VIRY.CZ

Logfile of random's system information tool 1.09 (written by random/random)
Run by admin at 2011-08-29 09:42:27
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 268 GB (89%) free of 300 GB
Total RAM: 3580 MB (65% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:42:34, on 29.8.2011
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\RegCure\RegCure.exe
C:\Windows\PixArt\Pac207\Monitor.exe
C:\Program Files (x86)\Common Files\Nero\Lib\NMBgMonitor.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\HpqSRmon.exe
C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.8\facemoodssrv.exe
C:\Windows\update.tray-3-0\svchost.exe
C:\Windows\update.tray-9-0\svchost.exe
C:\Windows\sysdriver32.exe
C:\Windows\sysdriver32_.exe
C:\Windows\systemup.exe
C:\Program Files\trend micro\admin.exe
C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.qip.ru
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bigseekpro.com/facesmooch3a/ ... 5EBB2DB885}
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=vsl&s={searchTerms}&f=4
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: QIPBHO Class - {95289393-33EA-4F8D-B952-483415B9C955} - C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: HiGames Toolbar - {64d23501-5195-4224-9446-e2b0fb64e859} - C:\Program Files (x86)\HiGames\prxtbHiG0.dll
R3 - URLSearchHook: Babylon-English Toolbar - {ce18769b-c7fa-42d2-860d-17c4662c70ad} - (no file)
R3 - URLSearchHook: Hot MP3 Toolbar - {9384bd4c-dd14-4be9-80f7-f6277511e4f5} - C:\Program Files (x86)\Hot_MP3\prxtbHot0.dll
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~1\mcafee\msk\mskapbho.dll (file missing)
O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll
O2 - BHO: facemoods Helper - {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.8\bh\facemoods.dll
O2 - BHO: HiGames - {64d23501-5195-4224-9446-e2b0fb64e859} - C:\Program Files (x86)\HiGames\prxtbHiG0.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20110821184232.dll (file missing)
O2 - BHO: Pomocná služba pro přihlášení ke službě Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Hot MP3 - {9384bd4c-dd14-4be9-80f7-f6277511e4f5} - C:\Program Files (x86)\Hot_MP3\prxtbHot0.dll
O2 - BHO: QIPBHO - {95289393-33EA-4F8D-B952-483415B9C955} - C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll
O2 - BHO: Freecause Shopping BHO - {998A3C0C-8914-4D2A-AE36-BFA2E5AE6D5D} - C:\Program Files (x86)\Digsby Donates\ShoppingBHO.dll
O2 - BHO: Babylon IE plugin - {9CFACCB6-2F3F-4177-94EA-0D2B72D384C1} - (no file)
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O2 - BHO: QIPBHO - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\progra~2\mcafee\sitead~1\mcieplg.dll (file missing)
O2 - BHO: Babylon-English Toolbar - {ce18769b-c7fa-42d2-860d-17c4662c70ad} - (no file)
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: HiGames Toolbar - {64d23501-5195-4224-9446-e2b0fb64e859} - C:\Program Files (x86)\HiGames\prxtbHiG0.dll
O3 - Toolbar: PandoraTV Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: Babylon-English Toolbar - {ce18769b-c7fa-42d2-860d-17c4662c70ad} - (no file)
O3 - Toolbar: Hot MP3 Toolbar - {9384bd4c-dd14-4be9-80f7-f6277511e4f5} - C:\Program Files (x86)\Hot_MP3\prxtbHot0.dll
O3 - Toolbar: facemoods Toolbar - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.8\facemoodsTlbr.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\progra~2\mcafee\sitead~1\mcieplg.dll (file missing)
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [ApnUpdater] "C:\Program Files (x86)\Ask.com\Updater\Updater.exe"
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [facemoods] "C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.8\facemoodssrv.exe" /md I
O4 - HKLM\..\Run: [wxpdrv] C:\Windows\services32.exe
O4 - HKLM\..\Run: [tray_ico0] C:\Windows\update.tray-3-0\svchost.exe
O4 - HKLM\..\Run: [tray_ico1] C:\Windows\update.tray-9-0\svchost.exe
O4 - HKLM\..\Run: [5636658.exe] "C:\Windows\Temp\5636658.exe"
O4 - HKLM\..\Run: [sysdriver32.exe] "C:\Windows\sysdriver32.exe" rezerv
O4 - HKLM\..\Run: [sysdriver32_.exe] "C:\Windows\sysdriver32_.exe" rezerv
O4 - HKLM\..\Run: [8987280.exe] "C:\Users\admin\AppData\Local\Temp\8987280.exe"
O4 - HKLM\..\Run: [1738605.exe] "C:\Users\admin\AppData\Local\Temp\1738605.exe"
O4 - HKLM\..\Run: [57779637-loader2.exe] "C:\Windows\Temp\57779637-loader2.exe"
O4 - HKLM\..\Run: [8556620.exe] "C:\Windows\Temp\8556620.exe"
O4 - HKLM\..\Run: [reset] regedit /s reset.reg
O4 - HKLM\..\Run: [McAfee Guardian] "C:\Program Files (x86)\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe" /SU
O4 - HKLM\..\Run: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [systemup] "C:\Windows\systemup.exe" stand
O4 - HKLM\..\Run: [149369.exe] "C:\Windows\Temp\149369.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files (x86)\Common Files\Nero\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [Exetender_298] "C:\Program Files (x86)\Frag Games\GPlayer.exe" /runonstartup (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Exetender_298] "C:\Program Files (x86)\Frag Games\GPlayer.exe" /runonstartup (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Exetender_298] "C:\Program Files (x86)\Frag Games\GPlayer.exe" /runonstartup (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\admin\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm
O8 - Extra context menu item: Translate this web page with Babylon - res://C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm
O8 - Extra context menu item: Translate with Babylon - res://C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Action.htm
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - (no file)
O9 - Extra button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: Zobrazit nebo skrýt HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (file missing)
O9 - Extra 'Tools' menuitem: Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (file missing)
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~2\mcafee\sitead~1\mcieplg.dll (file missing)
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~2\mcafee\sitead~1\mcieplg.dll (file missing)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
O23 - Service: AMD Reservation Manager - Advanced Micro Devices - C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe
O23 - Service: AppleChargerSrv - Unknown owner - C:\Windows\system32\AppleChargerSrv.exe (file missing)
O23 - Service: ddservice - Unknown owner - C:\Windows\update.7.1\svchostdriver.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ES lite Service for program management. (ES lite Service) - Unknown owner - C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Unknown owner - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (file missing)
O23 - Service: McAfee Personal Firewall (McMPFSvc) - Unknown owner - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (file missing)
O23 - Service: McAfee Services (mcmscsvc) - Unknown owner - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (file missing)
O23 - Service: McAfee VirusScan Announcer (McNaiAnn) - Unknown owner - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (file missing)
O23 - Service: McAfee Network Agent (McNASvc) - Unknown owner - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (file missing)
O23 - Service: McAfee Scanner (McODS) - Unknown owner - C:\Program Files\McAfee\VirusScan\mcods.exe (file missing)
O23 - Service: McAfee Proxy Service (McProxy) - Unknown owner - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (file missing)
O23 - Service: McShield - Unknown owner - C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe (file missing)
O23 - Service: McAfee Firewall Core Service (mfefire) - Unknown owner - C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe (file missing)
O23 - Service: McAfee Validation Trust Protection Service (mfevtp) - Unknown owner - C:\Windows\system32\mfevtps.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - Unknown owner - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (file missing)
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - C:\Program Files (x86)\WinPcap\rpcapd.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: srvbtcclient - Unknown owner - C:\Windows\update.5.0\svchost.exe
O23 - Service: srviecheck - Unknown owner - C:\Windows\update.2\svchost.exe
O23 - Service: srvsysdriver32 - Unknown owner - C:\Windows\sysdriver32.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: wxpdrivers - Unknown owner - C:\Windows\update.1\svchost.exe

--
End of file - 17315 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
atieclxx
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"taskhost.exe"
C:\Windows\system32\userinit.exe
taskeng.exe {56EFC2B7-40D9-4EB0-BDBF-D1C590AD7E1C}
"C:\Windows\system32\Dwm.exe"
"C:\Program Files (x86)\RegCure\RegCure.exe" -Tray
C:\Windows\Explorer.EXE
"C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe"
C:\Windows\update.7.1\svchostdriver.exe srv
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Windows\PixArt\Pac207\Monitor.exe"
"C:\Program Files\Logitech\SetPointP\SetPoint.exe" /launchGaming
"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
"C:\Program Files (x86)\Common Files\Nero\Lib\NMBgMonitor.exe"
"C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE"
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\SysWOW64\svchost.exe -k hpdevmgmt
"C:\Windows\system32\mfevtps.exe"
KHALMNPR.EXE /API
"C:\Program Files (x86)\HP\Digital Imaging\bin\HpqSRmon.exe"
"C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe"
"C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.8\facemoodssrv.exe" /md I
"C:\Windows\update.tray-3-0\svchost.exe"
"C:\Windows\update.7.1\svchostdriver.exe" stand
"C:\Windows\update.tray-9-0\svchost.exe"
"C:\Windows\sysdriver32.exe" rezerv
"C:\Windows\sysdriver32_.exe" rezerv
"C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
"C:\Windows\systemup.exe" stand
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\update.5.0\svchost.exe srv
"C:\Users\admin\Desktop\RSITx64.exe"
C:\Windows\update.2\svchost.exe srv
"C:\Windows\update.5.0\svchost.exe" stand
C:\Windows\sysdriver32.exe srv
"C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe"
"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"
C:\Windows\update.1\svchost.exe srv
C:\Windows\system32\wbem\wmiprvse.exe
WLIDSvcM.exe 3780
"C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesApp64.exe" /TUStart /pid:3772
"C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe" /launchService
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe"
"C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe" -Embedding
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

======Scheduled tasks folder======

C:\Windows\tasks\RegCure Program Check.job
C:\Windows\tasks\RegCure.job

=========Mozilla firefox=========

ProfilePath - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\rwe7uvgb.default

prefs.js - "browser.search.useDBForOrder" - true
prefs.js - "browser.startup.homepage" - "http://www.seznam.cz/"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/ShockwavePlayer]
"Description"=Adobe Shockwave Player
"Path"=C:\Windows\system32\Adobe\Director\np32dsw.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922]
"Description"=WLPG Install MIME type
"Path"=

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=8]
"Description"=Google Update
"Path"=

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

C:\Program Files (x86)\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}

C:\Program Files (x86)\Mozilla Firefox\components\
binary.manifest
browsercomps.dll
flashplayer.xpt
nsIQTScriptablePlugin.xpt
Scriptff.dll

C:\Program Files (x86)\Mozilla Firefox\plugins\
np-mswmp.dll
np32dsw.dll
npdeployJava1.dll
nppdf32.dll
npqtplugin.dll
npqtplugin2.dll
npqtplugin3.dll
npqtplugin4.dll
npqtplugin5.dll
npqtplugin6.dll
npqtplugin7.dll
QuickTimePlugin.class
ShockwavePlugin.class
WMP Firefox Plugin License.rtf
WMP Firefox Plugin RelNotes.txt

C:\Program Files (x86)\Mozilla Firefox\searchplugins\
babylon.xml
fcmdSrchvsl.xml
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\rwe7uvgb.default\extensions\
engine@conduit.com
{32a1fd71-835e-4b11-8e54-886fda0b4c89}
{7b13ec3e-999a-4b70-b9cb-2617b8323822}
{ACAA314B-EEBA-48e4-AD47-84E31C44796C}

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27B4851A-3207-45A2-B947-BE8AFE6163AB}]
McAfee Phishing Filter - c:\PROGRA~1\mcafee\msk\MSKAPB~1.DLL []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7DB2D5A0-7241-4E79-B68D-6309F01C5231}]
scriptproxy - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20110821184232.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21 529280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}]
McAfee SiteAdvisor BHO - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0347C33E-8762-4905-BF09-768834316C61}]
HP Print Enhancer - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll [2009-09-20 328248]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-06-06 63912]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27B4851A-3207-45A2-B947-BE8AFE6163AB}]
McAfee Phishing Filter - c:\progra~1\mcafee\msk\mskapbho.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
Conduit Engine - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll [2011-01-17 175912]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64182481-4F71-486b-A045-B233BD0DA8FC}]
CescrtHlpr Object - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.8\bh\facemoods.dll [2011-04-14 265944]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64d23501-5195-4224-9446-e2b0fb64e859}]
HiGames Toolbar - C:\Program Files (x86)\HiGames\prxtbHiG0.dll [2011-01-17 175912]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7DB2D5A0-7241-4E79-B68D-6309F01C5231}]
scriptproxy - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20110821184232.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocná služba pro přihlášení ke službě Windows Live ID - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21 439168]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9384bd4c-dd14-4be9-80f7-f6277511e4f5}]
Hot MP3 Toolbar - C:\Program Files (x86)\Hot_MP3\prxtbHot0.dll [2011-01-17 175912]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95289393-33EA-4F8D-B952-483415B9C955}]
QIPBHO Class - C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll [2010-12-13 141184]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{998A3C0C-8914-4D2A-AE36-BFA2E5AE6D5D}]
Digsby Donates - C:\Program Files (x86)\Digsby Donates\ShoppingBHO.dll [2011-05-29 682496]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9CFACCB6-2F3F-4177-94EA-0D2B72D384C1}]
Babylon IE plugin

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9FDDE16B-836F-4806-AB1F-1455CBEFF289}]
Windows Live Messenger Companion Helper - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll [2010-11-10 393600]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}]
QIPBHO Class - C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll [2010-12-13 141184]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}]
McAfee SiteAdvisor BHO - c:\progra~2\mcafee\sitead~1\mcieplg.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ce18769b-c7fa-42d2-860d-17c4662c70ad}]
Babylon-English Toolbar

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
PandoraTV Toolbar - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll [2011-05-17 1490312]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2011-05-04 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856}]
HP Smart BHO Class - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2009-09-20 509496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{32099AAC-C132-4136-9E9A-4E364A424E17} -
{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - McAfee SiteAdvisor Toolbar - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{64d23501-5195-4224-9446-e2b0fb64e859} - HiGames Toolbar - C:\Program Files (x86)\HiGames\prxtbHiG0.dll [2011-01-17 175912]
{D4027C7F-154A-4066-A1AD-4243D8127440} - PandoraTV Toolbar - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll [2011-05-17 1490312]
{ce18769b-c7fa-42d2-860d-17c4662c70ad} -
{9384bd4c-dd14-4be9-80f7-f6277511e4f5} - Hot MP3 Toolbar - C:\Program Files (x86)\Hot_MP3\prxtbHot0.dll [2011-01-17 175912]
{DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - facemoods Toolbar - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.8\facemoodsTlbr.dll [2011-04-14 220888]
{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - McAfee SiteAdvisor Toolbar - c:\progra~2\mcafee\sitead~1\mcieplg.dll []

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2010-04-06 10144288]
"Monitor"=C:\Windows\PixArt\PAC207\Monitor.exe [2006-11-03 319488]
"System"=C:\Program Files\system32.exe [2011-05-27 21778]
"EvtMgr6"=C:\Program Files\Logitech\SetPointP\SetPoint.exe [2010-10-29 1680976]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe /hide /waitservice []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-20 1475584]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files (x86)\Common Files\Nero\Lib\NMBgMonitor.exe [2007-09-20 202024]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"hpqSRMon"=C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe [2008-07-22 150528]
"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2011-01-26 336384]
"ApnUpdater"=C:\Program Files (x86)\Ask.com\Updater\Updater.exe [2011-05-17 395144]
"NBKeyScan"=C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [2007-09-20 1836328]
"facemoods"=C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.8\facemoodssrv.exe [2011-04-14 329432]
"wxpdrv"=C:\Windows\services32.exe [2011-08-21 1213440]
"tray_ico"= []
"tray_ico0"=C:\Windows\update.tray-3-0\svchost.exe [2011-08-21 1213440]
"tray_ico1"=C:\Windows\update.tray-9-0\svchost.exe [2011-08-21 1213440]
"tray_ico2"= []
"tray_ico3"= []
"tray_ico4"= []
"5636658.exe"=C:\Windows\Temp\5636658.exe [2011-08-21 258048]
"sysdriver32.exe"=C:\Windows\sysdriver32.exe [2011-08-21 258048]
"sysdriver32_.exe"=C:\Windows\sysdriver32_.exe [2011-08-21 258048]
"8987280.exe"=C:\Users\admin\AppData\Local\Temp\8987280.exe [2011-08-21 258048]
"1738605.exe"=C:\Users\admin\AppData\Local\Temp\1738605.exe [2011-08-21 258048]
"57779637-loader2.exe"=C:\Windows\Temp\57779637-loader2.exe [2011-08-21 258048]
"8556620.exe"=C:\Windows\Temp\8556620.exe [2011-08-21 258048]
"reset"=regedit /s reset.reg []
"McAfee Guardian"=C:\Program Files (x86)\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe /SU []
"mcui_exe"=C:\Program Files\McAfee.com\Agent\mcagent.exe [2010-08-04 1466840]
"systemup"=C:\Windows\systemup.exe [2011-08-29 130560]
"149369.exe"=C:\Windows\Temp\149369.exe [2011-08-24 636416]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wxpdrivers]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\McMPFSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mcmscsvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mfefire]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mfefirek]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mfefirek.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\wxpdrivers]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableSecureUIAPaths"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2011-08-29 09:39:07 ----DC---- C:\rsit
2011-08-29 09:39:07 ----D---- C:\Program Files\trend micro
2011-08-27 21:41:09 ----HD---- C:\Windows\update.8.1
2011-08-24 08:34:32 ----D---- C:\Windows\SYSWOW64\xlive
2011-08-24 08:34:15 ----A---- C:\Windows\SYSWOW64\tzres.dll
2011-08-24 08:34:15 ----A---- C:\Windows\system32\tzres.dll
2011-08-22 09:21:03 ----DC---- C:\$UPGRADE.~OS
2011-08-22 08:53:40 ----HD---- C:\Windows\update.tray-9-0-lnk
2011-08-22 08:53:40 ----HD---- C:\Windows\update.tray-3-0-lnk
2011-08-22 08:35:19 ----A---- C:\Windows\systemup.exe
2011-08-21 18:43:11 ----D---- C:\Program Files (x86)\SiteAdvisor
2011-08-21 18:42:31 ----A---- C:\Windows\system32\drivers\mfeclnk.sys
2011-08-21 18:42:09 ----A---- C:\Windows\system32\mfevtps.exe
2011-08-21 18:42:07 ----A---- C:\Windows\system32\drivers\mfewfpk.sys
2011-08-21 18:42:07 ----A---- C:\Windows\system32\drivers\mferkdet.sys
2011-08-21 18:42:07 ----A---- C:\Windows\system32\drivers\mfenlfk.sys
2011-08-21 18:42:07 ----A---- C:\Windows\system32\drivers\mfehidk.sys
2011-08-21 18:42:07 ----A---- C:\Windows\system32\drivers\mfefirek.sys
2011-08-21 18:42:07 ----A---- C:\Windows\system32\drivers\mfeavfk.sys
2011-08-21 18:42:07 ----A---- C:\Windows\system32\drivers\cfwids.sys
2011-08-21 18:42:04 ----D---- C:\Program Files\McAfee.com
2011-08-21 17:49:22 ----D---- C:\Windows\ufa
2011-08-21 17:49:22 ----D---- C:\Windows\rpcminer
2011-08-21 17:49:22 ----D---- C:\Windows\phoenix
2011-08-21 17:40:53 ----A---- C:\Windows\unrar.exe
2011-08-21 17:40:48 ----HD---- C:\Windows\update.7.1
2011-08-21 17:40:24 ----A---- C:\Windows\iecheck_iplist.txt
2011-08-21 17:39:59 ----HD---- C:\Windows\update.2
2011-08-21 17:39:44 ----A---- C:\Windows\btc_client_iplist.txt
2011-08-21 17:38:55 ----HD---- C:\Windows\update.5.0
2011-08-21 17:38:36 ----A---- C:\Windows\iplist.txt
2011-08-21 17:37:47 ----A---- C:\Windows\sysdriver32_.exe
2011-08-21 17:37:31 ----A---- C:\Windows\sysdriver32.exe
2011-08-21 17:37:15 ----D---- C:\Windows\av_ico
2011-08-21 17:37:12 ----A---- C:\Windows\front_ip_list.txt
2011-08-21 17:36:02 ----HD---- C:\Windows\update.1
2011-08-21 17:36:01 ----HD---- C:\Windows\update.tray-9-0
2011-08-21 17:36:00 ----HD---- C:\Windows\update.tray-3-0
2011-08-21 17:26:34 ----A---- C:\Windows\winlog-ids.txt
2011-08-21 17:26:34 ----A---- C:\Windows\winlog-dirs.txt
2011-08-21 17:26:30 ----A---- C:\Windows\services32.exe
2011-08-18 12:32:49 ----D---- C:\Program Files (x86)\Atari
2011-08-17 07:12:11 ----D---- C:\ProgramData\Electronic Arts
2011-08-16 09:45:25 ----D---- C:\Program Files (x86)\facemoods.com
2011-08-15 20:10:51 ----D---- C:\Program Files (x86)\AVI to 3GP
2011-08-12 15:28:00 ----D---- C:\Program Files (x86)\Download Master
2011-08-12 15:26:35 ----D---- C:\Program Files (x86)\REDEMAX
2011-08-10 11:56:13 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2011-08-10 11:56:13 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2011-08-10 11:56:13 ----A---- C:\Windows\system32\mshtmled.dll
2011-08-10 11:56:13 ----A---- C:\Windows\system32\iertutil.dll
2011-08-10 11:56:12 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2011-08-10 11:56:12 ----A---- C:\Windows\SYSWOW64\url.dll
2011-08-10 11:56:12 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2011-08-10 11:56:12 ----A---- C:\Windows\SYSWOW64\jscript.dll
2011-08-10 11:56:12 ----A---- C:\Windows\SYSWOW64\ieui.dll
2011-08-10 11:56:12 ----A---- C:\Windows\system32\urlmon.dll
2011-08-10 11:56:12 ----A---- C:\Windows\system32\url.dll
2011-08-10 11:56:12 ----A---- C:\Windows\system32\jscript9.dll
2011-08-10 11:56:12 ----A---- C:\Windows\system32\jscript.dll
2011-08-10 11:56:12 ----A---- C:\Windows\system32\ieui.dll
2011-08-10 11:56:11 ----A---- C:\Windows\SYSWOW64\wininet.dll
2011-08-10 11:56:11 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2011-08-10 11:56:11 ----A---- C:\Windows\system32\wininet.dll
2011-08-10 11:56:11 ----A---- C:\Windows\system32\jsproxy.dll
2011-08-10 11:56:10 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2011-08-10 11:56:09 ----A---- C:\Windows\system32\mshtml.dll
2011-08-10 11:56:08 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2011-08-10 11:56:08 ----A---- C:\Windows\system32\ieframe.dll
2011-08-10 11:55:24 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2011-08-10 11:55:23 ----A---- C:\Windows\SYSWOW64\xmllite.dll
2011-08-10 11:55:23 ----A---- C:\Windows\system32\xmllite.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2011-08-10 11:55:22 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2011-08-10 11:55:22 ----A---- C:\Windows\SYSWOW64\wow32.dll
2011-08-10 11:55:22 ----A---- C:\Windows\SYSWOW64\setup16.exe
2011-08-10 11:55:22 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2011-08-10 11:55:22 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2011-08-10 11:55:22 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2011-08-10 11:55:22 ----A---- C:\Windows\system32\wow64win.dll
2011-08-10 11:55:22 ----A---- C:\Windows\system32\wow64cpu.dll
2011-08-10 11:55:22 ----A---- C:\Windows\system32\wow64.dll
2011-08-10 11:55:22 ----A---- C:\Windows\system32\winsrv.dll
2011-08-10 11:55:22 ----A---- C:\Windows\system32\ntvdm64.dll
2011-08-10 11:55:22 ----A---- C:\Windows\system32\KernelBase.dll
2011-08-10 11:55:22 ----A---- C:\Windows\system32\kernel32.dll
2011-08-10 11:55:22 ----A---- C:\Windows\system32\conhost.exe
2011-08-10 11:55:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2011-08-10 11:55:21 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2011-08-10 11:55:21 ----A---- C:\Windows\SYSWOW64\user.exe
2011-08-10 11:55:21 ----A---- C:\Windows\SYSWOW64\instnm.exe
2011-08-10 11:55:17 ----A---- C:\Windows\SYSWOW64\odbcjt32.dll
2011-08-10 11:55:17 ----A---- C:\Windows\SYSWOW64\odbccu32.dll
2011-08-10 11:55:17 ----A---- C:\Windows\SYSWOW64\odbccr32.dll
2011-08-10 11:55:17 ----A---- C:\Windows\system32\odbctrac.dll
2011-08-10 11:55:17 ----A---- C:\Windows\system32\odbccu32.dll
2011-08-10 11:55:17 ----A---- C:\Windows\system32\odbccr32.dll
2011-08-10 11:55:17 ----A---- C:\Windows\system32\odbccp32.dll
2011-08-10 11:55:16 ----A---- C:\Windows\SYSWOW64\odbctrac.dll
2011-08-10 11:55:16 ----A---- C:\Windows\SYSWOW64\odbccp32.dll
2011-08-10 11:55:15 ----A---- C:\Windows\system32\drivers\tcpip.sys
2011-08-10 11:55:14 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2011-08-10 11:55:13 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2011-08-10 11:55:13 ----A---- C:\Windows\system32\ntoskrnl.exe
2011-08-07 22:47:11 ----D---- C:\Program Files (x86)\K-Lite Codec Pack
2011-08-07 22:47:08 ----D---- C:\Program Files (x86)\YouTube Song Downloader
2011-08-07 22:39:54 ----D---- C:\ProgramData\TheManWithNoLife
2011-08-07 22:39:49 ----D---- C:\Program Files\TheManWithNoLife
2011-08-07 22:02:09 ----D---- C:\Users\admin\AppData\Roaming\DVDVideoSoftIEHelpers
2011-08-07 22:02:02 ----D---- C:\Program Files (x86)\DVDVideoSoft
2011-08-01 07:02:15 ----D---- C:\Users\admin\AppData\Roaming\Ventrilo

======List of files/folders modified in the last 1 month======

2011-08-29 09:42:33 ----D---- C:\Windows\Temp
2011-08-29 09:42:33 ----A---- C:\Windows\ntbtlog.txt
2011-08-29 09:39:37 ----D---- C:\ProgramData
2011-08-29 09:39:07 ----RD---- C:\Program Files
2011-08-29 09:20:57 ----SHD---- C:\Windows\Installer
2011-08-29 09:20:57 ----D---- C:\Config.Msi
2011-08-29 09:11:36 ----D---- C:\Windows\Prefetch
2011-08-29 09:08:11 ----D---- C:\Windows\system32\config
2011-08-29 08:58:51 ----D---- C:\Windows
2011-08-24 19:43:00 ----D---- C:\Windows\system32\catroot2
2011-08-24 15:51:37 ----D---- C:\Windows\system32\drivers
2011-08-24 15:41:09 ----RD---- C:\Program Files (x86)
2011-08-24 08:54:26 ----D---- C:\Windows\Minidump
2011-08-24 08:45:56 ----D---- C:\Users\admin\AppData\Roaming\ICQ
2011-08-24 08:35:07 ----D---- C:\Users\admin\AppData\Roaming\uTorrent
2011-08-24 08:34:41 ----D---- C:\Windows\winsxs
2011-08-24 08:34:40 ----D---- C:\Windows\SYSWOW64\cs-CZ
2011-08-24 08:34:40 ----D---- C:\Windows\SysWOW64
2011-08-24 08:34:40 ----D---- C:\Windows\system32\cs-CZ
2011-08-24 08:34:40 ----D---- C:\Windows\System32
2011-08-24 08:34:32 ----D---- C:\Program Files (x86)\Microsoft Games for Windows - LIVE
2011-08-24 08:33:54 ----D---- C:\Windows\system32\catroot
2011-08-22 09:06:58 ----D---- C:\Windows\system32\Tasks
2011-08-21 18:42:33 ----D---- C:\Windows\system32\DriverStore
2011-08-21 18:42:33 ----D---- C:\Windows\inf
2011-08-21 18:42:32 ----D---- C:\Program Files (x86)\Mozilla Firefox
2011-08-21 18:42:32 ----D---- C:\Program Files (x86)\Common Files
2011-08-21 18:42:04 ----D---- C:\Program Files\Common Files
2011-08-21 18:07:19 ----D---- C:\Users\admin\AppData\Roaming\GetRightToGo
2011-08-21 18:04:33 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-08-21 17:40:24 ----D---- C:\Windows\system32\drivers\etc
2011-08-21 17:12:51 ----D---- C:\Users\admin\AppData\Roaming\Skype
2011-08-18 14:15:02 ----D---- C:\Windows\SYSWOW64\directx
2011-08-18 13:20:37 ----RSD---- C:\Windows\assembly
2011-08-16 09:46:32 ----D---- C:\Program Files (x86)\Mp3 Knife
2011-08-15 07:14:20 ----D---- C:\Windows\system32\NDF
2011-08-14 21:22:08 ----SD---- C:\Users\admin\AppData\Roaming\Microsoft
2011-08-12 13:38:17 ----D---- C:\Program Files (x86)\Farming Simulator 2011
2011-08-11 21:12:25 ----D---- C:\Users\admin\AppData\Roaming\Youtube to MP3 Converter
2011-08-11 08:14:53 ----D---- C:\Windows\Microsoft.NET
2011-08-10 18:27:32 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI
2011-08-10 12:02:20 ----D---- C:\Windows\SYSWOW64\migration
2011-08-10 12:02:20 ----D---- C:\Windows\system32\migration
2011-08-10 12:02:20 ----D---- C:\Windows\AppPatch
2011-08-10 12:02:20 ----D---- C:\Program Files\Internet Explorer
2011-08-10 12:02:20 ----D---- C:\Program Files (x86)\Internet Explorer
2011-08-10 12:01:09 ----D---- C:\ProgramData\Microsoft Help
2011-08-10 11:59:26 ----A---- C:\Windows\system32\MRT.exe
2011-08-09 11:23:04 ----D---- C:\Program Files (x86)\TuneUp Utilities 2011
2011-08-03 21:01:02 ----D---- C:\Program Files (x86)\ICQ7.5
2011-08-01 08:34:41 ----D---- C:\ProgramData\Codemasters

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 AtiPcie;AMD PCI Express (3GIO) Filter; C:\Windows\system32\DRIVERS\AtiPcie.sys [2009-05-05 16440]
R0 epfwwfp;epfwwfp; C:\Windows\system32\DRIVERS\epfwwfp.sys [2011-06-03 62496]
R0 mfehidk;McAfee Inc. mfehidk; C:\Windows\system32\drivers\mfehidk.sys [2011-04-14 530304]
R0 mfewfpk;McAfee Inc. mfewfpk; C:\Windows\system32\drivers\mfewfpk.sys [2011-04-14 283744]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-12-23 503352]
R1 AppleCharger;AppleCharger; C:\Windows\system32\DRIVERS\AppleCharger.sys [2010-04-27 21544]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2011-06-03 146432]
R1 mfenlfk;McAfee NDIS Light Filter; C:\Windows\system32\DRIVERS\mfenlfk.sys [2011-04-14 75160]
R2 epfw;epfw; C:\Windows\system32\DRIVERS\epfw.sys [2011-06-03 187632]
R2 RMCAST;@%SystemRoot%\system32\wshrm.dll,-102; C:\Windows\system32\DRIVERS\RMCAST.sys [2010-11-20 146432]
R3 amdiox64;AMD IO Driver; C:\Windows\system32\DRIVERS\amdiox64.sys [2010-02-18 46136]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2011-01-27 9085952]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2011-01-27 299520]
R3 gdrv;gdrv; \??\C:\Windows\gdrv.sys [2011-08-29 25640]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2010-04-06 2337440]
R3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter; C:\Windows\system32\DRIVERS\LEqdUsb.Sys [2011-04-30 76056]
R3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter; C:\Windows\system32\DRIVERS\LHidEqd.Sys [2011-04-30 15128]
R3 LHidFilt;Logitech SetPoint KMDF HID Filter Driver; C:\Windows\system32\DRIVERS\LHidFilt.Sys [2011-04-30 66840]
R3 LMouFilt;Logitech SetPoint KMDF Mouse Filter Driver; C:\Windows\system32\DRIVERS\LMouFilt.Sys [2011-04-30 60184]
R3 mfeavfk;McAfee Inc. mfeavfk; C:\Windows\system32\drivers\mfeavfk.sys [2011-04-14 190520]
R3 mfefirek;McAfee Inc. mfefirek; C:\Windows\system32\drivers\mfefirek.sys [2011-04-14 441840]
R3 pcouffin;VSO Software pcouffin; C:\Windows\System32\Drivers\pcouffin.sys [2011-02-23 82816]
R3 RTHDMIAzAudService;Service for HDMI; C:\Windows\system32\drivers\RtHDMIVX.sys [2010-01-27 231328]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2010-03-22 347680]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv; \??\C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesDriver64.sys [2011-02-10 11856]
S1 acedrv07;acedrv07; \??\C:\Windows\system32\drivers\acedrv07.sys [2011-01-22 125440]
S3 AODDriver;AODDriver; \??\C:\Program Files (x86)\Gigabyte\ET6\amd64\AODDriver.sys [2010-03-12 52280]
S3 cfwids;McAfee Inc. cfwids; C:\Windows\system32\drivers\cfwids.sys [2011-04-14 63056]
S3 Dot4;MS IEEE-1284.4 Driver; C:\Windows\system32\DRIVERS\Dot4.sys [2009-07-14 145920]
S3 Dot4Print;Print Class Driver for IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4Prt.sys [2010-11-20 19968]
S3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\Windows\system32\DRIVERS\dot4usb.sys [2009-07-14 43008]
S3 EagleX64;EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys []
S3 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2011-06-03 202064]
S3 etdrv;etdrv; \??\C:\Windows\etdrv.sys [2010-12-06 25640]
S3 GVTDrv64;GVTDrv64; \??\C:\Windows\GVTDrv64.sys [2010-12-23 30528]
S3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2011-05-10 33344]
S3 LUsbFilt;Logitech SetPoint KMDF USB Filter; C:\Windows\System32\Drivers\LUsbFilt.Sys [2011-04-30 42776]
S3 mferkdet;McAfee Inc. mferkdet; C:\Windows\system32\drivers\mferkdet.sys [2011-04-14 94992]
S3 NPF;NetGroup Packet Filter Driver; C:\Windows\system32\drivers\npf.sys []
S3 PAC207;SoC PC-Camera; C:\Windows\system32\DRIVERS\PFC027.SYS [2006-12-05 572416]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 59392]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 41984]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2011-01-27 203776]
R2 AMD FUEL Service;AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-01-26 354304]
R2 AMD Reservation Manager;AMD Reservation Manager; C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe [2010-06-17 194496]
R2 ddservice;ddservice; C:\Windows\update.7.1\svchostdriver.exe [2011-08-21 382464]
R2 ES lite Service;ES lite Service for program management.; C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE [2009-08-24 68136]
R2 ezGOSvc;Easybits GO Services for Windows; C:\Windows\system32\svchost.exe [2009-07-14 27136]
R2 hpqddsvc;Služba HP CUE DeviceDiscovery; C:\Windows\system32\svchost.exe [2009-07-14 27136]
R2 mfevtp;McAfee Validation Trust Protection Service; C:\Windows\system32\mfevtps.exe [2011-04-14 149032]
R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe [2007-09-20 853288]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 srvbtcclient;srvbtcclient; C:\Windows\update.5.0\svchost.exe [2011-08-22 355840]
R2 srviecheck;srviecheck; C:\Windows\update.2\svchost.exe [2011-08-24 636416]
R2 srvsysdriver32;srvsysdriver32; C:\Windows\sysdriver32.exe [2011-08-21 258048]
R2 StarWindServiceAE;StarWind AE Service; C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2007-05-28 275968]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service; C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe [2011-07-20 2027840]
R2 UxTuneUp;@%SystemRoot%\System32\uxtuneup.dll,-4096; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2010-09-21 2286976]
R3 hpqcxs08;hpqcxs08; C:\Windows\system32\svchost.exe [2009-07-14 27136]
R3 NMIndexingService;NMIndexingService; C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe [2007-09-20 382248]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /svc []
S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe /McCoreSvc []
S2 McMPFSvc;McAfee Personal Firewall; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe /McCoreSvc []
S2 mcmscsvc;McAfee Services; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe /McCoreSvc []
S2 McNaiAnn;McAfee VirusScan Announcer; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe /McCoreSvc []
S2 McNASvc;McAfee Network Agent; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe /McCoreSvc []
S2 McProxy;McAfee Proxy Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe /McCoreSvc []
S2 McShield;McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe []
S2 mfefire;McAfee Firewall Core Service; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe []
S2 MSK80Service;McAfee Anti-Spam Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe /McCoreSvc []
S3 AppleChargerSrv;AppleChargerSrv; C:\Windows\system32\AppleChargerSrv.exe [2010-04-06 31272]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2010-03-18 44376]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 McODS;McAfee Scanner; C:\Program Files\McAfee\VirusScan\mcods.exe []
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); C:\Program Files\WinPcap\rpcapd.exe -d -f C:\Program Files\WinPcap\rpcapd.ini []
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-12-06 1255736]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

-----------------EOF-----------------
předem díky za pomoc

Zdravim a den vecer preji,

Vas log se studuje a pracuje se na nem .
Prosim o strpeni!

Ten nelegalni ESET pak doufam nahradime free resenim

Spustte HJT a provedeme fixnuti polozek

• HJT najdete zde C:\Program Files\trend micro\admin.exe
• Otevre se Vam okno, kliknete na Do a system scan only
• V dalsim okne najdete radky které jsem Vam vypsal nize, vedle nich je ctverecek, do ktereho udelate zatrzitko
• R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qip.ru
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.qip.ru/ie
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.qip.ru
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bigseekpro.com/facesmooch3a/ ... 5EBB2DB885}
  R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=vsl&s={searchTerms}&f=4
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
  R3 - URLSearchHook: QIPBHO Class - {95289393-33EA-4F8D-B952-483415B9C955} - C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll
  R3 - URLSearchHook: (no name) - - (no file)
  R3 - URLSearchHook: HiGames Toolbar - {64d23501-5195-4224-9446-e2b0fb64e859} - C:\Program Files (x86)\HiGames\prxtbHiG0.dll
  R3 - URLSearchHook: Babylon-English Toolbar - {ce18769b-c7fa-42d2-860d-17c4662c70ad} - (no file)
  R3 - URLSearchHook: Hot MP3 Toolbar - {9384bd4c-dd14-4be9-80f7-f6277511e4f5} - C:\Program Files (x86)\Hot_MP3\prxtbHot0.dll
• Kliknete na Fix checked (vlevo dole)
• HJT se Vas zepta zda opravdu ANO, s tim souhlasite a je hotovo

Stahnete RogueKiller http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe

• Ukoncete vsechny programy
• Pokud pouzivate Win Vista ci W7, kliknete na RogueKiller pravym a dejte Run As Administrator ci Spustit jako spravce
• Zvolte moznost 2 a potvrte enterem
• Utilita provede svou cinnost a da log - ten sem vlozte
• Nyni znovu, ale zvolte moznost 3 a pote jeste 4 - logy opet vlozte

počítač zapnu do nouzového režimu se sítí a po cca půl minutě se mi restartuje

Mate moznost si na jinem PC stahovat utility na flash disk

Pokud ano, tak restartujte do nouzoveho rezimu s praci bez site

Ten nelegalni ESET pujde doufam po ukonceni leceni z PC pryc a bdue tam free reseni

jojo to by šlo, jiné pc mám...jasně ESET pujde pryč!

Fajn, zatim tam tedy natahnete RogueKiller a spustte dle navodu

PC samo nabiha do nouzoveho rezimu nebo se tam dostavate pomoci F8

když zapnu pc normálně se mi nastartuje po dvou minutách se restartuje skočí do NR tam vydrží tak půl minuty pak se restartuje, znovu se normálně zapne opět vydrží 2 minuty tak se restartuje znovu do NR a tak to běží pořád dokola...

možnost 2
RogueKiller V5.3.3 [08/18/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.sur-la-toile.com/discussion- ... ntees.html

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User: admin [Admin rights]
Mode: Remove -- Date : 08/29/2011 10:22:02

Bad processes: 11
[SVCHOST] svchost.exe -- c:\windows\update.tray-3-0\svchost.exe -> KILLED [TermProc]
[SVCHOST] svchost.exe -- c:\windows\update.tray-9-0\svchost.exe -> KILLED [TermProc]
[HJ NAME] svchost.exe -- c:\windows\update.5.0\svchost.exe -> KILLED [TermProc]
[SUSP PATH] sysdriver32.exe -- c:\windows\sysdriver32.exe -> KILLED [TermProc]
[SUSP PATH] sysdriver32_.exe -- c:\windows\sysdriver32_.exe -> KILLED [TermProc]
[SUSP PATH] systemup.exe -- c:\windows\systemup.exe -> KILLED [TermProc]
[SVCHOST] svchost.exe -- c:\windows\update.5.0\svchost.exe -> KILLED [TermProc]
[HJ NAME] svchost.exe -- c:\windows\update.2\svchost.exe -> KILLED [TermProc]
[SUSP PATH] sysdriver32.exe -- c:\windows\sysdriver32.exe -> KILLED [TermProc]
[HJ NAME] svchost.exe -- c:\windows\update.1\svchost.exe -> KILLED [TermProc]
[SVCHOST] svchost.exe -- c:\windows\update.2\svchost.exe -> KILLED [TermProc]

Registry Entries: 16
[BLACKLIST] HKLM\[...]\services : srvbtcclient (C:\Windows\update.5.0\svchost.exe srv) -> DELETED
[BLACKLIST] HKLM\[...]\services : srviecheck (C:\Windows\update.2\svchost.exe srv) -> DELETED
[BLACKLIST] HKLM\[...]\services : srvsysdriver32 (C:\Windows\sysdriver32.exe srv) -> DELETED
[BLACKLIST] HKLM\[...]\services : wxpdrivers (C:\Windows\update.1\svchost.exe srv) -> DELETED
[BLACKLIST] HKLM\[...]\services : srvbtcclient (C:\Windows\update.5.0\svchost.exe srv) -> DELETED
[BLACKLIST] HKLM\[...]\services : srviecheck (C:\Windows\update.2\svchost.exe srv) -> DELETED
[BLACKLIST] HKLM\[...]\services : srvsysdriver32 (C:\Windows\sysdriver32.exe srv) -> DELETED
[BLACKLIST] HKLM\[...]\services : wxpdrivers (C:\Windows\update.1\svchost.exe srv) -> DELETED
[HJ NAME] {084B0772-45F9-4CD8-A5DB-735A816B2605}.job : c:\windows\update.tray-9-0-lnk\svchost.exe -> DELETED
[SUSP PATH] {CECD87AF-2CC6-4741-9230-F926C1D701F9}.job : c:\users\admin\desktop\wmplayer.exe -> DELETED
[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> REPLACED (2)
[HJ] HKLM\[...]\System : EnableLUA (0) -> REPLACED (1)
[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)
[HJ] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)
[HJ] HKCU\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

Particular Files / Folders:

HOSTS File:
127.0.0.1 localhost
127.0.0.1 facebook.com
127.0.0.1 www.facebook.com
127.0.0.1 af-za.facebook.com
127.0.0.1 az-az.facebook.com
127.0.0.1 id-id.facebook.com
127.0.0.1 ms-my.facebook.com
127.0.0.1 bs-ba.facebook.com
127.0.0.1 ca-es.facebook.com
127.0.0.1 cs-cz.facebook.com
127.0.0.1 cy-gb.facebook.com
127.0.0.1 da-dk.facebook.com
127.0.0.1 de-de.facebook.com
127.0.0.1 et-ee.facebook.com
127.0.0.1 en-gb.facebook.com
127.0.0.1 es-la.facebook.com
127.0.0.1 eo-eo.facebook.com
127.0.0.1 eu-es.facebook.com
127.0.0.1 tl-ph.facebook.com
127.0.0.1 fo-fo.facebook.com
[...]


Finished : << RKreport[1].txt >>
RKreport[1].txt



možnost 3
RogueKiller V5.3.3 [08/18/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.sur-la-toile.com/discussion- ... ntees.html

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User: admin [Admin rights]
Mode: HOSTSFix -- Date : 08/29/2011 10:22:25

Bad processes: 0

HOSTS File:
127.0.0.1 localhost
127.0.0.1 facebook.com
127.0.0.1 www.facebook.com
127.0.0.1 af-za.facebook.com
127.0.0.1 az-az.facebook.com
127.0.0.1 id-id.facebook.com
127.0.0.1 ms-my.facebook.com
127.0.0.1 bs-ba.facebook.com
127.0.0.1 ca-es.facebook.com
127.0.0.1 cs-cz.facebook.com
127.0.0.1 cy-gb.facebook.com
127.0.0.1 da-dk.facebook.com
127.0.0.1 de-de.facebook.com
127.0.0.1 et-ee.facebook.com
127.0.0.1 en-gb.facebook.com
127.0.0.1 es-la.facebook.com
127.0.0.1 eo-eo.facebook.com
127.0.0.1 eu-es.facebook.com
127.0.0.1 tl-ph.facebook.com
127.0.0.1 fo-fo.facebook.com
[...]


Resetted HOSTS:
127.0.0.1 localhost

Finished : << RKreport[2].txt >>
RKreport[1].txt ; RKreport[2].txt



možnost 4
RogueKiller V5.3.3 [08/18/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.sur-la-toile.com/discussion- ... ntees.html

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User: admin [Admin rights]
Mode: ProxyFix -- Date : 08/29/2011 10:22:36

Bad processes: 0

Registry Entries: 0

Finished : << RKreport[3].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt

Kliknete na Start a pote Spustit, pripadne pouzijte klavesou zkratku Win+R

• Vyskoci na Vas okenko, do ktereho zkopirujte text nize

• Kód: Vybrat vše

  msconfig

• Kliknete na OK
• Prepnete se na zalozku Spuštění počítače
• Podivejte se, ci nemate zaskrtnute Bezpecne spousteni - pokud ano, tak odskrtnete
• Nasledny restart by jiz mel vest do normalniho rezimu

Stahnete RKill http://download.bleepingcomputer.com/grinler/rkill.com

• Pokud ho havet blokuje, pouzijte jeden z nasledujicich

  motji píše: Rkill EXE:
  http://download.bleepingcomputer.com/grinler/rkill.exe
  
  Rkill SCR:
  http://download.bleepingcomputer.com/grinler/rkill.scr
  
  Rkill PIF:
  http://download.bleepingcomputer.com/grinler/rkill.pif

• Ulozte nejlepena plochu a ukoncete vsechny aplikace (jinak to udela RKill za Vas)
• Spustte tradicne dvojklikem - program probehne temer okamzite a ukonci i svou cinnost
• RKill ukonci vsechny ne-systemove procesy - tedy i procesy, pod kterymi bezi havet
• Ted nerestartujte PC - prisli byste o ucinek RKillu

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK
Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

• Pokud mate Win XP spustte pod uctem Spravce\Administratora
• Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
• Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
• Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
• Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
• Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
• Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
• Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

vše jsem udělal podle návodu, ale když jsem chtěl zkopírovat log..zjistil jsem že mi negunfuje žádný program..

Resrtartujte PC, melo by se to dat do poradku

ComboFix 11-08-28.01 - admin 29.08.2011 10:37:36.2.6 - x64
Spuštěný z: c:\users\admin\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Digsby Donates\ShOPpingbho.dll
c:\program files (x86)\ESET\MiNODLogin
c:\program files (x86)\ESET\MiNODLogin\MiNODLogin.exe
c:\program files (x86)\ESET\MiNODLogin\MiNODLogin.jar
c:\program files (x86)\ESET\MiNODLogin\MiNODLoginLib.dll
c:\program files (x86)\ESET\MiNODLogin\MiNODLoginUninst.exe
c:\program files (x86)\ESET\MiNODLogin\servidores.xml
c:\program files (x86)\facemoods.com
c:\program files (x86)\facemoods.com\facemoods\1.4.17.8\bh\facemoods.dll
c:\program files (x86)\facemoods.com\facemoods\1.4.17.8\facemoods.crx
c:\program files (x86)\facemoods.com\facemoods\1.4.17.8\facemoods.png
c:\program files (x86)\facemoods.com\facemoods\1.4.17.8\facemoodsApp.dll
c:\program files (x86)\facemoods.com\facemoods\1.4.17.8\facemoodsEng.dll
c:\program files (x86)\facemoods.com\facemoods\1.4.17.8\facemoodssrv.exe
c:\program files (x86)\facemoods.com\facemoods\1.4.17.8\facemoodsTlbr.dll
c:\program files (x86)\facemoods.com\facemoods\1.4.17.8\uninstall.exe
c:\program files (x86)\facemoods.com\sqlite3.dll
c:\program files (x86)\WinPCap
c:\program files (x86)\WinPCap\daemon_mgm.exe
c:\program files (x86)\WinPCap\INSTALL.LOG
c:\program files (x86)\WinPCap\npf_mgm.exe
c:\program files (x86)\WinPCap\rpcapd.exe
c:\program files (x86)\WinPCap\Uninstall.exe
c:\program files\system32.EXE
c:\users\admin\AppData\Roaming\inst.exe
c:\users\admin\AppData\Roaming\Local
c:\users\admin\AppData\Roaming\Local\Temp\DDM\Settings\settings.ddi
c:\users\admin\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\(2).ddp
c:\users\admin\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\(3).ddp
c:\users\admin\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\(4).ddp
c:\users\admin\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\(5).ddp
c:\users\admin\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\(6).ddp
c:\users\admin\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\(7).ddp
c:\users\admin\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\(8).ddp
c:\users\admin\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\.ddp
c:\windows\btc_client_iplist.txt
c:\windows\front_ip_list.txt
c:\windows\geoiplist
c:\windows\geoiplist.rar
c:\windows\iecheck_iplist.txt
c:\windows\info1
c:\windows\iplist.txt
c:\windows\loader2.exe_ok
c:\windows\phoenix
c:\windows\phoenix.rar
c:\windows\phoenix\kernels\phatk\__init__.py
c:\windows\phoenix\kernels\phatk\__init__.pyc
c:\windows\phoenix\kernels\phatk\4881bf74a41a6622f0e24e9c982ffe4a.elf
c:\windows\phoenix\kernels\phatk\BFIPatcher.py
c:\windows\phoenix\kernels\phatk\BFIPatcher.pyc
c:\windows\phoenix\kernels\phatk\dd490d3f7b673a0cc51a70ccb429334d.elf
c:\windows\phoenix\kernels\phatk\kernel.cl
c:\windows\phoenix\kernels\poclbm\__init__.py
c:\windows\phoenix\kernels\poclbm\__init__.pyc
c:\windows\phoenix\kernels\poclbm\198ab205d0ff52e778ac1ee042be7228.elf
c:\windows\phoenix\kernels\poclbm\8769a65b4502d15ba944e48ba88de52e.elf
c:\windows\phoenix\kernels\poclbm\BFIPatcher.py
c:\windows\phoenix\kernels\poclbm\BFIPatcher.pyc
c:\windows\phoenix\kernels\poclbm\kernel.cl
c:\windows\phoenix\phoenix.exe
c:\windows\proc_list1.log
c:\windows\rpcminer
c:\windows\rpcminer.rar
c:\windows\rpcminer\bitcoinminercuda_10.cubin
c:\windows\rpcminer\bitcoinminercuda_11.cubin
c:\windows\rpcminer\bitcoinminercuda_20.cubin
c:\windows\rpcminer\bitcoinmineropencl.cl
c:\windows\rpcminer\cudart32_32_16.dll
c:\windows\rpcminer\curllib.dll
c:\windows\rpcminer\libeay32.dll
c:\windows\rpcminer\libsasl.dll
c:\windows\rpcminer\openldap.dll
c:\windows\rpcminer\rpcminer-4way.exe
c:\windows\rpcminer\rpcminer-cpu.exe
c:\windows\rpcminer\rpcminer-cuda.exe
c:\windows\rpcminer\rpcminer-opencl.exe
c:\windows\rpcminer\ssleay32.dll
c:\windows\services32.exe
c:\windows\sysdriver32.exe
c:\windows\sysdriver32_.exe
c:\windows\system32\drivers\etc\HSTS~1
c:\windows\systemup.exe
c:\windows\SysWow64\comct332.ocx
c:\windows\SysWow64\drivers\npf.sys
c:\windows\SysWow64\Packet.dll
c:\windows\SysWow64\pthreadVC.dll
c:\windows\SysWow64\wpcap.dll
c:\windows\Temp\5636658.exe
c:\windows\Temp\57779637-loader2.exe
c:\windows\Temp\8556620.exe
c:\windows\ufa.rar
c:\windows\update.1
c:\windows\update.1\svchost.exe
c:\windows\update.2
c:\windows\update.2\svchost.exe
c:\windows\update.5.0
c:\windows\update.5.0\svchost.exe
c:\windows\update.7.1
c:\windows\update.7.1\svchostdriver.exe
c:\windows\update.tray-3-0\svchost.exe
c:\windows\update.tray-9-0\svchost.exe
c:\windows\winlog-dirs.txt
c:\windows\winlog-ids.txt
c:\windows\winsetupapi.log
c:\users\admin\AppData\Roaming\Microsoft\Windows\Recent\?Katy Perry - The Girl Next Door with lyrics in HD?? - YouTube.URL . . . . nemohl být smazán
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_ddservice
-------\Service_NPF
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-07-28 do 2011-08-29 )))))))))))))))))))))))))))))))
.
.
2011-08-29 08:41 . 2011-08-29 08:41 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-08-29 08:24 . 2011-08-12 04:10 8862544 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F5E77159-442E-4FDF-A4BB-9F1D8FC36297}\mpengine.dll
2011-08-29 08:23 . 2011-08-29 08:23 -------- d-----w- c:\programdata\McAfee
2011-08-29 07:39 . 2011-08-29 08:18 -------- d-----w- c:\program files\trend micro
2011-08-29 07:39 . 2011-08-29 07:42 -------- dc----w- C:\rsit
2011-08-27 19:41 . 2011-08-27 19:41 -------- d--h--w- c:\windows\update.8.1
2011-08-24 06:34 . 2011-08-24 06:34 -------- d-----w- c:\windows\SysWow64\xlive
2011-08-24 06:34 . 2011-07-09 05:26 2048 ----a-w- c:\windows\system32\tzres.dll
2011-08-24 06:34 . 2011-07-09 04:29 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2011-08-22 07:21 . 2011-08-22 07:21 -------- dc----w- C:\$UPGRADE.~OS
2011-08-22 06:53 . 2011-08-22 06:53 -------- d--h--w- c:\windows\update.tray-9-0-lnk
2011-08-22 06:53 . 2011-08-22 06:53 -------- d--h--w- c:\windows\update.tray-3-0-lnk
2011-08-21 16:43 . 2011-08-21 16:43 -------- d-----w- c:\program files (x86)\SiteAdvisor
2011-08-21 16:42 . 2011-04-14 12:08 24376 ----a-w- c:\program files (x86)\Mozilla Firefox\components\Scriptff.dll
2011-08-21 16:42 . 2011-04-14 12:08 9984 ----a-w- c:\windows\system32\drivers\mfeclnk.sys
2011-08-21 16:42 . 2011-04-14 12:08 149032 ----a-w- c:\windows\system32\mfevtps.exe
2011-08-21 16:42 . 2011-04-14 12:08 94992 ----a-w- c:\windows\system32\drivers\mferkdet.sys
2011-08-21 16:42 . 2011-04-14 12:08 75160 ----a-w- c:\windows\system32\drivers\mfenlfk.sys
2011-08-21 16:42 . 2011-04-14 12:08 63056 ----a-w- c:\windows\system32\drivers\cfwids.sys
2011-08-21 16:42 . 2011-04-14 12:08 530304 ----a-w- c:\windows\system32\drivers\mfehidk.sys
2011-08-21 16:42 . 2011-04-14 12:08 441840 ----a-w- c:\windows\system32\drivers\mfefirek.sys
2011-08-21 16:42 . 2011-04-14 12:08 283744 ----a-w- c:\windows\system32\drivers\mfewfpk.sys
2011-08-21 16:42 . 2011-04-14 12:08 190520 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
2011-08-21 16:42 . 2011-08-21 16:42 -------- d-----w- c:\program files\McAfee.com
2011-08-21 16:16 . 2009-09-02 08:20 652 ----a-w- c:\windows\FIX.reg
2011-08-21 16:16 . 2008-11-01 11:23 280 ----a-w- c:\windows\reset.reg
2011-08-21 16:07 . 2011-08-21 16:08 53248 ------w- c:\program files (x86)\Common Files\InstallShield\engine\6\Intel 32\msihook.dll
2011-08-21 16:07 . 2011-08-21 16:08 32768 ------w- c:\program files (x86)\Common Files\InstallShield\engine\6\Intel 32\objectps.dll
2011-08-21 16:07 . 2011-08-21 16:08 221184 ------w- c:\program files (x86)\Common Files\InstallShield\IScript\iscript.dll
2011-08-21 16:07 . 2011-08-21 16:08 598016 ------w- c:\program files (x86)\Common Files\InstallShield\engine\6\Intel 32\ikernel.exe
2011-08-21 16:07 . 2011-08-21 16:08 217088 ------w- c:\program files (x86)\Common Files\InstallShield\engine\6\Intel 32\iuser.dll
2011-08-21 16:07 . 2011-08-21 16:08 114688 ------w- c:\program files (x86)\Common Files\InstallShield\engine\6\Intel 32\scpthdlr.dll
2011-08-21 16:07 . 2011-08-21 16:07 126976 ------w- c:\program files (x86)\Common Files\InstallShield\engine\6\Intel 32\knlwrap.exe
2011-08-21 15:49 . 2011-08-21 16:49 -------- d-----w- c:\windows\ufa
2011-08-21 15:40 . 2011-08-21 16:49 246272 ----a-w- c:\windows\unrar.exe
2011-08-21 15:37 . 2011-08-21 15:37 -------- d-----w- c:\windows\av_ico
2011-08-21 15:36 . 2011-08-29 08:40 -------- d--h--w- c:\windows\update.tray-9-0
2011-08-21 15:36 . 2011-08-29 08:40 -------- d--h--w- c:\windows\update.tray-3-0
2011-08-18 10:32 . 2011-08-18 10:32 -------- d-----w- c:\program files (x86)\Atari
2011-08-17 05:12 . 2011-08-21 16:03 -------- d-----w- c:\programdata\Electronic Arts
2011-08-16 20:53 . 2003-02-11 04:02 32768 ----a-w- c:\program files (x86)\Mozilla Firefox\plugins\np32dsw.dll
2011-08-15 18:10 . 2011-08-15 18:10 -------- d-----w- c:\program files (x86)\AVI to 3GP
2011-08-12 13:28 . 2011-08-12 13:28 -------- d-----w- c:\program files (x86)\Download Master
2011-08-12 13:26 . 2011-08-12 13:26 -------- d-----w- c:\program files (x86)\REDEMAX
2011-08-10 09:55 . 2011-07-09 02:46 288768 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-08-07 20:47 . 2011-08-07 20:47 -------- d-----w- c:\users\admin\AppData\Local\Abelssoft
2011-08-07 20:47 . 2011-08-07 20:49 -------- d-----w- c:\program files (x86)\K-Lite Codec Pack
2011-08-07 20:47 . 2011-08-07 20:49 -------- d-----w- c:\program files (x86)\YouTube Song Downloader
2011-08-07 20:39 . 2011-08-07 20:39 -------- d-----w- c:\programdata\TheManWithNoLife
2011-08-07 20:39 . 2011-08-07 20:43 -------- d-----w- c:\program files\TheManWithNoLife
2011-08-07 20:02 . 2011-08-07 20:02 -------- d-----w- c:\users\admin\AppData\Roaming\DVDVideoSoftIEHelpers
2011-08-07 20:02 . 2011-08-07 20:15 -------- d-----w- c:\program files (x86)\DVDVideoSoft
2011-08-07 20:02 . 2011-08-07 20:03 -------- d-----w- c:\program files (x86)\Common Files\DVDVideoSoft
2011-08-01 05:02 . 2011-08-01 05:02 -------- d-----w- c:\users\admin\AppData\Roaming\Ventrilo
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-29 08:42 . 2010-12-05 18:39 25640 ----a-w- c:\windows\gdrv.sys
2011-08-17 07:34 . 2011-06-13 19:22 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-07-20 15:14 . 2011-06-15 19:06 18960 ----a-w- c:\windows\system32\drivers\LNonPnP.sys
2011-07-20 08:41 . 2011-07-20 17:06 34624 ----a-w- c:\windows\system32\TURegOpt.exe
2011-07-20 08:35 . 2011-07-20 17:05 25920 ----a-w- c:\windows\system32\authuitu.dll
2011-07-20 08:35 . 2011-07-20 17:05 21312 ----a-w- c:\windows\SysWow64\authuitu.dll
2011-07-20 08:35 . 2011-07-20 17:05 36160 ----a-w- c:\windows\system32\uxtuneup.dll
2011-07-20 08:35 . 2011-07-20 17:05 29504 ----a-w- c:\windows\SysWow64\uxtuneup.dll
2011-07-16 04:26 . 2011-08-10 09:55 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2011-07-15 19:58 . 2011-07-15 19:58 53248 ----a-r- c:\users\admin\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2011-07-03 15:24 . 2011-07-03 15:24 20480 ----a-w- c:\windows\SysWow64\H@tKeysH@@k.DLL
2011-07-03 14:36 . 2011-07-01 14:20 73216 ----a-w- c:\windows\ST6UNST.EXE
2011-07-03 14:36 . 2011-07-01 14:20 249856 ------w- c:\windows\Setup1.exe
2011-06-21 04:55 . 2011-06-21 04:55 0 ----a-w- c:\windows\SysWow64\REN7177.tmp
2011-06-17 13:55 . 2011-06-01 10:02 466456 ----a-w- c:\windows\system32\wrap_oal.dll
2011-06-17 13:55 . 2011-06-01 10:02 122904 ----a-w- c:\windows\system32\OpenAL32.dll
2011-06-17 13:55 . 2010-12-23 19:58 444952 ----a-w- c:\windows\SysWow64\wrap_oal.dll
2011-06-17 13:55 . 2010-12-23 19:58 109080 ----a-w- c:\windows\SysWow64\OpenAL32.dll
2011-06-12 13:05 . 2011-06-12 14:33 80256 ----a-w- c:\windows\SysWow64\ezGOSvc.dll
2011-06-12 13:05 . 2011-06-12 14:33 663424 ----a-w- c:\windows\SysWow64\ezGOSvcApp.exe
2011-06-11 03:07 . 2011-07-13 06:19 3137536 ----a-w- c:\windows\system32\win32k.sys
2011-06-10 23:58 . 2011-06-10 23:58 81744 ----a-w- c:\windows\SysWow64\mfcm100u.dll
2011-06-10 23:58 . 2011-06-10 23:58 81744 ----a-w- c:\windows\SysWow64\mfcm100.dll
2011-06-10 23:58 . 2011-06-10 23:58 773968 ----a-w- c:\windows\SysWow64\msvcr100.dll
2011-06-10 23:58 . 2011-06-10 23:58 64336 ----a-w- c:\windows\SysWow64\mfc100fra.dll
2011-06-10 23:58 . 2011-06-10 23:58 64336 ----a-w- c:\windows\SysWow64\mfc100deu.dll
2011-06-10 23:58 . 2011-06-10 23:58 63824 ----a-w- c:\windows\SysWow64\mfc100esn.dll
2011-06-10 23:58 . 2011-06-10 23:58 62288 ----a-w- c:\windows\SysWow64\mfc100ita.dll
2011-06-10 23:58 . 2011-06-10 23:58 60752 ----a-w- c:\windows\SysWow64\mfc100rus.dll
2011-06-10 23:58 . 2011-06-10 23:58 55120 ----a-w- c:\windows\SysWow64\mfc100enu.dll
2011-06-10 23:58 . 2011-06-10 23:58 51024 ----a-w- c:\windows\SysWow64\vcomp100.dll
2011-06-10 23:58 . 2011-06-10 23:58 4422992 ----a-w- c:\windows\SysWow64\mfc100u.dll
2011-06-10 23:58 . 2011-06-10 23:58 4397384 ----a-w- c:\windows\SysWow64\mfc100.dll
2011-06-10 23:58 . 2011-06-10 23:58 43856 ----a-w- c:\windows\SysWow64\mfc100jpn.dll
2011-06-10 23:58 . 2011-06-10 23:58 43344 ----a-w- c:\windows\SysWow64\mfc100kor.dll
2011-06-10 23:58 . 2011-06-10 23:58 421200 ----a-w- c:\windows\SysWow64\msvcp100.dll
2011-06-10 23:58 . 2011-06-10 23:58 36176 ----a-w- c:\windows\SysWow64\mfc100cht.dll
2011-06-10 23:58 . 2011-06-10 23:58 36176 ----a-w- c:\windows\SysWow64\mfc100chs.dll
2011-06-10 23:58 . 2011-06-10 23:58 138056 ----a-w- c:\windows\SysWow64\atl100.dll
2011-06-03 14:02 . 2011-06-03 14:02 62496 ----a-w- c:\windows\system32\drivers\epfwwfp.sys
2011-06-03 14:01 . 2011-06-03 14:01 38288 ----a-w- c:\windows\system32\drivers\EpfwLWF.sys
2011-06-03 14:01 . 2011-06-03 14:01 187632 ----a-w- c:\windows\system32\drivers\epfw.sys
2011-06-03 14:01 . 2011-06-03 14:01 146432 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2011-06-03 14:00 . 2011-06-03 14:00 202064 ----a-w- c:\windows\system32\drivers\eamonm.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2011-01-17 14:54 175912 ----a-w- c:\program files (x86)\ConduitEngine\prxConduitEngine.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{64d23501-5195-4224-9446-e2b0fb64e859}]
2011-01-17 14:54 175912 ----a-w- c:\program files (x86)\HiGames\prxtbHiG0.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{9384bd4c-dd14-4be9-80f7-f6277511e4f5}]
2011-01-17 14:54 175912 ----a-w- c:\program files (x86)\Hot_MP3\prxtbHot0.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2011-05-17 11:29 1490312 ----a-w- c:\program files (x86)\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{64d23501-5195-4224-9446-e2b0fb64e859}"= "c:\program files (x86)\HiGames\prxtbHiG0.dll" [2011-01-17 175912]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2011-05-17 1490312]
"{9384bd4c-dd14-4be9-80f7-f6277511e4f5}"= "c:\program files (x86)\Hot_MP3\prxtbHot0.dll" [2011-01-17 175912]
.
[HKEY_CLASSES_ROOT\clsid\{64d23501-5195-4224-9446-e2b0fb64e859}]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CLASSES_ROOT\clsid\{9384bd4c-dd14-4be9-80f7-f6277511e4f5}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files (x86)\Common Files\Nero\Lib\NMBgMonitor.exe" [2007-09-20 202024]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"reset"="regedit" [X]
"hpqSRMon"="c:\program files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-07-22 150528]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-01-26 336384]
"ApnUpdater"="c:\program files (x86)\Ask.com\Updater\Updater.exe" [2011-05-17 395144]
"NBKeyScan"="c:\program files (x86)\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-09-20 1836328]
"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2010-08-04 1466840]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableSecureUIAPaths"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"HP Software Update"=c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" -atboottime
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
"ATICustomerCare"="c:\program files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe"
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
"DisableThumbnailCache"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Služba Google Update (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [x]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [x]
R2 McMPFSvc;McAfee Personal Firewall;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [x]
R2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [x]
R2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [x]
R3 AODDriver;AODDriver;c:\program files (x86)\Gigabyte\ET6\amd64\AODDriver.sys [2010-03-12 52280]
R3 AppleChargerSrv;AppleChargerSrv;c:\windows\system32\AppleChargerSrv.exe [x]
R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [x]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]
R3 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
R3 etdrv;etdrv;c:\windows\etdrv.sys [2010-12-06 25640]
R3 GVTDrv64;GVTDrv64;c:\windows\GVTDrv64.sys [2010-12-23 30528]
R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [x]
R3 PAC207;SoC PC-Camera;c:\windows\system32\DRIVERS\PFC027.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [x]
S0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S1 AppleCharger;AppleCharger;c:\windows\system32\DRIVERS\AppleCharger.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]
S1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\DRIVERS\mfenlfk.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-01-26 354304]
S2 AMD Reservation Manager;AMD Reservation Manager;c:\program files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe [2010-06-17 194496]
S2 ES lite Service;ES lite Service for program management.;c:\program files (x86)\Gigabyte\EasySaver\ESSVR.EXE [2009-08-24 68136]
S2 ezGOSvc;Easybits GO Services for Windows;c:\windows\system32\svchost.exe [2009-07-14 27136]
S2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [x]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe [2011-07-20 2027840]
S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [x]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\DRIVERS\LEqdUsb.Sys [x]
S3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\DRIVERS\LHidEqd.Sys [x]
S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesDriver64.sys [2011-02-10 11856]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Obsah adresáře 'Naplánované úlohy'
.
2011-08-22 c:\windows\Tasks\RegCure Program Check.job
- c:\program files (x86)\RegCure\RegCure.exe [2011-05-01 10:45]
.
2011-07-03 c:\windows\Tasks\RegCure.job
- c:\program files (x86)\RegCure\RegCure.exe [2011-05-01 10:45]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-04-06 10144288]
"Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2006-11-03 319488]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-10-28 1680976]
"combofix"="c:\combofix\CF17740.3XE" [2010-11-20 345088]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
ezGOSvc
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.seznam.cz/
mLocal Page = c:\windows\SYSTEM32\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
IE: Free YouTube to Mp3 Converter - c:\users\admin\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm
IE: Translate this web page with Babylon - c:\program files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm
IE: Translate with Babylon - c:\program files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Action.htm
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files (x86)\ICQ7.5\ICQ.exe
TCP: DhcpNameServer = 192.168.1.2
FF - ProfilePath - c:\users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\rwe7uvgb.default\
FF - prefs.js: browser.search.selectedEngine - Facemoods Search
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - user.js: network.http.max-connections-per-server - 6
FF - user.js: network.http.max-persistent-connections-per-server - 3
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
BHO-{ce18769b-c7fa-42d2-860d-17c4662c70ad} - (no file)
Toolbar-{ce18769b-c7fa-42d2-860d-17c4662c70ad} - (no file)
Wow6432Node-HKLM-Run-facemoods - c:\program files (x86)\facemoods.com\facemoods\1.4.17.8\facemoodssrv.exe
Wow6432Node-HKLM-Run-wxpdrv - c:\windows\services32.exe
Wow6432Node-HKLM-Run-tray_ico - (no file)
Wow6432Node-HKLM-Run-tray_ico0 - c:\windows\update.tray-3-0\svchost.exe
Wow6432Node-HKLM-Run-tray_ico1 - c:\windows\update.tray-9-0\svchost.exe
Wow6432Node-HKLM-Run-tray_ico2 - (no file)
Wow6432Node-HKLM-Run-tray_ico3 - (no file)
Wow6432Node-HKLM-Run-tray_ico4 - (no file)
Wow6432Node-HKLM-Run-McAfee Guardian - c:\program files (x86)\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe
Wow6432Node-HKLM-Run-systemup - c:\windows\systemup.exe
Wow6432Node-HKU-Default-Run-Exetender_298 - c:\program files (x86)\Frag Games\GPlayer.exe
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{64D23501-5195-4224-9446-E2B0FB64E859} - (no file)
WebBrowser-{CE18769B-C7FA-42D2-860D-17C4662C70AD} - (no file)
WebBrowser-{9384BD4C-DD14-4BE9-80F7-F6277511E4F5} - (no file)
HKLM-Run-System - c:\program files\system32.exe
HKLM-Run-egui - c:\program files\ESET\ESET Smart Security\egui.exe
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
AddRemove-facemoods - c:\program files (x86)\facemoods.com\facemoods\1.4.17.8\uninstall.exe
AddRemove-MiNODLogin - c:\program files (x86)\ESET\MiNODLogin\MiNODLoginUninst.exe
AddRemove-Shockwave - c:\windows\System32\Macromed\SHOCKW~1\UNWISE.EXE
AddRemove-WinPcapInst - c:\program files (x86)\WinPcap\Uninstall.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10v_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10v_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe
c:\program files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
.
**************************************************************************
.
Celkový čas: 2011-08-29 10:44:55 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-08-29 08:44
.
Před spuštěním: Volných bajtů: 280 705 622 016
Po spuštění: Volných bajtů: 282 938 028 032
.
- - End Of File - - 05AC635F8FBB0971427D083CFA9CFA04

Pokud nemate, tak presunte Combofix na plochu

• Spustte poznamkovy blok (Start-spustit-notepad)
• Zkopirujte skript nize

• Kód: Vybrat vše

  KillAll::
  
  Folder::
  c:\windows\update.8.1
  c:\windows\update.tray-9-0-lnk
  c:\windows\update.tray-3-0-lnk
  c:\windows\ufa
  c:\windows\update.tray-9-0
  c:\windows\update.tray-3-0
  c:\program files (x86)\Ask.com
  c:\program files (x86)\RegCure
  
  File::
  c:\windows\FIX.reg
  c:\windows\reset.reg
  c:\windows\unrar.exe
  c:\windows\SysWow64\REN7177.tmp
  c:\program files (x86)\ConduitEngine\prxConduitEngine.dll
  c:\program files (x86)\HiGames\prxtbHiG0.dll
  c:\program files (x86)\Hot_MP3\prxtbHot0.dll
  c:\windows\Tasks\RegCure Program Check.job
  c:\windows\Tasks\RegCure.job
  
  Registry::
  [-HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
  [-HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{64d23501-5195-4224-9446-e2b0fb64e859}]
  [-HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{9384bd4c-dd14-4be9-80f7-f6277511e4f5}]
  [-HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
  "{64d23501-5195-4224-9446-e2b0fb64e859}"=-
  "{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
  "{9384bd4c-dd14-4be9-80f7-f6277511e4f5}"=-
  [-HKEY_CLASSES_ROOT\clsid\{64d23501-5195-4224-9446-e2b0fb64e859}]
  [-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
  [-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
  [-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
  [-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
  [-HKEY_CLASSES_ROOT\clsid\{9384bd4c-dd14-4be9-80f7-f6277511e4f5}]
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=-
  [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
  "reset"=-
  "ApnUpdater"=-
  "NBKeyScan"=-
  "mcui_exe"=-
  [-HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
  [HKEY_LOCAL_MACHINE\software\microsoft\security center]
  "FirewallOverride"=dword:00000000
  "DisableThumbnailCache"=dword:00000000
  
  Driver::
  gupdate
  
  Firefox::
  FF - ProfilePath - c:\users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\rwe7uvgb.default\
  FF - prefs.js: browser.search.selectedEngine - Facemoods Search
  
  RegLock::
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
  [HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
  
  Reboot::

• Ulozte vytvoreny TXT jako CFScript.txt
• Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
  
• Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

ComboFix 11-08-28.01 - admin 29.08.2011 11:07:48.3.6 - x64
Spuštěný z: c:\users\admin\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\admin\Desktop\CFScript.txt
.
FILE ::
"c:\program files (x86)\ConduitEngine\prxConduitEngine.dll"
"c:\program files (x86)\HiGames\prxtbHiG0.dll"
"c:\program files (x86)\Hot_MP3\prxtbHot0.dll"
"c:\windows\FIX.reg"
"c:\windows\reset.reg"
"c:\windows\SysWow64\REN7177.tmp"
"c:\windows\Tasks\RegCure Program Check.job"
"c:\windows\Tasks\RegCure.job"
"c:\windows\unrar.exe"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Ask.com
c:\program files (x86)\Ask.com\assets\oobe\b.png
c:\program files (x86)\Ask.com\assets\oobe\bl.png
c:\program files (x86)\Ask.com\assets\oobe\br.png
c:\program files (x86)\Ask.com\assets\oobe\l.png
c:\program files (x86)\Ask.com\assets\oobe\pointer.png
c:\program files (x86)\Ask.com\assets\oobe\r.png
c:\program files (x86)\Ask.com\assets\oobe\t.png
c:\program files (x86)\Ask.com\assets\oobe\tl.png
c:\program files (x86)\Ask.com\assets\oobe\tr.png
c:\program files (x86)\Ask.com\cobrand.ico
c:\program files (x86)\Ask.com\config.xml
c:\program files (x86)\Ask.com\favicon.ico
c:\program files (x86)\Ask.com\fv_ebc5.ico
c:\program files (x86)\Ask.com\GenericAskToolbar.dll
c:\program files (x86)\Ask.com\mupcfg.xml
c:\program files (x86)\Ask.com\precache.exe
c:\program files (x86)\Ask.com\SaUpdate.exe
c:\program files (x86)\Ask.com\Updater\config.xml
c:\program files (x86)\Ask.com\Updater\Updater.exe
c:\program files (x86)\Ask.com\UpdateTask.exe
c:\program files (x86)\ConduitEngine\prxConduitEngine.dll
c:\program files (x86)\HiGames\prxtbHiG0.dll
c:\program files (x86)\Hot_MP3\prxtbHot0.dll
c:\program files (x86)\RegCure
c:\program files (x86)\RegCure\0_days.htm
c:\program files (x86)\RegCure\1_days.htm
c:\program files (x86)\RegCure\15_days.htm
c:\program files (x86)\RegCure\2_days.htm
c:\program files (x86)\RegCure\30_days.htm
c:\program files (x86)\RegCure\5_days.htm
c:\program files (x86)\RegCure\Animated-Bar.gif
c:\program files (x86)\RegCure\AutoUpdate.dll
c:\program files (x86)\RegCure\Backup\RegCureBak_April_28_11_16_57_11\311E.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_April_28_11_16_57_11\312F.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_April_28_11_16_57_11\3130.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_April_28_11_16_57_11\3131.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_April_28_11_16_57_11\3132.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_April_28_11_16_57_11\3133.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_April_28_11_16_57_11\3143.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_April_28_11_16_57_11\316B.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_April_28_11_16_57_11\316E.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_April_28_11_16_57_11\3198.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_April_28_11_16_57_11\31D2.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_April_28_11_16_57_11\31EA.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_08_30\8BCD.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14.64Bit.reg
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14.bak
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14.reg
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\243F.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2440.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2441.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2452.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2453.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2454.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2455.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2456.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2466.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2467.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2468.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2469.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\246A.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\246B.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\247C.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\247D.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\247E.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\247F.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2480.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2481.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2491.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2492.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2493.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2494.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2495.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2496.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24A7.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24A8.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24A9.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24AA.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24AB.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24AC.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24BD.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24BE.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24BF.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24C0.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24C1.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24C2.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24D2.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24D3.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24D4.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24D5.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24D6.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24E7.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24E8.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24E9.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24EA.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24EB.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24EC.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24FC.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24FD.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24FE.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\24FF.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2500.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2501.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2512.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2513.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2514.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2515.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2516.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2517.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2528.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2529.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\252A.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\252B.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\252C.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\252D.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\253D.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\253E.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\253F.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2540.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2541.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2542.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2553.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2554.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2555.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2556.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2557.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2567.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2568.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2569.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\256A.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\256B.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\256C.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\257D.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\257E.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\257F.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2580.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2581.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2582.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2593.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2594.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2595.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2596.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2597.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25A7.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25A8.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25A9.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25AA.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25AB.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25AC.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25BD.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25BE.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25BF.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25C0.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25C1.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25C2.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25D2.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25D3.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25D4.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25D5.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25D6.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25D7.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25E8.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25E9.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25EA.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25EB.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25EC.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25FD.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25FE.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\25FF.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2600.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2601.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2602.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2612.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2613.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2614.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2615.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2616.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2617.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2628.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2629.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\262A.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\262B.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\262C.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\263C.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\263D.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\263E.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\263F.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2640.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2641.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2652.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2653.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2654.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2655.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2656.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2657.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2668.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2669.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\266A.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\266B.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\266C.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\266D.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\267D.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\267E.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\267F.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2680.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2681.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2692.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2693.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2694.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2695.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2696.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2697.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26A7.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26A8.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26A9.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26AA.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26AB.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26AC.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26BD.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26BE.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26BF.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26C0.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26C1.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26D2.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26D3.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26D4.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26D5.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26D6.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26D7.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26E7.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26E8.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26E9.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26EA.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26EB.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26EC.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26FD.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26FE.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\26FF.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2700.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2701.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2711.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2712.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2713.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2714.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2715.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2716.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2727.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2728.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2729.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\272A.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\272B.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\273C.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\273D.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\273E.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\273F.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2740.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2741.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2751.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2752.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2753.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2754.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2755.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2756.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2767.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2768.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2769.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_10_14\2779.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_11_11.64Bit.reg
c:\program files (x86)\RegCure\Backup\RegCureBak_August_14_11_21_11_11.reg
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19.64Bit.reg
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19.bak
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19.reg
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\5984.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\5985.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\5986.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\5987.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\5988.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\5989.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\598A.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\598B.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\598C.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\598D.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\598E.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\598F.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\5990.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\5991.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\5992.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\5993.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\5994.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\5995.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\5996.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\5997.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\59A8.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\59A9.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\59AA.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\59AB.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\59AC.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\59AD.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\59AE.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\59AF.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\59B0.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\59B1.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\59B2.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\59C2.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\59C3.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\59C4.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\59C5.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\59C6.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\59C7.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\59C8.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_August_21_11_17_40_19\59C9.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_July_03_11_08_40_48\688B.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_July_03_11_08_40_48\688C.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_July_03_11_08_40_48\688D.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_July_03_11_08_40_48\689E.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_July_03_11_08_40_48\689F.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_July_03_11_08_40_48\68B2.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_July_03_11_08_40_48\68F1.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_July_20_11_21_49_17\BC6.tmp
c:\program files (x86)\RegCure\Backup\RegCureBak_May_01_11_17_47_56\6FA1.tmp
c:\program files (x86)\RegCure\blue_duo.jpg
c:\program files (x86)\RegCure\buttonfill.jpg
c:\program files (x86)\RegCure\buttonfill_expire.jpg
c:\program files (x86)\RegCure\buttonfill_mo.jpg
c:\program files (x86)\RegCure\buttonfill_mo_expire.jpg
c:\program files (x86)\RegCure\BuyNags.htm
c:\program files (x86)\RegCure\center_gradient.jpg
c:\program files (x86)\RegCure\container_content_bkimg.gif
c:\program files (x86)\RegCure\container_content_leftimg.gif
c:\program files (x86)\RegCure\container_content_rightimg.gif
c:\program files (x86)\RegCure\contentwrapper.gif
c:\program files (x86)\RegCure\email.htm
c:\program files (x86)\RegCure\expire.css
c:\program files (x86)\RegCure\footerbar.gif
c:\program files (x86)\RegCure\green_duo.jpg
c:\program files (x86)\RegCure\info_bubble.jpg
c:\program files (x86)\RegCure\left_gradient.jpg
c:\program files (x86)\RegCure\logo.jpg
c:\program files (x86)\RegCure\Logs\RegCure-01-05-11-17-47-56.zip
c:\program files (x86)\RegCure\Logs\RegCure-03-07-11-08-40-49.zip
c:\program files (x86)\RegCure\Logs\RegCure-11-05-11-21-52-07.zip
c:\program files (x86)\RegCure\Logs\RegCure-14-08-11-21-08-30.zip
c:\program files (x86)\RegCure\Logs\RegCure-14-08-11-21-10-15.zip
c:\program files (x86)\RegCure\Logs\RegCure-14-08-11-21-11-11.zip
c:\program files (x86)\RegCure\Logs\RegCure-19-05-11-06-21-24.zip
c:\program files (x86)\RegCure\Logs\RegCure-20-07-11-21-49-17.zip
c:\program files (x86)\RegCure\Logs\RegCure-21-08-11-17-40-20.zip
c:\program files (x86)\RegCure\Logs\RegCure-28-04-11-16-49-04.zip
c:\program files (x86)\RegCure\Logs\RegCure-28-04-11-16-57-11.zip
c:\program files (x86)\RegCure\Logs\RegCure-28-04-11-16-57-46.zip
c:\program files (x86)\RegCure\Logs\SystemInfo.zip
c:\program files (x86)\RegCure\LogSettings.xml
c:\program files (x86)\RegCure\main.css
c:\program files (x86)\RegCure\main_nag.css
c:\program files (x86)\RegCure\main_showstats.css
c:\program files (x86)\RegCure\package_titlebar_bkimg.jpg
c:\program files (x86)\RegCure\process-animation.gif
c:\program files (x86)\RegCure\RegCure.exe
c:\program files (x86)\RegCure\regcure.gif
c:\program files (x86)\RegCure\right_gradient.jpg
c:\program files (x86)\RegCure\settings.xml
c:\program files (x86)\RegCure\showstats.htm
c:\program files (x86)\RegCure\small_vbxregcure.jpg
c:\program files (x86)\RegCure\special_offer.jpg
c:\program files (x86)\RegCure\special_offer_nag.jpg
c:\program files (x86)\RegCure\subtitlebar.gif
c:\program files (x86)\RegCure\tile_titlebar.jpg
c:\program files (x86)\RegCure\titlebar_left.jpg
c:\program files (x86)\RegCure\titlebar_right.jpg
c:\program files (x86)\RegCure\tp.css
c:\program files (x86)\RegCure\TrialPay.htm
c:\program files (x86)\RegCure\underline.gif
c:\program files (x86)\RegCure\uninst.exe
c:\program files (x86)\RegCure\zlibwapi.dll
c:\windows\FIX.reg
c:\windows\reset.reg
c:\windows\SysWow64\REN7177.tmp
c:\windows\Tasks\RegCure Program Check.job
c:\windows\Tasks\RegCure.job
c:\windows\ufa
c:\windows\ufa\ufa.exe
c:\windows\unrar.exe
c:\windows\update.8.1
c:\windows\update.tray-3-0-lnk
c:\windows\update.tray-3-0-lnk\svchost.exe
c:\windows\update.tray-3-0
c:\windows\update.tray-9-0-lnk
c:\windows\update.tray-9-0-lnk\svchost.exe
c:\windows\update.tray-9-0
c:\users\admin\AppData\Roaming\Microsoft\Windows\Recent\?Katy Perry - The Girl Next Door with lyrics in HD?? - YouTube.URL . . . . nemohl být smazán
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_gupdate
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-07-28 do 2011-08-29 )))))))))))))))))))))))))))))))
.
.
2011-08-29 09:12 . 2011-08-29 09:12 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-08-29 08:24 . 2011-08-12 04:10 8862544 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F5E77159-442E-4FDF-A4BB-9F1D8FC36297}\mpengine.dll
2011-08-29 08:23 . 2011-08-29 08:23 -------- d-----w- c:\programdata\McAfee
2011-08-29 07:39 . 2011-08-29 08:18 -------- d-----w- c:\program files\trend micro
2011-08-29 07:39 . 2011-08-29 07:42 -------- dc----w- C:\rsit
2011-08-24 06:34 . 2011-08-24 06:34 -------- d-----w- c:\windows\SysWow64\xlive
2011-08-24 06:34 . 2011-07-09 05:26 2048 ----a-w- c:\windows\system32\tzres.dll
2011-08-24 06:34 . 2011-07-09 04:29 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2011-08-22 07:21 . 2011-08-22 07:21 -------- dc----w- C:\$UPGRADE.~OS
2011-08-21 16:43 . 2011-08-21 16:43 -------- d-----w- c:\program files (x86)\SiteAdvisor
2011-08-21 16:42 . 2011-04-14 12:08 24376 ----a-w- c:\program files (x86)\Mozilla Firefox\components\Scriptff.dll
2011-08-21 16:42 . 2011-04-14 12:08 9984 ----a-w- c:\windows\system32\drivers\mfeclnk.sys
2011-08-21 16:42 . 2011-04-14 12:08 149032 ----a-w- c:\windows\system32\mfevtps.exe
2011-08-21 16:42 . 2011-04-14 12:08 94992 ----a-w- c:\windows\system32\drivers\mferkdet.sys
2011-08-21 16:42 . 2011-04-14 12:08 75160 ----a-w- c:\windows\system32\drivers\mfenlfk.sys
2011-08-21 16:42 . 2011-04-14 12:08 63056 ----a-w- c:\windows\system32\drivers\cfwids.sys
2011-08-21 16:42 . 2011-04-14 12:08 530304 ----a-w- c:\windows\system32\drivers\mfehidk.sys
2011-08-21 16:42 . 2011-04-14 12:08 441840 ----a-w- c:\windows\system32\drivers\mfefirek.sys
2011-08-21 16:42 . 2011-04-14 12:08 283744 ----a-w- c:\windows\system32\drivers\mfewfpk.sys
2011-08-21 16:42 . 2011-04-14 12:08 190520 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
2011-08-21 16:42 . 2011-08-21 16:42 -------- d-----w- c:\program files\McAfee.com
2011-08-21 16:07 . 2011-08-21 16:08 53248 ------w- c:\program files (x86)\Common Files\InstallShield\engine\6\Intel 32\msihook.dll
2011-08-21 16:07 . 2011-08-21 16:08 32768 ------w- c:\program files (x86)\Common Files\InstallShield\engine\6\Intel 32\objectps.dll
2011-08-21 16:07 . 2011-08-21 16:08 221184 ------w- c:\program files (x86)\Common Files\InstallShield\IScript\iscript.dll
2011-08-21 16:07 . 2011-08-21 16:08 598016 ------w- c:\program files (x86)\Common Files\InstallShield\engine\6\Intel 32\ikernel.exe
2011-08-21 16:07 . 2011-08-21 16:08 217088 ------w- c:\program files (x86)\Common Files\InstallShield\engine\6\Intel 32\iuser.dll
2011-08-21 16:07 . 2011-08-21 16:08 114688 ------w- c:\program files (x86)\Common Files\InstallShield\engine\6\Intel 32\scpthdlr.dll
2011-08-21 16:07 . 2011-08-21 16:07 126976 ------w- c:\program files (x86)\Common Files\InstallShield\engine\6\Intel 32\knlwrap.exe
2011-08-21 15:37 . 2011-08-21 15:37 -------- d-----w- c:\windows\av_ico
2011-08-18 10:32 . 2011-08-18 10:32 -------- d-----w- c:\program files (x86)\Atari
2011-08-17 05:12 . 2011-08-21 16:03 -------- d-----w- c:\programdata\Electronic Arts
2011-08-16 20:53 . 2003-02-11 04:02 32768 ----a-w- c:\program files (x86)\Mozilla Firefox\plugins\np32dsw.dll
2011-08-15 18:10 . 2011-08-15 18:10 -------- d-----w- c:\program files (x86)\AVI to 3GP
2011-08-12 13:28 . 2011-08-12 13:28 -------- d-----w- c:\program files (x86)\Download Master
2011-08-12 13:26 . 2011-08-12 13:26 -------- d-----w- c:\program files (x86)\REDEMAX
2011-08-10 09:55 . 2011-07-09 02:46 288768 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-08-07 20:47 . 2011-08-07 20:47 -------- d-----w- c:\users\admin\AppData\Local\Abelssoft
2011-08-07 20:47 . 2011-08-07 20:49 -------- d-----w- c:\program files (x86)\K-Lite Codec Pack
2011-08-07 20:47 . 2011-08-07 20:49 -------- d-----w- c:\program files (x86)\YouTube Song Downloader
2011-08-07 20:39 . 2011-08-07 20:39 -------- d-----w- c:\programdata\TheManWithNoLife
2011-08-07 20:39 . 2011-08-07 20:43 -------- d-----w- c:\program files\TheManWithNoLife
2011-08-07 20:02 . 2011-08-07 20:02 -------- d-----w- c:\users\admin\AppData\Roaming\DVDVideoSoftIEHelpers
2011-08-07 20:02 . 2011-08-07 20:15 -------- d-----w- c:\program files (x86)\DVDVideoSoft
2011-08-07 20:02 . 2011-08-07 20:03 -------- d-----w- c:\program files (x86)\Common Files\DVDVideoSoft
2011-08-01 05:02 . 2011-08-01 05:02 -------- d-----w- c:\users\admin\AppData\Roaming\Ventrilo
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-29 09:13 . 2010-12-05 18:39 25640 ----a-w- c:\windows\gdrv.sys
2011-08-17 07:34 . 2011-06-13 19:22 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-07-20 15:14 . 2011-06-15 19:06 18960 ----a-w- c:\windows\system32\drivers\LNonPnP.sys
2011-07-20 08:41 . 2011-07-20 17:06 34624 ----a-w- c:\windows\system32\TURegOpt.exe
2011-07-20 08:35 . 2011-07-20 17:05 25920 ----a-w- c:\windows\system32\authuitu.dll
2011-07-20 08:35 . 2011-07-20 17:05 21312 ----a-w- c:\windows\SysWow64\authuitu.dll
2011-07-20 08:35 . 2011-07-20 17:05 36160 ----a-w- c:\windows\system32\uxtuneup.dll
2011-07-20 08:35 . 2011-07-20 17:05 29504 ----a-w- c:\windows\SysWow64\uxtuneup.dll
2011-07-16 04:26 . 2011-08-10 09:55 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2011-07-15 19:58 . 2011-07-15 19:58 53248 ----a-r- c:\users\admin\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2011-07-03 15:24 . 2011-07-03 15:24 20480 ----a-w- c:\windows\SysWow64\H@tKeysH@@k.DLL
2011-07-03 14:36 . 2011-07-01 14:20 73216 ----a-w- c:\windows\ST6UNST.EXE
2011-07-03 14:36 . 2011-07-01 14:20 249856 ------w- c:\windows\Setup1.exe
2011-06-17 13:55 . 2011-06-01 10:02 466456 ----a-w- c:\windows\system32\wrap_oal.dll
2011-06-17 13:55 . 2011-06-01 10:02 122904 ----a-w- c:\windows\system32\OpenAL32.dll
2011-06-17 13:55 . 2010-12-23 19:58 444952 ----a-w- c:\windows\SysWow64\wrap_oal.dll
2011-06-17 13:55 . 2010-12-23 19:58 109080 ----a-w- c:\windows\SysWow64\OpenAL32.dll
2011-06-12 13:05 . 2011-06-12 14:33 80256 ----a-w- c:\windows\SysWow64\ezGOSvc.dll
2011-06-12 13:05 . 2011-06-12 14:33 663424 ----a-w- c:\windows\SysWow64\ezGOSvcApp.exe
2011-06-11 03:07 . 2011-07-13 06:19 3137536 ----a-w- c:\windows\system32\win32k.sys
2011-06-10 23:58 . 2011-06-10 23:58 81744 ----a-w- c:\windows\SysWow64\mfcm100u.dll
2011-06-10 23:58 . 2011-06-10 23:58 81744 ----a-w- c:\windows\SysWow64\mfcm100.dll
2011-06-10 23:58 . 2011-06-10 23:58 773968 ----a-w- c:\windows\SysWow64\msvcr100.dll
2011-06-10 23:58 . 2011-06-10 23:58 64336 ----a-w- c:\windows\SysWow64\mfc100fra.dll
2011-06-10 23:58 . 2011-06-10 23:58 64336 ----a-w- c:\windows\SysWow64\mfc100deu.dll
2011-06-10 23:58 . 2011-06-10 23:58 63824 ----a-w- c:\windows\SysWow64\mfc100esn.dll
2011-06-10 23:58 . 2011-06-10 23:58 62288 ----a-w- c:\windows\SysWow64\mfc100ita.dll
2011-06-10 23:58 . 2011-06-10 23:58 60752 ----a-w- c:\windows\SysWow64\mfc100rus.dll
2011-06-10 23:58 . 2011-06-10 23:58 55120 ----a-w- c:\windows\SysWow64\mfc100enu.dll
2011-06-10 23:58 . 2011-06-10 23:58 51024 ----a-w- c:\windows\SysWow64\vcomp100.dll
2011-06-10 23:58 . 2011-06-10 23:58 4422992 ----a-w- c:\windows\SysWow64\mfc100u.dll
2011-06-10 23:58 . 2011-06-10 23:58 4397384 ----a-w- c:\windows\SysWow64\mfc100.dll
2011-06-10 23:58 . 2011-06-10 23:58 43856 ----a-w- c:\windows\SysWow64\mfc100jpn.dll
2011-06-10 23:58 . 2011-06-10 23:58 43344 ----a-w- c:\windows\SysWow64\mfc100kor.dll
2011-06-10 23:58 . 2011-06-10 23:58 421200 ----a-w- c:\windows\SysWow64\msvcp100.dll
2011-06-10 23:58 . 2011-06-10 23:58 36176 ----a-w- c:\windows\SysWow64\mfc100cht.dll
2011-06-10 23:58 . 2011-06-10 23:58 36176 ----a-w- c:\windows\SysWow64\mfc100chs.dll
2011-06-10 23:58 . 2011-06-10 23:58 138056 ----a-w- c:\windows\SysWow64\atl100.dll
2011-06-03 14:02 . 2011-06-03 14:02 62496 ----a-w- c:\windows\system32\drivers\epfwwfp.sys
2011-06-03 14:01 . 2011-06-03 14:01 38288 ----a-w- c:\windows\system32\drivers\EpfwLWF.sys
2011-06-03 14:01 . 2011-06-03 14:01 187632 ----a-w- c:\windows\system32\drivers\epfw.sys
2011-06-03 14:01 . 2011-06-03 14:01 146432 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2011-06-03 14:00 . 2011-06-03 14:00 202064 ----a-w- c:\windows\system32\drivers\eamonm.sys
.
.
((((((((((((((((((((((((((((( SnapShot@2011-08-29_08.42.29 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-07-14 04:54 . 2011-08-29 08:26 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54 . 2011-08-29 08:56 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54 . 2011-08-29 08:56 49152 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:54 . 2011-08-29 08:26 49152 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-12-05 18:31 . 2011-08-29 08:53 62084 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2011-08-29 08:53 24708 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
- 2009-07-14 05:10 . 2011-08-29 08:23 24708 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2010-12-05 18:24 . 2011-08-29 08:53 3322 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1071306001-177135528-4153119601-1001_UserData.bin
- 2011-08-29 08:42 . 2011-08-29 08:42 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-08-29 09:13 . 2011-08-29 09:13 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-08-29 08:42 . 2011-08-29 08:42 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-08-29 09:13 . 2011-08-29 09:13 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-07-14 04:54 . 2011-08-29 08:26 131072 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2011-08-29 08:56 131072 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"ISUSPM Startup"="c:\progra~2\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2005-02-17 221184]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"hpqSRMon"="c:\program files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-07-22 150528]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-01-26 336384]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableSecureUIAPaths"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [x]
R2 McMPFSvc;McAfee Personal Firewall;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [x]
R2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [x]
R2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [x]
R3 AODDriver;AODDriver;c:\program files (x86)\Gigabyte\ET6\amd64\AODDriver.sys [2010-03-12 52280]
R3 AppleChargerSrv;AppleChargerSrv;c:\windows\system32\AppleChargerSrv.exe [x]
R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [x]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]
R3 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
R3 etdrv;etdrv;c:\windows\etdrv.sys [2010-12-06 25640]
R3 GVTDrv64;GVTDrv64;c:\windows\GVTDrv64.sys [2010-12-23 30528]
R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [x]
R3 PAC207;SoC PC-Camera;c:\windows\system32\DRIVERS\PFC027.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [x]
S0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S1 AppleCharger;AppleCharger;c:\windows\system32\DRIVERS\AppleCharger.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]
S1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\DRIVERS\mfenlfk.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-01-26 354304]
S2 AMD Reservation Manager;AMD Reservation Manager;c:\program files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe [2010-06-17 194496]
S2 ES lite Service;ES lite Service for program management.;c:\program files (x86)\Gigabyte\EasySaver\ESSVR.EXE [2009-08-24 68136]
S2 ezGOSvc;Easybits GO Services for Windows;c:\windows\system32\svchost.exe [2009-07-14 27136]
S2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [x]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe [2011-07-20 2027840]
S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [x]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\DRIVERS\LEqdUsb.Sys [x]
S3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\DRIVERS\LHidEqd.Sys [x]
S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesDriver64.sys [2011-02-10 11856]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-04-06 10144288]
"Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2006-11-03 319488]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-10-28 1680976]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [BU]
"combofix"="c:\combofix\CF23592.3XE" [2010-11-20 345088]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
ezGOSvc
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.seznam.cz/
mLocal Page = c:\windows\SYSTEM32\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
IE: Free YouTube to Mp3 Converter - c:\users\admin\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm
IE: Translate this web page with Babylon - c:\program files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm
IE: Translate with Babylon - c:\program files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Action.htm
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files (x86)\ICQ7.5\ICQ.exe
TCP: DhcpNameServer = 192.168.1.2
FF - ProfilePath - c:\users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\rwe7uvgb.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - user.js: network.http.max-connections-per-server - 6
FF - user.js: network.http.max-persistent-connections-per-server - 3
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
BHO-{ce18769b-c7fa-42d2-860d-17c4662c70ad} - (no file)
Toolbar-{ce18769b-c7fa-42d2-860d-17c4662c70ad} - (no file)
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe
c:\program files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
.
**************************************************************************
.
Celkový čas: 2011-08-29 11:16:07 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-08-29 09:16
ComboFix2.txt 2011-08-29 08:44
.
Před spuštěním: Volných bajtů: 283 008 958 464
Po spuštění: Volných bajtů: 282 943 266 816
.
- - End Of File - - 10289A3445EE084262512C5FD4C0DA2F