53053BFA-F073-4612-91D7-7968FE6A312F}c:\\program files\\steam\\steamapps\\mxxxh\\counter-strike source\\hl2.exe"= TCP:c:\program files\steam\steamapps\mxxxh\counter-strike source\hl2.exe:hl2

"TCP Query User{D485A25A-1153-4BD5-A4F8-4C708D908271}c:\\program files\\steam\\steamapps\\mxxxh\\age of chivalry\\hl2.exe"= UDP:c:\program files\steam\steamapps\mxxxh\age of chivalry\hl2.exe:hl2

"UDP Query User{375CB536-CE18-4878-AC4D-E1401B0BF5C1}c:\\program files\\steam\\steamapps\\mxxxh\\age of chivalry\\hl2.exe"= TCP:c:\program files\steam\steamapps\mxxxh\age of chivalry\hl2.exe:hl2

"TCP Query User{8195E510-1599-4873-A5DC-757128ACA08E}c:\\program files\\steam\\steamapps\\mxxxh\\diprip warm up\\hl2.exe"= UDP:c:\program files\steam\steamapps\mxxxh\diprip warm up\hl2.exe:hl2

"UDP Query User{5577658A-A45A-4F8A-A8EB-9B6A88991670}c:\\program files\\steam\\steamapps\\mxxxh\\diprip warm up\\hl2.exe"= TCP:c:\program files\steam\steamapps\mxxxh\diprip warm up\hl2.exe:hl2

"TCP Query User{B55B4997-C975-46B9-826E-B687E1630BF9}c:\\program files\\steam\\steamapps\\wannabegamer93\\team fortress 2\\hl2.exe"= UDP:c:\program files\steam\steamapps\wannabegamer93\team fortress 2\hl2.exe:hl2

"UDP Query User{C90F7FC7-4C2A-4E5E-9C3F-FAF6C9904D2D}c:\\program files\\steam\\steamapps\\wannabegamer93\\team fortress 2\\hl2.exe"= TCP:c:\program files\steam\steamapps\wannabegamer93\team fortress 2\hl2.exe:hl2

"TCP Query User{48AAC2CD-7FAF-4175-A54F-780F83F21917}c:\\program files\\steam\\steamapps\\wannabegamer93\\counter-strike source\\hl2.exe"= UDP:c:\program files\steam\steamapps\wannabegamer93\counter-strike source\hl2.exe:hl2

"UDP Query User{CD6068A1-E2CD-4DFC-A00D-94D75BECFDC0}c:\\program files\\steam\\steamapps\\wannabegamer93\\counter-strike source\\hl2.exe"= TCP:c:\program files\steam\steamapps\wannabegamer93\counter-strike source\hl2.exe:hl2

"TCP Query User{78B2FB5E-AD00-4C75-917E-021FF7B2471F}c:\\program files\\steam\\steamapps\\wannabegamer93\\zombie panic! source\\hl2.exe"= UDP:c:\program files\steam\steamapps\wannabegamer93\zombie panic! source\hl2.exe:hl2

"UDP Query User{5210465A-AA8D-49C9-84FF-2D2057EF3B88}c:\\program files\\steam\\steamapps\\wannabegamer93\\zombie panic! source\\hl2.exe"= TCP:c:\program files\steam\steamapps\wannabegamer93\zombie panic! source\hl2.exe:hl2

"TCP Query User{A875F87F-0551-455E-849D-68FAB12D2920}c:\\program files\\steam\\steamapps\\wannabegamer93\\insurgency\\hl2.exe"= UDP:c:\program files\steam\steamapps\wannabegamer93\insurgency\hl2.exe:hl2

"UDP Query User{8A25E5E7-0C5A-4D36-B389-C480B56061C2}c:\\program files\\steam\\steamapps\\wannabegamer93\\insurgency\\hl2.exe"= TCP:c:\program files\steam\steamapps\wannabegamer93\insurgency\hl2.exe:hl2

"TCP Query User{C197BC38-21E1-43EB-AA40-608573B3D3ED}c:\\program files\\steam\\steamapps\\wannabegamer93\\age of chivalry\\hl2.exe"= UDP:c:\program files\steam\steamapps\wannabegamer93\age of chivalry\hl2.exe:hl2

"UDP Query User{62350548-489E-401E-8DC0-59AA0CC643A9}c:\\program files\\steam\\steamapps\\wannabegamer93\\age of chivalry\\hl2.exe"= TCP:c:\program files\steam\steamapps\wannabegamer93\age of chivalry\hl2.exe:hl2

"TCP Query User{C3D4D934-3AB3-4FAB-A8C8-7154281E1D1B}c:\\program files\\steam\\steamapps\\wannabegamer93\\team fortress 2\\hl2.exe"= UDP:c:\program files\steam\steamapps\wannabegamer93\team fortress 2\hl2.exe:hl2

"UDP Query User{FFAF9A4E-6009-413B-8D41-640D493224B9}c:\\program files\\steam\\steamapps\\wannabegamer93\\team fortress 2\\hl2.exe"= TCP:c:\program files\steam\steamapps\wannabegamer93\team fortress 2\hl2.exe:hl2

"{21A3C14D-254D-4DB5-A5D3-89701FA358A8}"= UDP:c:\program files\Steam\Steam.exe:Steam

"{9B8B1CD5-F1DF-4014-B9A7-ED5E57F54841}"= TCP:c:\program files\Steam\Steam.exe:Steam

"{FC1A0108-F49E-47A4-B122-B2B2D3E30DCF}"= UDP:c:\program files\GameSpy Arcade\Aphex.exe:GameSpy Arcade

"{23DA6A04-5D68-4D53-89BE-C514A6C324EF}"= TCP:c:\program files\GameSpy Arcade\Aphex.exe:GameSpy Arcade

"{8573BA2B-84DE-4BE5-88B8-D4CC45795B99}"= UDP:c:\program files\BearShare Applications\BearShare\BearShare.exe:BearShare

"{656EE746-BAC2-478F-811D-09F231D56B50}"= TCP:c:\program files\BearShare Applications\BearShare\BearShare.exe:BearShare

"TCP Query User{425E2529-C4E6-4CF9-AE37-4377DEA6E795}c:\\program files\\steam\\steamapps\\common\\left 4 dead\\left4dead.exe"= UDP:c:\program files\steam\steamapps\common\left 4 dead\left4dead.exe:left4dead

"UDP Query User{67AB0A08-5E6F-4F1D-9DF5-4D9F770D5103}c:\\program files\\steam\\steamapps\\common\\left 4 dead\\left4dead.exe"= TCP:c:\program files\steam\steamapps\common\left 4 dead\left4dead.exe:left4dead

"TCP Query User{D15CD420-5D90-43F7-924D-5CB571A6FC98}c:\\program files\\steam\\steamapps\\wannabegamer93\\source dedicated server\\srcds.exe"= UDP:c:\program files\steam\steamapps\wannabegamer93\source dedicated server\srcds.exe:srcds

"UDP Query User{8A19AB44-A321-46F1-AF8F-851299659A3D}c:\\program files\\steam\\steamapps\\wannabegamer93\\source dedicated server\\srcds.exe"= TCP:c:\program files\steam\steamapps\wannabegamer93\source dedicated server\srcds.exe:srcds

"{38E7FBC8-3975-4B4E-A39F-244178183055}"= UDP:c:\program files\Ventrilo\Ventrilo.exe:Ventrilo.exe

"{02C53056-FD95-4A11-BB28-35C16F003F69}"= TCP:c:\program files\Ventrilo\Ventrilo.exe:Ventrilo.exe

"{9A8DCF6A-A00A-4FC1-9EC6-2B6F5820475D}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour

"{A020DA6E-C5AC-4DE8-957E-5AFCE41DEED1}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour

"{54E21049-4EBB-45AF-A7DE-EF3A1CA3950F}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes

"{1F524092-8D94-4C6F-BE73-D4A9A6C45CCC}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2009-01-15 8944]

R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2009-01-15 55024]

R3 F5D5055;Belkin F5D5055 Gigabit USB 2.0 Network Adapter;c:\windows\System32\drivers\F5D5055.sys [2008-12-06 30336]

S3 GoogleDesktopManager-092308-165331;Google Desktop Manager 5.8.809.23506;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2009-01-11 30192]

S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-01-15 7408]

.

Innholdet i mappen 'Scheduled Tasks' (planlagte oppgaver)

2009-01-22 c:\windows\Tasks\At1.job