elikkä miten saan poistettua sysprot.exe tiedoston. Norman ei löydä koko virusta mutta netissä sanotaan että se on jonkunlainen vakoiluohjelma joka käynnistyy kun tietokoneen avaa. prosessin pystyy lopettamaan, ei aiheuta mitään erikoista, ainakaan vielä
http://www.bleepingcomputer.com/startups/sysprot.exe-14040.html
käyttöjärjestelmänä vista
http://www.bleepingcomputer.com/startups/sysprot.exe-14040.html
käyttöjärjestelmänä vista
Vastaukset 7
Vanhimmat
Lataa Malwarebytes' Anti-Malware työpöydällesi.
http://www.besttechie.net/tools/mbam-setup.exe
• Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
• Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes' Anti-Malware ja Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaa Finish.
• Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
• Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
• Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
• Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
• Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
• Lähetä lokin sisältö seuraavassa viestissäsi.
en tiiä onko oikea mut tää aukes tarkistuksen jälkeen
Malwarebytes' Anti-Malware 1.21
Database version: 971
Windows 6.0.6001 Service Pack 1
18:01:27 21.7.2008
mbam-log-7-21-2008 (18-01-27).txt
Scan type: Full Scan (C:\|E:\|)
Objects scanned: 159970
Time elapsed: 1 hour(s), 20 minute(s), 40 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\Users\jani\AppData\Local\Temp\avi3.112.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\sari\AppData\Roaming\addon.dat (Malware.Trace) -> Delete on reboot.
tässä tällanen loki, jos jotain apua
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:26:44, on 21.7.2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Norman\Npm\Bin\Zlh.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Mozilla Firefox\xpicleanup.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Norman\Nvc\BIN\NIP.EXE
C:\Program Files\Norman\Nvc\bin\cclaw.exe
C:\Windows\system32\sysprot.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\HJT\skanneri.exe.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fi.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Users\jani\Desktop\ohjelmat\BitComet\tools\BitCometBHO_1.2.1.2.dll
O2 - BHO: Burn4Free Toolbar Helper - {60BF5EE3-0105-4858-AD98-17C19F86B042} - C:\Program Files\Burn4Free Toolbar\v3.2.0.0\Burn4Free_Toolbar.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Burn4Free Toolbar - {55FAF0F2-44D4-425F-B5F5-6B275B621EAB} - C:\Program Files\Burn4Free Toolbar\v3.2.0.0\Burn4Free_Toolbar.dll (file missing)
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
O3 - Toolbar: MSN-työkalurivi - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.2607.0\fi\msntb.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Norman ZANDA] "C:\Program Files\Norman\Npm\bin\ZLH.EXE" /LOAD /SPLASH
O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Snapfire\Corel Photo Downloader.exe
O4 - HKLM\..\Run: [sysprot] sysprot.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"
O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"
O4 - HKLM\..\Run: [PPort11reminder] "C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\ProgramData\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini
O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\RunServices: [sysprot] sysprot.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Users\jani\Desktop\ohjelmat\Uusi kansio\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\RunOnce: [mozilla_cleanup] C:\Program Files\Mozilla Firefox\xpicleanup.exe
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [IETI] C:\Program Files\Skype\Phone\IEPlugin\unins000.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [IETI] C:\Program Files\Skype\Phone\IEPlugin\unins000.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART (User 'Default user')
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Users\jani\Desktop\ohjelmat\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Users\jani\Desktop\ohjelmat\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Users\jani\Desktop\ohjelmat\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Users\jani\Desktop\ohjelmat\BitComet\tools\BitCometBHO_1.2.1.2.dll/206 (file missing)
O13 - Gopher Prefix:
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Users\jani\Desktop\ohjelmat\Ares\chatServer.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Autodata Limited License Service - Autodata Limited - C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - C:\Program Files\Norman\Npm\bin\ELOGSVC.EXE
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Norman NJeeves - Norman ASA - C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Norman ASA - C:\Program Files\Norman\Npm\Bin\Zanda.exe
O23 - Service: Norman Scanner Engine Service (nsesvc) - Norman ASA - C:\Program Files\Norman\nse\bin\NSESVC.EXE
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Program Files\Norman\Nvc\bin\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - C:\Program Files\Norman\Nvc\BIN\NVCSCHED.EXE
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Fujitsu Siemens Computers Diagnostic Testhandler (TestHandler) - Fujitsu Siemens Computers - C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe
--
End of file - 8639 bytes
1.Lataa combofix.exe työpöydällesi yhdestä, kahdesta klinkistä:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe
2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
oli vähän ongelmia saada loki näkymään ku ekalla kerralla ei antanu mitään tekstiä. sellasta ihmettelin tossa että mikähän toi yks "virus" oli minkä norman löytää heti ku käynnistää combofixin, tiedostonimi on joku eicar - this is not a virus
mutta tässä se loki
ComboFix 08-07-21.2 - sari 2008-07-22 16:15:10.2 - NTFSx86
Microsoft® Windows Vista™ Home Basic 6.0.6001.1.1252.1.1035.18.157 [GMT 3:00]
Running from: C:\Users\jani\Desktop\torrent - kuvakkeet\ComboFix.exe
* Resident AV is active
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-06-22 to 2008-07-22 )))))))))))))))))
.
2008-07-21 18:23 . 2008-07-21 20:02 d-------- C:\HJT
2008-07-21 16:22 . 2008-07-21 16:22 d-------- C:\Users\jani\AppData\Roaming\Malwarebytes
2008-07-20 18:20 . 2008-07-20 18:20 d-------- C:\Users\sari\AppData\Roaming\Malwarebytes
2008-07-20 18:20 . 2008-07-20 18:20 d-------- C:\Users\All Users\Malwarebytes
2008-07-20 18:20 . 2008-07-20 18:20 d-------- C:\ProgramData\Malwarebytes
2008-07-20 18:20 . 2008-07-18 19:15 36,472 --a------ C:\Windows\System32\drivers\mbamswissarmy.sys
2008-07-20 18:20 . 2008-07-18 19:15 17,144 --a------ C:\Windows\System32\drivers\mbam.sys
2008-07-18 10:24 . 2008-06-26 04:45 12,240,896 --a------ C:\Windows\System32\NlsLexicons0007.dll
2008-07-18 10:24 . 2008-06-26 04:45 2,644,480 --a------ C:\Windows\System32\NlsLexicons0009.dll
2008-07-18 10:24 . 2008-06-26 06:29 801,280 --a------ C:\Windows\System32\NaturalLanguage6.dll
2008-07-05 15:05 . 2008-07-05 15:05 0 --ah----- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2008-07-03 11:08 . 2008-07-03 11:08 d-------- C:\PerfLogs
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-22 12:42 --------- d-----w C:\Program Files\Norman
2008-07-21 19:28 --------- d-----w C:\Users\sari\AppData\Roaming\DNA
2008-07-21 19:19 1,474 ----a-w C:\Users\sari\AppData\Roaming\wklnhst.dat
2008-07-21 17:20 --------- d-----w C:\Program Files\Java
2008-07-21 13:28 --------- d-----w C:\Program Files\AdVantage
2008-07-20 17:41 --------- d-----w C:\Users\sari\AppData\Roaming\OpenOffice.org2
2008-07-19 12:23 --------- d-----w C:\Users\jani\AppData\Roaming\BitTorrent
2008-07-19 06:44 --------- d-----w C:\Users\jani\AppData\Roaming\OpenOffice.org2
2008-07-18 18:51 --------- d-----w C:\Users\sari\AppData\Roaming\Skype
2008-07-14 13:52 --------- d-----w C:\Program Files\Ajokorttikoulu
2008-07-13 18:50 2,588 ----a-w C:\Users\jani\AppData\Roaming\wklnhst.dat
2008-07-12 11:51 --------- d-----w C:\Users\sari\AppData\Roaming\LimeWire
2008-07-09 09:45 --------- d-----w C:\Program Files\Windows Mail
2008-07-03 08:19 174 --sha-w C:\Program Files\desktop.ini
2008-07-03 08:09 --------- d-----w C:\Program Files\Windows Sidebar
2008-07-03 08:09 --------- d-----w C:\Program Files\Windows Photo Gallery
2008-07-03 08:09 --------- d-----w C:\Program Files\Windows Defender
2008-07-03 08:09 --------- d-----w C:\Program Files\Windows Collaboration
2008-07-03 08:09 --------- d-----w C:\Program Files\Windows Calendar
2008-07-03 07:52 82,432 ----a-w C:\Windows\System32\axaltocm.dll
2008-07-03 07:52 101,888 ----a-w C:\Windows\System32\ifxcardm.dll
2008-06-25 11:41 --------- d-----w C:\Users\jani\AppData\Roaming\Corel
2008-06-23 10:14 --------- d-----w C:\Program Files\DivX
2008-06-22 17:19 --------- d-----w C:\Users\sari\AppData\Roaming\BitTorrent
2008-06-14 11:33 --------- d-----w C:\Program Files\Opera
2008-06-14 10:18 --------- d-----w C:\ProgramData\Test Drive Unlimited
2008-06-12 19:03 --------- d-----w C:\Program Files\7-Zip
2008-05-31 14:19 --------- d-----w C:\ProgramData\FLEXnet
2008-05-31 14:14 --------- d-----w C:\Program Files\Common Files\Adobe
2008-05-31 14:14 --------- d-----w C:\Program Files\Bonjour
2008-05-31 14:02 --------- d-----w C:\Program Files\Common Files\Macrovision Shared
2008-05-30 23:22 823,296 ----a-w C:\Windows\System32\divx_xx0c.dll
2008-05-30 23:22 823,296 ----a-w C:\Windows\System32\divx_xx07.dll
2008-05-30 23:22 815,104 ----a-w C:\Windows\System32\divx_xx0a.dll
2008-05-30 23:22 802,816 ----a-w C:\Windows\System32\divx_xx11.dll
2008-05-30 23:22 683,520 ----a-w C:\Windows\System32\DivX.dll
2008-05-30 23:22 593,920 ----a-w C:\Windows\System32\dpuGUI11.dll
2008-05-30 23:22 57,344 ----a-w C:\Windows\System32\dpv11.dll
2008-05-30 23:22 53,248 ----a-w C:\Windows\System32\dpuGUI10.dll
2008-05-30 23:22 344,064 ----a-w C:\Windows\System32\dpus11.dll
2008-05-30 23:22 294,912 ----a-w C:\Windows\System32\dpu11.dll
2008-05-30 23:22 294,912 ----a-w C:\Windows\System32\dpu10.dll
2008-05-30 12:47 --------- d-----w C:\Program Files\Google
2008-05-30 09:46 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-30 09:46 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-05-30 09:33 --------- d-----w C:\Program Files\Common Files\Corel
2008-05-25 08:16 --------- d---a-w C:\ProgramData\TEMP
2008-05-22 22:22 524,288 ----a-w C:\Windows\System32\DivXsm.exe
2008-05-22 22:22 3,596,288 ----a-w C:\Windows\System32\qt-dx331.dll
2008-05-22 22:20 200,704 ----a-w C:\Windows\System32\ssldivx.dll
2008-05-22 22:20 1,044,480 ----a-w C:\Windows\System32\libdivx.dll
2008-05-22 22:19 81,920 ----a-w C:\Windows\System32\dpl100.dll
2008-05-22 22:19 196,608 ----a-w C:\Windows\System32\dtu100.dll
2008-05-22 22:19 161,096 ----a-w C:\Windows\System32\DivXCodecVersionChecker.exe
2008-05-22 22:18 12,288 ----a-w C:\Windows\System32\DivXWMPExtType.dll
2008-05-10 03:35 564,736 ----a-w C:\Windows\System32\emdmgmt.dll
2008-05-08 21:59 90,112 ----a-w C:\Windows\System32\wshext.dll
2008-05-08 21:59 430,080 ----a-w C:\Windows\System32\vbscript.dll
2008-05-08 21:59 180,224 ----a-w C:\Windows\System32\scrobj.dll
2008-05-08 21:59 172,032 ----a-w C:\Windows\System32\scrrun.dll
2008-05-08 21:59 155,648 ----a-w C:\Windows\System32\wscript.exe
2008-05-08 21:58 135,168 ----a-w C:\Windows\System32\cscript.exe
2008-04-26 08:25 3,600,952 ----a-w C:\Windows\System32\ntkrnlpa.exe
2008-04-26 08:25 3,549,240 ----a-w C:\Windows\System32\ntoskrnl.exe
2008-04-26 08:08 1,314,816 ----a-w C:\Windows\System32\quartz.dll
2008-04-25 04:35 826,880 ----a-w C:\Windows\System32\wininet.dll
2007-06-10 13:43 88 --sha-r C:\Windows\System32\2745A9569A.sys
2007-12-27 11:25 3,350 --sha-w C:\Windows\System32\KGyGaAvL.sys
2006-11-02 09:45 1,147,904 --sh--r C:\Windows\System32\sysprot.exe
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 10:33 1233920]
"BitTorrent DNA"="C:\Users\sari\Program Files\DNA\btdna.exe" [2008-05-08 18:16 289088]
"DAEMON Tools Lite"="C:\Users\jani\Desktop\ohjelmat\DAEMON Tools Lite\daemon.exe" [2008-02-14 02:09 486856]
"AdobeUpdater"="C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-02-28 23:06 2321600]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 10:33 202240]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-07-12 04:12 90112]
"Norman ZANDA"="C:\Program Files\Norman\Npm\bin\ZLH.EXE" [2008-06-02 14:46 273520]
"Corel Photo Downloader"="C:\Program Files\Corel\Corel Snapfire\Corel Photo Downloader.exe" [2006-08-04 11:00 462336]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 15:10 271360]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 10:03 210472]
"PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" [2007-01-29 22:12 30248]
"IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [2007-01-29 22:10 46632]
"PPort11reminder"="C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-02-01 14:46 255528]
"BrMfcWnd"="C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe" [2007-03-12 15:51 663552]
"ControlCenter3"="C:\Program Files\Brother\ControlCenter3\brctrcen.exe" [2007-01-26 16:58 65536]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"RtHDVCpl"="RtHDVCpl.exe" [2006-12-29 13:11 4317184 C:\Windows\RtHDVCpl.exe]
"sysprot"="sysprot.exe" [2006-11-02 12:45 1147904 C:\Windows\System32\sysprot.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"sysprot"="sysprot.exe" [2006-11-02 12:45 1147904 C:\Windows\System32\sysprot.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 10:17 1241088]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"IETI"="C:\Program Files\Skype\Phone\IEPlugin\unins000.exe" [BU]
C:\Users\sari\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
wkcalrem.LNK - C:\Program Files\Common Files\microsoft shared\Works Shared\WkCalRem.exe [2005-08-19 07:14:28 21504]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.IV41"= ir41_32.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-624926054-705826413-1190659251-1000]
"EnableNotificationsRef"=dword:00000003
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{CD5E41DC-59A6-4BBF-BFA0-85AE14452F12}"= C:\Program Files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"TCP Query User{E4FF19A5-F629-426A-889D-B5C7988ED40B}C:\\program files\\skype\\phone\\skype.exe"= UDP:C:\program files\skype\phone\skype.exe:Skype. The whole world can talk for free.
"UDP Query User{DDCF41EE-D964-4D23-B3FF-1FE82DDC3D50}C:\\program files\\skype\\phone\\skype.exe"= TCP:C:\program files\skype\phone\skype.exe:Skype. The whole world can talk for free.
"{3AA877A8-10EB-4DC6-994F-4CC23E2210CA}"= UDP:10152:BitComet 10152 TCP
"{8891A7E2-FEE6-41E9-BC5B-0CBE81E9611B}"= TCP:10152:BitComet 10152 UDP
"TCP Query User{F7C0EFFE-4C62-4D73-AEE9-BEBF53C7732E}C:\\program files\\bitcomet\\bitcomet.exe"= UDP:C:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"UDP Query User{BC3EA63D-E28A-43EF-BB8B-833F57632DF2}C:\\program files\\bitcomet\\bitcomet.exe"= TCP:C:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"{3E774ABE-2A8C-412E-9A0E-F33625D6B0EA}"= UDP:C:\Program Files\uTorrent\utorrent.exe:µTorrent
"{DFF73DC9-9D1C-4748-B3A1-1949EA92A1D7}"= TCP:C:\Program Files\uTorrent\utorrent.exe:µTorrent
"TCP Query User{C8ADF3BC-6191-4A60-9667-B9D2F5B0EE04}C:\\users\\jani\\desktop\\ohjelmat\\ares\\ares.exe"= UDP:C:\users\jani\desktop\ohjelmat\ares\ares.exe:ares.exe
"UDP Query User{2CF628FB-C389-4191-99C2-8599307454AA}C:\\users\\jani\\desktop\\ohjelmat\\ares\\ares.exe"= TCP:C:\users\jani\desktop\ohjelmat\ares\ares.exe:ares.exe
"TCP Query User{75F7FE2A-EE2E-4A15-8A33-5F362C80A527}C:\\users\\jani\\desktop\\[ pc games ] - age of empires ii(full)\\empires2.exe"= UDP:C:\users\jani\desktop\[ pc games ] - age of empires ii(full)\empires2.exe:empires2.exe
"UDP Query User{025DD092-669F-45D2-AA86-FCA06C0DA415}C:\\users\\jani\\desktop\\[ pc games ] - age of empires ii(full)\\empires2.exe"= TCP:C:\users\jani\desktop\[ pc games ] - age of empires ii(full)\empires2.exe:empires2.exe
"TCP Query User{6711AB3D-A589-4565-B73B-62F74F29F6EE}F:\\[ pc games ] - age of empires ii(full)\\age2_x1.exe"= UDP:F:\[ pc games ] - age of empires ii(full)\age2_x1.exe:Age of Empires II Expansion
"UDP Query User{8A8D687C-3642-4C8A-9186-BA9272FCC657}F:\\[ pc games ] - age of empires ii(full)\\age2_x1.exe"= TCP:F:\[ pc games ] - age of empires ii(full)\age2_x1.exe:Age of Empires II Expansion
"TCP Query User{5F1465CA-A160-40FB-919F-4C6BE1997DA8}C:\\users\\jani\\desktop\\[ pc games ] - age of empires ii(full)\\age2_x1.exe"= UDP:C:\users\jani\desktop\[ pc games ] - age of empires ii(full)\age2_x1.exe:age2_x1.exe
"UDP Query User{2FAE43D9-C858-477E-8705-A04643A81BA6}C:\\users\\jani\\desktop\\[ pc games ] - age of empires ii(full)\\age2_x1.exe"= TCP:C:\users\jani\desktop\[ pc games ] - age of empires ii(full)\age2_x1.exe:age2_x1.exe
"TCP Query User{24D3268E-DAB8-4B76-8157-3F4A95ACFA5E}C:\\users\\jani\\desktop\\bearflix.exe"= UDP:C:\users\jani\desktop\bearflix.exe:bearflix.exe
"UDP Query User{007E9383-C360-470F-88F1-5A169E627757}C:\\users\\jani\\desktop\\bearflix.exe"= TCP:C:\users\jani\desktop\bearflix.exe:bearflix.exe
"TCP Query User{A323C8F0-9E01-4415-B30A-A8C823DBED0C}C:\\users\\jani\\desktop\\bear flix\\bearflix.exe"= UDP:C:\users\jani\desktop\bear flix\bearflix.exe:bearflix.exe
"UDP Query User{528B7EB3-E559-4643-BAF6-E702A789EA3E}C:\\users\\jani\\desktop\\bear flix\\bearflix.exe"= TCP:C:\users\jani\desktop\bear flix\bearflix.exe:bearflix.exe
"TCP Query User{4AF9EF7A-202D-4FEE-9D21-0694BBCE17C0}C:\\program files\\sierra\\empire earth ii\\ee2.exe"= UDP:C:\program files\sierra\empire earth ii\ee2.exe:Empire Earth II
"UDP Query User{C9B19AF0-C06C-4FCC-8A9F-31CE7BEE6B31}C:\\program files\\sierra\\empire earth ii\\ee2.exe"= TCP:C:\program files\sierra\empire earth ii\ee2.exe:Empire Earth II
"TCP Query User{AC0EB14A-401A-4743-B461-392EC68412CA}C:\\users\\sari\\appdata\\local\\temp\\nero web\\setupxu.exe"= UDP:C:\users\sari\appdata\local\temp\nero web\setupxu.exe:setupxu.exe
"UDP Query User{37614BF2-F1E0-4A9E-9D17-5BB79E93AA3A}C:\\users\\sari\\appdata\\local\\temp\\nero web\\setupxu.exe"= TCP:C:\users\sari\appdata\local\temp\nero web\setupxu.exe:setupxu.exe
"{CB0BE933-0AAE-4462-AE03-7BD6EF87345C}"= C:\Program Files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{074AB40D-BF35-4EA6-947F-83D4BB21E906}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.5
"{33FD0BAA-DBA1-4421-8C4A-F08995DA42D8}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.5
"{AE2276DA-3874-446A-BC71-39DFC5D3ECCD}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.5
"{5D4503EC-C124-4CEA-A193-967FF8A54BBD}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.5
"TCP Query User{5461294D-74EE-4AEA-A8BB-FE6FB16BBD81}C:\\program files\\azureus\\azureus.exe"= UDP:C:\program files\azureus\azureus.exe:Azureus
"UDP Query User{9740FFA7-7508-431A-B3E2-1C3282227A6C}C:\\program files\\azureus\\azureus.exe"= TCP:C:\program files\azureus\azureus.exe:Azureus
"{A530869E-61E2-409F-B291-C65A66684333}"= UDP:C:\Program Files\BitTorrent_DNA\dna.exe:BitTorrent DNA
"{70C9C38F-B026-41F1-9BD4-06842196B49F}"= TCP:C:\Program Files\BitTorrent_DNA\dna.exe:BitTorrent DNA
"{F9E472B0-7464-486A-AC54-861BE7E9687D}"= UDP:C:\Program Files\BitTorrent\bittorrent.exe:BitTorrent
"{AEEA4941-1B4E-4F13-9F8C-CE5A57A6E173}"= TCP:C:\Program Files\BitTorrent\bittorrent.exe:BitTorrent
"TCP Query User{5D2C1578-8D84-4D51-A380-E914E82470DB}C:\\users\\jani\\program files\\bittorrent\\bittorrent.exe"= UDP:C:\users\jani\program files\bittorrent\bittorrent.exe:bittorrent.exe
"UDP Query User{964EEC3F-F75B-4D04-9A25-E66063B16F61}C:\\users\\jani\\program files\\bittorrent\\bittorrent.exe"= TCP:C:\users\jani\program files\bittorrent\bittorrent.exe:bittorrent.exe
"TCP Query User{CBF59C7C-8CA8-4023-91ED-F416256B35F2}C:\\program files\\limewire\\limewire.exe"= UDP:C:\program files\limewire\limewire.exe:LimeWire
"UDP Query User{234488FD-ACEC-488D-9DD1-20F41D3C772C}C:\\program files\\limewire\\limewire.exe"= TCP:C:\program files\limewire\limewire.exe:LimeWire
"TCP Query User{0F085F04-6C47-421F-85AE-351B0ABA743A}C:\\program files\\nokia\\nokia software updater\\nsu_ui_client.exe"= UDP:C:\program files\nokia\nokia software updater\nsu_ui_client.exe:Nokia Software Updater
"UDP Query User{3E70737E-99C1-4E93-8B7E-5F4BBAE9E30D}C:\\program files\\nokia\\nokia software updater\\nsu_ui_client.exe"= TCP:C:\program files\nokia\nokia software updater\nsu_ui_client.exe:Nokia Software Updater
"TCP Query User{3D245DAC-A7E3-4D44-8C7E-659A1149256F}C:\\program files\\common files\\nokia\\service layer\\a\\nsl_host_process.exe"= UDP:C:\program files\common files\nokia\service layer\a\nsl_host_process.exe:Nokia Service Layer Host Process
"UDP Query User{F0BA2CF9-514D-4498-B472-24DC8EB059BC}C:\\program files\\common files\\nokia\\service layer\\a\\nsl_host_process.exe"= TCP:C:\program files\common files\nokia\service layer\a\nsl_host_process.exe:Nokia Service Layer Host Process
"{B59C5017-FBCA-468F-8AD9-8BEF1FE2CD57}"= UDP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb
"{A497593C-131E-49EE-91D4-0E8E82DA25D8}"= TCP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb
"{09CE39E8-2935-4F56-A524-80125339AC92}"= UDP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray
"{17C561F0-6F81-4152-8497-8BA3B479A34B}"= TCP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray
"{AE7D7FE0-22C0-43D9-A181-706F7A303D9E}"= UDP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client
"{44CBF595-315B-4A7E-B8C9-20C1FBCF8EA3}"= TCP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client
"TCP Query User{7AA67694-2222-490C-A57E-0C220B009434}C:\\users\\jani\\desktop\\ohjelmat\\bitcomet\\bitcomet.exe"= UDP:C:\users\jani\desktop\ohjelmat\bitcomet\bitcomet.exe:bitcomet.exe
"UDP Query User{A30D4EE4-FFA9-4F8C-B346-CB5FCE67DFAB}C:\\users\\jani\\desktop\\ohjelmat\\bitcomet\\bitcomet.exe"= TCP:C:\users\jani\desktop\ohjelmat\bitcomet\bitcomet.exe:bitcomet.exe
"{075D12F9-4ACD-4695-B218-53D3F4A7F55E}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"C:\\Program Files\\BitTorrent\\bittorrent.exe"= C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent
R2 Ndiskio;Ndiskio;C:\Program Files\Norman\Nse\bin\NDISKIO.SYS [2007-01-02 10:55]
R2 TestHandler;Fujitsu Siemens Computers Diagnostic Testhandler;C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe [2006-11-15 03:07]
R3 NvcMFlt;NvcMFlt;C:\Windows\system32\DRIVERS\nvcv32mf.sys [2008-02-11 15:56]
R3 nvcoas;Norman Virus Control on-access component;C:\Program Files\Norman\Nvc\bin\nvcoas.exe [2008-04-29 10:58]
R3 NVCScheduler;Norman Virus Control Scheduler;C:\Program Files\Norman\Nvc\BIN\NVCSCHED.EXE [2008-03-11 15:00]
S3 MBAMSwissArmy;MBAMSwissArmy;C:\Windows\system32\drivers\mbamswissarmy.sys [2008-07-18 19:15]
S3 nvcfsr;nvcfsr;C:\Program Files\Norman\Nvc\bin\nvcfsr.sys [2007-01-09 15:25]
S3 nvcoafl4;nvcoafl4;C:\Program Files\Norman\Nvc\bin\nvcoafl4.sys [2007-01-09 15:25]
S3 nvcoaft4;nvcoaft4;C:\Program Files\Norman\Nvc\bin\nvcoaft4.sys [2007-01-09 15:25]
S3 nvcoarc4;nvcoarc4;C:\Program Files\Norman\Nvc\bin\nvcoarc4.sys [2007-01-09 15:25]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d955348f-f7b8-11db-9d87-001a923e710c}]
\shell\AutoRun\command - D:\Launcher.exe
.
- - - - ORPHANS REMOVED - - - -
WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
HKCU-Run-System Services Monitor - C:\Users\sari\AppData\Roaming\server.exe
HKCU-Run-{4B4FB127-2B56-223E-5663-08E09B00592A} - C:\Users\sari\AppData\Roaming\server.exe
.
------- Supplementary Scan -------
.
R1 -: HKCU-Internet Settings,ProxyOverride = *.local
O8 -: &D&ownload &with BitComet - C:\Users\jani\Desktop\ohjelmat\BitComet\BitComet.exe/AddLink.htm
O8 -: &D&ownload all video with BitComet - C:\Users\jani\Desktop\ohjelmat\BitComet\BitComet.exe/AddVideo.htm
O8 -: &D&ownload all with BitComet - C:\Users\jani\Desktop\ohjelmat\BitComet\BitComet.exe/AddAllLink.htm
O9 -: {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Users\jani\Desktop\ohjelmat\BitComet\tools\BitCometBHO_1.2.1.2.dll/206
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-22 16:21:30
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-07-22 16:27:49
ComboFix-quarantined-files.txt 2008-07-22 13:27:27
Pre-Run: 36,472,164,352 tavua vapaana
Post-Run: 37,271,334,912 tavua vapaana
231 --- E O F --- 2008-07-18 15:54:11
Avaa Muistio ja kopioi/liitä viivojen välistä sisältö sinne:
________
File::
C:\Windows\System32\sysprot.exe
______
Tallenna se nimellä CFScript.txt
Sitten raahaa CFScript ComboFix.exeen kuten alla.
http://users.pandora.be/bluepatchy/miekiemoes/images/CFScript.gif
Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.
combofix ilmottaa: YRITITKÖ AJAA SFCSriptin. SFCSript on kirjoitettu väärin.
eli mitä toi tarkottaa? tiedoston tallensin nimellä SFCSript.txt eli se on oikein, vai tarkottaako se tiedoston sisältöä, tässä pikku pätkä sysprot.exestä kun avaa muistiossa. ja äsken kun avasin ton muistiossa nii nettiyhteys hävis kokonaan mut toisessa koneessa toimi netti, tulee samasta modeemista. nyt toimii taas ku käynnisti uudelleen
MZ ÿÿ ¸ @ à º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ ö€7²{îd²{îd²{îdÒs£d³{îd²{ïd:{îdqt³d·{îdÉgâd±{îd1gàd«{îdÝdåd¹{îdÝdädÎ{îdæXßd{îdRich²{îd PE L Å!1F à Ì 0 @ 02 †ç < Ü @ À.rsrc ì @ À.idata ì @ ÀA87Ff3 0 – î @ À ¦l9}šÞeጰ$§Ê¨v°T
ßlý Qtr 32mR’`…{`8㥡l?ä‰Á,`af0 O¼kí8ý«ŽýÝMÛðݵñI5‘³ÈF6¥ý‹$ó:ÅÅá7 tÙŠ’©Ü\5hóiš‡Ne¼èÀ"næñ)ݛτ˜×ÒË7Áe¥Êûïlኢ$s¾ÍŸÙ~œv\ýÕÒsc8í lÚc»^‡¥f”°ä]ĺܫ;xB!Qú)¤¥nù©&Ùó³±!
æ¶â8$=j½å}•³Â®Ùe½£åÛ,tjŸÈÃˇaBdÔ¦Öø¤ËJœàÚXØ2õ¶%»|å §H tEçk—9/Ø»ì-\Ï“Ë$Öá$µ3â&Ãht·"82
*‚¶]ëh~ùÒª;¢Ž`µÈÅ5ëëð}ÿ˜»¡k˜M
üƒS5_Í &w uuKµc0¤ÛµÜÐp¿á°Q0ˆÛ¹á'4Oö*¾xH}?Ûò k¯
þR»™#j½“2½â*ØÄ‚µÒóÝmÖ«üzkn9k{Zëfív8û4ÃÒwpß\ŠÈïûB…®—oäûéaBÀwÈS"mÊk’5s[bìÓqhê¢Ï 1N% ÞÝ«£4•ýÞg¹8¤l˜MKò«5µb^A%hNïÜ;9¾à@jVÔÓÍ·K]•l
˜³p ÑQ–yaµE1¦B±à>ÐþhØ5áö=€Ø¯C× 5í¸Q⩇åëè !nÂÕý˜%×à›B½cD³û{€ÝØQ¥ _X±Î˜bhRW2—¿@Å… K/¨¡UêfŠs~tÄàÆ >âME®ÿÝ' å7.júúºZ,ÁKùù2
$$űm÷ÓÂ|?åË ³`¦[äö¤y”µô‘ûnø+‡ = AUT%V#Ùùfæ;$Ùúiµœöñ¥ŸûîÛ ÍbRaVôm†±œ $¤kâš ÝÑ˩Ûç·|Ά}+#]“ƒÕ¤#%öh=Ymìw3Žà×o–g>3Œ§ùm\žÚµ Í'ucµ¹{#š©a”ûÞ¡}bð®êUæ%Ýäsý ûGfU/Y &¸Q;Co¸yƒ´4E•ñÌ^P •·õ›«Ø’™LAY,_û¡›Ð;LZ㇣íÄãy÷Å+˜(p‚"f@æU¸KñŽCmT3=ÊI>`DÛð« Õxoûj…¾{PY¿Åœ˜&WFÑØ™!èªRÕrb“G‰D•˜²„܅力¯XÕ?"ÿïUnׂ SD2æQb9K„Á»ñKÐ\Õ‘àab[9! W1^¶yº8!rÅmÍXÑ¥ ú·Ý•¡·Û,q†[
A_x£+=µ)ža!…¦¤¹ø´•–r²’4Ü5¹c¾$$A¨å‰F© ýb_ìÐyBì(b|à¬äÊÔ´¤6ßb† [šÁ;÷Ùì$!ÃzìÀTqµ,áee©8¬dª×—?HLŽ4èÈnìºÔØôè_¿Ë5\œWÕ ÃS¤ðŒ§y´7Pɥʽ‡‘âÐlöV¯‘c ÏR(ßí1¿k½¶àÄbÖI]Ò×ÿÝÉ»õ´öƒH¦ó’œž†[é´
©¦†h-ñìiú´ñžÕcç“ßôM\VšÚ¥Ø7³Õ`†# ²ûĔȻ“$ÒÙaìΘܙWˆ½\†Ut]ý`¸ç™|Ö&§»ó*«/–Cò ŽC×U™=À÷…ùM÷A7¥úah¾ÿ؃ïÕû\A“ÈÛ=’ÜXØŽ8˜¹WJÀ`ª:ÌyÇJ=‰r?è{ññØw$ÊxZ«n=ÎÙ¤“ÓEäÈ)#` %ç¥ÄU%Ù&¶çÇo†Õ—½Üèc-T”Iw™†Iû(Ëz;Gá】i„Üe`áF‚ äYÏ +í}¶È`:Jiù ‹ö{á´Óîì Çß#q4=£²`
-– ØoÐxÝßþvñ9î…§å‰xd£8pãóDØÑÒáx@Ä+ò–sûCûúÚ7,Ýjî[•BäÅr æ%müÅ/–i˜á“ôÊÀûèä—¼ÖPªg¢Æå©} ÄÆ|z¯‹ƒ
þz„¦N)KK—sí0i>ñ¸5»Ðɼ‡ÛÒÚýàÚTjTZœ ®–Ã'5…Á}Ç[½ãØ÷ÖxuÝÆ5ÝØ>ÒçTé D„!ÈA^Bj€ÍšMð¥ÇÛ/¥D×P,|±¤ÐUÔ&,˜ÏÔÎòà¬Sµÿ®e‰ô½…IE ÓW¬™yéR:@0¤¸19ÚÃ{J2ðçªO¸³{ª¢y±û`¥C¥ÊòBâWµ ÐíI»±y¸I‘Ë…›8}÷¨ÜƒQY–Í{·¼Å.…ôç¸kJ†»çØÕ@°nç ”–†ÜmmTK8Q7€ŠHjŠ®Q|«¯Q¥Ü±Ì¢‘ýÑY 9MÇG¦ú`WOx!%eÀÑC†yîJÚ?«ØŠb`¾xv›6Gž@È[‰a6AÜ ñùî«ûzöxŠY&K}FH=lSëÊÛ9c&l…’>5³#•PÍh1Ñ‘["y̙Ԃu´léqÚ¦ex´Ñ¾S1€iÚ‰„{&[¥Ø‡ë«!Qh°_`L2¬Ýw‚;—vÎ5¿*ÂèMµ>íU\8šÙ¾Z>úL$Ï9ûú; €X×›üû•»'”• =ô)Ñ™ãÙ r c‚‰ëǾy_tüÞ¡`[Ü2®é8@yNƒ}úø¥úä ÐÊ“(LçŽ ãÜ#Ûémõ!WÑAG³%JNç=qEPÚ˜r6ôèŒtm¤î¼~ÔÉã UOq V©U» °M|Í/PI¡'í”°Î4.»ñ®${Ñð4CINü ?¦5ÕlFÍŒ ô'Ÿ±/†»m%¯] a)áJô®ãk5ܸÝ\”ÆÀwc3(¾€ôžoJG„”w7¢*ãÒ+Î Lsæo öS¢
˜GŽ`N{j’lw+ìÁ-—1ÅÒ™µª¶Q!dzû$ó…\ˆVsOýÜ«È›KÜMf¦xœtûÙ¬©¼ †œSq½=0ëŸKÏÏuþÀ¶Ø«ÝÙÂêzæñ2ñqØO¤&£@=e½ç¡BÀ[-Ä“¦Ã2£ 3X g'=’Iú~®ô€IÍ•wŽô†¡'°9‰
'ˆ¦ÇëÛcÜ‹RL¾ˆïà þLc‡áxéÕÛ¨¤J+}5wÕwa³ ¡G=„`3
} ¶ž¶#Ö¢w€ã–/Uáøë%1
‚±S3ò‚ƒ&/^Ó£.†"b¤W£³©zuq³%¤‹x`[ôššã*¿‰œ‰ÛT=Q,IÖÒÔØ‘ hEãæ,Ó€¯¶*ˆ¦ëh XyúÁáõýd2‡Óꌱsû