Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz

Facebook vírus prosím pomoc

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Odpovědět
Zpráva
Autor
Uživatelský avatar
Patriciusd
Návštěvník
Návštěvník
Příspěvky: 82
Registrován: 28 úno 2011 08:59

Facebook vírus prosím pomoc

#1 Příspěvek od Patriciusd »

Dobrý večer bratovi poslala kamaratka video na Facebooku ktore nešlo. Počítač sa dal do nudzového režimu... Teraz je v normal....
Antivirus nefunguj...
Zasielam LOG z RSITU:
Prosím Vás o pomoc ďakujem.

Logfile of random's system information tool 1.09 (written by random/random)
Run by Rudo at 2011-07-25 19:14:07
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 8 GB (40%) free of 20 GB
Total RAM: 1535 MB (68% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:14:12, on 25. 7. 2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\IObit\Advanced SystemCare 4\PMonitor.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\update.tray-3-0\svchost.exe
C:\Program Files\IObit\Advanced SystemCare 4\ASCService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\sysdriver32.exe
C:\WINDOWS\update.2\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\update.2\svchost.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\Rudo\Plocha\RSIT.exe
C:\Program Files\trend micro\Rudo.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.sk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Increase performance and video formats for your HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
O2 - BHO: Use the DivX Plus Web Player to watch web videos with less interruptions and smoother playback on supported sites - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [1429766.exe] "C:\WINDOWS\TEMP\1429766.exe"
O4 - HKLM\..\Run: [46430013-loader2.exe] "C:\WINDOWS\TEMP\46430013-loader2.exe"
O4 - HKLM\..\Run: [sysdriver32.exe] "C:\WINDOWS\sysdriver32.exe" rezerv
O4 - HKLM\..\Run: [sysdriver32_.exe] "C:\WINDOWS\sysdriver32_.exe" rezerv
O4 - HKCU\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Zdroje informácií - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Advanced SystemCare Service (AdvancedSystemCareService) - IObit - C:\Program Files\IObit\Advanced SystemCare 4\ASCService.exe
O23 - Service: ESET Service (ekrn) - Unknown owner - C:\Program Files\ESET\ESET Smart Security\ekrn.exe (file missing)
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: srviecheck - Unknown owner - C:\WINDOWS\update.2\svchost.exe
O23 - Service: srvsysdriver32 - Unknown owner - C:\WINDOWS\sysdriver32.exe

--
End of file - 6285 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\ASC4_PerformanceMonitor.job

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\Rudo\Data aplikací\Mozilla\Firefox\Profiles\3556j5fn.default

prefs.js - "browser.startup.homepage" - "google.sk"
prefs.js - "extensions.enabledItems" - "{20a82645-c095-46ed-80e3-08825760534b}:1.2.1, jqs@sun.com:1.0, bkmrksync@nokia.com:1.0.0.732, {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.1.94, {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.1.94, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.17"
prefs.js - "keyword.URL" - "http://search.icq.com/search/afe_result ... r=1.1.9&q="

"{20a82645-c095-46ed-80e3-08825760534b}"=C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
"jqs@sun.com"=C:\Program Files\Java\jre6\lib\deploy\jqs\ff
"bkmrksync@nokia.com"=C:\Program Files\Nokia\Nokia PC Suite 7\bkmrksync\
"{23fcfd51-4958-4f00-80a3-ae97e717ed8b}"=C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video
"{6904342A-8307-11DF-A508-4AE2DFD72085}"=C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/ShockwavePlayer]
"Description"=Adobe Shockwave Player
"Path"=C:\WINDOWS\system32\Adobe\Director\np32dsw.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0]
"Description"=DivX Plus Web Player
"Path"=C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0]
"Description"=DivX VOD Helper Plug-in
"Path"=C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Google.com/GoogleEarthPlugin]
"Description"=Google Earth in your browser
"Path"=C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WPF,version=3.5]
"Description"=Windows Presentation Foundation plug-in for Mozilla browsers
"Path"=C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videolan.org/vlc,version=1.1.8]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files\VideoLAN\VLC\npvlc.dll

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll
nsILegitCheckPlugin.xpt
nsIQTScriptablePlugin.xpt

C:\Program Files\Mozilla Firefox\plugins\
npdeployJava1.dll
npLegitCheckPlugin.dll
nppdf32.DEU
nppdf32.dll
nppdf32.FRA
nppdf32.JPN
npqtplugin.dll
npqtplugin2.dll
npqtplugin3.dll
npqtplugin4.dll
npqtplugin5.dll
npqtplugin6.dll
npqtplugin7.dll
QuickTimePlugin.class

C:\Program Files\Mozilla Firefox\searchplugins\
atlas-sk.xml
azet-sk.xml
dunaj-sk.xml
eBay.xml
google.xml
slovnik-sk.xml
wikipedia-sk.xml
zoznam-sk.xml

C:\Documents and Settings\Rudo\Data aplikací\Mozilla\Firefox\Profiles\3556j5fn.default\extensions\
plugin2@gameplaylabs.com
{20a82645-c095-46ed-80e3-08825760534b}

C:\Documents and Settings\Rudo\Data aplikací\Mozilla\Firefox\Profiles\3556j5fn.default\searchplugins\
daemon-search.xml
icqplugin.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0347C33E-8762-4905-BF09-768834316C61}]
HP Print Enhancer - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll [2007-03-02 1298024]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{053F9267-DC04-4294-A72C-58F732D338C0}]
HP Print Clips - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll [2007-03-02 177768]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-23 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{326E768D-4182-46FD-9C16-1449A49795F4}]
DivX Plus Web Player HTML5 <video> - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll [2011-02-08 3118976]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{593DDEC6-7468-4cdd-90E1-42DADAA222E9}]
DivX HiQ - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll [2011-02-08 3118976]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-04-30 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-04-30 79648]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2008-05-16 86016]
"BluetoothAuthenticationAgent"=bthprops.cpl,,BluetoothAuthenticationAgent []
"1429766.exe"=C:\WINDOWS\TEMP\1429766.exe [2011-07-25 495616]
"46430013-loader2.exe"=C:\WINDOWS\TEMP\46430013-loader2.exe [2011-07-25 256000]
"sysdriver32.exe"=C:\WINDOWS\sysdriver32.exe [2011-07-25 256000]
"sysdriver32_.exe"=C:\WINDOWS\sysdriver32_.exe [2011-07-25 256000]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2007-04-16 577536]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-09-21 932288]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\799791.exe]
C:\WINDOWS\TEMP\799791.exe [2011-07-25 256000]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\9700361.exe]
C:\DOCUME~1\Rudo\LOCALS~1\Temp\9700361.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2007-03-11 49152]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
C:\WINDOWS\system32\NvCpl.dll [2008-05-16 13529088]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe [2010-05-14 1479680]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sysdriver32.exe]
C:\WINDOWS\sysdriver32.exe [2011-07-25 256000]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sysdriver32_.exe]
C:\WINDOWS\sysdriver32_.exe [2011-07-25 256000]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\wxpdrv]
C:\WINDOWS\services32.exe [2011-07-25 1185280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wxpdrivers]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\wxpdrivers]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableLUA"=0
"EnableSecureUIAPaths"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
"NoResolveSearch"=1
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\AntikVirtualSTB\AntikVirtualSTB.exe"="C:\Program Files\AntikVirtualSTB\AntikVirtualSTB.exe:*:Enabled:AntikVirtualSTB"
"C:\Program Files\Mozilla Firefox\firefox.exe"="C:\Program Files\Mozilla Firefox\firefox.exe:*:Disabled:Mozilla Firefox"
"C:\WINDOWS\Network Diagnostic\xpnetdiag.exe"="C:\WINDOWS\Network Diagnostic\xpnetdiag.exe:*:Disabled:@xpsp3res.dll,-20000"
"C:\totalcmd\TOTALCMD.EXE"="C:\totalcmd\TOTALCMD.EXE:*:Disabled:Total Commander 32 bit international version, file manager replacement for Windows"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\WINDOWS\services32.exe"="C:\WINDOWS\services32.exe:*:Enabled:C:\WINDOWS\services32.exe"
"C:\WINDOWS\update.1\svchost.exe"="C:\WINDOWS\update.1\svchost.exe:*:Enabled:C:\WINDOWS\update.1\svchost.exe"
"C:\WINDOWS\update.tray-3-0\svchost.exe"="C:\WINDOWS\update.tray-3-0\svchost.exe:*:Enabled:C:\WINDOWS\update.tray-3-0\svchost.exe"
"C:\WINDOWS\update.2\svchost.exe"="C:\WINDOWS\update.2\svchost.exe:*:Enabled:C:\WINDOWS\update.2\svchost.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"VIDC.FPS1"=frapsvid.dll
"vidc.VP60"=C:\WINDOWS\system32\vp6vfw.dll
"vidc.VP61"=C:\WINDOWS\system32\vp6vfw.dll
"vidc.DIVX"=DivX.dll
"vidc.yv12"=DivX.dll
"VIDC.MPG4"=mpg4c32.dll
"VIDC.MP42"=mpg4c32.dll

======List of files/folders created in the last 1 month======

2011-07-25 19:12:51 ----HD---- C:\WINDOWS\update.2
2011-07-25 19:11:49 ----A---- C:\WINDOWS\unrar.exe
2011-07-25 19:06:53 ----A---- C:\WINDOWS\iplist.txt
2011-07-25 19:05:56 ----A---- C:\WINDOWS\sysdriver32_.exe
2011-07-25 19:05:41 ----A---- C:\WINDOWS\sysdriver32.exe
2011-07-25 19:05:24 ----A---- C:\WINDOWS\front_ip_list.txt
2011-07-25 19:05:19 ----D---- C:\WINDOWS\av_ico
2011-07-25 18:59:46 ----HD---- C:\WINDOWS\update.1
2011-07-25 18:59:31 ----HD---- C:\WINDOWS\update.tray-3-0-lnk
2011-07-25 18:59:31 ----HD---- C:\WINDOWS\update.tray-3-0
2011-07-25 10:44:27 ----D---- C:\Program Files\CCleaner
2011-07-25 10:05:41 ----A---- C:\WINDOWS\winlog-ids.txt
2011-07-25 10:05:41 ----A---- C:\WINDOWS\winlog-dirs.txt
2011-07-25 10:05:33 ----A---- C:\WINDOWS\services32.exe
2011-07-12 22:19:45 ----HDC---- C:\WINDOWS\$NtUninstallKB2507938$
2011-07-12 22:17:16 ----HDC---- C:\WINDOWS\$NtUninstallKB2555917$
2011-07-12 20:29:48 ----A---- C:\WINDOWS\{2158ED55-19D1-4C0C-B213-5EFF748248AC}_WiseFW.ini
2011-07-12 18:56:38 ----D---- C:\Documents and Settings\Rudo\Data aplikací\Salling Software AB
2011-07-12 18:56:36 ----A---- C:\WINDOWS\eSellerateEngine.dll
2011-07-12 14:01:02 ----D---- C:\Documents and Settings\Rudo\Data aplikací\GetRightToGo
2011-07-12 08:48:50 ----D---- C:\Documents and Settings\All Users\Data aplikací\SRS Labs
2011-07-11 19:16:18 ----HDC---- C:\WINDOWS\$NtUninstallKB2492386$
2011-07-11 19:12:50 ----D---- C:\WINDOWS\system32\WindowsPowerShell
2011-07-11 19:12:43 ----D---- C:\WINDOWS\system32\winrm
2011-07-11 19:12:43 ----D---- C:\WINDOWS\system32\GroupPolicy
2011-07-11 19:12:22 ----HDC---- C:\WINDOWS\$968930Uinstall_KB968930$
2011-07-11 19:12:20 ----D---- C:\WINDOWS\$NtUninstallKB968930$
2011-07-11 19:11:34 ----HDC---- C:\WINDOWS\$NtUninstallKB971513$
2011-07-11 19:11:06 ----HDC---- C:\WINDOWS\$NtUninstallbasecsp$
2011-07-11 18:52:34 ----D---- C:\Documents and Settings\All Users\Data aplikací\IObit
2011-07-11 18:50:49 ----D---- C:\Documents and Settings\Rudo\Data aplikací\IObit
2011-07-11 09:19:50 ----A---- C:\WINDOWS\v34peformatei.dll
2011-07-11 09:19:50 ----A---- C:\WINDOWS\eithirtyfour.dll
2011-07-11 09:19:48 ----A---- C:\WINDOWS\tellei34.sys
2011-07-11 09:19:48 ----A---- C:\WINDOWS\system32\sysaddei34.dll
2011-07-08 16:01:51 ----N---- C:\WINDOWS\system32\pxwma.dll
2011-07-08 16:01:44 ----D---- C:\Documents and Settings\Rudo\Data aplikací\Winamp
2011-07-08 16:01:44 ----D---- C:\Documents and Settings\Rudo\Data aplikací\OpenCandy
2011-07-07 20:40:06 ----A---- C:\ntuser.dat
2011-07-07 16:05:38 ----A---- C:\WINDOWS\system32\pokec.txt
2011-06-29 08:40:31 ----HDC---- C:\WINDOWS\$NtUninstallKB2541763$

======List of files/folders modified in the last 1 month======

2011-07-25 19:14:08 ----D---- C:\Program Files\trend micro
2011-07-25 19:13:30 ----D---- C:\WINDOWS\Temp
2011-07-25 19:13:11 ----D---- C:\WINDOWS\system32\drivers\etc
2011-07-25 19:12:51 ----D---- C:\WINDOWS
2011-07-25 19:05:07 ----N---- C:\WINDOWS\SchedLgU.Txt
2011-07-25 19:04:04 ----A---- C:\boot.ini
2011-07-25 17:55:48 ----D---- C:\Documents and Settings\Rudo\Data aplikací\Skype
2011-07-25 11:14:14 ----D---- C:\Program Files\Google
2011-07-25 11:13:45 ----SD---- C:\WINDOWS\Tasks
2011-07-25 11:13:43 ----SHD---- C:\WINDOWS\Installer
2011-07-25 11:00:07 ----D---- C:\WINDOWS\Prefetch
2011-07-25 10:44:27 ----RD---- C:\Program Files
2011-07-24 16:18:45 ----D---- C:\Documents and Settings\Rudo\Data aplikací\InstallShield
2011-07-24 11:05:10 ----A---- C:\WINDOWS\NeroDigital.ini
2011-07-23 10:51:01 ----D---- C:\Program Files\Nokia
2011-07-23 10:50:58 ----HD---- C:\Program Files\InstallShield Installation Information
2011-07-22 10:34:22 ----D---- C:\WINDOWS\system32\drivers
2011-07-22 10:34:22 ----AD---- C:\WINDOWS\system32
2011-07-19 16:56:37 ----D---- C:\WINDOWS\Debug
2011-07-12 22:19:49 ----HD---- C:\WINDOWS\inf
2011-07-12 22:19:47 ----RSHDC---- C:\WINDOWS\system32\dllcache
2011-07-12 22:17:28 ----A---- C:\WINDOWS\system32\MRT.exe
2011-07-12 20:31:09 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2011-07-12 20:30:38 ----HD---- C:\WINDOWS\$hf_mig$
2011-07-12 20:30:16 ----D---- C:\WINDOWS\system32\CatRoot2
2011-07-12 20:30:14 ----D---- C:\Config.Msi
2011-07-12 16:09:07 ----A---- C:\WINDOWS\win.ini
2011-07-12 16:09:07 ----A---- C:\WINDOWS\system.ini
2011-07-12 15:50:53 ----D---- C:\Program Files\IObit
2011-07-12 10:12:17 ----D---- C:\rsit
2011-07-12 10:10:45 ----D---- C:\Program Files\Mozilla Firefox
2011-07-11 19:32:18 ----D---- C:\WINDOWS\system32\config
2011-07-11 19:32:14 ----D---- C:\WINDOWS\AppPatch
2011-07-11 19:31:27 ----D---- C:\WINDOWS\security
2011-07-11 19:18:16 ----RSD---- C:\WINDOWS\assembly
2011-07-11 19:18:16 ----D---- C:\WINDOWS\Microsoft.NET
2011-07-11 19:13:14 ----D---- C:\WINDOWS\Help
2011-07-11 19:12:44 ----D---- C:\WINDOWS\system32\wbem
2011-07-11 17:56:58 ----A---- C:\WINDOWS\iltwain.ini
2011-07-08 16:05:03 ----D---- C:\WINDOWS\system
2011-07-08 16:03:02 ----D---- C:\Program Files\Winamp
2011-07-07 20:38:11 ----D---- C:\Documents and Settings\Rudo\Data aplikací\DAEMON Tools Lite
2011-07-07 16:33:53 ----D---- C:\Documents and Settings\Rudo\Data aplikací\AbsoluteTelnet
2011-07-07 13:27:41 ----RD---- C:\Program Files\Skype
2011-07-07 13:27:40 ----D---- C:\Documents and Settings\All Users\Data aplikací\Skype
2011-07-07 13:27:34 ----D---- C:\Program Files\Common Files
2011-07-07 12:07:20 ----D---- C:\Documents and Settings\Rudo\Data aplikací\skypePM
2011-07-04 15:51:38 ----D---- C:\WINDOWS\system32\CatRoot
2011-06-28 12:29:42 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2011-06-28 12:29:08 ----D---- C:\WINDOWS\WinSxS

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 agp440;Filtr Intel sběrnice AGP; C:\WINDOWS\system32\DRIVERS\agp440.sys [2008-04-14 42368]
R0 BtHidBus;Bluetooth HID Bus Service; C:\WINDOWS\System32\Drivers\BtHidBus.sys [2010-04-06 20104]
R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2010-07-12 45648]
R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2010-08-09 691696]
R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2009-11-16 108792]
R1 epfwtdi;epfwtdi; C:\WINDOWS\system32\DRIVERS\epfwtdi.sys [2009-11-16 55768]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2009-11-16 116520]
R2 epfw;epfw; C:\WINDOWS\system32\DRIVERS\epfw.sys [2009-12-18 135048]
R2 irda;Protokol IrDA; C:\WINDOWS\system32\DRIVERS\irda.sys [2008-04-14 88192]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2008-09-24 4122368]
R3 Epfwndis;Eset Personal Firewall; C:\WINDOWS\system32\DRIVERS\Epfwndis.sys [2010-01-08 33096]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 irsir;Microsoft Serial Infrared Driver; C:\WINDOWS\system32\DRIVERS\irsir.sys [2001-08-17 18688]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-05-16 6557408]
R3 Rasirda;WAN Miniport (IrDA); C:\WINDOWS\system32\DRIVERS\rasirda.sys [2001-08-17 19584]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
R3 WmBEnum;Logitech Virtual Bus Enumerator Driver; C:\WINDOWS\system32\drivers\WmBEnum.sys [2004-05-13 10144]
R3 WmXlCore;Logitech WingMan Translation Layer Driver; C:\WINDOWS\system32\drivers\WmXlCore.sys [2004-05-13 44384]
R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller; C:\WINDOWS\system32\DRIVERS\yk51x86.sys [2006-07-26 248832]
S3 BT;Bluetooth PAN Network Adapter; C:\WINDOWS\system32\DRIVERS\btnetdrv.sys []
S3 BTCOM;Bluetooth Serial port driver; C:\WINDOWS\system32\DRIVERS\btcomport.sys []
S3 BTCOMBUS;Bluetooth Serial Port Bus Service; C:\WINDOWS\System32\Drivers\btcombus.sys []
S3 BthEnum;Služba Bluetooth Enumerator; C:\WINDOWS\system32\DRIVERS\BthEnum.sys [2008-04-14 17024]
S3 BTHMODEM;Ovladač komunikace modemu Bluetooth; C:\WINDOWS\system32\DRIVERS\bthmodem.sys [2008-04-14 37888]
S3 BthPan;Bluetooth Device (Personal Area Network); C:\WINDOWS\system32\DRIVERS\bthpan.sys [2008-04-14 101120]
S3 BTHPORT;Ovladač portu Bluetooth; C:\WINDOWS\System32\Drivers\BTHport.sys [2008-06-14 272128]
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\WINDOWS\System32\Drivers\BTHUSB.sys [2008-04-14 18944]
S3 btnetBUs;Bluetooth PAN Bus Service; C:\WINDOWS\System32\Drivers\btnetBus.sys [2010-04-06 25864]
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2007-03-07 49920]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2007-03-07 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2007-03-07 21568]
S3 IvtBtBUs;IVT Bluetooth Bus Service; C:\WINDOWS\System32\Drivers\IvtBtBus.sys [2010-04-06 23048]
S3 nmwcd;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\ccdcmb.sys [2010-02-26 18176]
S3 nmwcdc;Nokia USB Generic; C:\WINDOWS\system32\drivers\ccdcmbo.sys [2010-02-26 22528]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent; C:\WINDOWS\system32\drivers\nmwcdnsu.sys [2010-02-26 137344]
S3 nmwcdnsuc;Nokia USB Flashing Generic; C:\WINDOWS\system32\drivers\nmwcdnsuc.sys [2010-02-26 8320]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 PRODIGY;PRODIGY; C:\WINDOWS\System32\Drivers\PRODIGY.SYS [2006-08-29 32377]
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\WINDOWS\system32\DRIVERS\rfcomm.sys [2008-04-14 59136]
S3 Smport;Smport; \??\C:\WINDOWS\system32\Smport.sys []
S3 SRS_SSCFilter;SRS Labs Audio Sandbox (WDM); C:\WINDOWS\system32\drivers\srs_sscfilter_i386.sys [2009-12-15 268912]
S3 StarOpen;StarOpen; C:\WINDOWS\system32\drivers\StarOpen.sys []
S3 upperdev;upperdev; C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys [2010-02-26 8192]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 usbser;USB Modem Driver; C:\WINDOWS\system32\drivers\usbser.sys [2008-04-14 26112]
S3 UsbserFilt;UsbserFilt; C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys [2010-02-26 8192]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 vsbus;Virtual Serial Bus Enumerator; C:\WINDOWS\system32\DRIVERS\vsb.sys [2008-07-24 15264]
S3 vserial;ELTIMA Virtual Serial Ports Driver; C:\WINDOWS\System32\DRIVERS\vserial.sys [2008-07-24 47744]
S3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2009-07-14 444136]
S3 WmFilter;Logitech WingMan HID Filter Driver; C:\WINDOWS\system32\drivers\WmFilter.sys [2004-05-13 21440]
S3 WmHidLo;Logitech WingMan USB Filter Driver; C:\WINDOWS\system32\drivers\WmHidLo.sys [2004-05-13 14720]
S3 WmVirHid;Logitech Virtual Hid Device Driver; C:\WINDOWS\system32\drivers\WmVirHid.sys [2004-05-13 5600]
S3 WpdUsb;WpdUsb; C:\WINDOWS\System32\Drivers\wpdusb.sys [2004-08-11 18944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdvancedSystemCareService;Advanced SystemCare Service; C:\Program Files\IObit\Advanced SystemCare 4\ASCService.exe [2011-05-28 353168]
R2 BthServ;Bluetooth Support Service; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 hpqddsvc;Služba HP CUE DeviceDiscovery; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 Irmon;Sledování infračerveného přenosu; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-04-30 153376]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-20 322120]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-05-16 159812]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R2 srviecheck;srviecheck; C:\WINDOWS\update.2\svchost.exe [2011-07-25 495616]
R2 srvsysdriver32;srvsysdriver32; C:\WINDOWS\sysdriver32.exe [2011-07-25 256000]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2004-08-11 38912]
R3 hpqcxs08;hpqcxs08; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe []
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-04-13 792112]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-05-16 271920]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2010-05-25 613888]
S3 WinRM;Windows Remote Management (WS-Management); C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------
Uisti sa, kde spravíš nasledujúci krok, aby si náhodou nespadol. :)
Nahoru
Uživatelský avatar
vyosek
VIP
VIP
Příspěvky: 56373
Registrován: 07 lis 2006 15:24
Bydliště: Šalingrad - Brno

Re: Facebook vírus prosím pomoc

#2 Příspěvek od vyosek »

Zdravim a pekny vecer preji :)

:arrow: Stahnete RKill http://download.bleepingcomputer.com/grinler/rkill.com :arrow: Aplikujte exeHelper by Raktor :arrow: Aplikujte RogueKiller
stell píše: pouzijes RogueKiller>.spustis>>stlac 2> [enter] log vloz sem
http://www.viry.cz/forum/viewtopic.php? ... 05#p981205
:arrow: Jeste znovu RogueKiller ale nyni s moznosti 3 a pote jeste jednou s moznosti 4

:arrow: RKill, eXeHelper i RogueKiller by mely udelat logy, vlozte mi je sem
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Uživatelský avatar
Patriciusd
Návštěvník
Návštěvník
Příspěvky: 82
Registrován: 28 úno 2011 08:59

Re: Facebook vírus prosím pomoc

#3 Příspěvek od Patriciusd »

RogueKiller V5.2.8 [07/23/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.sur-la-toile.com/discussion- ... ntees.html

Operating System: Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User: Rudo [Admin rights]
Mode: Remove -- Date : 07/25/2011 19:38:17

Bad processes: 6
[SVCHOST] svchost.exe -- c:\windows\update.tray-3-0\svchost.exe -> KILLED
[SUSP PATH] sysdriver32.exe -- c:\windows\sysdriver32.exe -> KILLED
[SVCHOST] svchost.exe -- c:\windows\update.2\svchost.exe -> KILLED
[SUSP PATH] l1rezerv.exe -- c:\windows\l1rezerv.exe -> KILLED
[SVCHOST] svchost.exe -- c:\windows\update.5.0\svchost.exe -> KILLED
[SUSP PATH] systemup.exe -- c:\windows\systemup.exe -> KILLED

Registry Entries: 10
[SUSP PATH] HKLM\[...]\Run : 46430013-loader2.exe ("C:\WINDOWS\TEMP\46430013-loader2.exe") -> DELETED
[SUSP PATH] HKLM\[...]\Run : sysdriver32.exe ("C:\WINDOWS\sysdriver32.exe" rezerv) -> DELETED
[SUSP PATH] HKLM\[...]\Run : sysdriver32_.exe ("C:\WINDOWS\sysdriver32_.exe" rezerv) -> DELETED
[SUSP PATH] HKLM\[...]\Run : l1rezerv.exe ("C:\WINDOWS\l1rezerv.exe") -> DELETED
[SUSP PATH] HKLM\[...]\Run : systemup ("C:\WINDOWS\systemup.exe" stand) -> DELETED
[HJ] HKLM\[...]\System : EnableLUA (0) -> REPLACED (1)
[HJ] HKLM\[...]\Security Center : AntiVirusDisableNotify (1) -> REPLACED (0)
[HJ] HKLM\[...]\Security Center : FirewallDisableNotify (1) -> REPLACED (0)
[HJ] HKLM\[...]\Security Center : UpdatesDisableNotify (1) -> REPLACED (0)
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

HOSTS File:
127.0.0.1 localhost
127.0.0.1 vkontakte.ru
127.0.0.1 www.vkontakte.ru
127.0.0.1 login.vk.com
127.0.0.1 vk.com
127.0.0.1 www.vk.com
127.0.0.1 odnoklassniki.ru
127.0.0.1 www.odnoklassniki.ru
127.0.0.1 facebook.com
127.0.0.1 www.facebook.com
127.0.0.1 af-za.facebook.com
127.0.0.1 az-az.facebook.com
127.0.0.1 id-id.facebook.com
127.0.0.1 ms-my.facebook.com
127.0.0.1 bs-ba.facebook.com
127.0.0.1 ca-es.facebook.com
127.0.0.1 cs-cz.facebook.com
127.0.0.1 cy-gb.facebook.com
127.0.0.1 da-dk.facebook.com
127.0.0.1 de-de.facebook.com
[...]


Finished : << RKreport[1].txt >>
RKreport[1].txt


....................................................
RogueKiller V5.2.8 [07/23/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.sur-la-toile.com/discussion- ... ntees.html

Operating System: Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User: Rudo [Admin rights]
Mode: HOSTSFix -- Date : 07/25/2011 19:38:38

Bad processes: 0

HOSTS File:
127.0.0.1 localhost
127.0.0.1 vkontakte.ru
127.0.0.1 www.vkontakte.ru
127.0.0.1 login.vk.com
127.0.0.1 vk.com
127.0.0.1 www.vk.com
127.0.0.1 odnoklassniki.ru
127.0.0.1 www.odnoklassniki.ru
127.0.0.1 facebook.com
127.0.0.1 www.facebook.com
127.0.0.1 af-za.facebook.com
127.0.0.1 az-az.facebook.com
127.0.0.1 id-id.facebook.com
127.0.0.1 ms-my.facebook.com
127.0.0.1 bs-ba.facebook.com
127.0.0.1 ca-es.facebook.com
127.0.0.1 cs-cz.facebook.com
127.0.0.1 cy-gb.facebook.com
127.0.0.1 da-dk.facebook.com
127.0.0.1 de-de.facebook.com
[...]


Resetted HOSTS:
127.0.0.1 localhost

Finished : << RKreport[2].txt >>
RKreport[1].txt ; RKreport[2].txt
............................................................
RogueKiller V5.2.8 [07/23/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.sur-la-toile.com/discussion- ... ntees.html

Operating System: Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User: Rudo [Admin rights]
Mode: ProxyFix -- Date : 07/25/2011 19:38:45

Bad processes: 0

Registry Entries: 0

Finished : << RKreport[3].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt
..............................................................................
This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.

Rkill was run on . 07. 2011 at 19:34:27.
Operating System: Microsoft Windows XP


Processes terminated by Rkill or while it was running:



Rkill completed on . 07. 2011 at 19:34:36.
...............................................................................
exeHelper by Raktor
Build 20100414
Run at 19:35:44 on 07/25/11
Now searching...
Checking for numerical processes...
Removing HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1429766.exe
Checking for sysguard processes...
Checking for bad processes...
Checking for bad files...
Checking for bad registry entries...
Resetting filetype association for .exe
Resetting filetype association for .com
Resetting userinit and shell values...
Resetting policies...
--Finished--
Uisti sa, kde spravíš nasledujúci krok, aby si náhodou nespadol. :)
Nahoru
Uživatelský avatar
vyosek
VIP
VIP
Příspěvky: 56373
Registrován: 07 lis 2006 15:24
Bydliště: Šalingrad - Brno

Re: Facebook vírus prosím pomoc

#4 Příspěvek od vyosek »

Vyborne, jdeme dale :James008:

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK
:arrow: Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe
  • Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
  • Pokud mate Win XP spustte pod uctem Spravce\Administratora
  • Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
  • Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
  • Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
  • Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
  • Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
  • Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
  • Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Uživatelský avatar
Patriciusd
Návštěvník
Návštěvník
Příspěvky: 82
Registrován: 28 úno 2011 08:59

Re: Facebook vírus prosím pomoc

#5 Příspěvek od Patriciusd »

mam ist do administratora a nie cez obycajny ucet?
Uisti sa, kde spravíš nasledujúci krok, aby si náhodou nespadol. :)
Nahoru
Uživatelský avatar
vyosek
VIP
VIP
Příspěvky: 56373
Registrován: 07 lis 2006 15:24
Bydliště: Šalingrad - Brno

Re: Facebook vírus prosím pomoc

#6 Příspěvek od vyosek »

Muzete zustat na beznem, tez ma admin prava :wink:
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Uživatelský avatar
Patriciusd
Návštěvník
Návštěvník
Příspěvky: 82
Registrován: 28 úno 2011 08:59

Re: Facebook vírus prosím pomoc

#7 Příspěvek od Patriciusd »

Tu je to :


ComboFix 11-07-25.02 - Rudo . 07. 2011 20:05:29.5.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.421.1029.18.1535.1096 [GMT 2:00]
Running from: c:\documents and settings\Rudo\Plocha\ComboFix.exe
AV: ESET Smart Security 4.0 *Enabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *Enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\NetworkService\Data aplikací\desktop.ini
c:\windows\btc_client_iplist.txt
c:\windows\ddh_iplist.txt
c:\windows\eithirtyfour.dll
c:\windows\front_ip_list.txt
c:\windows\iecheck_iplist.txt
c:\windows\info1
c:\windows\iplist.txt
c:\windows\l1rezerv.exe
c:\windows\loader2.exe_ok
c:\windows\phoenix.rar
c:\windows\rpcminer.rar
c:\windows\services32.exe
c:\windows\sysdriver32.exe
c:\windows\sysdriver32_.exe
c:\windows\system32\drivers\etc\HSTS~1
c:\windows\system32\log.html
c:\windows\systemup.exe
c:\windows\TEMP\799791.exe
c:\windows\ufa.rar
c:\windows\update.1
c:\windows\update.1\svchost.exe
c:\windows\update.2
c:\windows\update.2\svchost.exe
c:\windows\update.5.0
c:\windows\update.5.0\svchost.exe
c:\windows\v34peformatei.dll
c:\windows\winlog-dirs.txt
c:\windows\winlog-ids.txt
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_SRVIECHECK
-------\Legacy_SRVSYSDRIVER32
-------\Legacy_WXPDRIVERS
-------\Service_srviecheck
-------\Service_srvsysdriver32
-------\Service_wxpdrivers
-------\Legacy_srvbtcclient
-------\Legacy_srvbtcclient
-------\Service_srvbtcclient
-------\Service_srvbtcclient
.
.
((((((((((((((((((((((((( Files Created from 2011-06-25 to 2011-07-25 )))))))))))))))))))))))))))))))
.
.
2011-07-25 17:28 . 2011-07-25 17:28 -------- d-----w- c:\windows\rpcminer
2011-07-25 17:28 . 2011-07-25 17:28 -------- d-----w- c:\windows\phoenix
2011-07-25 17:28 . 2011-07-25 17:28 -------- d-----w- c:\windows\ufa
2011-07-25 17:11 . 2011-07-25 17:28 246272 ----a-w- c:\windows\unrar.exe
2011-07-25 17:05 . 2011-07-25 17:05 -------- d-----w- c:\windows\av_ico
2011-07-25 16:59 . 2011-07-25 16:59 -------- d--h--w- c:\windows\update.tray-3-0
2011-07-25 16:59 . 2011-07-25 16:59 -------- d--h--w- c:\windows\update.tray-3-0-lnk
2011-07-25 08:44 . 2011-07-25 08:44 -------- d-----w- c:\program files\CCleaner
2011-07-25 08:05 . 2011-07-25 08:05 -------- d-----w- c:\documents and settings\LocalService\Nabídka Start
2011-07-12 16:56 . 2011-07-12 16:56 -------- d-----w- c:\documents and settings\Rudo\Data aplikací\Salling Software AB
2011-07-12 16:56 . 2011-07-12 16:56 360580 ----a-w- c:\windows\eSellerateEngine.dll
2011-07-12 12:01 . 2011-07-12 12:01 -------- d-----w- c:\documents and settings\Rudo\Data aplikací\GetRightToGo
2011-07-12 06:48 . 2011-07-12 06:48 -------- d-----w- c:\documents and settings\All Users\Data aplikací\SRS Labs
2011-07-11 17:14 . 2011-03-11 14:10 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
2011-07-11 17:12 . 2011-07-11 17:12 -------- d-----w- c:\windows\system32\winrm
2011-07-11 17:12 . 2011-07-11 17:12 -------- d-----w- c:\windows\system32\GroupPolicy
2011-07-11 17:12 . 2011-07-11 17:13 -------- dc-h--w- c:\windows\$968930Uinstall_KB968930$
2011-07-11 16:52 . 2011-07-11 16:53 -------- d-----w- c:\documents and settings\All Users\Data aplikací\IObit
2011-07-11 16:50 . 2011-07-11 16:53 -------- d-----w- c:\documents and settings\Rudo\Data aplikací\IObit
2011-07-11 07:19 . 1999-05-05 20:22 0 ----a-w- c:\windows\tellei34.sys
2011-07-11 07:19 . 1999-05-05 20:22 0 ----a-w- c:\windows\system32\sysaddei34.dll
2011-07-08 14:01 . 2011-03-04 19:44 59888 ------w- c:\windows\system32\pxwma.dll
2011-07-08 14:01 . 2011-07-25 17:07 -------- d-----w- c:\documents and settings\Rudo\Data aplikací\Winamp
2011-07-08 14:01 . 2011-07-08 14:01 -------- d-----w- c:\documents and settings\Rudo\Data aplikací\OpenCandy
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-25 08:58 . 2011-05-18 05:11 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-08 14:05 . 2011-04-05 14:44 2627 ----a-w- c:\windows\system32\smport.sys
2011-06-06 11:35 . 2008-04-14 12:00 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-06-02 13:44 . 2011-06-02 13:41 5312 ----a-w- c:\windows\BricoPackFoldersDelete.cmd
2011-06-02 13:44 . 2010-06-09 12:44 71634 ----a-w- c:\windows\BricoPackUninst.cmd
2011-05-29 07:11 . 2011-04-03 13:16 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-29 07:11 . 2011-04-03 13:16 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-05-02 15:32 . 2010-03-05 10:12 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-04-29 17:25 . 2008-04-14 12:00 151552 ----a-w- c:\windows\system32\schannel.dll
2011-04-29 16:19 . 2008-04-14 12:00 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-06-25 16:14 . 2011-05-06 13:18 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2009-08-06 . 0B6DABD6FFF1AD42A3CD65A1C7EE8F35 . 68832 . . [7.4.7600.226] . . c:\windows\system32\wuauclt.exe
[-] 2009-08-06 . 0B6DABD6FFF1AD42A3CD65A1C7EE8F35 . 68832 . . [7.4.7600.226] . . c:\windows\system32\dllcache\wuauclt.exe
.
[-] 2008-04-14 . 13E794E5591776CBC71055A7B3CC1D5F . 976384 . . [6.00.2900.5512] . . c:\windows\explorer.exe
[-] 2008-04-14 . 13E794E5591776CBC71055A7B3CC1D5F . 976384 . . [6.00.2900.5512] . . c:\windows\system32\dllcache\explorer.exe
.
[-] 2008-04-14 . ED69B3B6CD23D1D00815D5F70D517E01 . 225792 . . [5.1.2600.5512] . . c:\windows\regedit.exe
[-] 2008-04-14 . ED69B3B6CD23D1D00815D5F70D517E01 . 225792 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\regedit.exe
.
[-] 2008-04-14 . D008D88ED7D047B78A504986DF5647EE . 832512 . . [6.00.2900.5512] . . c:\windows\system32\dllcache\iexplore.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 577536]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="nwiz.exe" [2008-05-16 1630208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 86016]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableSecureUIAPaths"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-03-11 20:34 49152 ----a-w- c:\program files\HP\HP Software Update\HPWuSchd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2008-05-16 13:01 13529088 ----a-w- c:\windows\system32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
2010-05-14 09:32 1479680 ----a-w- c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
"DisableThumbnailCache"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AntikVirtualSTB\\AntikVirtualSTB.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\totalcmd\\TOTALCMD.EXE"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\WINDOWS\\update.tray-3-0\\svchost.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Vzdálená správa systému Windows
.
R0 BtHidBus;Bluetooth HID Bus Service;c:\windows\system32\drivers\BtHidBus.sys [6. 4. 2010 18:32 20104]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [9. 8. 2010 17:32 691696]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [16. 11. 2009 9:03 108792]
R2 AdvancedSystemCareService;Advanced SystemCare Service;c:\program files\IObit\Advanced SystemCare 4\ASCService.exe [11. 7. 2011 18:50 353168]
S2 ekrn;ESET Service;"c:\program files\ESET\ESET Smart Security\ekrn.exe" --> c:\program files\ESET\ESET Smart Security\ekrn.exe [?]
S3 BTCOM;Bluetooth Serial port driver;c:\windows\system32\DRIVERS\btcomport.sys --> c:\windows\system32\DRIVERS\btcomport.sys [?]
S3 BTCOMBUS;Bluetooth Serial Port Bus Service;c:\windows\system32\Drivers\btcombus.sys --> c:\windows\system32\Drivers\btcombus.sys [?]
S3 btnetBUs;Bluetooth PAN Bus Service;c:\windows\system32\drivers\btnetBus.sys [6. 4. 2010 18:33 25864]
S3 IvtBtBUs;IVT Bluetooth Bus Service;c:\windows\system32\drivers\IvtBtBus.sys [6. 4. 2010 18:32 23048]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [7. 1. 2011 23:35 137344]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [7. 1. 2011 23:35 8320]
S3 PRODIGY;PRODIGY;c:\windows\system32\drivers\prodigy.sys [8. 5. 2011 20:37 32377]
S3 Smport;Smport;c:\windows\system32\smport.sys [5. 4. 2011 16:44 2627]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [14. 4. 2008 14:00 14336]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
WINRM REG_MULTI_SZ WINRM
.
Contents of the 'Scheduled Tasks' folder
.
2011-07-12 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
2011-07-25 c:\windows\Tasks\ASC4_PerformanceMonitor.job
- c:\program files\IObit\Advanced SystemCare 4\PMonitor.exe [2011-07-11 12:46]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.sk/
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\documents and settings\Rudo\Data aplikací\Mozilla\Firefox\Profiles\3556j5fn.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - google.sk
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.9&q=
.
- - - - ORPHANS REMOVED - - - -
.
MSConfigStartUp-799791 - c:\windows\TEMP\799791.exe
MSConfigStartUp-9700361 - c:\docume~1\Rudo\LOCALS~1\Temp\9700361.exe
MSConfigStartUp-sysdriver32 - c:\windows\sysdriver32.exe
MSConfigStartUp-sysdriver32_ - c:\windows\sysdriver32_.exe
MSConfigStartUp-wxpdrv - c:\windows\services32.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-07-25 20:12
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-789336058-179605362-1177238915-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(3632)
c:\windows\system32\msi.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\credui.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\nvsvc32.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\RUNDLL32.EXE
c:\windows\system32\rundll32.exe
c:\windows\SOUNDMAN.EXE
.
**************************************************************************
.
Completion time: 2011-07-25 20:17:07 - machine was rebooted
ComboFix-quarantined-files.txt 2011-07-25 18:17
.
Pre-Run: 9 621 852 160
Post-Run: 9 570 922 496
.
- - End Of File - - B369B1C13AF56A7BF39D371A7DF7078D
Uisti sa, kde spravíš nasledujúci krok, aby si náhodou nespadol. :)
Nahoru
Uživatelský avatar
Patriciusd
Návštěvník
Návštěvník
Příspěvky: 82
Registrován: 28 úno 2011 08:59

Re: Facebook vírus prosím pomoc

#8 Příspěvek od Patriciusd »

ako to vyzerá? :)
Uisti sa, kde spravíš nasledujúci krok, aby si náhodou nespadol. :)
Nahoru
Uživatelský avatar
vyosek
VIP
VIP
Příspěvky: 56373
Registrován: 07 lis 2006 15:24
Bydliště: Šalingrad - Brno

Re: Facebook vírus prosím pomoc

#9 Příspěvek od vyosek »

:arrow: Chvili strpeni prosim, nejste tu sam :?:

:arrow: Pokud nemate, tak presunte Combofix na plochu
  • Spustte poznamkovy blok (Start-spustit-notepad)
  • Zkopirujte skript nize

  • Kód: Vybrat vše

    KillAll::

Firefox::
FF - ProfilePath - c:\documents and settings\Rudo\Data aplikací\Mozilla\Firefox\Profiles\3556j5fn.default\
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_result ... r=1.1.9&q=

File::
c:\windows\Tasks\AppleSoftwareUpdate.job
c:\windows\Tasks\ASC4_PerformanceMonitor.job
c:\windows\unrar.exe

Folder::
c:\program files\IObit
c:\windows\rpcminer
c:\windows\phoenix
c:\windows\ufa
c:\windows\av_ico
c:\windows\update.tray-3-0
c:\windows\update.tray-3-0-lnk
c:\documents and settings\Rudo\Data aplikací\IObit
c:\documents and settings\All Users\Data aplikací\IObit

Collect::
c:\windows\tellei34.sys
c:\windows\system32\sysaddei34.dll

Driver::
AdvancedSystemCareService

Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"=-
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\update.tray-3-0\\svchost.exe"=-
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000000
"DisableThumbnailCache"=dword:00000000
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"=-

Reboot::
  • Ulozte vytvoreny TXT jako CFScript.txt
  • Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
    Obrázek
  • Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte
:arrow: Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Uživatelský avatar
Patriciusd
Návštěvník
Návštěvník
Příspěvky: 82
Registrován: 28 úno 2011 08:59

Re: Facebook vírus prosím pomoc

#10 Příspěvek od Patriciusd »

Len som sa opýtal veľmi si Vás vážim, že nám pomáhate :)
Tu to je :



ComboFix 11-07-25.02 - Rudo . 07. 2011 20:47:44.6.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.421.1029.18.1535.1143 [GMT 2:00]
Running from: c:\documents and settings\Rudo\Plocha\ComboFix.exe
Command switches used :: c:\documents and settings\Rudo\Plocha\CFScript.txt
AV: ESET Smart Security 4.0 *Enabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *Enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
.
FILE ::
"c:\windows\Tasks\AppleSoftwareUpdate.job"
"c:\windows\Tasks\ASC4_PerformanceMonitor.job"
"c:\windows\unrar.exe"
.
file zipped: c:\windows\system32\sysaddei34.dll
file zipped: c:\windows\tellei34.sys
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\IObit
c:\program files\IObit\Advanced SystemCare 4\About.dll
c:\program files\IObit\Advanced SystemCare 4\ASC.exe
c:\program files\IObit\Advanced SystemCare 4\ASCInit.exe
c:\program files\IObit\Advanced SystemCare 4\ASCService.exe
c:\program files\IObit\Advanced SystemCare 4\ASCTray.exe
c:\program files\IObit\Advanced SystemCare 4\ASCv4ComputerMenu.dll
c:\program files\IObit\Advanced SystemCare 4\ASCv4ComputerMenu_64.dll
c:\program files\IObit\Advanced SystemCare 4\ASCv4ExtMenu.dll
c:\program files\IObit\Advanced SystemCare 4\ASCv4ExtMenu_64.dll
c:\program files\IObit\Advanced SystemCare 4\AutoCare.exe
c:\program files\IObit\Advanced SystemCare 4\AutoSweep.exe
c:\program files\IObit\Advanced SystemCare 4\AutoUpdate.exe
c:\program files\IObit\Advanced SystemCare 4\cxLibraryD12.bpl
c:\program files\IObit\Advanced SystemCare 4\datastate.dll
c:\program files\IObit\Advanced SystemCare 4\Def.dbd
c:\program files\IObit\Advanced SystemCare 4\DiskMap.dll
c:\program files\IObit\Advanced SystemCare 4\DiskScan.exe
c:\program files\IObit\Advanced SystemCare 4\DriverData.db
c:\program files\IObit\Advanced SystemCare 4\dxBarD12.bpl
c:\program files\IObit\Advanced SystemCare 4\dxComnD12.bpl
c:\program files\IObit\Advanced SystemCare 4\dxCoreD12.bpl
c:\program files\IObit\Advanced SystemCare 4\dxDockingD12.bpl
c:\program files\IObit\Advanced SystemCare 4\dxGDIPlusD12.bpl
c:\program files\IObit\Advanced SystemCare 4\dxSkinOffice2007BlueD12.bpl
c:\program files\IObit\Advanced SystemCare 4\dxSkinsCoreD12.bpl
c:\program files\IObit\Advanced SystemCare 4\dxThemeD12.bpl
c:\program files\IObit\Advanced SystemCare 4\EULA.rtf
c:\program files\IObit\Advanced SystemCare 4\fav.ico
c:\program files\IObit\Advanced SystemCare 4\FfSweep.dll
c:\program files\IObit\Advanced SystemCare 4\Freeware\ASC_FreeSoftwareDownloader.exe
c:\program files\IObit\Advanced SystemCare 4\Freeware\Check.dll
c:\program files\IObit\Advanced SystemCare 4\help.html
c:\program files\IObit\Advanced SystemCare 4\ChangeType.exe
c:\program files\IObit\Advanced SystemCare 4\checkinfo.txt
c:\program files\IObit\Advanced SystemCare 4\images\dcScreen.png
c:\program files\IObit\Advanced SystemCare 4\images\dcScreen2.png
c:\program files\IObit\Advanced SystemCare 4\images\icon-dc.png
c:\program files\IObit\Advanced SystemCare 4\images\icon-qc.png
c:\program files\IObit\Advanced SystemCare 4\images\icon-tb.png
c:\program files\IObit\Advanced SystemCare 4\images\icon-tbox.png
c:\program files\IObit\Advanced SystemCare 4\images\main.png
c:\program files\IObit\Advanced SystemCare 4\images\mainPro.png
c:\program files\IObit\Advanced SystemCare 4\images\toolboxscreen.png
c:\program files\IObit\Advanced SystemCare 4\images\turboboost.png
c:\program files\IObit\Advanced SystemCare 4\Language\Arabic.lng
c:\program files\IObit\Advanced SystemCare 4\Language\Belarusian.lng
c:\program files\IObit\Advanced SystemCare 4\Language\Bulgarian.lng
c:\program files\IObit\Advanced SystemCare 4\Language\Czech.lng
c:\program files\IObit\Advanced SystemCare 4\Language\Danish.lng
c:\program files\IObit\Advanced SystemCare 4\Language\Dutch.lng
c:\program files\IObit\Advanced SystemCare 4\Language\English.lng
c:\program files\IObit\Advanced SystemCare 4\Language\French.lng
c:\program files\IObit\Advanced SystemCare 4\Language\German.lng
c:\program files\IObit\Advanced SystemCare 4\Language\Greek.lng
c:\program files\IObit\Advanced SystemCare 4\Language\Hungarian.lng
c:\program files\IObit\Advanced SystemCare 4\Language\ChineseSimp.lng
c:\program files\IObit\Advanced SystemCare 4\Language\ChineseTrad.lng
c:\program files\IObit\Advanced SystemCare 4\Language\Italiano.lng
c:\program files\IObit\Advanced SystemCare 4\Language\Japanese.lng
c:\program files\IObit\Advanced SystemCare 4\Language\Korean.lng
c:\program files\IObit\Advanced SystemCare 4\Language\Polish.lng
c:\program files\IObit\Advanced SystemCare 4\Language\PortugueseBR.lng
c:\program files\IObit\Advanced SystemCare 4\Language\Russian.lng
c:\program files\IObit\Advanced SystemCare 4\Language\Serbian.lng
c:\program files\IObit\Advanced SystemCare 4\Language\Spanish.lng
c:\program files\IObit\Advanced SystemCare 4\Language\Swedish.lng
c:\program files\IObit\Advanced SystemCare 4\Language\Turkish.lng
c:\program files\IObit\Advanced SystemCare 4\LatestNews\imagenews.png
c:\program files\IObit\Advanced SystemCare 4\LatestNews\LatestNews.ini
c:\program files\IObit\Advanced SystemCare 4\License.dat
c:\program files\IObit\Advanced SystemCare 4\madbasic_.bpl
c:\program files\IObit\Advanced SystemCare 4\maddisAsm_.bpl
c:\program files\IObit\Advanced SystemCare 4\madexcept_.bpl
c:\program files\IObit\Advanced SystemCare 4\NtfsData.dll
c:\program files\IObit\Advanced SystemCare 4\OFCommon.dll
c:\program files\IObit\Advanced SystemCare 4\OFCommon3.dll
c:\program files\IObit\Advanced SystemCare 4\PMonitor.exe
c:\program files\IObit\Advanced SystemCare 4\Register.exe
c:\program files\IObit\Advanced SystemCare 4\RescueCenter.exe
c:\program files\IObit\Advanced SystemCare 4\rtl120.bpl
c:\program files\IObit\Advanced SystemCare 4\Scan.dll
c:\program files\IObit\Advanced SystemCare 4\ScanCache.db
c:\program files\IObit\Advanced SystemCare 4\services.ini
c:\program files\IObit\Advanced SystemCare 4\sqlite3.dll
c:\program files\IObit\Advanced SystemCare 4\StartMenu.exe
c:\program files\IObit\Advanced SystemCare 4\Suc10_RegistryCleaner.exe
c:\program files\IObit\Advanced SystemCare 4\Suc11_PrivacySweeper.exe
c:\program files\IObit\Advanced SystemCare 4\Suc12_Uninstal.exe
c:\program files\IObit\Advanced SystemCare 4\Suc13_DiskCleaner.exe
c:\program files\IObit\Advanced SystemCare 4\Suc14_FileShredder.exe
c:\program files\IObit\Advanced SystemCare 4\Sun10_ClonedFilesScanner.exe
c:\program files\IObit\Advanced SystemCare 4\Sun11_DiskExplorer.exe
c:\program files\IObit\Advanced SystemCare 4\Sun12_SystemInformation.exe
c:\program files\IObit\Advanced SystemCare 4\Sun13_EmptyFoldersScanner.exe
c:\program files\IObit\Advanced SystemCare 4\Sun14_SystemControl.exe
c:\program files\IObit\Advanced SystemCare 4\Suo10_SmartRAM.exe
c:\program files\IObit\Advanced SystemCare 4\Suo11_InternetBooster.exe
c:\program files\IObit\Advanced SystemCare 4\Suo12_StartupManager.exe
c:\program files\IObit\Advanced SystemCare 4\Suo13_RegistryDefrag.exe
c:\program files\IObit\Advanced SystemCare 4\Suo14_SmartDefrag.exe
c:\program files\IObit\Advanced SystemCare 4\Suo15_GameBooster.exe
c:\program files\IObit\Advanced SystemCare 4\Sur10_Undelete.exe
c:\program files\IObit\Advanced SystemCare 4\Sur11_ShortcutFixer.exe
c:\program files\IObit\Advanced SystemCare 4\Sur12_DiskDoctor.exe
c:\program files\IObit\Advanced SystemCare 4\Sur13_WinFix.exe
c:\program files\IObit\Advanced SystemCare 4\Sur14_IEHelper.exe
c:\program files\IObit\Advanced SystemCare 4\Sus10_SecurityHolesScanner.exe
c:\program files\IObit\Advanced SystemCare 4\Sus11_ProcessManager.exe
c:\program files\IObit\Advanced SystemCare 4\Sus12_DriverManager.exe
c:\program files\IObit\Advanced SystemCare 4\Sus13_IMF.exe
c:\program files\IObit\Advanced SystemCare 4\taskMgr.dll
c:\program files\IObit\Advanced SystemCare 4\TaskSchedule.exe
c:\program files\IObit\Advanced SystemCare 4\TBconfig.ini
c:\program files\IObit\Advanced SystemCare 4\TbFfSweep.dll
c:\program files\IObit\Advanced SystemCare 4\TbFileSweep.dll
c:\program files\IObit\Advanced SystemCare 4\Test.log
c:\program files\IObit\Advanced SystemCare 4\ToolBox.exe
c:\program files\IObit\Advanced SystemCare 4\Toolbox_Language\Arabic.lng
c:\program files\IObit\Advanced SystemCare 4\Toolbox_Language\Belarusian.lng
c:\program files\IObit\Advanced SystemCare 4\Toolbox_Language\Bulgarian.lng
c:\program files\IObit\Advanced SystemCare 4\Toolbox_Language\Czech.lng
c:\program files\IObit\Advanced SystemCare 4\Toolbox_Language\English.lng
c:\program files\IObit\Advanced SystemCare 4\Toolbox_Language\French.lng
c:\program files\IObit\Advanced SystemCare 4\Toolbox_Language\German.lng
c:\program files\IObit\Advanced SystemCare 4\Toolbox_Language\Hungarian.lng
c:\program files\IObit\Advanced SystemCare 4\Toolbox_Language\ChineseSimp.lng
c:\program files\IObit\Advanced SystemCare 4\Toolbox_Language\ChineseTrad.lng
c:\program files\IObit\Advanced SystemCare 4\Toolbox_Language\Italiano.lng
c:\program files\IObit\Advanced SystemCare 4\Toolbox_Language\Japanese.lng
c:\program files\IObit\Advanced SystemCare 4\Toolbox_Language\Korean.lng
c:\program files\IObit\Advanced SystemCare 4\Toolbox_Language\Polish.lng
c:\program files\IObit\Advanced SystemCare 4\Toolbox_Language\Russian.lng
c:\program files\IObit\Advanced SystemCare 4\Toolbox_Language\Serbian.LNG
c:\program files\IObit\Advanced SystemCare 4\Toolbox_Language\Spanish.lng
c:\program files\IObit\Advanced SystemCare 4\Toolbox_Language\Turkish.lng
c:\program files\IObit\Advanced SystemCare 4\Toolbox_UI\img\btn-bg.png
c:\program files\IObit\Advanced SystemCare 4\Toolbox_UI\img\menu-bg.png
c:\program files\IObit\Advanced SystemCare 4\Toolbox_UI\Index.html
c:\program files\IObit\Advanced SystemCare 4\Toolbox_UI\js\jquery-1.4.2.min.js
c:\program files\IObit\Advanced SystemCare 4\Toolbox_UI\Recently.html
c:\program files\IObit\Advanced SystemCare 4\TurboBoost.exe
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\appimages\Btn_Back_Disable.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\appimages\Btn_Back_Down.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\appimages\Btn_Back_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\appimages\Btn_Back_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\appimages\Btn_BackBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\appimages\Btn_Down.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\appimages\Btn_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\appimages\Btn_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\appimages\BtnStop_Down.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\appimages\BtnStop_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\appimages\BtnStop_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\appimages\btnUpgradeDown.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\appimages\btnUpgradeNormal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\appimages\btnUpgradeOver.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\appimages\CareBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\appimages\CareWorkBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\appimages\Close_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\appimages\Close_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\appimages\CheckBox_Checked.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\appimages\CheckBox_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\appimages\Img_Error.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\appimages\Img_NoProblem.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\appimages\Layout.ini
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\appimages\Main_Shade.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\appimages\Min_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\appimages\Min_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\appimages\More_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\appimages\More_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\appimages\Preview.jpg
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\appimages\ProgressBarBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\appimages\ProgressBarInnerBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\appimages\ProgressBarInnerLeft.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\appimages\ProgressBarInnerMid.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\appimages\ProgressBarInnerRight.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\appimages\Rescue_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\appimages\Rescue_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\appimages\ScannerBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\appimages\ScanningBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\appimages\Skin_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\appimages\Skin_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\appimages\TopBar.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\appimages\TrackBar.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\appimages\TrackBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\appimages\UpgraudD.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\css\css.css
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\images\clear.gif
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\images\dailycare.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\images\deepcare.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\images\halo.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\images\hints.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\images\MainBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\images\quickcare.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\images\shadow.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\images\tip215.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\images\toolBox.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\images\toolboxs.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\images\transparent.gif
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\images\turboboostoff.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\images\turbobooston.png
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\js\action.js
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\js\action1.js
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\js\jquery-1.4.2.js
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\js\jquery.easing.1.3.js
c:\program files\IObit\Advanced SystemCare 4\UI\Asia\main.html
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\Btn_Back_Disable.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\Btn_Back_Down.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\Btn_Back_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\Btn_Back_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\Btn_BackBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\Btn_Down.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\Btn_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\Btn_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\BtnStop_Down.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\BtnStop_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\BtnStop_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\btnUpgradeDown.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\btnUpgradeNormal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\btnUpgradeOver.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\CareBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\CareWorkBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\Close_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\Close_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\halo.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\CheckBox_Checked.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\CheckBox_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\Img_Error.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\Img_NoProblem.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\Layout.ini
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\Main_Shade.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\Min_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\Min_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\More_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\More_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\Preview.jpg
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\ProgressBarBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\ProgressBarInnerBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\ProgressBarInnerLeft.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\ProgressBarInnerMid.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\ProgressBarInnerRight.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\Rescue_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\Rescue_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\ScannerBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\ScanningBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\Setting_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\Setting_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\shadow.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\Skin_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\Skin_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\tip215.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\TopBar.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\TrackBar.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\TrackBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\appimages\UpgraudD.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\css\css.css
c:\program files\IObit\Advanced SystemCare 4\UI\Black\images\clear.gif
c:\program files\IObit\Advanced SystemCare 4\UI\Black\images\dailycare.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\images\deepcare.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\images\halo.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\images\hints.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\images\MainBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\images\quickcare.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\images\shadow.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\images\tip215.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\images\toolBox.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\images\toolboxs.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\images\transparent.gif
c:\program files\IObit\Advanced SystemCare 4\UI\Black\images\turboboostoff.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\images\turbobooston.png
c:\program files\IObit\Advanced SystemCare 4\UI\Black\js\action.js
c:\program files\IObit\Advanced SystemCare 4\UI\Black\js\action1.js
c:\program files\IObit\Advanced SystemCare 4\UI\Black\js\jquery-1.4.2.js
c:\program files\IObit\Advanced SystemCare 4\UI\Black\js\jquery.easing.1.3.js
c:\program files\IObit\Advanced SystemCare 4\UI\Black\main.html
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\appimages\Btn_Back_Disable.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\appimages\Btn_Back_Down.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\appimages\Btn_Back_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\appimages\Btn_Back_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\appimages\Btn_BackBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\appimages\Btn_Down.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\appimages\Btn_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\appimages\Btn_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\appimages\BtnStop_Down.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\appimages\BtnStop_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\appimages\BtnStop_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\appimages\CareBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\appimages\CareWorkBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\appimages\Close_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\appimages\Close_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\appimages\CheckBox_Checked.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\appimages\CheckBox_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\appimages\Img_Error.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\appimages\Img_NoProblem.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\appimages\Layout.ini
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\appimages\Main_Shade.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\appimages\Min_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\appimages\Min_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\appimages\More_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\appimages\More_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\appimages\Preview.jpg
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\appimages\ProgressBarBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\appimages\ProgressBarInnerBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\appimages\ProgressBarInnerLeft.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\appimages\ProgressBarInnerMid.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\appimages\ProgressBarInnerRight.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\appimages\Rescue_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\appimages\Rescue_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\appimages\ScannerBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\appimages\ScanningBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\appimages\Skin_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\appimages\Skin_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\appimages\TopBar.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\appimages\TrackBar.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\appimages\TrackBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\css\css.css
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\images\clear.gif
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\images\deepcare.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\images\MainBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\images\quickcare.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\images\tip215.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\images\toolBox.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\images\transparent.gif
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\images\turboboostoff.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\images\turbobooston.png
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\js\action.js
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\js\action1.js
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\js\jquery-1.4.2.js
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\js\jquery.easing.1.3.js
c:\program files\IObit\Advanced SystemCare 4\UI\Blue\main.html
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\appimages\Btn_Back_Disable.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\appimages\Btn_Back_Down.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\appimages\Btn_Back_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\appimages\Btn_Back_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\appimages\Btn_BackBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\appimages\Btn_Down.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\appimages\Btn_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\appimages\Btn_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\appimages\BtnStop_Down.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\appimages\BtnStop_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\appimages\BtnStop_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\appimages\btnUpgradeDown.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\appimages\btnUpgradeNormal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\appimages\btnUpgradeOver.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\appimages\CareBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\appimages\CareWorkBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\appimages\Close_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\appimages\Close_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\appimages\CheckBox_Checked.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\appimages\CheckBox_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\appimages\Img_Error.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\appimages\Img_NoProblem.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\appimages\Layout.ini
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\appimages\Main_Shade.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\appimages\Min_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\appimages\Min_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\appimages\More_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\appimages\More_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\appimages\Preview.jpg
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\appimages\ProgressBarBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\appimages\ProgressBarInnerBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\appimages\ProgressBarInnerLeft.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\appimages\ProgressBarInnerMid.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\appimages\ProgressBarInnerRight.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\appimages\Rescue_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\appimages\Rescue_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\appimages\ScannerBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\appimages\ScanningBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\appimages\Skin_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\appimages\Skin_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\appimages\TopBar.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\appimages\TrackBar.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\appimages\TrackBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\appimages\UpgraudD.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\css\css.css
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\images\clear.gif
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\images\dailycare.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\images\deepcare.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\images\halo.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\images\hints.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\images\MainBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\images\quickcare.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\images\shadow.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\images\tip215.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\images\toolBox.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\images\toolboxs.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\images\transparent.gif
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\images\turboboostoff.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\images\turbobooston.png
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\js\action.js
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\js\action1.js
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\js\jquery-1.4.2.js
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\js\jquery.easing.1.3.js
c:\program files\IObit\Advanced SystemCare 4\UI\Cute\main.html
c:\program files\IObit\Advanced SystemCare 4\UI\Default\appimages\Btn_Back_Disable.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\appimages\Btn_Back_Down.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\appimages\Btn_Back_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\appimages\Btn_Back_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\appimages\Btn_BackBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\appimages\Btn_Down.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\appimages\Btn_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\appimages\Btn_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\appimages\BtnStop_Down.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\appimages\BtnStop_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\appimages\BtnStop_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\appimages\CareBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\appimages\CareWorkBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\appimages\Close_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\appimages\Close_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\appimages\CheckBox_Checked.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\appimages\CheckBox_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\appimages\Img_Error.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\appimages\Img_NoProblem.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\appimages\Layout.ini
c:\program files\IObit\Advanced SystemCare 4\UI\Default\appimages\Main_Shade.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\appimages\Min_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\appimages\Min_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\appimages\More_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\appimages\More_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\appimages\Preview.jpg
c:\program files\IObit\Advanced SystemCare 4\UI\Default\appimages\ProgressBarBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\appimages\ProgressBarInnerBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\appimages\ProgressBarInnerLeft.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\appimages\ProgressBarInnerMid.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\appimages\ProgressBarInnerRight.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\appimages\Rescue_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\appimages\Rescue_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\appimages\ScannerBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\appimages\ScanningBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\appimages\Skin_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\appimages\Skin_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\appimages\TopBar.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\appimages\TrackBar.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\appimages\TrackBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\css\css.css
c:\program files\IObit\Advanced SystemCare 4\UI\Default\images\clear.gif
c:\program files\IObit\Advanced SystemCare 4\UI\Default\images\dailycare.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\images\deepcare.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\images\halo.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\images\hints.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\images\MainBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\images\quickcare.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\images\shadow.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\images\tip215.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\images\toolBox.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\images\toolboxs.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\images\transparent.gif
c:\program files\IObit\Advanced SystemCare 4\UI\Default\images\turboboostoff.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\images\turbobooston.png
c:\program files\IObit\Advanced SystemCare 4\UI\Default\js\action.js
c:\program files\IObit\Advanced SystemCare 4\UI\Default\js\action1.js
c:\program files\IObit\Advanced SystemCare 4\UI\Default\js\jquery-1.4.2.js
c:\program files\IObit\Advanced SystemCare 4\UI\Default\js\jquery.easing.1.3.js
c:\program files\IObit\Advanced SystemCare 4\UI\Default\main.html
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\Btn_Back_Disable.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\Btn_Back_Down.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\Btn_Back_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\Btn_Back_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\Btn_BackBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\Btn_Down.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\Btn_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\Btn_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\BtnStop_Down.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\BtnStop_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\BtnStop_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\btnUpgradeDown.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\btnUpgradeNormal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\btnUpgradeOver.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\CareBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\CareWorkBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\Close_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\Close_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\halo.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\CheckBox_Checked.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\CheckBox_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\Img_Error.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\Img_NoProblem.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\Layout.ini
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\Main_Shade.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\Min_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\Min_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\More_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\More_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\Preview.jpg
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\ProgressBarBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\ProgressBarInnerBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\ProgressBarInnerLeft.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\ProgressBarInnerMid.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\ProgressBarInnerRight.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\Rescue_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\Rescue_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\ScannerBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\ScanningBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\shadow.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\Skin_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\Skin_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\tip215.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\TopBar.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\TrackBar.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\TrackBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\appimages\UpgraudD.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\css\css.css
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\images\CareBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\images\clear.gif
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\images\dailycare.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\images\deepcare.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\images\halo.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\images\hints.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\images\MainBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\images\quickcare.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\images\shadow.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\images\tip215.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\images\toolBox.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\images\toolboxs.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\images\transparent.gif
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\images\turboboostoff.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\images\turbobooston.png
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\js\action.js
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\js\action1.js
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\js\jquery-1.4.2.js
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\js\jquery.easing.1.3.js
c:\program files\IObit\Advanced SystemCare 4\UI\Flat\main.html
c:\program files\IObit\Advanced SystemCare 4\UI\China\appimages\Btn_Back_Disable.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\appimages\Btn_Back_Down.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\appimages\Btn_Back_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\appimages\Btn_Back_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\appimages\Btn_BackBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\appimages\Btn_Down.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\appimages\Btn_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\appimages\Btn_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\appimages\BtnStop_Down.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\appimages\BtnStop_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\appimages\BtnStop_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\appimages\btnUpgradeDown.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\appimages\btnUpgradeNormal.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\appimages\btnUpgradeOver.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\appimages\CareBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\appimages\CareWorkBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\appimages\Close_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\appimages\Close_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\appimages\CheckBox_Checked.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\appimages\CheckBox_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\appimages\Img_Error.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\appimages\Img_NoProblem.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\appimages\Layout.ini
c:\program files\IObit\Advanced SystemCare 4\UI\China\appimages\Main_Shade.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\appimages\Min_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\appimages\Min_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\appimages\More_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\appimages\More_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\appimages\Preview.jpg
c:\program files\IObit\Advanced SystemCare 4\UI\China\appimages\ProgressBarBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\appimages\ProgressBarInnerBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\appimages\ProgressBarInnerLeft.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\appimages\ProgressBarInnerMid.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\appimages\ProgressBarInnerRight.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\appimages\Rescue_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\appimages\Rescue_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\appimages\ScannerBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\appimages\ScanningBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\appimages\Skin_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\appimages\Skin_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\appimages\TopBar.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\appimages\TrackBar.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\appimages\TrackBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\appimages\UpgraudD.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\css\css.css
c:\program files\IObit\Advanced SystemCare 4\UI\China\images\clear.gif
c:\program files\IObit\Advanced SystemCare 4\UI\China\images\dailycare.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\images\deepcare.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\images\halo.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\images\hints.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\images\MainBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\images\quickcare.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\images\shadow.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\images\tip215.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\images\toolBox.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\images\toolboxs.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\images\transparent.gif
c:\program files\IObit\Advanced SystemCare 4\UI\China\images\turboboostoff.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\images\turbobooston.png
c:\program files\IObit\Advanced SystemCare 4\UI\China\js\action.js
c:\program files\IObit\Advanced SystemCare 4\UI\China\js\action1.js
c:\program files\IObit\Advanced SystemCare 4\UI\China\js\jquery-1.4.2.js
c:\program files\IObit\Advanced SystemCare 4\UI\China\js\jquery.easing.1.3.js
c:\program files\IObit\Advanced SystemCare 4\UI\China\main.html
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\appimages\Btn_Back_Disable.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\appimages\Btn_Back_Down.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\appimages\Btn_Back_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\appimages\Btn_Back_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\appimages\Btn_BackBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\appimages\Btn_Down.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\appimages\Btn_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\appimages\Btn_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\appimages\BtnStop_Down.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\appimages\BtnStop_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\appimages\BtnStop_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\appimages\CareBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\appimages\CareWorkBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\appimages\Close_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\appimages\Close_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\appimages\halo.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\appimages\CheckBox_Checked.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\appimages\CheckBox_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\appimages\Img_Error.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\appimages\Img_NoProblem.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\appimages\Layout.ini
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\appimages\Main_Shade.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\appimages\Min_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\appimages\Min_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\appimages\More_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\appimages\More_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\appimages\Preview.jpg
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\appimages\ProgressBarBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\appimages\ProgressBarInnerBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\appimages\ProgressBarInnerLeft.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\appimages\ProgressBarInnerMid.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\appimages\ProgressBarInnerRight.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\appimages\Rescue_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\appimages\Rescue_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\appimages\ScannerBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\appimages\ScanningBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\appimages\shadow.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\appimages\Skin_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\appimages\Skin_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\appimages\tip215.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\appimages\TopBar.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\appimages\TrackBar.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\appimages\TrackBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\appimages\UpgraudD.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\css\css.css
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\images\clear.gif
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\images\deepcare.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\images\halo.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\images\Main_Shade.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\images\MainBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\images\quickcare.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\images\shadow.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\images\tip215.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\images\toolBox.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\images\toolboxs.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\images\transparent.gif
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\images\turboboostoff.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\images\turbobooston.png
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\js\action.js
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\js\action1.js
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\js\jquery-1.4.2.js
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\js\jquery.easing.1.3.js
c:\program files\IObit\Advanced SystemCare 4\UI\Maya\main.html
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\appimages\Btn_Back_Disable.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\appimages\Btn_Back_Down.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\appimages\Btn_Back_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\appimages\Btn_Back_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\appimages\Btn_BackBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\appimages\Btn_Down.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\appimages\Btn_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\appimages\Btn_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\appimages\BtnStop_Down.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\appimages\BtnStop_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\appimages\BtnStop_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\appimages\CareBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\appimages\CareWorkBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\appimages\Close_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\appimages\Close_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\appimages\CheckBox_Checked.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\appimages\CheckBox_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\appimages\Img_Error.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\appimages\Img_NoProblem.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\appimages\Layout.ini
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\appimages\Main_Shade.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\appimages\Min_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\appimages\Min_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\appimages\More_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\appimages\More_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\appimages\Preview.jpg
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\appimages\ProgressBarBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\appimages\ProgressBarInnerBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\appimages\ProgressBarInnerLeft.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\appimages\ProgressBarInnerMid.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\appimages\ProgressBarInnerRight.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\appimages\Rescue_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\appimages\Rescue_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\appimages\ScannerBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\appimages\ScanningBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\appimages\Skin_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\appimages\Skin_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\appimages\TopBar.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\appimages\TrackBar.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\appimages\TrackBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\css\css.css
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\images\clear.gif
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\images\deepcare.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\images\MainBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\images\quickcare.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\images\tip215.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\images\toolBox.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\images\transparent.gif
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\images\turboboostoff.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\images\turbobooston.png
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\js\action.js
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\js\action1.js
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\js\jquery-1.4.2.js
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\js\jquery.easing.1.3.js
c:\program files\IObit\Advanced SystemCare 4\UI\Metal\main.html
c:\program files\IObit\Advanced SystemCare 4\UI\Office\appimages\Btn_Back_Disable.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\appimages\Btn_Back_Down.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\appimages\Btn_Back_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\appimages\Btn_Back_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\appimages\Btn_BackBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\appimages\Btn_Down.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\appimages\Btn_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\appimages\Btn_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\appimages\BtnStop_Down.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\appimages\BtnStop_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\appimages\BtnStop_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\appimages\CareBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\appimages\CareWorkBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\appimages\Close_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\appimages\Close_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\appimages\CheckBox_Checked.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\appimages\CheckBox_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\appimages\Img_Error.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\appimages\Img_NoProblem.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\appimages\Layout.ini
c:\program files\IObit\Advanced SystemCare 4\UI\Office\appimages\Main_Shade.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\appimages\Min_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\appimages\Min_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\appimages\More_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\appimages\More_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\appimages\Preview.jpg
c:\program files\IObit\Advanced SystemCare 4\UI\Office\appimages\ProgressBarBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\appimages\ProgressBarInnerBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\appimages\ProgressBarInnerLeft.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\appimages\ProgressBarInnerMid.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\appimages\ProgressBarInnerRight.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\appimages\Rescue_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\appimages\Rescue_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\appimages\ScannerBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\appimages\ScanningBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\appimages\Skin_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\appimages\Skin_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\appimages\TopBar.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\appimages\TrackBar.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\appimages\TrackBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\css\css.css
c:\program files\IObit\Advanced SystemCare 4\UI\Office\images\clear.gif
c:\program files\IObit\Advanced SystemCare 4\UI\Office\images\deepcare.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\images\MainBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\images\quickcare.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\images\tip215.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\images\toolBox.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\images\transparent.gif
c:\program files\IObit\Advanced SystemCare 4\UI\Office\images\turboboostoff.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\images\turbobooston.png
c:\program files\IObit\Advanced SystemCare 4\UI\Office\js\action.js
c:\program files\IObit\Advanced SystemCare 4\UI\Office\js\action1.js
c:\program files\IObit\Advanced SystemCare 4\UI\Office\js\jquery-1.4.2.js
c:\program files\IObit\Advanced SystemCare 4\UI\Office\js\jquery.easing.1.3.js
c:\program files\IObit\Advanced SystemCare 4\UI\Office\main.html
c:\program files\IObit\Advanced SystemCare 4\UI\Public\js\action.js
c:\program files\IObit\Advanced SystemCare 4\UI\Public\js\jquery-1.4.2.js
c:\program files\IObit\Advanced SystemCare 4\UI\Public\js\jquery.easing.1.3.js
c:\program files\IObit\Advanced SystemCare 4\UI\Public\upgrade\btnMLDown.png
c:\program files\IObit\Advanced SystemCare 4\UI\Public\upgrade\btnMLNormal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Public\upgrade\btnMLOver.png
c:\program files\IObit\Advanced SystemCare 4\UI\Public\upgrade\btnUpgradeDown.png
c:\program files\IObit\Advanced SystemCare 4\UI\Public\upgrade\btnUpgradeNormal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Public\upgrade\btnUpgradeOver.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\Btn_Back_Disable.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\Btn_Back_Down.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\Btn_Back_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\Btn_Back_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\Btn_BackBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\Btn_Down.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\Btn_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\Btn_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\BtnStop_Down.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\BtnStop_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\BtnStop_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\btnUpgradeDown.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\btnUpgradeNormal.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\btnUpgradeOver.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\CareBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\CareWorkBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\Close_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\Close_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\halo.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\CheckBox_Checked.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\CheckBox_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\Img_Error.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\Img_NoProblem.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\Layout.ini
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\Main_Shade.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\Min_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\Min_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\More_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\More_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\Preview.jpg
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\ProgressBarBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\ProgressBarInnerBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\ProgressBarInnerLeft.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\ProgressBarInnerMid.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\ProgressBarInnerRight.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\Rescue_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\Rescue_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\ScannerBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\ScanningBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\shadow.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\Skin_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\Skin_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\tip215.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\TopBar.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\TrackBar.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\TrackBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\appimages\UpgraudD.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\css\css.css
c:\program files\IObit\Advanced SystemCare 4\UI\White\images\clear.gif
c:\program files\IObit\Advanced SystemCare 4\UI\White\images\deepcare.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\images\halo.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\images\MainBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\images\quickcare.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\images\shadow.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\images\tip215.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\images\toolBox.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\images\toolboxs.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\images\transparent.gif
c:\program files\IObit\Advanced SystemCare 4\UI\White\images\turboboostoff.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\images\turbobooston.png
c:\program files\IObit\Advanced SystemCare 4\UI\White\js\action.js
c:\program files\IObit\Advanced SystemCare 4\UI\White\js\action1.js
c:\program files\IObit\Advanced SystemCare 4\UI\White\js\jquery-1.4.2.js
c:\program files\IObit\Advanced SystemCare 4\UI\White\js\jquery.easing.1.3.js
c:\program files\IObit\Advanced SystemCare 4\UI\White\main.html
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\Btn_Back_Disable.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\Btn_Back_Down.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\Btn_Back_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\Btn_Back_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\Btn_BackBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\Btn_Down.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\Btn_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\Btn_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\BtnStop_Down.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\BtnStop_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\BtnStop_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\btnUpgradeDown.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\btnUpgradeNormal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\btnUpgradeOver.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\CareBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\CareWorkBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\Close_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\Close_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\halo.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\CheckBox_Checked.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\CheckBox_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\Img_Error.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\Img_NoProblem.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\Layout.ini
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\Main_Shade.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\Min_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\Min_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\More_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\More_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\Preview.jpg
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\ProgressBarBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\ProgressBarInnerBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\ProgressBarInnerLeft.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\ProgressBarInnerMid.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\ProgressBarInnerRight.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\Rescue_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\Rescue_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\ScannerBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\ScanningBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\shadow.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\Skin_Move.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\Skin_Normal.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\tip215.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\TopBar.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\TrackBar.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\appimages\TrackBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\css\css.css
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\images\btnUpgradeDown.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\images\clear.gif
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\images\dailycare.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\images\deepcare.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\images\halo.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\images\hints.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\images\MainBG.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\images\quickcare.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\images\shadow.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\images\tip215.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\images\toolBox.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\images\toolboxs.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\images\transparent.gif
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\images\turboboostoff.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\images\turbobooston.png
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\js\action.js
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\js\action1.js
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\js\jquery-1.4.2.js
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\js\jquery.easing.1.3.js
c:\program files\IObit\Advanced SystemCare 4\UI\Wood\main.html
c:\program files\IObit\Advanced SystemCare 4\UnDelete.dll
c:\program files\IObit\Advanced SystemCare 4\unins000.dat
c:\program files\IObit\Advanced SystemCare 4\unins000.exe
c:\program files\IObit\Advanced SystemCare 4\unins000.msg
c:\program files\IObit\Advanced SystemCare 4\Update\Update.Ini
c:\program files\IObit\Advanced SystemCare 4\vcl120.bpl
c:\program files\IObit\Advanced SystemCare 4\vclx120.bpl
c:\program files\IObit\Advanced SystemCare 4\Wizard.exe
c:\program files\IObit\IObit Malware Fighter\IMFShellExt.dll
c:\windows\av_ico
c:\windows\av_ico\ico_NOD_SS_START.ico
c:\windows\av_ico\ico_NOD_SYSINSP.ico
c:\windows\av_ico\ico_NOD_SYSRESC.ico
c:\windows\av_ico\ico_NOD_TXT.ico
c:\windows\av_ico\ico_NOD_UNINSTALL.ico
c:\windows\phoenix
c:\windows\phoenix\kernels\phatk\__init__.py
c:\windows\phoenix\kernels\phatk\BFIPatcher.py
c:\windows\phoenix\kernels\phatk\kernel.cl
c:\windows\phoenix\kernels\poclbm\__init__.py
c:\windows\phoenix\kernels\poclbm\BFIPatcher.py
c:\windows\phoenix\kernels\poclbm\kernel.cl
c:\windows\phoenix\phoenix.exe
c:\windows\proc_list1.log
c:\windows\rpcminer
c:\windows\rpcminer\bitcoinminercuda_10.cubin
c:\windows\rpcminer\bitcoinminercuda_11.cubin
c:\windows\rpcminer\bitcoinminercuda_20.cubin
c:\windows\rpcminer\bitcoinmineropencl.cl
c:\windows\rpcminer\cudart32_32_16.dll
c:\windows\rpcminer\curllib.dll
c:\windows\rpcminer\libeay32.dll
c:\windows\rpcminer\libsasl.dll
c:\windows\rpcminer\openldap.dll
c:\windows\rpcminer\rpcminer-4way.exe
c:\windows\rpcminer\rpcminer-cpu.exe
c:\windows\rpcminer\rpcminer-cuda.exe
c:\windows\rpcminer\rpcminer-opencl.exe
c:\windows\rpcminer\ssleay32.dll
c:\windows\system32\sysaddei34.dll
c:\windows\Tasks\AppleSoftwareUpdate.job
c:\windows\Tasks\ASC4_PerformanceMonitor.job
c:\windows\tellei34.sys
c:\windows\ufa
c:\windows\ufa\ufa.exe
c:\windows\unrar.exe
c:\windows\update.tray-3-0-lnk
c:\windows\update.tray-3-0-lnk\svchost.exe
c:\windows\update.tray-3-0
c:\windows\update.tray-3-0\svchost.exe
Uisti sa, kde spravíš nasledujúci krok, aby si náhodou nespadol. :)
Nahoru
Uživatelský avatar
Patriciusd
Návštěvník
Návštěvník
Příspěvky: 82
Registrován: 28 úno 2011 08:59

Re: Facebook vírus prosím pomoc

#11 Příspěvek od Patriciusd »

pokračovanie....


.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_ADVANCEDSYSTEMCARESERVICE
-------\Service_AdvancedSystemCareService
.
.
((((((((((((((((((((((((( Files Created from 2011-06-25 to 2011-07-25 )))))))))))))))))))))))))))))))
.
.
2011-07-25 08:44 . 2011-07-25 08:44 -------- d-----w- c:\program files\CCleaner
2011-07-25 08:05 . 2011-07-25 08:05 -------- d-----w- c:\documents and settings\LocalService\Nabídka Start
2011-07-12 16:56 . 2011-07-12 16:56 -------- d-----w- c:\documents and settings\Rudo\Data aplikací\Salling Software AB
2011-07-12 16:56 . 2011-07-12 16:56 360580 ----a-w- c:\windows\eSellerateEngine.dll
2011-07-12 12:01 . 2011-07-12 12:01 -------- d-----w- c:\documents and settings\Rudo\Data aplikací\GetRightToGo
2011-07-12 06:48 . 2011-07-12 06:48 -------- d-----w- c:\documents and settings\All Users\Data aplikací\SRS Labs
2011-07-11 17:14 . 2011-03-11 14:10 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
2011-07-11 17:12 . 2011-07-11 17:12 -------- d-----w- c:\windows\system32\winrm
2011-07-11 17:12 . 2011-07-11 17:12 -------- d-----w- c:\windows\system32\GroupPolicy
2011-07-11 17:12 . 2011-07-11 17:13 -------- dc-h--w- c:\windows\$968930Uinstall_KB968930$
2011-07-11 16:52 . 2011-07-11 16:53 -------- d-----w- c:\documents and settings\All Users\Data aplikací\IObit
2011-07-11 16:50 . 2011-07-11 16:53 -------- d-----w- c:\documents and settings\Rudo\Data aplikací\IObit
2011-07-08 14:01 . 2011-03-04 19:44 59888 ------w- c:\windows\system32\pxwma.dll
2011-07-08 14:01 . 2011-07-25 17:07 -------- d-----w- c:\documents and settings\Rudo\Data aplikací\Winamp
2011-07-08 14:01 . 2011-07-08 14:01 -------- d-----w- c:\documents and settings\Rudo\Data aplikací\OpenCandy
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-25 08:58 . 2011-05-18 05:11 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-08 14:05 . 2011-04-05 14:44 2627 ----a-w- c:\windows\system32\smport.sys
2011-06-06 11:35 . 2008-04-14 12:00 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-06-02 13:44 . 2011-06-02 13:41 5312 ----a-w- c:\windows\BricoPackFoldersDelete.cmd
2011-06-02 13:44 . 2010-06-09 12:44 71634 ----a-w- c:\windows\BricoPackUninst.cmd
2011-05-29 07:11 . 2011-04-03 13:16 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-29 07:11 . 2011-04-03 13:16 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-05-02 15:32 . 2010-03-05 10:12 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-04-29 17:25 . 2008-04-14 12:00 151552 ----a-w- c:\windows\system32\schannel.dll
2011-04-29 16:19 . 2008-04-14 12:00 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-06-25 16:14 . 2011-05-06 13:18 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2009-08-06 . 0B6DABD6FFF1AD42A3CD65A1C7EE8F35 . 68832 . . [7.4.7600.226] . . c:\windows\system32\wuauclt.exe
[-] 2009-08-06 . 0B6DABD6FFF1AD42A3CD65A1C7EE8F35 . 68832 . . [7.4.7600.226] . . c:\windows\system32\dllcache\wuauclt.exe
.
[-] 2008-04-14 . 13E794E5591776CBC71055A7B3CC1D5F . 976384 . . [6.00.2900.5512] . . c:\windows\explorer.exe
[-] 2008-04-14 . 13E794E5591776CBC71055A7B3CC1D5F . 976384 . . [6.00.2900.5512] . . c:\windows\system32\dllcache\explorer.exe
.
[-] 2008-04-14 . ED69B3B6CD23D1D00815D5F70D517E01 . 225792 . . [5.1.2600.5512] . . c:\windows\regedit.exe
[-] 2008-04-14 . ED69B3B6CD23D1D00815D5F70D517E01 . 225792 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\regedit.exe
.
[-] 2008-04-14 . D008D88ED7D047B78A504986DF5647EE . 832512 . . [6.00.2900.5512] . . c:\windows\system32\dllcache\iexplore.exe
.
((((((((((((((((((((((((((((( SnapShot@2011-07-25_18.12.45 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-07-25 18:55 . 2011-07-25 18:55 16384 c:\windows\temp\Perflib_Perfdata_4f8.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 577536]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="nwiz.exe" [2008-05-16 1630208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 86016]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableSecureUIAPaths"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2008-05-16 13:01 13529088 ----a-w- c:\windows\system32\nvcpl.dll
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AntikVirtualSTB\\AntikVirtualSTB.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\totalcmd\\TOTALCMD.EXE"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R0 BtHidBus;Bluetooth HID Bus Service;c:\windows\system32\drivers\BtHidBus.sys [6. 4. 2010 18:32 20104]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [9. 8. 2010 17:32 691696]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [16. 11. 2009 9:03 108792]
S2 ekrn;ESET Service;"c:\program files\ESET\ESET Smart Security\ekrn.exe" --> c:\program files\ESET\ESET Smart Security\ekrn.exe [?]
S3 BTCOM;Bluetooth Serial port driver;c:\windows\system32\DRIVERS\btcomport.sys --> c:\windows\system32\DRIVERS\btcomport.sys [?]
S3 BTCOMBUS;Bluetooth Serial Port Bus Service;c:\windows\system32\Drivers\btcombus.sys --> c:\windows\system32\Drivers\btcombus.sys [?]
S3 btnetBUs;Bluetooth PAN Bus Service;c:\windows\system32\drivers\btnetBus.sys [6. 4. 2010 18:33 25864]
S3 IvtBtBUs;IVT Bluetooth Bus Service;c:\windows\system32\drivers\IvtBtBus.sys [6. 4. 2010 18:32 23048]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [7. 1. 2011 23:35 137344]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [7. 1. 2011 23:35 8320]
S3 PRODIGY;PRODIGY;c:\windows\system32\drivers\prodigy.sys [8. 5. 2011 20:37 32377]
S3 Smport;Smport;c:\windows\system32\smport.sys [5. 4. 2011 16:44 2627]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [14. 4. 2008 14:00 14336]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
WINRM REG_MULTI_SZ WINRM
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.sk/
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\documents and settings\Rudo\Data aplikací\Mozilla\Firefox\Profiles\3556j5fn.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - google.sk
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-Advanced SystemCare 4_is1 - c:\program files\IObit\Advanced SystemCare 4\unins000.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-07-25 20:55
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-789336058-179605362-1177238915-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(1236)
c:\windows\system32\msi.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\credui.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\nvsvc32.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\RUNDLL32.EXE
c:\windows\system32\rundll32.exe
c:\windows\SOUNDMAN.EXE
.
**************************************************************************
.
Completion time: 2011-07-25 20:59:34 - machine was rebooted
ComboFix-quarantined-files.txt 2011-07-25 18:59
ComboFix2.txt 2011-07-25 18:17
.
Pre-Run: 9 584 869 376
Post-Run: 9 516 707 840
.
- - End Of File - - 3C99789E4D9630F499FF5871DB7B7D2C
Upload was successful
Uisti sa, kde spravíš nasledujúci krok, aby si náhodou nespadol. :)
Nahoru
Uživatelský avatar
vyosek
VIP
VIP
Příspěvky: 56373
Registrován: 07 lis 2006 15:24
Bydliště: Šalingrad - Brno

Re: Facebook vírus prosím pomoc

#12 Příspěvek od vyosek »

Jak se chova PC :???:
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Uživatelský avatar
Patriciusd
Návštěvník
Návštěvník
Příspěvky: 82
Registrován: 28 úno 2011 08:59

Re: Facebook vírus prosím pomoc

#13 Příspěvek od Patriciusd »

Vyzerá byť v poriadku :)
Uisti sa, kde spravíš nasledujúci krok, aby si náhodou nespadol. :)
Nahoru
Uživatelský avatar
vyosek
VIP
VIP
Příspěvky: 56373
Registrován: 07 lis 2006 15:24
Bydliště: Šalingrad - Brno

Re: Facebook vírus prosím pomoc

#14 Příspěvek od vyosek »

Tak jeste uklidime :James008:

:arrow: Odinstalujte Combofix
  • Start - Spustit (nebo pouzijte klavesobou zkratku Win+R)
  • Napiste ComboFix /UninstallA
  • Stisknete Enter
  • Tohle smaze Combofix a jeho slozky
:arrow: T-Cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe
  • Stahnete a spustte
  • Pro potvrzeni volby mackejte A, Enter
  • Po pouziti utilitu smazte
  • Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)
:arrow: OTC http://oldtimer.geekstogo.com/OTC.exe
  • Stahnete a spustte
  • Kliknete na CleanUp a potvrdte YES
  • Program uklidi a restartuje PC

:arrow: TFC http://oldtimer.geekstogo.com/TFC.exe
  • Stahnete a spustte
  • Kliknete na Start a potvrdte OK
  • Program uklidi a restartuje pc
  • Po pouziti utilitu smazte
:arrow: Stahnete Ccleaner (viz muj podpis)
Panel čistič
  • Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner
Panel registry
  • dejte Hledej problémy
  • nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
  • postup opakujte dokud nebude bez problemu - vetsinou cca 3x
Panel nástroje
  • Zde muzete odinstalovat nepotrebne programy
CCleaner doporucuji pouzivat cca jednou za tyden

:arrow: A pokud nejsou problemy ci dotazy, je to z me strany vse :turned:
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Uživatelský avatar
Patriciusd
Návštěvník
Návštěvník
Příspěvky: 82
Registrován: 28 úno 2011 08:59

Re: Facebook vírus prosím pomoc

#15 Příspěvek od Patriciusd »

Všetko som urobil podľa Vašich pokynov veľmi pekne Vám ďakujem, že ste mi pomohli .
Trápi ma ešte jedna vec, po otvorení nástrojov pre konfiguráciu systému sa dostanem do zložky po spustení jedna vec tam nie je zaškrtnutá : NvCplDaemon ...... ktorý sa nachádza vo WINDOWS/system32NvCpl.dll ......... mám to ponechať takto, alebo mam zaškrtnúť?
Uisti sa, kde spravíš nasledujúci krok, aby si náhodou nespadol. :)
Nahoru
Odpovědět

Zpět na „Řešení problémů, logy“