FB vir

[Kopecz]

Logfile of random's system information tool 1.09 (written by random/random)
Run by admin at 2011-08-29 09:42:27
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 268 GB (89%) free of 300 GB
Total RAM: 3580 MB (65% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:42:34, on 29.8.2011
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\RegCure\RegCure.exe
C:\Windows\PixArt\Pac207\Monitor.exe
C:\Program Files (x86)\Common Files\Nero\Lib\NMBgMonitor.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\HpqSRmon.exe
C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.8\facemoodssrv.exe
C:\Windows\update.tray-3-0\svchost.exe
C:\Windows\update.tray-9-0\svchost.exe
C:\Windows\sysdriver32.exe
C:\Windows\sysdriver32_.exe
C:\Windows\systemup.exe
C:\Program Files\trend micro\admin.exe
C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.qip.ru
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bigseekpro.com/facesmooch3a/ ... 5EBB2DB885}
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=vsl&s={searchTerms}&f=4
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: QIPBHO Class - {95289393-33EA-4F8D-B952-483415B9C955} - C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: HiGames Toolbar - {64d23501-5195-4224-9446-e2b0fb64e859} - C:\Program Files (x86)\HiGames\prxtbHiG0.dll
R3 - URLSearchHook: Babylon-English Toolbar - {ce18769b-c7fa-42d2-860d-17c4662c70ad} - (no file)
R3 - URLSearchHook: Hot MP3 Toolbar - {9384bd4c-dd14-4be9-80f7-f6277511e4f5} - C:\Program Files (x86)\Hot_MP3\prxtbHot0.dll
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~1\mcafee\msk\mskapbho.dll (file missing)
O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll
O2 - BHO: facemoods Helper - {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.8\bh\facemoods.dll
O2 - BHO: HiGames - {64d23501-5195-4224-9446-e2b0fb64e859} - C:\Program Files (x86)\HiGames\prxtbHiG0.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20110821184232.dll (file missing)
O2 - BHO: Pomocná služba pro přihlášení ke službě Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Hot MP3 - {9384bd4c-dd14-4be9-80f7-f6277511e4f5} - C:\Program Files (x86)\Hot_MP3\prxtbHot0.dll
O2 - BHO: QIPBHO - {95289393-33EA-4F8D-B952-483415B9C955} - C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll
O2 - BHO: Freecause Shopping BHO - {998A3C0C-8914-4D2A-AE36-BFA2E5AE6D5D} - C:\Program Files (x86)\Digsby Donates\ShoppingBHO.dll
O2 - BHO: Babylon IE plugin - {9CFACCB6-2F3F-4177-94EA-0D2B72D384C1} - (no file)
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O2 - BHO: QIPBHO - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\progra~2\mcafee\sitead~1\mcieplg.dll (file missing)
O2 - BHO: Babylon-English Toolbar - {ce18769b-c7fa-42d2-860d-17c4662c70ad} - (no file)
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: HiGames Toolbar - {64d23501-5195-4224-9446-e2b0fb64e859} - C:\Program Files (x86)\HiGames\prxtbHiG0.dll
O3 - Toolbar: PandoraTV Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: Babylon-English Toolbar - {ce18769b-c7fa-42d2-860d-17c4662c70ad} - (no file)
O3 - Toolbar: Hot MP3 Toolbar - {9384bd4c-dd14-4be9-80f7-f6277511e4f5} - C:\Program Files (x86)\Hot_MP3\prxtbHot0.dll
O3 - Toolbar: facemoods Toolbar - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.8\facemoodsTlbr.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\progra~2\mcafee\sitead~1\mcieplg.dll (file missing)
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [ApnUpdater] "C:\Program Files (x86)\Ask.com\Updater\Updater.exe"
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [facemoods] "C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.8\facemoodssrv.exe" /md I
O4 - HKLM\..\Run: [wxpdrv] C:\Windows\services32.exe
O4 - HKLM\..\Run: [tray_ico0] C:\Windows\update.tray-3-0\svchost.exe
O4 - HKLM\..\Run: [tray_ico1] C:\Windows\update.tray-9-0\svchost.exe
O4 - HKLM\..\Run: [5636658.exe] "C:\Windows\Temp\5636658.exe"
O4 - HKLM\..\Run: [sysdriver32.exe] "C:\Windows\sysdriver32.exe" rezerv
O4 - HKLM\..\Run: [sysdriver32_.exe] "C:\Windows\sysdriver32_.exe" rezerv
O4 - HKLM\..\Run: [8987280.exe] "C:\Users\admin\AppData\Local\Temp\8987280.exe"
O4 - HKLM\..\Run: [1738605.exe] "C:\Users\admin\AppData\Local\Temp\1738605.exe"
O4 - HKLM\..\Run: [57779637-loader2.exe] "C:\Windows\Temp\57779637-loader2.exe"
O4 - HKLM\..\Run: [8556620.exe] "C:\Windows\Temp\8556620.exe"
O4 - HKLM\..\Run: [reset] regedit /s reset.reg
O4 - HKLM\..\Run: [McAfee Guardian] "C:\Program Files (x86)\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe" /SU
O4 - HKLM\..\Run: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [systemup] "C:\Windows\systemup.exe" stand
O4 - HKLM\..\Run: [149369.exe] "C:\Windows\Temp\149369.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files (x86)\Common Files\Nero\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [Exetender_298] "C:\Program Files (x86)\Frag Games\GPlayer.exe" /runonstartup (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Exetender_298] "C:\Program Files (x86)\Frag Games\GPlayer.exe" /runonstartup (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Exetender_298] "C:\Program Files (x86)\Frag Games\GPlayer.exe" /runonstartup (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\admin\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm
O8 - Extra context menu item: Translate this web page with Babylon - res://C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm
O8 - Extra context menu item: Translate with Babylon - res://C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Action.htm
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - (no file)
O9 - Extra button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: Zobrazit nebo skrýt HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (file missing)
O9 - Extra 'Tools' menuitem: Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (file missing)
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~2\mcafee\sitead~1\mcieplg.dll (file missing)
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~2\mcafee\sitead~1\mcieplg.dll (file missing)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
O23 - Service: AMD Reservation Manager - Advanced Micro Devices - C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe
O23 - Service: AppleChargerSrv - Unknown owner - C:\Windows\system32\AppleChargerSrv.exe (file missing)
O23 - Service: ddservice - Unknown owner - C:\Windows\update.7.1\svchostdriver.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ES lite Service for program management. (ES lite Service) - Unknown owner - C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Unknown owner - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (file missing)
O23 - Service: McAfee Personal Firewall (McMPFSvc) - Unknown owner - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (file missing)
O23 - Service: McAfee Services (mcmscsvc) - Unknown owner - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (file missing)
O23 - Service: McAfee VirusScan Announcer (McNaiAnn) - Unknown owner - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (file missing)
O23 - Service: McAfee Network Agent (McNASvc) - Unknown owner - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (file missing)
O23 - Service: McAfee Scanner (McODS) - Unknown owner - C:\Program Files\McAfee\VirusScan\mcods.exe (file missing)
O23 - Service: McAfee Proxy Service (McProxy) - Unknown owner - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (file missing)
O23 - Service: McShield - Unknown owner - C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe (file missing)
O23 - Service: McAfee Firewall Core Service (mfefire) - Unknown owner - C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe (file missing)
O23 - Service: McAfee Validation Trust Protection Service (mfevtp) - Unknown owner - C:\Windows\system32\mfevtps.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - Unknown owner - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (file missing)
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - C:\Program Files (x86)\WinPcap\rpcapd.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: srvbtcclient - Unknown owner - C:\Windows\update.5.0\svchost.exe
O23 - Service: srviecheck - Unknown owner - C:\Windows\update.2\svchost.exe
O23 - Service: srvsysdriver32 - Unknown owner - C:\Windows\sysdriver32.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: wxpdrivers - Unknown owner - C:\Windows\update.1\svchost.exe

--
End of file - 17315 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
atieclxx
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"taskhost.exe"
C:\Windows\system32\userinit.exe
taskeng.exe {56EFC2B7-40D9-4EB0-BDBF-D1C590AD7E1C}
"C:\Windows\system32\Dwm.exe"
"C:\Program Files (x86)\RegCure\RegCure.exe" -Tray
C:\Windows\Explorer.EXE
"C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe"
C:\Windows\update.7.1\svchostdriver.exe srv
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Windows\PixArt\Pac207\Monitor.exe"
"C:\Program Files\Logitech\SetPointP\SetPoint.exe" /launchGaming
"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
"C:\Program Files (x86)\Common Files\Nero\Lib\NMBgMonitor.exe"
"C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE"
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\SysWOW64\svchost.exe -k hpdevmgmt
"C:\Windows\system32\mfevtps.exe"
KHALMNPR.EXE /API
"C:\Program Files (x86)\HP\Digital Imaging\bin\HpqSRmon.exe"
"C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe"
"C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.8\facemoodssrv.exe" /md I
"C:\Windows\update.tray-3-0\svchost.exe"
"C:\Windows\update.7.1\svchostdriver.exe" stand
"C:\Windows\update.tray-9-0\svchost.exe"
"C:\Windows\sysdriver32.exe" rezerv
"C:\Windows\sysdriver32_.exe" rezerv
"C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
"C:\Windows\systemup.exe" stand
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\update.5.0\svchost.exe srv
"C:\Users\admin\Desktop\RSITx64.exe"
C:\Windows\update.2\svchost.exe srv
"C:\Windows\update.5.0\svchost.exe" stand
C:\Windows\sysdriver32.exe srv
"C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe"
"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"
C:\Windows\update.1\svchost.exe srv
C:\Windows\system32\wbem\wmiprvse.exe
WLIDSvcM.exe 3780
"C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesApp64.exe" /TUStart /pid:3772
"C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe" /launchService
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe"
"C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe" -Embedding
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

======Scheduled tasks folder======

C:\Windows\tasks\RegCure Program Check.job
C:\Windows\tasks\RegCure.job

=========Mozilla firefox=========

ProfilePath - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\rwe7uvgb.default

prefs.js - "browser.search.useDBForOrder" - true
prefs.js - "browser.startup.homepage" - "http://www.seznam.cz/"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/ShockwavePlayer]
"Description"=Adobe Shockwave Player
"Path"=C:\Windows\system32\Adobe\Director\np32dsw.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922]
"Description"=WLPG Install MIME type
"Path"=

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=8]
"Description"=Google Update
"Path"=

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

C:\Program Files (x86)\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}

C:\Program Files (x86)\Mozilla Firefox\components\
binary.manifest
browsercomps.dll
flashplayer.xpt
nsIQTScriptablePlugin.xpt
Scriptff.dll

C:\Program Files (x86)\Mozilla Firefox\plugins\
np-mswmp.dll
np32dsw.dll
npdeployJava1.dll
nppdf32.dll
npqtplugin.dll
npqtplugin2.dll
npqtplugin3.dll
npqtplugin4.dll
npqtplugin5.dll
npqtplugin6.dll
npqtplugin7.dll
QuickTimePlugin.class
ShockwavePlugin.class
WMP Firefox Plugin License.rtf
WMP Firefox Plugin RelNotes.txt

C:\Program Files (x86)\Mozilla Firefox\searchplugins\
babylon.xml
fcmdSrchvsl.xml
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\rwe7uvgb.default\extensions\
engine@conduit.com
{32a1fd71-835e-4b11-8e54-886fda0b4c89}
{7b13ec3e-999a-4b70-b9cb-2617b8323822}
{ACAA314B-EEBA-48e4-AD47-84E31C44796C}

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27B4851A-3207-45A2-B947-BE8AFE6163AB}]
McAfee Phishing Filter - c:\PROGRA~1\mcafee\msk\MSKAPB~1.DLL []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7DB2D5A0-7241-4E79-B68D-6309F01C5231}]
scriptproxy - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20110821184232.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21 529280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}]
McAfee SiteAdvisor BHO - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0347C33E-8762-4905-BF09-768834316C61}]
HP Print Enhancer - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll [2009-09-20 328248]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-06-06 63912]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27B4851A-3207-45A2-B947-BE8AFE6163AB}]
McAfee Phishing Filter - c:\progra~1\mcafee\msk\mskapbho.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
Conduit Engine - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll [2011-01-17 175912]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64182481-4F71-486b-A045-B233BD0DA8FC}]
CescrtHlpr Object - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.8\bh\facemoods.dll [2011-04-14 265944]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64d23501-5195-4224-9446-e2b0fb64e859}]
HiGames Toolbar - C:\Program Files (x86)\HiGames\prxtbHiG0.dll [2011-01-17 175912]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7DB2D5A0-7241-4E79-B68D-6309F01C5231}]
scriptproxy - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20110821184232.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocná služba pro přihlášení ke službě Windows Live ID - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21 439168]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9384bd4c-dd14-4be9-80f7-f6277511e4f5}]
Hot MP3 Toolbar - C:\Program Files (x86)\Hot_MP3\prxtbHot0.dll [2011-01-17 175912]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95289393-33EA-4F8D-B952-483415B9C955}]
QIPBHO Class - C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll [2010-12-13 141184]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{998A3C0C-8914-4D2A-AE36-BFA2E5AE6D5D}]
Digsby Donates - C:\Program Files (x86)\Digsby Donates\ShoppingBHO.dll [2011-05-29 682496]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9CFACCB6-2F3F-4177-94EA-0D2B72D384C1}]
Babylon IE plugin

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9FDDE16B-836F-4806-AB1F-1455CBEFF289}]
Windows Live Messenger Companion Helper - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll [2010-11-10 393600]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}]
QIPBHO Class - C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll [2010-12-13 141184]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}]
McAfee SiteAdvisor BHO - c:\progra~2\mcafee\sitead~1\mcieplg.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ce18769b-c7fa-42d2-860d-17c4662c70ad}]
Babylon-English Toolbar

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
PandoraTV Toolbar - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll [2011-05-17 1490312]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2011-05-04 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856}]
HP Smart BHO Class - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2009-09-20 509496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{32099AAC-C132-4136-9E9A-4E364A424E17} -
{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - McAfee SiteAdvisor Toolbar - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{64d23501-5195-4224-9446-e2b0fb64e859} - HiGames Toolbar - C:\Program Files (x86)\HiGames\prxtbHiG0.dll [2011-01-17 175912]
{D4027C7F-154A-4066-A1AD-4243D8127440} - PandoraTV Toolbar - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll [2011-05-17 1490312]
{ce18769b-c7fa-42d2-860d-17c4662c70ad} -
{9384bd4c-dd14-4be9-80f7-f6277511e4f5} - Hot MP3 Toolbar - C:\Program Files (x86)\Hot_MP3\prxtbHot0.dll [2011-01-17 175912]
{DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - facemoods Toolbar - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.8\facemoodsTlbr.dll [2011-04-14 220888]
{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - McAfee SiteAdvisor Toolbar - c:\progra~2\mcafee\sitead~1\mcieplg.dll []

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2010-04-06 10144288]
"Monitor"=C:\Windows\PixArt\PAC207\Monitor.exe [2006-11-03 319488]
"System"=C:\Program Files\system32.exe [2011-05-27 21778]
"EvtMgr6"=C:\Program Files\Logitech\SetPointP\SetPoint.exe [2010-10-29 1680976]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe /hide /waitservice []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-20 1475584]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files (x86)\Common Files\Nero\Lib\NMBgMonitor.exe [2007-09-20 202024]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"hpqSRMon"=C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe [2008-07-22 150528]
"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2011-01-26 336384]
"ApnUpdater"=C:\Program Files (x86)\Ask.com\Updater\Updater.exe [2011-05-17 395144]
"NBKeyScan"=C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [2007-09-20 1836328]
"facemoods"=C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.8\facemoodssrv.exe [2011-04-14 329432]
"wxpdrv"=C:\Windows\services32.exe [2011-08-21 1213440]
"tray_ico"= []
"tray_ico0"=C:\Windows\update.tray-3-0\svchost.exe [2011-08-21 1213440]
"tray_ico1"=C:\Windows\update.tray-9-0\svchost.exe [2011-08-21 1213440]
"tray_ico2"= []
"tray_ico3"= []
"tray_ico4"= []
"5636658.exe"=C:\Windows\Temp\5636658.exe [2011-08-21 258048]
"sysdriver32.exe"=C:\Windows\sysdriver32.exe [2011-08-21 258048]
"sysdriver32_.exe"=C:\Windows\sysdriver32_.exe [2011-08-21 258048]
"8987280.exe"=C:\Users\admin\AppData\Local\Temp\8987280.exe [2011-08-21 258048]
"1738605.exe"=C:\Users\admin\AppData\Local\Temp\1738605.exe [2011-08-21 258048]
"57779637-loader2.exe"=C:\Windows\Temp\57779637-loader2.exe [2011-08-21 258048]
"8556620.exe"=C:\Windows\Temp\8556620.exe [2011-08-21 258048]
"reset"=regedit /s reset.reg []
"McAfee Guardian"=C:\Program Files (x86)\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe /SU []
"mcui_exe"=C:\Program Files\McAfee.com\Agent\mcagent.exe [2010-08-04 1466840]
"systemup"=C:\Windows\systemup.exe [2011-08-29 130560]
"149369.exe"=C:\Windows\Temp\149369.exe [2011-08-24 636416]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wxpdrivers]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\McMPFSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mcmscsvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mfefire]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mfefirek]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mfefirek.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\wxpdrivers]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableSecureUIAPaths"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2011-08-29 09:39:07 ----DC---- C:\rsit
2011-08-29 09:39:07 ----D---- C:\Program Files\trend micro
2011-08-27 21:41:09 ----HD---- C:\Windows\update.8.1
2011-08-24 08:34:32 ----D---- C:\Windows\SYSWOW64\xlive
2011-08-24 08:34:15 ----A---- C:\Windows\SYSWOW64\tzres.dll
2011-08-24 08:34:15 ----A---- C:\Windows\system32\tzres.dll
2011-08-22 09:21:03 ----DC---- C:\$UPGRADE.~OS
2011-08-22 08:53:40 ----HD---- C:\Windows\update.tray-9-0-lnk
2011-08-22 08:53:40 ----HD---- C:\Windows\update.tray-3-0-lnk
2011-08-22 08:35:19 ----A---- C:\Windows\systemup.exe
2011-08-21 18:43:11 ----D---- C:\Program Files (x86)\SiteAdvisor
2011-08-21 18:42:31 ----A---- C:\Windows\system32\drivers\mfeclnk.sys
2011-08-21 18:42:09 ----A---- C:\Windows\system32\mfevtps.exe
2011-08-21 18:42:07 ----A---- C:\Windows\system32\drivers\mfewfpk.sys
2011-08-21 18:42:07 ----A---- C:\Windows\system32\drivers\mferkdet.sys
2011-08-21 18:42:07 ----A---- C:\Windows\system32\drivers\mfenlfk.sys
2011-08-21 18:42:07 ----A---- C:\Windows\system32\drivers\mfehidk.sys
2011-08-21 18:42:07 ----A---- C:\Windows\system32\drivers\mfefirek.sys
2011-08-21 18:42:07 ----A---- C:\Windows\system32\drivers\mfeavfk.sys
2011-08-21 18:42:07 ----A---- C:\Windows\system32\drivers\cfwids.sys
2011-08-21 18:42:04 ----D---- C:\Program Files\McAfee.com
2011-08-21 17:49:22 ----D---- C:\Windows\ufa
2011-08-21 17:49:22 ----D---- C:\Windows\rpcminer
2011-08-21 17:49:22 ----D---- C:\Windows\phoenix
2011-08-21 17:40:53 ----A---- C:\Windows\unrar.exe
2011-08-21 17:40:48 ----HD---- C:\Windows\update.7.1
2011-08-21 17:40:24 ----A---- C:\Windows\iecheck_iplist.txt
2011-08-21 17:39:59 ----HD---- C:\Windows\update.2
2011-08-21 17:39:44 ----A---- C:\Windows\btc_client_iplist.txt
2011-08-21 17:38:55 ----HD---- C:\Windows\update.5.0
2011-08-21 17:38:36 ----A---- C:\Windows\iplist.txt
2011-08-21 17:37:47 ----A---- C:\Windows\sysdriver32_.exe
2011-08-21 17:37:31 ----A---- C:\Windows\sysdriver32.exe
2011-08-21 17:37:15 ----D---- C:\Windows\av_ico
2011-08-21 17:37:12 ----A---- C:\Windows\front_ip_list.txt
2011-08-21 17:36:02 ----HD---- C:\Windows\update.1
2011-08-21 17:36:01 ----HD---- C:\Windows\update.tray-9-0
2011-08-21 17:36:00 ----HD---- C:\Windows\update.tray-3-0
2011-08-21 17:26:34 ----A---- C:\Windows\winlog-ids.txt
2011-08-21 17:26:34 ----A---- C:\Windows\winlog-dirs.txt
2011-08-21 17:26:30 ----A---- C:\Windows\services32.exe
2011-08-18 12:32:49 ----D---- C:\Program Files (x86)\Atari
2011-08-17 07:12:11 ----D---- C:\ProgramData\Electronic Arts
2011-08-16 09:45:25 ----D---- C:\Program Files (x86)\facemoods.com
2011-08-15 20:10:51 ----D---- C:\Program Files (x86)\AVI to 3GP
2011-08-12 15:28:00 ----D---- C:\Program Files (x86)\Download Master
2011-08-12 15:26:35 ----D---- C:\Program Files (x86)\REDEMAX
2011-08-10 11:56:13 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2011-08-10 11:56:13 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2011-08-10 11:56:13 ----A---- C:\Windows\system32\mshtmled.dll
2011-08-10 11:56:13 ----A---- C:\Windows\system32\iertutil.dll
2011-08-10 11:56:12 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2011-08-10 11:56:12 ----A---- C:\Windows\SYSWOW64\url.dll
2011-08-10 11:56:12 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2011-08-10 11:56:12 ----A---- C:\Windows\SYSWOW64\jscript.dll
2011-08-10 11:56:12 ----A---- C:\Windows\SYSWOW64\ieui.dll
2011-08-10 11:56:12 ----A---- C:\Windows\system32\urlmon.dll
2011-08-10 11:56:12 ----A---- C:\Windows\system32\url.dll
2011-08-10 11:56:12 ----A---- C:\Windows\system32\jscript9.dll
2011-08-10 11:56:12 ----A---- C:\Windows\system32\jscript.dll
2011-08-10 11:56:12 ----A---- C:\Windows\system32\ieui.dll
2011-08-10 11:56:11 ----A---- C:\Windows\SYSWOW64\wininet.dll
2011-08-10 11:56:11 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2011-08-10 11:56:11 ----A---- C:\Windows\system32\wininet.dll
2011-08-10 11:56:11 ----A---- C:\Windows\system32\jsproxy.dll
2011-08-10 11:56:10 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2011-08-10 11:56:09 ----A---- C:\Windows\system32\mshtml.dll
2011-08-10 11:56:08 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2011-08-10 11:56:08 ----A---- C:\Windows\system32\ieframe.dll
2011-08-10 11:55:24 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2011-08-10 11:55:23 ----A---- C:\Windows\SYSWOW64\xmllite.dll
2011-08-10 11:55:23 ----A---- C:\Windows\system32\xmllite.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2011-08-10 11:55:22 ----A---- C:\Windows\SYSWOW64\wow32.dll
2011-08-10 11:55:22 ----A---- C:\Windows\SYSWOW64\setup16.exe
2011-08-10 11:55:22 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2011-08-10 11:55:22 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2011-08-10 11:55:22 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2011-08-10 11:55:22 ----A---- C:\Windows\system32\wow64win.dll
2011-08-10 11:55:22 ----A---- C:\Windows\system32\wow64cpu.dll
2011-08-10 11:55:22 ----A---- C:\Windows\system32\wow64.dll
2011-08-10 11:55:22 ----A---- C:\Windows\system32\winsrv.dll
2011-08-10 11:55:22 ----A---- C:\Windows\system32\ntvdm64.dll
2011-08-10 11:55:22 ----A---- C:\Windows\system32\KernelBase.dll
2011-08-10 11:55:22 ----A---- C:\Windows\system32\kernel32.dll
2011-08-10 11:55:22 ----A---- C:\Windows\system32\conhost.exe
2011-08-10 11:55:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2011-08-10 11:55:21 ----A---- C:\Windows\SYSWOW64\user.exe
2011-08-10 11:55:21 ----A---- C:\Windows\SYSWOW64\instnm.exe
2011-08-10 11:55:17 ----A---- C:\Windows\SYSWOW64\odbcjt32.dll
2011-08-10 11:55:17 ----A---- C:\Windows\SYSWOW64\odbccu32.dll
2011-08-10 11:55:17 ----A---- C:\Windows\SYSWOW64\odbccr32.dll
2011-08-10 11:55:17 ----A---- C:\Windows\system32\odbctrac.dll
2011-08-10 11:55:17 ----A---- C:\Windows\system32\odbccu32.dll
2011-08-10 11:55:17 ----A---- C:\Windows\system32\odbccr32.dll
2011-08-10 11:55:17 ----A---- C:\Windows\system32\odbccp32.dll
2011-08-10 11:55:16 ----A---- C:\Windows\SYSWOW64\odbctrac.dll
2011-08-10 11:55:16 ----A---- C:\Windows\SYSWOW64\odbccp32.dll
2011-08-10 11:55:15 ----A---- C:\Windows\system32\drivers\tcpip.sys
2011-08-10 11:55:14 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2011-08-10 11:55:13 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2011-08-10 11:55:13 ----A---- C:\Windows\system32\ntoskrnl.exe
2011-08-07 22:47:11 ----D---- C:\Program Files (x86)\K-Lite Codec Pack
2011-08-07 22:47:08 ----D---- C:\Program Files (x86)\YouTube Song Downloader
2011-08-07 22:39:54 ----D---- C:\ProgramData\TheManWithNoLife
2011-08-07 22:39:49 ----D---- C:\Program Files\TheManWithNoLife
2011-08-07 22:02:09 ----D---- C:\Users\admin\AppData\Roaming\DVDVideoSoftIEHelpers
2011-08-07 22:02:02 ----D---- C:\Program Files (x86)\DVDVideoSoft
2011-08-01 07:02:15 ----D---- C:\Users\admin\AppData\Roaming\Ventrilo

======List of files/folders modified in the last 1 month======

2011-08-29 09:42:33 ----D---- C:\Windows\Temp
2011-08-29 09:42:33 ----A---- C:\Windows\ntbtlog.txt
2011-08-29 09:39:37 ----D---- C:\ProgramData
2011-08-29 09:39:07 ----RD---- C:\Program Files
2011-08-29 09:20:57 ----SHD---- C:\Windows\Installer
2011-08-29 09:20:57 ----D---- C:\Config.Msi
2011-08-29 09:11:36 ----D---- C:\Windows\Prefetch
2011-08-29 09:08:11 ----D---- C:\Windows\system32\config
2011-08-29 08:58:51 ----D---- C:\Windows
2011-08-24 19:43:00 ----D---- C:\Windows\system32\catroot2
2011-08-24 15:51:37 ----D---- C:\Windows\system32\drivers
2011-08-24 15:41:09 ----RD---- C:\Program Files (x86)
2011-08-24 08:54:26 ----D---- C:\Windows\Minidump
2011-08-24 08:45:56 ----D---- C:\Users\admin\AppData\Roaming\ICQ
2011-08-24 08:35:07 ----D---- C:\Users\admin\AppData\Roaming\uTorrent
2011-08-24 08:34:41 ----D---- C:\Windows\winsxs
2011-08-24 08:34:40 ----D---- C:\Windows\SYSWOW64\cs-CZ
2011-08-24 08:34:40 ----D---- C:\Windows\SysWOW64
2011-08-24 08:34:40 ----D---- C:\Windows\system32\cs-CZ
2011-08-24 08:34:40 ----D---- C:\Windows\System32
2011-08-24 08:34:32 ----D---- C:\Program Files (x86)\Microsoft Games for Windows - LIVE
2011-08-24 08:33:54 ----D---- C:\Windows\system32\catroot
2011-08-22 09:06:58 ----D---- C:\Windows\system32\Tasks
2011-08-21 18:42:33 ----D---- C:\Windows\system32\DriverStore
2011-08-21 18:42:33 ----D---- C:\Windows\inf
2011-08-21 18:42:32 ----D---- C:\Program Files (x86)\Mozilla Firefox
2011-08-21 18:42:32 ----D---- C:\Program Files (x86)\Common Files
2011-08-21 18:42:04 ----D---- C:\Program Files\Common Files
2011-08-21 18:07:19 ----D---- C:\Users\admin\AppData\Roaming\GetRightToGo
2011-08-21 18:04:33 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-08-21 17:40:24 ----D---- C:\Windows\system32\drivers\etc
2011-08-21 17:12:51 ----D---- C:\Users\admin\AppData\Roaming\Skype
2011-08-18 14:15:02 ----D---- C:\Windows\SYSWOW64\directx
2011-08-18 13:20:37 ----RSD---- C:\Windows\assembly
2011-08-16 09:46:32 ----D---- C:\Program Files (x86)\Mp3 Knife
2011-08-15 07:14:20 ----D---- C:\Windows\system32\NDF
2011-08-14 21:22:08 ----SD---- C:\Users\admin\AppData\Roaming\Microsoft
2011-08-12 13:38:17 ----D---- C:\Program Files (x86)\Farming Simulator 2011
2011-08-11 21:12:25 ----D---- C:\Users\admin\AppData\Roaming\Youtube to MP3 Converter
2011-08-11 08:14:53 ----D---- C:\Windows\Microsoft.NET
2011-08-10 18:27:32 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI
2011-08-10 12:02:20 ----D---- C:\Windows\SYSWOW64\migration
2011-08-10 12:02:20 ----D---- C:\Windows\system32\migration
2011-08-10 12:02:20 ----D---- C:\Windows\AppPatch
2011-08-10 12:02:20 ----D---- C:\Program Files\Internet Explorer
2011-08-10 12:02:20 ----D---- C:\Program Files (x86)\Internet Explorer
2011-08-10 12:01:09 ----D---- C:\ProgramData\Microsoft Help
2011-08-10 11:59:26 ----A---- C:\Windows\system32\MRT.exe
2011-08-09 11:23:04 ----D---- C:\Program Files (x86)\TuneUp Utilities 2011
2011-08-03 21:01:02 ----D---- C:\Program Files (x86)\ICQ7.5
2011-08-01 08:34:41 ----D---- C:\ProgramData\Codemasters

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 AtiPcie;AMD PCI Express (3GIO) Filter; C:\Windows\system32\DRIVERS\AtiPcie.sys [2009-05-05 16440]
R0 epfwwfp;epfwwfp; C:\Windows\system32\DRIVERS\epfwwfp.sys [2011-06-03 62496]
R0 mfehidk;McAfee Inc. mfehidk; C:\Windows\system32\drivers\mfehidk.sys [2011-04-14 530304]
R0 mfewfpk;McAfee Inc. mfewfpk; C:\Windows\system32\drivers\mfewfpk.sys [2011-04-14 283744]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-12-23 503352]
R1 AppleCharger;AppleCharger; C:\Windows\system32\DRIVERS\AppleCharger.sys [2010-04-27 21544]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2011-06-03 146432]
R1 mfenlfk;McAfee NDIS Light Filter; C:\Windows\system32\DRIVERS\mfenlfk.sys [2011-04-14 75160]
R2 epfw;epfw; C:\Windows\system32\DRIVERS\epfw.sys [2011-06-03 187632]
R2 RMCAST;@%SystemRoot%\system32\wshrm.dll,-102; C:\Windows\system32\DRIVERS\RMCAST.sys [2010-11-20 146432]
R3 amdiox64;AMD IO Driver; C:\Windows\system32\DRIVERS\amdiox64.sys [2010-02-18 46136]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2011-01-27 9085952]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2011-01-27 299520]
R3 gdrv;gdrv; \??\C:\Windows\gdrv.sys [2011-08-29 25640]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2010-04-06 2337440]
R3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter; C:\Windows\system32\DRIVERS\LEqdUsb.Sys [2011-04-30 76056]
R3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter; C:\Windows\system32\DRIVERS\LHidEqd.Sys [2011-04-30 15128]
R3 LHidFilt;Logitech SetPoint KMDF HID Filter Driver; C:\Windows\system32\DRIVERS\LHidFilt.Sys [2011-04-30 66840]
R3 LMouFilt;Logitech SetPoint KMDF Mouse Filter Driver; C:\Windows\system32\DRIVERS\LMouFilt.Sys [2011-04-30 60184]
R3 mfeavfk;McAfee Inc. mfeavfk; C:\Windows\system32\drivers\mfeavfk.sys [2011-04-14 190520]
R3 mfefirek;McAfee Inc. mfefirek; C:\Windows\system32\drivers\mfefirek.sys [2011-04-14 441840]
R3 pcouffin;VSO Software pcouffin; C:\Windows\System32\Drivers\pcouffin.sys [2011-02-23 82816]
R3 RTHDMIAzAudService;Service for HDMI; C:\Windows\system32\drivers\RtHDMIVX.sys [2010-01-27 231328]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2010-03-22 347680]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv; \??\C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesDriver64.sys [2011-02-10 11856]
S1 acedrv07;acedrv07; \??\C:\Windows\system32\drivers\acedrv07.sys [2011-01-22 125440]
S3 AODDriver;AODDriver; \??\C:\Program Files (x86)\Gigabyte\ET6\amd64\AODDriver.sys [2010-03-12 52280]
S3 cfwids;McAfee Inc. cfwids; C:\Windows\system32\drivers\cfwids.sys [2011-04-14 63056]
S3 Dot4;MS IEEE-1284.4 Driver; C:\Windows\system32\DRIVERS\Dot4.sys [2009-07-14 145920]
S3 Dot4Print;Print Class Driver for IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4Prt.sys [2010-11-20 19968]
S3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\Windows\system32\DRIVERS\dot4usb.sys [2009-07-14 43008]
S3 EagleX64;EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys []
S3 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2011-06-03 202064]
S3 etdrv;etdrv; \??\C:\Windows\etdrv.sys [2010-12-06 25640]
S3 GVTDrv64;GVTDrv64; \??\C:\Windows\GVTDrv64.sys [2010-12-23 30528]
S3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2011-05-10 33344]
S3 LUsbFilt;Logitech SetPoint KMDF USB Filter; C:\Windows\System32\Drivers\LUsbFilt.Sys [2011-04-30 42776]
S3 mferkdet;McAfee Inc. mferkdet; C:\Windows\system32\drivers\mferkdet.sys [2011-04-14 94992]
S3 NPF;NetGroup Packet Filter Driver; C:\Windows\system32\drivers\npf.sys []
S3 PAC207;SoC PC-Camera; C:\Windows\system32\DRIVERS\PFC027.SYS [2006-12-05 572416]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 59392]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 41984]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2011-01-27 203776]
R2 AMD FUEL Service;AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-01-26 354304]
R2 AMD Reservation Manager;AMD Reservation Manager; C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe [2010-06-17 194496]
R2 ddservice;ddservice; C:\Windows\update.7.1\svchostdriver.exe [2011-08-21 382464]
R2 ES lite Service;ES lite Service for program management.; C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE [2009-08-24 68136]
R2 ezGOSvc;Easybits GO Services for Windows; C:\Windows\system32\svchost.exe [2009-07-14 27136]
R2 hpqddsvc;Služba HP CUE DeviceDiscovery; C:\Windows\system32\svchost.exe [2009-07-14 27136]
R2 mfevtp;McAfee Validation Trust Protection Service; C:\Windows\system32\mfevtps.exe [2011-04-14 149032]
R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe [2007-09-20 853288]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 srvbtcclient;srvbtcclient; C:\Windows\update.5.0\svchost.exe [2011-08-22 355840]
R2 srviecheck;srviecheck; C:\Windows\update.2\svchost.exe [2011-08-24 636416]
R2 srvsysdriver32;srvsysdriver32; C:\Windows\sysdriver32.exe [2011-08-21 258048]
R2 StarWindServiceAE;StarWind AE Service; C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2007-05-28 275968]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service; C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe [2011-07-20 2027840]
R2 UxTuneUp;@%SystemRoot%\System32\uxtuneup.dll,-4096; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2010-09-21 2286976]
R3 hpqcxs08;hpqcxs08; C:\Windows\system32\svchost.exe [2009-07-14 27136]
R3 NMIndexingService;NMIndexingService; C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe [2007-09-20 382248]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /svc []
S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe /McCoreSvc []
S2 McMPFSvc;McAfee Personal Firewall; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe /McCoreSvc []
S2 mcmscsvc;McAfee Services; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe /McCoreSvc []
S2 McNaiAnn;McAfee VirusScan Announcer; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe /McCoreSvc []
S2 McNASvc;McAfee Network Agent; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe /McCoreSvc []
S2 McProxy;McAfee Proxy Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe /McCoreSvc []
S2 McShield;McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe []
S2 mfefire;McAfee Firewall Core Service; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe []
S2 MSK80Service;McAfee Anti-Spam Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe /McCoreSvc []
S3 AppleChargerSrv;AppleChargerSrv; C:\Windows\system32\AppleChargerSrv.exe [2010-04-06 31272]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2010-03-18 44376]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 McODS;McAfee Scanner; C:\Program Files\McAfee\VirusScan\mcods.exe []
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); C:\Program Files\WinPcap\rpcapd.exe -d -f C:\Program Files\WinPcap\rpcapd.ini []
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-12-06 1255736]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

-----------------EOF-----------------
předem díky za pomoc

[vyosek]

Zdravim a den vecer preji,

Vas log se studuje a pracuje se na nem .
Prosim o strpeni!

[vyosek]

Ten nelegalni ESET pak doufam nahradime free resenim

Spustte HJT a provedeme fixnuti polozek

• HJT najdete zde C:\Program Files\trend micro\admin.exe
• Otevre se Vam okno, kliknete na Do a system scan only
• V dalsim okne najdete radky které jsem Vam vypsal nize, vedle nich je ctverecek, do ktereho udelate zatrzitko
• R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qip.ru
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.qip.ru/ie
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.qip.ru
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bigseekpro.com/facesmooch3a/ ... 5EBB2DB885}
  R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=vsl&s={searchTerms}&f=4
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
  R3 - URLSearchHook: QIPBHO Class - {95289393-33EA-4F8D-B952-483415B9C955} - C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll
  R3 - URLSearchHook: (no name) - - (no file)
  R3 - URLSearchHook: HiGames Toolbar - {64d23501-5195-4224-9446-e2b0fb64e859} - C:\Program Files (x86)\HiGames\prxtbHiG0.dll
  R3 - URLSearchHook: Babylon-English Toolbar - {ce18769b-c7fa-42d2-860d-17c4662c70ad} - (no file)
  R3 - URLSearchHook: Hot MP3 Toolbar - {9384bd4c-dd14-4be9-80f7-f6277511e4f5} - C:\Program Files (x86)\Hot_MP3\prxtbHot0.dll
• Kliknete na Fix checked (vlevo dole)
• HJT se Vas zepta zda opravdu ANO, s tim souhlasite a je hotovo

Stahnete RogueKiller http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe

• Ukoncete vsechny programy
• Pokud pouzivate Win Vista ci W7, kliknete na RogueKiller pravym a dejte Run As Administrator ci Spustit jako spravce
• Zvolte moznost 2 a potvrte enterem
• Utilita provede svou cinnost a da log - ten sem vlozte
• Nyni znovu, ale zvolte moznost 3 a pote jeste 4 - logy opet vlozte

[Kopecz]

počítač zapnu do nouzového režimu se sítí a po cca půl minutě se mi restartuje

[vyosek]

Mate moznost si na jinem PC stahovat utility na flash disk

Pokud ano, tak restartujte do nouzoveho rezimu s praci bez site

Ten nelegalni ESET pujde doufam po ukonceni leceni z PC pryc a bdue tam free reseni

[Kopecz]

jojo to by šlo, jiné pc mám...jasně ESET pujde pryč!

[vyosek]

Fajn, zatim tam tedy natahnete RogueKiller a spustte dle navodu

PC samo nabiha do nouzoveho rezimu nebo se tam dostavate pomoci F8

[Kopecz]

když zapnu pc normálně se mi nastartuje po dvou minutách se restartuje skočí do NR tam vydrží tak půl minuty pak se restartuje, znovu se normálně zapne opět vydrží 2 minuty tak se restartuje znovu do NR a tak to běží pořád dokola...

[Kopecz]

možnost 2
RogueKiller V5.3.3 [08/18/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.sur-la-toile.com/discussion- ... ntees.html

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User: admin [Admin rights]
Mode: Remove -- Date : 08/29/2011 10:22:02

Bad processes: 11
[SVCHOST] svchost.exe -- c:\windows\update.tray-3-0\svchost.exe -> KILLED [TermProc]
[SVCHOST] svchost.exe -- c:\windows\update.tray-9-0\svchost.exe -> KILLED [TermProc]
[HJ NAME] svchost.exe -- c:\windows\update.5.0\svchost.exe -> KILLED [TermProc]
[SUSP PATH] sysdriver32.exe -- c:\windows\sysdriver32.exe -> KILLED [TermProc]
[SUSP PATH] sysdriver32_.exe -- c:\windows\sysdriver32_.exe -> KILLED [TermProc]
[SUSP PATH] systemup.exe -- c:\windows\systemup.exe -> KILLED [TermProc]
[SVCHOST] svchost.exe -- c:\windows\update.5.0\svchost.exe -> KILLED [TermProc]
[HJ NAME] svchost.exe -- c:\windows\update.2\svchost.exe -> KILLED [TermProc]
[SUSP PATH] sysdriver32.exe -- c:\windows\sysdriver32.exe -> KILLED [TermProc]
[HJ NAME] svchost.exe -- c:\windows\update.1\svchost.exe -> KILLED [TermProc]
[SVCHOST] svchost.exe -- c:\windows\update.2\svchost.exe -> KILLED [TermProc]

Registry Entries: 16
[BLACKLIST] HKLM\[...]\services : srvbtcclient (C:\Windows\update.5.0\svchost.exe srv) -> DELETED
[BLACKLIST] HKLM\[...]\services : srviecheck (C:\Windows\update.2\svchost.exe srv) -> DELETED
[BLACKLIST] HKLM\[...]\services : srvsysdriver32 (C:\Windows\sysdriver32.exe srv) -> DELETED
[BLACKLIST] HKLM\[...]\services : wxpdrivers (C:\Windows\update.1\svchost.exe srv) -> DELETED
[BLACKLIST] HKLM\[...]\services : srvbtcclient (C:\Windows\update.5.0\svchost.exe srv) -> DELETED
[BLACKLIST] HKLM\[...]\services : srviecheck (C:\Windows\update.2\svchost.exe srv) -> DELETED
[BLACKLIST] HKLM\[...]\services : srvsysdriver32 (C:\Windows\sysdriver32.exe srv) -> DELETED
[BLACKLIST] HKLM\[...]\services : wxpdrivers (C:\Windows\update.1\svchost.exe srv) -> DELETED
[HJ NAME] {084B0772-45F9-4CD8-A5DB-735A816B2605}.job : c:\windows\update.tray-9-0-lnk\svchost.exe -> DELETED
[SUSP PATH] {CECD87AF-2CC6-4741-9230-F926C1D701F9}.job : c:\users\admin\desktop\wmplayer.exe -> DELETED
[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> REPLACED (2)
[HJ] HKLM\[...]\System : EnableLUA (0) -> REPLACED (1)
[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)
[HJ] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)
[HJ] HKCU\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

Particular Files / Folders:

HOSTS File:
127.0.0.1 localhost
127.0.0.1 facebook.com
127.0.0.1 www.facebook.com
127.0.0.1 af-za.facebook.com
127.0.0.1 az-az.facebook.com
127.0.0.1 id-id.facebook.com
127.0.0.1 ms-my.facebook.com
127.0.0.1 bs-ba.facebook.com
127.0.0.1 ca-es.facebook.com
127.0.0.1 cs-cz.facebook.com
127.0.0.1 cy-gb.facebook.com
127.0.0.1 da-dk.facebook.com
127.0.0.1 de-de.facebook.com
127.0.0.1 et-ee.facebook.com
127.0.0.1 en-gb.facebook.com
127.0.0.1 es-la.facebook.com
127.0.0.1 eo-eo.facebook.com
127.0.0.1 eu-es.facebook.com
127.0.0.1 tl-ph.facebook.com
127.0.0.1 fo-fo.facebook.com
[...]


Finished : << RKreport[1].txt >>
RKreport[1].txt



možnost 3
RogueKiller V5.3.3 [08/18/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.sur-la-toile.com/discussion- ... ntees.html

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User: admin [Admin rights]
Mode: HOSTSFix -- Date : 08/29/2011 10:22:25

Bad processes: 0

HOSTS File:
127.0.0.1 localhost
127.0.0.1 facebook.com
127.0.0.1 www.facebook.com
127.0.0.1 af-za.facebook.com
127.0.0.1 az-az.facebook.com
127.0.0.1 id-id.facebook.com
127.0.0.1 ms-my.facebook.com
127.0.0.1 bs-ba.facebook.com
127.0.0.1 ca-es.facebook.com
127.0.0.1 cs-cz.facebook.com
127.0.0.1 cy-gb.facebook.com
127.0.0.1 da-dk.facebook.com
127.0.0.1 de-de.facebook.com
127.0.0.1 et-ee.facebook.com
127.0.0.1 en-gb.facebook.com
127.0.0.1 es-la.facebook.com
127.0.0.1 eo-eo.facebook.com
127.0.0.1 eu-es.facebook.com
127.0.0.1 tl-ph.facebook.com
127.0.0.1 fo-fo.facebook.com
[...]


Resetted HOSTS:
127.0.0.1 localhost

Finished : << RKreport[2].txt >>
RKreport[1].txt ; RKreport[2].txt



možnost 4
RogueKiller V5.3.3 [08/18/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.sur-la-toile.com/discussion- ... ntees.html

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User: admin [Admin rights]
Mode: ProxyFix -- Date : 08/29/2011 10:22:36

Bad processes: 0

Registry Entries: 0

Finished : << RKreport[3].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt

[vyosek]

Kliknete na Start a pote Spustit, pripadne pouzijte klavesou zkratku Win+R

• Vyskoci na Vas okenko, do ktereho zkopirujte text nize

• Kód: Vybrat vše

  msconfig

• Kliknete na OK
• Prepnete se na zalozku Spuštění počítače
• Podivejte se, ci nemate zaskrtnute Bezpecne spousteni - pokud ano, tak odskrtnete
• Nasledny restart by jiz mel vest do normalniho rezimu

Stahnete RKill http://download.bleepingcomputer.com/grinler/rkill.com

• Pokud ho havet blokuje, pouzijte jeden z nasledujicich

  Rkill EXE:
  http://download.bleepingcomputer.com/grinler/rkill.exe
  
  Rkill SCR:
  http://download.bleepingcomputer.com/grinler/rkill.scr
  
  Rkill PIF:
  http://download.bleepingcomputer.com/grinler/rkill.pif

• Ulozte nejlepena plochu a ukoncete vsechny aplikace (jinak to udela RKill za Vas)
• Spustte tradicne dvojklikem - program probehne temer okamzite a ukonci i svou cinnost
• RKill ukonci vsechny ne-systemove procesy - tedy i procesy, pod kterymi bezi havet
• Ted nerestartujte PC - prisli byste o ucinek RKillu

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK
Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

• Pokud mate Win XP spustte pod uctem Spravce\Administratora
• Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
• Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
• Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
• Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
• Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
• Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
• Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

[Kopecz]

vše jsem udělal podle návodu, ale když jsem chtěl zkopírovat log..zjistil jsem že mi negunfuje žádný program..

[vyosek]

Resrtartujte PC, melo by se to dat do poradku

[Kopecz]

ComboFix 11-08-28.01 - admin 29.08.2011 10:37:36.2.6 - x64
Spuštěný z: c:\users\admin\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Digsby Donates\ShOPpingbho.dll
c:\program files (x86)\ESET\MiNODLogin
c:\program files (x86)\ESET\MiNODLogin\MiNODLogin.exe
c:\program files (x86)\ESET\MiNODLogin\MiNODLogin.jar
c:\program files (x86)\ESET\MiNODLogin\MiNODLoginLib.dll
c:\program files (x86)\ESET\MiNODLogin\MiNODLoginUninst.exe
c:\program files (x86)\ESET\MiNODLogin\servidores.xml
c:\program files (x86)\facemoods.com
c:\program files (x86)\facemoods.com\facemoods\1.4.17.8\bh\facemoods.dll
c:\program files (x86)\facemoods.com\facemoods\1.4.17.8\facemoods.crx
c:\program files (x86)\facemoods.com\facemoods\1.4.17.8\facemoods.png
c:\program files (x86)\facemoods.com\facemoods\1.4.17.8\facemoodsApp.dll
c:\program files (x86)\facemoods.com\facemoods\1.4.17.8\facemoodsEng.dll
c:\program files (x86)\facemoods.com\facemoods\1.4.17.8\facemoodssrv.exe
c:\program files (x86)\facemoods.com\facemoods\1.4.17.8\facemoodsTlbr.dll
c:\program files (x86)\facemoods.com\facemoods\1.4.17.8\uninstall.exe
c:\program files (x86)\facemoods.com\sqlite3.dll
c:\program files (x86)\WinPCap
c:\program files (x86)\WinPCap\daemon_mgm.exe
c:\program files (x86)\WinPCap\INSTALL.LOG
c:\program files (x86)\WinPCap\npf_mgm.exe
c:\program files (x86)\WinPCap\rpcapd.exe
c:\program files (x86)\WinPCap\Uninstall.exe
c:\program files\system32.EXE
c:\users\admin\AppData\Roaming\inst.exe
c:\users\admin\AppData\Roaming\Local
c:\users\admin\AppData\Roaming\Local\Temp\DDM\Settings\settings.ddi
c:\users\admin\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\(2).ddp
c:\users\admin\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\(3).ddp
c:\users\admin\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\(4).ddp
c:\users\admin\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\(5).ddp
c:\users\admin\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\(6).ddp
c:\users\admin\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\(7).ddp
c:\users\admin\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\(8).ddp
c:\users\admin\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\.ddp
c:\windows\btc_client_iplist.txt
c:\windows\front_ip_list.txt
c:\windows\geoiplist
c:\windows\geoiplist.rar
c:\windows\iecheck_iplist.txt
c:\windows\info1
c:\windows\iplist.txt
c:\windows\loader2.exe_ok
c:\windows\phoenix
c:\windows\phoenix.rar
c:\windows\phoenix\kernels\phatk\__init__.py
c:\windows\phoenix\kernels\phatk\__init__.pyc
c:\windows\phoenix\kernels\phatk\4881bf74a41a6622f0e24e9c982ffe4a.elf
c:\windows\phoenix\kernels\phatk\BFIPatcher.py
c:\windows\phoenix\kernels\phatk\BFIPatcher.pyc
c:\windows\phoenix\kernels\phatk\dd490d3f7b673a0cc51a70ccb429334d.elf
c:\windows\phoenix\kernels\phatk\kernel.cl
c:\windows\phoenix\kernels\poclbm\__init__.py
c:\windows\phoenix\kernels\poclbm\__init__.pyc
c:\windows\phoenix\kernels\poclbm\198ab205d0ff52e778ac1ee042be7228.elf
c:\windows\phoenix\kernels\poclbm\8769a65b4502d15ba944e48ba88de52e.elf
c:\windows\phoenix\kernels\poclbm\BFIPatcher.py
c:\windows\phoenix\kernels\poclbm\BFIPatcher.pyc
c:\windows\phoenix\kernels\poclbm\kernel.cl
c:\windows\phoenix\phoenix.exe
c:\windows\proc_list1.log
c:\windows\rpcminer
c:\windows\rpcminer.rar
c:\windows\rpcminer\bitcoinminercuda_10.cubin
c:\windows\rpcminer\bitcoinminercuda_11.cubin
c:\windows\rpcminer\bitcoinminercuda_20.cubin
c:\windows\rpcminer\bitcoinmineropencl.cl
c:\windows\rpcminer\cudart32_32_16.dll
c:\windows\rpcminer\curllib.dll
c:\windows\rpcminer\libeay32.dll
c:\windows\rpcminer\libsasl.dll
c:\windows\rpcminer\openldap.dll
c:\windows\rpcminer\rpcminer-4way.exe
c:\windows\rpcminer\rpcminer-cpu.exe
c:\windows\rpcminer\rpcminer-cuda.exe
c:\windows\rpcminer\rpcminer-opencl.exe
c:\windows\rpcminer\ssleay32.dll
c:\windows\services32.exe
c:\windows\sysdriver32.exe
c:\windows\sysdriver32_.exe
c:\windows\system32\drivers\etc\HSTS~1
c:\windows\systemup.exe
c:\windows\SysWow64\comct332.ocx
c:\windows\SysWow64\drivers\npf.sys
c:\windows\SysWow64\Packet.dll
c:\windows\SysWow64\pthreadVC.dll
c:\windows\SysWow64\wpcap.dll
c:\windows\Temp\5636658.exe
c:\windows\Temp\57779637-loader2.exe
c:\windows\Temp\8556620.exe
c:\windows\ufa.rar
c:\windows\update.1
c:\windows\update.1\svchost.exe
c:\windows\update.2
c:\windows\update.2\svchost.exe
c:\windows\update.5.0
c:\windows\update.5.0\svchost.exe
c:\windows\update.7.1
c:\windows\update.7.1\svchostdriver.exe
c:\windows\update.tray-3-0\svchost.exe
c:\windows\update.tray-9-0\svchost.exe
c:\windows\winlog-dirs.txt
c:\windows\winlog-ids.txt
c:\windows\winsetupapi.log
c:\users\admin\AppData\Roaming\Microsoft\Windows\Recent\?Katy Perry - The yyy Next Door with lyrics in HD?? - YouTube.URL . . . . nemohl být smazán
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_ddservice
-------\Service_NPF
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-07-28 do 2011-08-29 )))))))))))))))))))))))))))))))
.
.
2011-08-29 08:41 . 2011-08-29 08:41 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-08-29 08:24 . 2011-08-12 04:10 8862544 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F5E77159-442E-4FDF-A4BB-9F1D8FC36297}\mpengine.dll
2011-08-29 08:23 . 2011-08-29 08:23 -------- d-----w- c:\programdata\McAfee
2011-08-29 07:39 . 2011-08-29 08:18 -------- d-----w- c:\program files\trend micro
2011-08-29 07:39 . 2011-08-29 07:42 -------- dc----w- C:\rsit
2011-08-27 19:41 . 2011-08-27 19:41 -------- d--h--w- c:\windows\update.8.1
2011-08-24 06:34 . 2011-08-24 06:34 -------- d-----w- c:\windows\SysWow64\xlive
2011-08-24 06:34 . 2011-07-09 05:26 2048 ----a-w- c:\windows\system32\tzres.dll
2011-08-24 06:34 . 2011-07-09 04:29 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2011-08-22 07:21 . 2011-08-22 07:21 -------- dc----w- C:\$UPGRADE.~OS
2011-08-22 06:53 . 2011-08-22 06:53 -------- d--h--w- c:\windows\update.tray-9-0-lnk
2011-08-22 06:53 . 2011-08-22 06:53 -------- d--h--w- c:\windows\update.tray-3-0-lnk
2011-08-21 16:43 . 2011-08-21 16:43 -------- d-----w- c:\program files (x86)\SiteAdvisor
2011-08-21 16:42 . 2011-04-14 12:08 24376 ----a-w- c:\program files (x86)\Mozilla Firefox\components\Scriptff.dll
2011-08-21 16:42 . 2011-04-14 12:08 9984 ----a-w- c:\windows\system32\drivers\mfeclnk.sys
2011-08-21 16:42 . 2011-04-14 12:08 149032 ----a-w- c:\windows\system32\mfevtps.exe
2011-08-21 16:42 . 2011-04-14 12:08 94992 ----a-w- c:\windows\system32\drivers\mferkdet.sys
2011-08-21 16:42 . 2011-04-14 12:08 75160 ----a-w- c:\windows\system32\drivers\mfenlfk.sys
2011-08-21 16:42 . 2011-04-14 12:08 63056 ----a-w- c:\windows\system32\drivers\cfwids.sys
2011-08-21 16:42 . 2011-04-14 12:08 530304 ----a-w- c:\windows\system32\drivers\mfehidk.sys
2011-08-21 16:42 . 2011-04-14 12:08 441840 ----a-w- c:\windows\system32\drivers\mfefirek.sys
2011-08-21 16:42 . 2011-04-14 12:08 283744 ----a-w- c:\windows\system32\drivers\mfewfpk.sys
2011-08-21 16:42 . 2011-04-14 12:08 190520 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
2011-08-21 16:42 . 2011-08-21 16:42 -------- d-----w- c:\program files\McAfee.com
2011-08-21 16:16 . 2009-09-02 08:20 652 ----a-w- c:\windows\FIX.reg
2011-08-21 16:16 . 2008-11-01 11:23 280 ----a-w- c:\windows\reset.reg
2011-08-21 16:07 . 2011-08-21 16:08 53248 ------w- c:\program files (x86)\Common Files\InstallShield\engine\6\Intel 32\msihook.dll
2011-08-21 16:07 . 2011-08-21 16:08 32768 ------w- c:\program files (x86)\Common Files\InstallShield\engine\6\Intel 32\objectps.dll
2011-08-21 16:07 . 2011-08-21 16:08 221184 ------w- c:\program files (x86)\Common Files\InstallShield\IScript\iscript.dll
2011-08-21 16:07 . 2011-08-21 16:08 598016 ------w- c:\program files (x86)\Common Files\InstallShield\engine\6\Intel 32\ikernel.exe
2011-08-21 16:07 . 2011-08-21 16:08 217088 ------w- c:\program files (x86)\Common Files\InstallShield\engine\6\Intel 32\iuser.dll
2011-08-21 16:07 . 2011-08-21 16:08 114688 ------w- c:\program files (x86)\Common Files\InstallShield\engine\6\Intel 32\scpthdlr.dll
2011-08-21 16:07 . 2011-08-21 16:07 126976 ------w- c:\program files (x86)\Common Files\InstallShield\engine\6\Intel 32\knlwrap.exe
2011-08-21 15:49 . 2011-08-21 16:49 -------- d-----w- c:\windows\ufa
2011-08-21 15:40 . 2011-08-21 16:49 246272 ----a-w- c:\windows\unrar.exe
2011-08-21 15:37 . 2011-08-21 15:37 -------- d-----w- c:\windows\av_ico
2011-08-21 15:36 . 2011-08-29 08:40 -------- d--h--w- c:\windows\update.tray-9-0
2011-08-21 15:36 . 2011-08-29 08:40 -------- d--h--w- c:\windows\update.tray-3-0
2011-08-18 10:32 . 2011-08-18 10:32 -------- d-----w- c:\program files (x86)\Atari
2011-08-17 05:12 . 2011-08-21 16:03 -------- d-----w- c:\programdata\Electronic Arts
2011-08-16 20:53 . 2003-02-11 04:02 32768 ----a-w- c:\program files (x86)\Mozilla Firefox\plugins\np32dsw.dll
2011-08-15 18:10 . 2011-08-15 18:10 -------- d-----w- c:\program files (x86)\AVI to 3GP
2011-08-12 13:28 . 2011-08-12 13:28 -------- d-----w- c:\program files (x86)\Download Master
2011-08-12 13:26 . 2011-08-12 13:26 -------- d-----w- c:\program files (x86)\REDEMAX
2011-08-10 09:55 . 2011-07-09 02:46 288768 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-08-07 20:47 . 2011-08-07 20:47 -------- d-----w- c:\users\admin\AppData\Local\Abelssoft
2011-08-07 20:47 . 2011-08-07 20:49 -------- d-----w- c:\program files (x86)\K-Lite Codec Pack
2011-08-07 20:47 . 2011-08-07 20:49 -------- d-----w- c:\program files (x86)\YouTube Song Downloader
2011-08-07 20:39 . 2011-08-07 20:39 -------- d-----w- c:\programdata\TheManWithNoLife
2011-08-07 20:39 . 2011-08-07 20:43 -------- d-----w- c:\program files\TheManWithNoLife
2011-08-07 20:02 . 2011-08-07 20:02 -------- d-----w- c:\users\admin\AppData\Roaming\DVDVideoSoftIEHelpers
2011-08-07 20:02 . 2011-08-07 20:15 -------- d-----w- c:\program files (x86)\DVDVideoSoft
2011-08-07 20:02 . 2011-08-07 20:03 -------- d-----w- c:\program files (x86)\Common Files\DVDVideoSoft
2011-08-01 05:02 . 2011-08-01 05:02 -------- d-----w- c:\users\admin\AppData\Roaming\Ventrilo
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-29 08:42 . 2010-12-05 18:39 25640 ----a-w- c:\windows\gdrv.sys
2011-08-17 07:34 . 2011-06-13 19:22 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-07-20 15:14 . 2011-06-15 19:06 18960 ----a-w- c:\windows\system32\drivers\LNonPnP.sys
2011-07-20 08:41 . 2011-07-20 17:06 34624 ----a-w- c:\windows\system32\TURegOpt.exe
2011-07-20 08:35 . 2011-07-20 17:05 25920 ----a-w- c:\windows\system32\authuitu.dll
2011-07-20 08:35 . 2011-07-20 17:05 21312 ----a-w- c:\windows\SysWow64\authuitu.dll
2011-07-20 08:35 . 2011-07-20 17:05 36160 ----a-w- c:\windows\system32\uxtuneup.dll
2011-07-20 08:35 . 2011-07-20 17:05 29504 ----a-w- c:\windows\SysWow64\uxtuneup.dll
2011-07-16 04:26 . 2011-08-10 09:55 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2011-07-15 19:58 . 2011-07-15 19:58 53248 ----a-r- c:\users\admin\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2011-07-03 15:24 . 2011-07-03 15:24 20480 ----a-w- c:\windows\SysWow64\H@tKeysH@@k.DLL
2011-07-03 14:36 . 2011-07-01 14:20 73216 ----a-w- c:\windows\ST6UNST.EXE
2011-07-03 14:36 . 2011-07-01 14:20 249856 ------w- c:\windows\Setup1.exe
2011-06-21 04:55 . 2011-06-21 04:55 0 ----a-w- c:\windows\SysWow64\REN7177.tmp
2011-06-17 13:55 . 2011-06-01 10:02 466456 ----a-w- c:\windows\system32\wrap_oal.dll
2011-06-17 13:55 . 2011-06-01 10:02 122904 ----a-w- c:\windows\system32\OpenAL32.dll
2011-06-17 13:55 . 2010-12-23 19:58 444952 ----a-w- c:\windows\SysWow64\wrap_oal.dll
2011-06-17 13:55 . 2010-12-23 19:58 109080 ----a-w- c:\windows\SysWow64\OpenAL32.dll
2011-06-12 13:05 . 2011-06-12 14:33 80256 ----a-w- c:\windows\SysWow64\ezGOSvc.dll
2011-06-12 13:05 . 2011-06-12 14:33 663424 ----a-w- c:\windows\SysWow64\ezGOSvcApp.exe
2011-06-11 03:07 . 2011-07-13 06:19 3137536 ----a-w- c:\windows\system32\win32k.sys
2011-06-10 23:58 . 2011-06-10 23:58 81744 ----a-w- c:\windows\SysWow64\mfcm100u.dll
2011-06-10 23:58 . 2011-06-10 23:58 81744 ----a-w- c:\windows\SysWow64\mfcm100.dll
2011-06-10 23:58 . 2011-06-10 23:58 773968 ----a-w- c:\windows\SysWow64\msvcr100.dll
2011-06-10 23:58 . 2011-06-10 23:58 64336 ----a-w- c:\windows\SysWow64\mfc100fra.dll
2011-06-10 23:58 . 2011-06-10 23:58 64336 ----a-w- c:\windows\SysWow64\mfc100deu.dll
2011-06-10 23:58 . 2011-06-10 23:58 63824 ----a-w- c:\windows\SysWow64\mfc100esn.dll
2011-06-10 23:58 . 2011-06-10 23:58 62288 ----a-w- c:\windows\SysWow64\mfc100ita.dll
2011-06-10 23:58 . 2011-06-10 23:58 60752 ----a-w- c:\windows\SysWow64\mfc100rus.dll
2011-06-10 23:58 . 2011-06-10 23:58 55120 ----a-w- c:\windows\SysWow64\mfc100enu.dll
2011-06-10 23:58 . 2011-06-10 23:58 51024 ----a-w- c:\windows\SysWow64\vcomp100.dll
2011-06-10 23:58 . 2011-06-10 23:58 4422992 ----a-w- c:\windows\SysWow64\mfc100u.dll
2011-06-10 23:58 . 2011-06-10 23:58 4397384 ----a-w- c:\windows\SysWow64\mfc100.dll
2011-06-10 23:58 . 2011-06-10 23:58 43856 ----a-w- c:\windows\SysWow64\mfc100jpn.dll
2011-06-10 23:58 . 2011-06-10 23:58 43344 ----a-w- c:\windows\SysWow64\mfc100kor.dll
2011-06-10 23:58 . 2011-06-10 23:58 421200 ----a-w- c:\windows\SysWow64\msvcp100.dll
2011-06-10 23:58 . 2011-06-10 23:58 36176 ----a-w- c:\windows\SysWow64\mfc100cht.dll
2011-06-10 23:58 . 2011-06-10 23:58 36176 ----a-w- c:\windows\SysWow64\mfc100chs.dll
2011-06-10 23:58 . 2011-06-10 23:58 138056 ----a-w- c:\windows\SysWow64\atl100.dll
2011-06-03 14:02 . 2011-06-03 14:02 62496 ----a-w- c:\windows\system32\drivers\epfwwfp.sys
2011-06-03 14:01 . 2011-06-03 14:01 38288 ----a-w- c:\windows\system32\drivers\EpfwLWF.sys
2011-06-03 14:01 . 2011-06-03 14:01 187632 ----a-w- c:\windows\system32\drivers\epfw.sys
2011-06-03 14:01 . 2011-06-03 14:01 146432 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2011-06-03 14:00 . 2011-06-03 14:00 202064 ----a-w- c:\windows\system32\drivers\eamonm.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2011-01-17 14:54 175912 ----a-w- c:\program files (x86)\ConduitEngine\prxConduitEngine.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{64d23501-5195-4224-9446-e2b0fb64e859}]
2011-01-17 14:54 175912 ----a-w- c:\program files (x86)\HiGames\prxtbHiG0.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{9384bd4c-dd14-4be9-80f7-f6277511e4f5}]
2011-01-17 14:54 175912 ----a-w- c:\program files (x86)\Hot_MP3\prxtbHot0.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2011-05-17 11:29 1490312 ----a-w- c:\program files (x86)\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{64d23501-5195-4224-9446-e2b0fb64e859}"= "c:\program files (x86)\HiGames\prxtbHiG0.dll" [2011-01-17 175912]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2011-05-17 1490312]
"{9384bd4c-dd14-4be9-80f7-f6277511e4f5}"= "c:\program files (x86)\Hot_MP3\prxtbHot0.dll" [2011-01-17 175912]
.
[HKEY_CLASSES_ROOT\clsid\{64d23501-5195-4224-9446-e2b0fb64e859}]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CLASSES_ROOT\clsid\{9384bd4c-dd14-4be9-80f7-f6277511e4f5}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files (x86)\Common Files\Nero\Lib\NMBgMonitor.exe" [2007-09-20 202024]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"reset"="regedit" [X]
"hpqSRMon"="c:\program files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-07-22 150528]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-01-26 336384]
"ApnUpdater"="c:\program files (x86)\Ask.com\Updater\Updater.exe" [2011-05-17 395144]
"NBKeyScan"="c:\program files (x86)\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-09-20 1836328]
"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2010-08-04 1466840]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableSecureUIAPaths"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"HP Software Update"=c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" -atboottime
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
"ATICustomerCare"="c:\program files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe"
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
"DisableThumbnailCache"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Služba Google Update (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [x]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [x]
R2 McMPFSvc;McAfee Personal Firewall;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [x]
R2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [x]
R2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [x]
R3 AODDriver;AODDriver;c:\program files (x86)\Gigabyte\ET6\amd64\AODDriver.sys [2010-03-12 52280]
R3 AppleChargerSrv;AppleChargerSrv;c:\windows\system32\AppleChargerSrv.exe [x]
R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [x]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]
R3 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
R3 etdrv;etdrv;c:\windows\etdrv.sys [2010-12-06 25640]
R3 GVTDrv64;GVTDrv64;c:\windows\GVTDrv64.sys [2010-12-23 30528]
R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [x]
R3 PAC207;SoC PC-Camera;c:\windows\system32\DRIVERS\PFC027.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [x]
S0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S1 AppleCharger;AppleCharger;c:\windows\system32\DRIVERS\AppleCharger.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]
S1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\DRIVERS\mfenlfk.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-01-26 354304]
S2 AMD Reservation Manager;AMD Reservation Manager;c:\program files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe [2010-06-17 194496]
S2 ES lite Service;ES lite Service for program management.;c:\program files (x86)\Gigabyte\EasySaver\ESSVR.EXE [2009-08-24 68136]
S2 ezGOSvc;Easybits GO Services for Windows;c:\windows\system32\svchost.exe [2009-07-14 27136]
S2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [x]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe [2011-07-20 2027840]
S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [x]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\DRIVERS\LEqdUsb.Sys [x]
S3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\DRIVERS\LHidEqd.Sys [x]
S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesDriver64.sys [2011-02-10 11856]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Obsah adresáře 'Naplánované úlohy'
.
2011-08-22 c:\windows\Tasks\RegCure Program Check.job
- c:\program files (x86)\RegCure\RegCure.exe [2011-05-01 10:45]
.
2011-07-03 c:\windows\Tasks\RegCure.job
- c:\program files (x86)\RegCure\RegCure.exe [2011-05-01 10:45]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-04-06 10144288]
"Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2006-11-03 319488]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-10-28 1680976]
"combofix"="c:\combofix\CF17740.3XE" [2010-11-20 345088]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
ezGOSvc
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.seznam.cz/
mLocal Page = c:\windows\SYSTEM32\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
IE: Free YouTube to Mp3 Converter - c:\users\admin\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm
IE: Translate this web page with Babylon - c:\program files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm
IE: Translate with Babylon - c:\program files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Action.htm
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files (x86)\ICQ7.5\ICQ.exe
TCP: DhcpNameServer = 192.168.1.2
FF - ProfilePath - c:\users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\rwe7uvgb.default\
FF - prefs.js: browser.search.selectedEngine - Facemoods Search
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - user.js: network.http.max-connections-per-server - 6
FF - user.js: network.http.max-persistent-connections-per-server - 3
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
BHO-{ce18769b-c7fa-42d2-860d-17c4662c70ad} - (no file)
Toolbar-{ce18769b-c7fa-42d2-860d-17c4662c70ad} - (no file)
Wow6432Node-HKLM-Run-facemoods - c:\program files (x86)\facemoods.com\facemoods\1.4.17.8\facemoodssrv.exe
Wow6432Node-HKLM-Run-wxpdrv - c:\windows\services32.exe
Wow6432Node-HKLM-Run-tray_ico - (no file)
Wow6432Node-HKLM-Run-tray_ico0 - c:\windows\update.tray-3-0\svchost.exe
Wow6432Node-HKLM-Run-tray_ico1 - c:\windows\update.tray-9-0\svchost.exe
Wow6432Node-HKLM-Run-tray_ico2 - (no file)
Wow6432Node-HKLM-Run-tray_ico3 - (no file)
Wow6432Node-HKLM-Run-tray_ico4 - (no file)
Wow6432Node-HKLM-Run-McAfee Guardian - c:\program files (x86)\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe
Wow6432Node-HKLM-Run-systemup - c:\windows\systemup.exe
Wow6432Node-HKU-Default-Run-Exetender_298 - c:\program files (x86)\Frag Games\GPlayer.exe
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{64D23501-5195-4224-9446-E2B0FB64E859} - (no file)
WebBrowser-{CE18769B-C7FA-42D2-860D-17C4662C70AD} - (no file)
WebBrowser-{9384BD4C-DD14-4BE9-80F7-F6277511E4F5} - (no file)
HKLM-Run-System - c:\program files\system32.exe
HKLM-Run-egui - c:\program files\ESET\ESET Smart Security\egui.exe
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
AddRemove-facemoods - c:\program files (x86)\facemoods.com\facemoods\1.4.17.8\uninstall.exe
AddRemove-MiNODLogin - c:\program files (x86)\ESET\MiNODLogin\MiNODLoginUninst.exe
AddRemove-Shockwave - c:\windows\System32\Macromed\SHOCKW~1\UNWISE.EXE
AddRemove-WinPcapInst - c:\program files (x86)\WinPcap\Uninstall.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10v_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10v_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe
c:\program files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
.
**************************************************************************
.
Celkový čas: 2011-08-29 10:44:55 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-08-29 08:44
.
Před spuštěním: Volných bajtů: 280 705 622 016
Po spuštění: Volných bajtů: 282 938 028 032
.
- - End Of File - - 05AC635F8FBB0971427D083CFA9CFA04

[vyosek]

Pokud nemate, tak presunte Combofix na plochu

• Spustte poznamkovy blok (Start-spustit-notepad)
• Zkopirujte skript nize

• Kód: Vybrat vše

  KillAll::
  
  Folder::
  c:\windows\update.8.1
  c:\windows\update.tray-9-0-lnk
  c:\windows\update.tray-3-0-lnk
  c:\windows\ufa
  c:\windows\update.tray-9-0
  c:\windows\update.tray-3-0
  c:\program files (x86)\Ask.com
  c:\program files (x86)\RegCure
  
  File::
  c:\windows\FIX.reg
  c:\windows\reset.reg
  c:\windows\unrar.exe
  c:\windows\SysWow64\REN7177.tmp
  c:\program files (x86)\ConduitEngine\prxConduitEngine.dll
  c:\program files (x86)\HiGames\prxtbHiG0.dll
  c:\program files (x86)\Hot_MP3\prxtbHot0.dll
  c:\windows\Tasks\RegCure Program Check.job
  c:\windows\Tasks\RegCure.job
  
  Registry::
  [-HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
  [-HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{64d23501-5195-4224-9446-e2b0fb64e859}]
  [-HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{9384bd4c-dd14-4be9-80f7-f6277511e4f5}]
  [-HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
  "{64d23501-5195-4224-9446-e2b0fb64e859}"=-
  "{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
  "{9384bd4c-dd14-4be9-80f7-f6277511e4f5}"=-
  [-HKEY_CLASSES_ROOT\clsid\{64d23501-5195-4224-9446-e2b0fb64e859}]
  [-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
  [-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
  [-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
  [-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
  [-HKEY_CLASSES_ROOT\clsid\{9384bd4c-dd14-4be9-80f7-f6277511e4f5}]
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=-
  [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
  "reset"=-
  "ApnUpdater"=-
  "NBKeyScan"=-
  "mcui_exe"=-
  [-HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
  [HKEY_LOCAL_MACHINE\software\microsoft\security center]
  "FirewallOverride"=dword:00000000
  "DisableThumbnailCache"=dword:00000000
  
  Driver::
  gupdate
  
  Firefox::
  FF - ProfilePath - c:\users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\rwe7uvgb.default\
  FF - prefs.js: browser.search.selectedEngine - Facemoods Search
  
  RegLock::
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
  [HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
  
  Reboot::

• Ulozte vytvoreny TXT jako CFScript.txt
• Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
  
• Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

[Kopecz]

ComboFix 11-08-28.01 - admin 29.08.2011 11:07:48.3.6 - x64
Spuštěný z: c:\users\admin\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\admin\Desktop\CFScript.txt
.
FILE ::
"c:\program files (x86)\ConduitEngine\prxConduitEngine.dll"
"c:\program files (x86)\HiGames\prxtbHiG0.dll"
"c:\program files (x86)\Hot_MP3\prxtbHot0.dll"
"c:\windows\FIX.reg"
"c:\windows\reset.reg"
"c:\windows\SysWow64\REN7177.tmp"
"c:\windows\Tasks\RegCure Program Check.job"
"c:\windows\Tasks\RegCure.job"
"c:\windows\unrar.exe"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Ask.com
c:\program files (x86)\Ask.com\assets\oobe\b.png
c:\program files (x86)\Ask.com\assets\oobe\bl.png
c:\program files (x86)\Ask.com\assets\oobe\br.png
c:\program files (x86)\Ask.com\assets\oobe\l.png
c:\program files (x86)\Ask.com\assets\oobe\pointer.png
c:\program files (x86)\Ask.com\assets\oobe\r.png
c:\program files (x86)\Ask.com\assets\oobe\t.png
c:\program files (x86)\Ask.com\assets\oobe\tl.png
c:\program files (x86)\Ask.com\assets\oobe\tr.png
c:\program files (x86)\Ask.com\cobrand.ico
c:\program files (x86)\Ask.com\config.xml
c:\program files (x86)\Ask.com\favicon.ico
c:\program files (x86)\Ask.com\fv_ebc5.ico
c:\program files (x86)\Ask.com\GenericAskToolbar.dll
c:\program files (x86)\Ask.com\mupcfg.xml
c:\program files (x86)\Ask.com\precache.exe
c:\program files (x86)\Ask.com\SaUpdate.exe
c:\program files (x86)\Ask.com\Updater\config.xml
c:\program files (x86)\Ask.com\Updater\Updater.exe
c:\program files (x86)\Ask.com\UpdateTask.exe
c:\program files (x86)\ConduitEngine\prxConduitEngine.dll
c:\program files (x86)\HiGames\prxtbHiG0.dll
c:\program files (x86)\Hot_MP3\prxtbHot0.dll
c:\program files (x86)\RegCure
c:\program files (x86)\RegCure\0_days.htm
c:\program files (x86)\RegCure\1_days.htm
c:\program files (x86)\RegCure\15_days.htm
c:\program files (x86)\RegCure\2_days.htm
c:\program files (x86)\RegCure\30_days.htm
c:\program files (x86)\RegCure\5_days.htm
c:\program files (x86)\RegCure\Animated-Bar.gif
c:\program files (x86)\RegCure\AutoUpdate.dll
c:\program files (x86)\RegCure\Backup\RegCureBak_April_28_11_16_57_11\311E.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_April_28_11_16_57_11\312F.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_April_28_11_16_57_11\3130.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_April_28_11_16_57_11\3131.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_April_28_11_16_57_11\3132.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_April_28_11_16_57_11\3133.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_April_28_11_16_57_11\3143.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_April_28_11_16_57_11\316B.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_April_28_11_16_57_11\316E.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_April_28_11_16_57_11\3198.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_April_28_11_16_57_11\31D2.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_April_28_11_16_57_11\31EA.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_08_30\8BCD.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14.64Bit.reg
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14.bak
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14.reg
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\243F.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2440.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2441.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2452.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2453.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2454.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2455.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2456.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2466.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2467.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2468.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2469.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\246A.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\246B.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\247C.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\247D.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\247E.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\247F.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2480.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2481.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2491.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2492.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2493.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2494.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2495.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2496.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24A7.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24A8.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24A9.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24AA.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24AB.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24AC.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24BD.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24BE.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24BF.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24C0.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24C1.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24C2.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24D2.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24D3.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24D4.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24D5.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24D6.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24E7.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24E8.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24E9.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24EA.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24EB.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24EC.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24FC.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24FD.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24FE.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24FF.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2500.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2501.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2512.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2513.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2514.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2515.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2516.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2517.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2528.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2529.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\252A.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\252B.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\252C.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\252D.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\253D.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\253E.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\253F.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2540.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2541.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2542.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2553.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2554.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2555.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2556.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2557.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2567.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2568.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2569.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\256A.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\256B.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\256C.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\257D.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\257E.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\257F.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2580.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2581.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2582.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2593.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2594.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2595.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2596.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2597.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25A7.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25A8.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25A9.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25AA.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25AB.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25AC.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25BD.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25BE.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25BF.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25C0.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25C1.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25C2.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25D2.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25D3.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25D4.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25D5.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25D6.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25D7.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25E8.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25E9.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25EA.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25EB.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25EC.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25FD.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25FE.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25FF.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2600.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2601.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2602.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2612.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2613.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2614.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2615.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2616.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2617.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2628.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2629.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\262A.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\262B.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\262C.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\263C.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\263D.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\263E.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\263F.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2640.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2641.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2652.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2653.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2654.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2655.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2656.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2657.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2668.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2669.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\266A.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\266B.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\266C.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\266D.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\267D.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\267E.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\267F.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2680.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2681.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2692.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2693.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2694.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2695.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2696.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2697.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26A7.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26A8.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26A9.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26AA.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26AB.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26AC.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26BD.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26BE.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26BF.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26C0.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26C1.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26D2.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26D3.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26D4.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26D5.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26D6.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26D7.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26E7.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26E8.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26E9.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26EA.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26EB.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26EC.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26FD.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26FE.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26FF.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2700.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2701.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2711.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2712.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2713.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2714.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2715.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2716.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2727.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2728.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2729.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\272A.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\272B.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\273C.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\273D.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\273E.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\273F.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2740.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2741.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2751.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2752.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2753.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2754.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2755.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2756.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2767.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2768.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2769.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2779.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_11_11.64Bit.reg
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_11_11.reg
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19.64Bit.reg
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19.bak
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19.reg
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\5984.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\5985.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\5986.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\5987.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\5988.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\5989.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\598A.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\598B.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\598C.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\598D.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\598E.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\598F.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\5990.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\5991.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\5992.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\5993.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\5994.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\5995.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\5996.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\5997.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\59A8.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\59A9.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\59AA.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\59AB.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\59AC.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\59AD.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\59AE.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\59AF.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\59B0.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\59B1.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\59B2.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\59C2.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\59C3.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\59C4.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\59C5.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\59C6.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\59C7.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\59C8.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\59C9.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_July_03_11_08_40_48\688B.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_July_03_11_08_40_48\688C.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_July_03_11_08_40_48\688D.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_July_03_11_08_40_48\689E.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_July_03_11_08_40_48\689F.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_July_03_11_08_40_48\68B2.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_July_03_11_08_40_48\68F1.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_July_20_11_21_49_17\BC6.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_May_01_11_17_47_56\6FA1.tmp
c:\program files (x86)\RegCure\blue_duo.jpg
c:\program files (x86)\RegCure\buttonfill.jpg
c:\program files (x86)\RegCure\buttonfill_expire.jpg
c:\program files (x86)\RegCure\buttonfill_mo.jpg
c:\program files (x86)\RegCure\buttonfill_mo_expire.jpg
c:\program files (x86)\RegCure\BuyNags.htm
c:\program files (x86)\RegCure\center_gradient.jpg
c:\program files (x86)\RegCure\container_content_bkimg.gif
c:\program files (x86)\RegCure\container_content_leftimg.gif
c:\program files (x86)\RegCure\container_content_rightimg.gif
c:\program files (x86)\RegCure\contentwrapper.gif
c:\program files (x86)\RegCure\email.htm
c:\program files (x86)\RegCure\expire.css
c:\program files (x86)\RegCure\footerbar.gif
c:\program files (x86)\RegCure\green_duo.jpg
c:\program files (x86)\RegCure\info_bubble.jpg
c:\program files (x86)\RegCure\left_gradient.jpg
c:\program files (x86)\RegCure\logo.jpg
c:\program files (x86)\RegCure\Logs\RegCure-01-05-11-17-47-56.zip
c:\program files (x86)\RegCure\Logs\RegCure-03-07-11-08-40-49.zip
c:\program files (x86)\RegCure\Logs\RegCure-11-05-11-21-52-07.zip
c:\program files (x86)\RegCure\Logs\RegCure-14-08-11-21-08-30.zip
c:\program files (x86)\RegCure\Logs\RegCure-14-08-11-21-10-15.zip
c:\program files (x86)\RegCure\Logs\RegCure-14-08-11-21-11-11.zip
c:\program files (x86)\RegCure\Logs\RegCure-19-05-11-06-21-24.zip
c:\program files (x86)\RegCure\Logs\RegCure-20-07-11-21-49-17.zip
c:\program files (x86)\RegCure\Logs\RegCure-21-08-11-17-40-20.zip
c:\program files (x86)\RegCure\Logs\RegCure-28-04-11-16-49-04.zip
c:\program files (x86)\RegCure\Logs\RegCure-28-04-11-16-57-11.zip
c:\program files (x86)\RegCure\Logs\RegCure-28-04-11-16-57-46.zip
c:\program files (x86)\RegCure\Logs\SystemInfo.zip
c:\program files (x86)\RegCure\LogSettings.xml
c:\program files (x86)\RegCure\main.css
c:\program files (x86)\RegCure\main_nag.css
c:\program files (x86)\RegCure\main_showstats.css
c:\program files (x86)\RegCure\package_titlebar_bkimg.jpg
c:\program files (x86)\RegCure\process-animation.gif
c:\program files (x86)\RegCure\RegCure.exe
c:\program files (x86)\RegCure\regcure.gif
c:\program files (x86)\RegCure\right_gradient.jpg
c:\program files (x86)\RegCure\settings.xml
c:\program files (x86)\RegCure\showstats.htm
c:\program files (x86)\RegCure\small_vbxregcure.jpg
c:\program files (x86)\RegCure\special_offer.jpg
c:\program files (x86)\RegCure\special_offer_nag.jpg
c:\program files (x86)\RegCure\subtitlebar.gif
c:\program files (x86)\RegCure\tile_titlebar.jpg
c:\program files (x86)\RegCure\titlebar_left.jpg
c:\program files (x86)\RegCure\titlebar_right.jpg
c:\program files (x86)\RegCure\tp.css
c:\program files (x86)\RegCure\TrialPay.htm
c:\program files (x86)\RegCure\underline.gif
c:\program files (x86)\RegCure\uninst.exe
c:\program files (x86)\RegCure\zlibwapi.dll
c:\windows\FIX.reg
c:\windows\reset.reg
c:\windows\SysWow64\REN7177.tmp
c:\windows\Tasks\RegCure Program Check.job
c:\windows\Tasks\RegCure.job
c:\windows\ufa
c:\windows\ufa\ufa.exe
c:\windows\unrar.exe
c:\windows\update.8.1
c:\windows\update.tray-3-0-lnk
c:\windows\update.tray-3-0-lnk\svchost.exe
c:\windows\update.tray-3-0
c:\windows\update.tray-9-0-lnk
c:\windows\update.tray-9-0-lnk\svchost.exe
c:\windows\update.tray-9-0
c:\users\admin\AppData\Roaming\Microsoft\Windows\Recent\?Katy Perry - The yyy Next Door with lyrics in HD?? - YouTube.URL . . . . nemohl být smazán
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_gupdate
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-07-28 do 2011-08-29 )))))))))))))))))))))))))))))))
.
.
2011-08-29 09:12 . 2011-08-29 09:12 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-08-29 08:24 . 2011-08-12 04:10 8862544 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F5E77159-442E-4FDF-A4BB-9F1D8FC36297}\mpengine.dll
2011-08-29 08:23 . 2011-08-29 08:23 -------- d-----w- c:\programdata\McAfee
2011-08-29 07:39 . 2011-08-29 08:18 -------- d-----w- c:\program files\trend micro
2011-08-29 07:39 . 2011-08-29 07:42 -------- dc----w- C:\rsit
2011-08-24 06:34 . 2011-08-24 06:34 -------- d-----w- c:\windows\SysWow64\xlive
2011-08-24 06:34 . 2011-07-09 05:26 2048 ----a-w- c:\windows\system32\tzres.dll
2011-08-24 06:34 . 2011-07-09 04:29 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2011-08-22 07:21 . 2011-08-22 07:21 -------- dc----w- C:\$UPGRADE.~OS
2011-08-21 16:43 . 2011-08-21 16:43 -------- d-----w- c:\program files (x86)\SiteAdvisor
2011-08-21 16:42 . 2011-04-14 12:08 24376 ----a-w- c:\program files (x86)\Mozilla Firefox\components\Scriptff.dll
2011-08-21 16:42 . 2011-04-14 12:08 9984 ----a-w- c:\windows\system32\drivers\mfeclnk.sys
2011-08-21 16:42 . 2011-04-14 12:08 149032 ----a-w- c:\windows\system32\mfevtps.exe
2011-08-21 16:42 . 2011-04-14 12:08 94992 ----a-w- c:\windows\system32\drivers\mferkdet.sys
2011-08-21 16:42 . 2011-04-14 12:08 75160 ----a-w- c:\windows\system32\drivers\mfenlfk.sys
2011-08-21 16:42 . 2011-04-14 12:08 63056 ----a-w- c:\windows\system32\drivers\cfwids.sys
2011-08-21 16:42 . 2011-04-14 12:08 530304 ----a-w- c:\windows\system32\drivers\mfehidk.sys
2011-08-21 16:42 . 2011-04-14 12:08 441840 ----a-w- c:\windows\system32\drivers\mfefirek.sys
2011-08-21 16:42 . 2011-04-14 12:08 283744 ----a-w- c:\windows\system32\drivers\mfewfpk.sys
2011-08-21 16:42 . 2011-04-14 12:08 190520 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
2011-08-21 16:42 . 2011-08-21 16:42 -------- d-----w- c:\program files\McAfee.com
2011-08-21 16:07 . 2011-08-21 16:08 53248 ------w- c:\program files (x86)\Common Files\InstallShield\engine\6\Intel 32\msihook.dll
2011-08-21 16:07 . 2011-08-21 16:08 32768 ------w- c:\program files (x86)\Common Files\InstallShield\engine\6\Intel 32\objectps.dll
2011-08-21 16:07 . 2011-08-21 16:08 221184 ------w- c:\program files (x86)\Common Files\InstallShield\IScript\iscript.dll
2011-08-21 16:07 . 2011-08-21 16:08 598016 ------w- c:\program files (x86)\Common Files\InstallShield\engine\6\Intel 32\ikernel.exe
2011-08-21 16:07 . 2011-08-21 16:08 217088 ------w- c:\program files (x86)\Common Files\InstallShield\engine\6\Intel 32\iuser.dll
2011-08-21 16:07 . 2011-08-21 16:08 114688 ------w- c:\program files (x86)\Common Files\InstallShield\engine\6\Intel 32\scpthdlr.dll
2011-08-21 16:07 . 2011-08-21 16:07 126976 ------w- c:\program files (x86)\Common Files\InstallShield\engine\6\Intel 32\knlwrap.exe
2011-08-21 15:37 . 2011-08-21 15:37 -------- d-----w- c:\windows\av_ico
2011-08-18 10:32 . 2011-08-18 10:32 -------- d-----w- c:\program files (x86)\Atari
2011-08-17 05:12 . 2011-08-21 16:03 -------- d-----w- c:\programdata\Electronic Arts
2011-08-16 20:53 . 2003-02-11 04:02 32768 ----a-w- c:\program files (x86)\Mozilla Firefox\plugins\np32dsw.dll
2011-08-15 18:10 . 2011-08-15 18:10 -------- d-----w- c:\program files (x86)\AVI to 3GP
2011-08-12 13:28 . 2011-08-12 13:28 -------- d-----w- c:\program files (x86)\Download Master
2011-08-12 13:26 . 2011-08-12 13:26 -------- d-----w- c:\program files (x86)\REDEMAX
2011-08-10 09:55 . 2011-07-09 02:46 288768 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-08-07 20:47 . 2011-08-07 20:47 -------- d-----w- c:\users\admin\AppData\Local\Abelssoft
2011-08-07 20:47 . 2011-08-07 20:49 -------- d-----w- c:\program files (x86)\K-Lite Codec Pack
2011-08-07 20:47 . 2011-08-07 20:49 -------- d-----w- c:\program files (x86)\YouTube Song Downloader
2011-08-07 20:39 . 2011-08-07 20:39 -------- d-----w- c:\programdata\TheManWithNoLife
2011-08-07 20:39 . 2011-08-07 20:43 -------- d-----w- c:\program files\TheManWithNoLife
2011-08-07 20:02 . 2011-08-07 20:02 -------- d-----w- c:\users\admin\AppData\Roaming\DVDVideoSoftIEHelpers
2011-08-07 20:02 . 2011-08-07 20:15 -------- d-----w- c:\program files (x86)\DVDVideoSoft
2011-08-07 20:02 . 2011-08-07 20:03 -------- d-----w- c:\program files (x86)\Common Files\DVDVideoSoft
2011-08-01 05:02 . 2011-08-01 05:02 -------- d-----w- c:\users\admin\AppData\Roaming\Ventrilo
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-29 09:13 . 2010-12-05 18:39 25640 ----a-w- c:\windows\gdrv.sys
2011-08-17 07:34 . 2011-06-13 19:22 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-07-20 15:14 . 2011-06-15 19:06 18960 ----a-w- c:\windows\system32\drivers\LNonPnP.sys
2011-07-20 08:41 . 2011-07-20 17:06 34624 ----a-w- c:\windows\system32\TURegOpt.exe
2011-07-20 08:35 . 2011-07-20 17:05 25920 ----a-w- c:\windows\system32\authuitu.dll
2011-07-20 08:35 . 2011-07-20 17:05 21312 ----a-w- c:\windows\SysWow64\authuitu.dll
2011-07-20 08:35 . 2011-07-20 17:05 36160 ----a-w- c:\windows\system32\uxtuneup.dll
2011-07-20 08:35 . 2011-07-20 17:05 29504 ----a-w- c:\windows\SysWow64\uxtuneup.dll
2011-07-16 04:26 . 2011-08-10 09:55 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2011-07-15 19:58 . 2011-07-15 19:58 53248 ----a-r- c:\users\admin\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2011-07-03 15:24 . 2011-07-03 15:24 20480 ----a-w- c:\windows\SysWow64\H@tKeysH@@k.DLL
2011-07-03 14:36 . 2011-07-01 14:20 73216 ----a-w- c:\windows\ST6UNST.EXE
2011-07-03 14:36 . 2011-07-01 14:20 249856 ------w- c:\windows\Setup1.exe
2011-06-17 13:55 . 2011-06-01 10:02 466456 ----a-w- c:\windows\system32\wrap_oal.dll
2011-06-17 13:55 . 2011-06-01 10:02 122904 ----a-w- c:\windows\system32\OpenAL32.dll
2011-06-17 13:55 . 2010-12-23 19:58 444952 ----a-w- c:\windows\SysWow64\wrap_oal.dll
2011-06-17 13:55 . 2010-12-23 19:58 109080 ----a-w- c:\windows\SysWow64\OpenAL32.dll
2011-06-12 13:05 . 2011-06-12 14:33 80256 ----a-w- c:\windows\SysWow64\ezGOSvc.dll
2011-06-12 13:05 . 2011-06-12 14:33 663424 ----a-w- c:\windows\SysWow64\ezGOSvcApp.exe
2011-06-11 03:07 . 2011-07-13 06:19 3137536 ----a-w- c:\windows\system32\win32k.sys
2011-06-10 23:58 . 2011-06-10 23:58 81744 ----a-w- c:\windows\SysWow64\mfcm100u.dll
2011-06-10 23:58 . 2011-06-10 23:58 81744 ----a-w- c:\windows\SysWow64\mfcm100.dll
2011-06-10 23:58 . 2011-06-10 23:58 773968 ----a-w- c:\windows\SysWow64\msvcr100.dll
2011-06-10 23:58 . 2011-06-10 23:58 64336 ----a-w- c:\windows\SysWow64\mfc100fra.dll
2011-06-10 23:58 . 2011-06-10 23:58 64336 ----a-w- c:\windows\SysWow64\mfc100deu.dll
2011-06-10 23:58 . 2011-06-10 23:58 63824 ----a-w- c:\windows\SysWow64\mfc100esn.dll
2011-06-10 23:58 . 2011-06-10 23:58 62288 ----a-w- c:\windows\SysWow64\mfc100ita.dll
2011-06-10 23:58 . 2011-06-10 23:58 60752 ----a-w- c:\windows\SysWow64\mfc100rus.dll
2011-06-10 23:58 . 2011-06-10 23:58 55120 ----a-w- c:\windows\SysWow64\mfc100enu.dll
2011-06-10 23:58 . 2011-06-10 23:58 51024 ----a-w- c:\windows\SysWow64\vcomp100.dll
2011-06-10 23:58 . 2011-06-10 23:58 4422992 ----a-w- c:\windows\SysWow64\mfc100u.dll
2011-06-10 23:58 . 2011-06-10 23:58 4397384 ----a-w- c:\windows\SysWow64\mfc100.dll
2011-06-10 23:58 . 2011-06-10 23:58 43856 ----a-w- c:\windows\SysWow64\mfc100jpn.dll
2011-06-10 23:58 . 2011-06-10 23:58 43344 ----a-w- c:\windows\SysWow64\mfc100kor.dll
2011-06-10 23:58 . 2011-06-10 23:58 421200 ----a-w- c:\windows\SysWow64\msvcp100.dll
2011-06-10 23:58 . 2011-06-10 23:58 36176 ----a-w- c:\windows\SysWow64\mfc100cht.dll
2011-06-10 23:58 . 2011-06-10 23:58 36176 ----a-w- c:\windows\SysWow64\mfc100chs.dll
2011-06-10 23:58 . 2011-06-10 23:58 138056 ----a-w- c:\windows\SysWow64\atl100.dll
2011-06-03 14:02 . 2011-06-03 14:02 62496 ----a-w- c:\windows\system32\drivers\epfwwfp.sys
2011-06-03 14:01 . 2011-06-03 14:01 38288 ----a-w- c:\windows\system32\drivers\EpfwLWF.sys
2011-06-03 14:01 . 2011-06-03 14:01 187632 ----a-w- c:\windows\system32\drivers\epfw.sys
2011-06-03 14:01 . 2011-06-03 14:01 146432 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2011-06-03 14:00 . 2011-06-03 14:00 202064 ----a-w- c:\windows\system32\drivers\eamonm.sys
.
.
((((((((((((((((((((((((((((( SnapShot@2011-08-29_08.42.29 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-07-14 04:54 . 2011-08-29 08:26 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54 . 2011-08-29 08:56 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54 . 2011-08-29 08:56 49152 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:54 . 2011-08-29 08:26 49152 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-12-05 18:31 . 2011-08-29 08:53 62084 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2011-08-29 08:53 24708 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
- 2009-07-14 05:10 . 2011-08-29 08:23 24708 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2010-12-05 18:24 . 2011-08-29 08:53 3322 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1071306001-177135528-4153119601-1001_UserData.bin
- 2011-08-29 08:42 . 2011-08-29 08:42 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-08-29 09:13 . 2011-08-29 09:13 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-08-29 08:42 . 2011-08-29 08:42 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-08-29 09:13 . 2011-08-29 09:13 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-07-14 04:54 . 2011-08-29 08:26 131072 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2011-08-29 08:56 131072 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"ISUSPM Startup"="c:\progra~2\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2005-02-17 221184]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"hpqSRMon"="c:\program files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-07-22 150528]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-01-26 336384]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableSecureUIAPaths"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [x]
R2 McMPFSvc;McAfee Personal Firewall;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [x]
R2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [x]
R2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [x]
R3 AODDriver;AODDriver;c:\program files (x86)\Gigabyte\ET6\amd64\AODDriver.sys [2010-03-12 52280]
R3 AppleChargerSrv;AppleChargerSrv;c:\windows\system32\AppleChargerSrv.exe [x]
R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [x]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]
R3 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
R3 etdrv;etdrv;c:\windows\etdrv.sys [2010-12-06 25640]
R3 GVTDrv64;GVTDrv64;c:\windows\GVTDrv64.sys [2010-12-23 30528]
R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [x]
R3 PAC207;SoC PC-Camera;c:\windows\system32\DRIVERS\PFC027.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [x]
S0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S1 AppleCharger;AppleCharger;c:\windows\system32\DRIVERS\AppleCharger.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]
S1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\DRIVERS\mfenlfk.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-01-26 354304]
S2 AMD Reservation Manager;AMD Reservation Manager;c:\program files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe [2010-06-17 194496]
S2 ES lite Service;ES lite Service for program management.;c:\program files (x86)\Gigabyte\EasySaver\ESSVR.EXE [2009-08-24 68136]
S2 ezGOSvc;Easybits GO Services for Windows;c:\windows\system32\svchost.exe [2009-07-14 27136]
S2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [x]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe [2011-07-20 2027840]
S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [x]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\DRIVERS\LEqdUsb.Sys [x]
S3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\DRIVERS\LHidEqd.Sys [x]
S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesDriver64.sys [2011-02-10 11856]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-04-06 10144288]
"Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2006-11-03 319488]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-10-28 1680976]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [BU]
"combofix"="c:\combofix\CF23592.3XE" [2010-11-20 345088]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
ezGOSvc
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.seznam.cz/
mLocal Page = c:\windows\SYSTEM32\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
IE: Free YouTube to Mp3 Converter - c:\users\admin\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm
IE: Translate this web page with Babylon - c:\program files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm
IE: Translate with Babylon - c:\program files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Action.htm
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files (x86)\ICQ7.5\ICQ.exe
TCP: DhcpNameServer = 192.168.1.2
FF - ProfilePath - c:\users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\rwe7uvgb.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - user.js: network.http.max-connections-per-server - 6
FF - user.js: network.http.max-persistent-connections-per-server - 3
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
BHO-{ce18769b-c7fa-42d2-860d-17c4662c70ad} - (no file)
Toolbar-{ce18769b-c7fa-42d2-860d-17c4662c70ad} - (no file)
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe
c:\program files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
.
**************************************************************************
.
Celkový čas: 2011-08-29 11:16:07 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-08-29 09:16
ComboFix2.txt 2011-08-29 08:44
.
Před spuštěním: Volných bajtů: 283 008 958 464
Po spuštění: Volných bajtů: 282 943 266 816
.
- - End Of File - - 10289A3445EE084262512C5FD4C0DA2F