VIRY.CZ

Ahoj, nevyznám sa v pc, ale potrebujem poradiť. Spyboot mi našiel Win32 pornpopup, dala som ho odstrániť. Mám otázku, pre vás asi smiešnu, ale som matka a mám dve deti, tak možno ju pochopíte. Ako sa tam dostal ?

Znamená to, že moje deti chodia na porno? Moc by ma to nepotešilo...

Ďakujem vám za odpoveď.
Eve

Zdravim, pekny den preji a vitam Vas u nas na foru

Doporucuji odinstalovat Spybot - Search & Destroy - program ma uz nejlepsi leta davno za sebou a posledni cca 3 roky neni schopen celit aktualnim hrozbam

Nahrady za Spybota:
- Spyware Terminator - info o nem http://www.viry.cz/forum/viewtopic.php?f=29&t=44730
- SuperAntiSpyare - info o nem http://www.viry.cz/forum/viewtopic.php?f=29&t=51359
Samozrejme pouzivejte jen jeden z nich
Osobne doporucuji SuperAntiSpyware

Jelikoz nevime o Vasem PC nic a z kristalove koule se spatne vesti, a i pri jasnem pocasi jake ted v okrese Kromeriz panuje, neni nic videt

Ale dosti legracek, kouknem na to

Kliknete do meho podpisu na RSIT a dejte log z nej - navod Vas povede...

Ďakujem za privítanie aj za pomoc. Podarilo sa mi to podľa návodu urobiť, najprv som skúšala 32bit, ale to nešlo, tak potom som stiahla 64bit. Skúsim nakopírovať. Ale je toho nejako moc

.
Ďakujem za odpoveď.
Eve

Logfile of random's system information tool 1.08 (written by random/random)
Run by Admin at 2010-10-20 18:26:30
Microsoft Windows 7 Professional
System drive C: has 75 GB (75%) free of 100 GB
Total RAM: 3063 MB (67% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:26:41, on 20. 10. 2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16671)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files (x86)\Internet Explorer\IELowutil.exe
C:\Program Files (x86)\trend micro\Admin.exe
C:\Program Files\trend micro\Admin.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.heso-com.sk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Odoslať do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&oslať do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 6316 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\nvvsvc.exe -session -first
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe"
"C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe"
"taskhost.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Windows\system32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-801fb3f3-6542-4ac3-94c0-9a8924187740 -SystemEventPortName:HostProcess-97f08320-4eec-4321-adb7-a60409add335 -IoCancelEventPortName:HostProcess-89c3342d-00b4-4346-8310-2e17620a94e6 -NonStateChangingEventPortName:HostProcess-0c0da83d-7810-46c5-8a28-91ba1c16b174 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:4e5ded0c-e3d2-4f76-ae67-3acf1f076239
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel=2252.4f3d660.463162638 "C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll" 2252 plugin \\.\pipe\gecko-crash-server-pipe.2252
"C:\Program Files (x86)\Internet Explorer\IELowutil.exe" -embedding
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Program Files (x86)\trend micro\Admin.exe" /silentautolog
C:\Windows\System32\svchost.exe -k WerSvcGroup
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 516 520 528 65536 524
"C:\Users\Admin\RSITx64.exe"

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2010-08-12 2916584]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]
"Adobe Reader Speed Launcher"=C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-09-23 35760]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-09-20 932288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-10-20 18:26:30 ----D---- C:\Program Files\trend micro
2010-10-20 18:20:36 ----D---- C:\rsit
2010-10-20 18:20:36 ----D---- C:\Program Files (x86)\trend micro
2010-10-17 10:01:39 ----D---- C:\Program Files (x86)\Adobe
2010-10-17 10:01:20 ----SHD---- C:\Config.Msi
2010-10-17 09:30:51 ----A---- C:\Windows\ntbtlog.txt
2010-10-17 01:10:45 ----A---- C:\Windows\SYSWOW64\t2embed.dll
2010-10-17 01:10:45 ----A---- C:\Windows\system32\t2embed.dll
2010-10-17 01:10:44 ----A---- C:\Windows\system32\ole32.dll
2010-10-17 01:10:43 ----A---- C:\Windows\SYSWOW64\ole32.dll
2010-10-17 01:10:41 ----A---- C:\Windows\SYSWOW64\StructuredQuery.dll
2010-10-17 01:10:41 ----A---- C:\Windows\SYSWOW64\schannel.dll
2010-10-17 01:10:41 ----A---- C:\Windows\system32\StructuredQuery.dll
2010-10-17 01:10:41 ----A---- C:\Windows\system32\schannel.dll
2010-10-17 01:10:39 ----A---- C:\Windows\SYSWOW64\comctl32.dll
2010-10-17 01:10:39 ----A---- C:\Windows\system32\comctl32.dll
2010-10-17 01:10:38 ----A---- C:\Windows\SYSWOW64\wmpmde.dll
2010-10-17 01:10:38 ----A---- C:\Windows\system32\wmpmde.dll
2010-10-17 01:10:36 ----A---- C:\Windows\system32\wmp.dll
2010-10-17 01:10:34 ----A---- C:\Windows\SYSWOW64\wmp.dll
2010-10-17 01:10:33 ----A---- C:\Windows\SYSWOW64\wmploc.DLL
2010-10-17 01:10:33 ----A---- C:\Windows\system32\wmploc.DLL
2010-10-17 01:10:28 ----A---- C:\Windows\system32\mshtml.dll
2010-10-17 01:10:27 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2010-10-17 01:10:27 ----A---- C:\Windows\system32\iertutil.dll
2010-10-17 01:10:27 ----A---- C:\Windows\system32\ieframe.dll
2010-10-17 01:10:25 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2010-10-17 01:10:24 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2010-10-17 01:10:23 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2010-10-17 01:10:23 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2010-10-17 01:10:23 ----A---- C:\Windows\system32\urlmon.dll
2010-10-17 01:10:23 ----A---- C:\Windows\system32\msfeeds.dll
2010-10-17 01:10:23 ----A---- C:\Windows\system32\licmgr10.dll
2010-10-17 01:10:22 ----A---- C:\Windows\SYSWOW64\wininet.dll
2010-10-17 01:10:22 ----A---- C:\Windows\SYSWOW64\mstime.dll
2010-10-17 01:10:22 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2010-10-17 01:10:22 ----A---- C:\Windows\SYSWOW64\msfeedsbs.dll
2010-10-17 01:10:22 ----A---- C:\Windows\SYSWOW64\licmgr10.dll
2010-10-17 01:10:22 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2010-10-17 01:10:22 ----A---- C:\Windows\SYSWOW64\ieui.dll
2010-10-17 01:10:22 ----A---- C:\Windows\SYSWOW64\iepeers.dll
2010-10-17 01:10:22 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2010-10-17 01:10:22 ----A---- C:\Windows\system32\wininet.dll
2010-10-17 01:10:22 ----A---- C:\Windows\system32\mstime.dll
2010-10-17 01:10:22 ----A---- C:\Windows\system32\mshtmled.dll
2010-10-17 01:10:22 ----A---- C:\Windows\system32\msfeedsbs.dll
2010-10-17 01:10:22 ----A---- C:\Windows\system32\jsproxy.dll
2010-10-17 01:10:22 ----A---- C:\Windows\system32\ieui.dll
2010-10-17 01:10:22 ----A---- C:\Windows\system32\iepeers.dll
2010-10-17 01:10:22 ----A---- C:\Windows\system32\iedkcs32.dll
2010-10-17 01:10:21 ----A---- C:\Windows\SYSWOW64\msfeedssync.exe
2010-10-17 01:10:21 ----A---- C:\Windows\system32\msfeedssync.exe
2010-10-17 01:10:19 ----A---- C:\Windows\SYSWOW64\mfc40u.dll
2010-10-17 01:10:19 ----A---- C:\Windows\SYSWOW64\mfc40.dll
2010-10-17 01:10:18 ----A---- C:\Windows\SYSWOW64\sscore.dll
2010-10-17 01:10:18 ----A---- C:\Windows\system32\srvsvc.dll
2010-10-17 01:10:18 ----A---- C:\Windows\system32\drivers\srvnet.sys
2010-10-17 01:10:18 ----A---- C:\Windows\system32\drivers\srv2.sys
2010-10-17 01:10:18 ----A---- C:\Windows\system32\drivers\srv.sys
2010-10-17 01:10:17 ----A---- C:\Windows\system32\win32k.sys
2010-10-08 16:29:12 ----D---- C:\Users\Admin\AppData\Roaming\Mozilla
2010-10-08 16:29:07 ----D---- C:\Program Files (x86)\Mozilla Firefox
2010-09-30 00:34:33 ----A---- C:\Windows\system32\drivers\ks.sys
2010-09-29 21:12:24 ----A---- C:\Windows\SYSWOW64\tzres.dll
2010-09-29 21:12:24 ----A---- C:\Windows\system32\tzres.dll
2010-09-27 15:54:34 ----D---- C:\Users\Admin\AppData\Roaming\Macromedia
2010-09-27 15:12:39 ----D---- C:\Users\Admin\AppData\Roaming\WinRAR
2010-09-27 15:12:16 ----D---- C:\Windows\SYSWOW64\Macromed
2010-09-23 19:14:37 ----D---- C:\Windows\Panther
2010-09-23 12:16:14 ----D---- C:\Windows\SYSWOW64\RTCOM
2010-09-23 12:16:14 ----D---- C:\Program Files\Realtek
2010-09-23 12:15:56 ----A---- C:\Windows\system32\drivers\sffp_sd.sys
2010-09-23 12:13:52 ----D---- C:\Windows\SYSWOW64\Wat
2010-09-23 12:13:52 ----D---- C:\Windows\system32\Wat
2010-09-23 12:05:38 ----D---- C:\Users\Admin\AppData\Roaming\Lavasoft
2010-09-23 12:05:06 ----D---- C:\Program Files (x86)\Lavasoft
2010-09-23 12:01:29 ----A---- C:\Windows\SYSWOW64\msv1_0.dll
2010-09-23 12:01:29 ----A---- C:\Windows\system32\msv1_0.dll
2010-09-23 11:58:19 ----A---- C:\Windows\SYSWOW64\PresentationHostProxy.dll
2010-09-23 11:58:19 ----A---- C:\Windows\SYSWOW64\PresentationHost.exe
2010-09-23 11:58:19 ----A---- C:\Windows\SYSWOW64\netfxperf.dll
2010-09-23 11:58:19 ----A---- C:\Windows\SYSWOW64\mscoree.dll
2010-09-23 11:58:19 ----A---- C:\Windows\SYSWOW64\dfshim.dll
2010-09-23 11:58:19 ----A---- C:\Windows\system32\PresentationHostProxy.dll
2010-09-23 11:58:19 ----A---- C:\Windows\system32\PresentationHost.exe
2010-09-23 11:58:19 ----A---- C:\Windows\system32\netfxperf.dll
2010-09-23 11:58:19 ----A---- C:\Windows\system32\mscoree.dll
2010-09-23 11:58:19 ----A---- C:\Windows\system32\dfshim.dll
2010-09-23 11:58:10 ----A---- C:\Windows\system32\browserchoice.exe
2010-09-23 11:57:11 ----A---- C:\Windows\system32\MRT.exe
2010-09-23 11:55:12 ----A---- C:\Windows\SYSWOW64\wow32.dll
2010-09-23 11:55:12 ----A---- C:\Windows\SYSWOW64\user.exe
2010-09-23 11:55:12 ----A---- C:\Windows\SYSWOW64\setup16.exe
2010-09-23 11:55:12 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2010-09-23 11:55:12 ----A---- C:\Windows\SYSWOW64\instnm.exe
2010-09-23 11:55:12 ----A---- C:\Windows\system32\wow64.dll
2010-09-23 11:55:11 ----A---- C:\Windows\system32\spoolsv.exe
2010-09-23 11:54:50 ----A---- C:\Windows\SYSWOW64\rtutils.dll
2010-09-23 11:54:50 ----A---- C:\Windows\system32\rtutils.dll
2010-09-23 11:54:47 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2010-09-23 11:54:47 ----A---- C:\Windows\SYSWOW64\secur32.dll
2010-09-23 11:54:47 ----A---- C:\Windows\system32\lsasrv.dll
2010-09-23 11:54:47 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2010-09-23 11:54:40 ----A---- C:\Windows\SYSWOW64\CertEnroll.dll
2010-09-23 11:54:40 ----A---- C:\Windows\system32\CertEnroll.dll
2010-09-23 11:54:33 ----A---- C:\Windows\SYSWOW64\CPFilters.dll
2010-09-23 11:54:33 ----A---- C:\Windows\system32\CPFilters.dll
2010-09-23 11:54:32 ----A---- C:\Windows\system32\psisdecd.dll
2010-09-23 11:54:32 ----A---- C:\Windows\system32\msdri.dll
2010-09-23 11:54:31 ----A---- C:\Windows\SYSWOW64\psisdecd.dll
2010-09-23 11:54:20 ----A---- C:\Windows\system32\ntoskrnl.exe
2010-09-23 11:54:19 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2010-09-23 11:54:18 ----A---- C:\Windows\SYSWOW64\secproc_isv.dll
2010-09-23 11:54:18 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2010-09-23 11:54:18 ----A---- C:\Windows\system32\secproc_isv.dll
2010-09-23 11:54:17 ----A---- C:\Windows\SYSWOW64\secproc_ssp_isv.dll
2010-09-23 11:54:17 ----A---- C:\Windows\SYSWOW64\secproc_ssp.dll
2010-09-23 11:54:17 ----A---- C:\Windows\SYSWOW64\secproc.dll
2010-09-23 11:54:17 ----A---- C:\Windows\SYSWOW64\RMActivate_ssp_isv.exe
2010-09-23 11:54:17 ----A---- C:\Windows\SYSWOW64\RMActivate_ssp.exe
2010-09-23 11:54:17 ----A---- C:\Windows\SYSWOW64\RMActivate_isv.exe
2010-09-23 11:54:17 ----A---- C:\Windows\SYSWOW64\RMActivate.exe
2010-09-23 11:54:17 ----A---- C:\Windows\system32\secproc_ssp_isv.dll
2010-09-23 11:54:17 ----A---- C:\Windows\system32\secproc_ssp.dll
2010-09-23 11:54:17 ----A---- C:\Windows\system32\secproc.dll
2010-09-23 11:54:17 ----A---- C:\Windows\system32\RMActivate_ssp_isv.exe
2010-09-23 11:54:17 ----A---- C:\Windows\system32\RMActivate_ssp.exe
2010-09-23 11:54:17 ----A---- C:\Windows\system32\RMActivate_isv.exe
2010-09-23 11:54:17 ----A---- C:\Windows\system32\RMActivate.exe
2010-09-23 11:54:16 ----A---- C:\Windows\SYSWOW64\explorer.exe
2010-09-23 11:54:16 ----A---- C:\Windows\system32\winlogon.exe
2010-09-23 11:54:16 ----A---- C:\Windows\explorer.exe
2010-09-23 11:54:15 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2010-09-23 11:54:15 ----A---- C:\Windows\system32\cdd.dll
2010-09-23 11:54:13 ----A---- C:\Windows\system32\shell32.dll
2010-09-23 11:54:11 ----A---- C:\Windows\SYSWOW64\shell32.dll
2010-09-23 11:54:09 ----A---- C:\Windows\SYSWOW64\oleaut32.dll
2010-09-23 11:54:08 ----A---- C:\Windows\system32\oleaut32.dll
2010-09-23 11:54:08 ----A---- C:\Windows\system32\drivers\tcpip.sys
2010-09-23 11:54:07 ----A---- C:\Windows\SYSWOW64\quartz.dll
2010-09-23 11:54:07 ----A---- C:\Windows\SYSWOW64\msvidc32.dll
2010-09-23 11:54:07 ----A---- C:\Windows\SYSWOW64\mciavi32.dll
2010-09-23 11:54:07 ----A---- C:\Windows\system32\tsbyuv.dll
2010-09-23 11:54:07 ----A---- C:\Windows\system32\quartz.dll
2010-09-23 11:54:07 ----A---- C:\Windows\system32\msyuv.dll
2010-09-23 11:54:07 ----A---- C:\Windows\system32\msvidc32.dll
2010-09-23 11:54:07 ----A---- C:\Windows\system32\msrle32.dll
2010-09-23 11:54:07 ----A---- C:\Windows\system32\iyuv_32.dll
2010-09-23 11:54:06 ----A---- C:\Windows\SYSWOW64\tsbyuv.dll
2010-09-23 11:54:06 ----A---- C:\Windows\SYSWOW64\msyuv.dll
2010-09-23 11:54:06 ----A---- C:\Windows\SYSWOW64\msrle32.dll
2010-09-23 11:54:06 ----A---- C:\Windows\SYSWOW64\iyuv_32.dll
2010-09-23 11:54:06 ----A---- C:\Windows\SYSWOW64\avifil32.dll
2010-09-23 11:54:05 ----A---- C:\Windows\SYSWOW64\ntdll.dll
2010-09-23 11:54:05 ----A---- C:\Windows\system32\ntdll.dll
2010-09-23 11:54:03 ----A---- C:\Windows\SYSWOW64\msxml3.dll
2010-09-23 11:54:03 ----A---- C:\Windows\system32\msxml3.dll
2010-09-23 11:54:02 ----A---- C:\Windows\system32\atmfd.dll
2010-09-23 11:54:01 ----A---- C:\Windows\SYSWOW64\fontsub.dll
2010-09-23 11:54:01 ----A---- C:\Windows\SYSWOW64\atmlib.dll
2010-09-23 11:54:01 ----A---- C:\Windows\SYSWOW64\atmfd.dll
2010-09-23 11:54:01 ----A---- C:\Windows\system32\fontsub.dll
2010-09-23 11:54:01 ----A---- C:\Windows\system32\atmlib.dll
2010-09-23 11:53:58 ----A---- C:\Windows\system32\drivers\fvevol.sys
2010-09-23 11:53:57 ----A---- C:\Windows\system32\inetcomm.dll
2010-09-23 11:53:56 ----A---- C:\Windows\SYSWOW64\inetcomm.dll
2010-09-23 11:53:55 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2010-09-23 11:53:55 ----A---- C:\Windows\SYSWOW64\msasn1.dll
2010-09-23 11:53:55 ----A---- C:\Windows\system32\vbscript.dll
2010-09-23 11:53:55 ----A---- C:\Windows\system32\msasn1.dll
2010-09-23 11:53:52 ----A---- C:\Windows\SYSWOW64\jscript.dll
2010-09-23 11:53:52 ----A---- C:\Windows\system32\jscript.dll
2010-09-23 11:53:42 ----A---- C:\Windows\SYSWOW64\asycfilt.dll
2010-09-23 11:53:42 ----A---- C:\Windows\system32\asycfilt.dll
2010-09-23 11:53:41 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2010-09-23 11:53:41 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2010-09-23 11:53:41 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2010-09-23 11:53:40 ----A---- C:\Windows\SYSWOW64\iccvid.dll
2010-09-23 11:43:11 ----D---- C:\Users\Admin\AppData\Roaming\ESET
2010-09-23 11:42:23 ----D---- C:\ProgramData\ESET
2010-09-23 11:42:23 ----D---- C:\Program Files\ESET
2010-09-23 11:28:17 ----D---- C:\Users\Admin\AppData\Roaming\Win7codecs
2010-09-23 11:28:15 ----D---- C:\Program Files (x86)\Win7codecs
2010-09-23 11:27:41 ----D---- C:\ProgramData\Win7codecs
2010-09-23 11:22:22 ----D---- C:\Users\Admin\AppData\Roaming\Adobe
2010-09-23 11:15:53 ----D---- C:\Program Files (x86)\Microsoft Works
2010-09-23 11:15:40 ----D---- C:\Program Files (x86)\Microsoft Visual Studio
2010-09-23 11:15:24 ----D---- C:\Windows\PCHEALTH
2010-09-23 11:15:24 ----D---- C:\Program Files (x86)\Microsoft.NET
2010-09-23 11:13:51 ----D---- C:\Program Files\Microsoft Office
2010-09-23 11:13:46 ----D---- C:\Program Files (x86)\Microsoft Visual Studio 8
2010-09-23 11:13:22 ----D---- C:\ProgramData\Microsoft Help
2010-09-23 11:13:22 ----D---- C:\Program Files (x86)\Microsoft Office
2010-09-23 11:13:10 ----RHD---- C:\MSOCache
2010-09-23 11:10:18 ----D---- C:\Users\Admin\AppData\Roaming\GHISLER
2010-09-23 11:10:18 ----D---- C:\totalcmd
2010-09-23 11:10:18 ----A---- C:\Windows\UC.PIF
2010-09-23 11:10:18 ----A---- C:\Windows\RAR.PIF
2010-09-23 11:10:18 ----A---- C:\Windows\PKZIP.PIF
2010-09-23 11:10:18 ----A---- C:\Windows\PKUNZIP.PIF
2010-09-23 11:10:18 ----A---- C:\Windows\NOCLOSE.PIF
2010-09-23 11:10:18 ----A---- C:\Windows\LHA.PIF
2010-09-23 11:10:18 ----A---- C:\Windows\ARJ.PIF
2010-09-23 11:09:16 ----D---- C:\ProgramData\Spybot - Search & Destroy
2010-09-23 11:09:16 ----D---- C:\Program Files (x86)\Spybot - Search & Destroy
2010-09-23 11:06:15 ----D---- C:\ProgramData\Adobe
2010-09-23 11:04:06 ----D---- C:\Program Files (x86)\WinRAR
2010-09-23 10:56:12 ----N---- C:\Windows\system32\MpSigStub.exe
2010-09-23 10:54:37 ----D---- C:\Windows\SYSWOW64\drivers\sk-SK
2010-09-23 10:54:36 ----D---- C:\Windows\sk-SK
2010-09-23 10:54:34 ----D---- C:\Windows\system32\drivers\sk-SK
2010-09-23 10:38:02 ----D---- C:\ProgramData\NVIDIA
2010-09-23 10:36:11 ----SHD---- C:\Windows\Installer
2010-09-23 10:36:07 ----D---- C:\Program Files\NVIDIA Corporation
2010-09-23 10:24:10 ----A---- C:\Windows\SYSWOW64\wintrust.dll
2010-09-23 10:24:10 ----A---- C:\Windows\system32\wintrust.dll
2010-09-23 10:24:09 ----A---- C:\Windows\SYSWOW64\cabview.dll
2010-09-23 10:24:09 ----A---- C:\Windows\system32\cabview.dll
2010-09-23 10:23:08 ----D---- C:\Users\Admin\AppData\Roaming\Identities
2010-09-23 10:22:58 ----SD---- C:\Users\Admin\AppData\Roaming\Microsoft
2010-09-23 10:22:58 ----D---- C:\Users\Admin\AppData\Roaming\Media Center Programs
2010-09-23 10:22:50 ----SHD---- C:\Recovery
2010-09-23 10:22:45 ----D---- C:\Windows\SoftwareDistribution
2010-09-23 09:15:38 ----D---- C:\Windows\Prefetch
2010-09-23 09:15:04 ----ASH---- C:\pagefile.sys
2010-09-23 09:15:03 ----SHD---- C:\System Volume Information
2010-09-23 09:15:03 ----ASH---- C:\hiberfil.sys

======List of files/folders modified in the last 1 months======

2010-10-20 18:26:32 ----D---- C:\Windows\Temp
2010-10-20 18:26:30 ----RD---- C:\Program Files
2010-10-20 18:20:36 ----RD---- C:\Program Files (x86)
2010-10-20 18:19:16 ----D---- C:\Windows\System32
2010-10-20 18:19:15 ----D---- C:\Windows\inf
2010-10-20 18:19:15 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-10-20 18:15:53 ----D---- C:\Windows\system32\config
2010-10-19 09:27:35 ----D---- C:\Windows\system32\NDF
2010-10-17 10:01:39 ----D---- C:\Program Files (x86)\Common Files
2010-10-17 10:01:14 ----D---- C:\Windows\SysWOW64
2010-10-17 09:54:00 ----D---- C:\Windows\winsxs
2010-10-17 09:52:38 ----D---- C:\Windows\SYSWOW64\migration
2010-10-17 09:52:38 ----D---- C:\Windows\system32\migration
2010-10-17 09:52:38 ----D---- C:\Windows\system32\drivers
2010-10-17 09:52:38 ----D---- C:\Program Files\Windows Media Player
2010-10-17 09:52:38 ----D---- C:\Program Files\Internet Explorer
2010-10-17 09:52:38 ----D---- C:\Program Files (x86)\Windows Media Player
2010-10-17 09:52:38 ----D---- C:\Program Files (x86)\Internet Explorer
2010-10-17 09:30:51 ----D---- C:\Windows
2010-10-17 03:09:51 ----RSD---- C:\Windows\assembly
2010-10-17 03:09:51 ----D---- C:\Windows\Microsoft.NET
2010-10-17 01:10:14 ----D---- C:\Windows\system32\catroot
2010-10-17 01:09:55 ----D---- C:\Windows\system32\catroot2
2010-10-01 09:36:24 ----D---- C:\Windows\system32\wdi
2010-10-01 07:03:29 ----D---- C:\Windows\SYSWOW64\sk-SK
2010-10-01 07:03:29 ----D---- C:\Windows\SYSWOW64\en-US
2010-10-01 07:03:29 ----D---- C:\Windows\system32\sk-SK
2010-10-01 07:03:29 ----D---- C:\Windows\system32\en-US
2010-10-01 07:03:28 ----D---- C:\Windows\system32\DriverStore
2010-09-29 10:17:14 ----D---- C:\Windows\Logs
2010-09-27 15:00:57 ----D---- C:\Windows\Downloaded Program Files
2010-09-23 12:10:51 ----D---- C:\Windows\system32\Tasks
2010-09-23 12:08:15 ----D---- C:\Program Files\Windows Mail
2010-09-23 12:08:15 ----D---- C:\Program Files (x86)\Windows Mail
2010-09-23 12:08:13 ----D---- C:\Windows\AppPatch
2010-09-23 12:08:12 ----D---- C:\Windows\ehome
2010-09-23 12:05:38 ----SD---- C:\ProgramData\Microsoft
2010-09-23 11:57:12 ----D---- C:\Windows\debug
2010-09-23 11:42:23 ----HD---- C:\ProgramData
2010-09-23 11:26:22 ----D---- C:\Windows\system32\drivers\etc
2010-09-23 11:20:23 ----RSD---- C:\Windows\Fonts
2010-09-23 11:18:47 ----A---- C:\Windows\win.ini
2010-09-23 11:15:49 ----D---- C:\Program Files (x86)\MSBuild
2010-09-23 11:15:39 ----D---- C:\Windows\ShellNew
2010-09-23 11:14:53 ----D---- C:\Program Files\Common Files\Microsoft Shared
2010-09-23 10:54:40 ----D---- C:\Program Files\Windows Sidebar
2010-09-23 10:54:40 ----D---- C:\Program Files\Windows Photo Viewer
2010-09-23 10:54:40 ----D---- C:\Program Files\Windows Journal
2010-09-23 10:54:40 ----D---- C:\Program Files\Windows Defender
2010-09-23 10:54:40 ----D---- C:\Program Files\DVD Maker
2010-09-23 10:54:40 ----D---- C:\Program Files\Common Files\System
2010-09-23 10:54:40 ----D---- C:\Program Files (x86)\Windows Sidebar
2010-09-23 10:54:39 ----D---- C:\Windows\SYSWOW64\migwiz
2010-09-23 10:54:39 ----D---- C:\Windows\servicing
2010-09-23 10:54:39 ----D---- C:\Program Files (x86)\Windows Photo Viewer
2010-09-23 10:54:39 ----D---- C:\Program Files (x86)\Windows Defender
2010-09-23 10:54:37 ----D---- C:\Windows\SYSWOW64\WCN
2010-09-23 10:54:37 ----D---- C:\Windows\SYSWOW64\wbem
2010-09-23 10:54:37 ----D---- C:\Windows\SYSWOW64\drivers
2010-09-23 10:54:36 ----D---- C:\Windows\system32\sysprep
2010-09-23 10:54:36 ----D---- C:\Windows\system32\oobe
2010-09-23 10:54:36 ----D---- C:\Windows\system32\migwiz
2010-09-23 10:54:36 ----D---- C:\Windows\PolicyDefinitions
2010-09-23 10:54:34 ----D---- C:\Windows\system32\WCN
2010-09-23 10:54:33 ----D---- C:\Windows\system32\wbem
2010-09-23 10:36:21 ----D---- C:\Windows\Help
2010-09-23 10:35:31 ----D---- C:\Windows\system32\restore
2010-09-23 10:31:19 ----D---- C:\Windows\system32\CodeIntegrity
2010-09-23 10:23:06 ----SHD---- C:\$Recycle.Bin
2010-09-23 10:22:55 ----RD---- C:\Users
2010-09-23 10:22:50 ----D---- C:\Windows\system32\Recovery
2010-09-23 09:19:55 ----D---- C:\Windows\rescache
2010-09-23 09:16:17 ----D---- C:\Windows\system32\drivers\UMDF
2010-09-23 09:15:34 ----D---- C:\Windows\CSC

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 214096]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 514048]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2010-07-29 141264]
R2 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2010-07-29 168544]
R2 epfw;epfw; C:\Windows\system32\DRIVERS\epfw.sys [2010-07-29 171152]
R2 epfwwfp;epfwwfp; C:\Windows\system32\DRIVERS\epfwwfp.sys [2010-07-29 50624]
R3 Epfwndis;Eset Personal Firewall; C:\Windows\system32\DRIVERS\Epfwndis.sys [2010-07-29 33632]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2009-08-04 1973792]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2009-03-01 187392]
S3 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12352]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 165376]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 6656]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 34896]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 200272]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 21760]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [2010-08-12 810144]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2010-05-21 159336]
R2 SBSDWSCService;SBSD Security Center Service; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2010-08-12 42360]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-09-23 1255736]

-----------------EOF-----------------

Odinstalovala jste ten Spybot a nainstalovala SuperAntiSpyware

Pokud ano tak, udelejte pres nej scan (navod http://viry.cz/forum/viewtopic.php?f=29&t=51359 ) a log sem pak dejte

Pokud ne, tak udelame sken pomoci MBAM - viz nize

Stahnete Malwarebytes' Anti-Malware (zkracene MBAM) (viz muj podpis)

Provedte aktualizaci - treti zalozka
Provedte uplny sken - nic nemazte
MBAM miva obcas falesne detekce, proto vlozte log do prispevku a pockejte na posouzeni

No, neodinstalovala a nenainstalovala som to, idem na to, snad nic nepokazim, ja som antitalent

. Urobila som vcera to mbam, tak posielam.
Dakujem.
Eve

20. 10. 2010 19:12:25
mbam-log-2010-10-20 (19-12-25).txt

Typ kontroly: Úplná kontrola (C:\|D:\|)
Objektov kontrolovaných: 219494
Uplynulý čas: 19 min, 55 sek

Infikované služby pamäte: 0
Infikované moduly pamäte: 0
Infikované registračné kľúče: 0
Infikované registračné hodnoty: 0
Infikované položky registračných dát: 0
Infikované priečinky: 0
Infikované súbory: 1

Infikované služby pamäte:
(Škodlivé položky neboli zistené)

Infikované moduly pamäte:
(Škodlivé položky neboli zistené)

Infikované registračné kľúče:
(Škodlivé položky neboli zistené)

Infikované registračné hodnoty:
(Škodlivé položky neboli zistené)

Infikované položky registračných dát:
(Škodlivé položky neboli zistené)

Infikované priečinky:
(Škodlivé položky neboli zistené)

Infikované súbory:
D:\Install\tc11.exe (Trojan.FlashKiller) -> No action taken.

Odinstalovala som Spybot a nainstalovala SuperAntiSpyvare. Len Spybot mi nakoniec napisal, nieco v zmysle, ze sa odinstaloval, ale niektore sucasti zostali a mozem ich odinstalovat rucne. Odinstalovavala som cez ovladaci panel-odinstalovat program. Vysledok SuperAntiSpyvare je tu:

Dakujem za ochotu, je to fajn, ze mate so mnou trpezlivost.
Eve

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 10/21/2010 at 02:15 PM

Application Version : 4.44.1000

Core Rules Database Version : 5725
Trace Rules Database Version: 3537

Scan type : Complete Scan
Total Scan Time : 00:19:36

Memory items scanned : 546
Memory threats detected : 0
Registry items scanned : 13021
Registry threats detected : 0
File items scanned : 23099
File threats detected : 41

Adware.Tracking Cookie
.etargetnet.com [ C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2c5yp1i8.default\cookies.sqlite ]
.adtech.de [ C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2c5yp1i8.default\cookies.sqlite ]
.toplist.cz [ C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2c5yp1i8.default\cookies.sqlite ]
.toplist.sk [ C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2c5yp1i8.default\cookies.sqlite ]
.bs.serving-sys.com [ C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2c5yp1i8.default\cookies.sqlite ]
.serving-sys.com [ C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2c5yp1i8.default\cookies.sqlite ]
.serving-sys.com [ C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2c5yp1i8.default\cookies.sqlite ]
.serving-sys.com [ C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2c5yp1i8.default\cookies.sqlite ]
.serving-sys.com [ C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2c5yp1i8.default\cookies.sqlite ]
.serving-sys.com [ C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2c5yp1i8.default\cookies.sqlite ]
.serving-sys.com [ C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2c5yp1i8.default\cookies.sqlite ]
.serving-sys.com [ C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2c5yp1i8.default\cookies.sqlite ]
.imrworldwide.com [ C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2c5yp1i8.default\cookies.sqlite ]
.imrworldwide.com [ C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2c5yp1i8.default\cookies.sqlite ]
.smartadserver.com [ C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2c5yp1i8.default\cookies.sqlite ]
.smartadserver.com [ C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2c5yp1i8.default\cookies.sqlite ]
.smartadserver.com [ C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2c5yp1i8.default\cookies.sqlite ]
.smartadserver.com [ C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2c5yp1i8.default\cookies.sqlite ]
.smartadserver.com [ C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2c5yp1i8.default\cookies.sqlite ]
adserver.itsfogo.com [ C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2c5yp1i8.default\cookies.sqlite ]
b2m.web2media.sk [ C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2c5yp1i8.default\cookies.sqlite ]
b2m.web2media.sk [ C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2c5yp1i8.default\cookies.sqlite ]
.rambler.ru [ C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2c5yp1i8.default\cookies.sqlite ]
.nhl.112.2o7.net [ C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2c5yp1i8.default\cookies.sqlite ]
counter.cnw.cz [ C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2c5yp1i8.default\cookies.sqlite ]
counter.cnw.cz [ C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2c5yp1i8.default\cookies.sqlite ]
counter.cnw.cz [ C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2c5yp1i8.default\cookies.sqlite ]
www.etracker.de [ C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2c5yp1i8.default\cookies.sqlite ]
.etargetnet.com [ C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2c5yp1i8.default\cookies.sqlite ]
.etargetnet.com [ C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2c5yp1i8.default\cookies.sqlite ]
.estat.com [ C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2c5yp1i8.default\cookies.sqlite ]
.smartadserver.com [ C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2c5yp1i8.default\cookies.sqlite ]
.doubleclick.net [ C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2c5yp1i8.default\cookies.sqlite ]
.invitemedia.com [ C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2c5yp1i8.default\cookies.sqlite ]
.invitemedia.com [ C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2c5yp1i8.default\cookies.sqlite ]
.collective-media.net [ C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2c5yp1i8.default\cookies.sqlite ]
.collective-media.net [ C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2c5yp1i8.default\cookies.sqlite ]
.interclick.com [ C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2c5yp1i8.default\cookies.sqlite ]
.invitemedia.com [ C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2c5yp1i8.default\cookies.sqlite ]
.interclick.com [ C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2c5yp1i8.default\cookies.sqlite ]
.interclick.com [ C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2c5yp1i8.default\cookies.sqlite ]

Stahnete OTM (viz muj podpis)

Pokud pouzivate Win Vista ci W7, kliknete na OTM pravym a dejte Run As Administrator ci Spustit jako spravce
Do leveho okna Paste Instructions for Items to be Moved (pod zlutou caru) vlozte obsah, ktery mate nize

Kód: Vybrat vše

:reg
[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"=-
"Adobe ARM"=-

:files
D:\Install\tc11.exe
%windir%\system32\*.tmp.dll /s
%windir%\system32\SET*.tmp /s
%windir%\*.tmp /s

:commands
[RESETHOSTS]
[EMPTYTEMP]
[EMPTYFLASH]
[CLEARALLRESTOREPOINTS]

Kliknete na cervene tlacitko MoveIt!
Budete vyzvani na restart, dejte Yes, log pote najdete C:\_OTM\MovedFiles, obsah sem vlozte

Jinak PC vypada na havet ciste

Ahoj, vysledok je tu.
Dakujem.
Eve

All processes killed
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run\\Adobe Reader Speed Launcher deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run\\Adobe ARM deleted successfully.
========== FILES ==========
D:\Install\tc11.exe moved successfully.
File/Folder C:\Windows\system32\*.tmp.dll not found.
File/Folder C:\Windows\system32\SET*.tmp not found.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP2730.tmp folder moved successfully.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp folder moved successfully.
C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP2194.tmp folder moved successfully.
C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp folder moved successfully.
C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp folder moved successfully.
C:\Windows\SoftwareDistribution\Download\1c39bb66112ccb45aa0a3d045d02b7c0\BITA044.tmp moved successfully.
C:\Windows\Temp\DMI5B68.tmp moved successfully.
C:\Windows\Temp\TFR6BC3.tmp moved successfully.
C:\Windows\Temp\TS_9AC9.tmp moved successfully.
C:\Windows\Temp\TS_9F3D.tmp moved successfully.
C:\Windows\Temp\TS_A21B.tmp moved successfully.
C:\Windows\Temp\TS_A863.tmp moved successfully.
C:\Windows\Temp\TS_A9F9.tmp moved successfully.
C:\Windows\Temp\TS_B5AD.tmp moved successfully.
C:\Windows\Temp\TS_B754.tmp moved successfully.
C:\Windows\Temp\TS_BD9B.tmp moved successfully.
C:\Windows\Temp\TS_C01C.tmp moved successfully.
C:\Windows\Temp\TS_E4A3.tmp moved successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: Admin
->Temp folder emptied: 39851764 bytes
->Temporary Internet Files folder emptied: 71196978 bytes
->FireFox cache emptied: 116243135 bytes
->Flash cache emptied: 5237 bytes

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 13751500 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50453 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 230,00 mb

Restore point Set: OTM Restore Point

OTM by OldTimer - Version 3.1.16.1 log created on 10222010_140710

Files moved on Reboot...
C:\Users\Admin\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MOQ3QFAT\viewtopic[1].htm moved successfully.
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\J1CATC7U\afr[1].htm moved successfully.
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\J1CATC7U\afr[2].htm moved successfully.
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5HD2DUFJ\afr[1].htm moved successfully.
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5HD2DUFJ\honeypot_export[1].htm moved successfully.
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully.

Registry entries deleted on Reboot...

Teraz som si vsimla v tom vypise OTM, co som vam prave poslala, niekde je pisane ze IE5. Pouzivam tu casto aj mozillu, ta je v poriadku? Prepacte, ak je to blba otazka

Dakujem.
Eve

Nejak nenasel zadnou havet co by Vase deti do PC natahaly...

Je mozne nastavit na PC sledovani obsahu = bude vedet kam deti chodi

Nebo existuji aplikace a i v IE to jde nastavit, aby takoveto stranky primo blokovali (porno apod.)

Bod 1 ma velmi potesil

, lebo na odstranovanie havede nemam bunky.
Bod 2 by som vyskusala, ak mi poradite ako na to. Toto by mohla byt pre zaciatok dobra cesta, aby som ich nahodou krivo neobvinovala. Pokial by sa nieco objavilo, pride na radu vychovny rozhovor, a ked nezaberie, tak pouzijem nejaku aplikaciu na blokovanie nevhodnych stranok. Zatial na to fakt nemaju vek. Ak mozem nakoniec poprosit, poradite mi este s "Je mozne nastavit na PC sledovani obsahu = bude vedet kam deti chodi"

Za vsetko velmi pekne dakujem.
Eve

Takze tenhle prispevek uklidi po utilitach a procisti PC od zbytecnosti

OTC http://oldtimer.geekstogo.com/OTC.exe

Stahnete a spustte
Kliknete na CleanUp a potvrdte YES
Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

Stahnete a spustte
Kliknete na Start a potvrdte OK
Program uklidi a restartuje pc
Po pouziti utilitu smazte

Stahnete Ccleaner (viz muj podpis), pri instalaci dejte fajfku pryc u yahoo toolbaru
Panel čistič

Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

dejte Hledej problémy
nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za 14 dni

A ted neco k tomu sledovani

Nejjednodussi je sledovat historii prohlizenych stranek v prohlizeci - trady zjistite kam kdo sel apod - avsak deti mohou historii promazat a tim zahladi stopy

Pak je moznost pouzit nejaky monitorovaci program

PC - Monitoring http://www.stahuj.centrum.cz/uprava_plo ... onitoring/
ActivityMon Home/Family http://www.stahuj.centrum.cz/utility_a_ ... omefamily/

Nebo nasadit primo keylogger - sleduje presne obsah prace na PC a i stisknute klavesy atd...ale myslim ze prvni dva navrhy by mely stacit

VIRY.CZ

Chodia moje deti na porno?

Chodia moje deti na porno?

Re: Chodia moje deti na porno?

Re: Chodia moje deti na porno?

Re: Chodia moje deti na porno?

Re: Chodia moje deti na porno?

Re: Chodia moje deti na porno?

Re: Chodia moje deti na porno?

Re: Chodia moje deti na porno?

Re: Chodia moje deti na porno?

Re: Chodia moje deti na porno?

Re: Chodia moje deti na porno?

Re: Chodia moje deti na porno?

Re: Chodia moje deti na porno?