VIRY.CZ

Pomáháme v boji s počítačovou havěti!
https://forum.viry.cz:443/

pomale pc prosim o preventivku

https://forum.viry.cz:443/viewtopic.php?t=115105

Stránka 1 z 1

pomale pc prosim o preventivku

Napsal: 02 zář 2011 22:28
od RGCOM
Logfile of random's system information tool 1.09 (written by random/random)
Run by rgcom at 2011-09-02 23:24:27
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 66 GB (24%) free of 277 GB
Total RAM: 4091 MB (38% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 23:25:10, on 2. 9. 2011
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\ProgramData\Badoo\Badoo Desktop\1.6.38.1042\Badoo.Desktop.exe
C:\Users\rgcom\AppData\Roaming\Mikogo 4\mikogo-host.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Windows\SysWOW64\DllHost.exe
C:\Program Files (x86)\Opera\opera.exe
C:\Program Files (x86)\RelevantKnowledge\rlvknlg.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\Skype\Plugin Manager\skypePM.exe
C:\Program Files\trend micro\rgcom.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bigseekpro.com/bsprpc/{E5EC6 ... 59285084BF}
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bigseekpro.com/bsprpc/{E5EC6 ... 59285084BF}
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {dfabc5b5-039b-4865-979a-de31cdf3e351} - (no file)
R3 - URLSearchHook: (no name) - {09ec805c-cb2e-4d53-b0d3-a75a428b81c7} - (no file)
R3 - URLSearchHook: (no name) - {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - (no file)
R3 - URLSearchHook: ToolbarURLSearchHook Class - {CA3EB689-8F09-4026-AA10-B9534C691CE0} - C:\Program Files (x86)\BSP DB Toolbar\tbhelper.dll
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Bing Bar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1449.0\npwinext.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SMTTB2009 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files (x86)\BSP DB Toolbar\tbcore3.dll
O3 - Toolbar: Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll
O3 - Toolbar: @C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1449.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1449.0\npwinext.dll
O3 - Toolbar: BSP DB Toolbar - {338B4DFE-2E2C-4338-9E41-E176D497299E} - C:\Program Files (x86)\BSP DB Toolbar\tbcore3.dll
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Badoo Desktop] C:\ProgramData\Badoo\Badoo Desktop\1.6.38.1042\Badoo.Desktop.exe
O4 - HKCU\..\Run: [Mikogo] "C:\Users\rgcom\AppData\Roaming\Mikogo 4\mikogo-host.exe" -asp
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: Startup.event
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\Windows\SysWOW64\guard32.dll
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - LSI Corporation - C:\Program Files\LSI SoftModem\agr64svc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: M4-Service - Unknown owner - C:\Users\rgcom\AppData\Roaming\Mikogo 4\M4-Service.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: RelevantKnowledge - TMRG, Inc. - C:\Program Files (x86)\RelevantKnowledge\rlservice.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: TomTomHOMEService - TomTom - C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 10139 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
winlogon.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
"C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe"
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
atieclxx
"C:\Program Files\Alwil Software\Avast5\AvastSvc.exe"
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"taskhost.exe"
"C:\Windows\system32\Dwm.exe"
"C:\Program Files\LSI SoftModem\agr64svc.exe"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\Explorer.EXE
"C:\Users\rgcom\AppData\Roaming\Mikogo 4\M4-Service.exe"
"C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe"
"C:\Users\rgcom\AppData\Roaming\Mikogo 4\M4-Capture.exe"
"C:\Program Files (x86)\RelevantKnowledge\rlservice.exe" /service
"C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe"
"C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe"
"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"
"C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe"
"C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesApp64.exe" /TUStart /pid:2536
C:\Windows\system32\wbem\wmiprvse.exe
WLIDSvcM.exe 2572
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files\Comodo\COMODO Internet Security\cfp.exe" -h
"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
"C:\ProgramData\Badoo\Badoo Desktop\1.6.38.1042\Badoo.Desktop.exe"
"C:\Users\rgcom\AppData\Roaming\Mikogo 4\mikogo-host.exe" -asp
"C:\Program Files\Alwil Software\Avast5\AvastUI.exe" /nogui
C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}
"C:\Program Files (x86)\Opera\opera.exe"
"C:\Program Files (x86)\RelevantKnowledge\rlvknlg.exe" -boot
"C:\Program Files (x86)\RelevantKnowledge\rlvknlg64.exe"
C:\Windows\system32\wbem\unsecapp.exe -Embedding
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
"C:\Program Files (x86)\Skype\Phone\Skype.exe"
"C:\Program Files (x86)\Skype\Plugin Manager\skypePM.exe" /SILENT
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\rgcom\Desktop\Otdihaem_Dance.rar"
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe74_ Global\UsGthrCtrlFltPipeMssGthrPipe74 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 532 536 544 65536 540
"C:\Users\rgcom\Desktop\RSITx64.exe"
C:\Windows\System32\svchost.exe -k WerSvcGroup

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3510052006-2587695730-3173378556-1000Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3510052006-2587695730-3173378556-1000UA.job

=========Mozilla firefox=========

ProfilePath - C:\Users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default

prefs.js - "browser.search.useDBForOrder" - true
prefs.js - "browser.startup.homepage" - "http://www.bigseekpro.com/bsprpc/{E5EC6 ... 59285084BF}"
prefs.js - "extensions.enabledItems" - "sam@samfind.com:2.2, {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23, engine@conduit.com:3.2.5.2, {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}:3.2.5.2, {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.1, {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24, {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26, {75656794-AB59-4712-BFBC-5D816D56F3BC}:1.1.8, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.13"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@garmin.com/GpsControl]
"Description"=Garmin GPS Control for Firefox
"Path"=C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpWinExt,version=5.0]
"Description"=Bing Bar
"Path"=C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1449.0\npwinext.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.21.65\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.21.65\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_11_0_1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

C:\Program Files (x86)\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}

C:\Program Files (x86)\Mozilla Firefox\components\
browser.xpt
browserdirprovider.dll
brwsrcmp.dll
components.list
FeedConverter.js
FeedProcessor.js
FeedWriter.js
fuelApplication.js
GPSDGeolocationProvider.js
jsconsole-clhandler.js
NetworkGeolocationProvider.js
nsAddonRepository.js
nsBadCertHandler.js
nsBlocklistService.js
nsBrowserContentHandler.js
nsBrowserGlue.js
nsContentDispatchChooser.js
nsContentPrefService.js
nsDefaultCLH.js
nsDownloadManagerUI.js
nsExtensionManager.js
nsFormAutoComplete.js
nsHandlerService.js
nsHelperAppDlg.js
nsINIProcessor.js
nsLivemarkService.js
nsLoginInfo.js
nsLoginManager.js
nsLoginManagerPrompter.js
nsMicrosummaryService.js
nsPlacesAutoComplete.js
nsPlacesDBFlush.js
nsPlacesTransactionsService.js
nsPrivateBrowsingService.js
nsProxyAutoConfig.js
nsSafebrowsingApplication.js
nsSearchService.js
nsSearchSuggestions.js
nsSessionStartup.js
nsSessionStore.js
nsSetDefaultBrowser.js
nsSidebar.js
nsTaggingService.js
nsTryToClose.js
nsUpdateService.js
nsUpdateServiceStub.js
nsUpdateTimerManager.js
nsUrlClassifierLib.js
nsUrlClassifierListManager.js
nsURLFormatter.js
nsWebHandlerApp.js
pluginGlue.js
storage-Legacy.js
storage-mozStorage.js
txEXSLTRegExFunctions.js
WebContentConverter.js

C:\Program Files (x86)\Mozilla Firefox\plugins\
npdeployJava1.dll
npnul32.dll
nppdf32.dll

C:\Program Files (x86)\Mozilla Firefox\searchplugins\
atlas-sk.xml
azet-sk.xml
dunaj-sk.xml
eBay.xml
google.xml
slovnik-sk.xml
wikipedia-sk.xml
zoznam-sk.xml

C:\Users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\
engine@conduit.com
isgdcreator@postspectacular.com
sam@samfind.com
staged-xpis
{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}
{75656794-AB59-4712-BFBC-5D816D56F3BC}
{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
{e4a8a97b-f2ed-450b-b12d-ee082ba24781}

C:\Users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\searchplugins\
askcom.xml
badoo.xml
conduit.xml
MyStart Search.xml
searchplugins.event

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18 532336]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3785D0AD-BFFF-47F6-BF5B-A587C162FED9}]
Canon Easy-WebPrint EX BHO - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll [2010-11-08 202144]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
Search Helper - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll [2010-05-14 191792]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18 403840]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d2ce3e00-f94a-4740-988e-03dc2f38c34f}]
Bing Bar BHO - C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1449.0\npwinext.dll [2010-04-27 550744]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2011-05-04 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}]
SMTTB2009 Class - C:\Program Files (x86)\BSP DB Toolbar\tbcore3.dll [2011-06-22 2398720]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - Canon Easy-WebPrint EX - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll [2010-11-08 1619352]
{8dcb7100-df86-4384-8842-8fa844297b3f} - @C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1449.0\npwinext.dll,-100 - C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1449.0\npwinext.dll [2010-04-27 550744]
{338B4DFE-2E2C-4338-9E41-E176D497299E} - BSP DB Toolbar - C:\Program Files (x86)\BSP DB Toolbar\tbcore3.dll [2011-06-22 2398720]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"COMODO Internet Security"=C:\Program Files\COMODO\COMODO Internet Security\cfp.exe [2011-07-05 9048392]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-20 1475584]
"Badoo Desktop"=C:\ProgramData\Badoo\Badoo Desktop\1.6.38.1042\Badoo.Desktop.exe [2011-08-04 1042944]
"Mikogo"=C:\Users\rgcom\AppData\Roaming\Mikogo 4\mikogo-host.exe [2011-08-04 5420408]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-03-30 937920]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [2011-06-08 37296]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AutoStartNPSAgent]
C:\Program Files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Bing Bar]
C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1449.0\mswinext.exe [2010-04-27 243544]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
C:\Program Files (x86)\SlySoft\CloneCD\CloneCDTray.exe /s []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LManager]
C:\Program Files (x86)\Launch Manager\LManager.exe [2009-08-24 1190920]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Default Manager]
C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe [2009-11-11 288088]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MP4 Player]
C:\Program Files (x86)\MP4 Player\mp4Player.exe [2007-09-19 639488]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
C:\Program Files (x86)\Nokia\Nokia PC Suite 7\PCSuite.exe -onlytray []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
C:\Program Files (x86)\PowerISO\PWRISOVM.EXE []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files (x86)\Skype\Phone\Skype.exe [2011-01-26 15026056]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2009-01-26 2144088]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-12-09 98304]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [2010-08-24 247144]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdatePDRShortCut]
C:\Program Files (x86)\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe C:\Program Files (x86)\CyberLink\PowerDirector UpdateWithCreateOnce Software\CyberLink\PowerDirector\8.0 []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^ADnews.lnk]
C:\AUTO-D~1\ADnews.exe []

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"avast5"=C:\Program Files\Alwil Software\Avast5\avastUI.exe [2011-05-10 3459712]
""= []

C:\Users\rgcom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Startup.event

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=" C:\Windows\system32\guard64.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0
"NoDriveTypeAutoRun"=95

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"MSVideo8"=VfWWDM32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2011-08-28 21:47:56 ----D---- C:\Program Files (x86)\ESET
2011-08-28 21:37:39 ----D---- C:\Users\rgcom\AppData\Roaming\Mikogo 4
2011-08-28 18:25:47 ----D---- C:\Program Files (x86)\BSP DB Toolbar
2011-08-27 08:08:15 ----D---- C:\ProgramData\Comodo Downloader
2011-08-24 16:49:35 ----D---- C:\ProgramData\Badoo
2011-08-23 21:30:36 ----A---- C:\Windows\SYSWOW64\tzres.dll
2011-08-23 21:30:36 ----A---- C:\Windows\system32\tzres.dll
2011-08-10 18:26:03 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2011-08-10 18:26:03 ----A---- C:\Windows\system32\mshtmled.dll
2011-08-10 18:26:01 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2011-08-10 18:26:01 ----A---- C:\Windows\system32\iertutil.dll
2011-08-10 18:26:00 ----A---- C:\Windows\SYSWOW64\ieui.dll
2011-08-10 18:25:59 ----A---- C:\Windows\system32\jscript9.dll
2011-08-10 18:25:59 ----A---- C:\Windows\system32\ieui.dll
2011-08-10 18:25:58 ----A---- C:\Windows\SYSWOW64\url.dll
2011-08-10 18:25:58 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2011-08-10 18:25:58 ----A---- C:\Windows\system32\url.dll
2011-08-10 18:25:57 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2011-08-10 18:25:57 ----A---- C:\Windows\SYSWOW64\jscript.dll
2011-08-10 18:25:57 ----A---- C:\Windows\system32\urlmon.dll
2011-08-10 18:25:57 ----A---- C:\Windows\system32\jscript.dll
2011-08-10 18:25:56 ----A---- C:\Windows\system32\jsproxy.dll
2011-08-10 18:25:55 ----A---- C:\Windows\SYSWOW64\wininet.dll
2011-08-10 18:25:54 ----A---- C:\Windows\system32\wininet.dll
2011-08-10 18:25:52 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2011-08-10 18:25:49 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2011-08-10 18:25:47 ----A---- C:\Windows\system32\mshtml.dll
2011-08-10 18:25:46 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2011-08-10 18:25:45 ----A---- C:\Windows\system32\ieframe.dll
2011-08-10 09:58:25 ----A---- C:\Windows\system32\xmllite.dll
2011-08-10 09:58:24 ----A---- C:\Windows\SYSWOW64\xmllite.dll
2011-08-10 09:58:22 ----A---- C:\Windows\system32\odbccu32.dll
2011-08-10 09:58:22 ----A---- C:\Windows\system32\odbccr32.dll
2011-08-10 09:58:22 ----A---- C:\Windows\system32\odbccp32.dll
2011-08-10 09:58:21 ----A---- C:\Windows\SYSWOW64\odbcjt32.dll
2011-08-10 09:58:21 ----A---- C:\Windows\SYSWOW64\odbccu32.dll
2011-08-10 09:58:21 ----A---- C:\Windows\SYSWOW64\odbccr32.dll
2011-08-10 09:58:21 ----A---- C:\Windows\SYSWOW64\odbccp32.dll
2011-08-10 09:58:21 ----A---- C:\Windows\system32\odbctrac.dll
2011-08-10 09:58:20 ----A---- C:\Windows\SYSWOW64\odbctrac.dll
2011-08-10 09:58:18 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2011-08-10 09:58:03 ----A---- C:\Windows\system32\kernel32.dll
2011-08-10 09:58:03 ----A---- C:\Windows\system32\conhost.exe
2011-08-10 09:58:02 ----A---- C:\Windows\system32\wow64.dll
2011-08-10 09:58:02 ----A---- C:\Windows\system32\winsrv.dll
2011-08-10 09:58:02 ----A---- C:\Windows\system32\KernelBase.dll
2011-08-10 09:58:00 ----A---- C:\Windows\SYSWOW64\setup16.exe
2011-08-10 09:58:00 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2011-08-10 09:58:00 ----A---- C:\Windows\system32\ntvdm64.dll
2011-08-10 09:57:59 ----A---- C:\Windows\system32\wow64win.dll
2011-08-10 09:57:59 ----A---- C:\Windows\system32\wow64cpu.dll
2011-08-10 09:57:58 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2011-08-10 09:57:57 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2011-08-10 09:57:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2011-08-10 09:57:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2011-08-10 09:57:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2011-08-10 09:57:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2011-08-10 09:57:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2011-08-10 09:57:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2011-08-10 09:57:56 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2011-08-10 09:57:56 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2011-08-10 09:57:56 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2011-08-10 09:57:56 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2011-08-10 09:57:56 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2011-08-10 09:57:56 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2011-08-10 09:57:56 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2011-08-10 09:57:56 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2011-08-10 09:57:56 ----A---- C:\Windows\SYSWOW64\wow32.dll
2011-08-10 09:57:55 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2011-08-10 09:57:55 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-08-10 09:57:55 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2011-08-10 09:57:55 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2011-08-10 09:57:55 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2011-08-10 09:57:55 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2011-08-10 09:57:55 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2011-08-10 09:57:55 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2011-08-10 09:57:55 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2011-08-10 09:57:55 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-08-10 09:57:55 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2011-08-10 09:57:55 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2011-08-10 09:57:55 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2011-08-10 09:57:54 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2011-08-10 09:57:54 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2011-08-10 09:57:54 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2011-08-10 09:57:54 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2011-08-10 09:57:54 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2011-08-10 09:57:54 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2011-08-10 09:57:54 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2011-08-10 09:57:54 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2011-08-10 09:57:53 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2011-08-10 09:57:53 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2011-08-10 09:57:53 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2011-08-10 09:57:53 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2011-08-10 09:57:53 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2011-08-10 09:57:53 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2011-08-10 09:57:53 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2011-08-10 09:57:53 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2011-08-10 09:57:53 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2011-08-10 09:57:53 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2011-08-10 09:57:53 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2011-08-10 09:57:53 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2011-08-10 09:57:52 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2011-08-10 09:57:51 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2011-08-10 09:57:51 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2011-08-10 09:57:51 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2011-08-10 09:57:50 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2011-08-10 09:57:50 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2011-08-10 09:57:50 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2011-08-10 09:57:50 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2011-08-10 09:57:49 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2011-08-10 09:57:49 ----A---- C:\Windows\SYSWOW64\user.exe
2011-08-10 09:57:49 ----A---- C:\Windows\SYSWOW64\instnm.exe
2011-08-10 09:57:45 ----A---- C:\Windows\system32\drivers\tcpip.sys
2011-08-10 09:57:40 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2011-08-10 09:57:39 ----A---- C:\Windows\system32\ntoskrnl.exe
2011-08-10 09:57:38 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe

======List of files/folders modified in the last 1 month======

2011-09-02 23:25:06 ----D---- C:\Program Files\trend micro
2011-09-02 23:25:05 ----D---- C:\Windows\Temp
2011-09-02 23:20:13 ----D---- C:\Users\rgcom\AppData\Roaming\Skype
2011-09-02 19:41:26 ----D---- C:\Users\rgcom\AppData\Roaming\Winamp
2011-09-02 19:24:05 ----D---- C:\Windows\Prefetch
2011-09-02 19:23:57 ----AD---- C:\Windows
2011-09-02 16:07:10 ----D---- C:\Users\rgcom\AppData\Roaming\skypePM
2011-09-02 14:53:04 ----D---- C:\Windows\system32\config
2011-09-02 14:45:09 ----D---- C:\Program Files (x86)\RelevantKnowledge
2011-08-30 20:01:16 ----SHD---- C:\System Volume Information
2011-08-28 23:51:05 ----D---- C:\Users\rgcom\AppData\Roaming\Media Player Classic
2011-08-28 22:38:25 ----D---- C:\Windows\System32
2011-08-28 22:38:25 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-08-28 22:38:23 ----D---- C:\Windows\inf
2011-08-28 21:47:56 ----RD---- C:\Program Files (x86)
2011-08-27 08:08:15 ----HD---- C:\ProgramData
2011-08-24 16:49:37 ----SHD---- C:\Windows\Installer
2011-08-24 16:07:52 ----D---- C:\Windows\winsxs
2011-08-24 16:07:33 ----D---- C:\Windows\SYSWOW64\sk-SK
2011-08-24 16:07:33 ----D---- C:\Windows\SysWOW64
2011-08-24 16:07:33 ----D---- C:\Windows\system32\sk-SK
2011-08-23 21:28:02 ----D---- C:\Windows\system32\catroot
2011-08-23 21:28:01 ----D---- C:\Windows\system32\catroot2
2011-08-12 20:02:14 ----HD---- C:\Program Files (x86)\Temp
2011-08-12 20:00:31 ----D---- C:\Windows\system32\drivers
2011-08-12 20:00:29 ----D---- C:\Windows\system32\DriverStore
2011-08-11 17:14:32 ----D---- C:\Windows\Microsoft.NET
2011-08-11 17:14:28 ----RSD---- C:\Windows\assembly
2011-08-11 11:01:52 ----D---- C:\Windows\debug
2011-08-10 22:08:56 ----D---- C:\Windows\SYSWOW64\migration
2011-08-10 22:08:56 ----D---- C:\Windows\AppPatch
2011-08-10 22:08:56 ----D---- C:\Program Files (x86)\Internet Explorer
2011-08-10 22:08:55 ----D---- C:\Windows\system32\migration
2011-08-10 22:08:55 ----D---- C:\Program Files\Internet Explorer
2011-08-10 18:40:18 ----D---- C:\ProgramData\Microsoft Help
2011-08-10 18:36:33 ----A---- C:\Windows\system32\MRT.exe
2011-08-08 15:36:20 ----D---- C:\Program Files (x86)\Nokia
2011-08-08 15:36:20 ----D---- C:\Program Files (x86)\Common Files
2011-08-08 15:34:31 ----D---- C:\Program Files (x86)\Crash Bandicoot

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2011-04-15 503352]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2011-05-10 31064]
R1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2011-05-10 600920]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2011-05-10 287576]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2011-05-10 53592]
R1 cmdGuard;COMODO Internet Security Sandbox Driver; C:\Windows\System32\DRIVERS\cmdguard.sys [2011-07-05 252344]
R1 cmdHlp;COMODO Internet Security Helper Driver; C:\Windows\System32\DRIVERS\cmdhlp.sys [2011-07-05 41712]
R1 inspect;COMODO Internet Security Firewall Driver; C:\Windows\system32\DRIVERS\inspect.sys [2011-07-05 92688]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2011-05-10 22360]
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2011-05-10 64344]
R3 AgereSoftModem;Agere Systems Soft Modem; C:\Windows\system32\DRIVERS\agrsm64.sys [2009-08-13 1209856]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athrx.sys [2010-03-31 2216960]
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2009-12-10 6179328]
R3 DKbFltr;Dritek Keyboard Filter Driver (64-bit); C:\Windows\SysWOW64\Drivers\DKbFltr.sys [2009-03-26 25608]
R3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\k57nd60a.sys [2010-03-15 384552]
R3 RTL8187;Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter; C:\Windows\system32\DRIVERS\rtl8187.sys [2008-06-27 399360]
R3 seehcri;Sony Ericsson seehcri Device Driver; C:\Windows\system32\DRIVERS\seehcri.sys [2008-01-09 34032]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv; \??\C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesDriver64.sys [2010-11-29 11856]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
S1 DritekPortIO;Dritek General Port I/O; \??\C:\Program Files (x86)\Launch Manager\DPortIO.sys []
S3 AF15BDA;AF9015 BDA Device; C:\Windows\system32\DRIVERS\AF15BDA.sys [2009-06-03 507392]
S3 BthEnum;Bluetooth Request Block Driver; C:\Windows\system32\drivers\BthEnum.sys [2009-07-14 41984]
S3 BthPan;Bluetooth Device (Personal Area Network); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
S3 BTHPORT;Bluetooth Port Driver; C:\Windows\System32\Drivers\BTHport.sys [2011-04-28 552960]
S3 BTHUSB;Bluetooth Radio USB Driver; C:\Windows\System32\Drivers\BTHUSB.sys [2011-04-28 80384]
S3 ezplay;VSO Software ezplay; C:\Windows\System32\Drivers\ezplay.sys [2010-12-29 118400]
S3 ggflt;SEMC USB Flash Driver Filter; C:\Windows\system32\DRIVERS\ggflt.sys [2010-10-31 13352]
S3 ggsemc;SEMC USB Flash Driver; C:\Windows\system32\DRIVERS\ggsemc.sys [2010-10-31 27176]
S3 grmnusb;Garmin USB Driver; C:\Windows\system32\drivers\grmnusb.sys [2009-05-08 20520]
S3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys []
S3 netr28ux;RT2870 USB Extensible Wireless LAN Card Driver; C:\Windows\system32\DRIVERS\netr28ux.sys [2010-05-26 1121632]
S3 nmwcd;Nokia USB Phone Parent Driver; C:\Windows\system32\drivers\ccdcmbx64.sys [2010-07-30 19456]
S3 nmwcdc;Nokia USB Communication Driver; C:\Windows\system32\drivers\ccdcmbox64.sys [2010-07-30 26624]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfdx64.sys [2008-08-28 25600]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 pcouffin;VSO Software pcouffin; C:\Windows\System32\Drivers\pcouffin.sys [2010-12-29 82816]
S3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader; C:\Windows\System32\Drivers\RtsUStor.sys [2010-06-17 246376]
S3 RTHDMIAzAudService;Service for HDMI; C:\Windows\system32\drivers\RtHDMIVX.sys []
S3 s1018bus;Sony Ericsson Device 1018 driver (WDM); C:\Windows\system32\DRIVERS\s1018bus.sys [2009-03-25 113704]
S3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter; C:\Windows\system32\DRIVERS\s1018mdfl.sys [2009-03-25 19496]
S3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver; C:\Windows\system32\DRIVERS\s1018mdm.sys [2009-03-25 153128]
S3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM); C:\Windows\system32\DRIVERS\s1018mgmt.sys [2009-03-25 133160]
S3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS); C:\Windows\system32\DRIVERS\s1018nd5.sys [2009-03-25 34856]
S3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface; C:\Windows\system32\DRIVERS\s1018obex.sys [2009-03-25 128552]
S3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM); C:\Windows\system32\DRIVERS\s1018unic.sys [2009-03-25 146472]
S3 TFsExDisk;TFsExDisk; \??\C:\Windows\System32\Drivers\TFsExDisk.sys [2010-06-14 16448]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
S3 upperdev;upperdev; C:\Windows\system32\DRIVERS\usbser_lowerfltx64.sys [2010-07-30 9216]
S3 usbscan;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 41984]
S3 usbser;USB Modem Driver; C:\Windows\system32\DRIVERS\usbser.sys [2010-11-20 32768]
S3 UsbserFilt;UsbserFilt; C:\Windows\system32\DRIVERS\usbser_lowerfltjx64.sys [2010-07-30 9216]
S3 VMnetAdapter;VMware Virtual Ethernet Adapter Driver; C:\Windows\system32\DRIVERS\vmnetadapter.sys []
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AgereModemAudio;Agere Modem Call Progress Audio; C:\Program Files\LSI SoftModem\agr64svc.exe [2009-03-28 16896]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2009-12-10 202752]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2011-05-10 42184]
R2 cmdAgent;COMODO Internet Security Helper Service; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [2011-07-05 2528096]
R2 M4-Service;M4-Service; C:\Users\rgcom\AppData\Roaming\Mikogo 4\M4-Service.exe [2011-08-04 1003888]
R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe [2008-09-29 935208]
R2 RelevantKnowledge;RelevantKnowledge; C:\Program Files (x86)\RelevantKnowledge\rlservice.exe [2011-03-03 107136]
R2 SBSDWSCService;SBSD Security Center Service; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
R2 SeaPort;SeaPort; C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2010-05-14 249136]
R2 TomTomHOMEService;TomTomHOMEService; C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe [2010-08-24 92008]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service; C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe [2010-12-14 2019648]
R2 UxTuneUp;@%SystemRoot%\System32\uxtuneup.dll,-4096; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2009-08-18 2291568]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-11-20 136176]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2011-06-04 655624]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-11-20 136176]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 ServiceLayer;ServiceLayer; C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe [2010-12-08 628736]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-10-14 1255736]

-----------------EOF-----------------

Re: pomale pc prosim o preventivku

Napsal: 02 zář 2011 22:33
od chodnik74
Dobrý večer :welcome:

:arrow: Stáhněte program RogueKiller
  • Spuste program
  • Stiskněte klávesu 2 a enter
  • Objeví se vám log a ten sem vložte
  • Stějně tak opakujte s volbou 3 a 4 a vložte logy

Program nepoužívejte bez doporučení Rádce a pozorně se řiďte následujících pokynu,protože program netoleruje chyby a může dojít k úplnému poškození systému!!
  • :arrow: Stáhneme si Combofix Obrázek
  • Program uložíme nejlépe na Plochu
  • Vypneme všechny rezidentní štíty.Jak antiviru,tak antispywaru a firewallu
  • Vypneme všechny běžící aplikace (ICQ,prohlížeč,programy) a necháme pouze Combofix
  • Spustíme Combofix.exe s administrátorským oprávněním
    U Windows XP se přihlásíme pod účtem správce
    Ve Windows 7 a Vista klikněte pravým tlačítkem myši na Combofix.exe a dejte ,,Spustit jako správce,,)
  • Hned po startu programu na vás vyskočí licenční podmínky,tak potvrdíme tlačítkemANO
  • Pokud vám Combofix nabídne instalaci Konzoly pro zotavení,tak souhlaste a nechte nainstalovat(zde je potřeba aktivní připojení na internet)
  • Pokračujte dle pokynů programu a během skenování na nic neklikejte,na pc nepracujte(ICQ,jiné aplikace,internet..).Nechte počítač v klidu.
  • Celý sken tvá mezi 5-15 min,ale pokud je v PC hodně havěti,tak se čas může lišit.
  • Po skončení skenování(případném restartu počítače) se vám zobrazí log z Combofixu,který mi vložte sem(Kdyby se log nezobrazil,tak jej najdete zde: C:\ComboFix.txt
  • (Pokud si nevíte rady s kterýmkoliv z výše uvedených kroků,tak se ptejte nebo mrkněte na detailnější návod včetně obrázků http://www.bleepingcomputer.com/combofi ... t-combofix )

Re: pomale pc prosim o preventivku

Napsal: 03 zář 2011 07:00
od RGCOM
RogueKiller V5.3.4 [08/30/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.sur-la-toile.com/discussion- ... ntees.html

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User: rgcom [Admin rights]
Mode: Remove -- Date : 09/03/2011 07:58:34

Bad processes: 2
[SUSP PATH] M4-Service.exe -- c:\users\rgcom\appdata\roaming\mikogo 4\m4-service.exe -> KILLED [TermProc]
[SUSP PATH] M4-Capture.exe -- c:\users\rgcom\appdata\roaming\mikogo 4\m4-capture.exe -> KILLED [TermProc]

Registry Entries: 4
[SUSP PATH] HKCU\[...]\Run : Badoo Desktop (C:\ProgramData\Badoo\Badoo Desktop\1.6.38.1042\Badoo.Desktop.exe) -> DELETED
[SUSP PATH] HKCU\[...]\Run : Mikogo ("C:\Users\rgcom\AppData\Roaming\Mikogo 4\mikogo-host.exe" -asp) -> DELETED
[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

Particular Files / Folders:

HOSTS File:


Finished : << RKreport[1].txt >>
RKreport[1].txt

Re: pomale pc prosim o preventivku

Napsal: 03 zář 2011 07:02
od RGCOM
RogueKiller V5.3.4 [08/30/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.sur-la-toile.com/discussion- ... ntees.html

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User: rgcom [Admin rights]
Mode: HOSTSFix -- Date : 09/03/2011 08:00:43

Bad processes: 0

HOSTS File:


Resetted HOSTS:
127.0.0.1 localhost

Finished : << RKreport[2].txt >>
RKreport[1].txt ; RKreport[2].txt

Re: pomale pc prosim o preventivku

Napsal: 03 zář 2011 07:03
od RGCOM
RogueKiller V5.3.4 [08/30/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.sur-la-toile.com/discussion- ... ntees.html

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User: rgcom [Admin rights]
Mode: ProxyFix -- Date : 09/03/2011 08:01:35

Bad processes: 0

Registry Entries: 0

Finished : << RKreport[3].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt

Re: pomale pc prosim o preventivku

Napsal: 03 zář 2011 07:11
od chodnik74
Pokračujte Combofixem :)

Re: pomale pc prosim o preventivku

Napsal: 03 zář 2011 08:13
od RGCOM
ComboFix 11-09-02.04 - rgcom . 09. 2011 8:32.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.421.1051.18.4091.3096 [GMT 2:00]
Running from: c:\users\rgcom\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
ADS - Windows: deleted 48 bytes in 1 streams.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\BSP DB Toolbar\tbHElper.dll
c:\program files (x86)\RelevantKnowledge
c:\program files (x86)\RelevantKnowledge\ncncf.dat
c:\program files (x86)\RelevantKnowledge\nscf.dat
c:\program files (x86)\RelevantKnowledge\rlls.dll
c:\program files (x86)\RelevantKnowledge\rlls64.dll
c:\program files (x86)\RelevantKnowledge\rloci.bin
c:\program files (x86)\RelevantKnowledge\rlservice.exe
c:\program files (x86)\RelevantKnowledge\rlvknlg.exe
c:\program files (x86)\RelevantKnowledge\rlvknlg64.exe
c:\programdata\hpe5464.dll
c:\programdata\hpeB2FC.dll
c:\programdata\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge
c:\programdata\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge\About RelevantKnowledge.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge\Privacy Policy and User License Agreement.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge\Support.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge\Uninstall Instructions.lnk
c:\users\Public\Favorites\Favorites.event
c:\users\rgcom\AppData\Local\TempDIR
c:\users\rgcom\AppData\Local\TempDIR\BetterInstaller.exe
c:\users\rgcom\AppData\Roaming\inst.exe
c:\users\rgcom\AppData\Roaming\Microsoft\Windows\Recent\desktop_82108171.ico
c:\users\rgcom\AppData\Roaming\Microsoft\Windows\Recent\FreeWallpapersDesktop.url
c:\users\rgcom\AppData\Roaming\Microsoft\Windows\Recent\Iobit.url
c:\users\rgcom\AppData\Roaming\Microsoft\Windows\Recent\Recent.event
c:\users\rgcom\Favorites\Favorites.event
c:\windows\SysWow64\comct332.ocx
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_RelevantKnowledge
.
.
((((((((((((((((((((((((( Files Created from 2011-08-03 to 2011-09-03 )))))))))))))))))))))))))))))))
.
.
2011-09-03 06:41 . 2011-09-03 06:41 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-09-02 12:42 . 2011-08-12 04:10 8862544 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{5DF7416D-5696-4C79-B7A9-1451ED0C2C3B}\mpengine.dll
2011-08-28 19:47 . 2011-08-28 19:47 -------- d-----w- c:\program files (x86)\ESET
2011-08-28 19:37 . 2011-08-28 19:41 -------- d-----w- c:\users\rgcom\AppData\Roaming\Mikogo 4
2011-08-28 16:25 . 2011-09-03 06:40 -------- d-----w- c:\program files (x86)\BSP DB Toolbar
2011-08-27 06:08 . 2011-08-27 06:08 -------- d-----w- c:\programdata\Comodo Downloader
2011-08-24 14:49 . 2011-08-24 14:49 -------- d-----w- c:\programdata\Badoo
2011-08-23 19:30 . 2011-07-09 05:26 2048 ----a-w- c:\windows\system32\tzres.dll
2011-08-23 19:30 . 2011-07-09 04:29 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2011-08-10 16:26 . 2011-07-22 05:32 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2011-08-10 16:26 . 2011-07-22 02:44 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb
2011-08-10 16:26 . 2011-07-22 05:55 174384 ----a-w- c:\program files\Internet Explorer\sqmapi.dll
2011-08-10 16:26 . 2011-07-22 03:00 141104 ----a-w- c:\program files (x86)\Internet Explorer\sqmapi.dll
2011-08-10 16:26 . 2011-07-22 05:34 304640 ----a-w- c:\program files\Internet Explorer\IEShims.dll
2011-08-10 16:26 . 2011-07-22 02:46 194048 ----a-w- c:\program files (x86)\Internet Explorer\IEShims.dll
2011-08-10 07:57 . 2011-07-16 05:41 362496 ----a-w- c:\windows\system32\wow64win.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-16 04:26 . 2011-08-10 07:58 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2011-07-14 20:00 . 2011-05-17 16:49 403616 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-06-17 18:32 . 2011-06-17 18:32 0 ---ha-w- c:\users\rgcom\AppData\Local\BITF7A7.tmp
2011-06-11 03:07 . 2011-07-13 17:03 3137536 ----a-w- c:\windows\system32\win32k.sys
2011-06-05 15:42 . 2011-06-05 10:12 952 --sha-w- c:\programdata\KGyGaAvL.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
c:\users\rgcom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Startup.event [2011-6-5 0]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"WinampAgent"="c:\program files (x86)\Winamp\winampa.exe"
"HP Software Update"=c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Služba Google Update (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-11-20 136176]
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys [x]
R3 gupdatem;Služba Google Update (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-11-20 136176]
R3 netr28ux;RT2870 USB Extensible Wireless LAN Card Driver;c:\windows\system32\DRIVERS\netr28ux.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 s1018bus;Sony Ericsson Device 1018 driver (WDM);c:\windows\system32\DRIVERS\s1018bus.sys [x]
R3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s1018mdfl.sys [x]
R3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s1018mdm.sys [x]
R3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s1018mgmt.sys [x]
R3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS);c:\windows\system32\DRIVERS\s1018nd5.sys [x]
R3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s1018obex.sys [x]
R3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM);c:\windows\system32\DRIVERS\s1018unic.sys [x]
R3 TFsExDisk;TFsExDisk;c:\windows\System32\Drivers\TFsExDisk.sys [2010-06-14 16448]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Služba Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [x]
S2 M4-Service;M4-Service;c:\users\rgcom\AppData\Roaming\Mikogo 4\M4-Service.exe [2011-08-04 1003888]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S2 TomTomHOMEService;TomTomHOMEService;c:\program files (x86)\TomTom HOME 2\TomTomHOMEService.exe [2010-08-24 92008]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe [2010-12-14 2019648]
S3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [x]
S3 RTL8187;Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\rtl8187.sys [x]
S3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\DRIVERS\seehcri.sys [x]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesDriver64.sys [2010-11-29 11856]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
Contents of the 'Scheduled Tasks' folder
.
2011-09-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-20 13:03]
.
2011-09-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-20 13:03]
.
2011-09-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3510052006-2587695730-3173378556-1000Core.job
- c:\users\rgcom\AppData\Local\Google\Update\GoogleUpdate.exe [2011-01-23 13:03]
.
2011-09-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3510052006-2587695730-3173378556-1000UA.job
- c:\users\rgcom\AppData\Local\Google\Update\GoogleUpdate.exe [2011-01-23 13:03]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-05-10 12:10 134384 ----a-w- c:\program files\Alwil Software\Avast5\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"combofix"="c:\combofix\CF27255.3XE" [2010-11-20 345088]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x1
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.bigseekpro.com/bsprpc/{E5EC6DC4-AC2 ... 59285084BF}
mStart Page = hxxp://www.bigseekpro.com/bsprpc/{E5EC6DC4-AC2 ... 59285084BF}
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovať do programu Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 195.130.131.4 195.130.130.132
FF - ProfilePath - c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2405280&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://www.bigseekpro.com/bsprpc/{E5EC6DC4-AC2 ... 59285084BF}
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
FF - Ext: Conduit Engine : engine@conduit.com - %profile%\extensions\engine@conduit.com
FF - Ext: samfind Bookmarks Bar: sam@samfind.com - %profile%\extensions\sam@samfind.com
FF - Ext: Softonic-Eng7 Community Toolbar: {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - %profile%\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}
FF - Ext: Greasemonkey: {e4a8a97b-f2ed-450b-b12d-ee082ba24781} - %profile%\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
FF - Ext: BSPDB Toolbar: {75656794-AB59-4712-BFBC-5D816D56F3BC} - %profile%\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{dfabc5b5-039b-4865-979a-de31cdf3e351} - (no file)
URLSearchHooks-{09ec805c-cb2e-4d53-b0d3-a75a428b81c7} - (no file)
URLSearchHooks-{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - (no file)
WebBrowser-{DFABC5B5-039B-4865-979A-DE31CDF3E351} - (no file)
WebBrowser-{414B6D9D-4A95-4E8D-B5B1-149DD2D93BB3} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
AddRemove-{d08d9f98-1c78-4704-87e6-368b0023d831} - c:\program files (x86)\RelevantKnowledge\rlvknlg.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10s_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10s_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10s.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10s.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10s.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10s.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0009\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
c:\users\rgcom\AppData\Roaming\Mikogo 4\M4-Capture.exe
c:\program files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
.
**************************************************************************
.
Completion time: 2011-09-03 08:52:53 - machine was rebooted
ComboFix-quarantined-files.txt 2011-09-03 06:52
.
Pre-Run: 69 513 281 536 bytes free
Post-Run: 68 737 613 824 bytes free
.
- - End Of File - - 411D8C5ABB23037D5A5C2F37918EBE22

Re: pomale pc prosim o preventivku

Napsal: 03 zář 2011 08:31
od chodnik74
:arrow: Odinstalujte conduit engine,Spybot - Search & Destroy a všechny nepotřebné toolbary,poté pokračujte dále..


:arrow: Otevřeme si Poznámkový blok Obrázek
  • (stiskneme klávesovou kombinaci WIN+R a napíšeme ,,notepad,, bez úvozovek a dáme enter)
  • Vložíme do něj následující script:

    Kód: Vybrat vše

    
KillAll::

Registry::
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"=-
"Adobe Reader Speed Launcher"=-
"Adobe ARM"=-
"WinampAgent"=-
"HP Software Update"=-

Driver::
gupdate
gupdatem
M4-Service

Folder::
c:\users\rgcom\AppData\Roaming\Mikogo 4\

File::
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3510052006-2587695730-3173378556-1000Core.job
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3510052006-2587695730-3173378556-1000UA.job

DDS::
uStart Page = hxxp://www.bigseekpro.com/bsprpc/{E5EC6DC4-AC23-433D-AA9C-9759285084BF}
mStart Page = hxxp://www.bigseekpro.com/bsprpc/{E5EC6DC4-AC23-433D-AA9C-9759285084BF}

Firefox::
FF - ProfilePath - c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.as ... ource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://www.bigseekpro.com/bsprpc/{E5EC6DC4-AC23-433D-AA9C-9759285084BF}
FF - Ext: Conduit Engine : engine@conduit.com - %profile%\extensions\engine@conduit.com
FF - Ext: BSPDB Toolbar: {75656794-AB59-4712-BFBC-5D816D56F3BC} - %profile%\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}

RegLock::
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0009\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

Reboot::
  • Soubor uložíme na Plochu jako CFScript.txt
  • Poté tento soubor uchopíme levým tlačítkem myši a přetáhneme na ikonu Combofixu a upustíme

    Obrázek
  • Poté Combofix provede všechny operace a udělá nový log,který sem vložte

Re: pomale pc prosim o preventivku

Napsal: 03 zář 2011 11:30
od RGCOM
ComboFix 11-09-02.04 - rgcom . 09. 2011 12:03:33.2.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.421.1051.18.4091.1017 [GMT 2:00]
Running from: c:\users\rgcom\Desktop\ComboFix.exe
Command switches used :: c:\users\rgcom\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
"c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3510052006-2587695730-3173378556-1000Core.job"
"c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3510052006-2587695730-3173378556-1000UA.job"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\rgcom\AppData\Roaming\Mikogo 4
c:\users\rgcom\AppData\Roaming\Mikogo 4\config.ini
c:\users\rgcom\AppData\Roaming\Mikogo 4\connections.ini
c:\users\rgcom\AppData\Roaming\Mikogo 4\M4-Capture.exe
c:\users\rgcom\AppData\Roaming\Mikogo 4\M4-Service.exe
c:\users\rgcom\AppData\Roaming\Mikogo 4\mikogo-host.exe
c:\users\rgcom\AppData\Roaming\Mikogo 4\remover.exe
c:\users\rgcom\AppData\Roaming\Mikogo 4\sessionplayer.exe
c:\users\rgcom\AppData\Roaming\Mikogo 4\Stopper.exe
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome.manifest
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\1.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\10.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\11.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\12.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\13.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\14.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\15.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\16.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\17.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\18.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\19.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\2.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\20.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\21.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\22.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\23.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\24.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\25.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\26.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\27.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\28.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\29.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\3.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\30.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\31.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\32.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\33.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\34.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\35.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\36.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\37.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\38.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\39.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\4.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\40.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\41.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\42.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\43.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\44.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\45.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\46.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\47.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\48.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\49.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\5.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\50.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\51.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\52.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\53.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\54.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\55.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\56.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\57.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\6.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\7.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\8.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\9.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\affid.dat
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\basis.xml
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\bubble.js
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\bubble.xul
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\colorpicker.htm
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\contents.rdf
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\icons.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\info.txt
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\jscontainer.htm
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\mbback.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\mbbigopen.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\mbclose.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\mbfwd.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\mbsep.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\md5.js
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\mozilla.xul
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\mymenuitem.xml
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\nav1c.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\options.js
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\options.xul
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\separator.png
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\tb.css
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\tb.js
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\tb.xsl
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\tb.xul
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\tbcore3.inf
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\version.txt
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\install.rdf
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\engine@conduit.com
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\engine@conduit.com\components\components.event
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\engine@conduit.com\components\ConduitAutoCompleteSearch.js
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\engine@conduit.com\components\ConduitAutoCompleteSearch.xpt
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\engine@conduit.com\components\ConduitToolbar.idl
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\engine@conduit.com\components\ConduitToolbar.js
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\engine@conduit.com\components\ConduitToolbar.xpt
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\engine@conduit.com\components\RadioWMPCore.dll
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\engine@conduit.com\components\RadioWMPCore.xpt
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\engine@conduit.com\components\RadioWMPCoreGecko19.dll
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\engine@conduit.com\defaults\alertSettingsComponent.xml
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\engine@conduit.com\defaults\appContextMenu.xml
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\engine@conduit.com\defaults\defaults.event
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\engine@conduit.com\defaults\engineContextMenu.xml
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\engine@conduit.com\defaults\engineSettings.json
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\engine@conduit.com\defaults\fbAlert.js
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\engine@conduit.com\defaults\getAppsContextMenu.xml
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\engine@conduit.com\defaults\postAppsContextMenu.xml
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\engine@conduit.com\defaults\toolbarContextMenu.xml
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\engine@conduit.com\defaults\unsharedAppsContextMenu.xml
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\engine@conduit.com\DualPackage\DualPackage.event
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\engine@conduit.com\DualPackage\install.rdf
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\engine@conduit.com\engine@conduit.com.event
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\engine@conduit.com\chrome.manifest
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\engine@conduit.com\chrome\conduitengine.jar
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\engine@conduit.com\chrome\chrome.event
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\engine@conduit.com\install.rdf
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\engine@conduit.com\lib\lib.event
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\engine@conduit.com\lib\xpcom.js
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\engine@conduit.com\META-INF\manifest.mf
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\engine@conduit.com\META-INF\META-INF.event
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\engine@conduit.com\META-INF\zigbert.rsa
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\engine@conduit.com\META-INF\zigbert.sf
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\engine@conduit.com\searchplugin\conduit.gif
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\engine@conduit.com\searchplugin\conduit.ico
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\engine@conduit.com\searchplugin\conduit.PNG
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\engine@conduit.com\searchplugin\conduit.src
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\engine@conduit.com\searchplugin\conduit.xml
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\engine@conduit.com\searchplugin\searchplugin.event
c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\extensions\engine@conduit.com\version.txt
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3510052006-2587695730-3173378556-1000Core.job
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3510052006-2587695730-3173378556-1000UA.job
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_gupdate
-------\Service_gupdatem
-------\Service_M4-Service
.
.
((((((((((((((((((((((((( Files Created from 2011-08-03 to 2011-09-03 )))))))))))))))))))))))))))))))
.
.
2011-09-03 10:12 . 2011-09-03 10:12 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-09-02 12:42 . 2011-08-12 04:10 8862544 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{5DF7416D-5696-4C79-B7A9-1451ED0C2C3B}\mpengine.dll
2011-08-28 19:47 . 2011-08-28 19:47 -------- d-----w- c:\program files (x86)\ESET
2011-08-28 16:25 . 2011-09-03 06:40 -------- d-----w- c:\program files (x86)\BSP DB Toolbar
2011-08-27 06:08 . 2011-08-27 06:08 -------- d-----w- c:\programdata\Comodo Downloader
2011-08-24 14:49 . 2011-08-24 14:49 -------- d-----w- c:\programdata\Badoo
2011-08-23 19:30 . 2011-07-09 05:26 2048 ----a-w- c:\windows\system32\tzres.dll
2011-08-23 19:30 . 2011-07-09 04:29 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2011-08-10 16:26 . 2011-07-22 05:32 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2011-08-10 16:26 . 2011-07-22 02:44 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb
2011-08-10 16:26 . 2011-07-22 05:55 174384 ----a-w- c:\program files\Internet Explorer\sqmapi.dll
2011-08-10 16:26 . 2011-07-22 03:00 141104 ----a-w- c:\program files (x86)\Internet Explorer\sqmapi.dll
2011-08-10 16:26 . 2011-07-22 05:34 304640 ----a-w- c:\program files\Internet Explorer\IEShims.dll
2011-08-10 16:26 . 2011-07-22 02:46 194048 ----a-w- c:\program files (x86)\Internet Explorer\IEShims.dll
2011-08-10 07:57 . 2011-07-16 05:41 362496 ----a-w- c:\windows\system32\wow64win.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-16 04:26 . 2011-08-10 07:58 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2011-07-14 20:00 . 2011-05-17 16:49 403616 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-06-17 18:32 . 2011-06-17 18:32 0 ---ha-w- c:\users\rgcom\AppData\Local\BITF7A7.tmp
2011-06-11 03:07 . 2011-07-13 17:03 3137536 ----a-w- c:\windows\system32\win32k.sys
2011-06-05 15:42 . 2011-06-05 10:12 952 --sha-w- c:\programdata\KGyGaAvL.sys
.
.
((((((((((((((((((((((((((((( SnapShot@2011-09-03_06.46.51 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-07-14 04:54 . 2011-09-03 06:34 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54 . 2011-09-03 07:12 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54 . 2011-09-03 07:12 49152 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2011-09-03 06:34 49152 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2011-09-03 06:34 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2011-09-03 07:12 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-10-13 16:38 . 2011-09-03 07:12 53472 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2011-09-03 07:12 44994 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
- 2009-07-14 05:10 . 2011-09-03 06:47 44994 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2010-10-13 16:38 . 2011-09-03 07:12 19844 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3510052006-2587695730-3173378556-1000_UserData.bin
+ 2010-10-13 16:31 . 2011-09-03 08:47 32768 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-10-13 16:31 . 2011-09-03 06:34 32768 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-10-13 16:31 . 2011-09-03 06:34 49152 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-10-13 16:31 . 2011-09-03 08:47 49152 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2011-09-03 08:47 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:54 . 2011-09-03 06:34 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-09-03 10:14 . 2011-09-03 10:14 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-09-03 06:45 . 2011-09-03 06:45 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-09-03 06:45 . 2011-09-03 06:45 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-09-03 10:14 . 2011-09-03 10:14 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-01-11 18:43 . 2011-09-03 07:06 262144 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
- 2011-01-11 18:43 . 2011-09-03 06:32 262144 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2009-07-14 05:01 . 2011-09-03 10:13 391628 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2009-07-14 05:01 . 2011-09-03 06:41 391628 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
c:\users\rgcom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Startup.event [2011-6-5 0]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys [x]
R3 netr28ux;RT2870 USB Extensible Wireless LAN Card Driver;c:\windows\system32\DRIVERS\netr28ux.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 s1018bus;Sony Ericsson Device 1018 driver (WDM);c:\windows\system32\DRIVERS\s1018bus.sys [x]
R3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s1018mdfl.sys [x]
R3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s1018mdm.sys [x]
R3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s1018mgmt.sys [x]
R3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS);c:\windows\system32\DRIVERS\s1018nd5.sys [x]
R3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s1018obex.sys [x]
R3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM);c:\windows\system32\DRIVERS\s1018unic.sys [x]
R3 TFsExDisk;TFsExDisk;c:\windows\System32\Drivers\TFsExDisk.sys [2010-06-14 16448]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Služba Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [x]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S2 TomTomHOMEService;TomTomHOMEService;c:\program files (x86)\TomTom HOME 2\TomTomHOMEService.exe [2010-08-24 92008]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe [2010-12-14 2019648]
S3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [x]
S3 RTL8187;Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\rtl8187.sys [x]
S3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\DRIVERS\seehcri.sys [x]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesDriver64.sys [2010-11-29 11856]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-05-10 12:10 134384 ----a-w- c:\program files\Alwil Software\Avast5\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"combofix"="c:\combofix\CF3127.3XE" [2010-11-20 345088]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovať do programu Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 195.130.131.4 195.130.130.132
FF - ProfilePath - c:\users\rgcom\AppData\Roaming\Mozilla\Firefox\Profiles\z1jhtgaf.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
FF - Ext: samfind Bookmarks Bar: sam@samfind.com - %profile%\extensions\sam@samfind.com
FF - Ext: Softonic-Eng7 Community Toolbar: {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - %profile%\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}
FF - Ext: Greasemonkey: {e4a8a97b-f2ed-450b-b12d-ee082ba24781} - %profile%\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
- - - - ORPHANS REMOVED - - - -
.
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
AddRemove-Mikogo 4 - c:\users\rgcom\AppData\Roaming\Mikogo 4\remover.exe
.
.
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
c:\program files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files (x86)\Google\Update\GoogleUpdate.exe
.
**************************************************************************
.
Completion time: 2011-09-03 12:20:36 - machine was rebooted
ComboFix-quarantined-files.txt 2011-09-03 10:20
ComboFix2.txt 2011-09-03 06:52
.
Pre-Run: 64 608 477 184 bytes free
Post-Run: 64 336 928 768 bytes free
.
- - End Of File - - DFDD96641F96F8F2463F660648435ACF

Re: pomale pc prosim o preventivku

Napsal: 04 zář 2011 15:43
od chodnik74
Výborně :)

:arrow: Stiskněte klávesovou kombinaci WIN+R( nebo start-spustit ),čímž se vám otevře okno pro zadání příkazu pro spuštění a zkopírujte a vložte sem následujíci text: Combofix /Uninstall a dejte enter

:arrow: ObrázekT-Cleaner
  • Spustíme,zmáčkneme klávesu A a potvrdíme ENTER(některé antiviry mohou detekovat utilitu jako vir-jedá se o falešný poplach,proto IGNOROVAT nebo dočasně vypnout antivir )
  • po použití T-Cleaner smažte ;-)


:arrow: Obrázek TFC
  • Stáhneme a spustíme program
  • Klikneme na Start a potvrdíme OK
  • Program začne uklízet,poté restartuje pc
  • po použití program smažte

:arrow: Malwarebytes' Anti-Malware Obrázek
  • Stáhneme,nainstalujeme a spustíme(pokud si nevíte rady jak,klikněte ZDE)
  • Vybereme Úplná kontrola a klikneme na tlačítko ProhledatObrázek
  • Program provede kontrolu počítače a na konci se vám objeví hláska,že bylo skenování dokončeno,tak potvrdíme tlačítkem OK
  • Objeví se vám log,který mi sem vložte
  • NIC NEMAZAT!!Program mívá občas falešné detekce,takže mazat budeme až po konzultaci :twisted:

Re: pomale pc prosim o preventivku

Napsal: 04 zář 2011 18:51
od RGCOM
Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org

Verzia databázy: 7650

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

4. 9. 2011 18:03:47
mbam-log-2011-09-04 (18-03-47).txt

Typ kontroly: Rýchla kontrola
Objektov kontrolovaných: 175275
Uplynutý čas: 2 min, 57 sek

Infikované služby pamäte: 0
Infikované moduly pamäte: 0
Infikované registračné kľúče: 1
Infikované registračné hodnoty: 0
Infikované položky registračných dát: 0
Infikované priečinky: 0
Infikované súbory: 0

Infikované služby pamäte:
(Škodlivé položky neboli zistené)

Infikované moduly pamäte:
(Škodlivé položky neboli zistené)

Infikované registračné kľúče:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831} (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.

Infikované registračné hodnoty:
(Škodlivé položky neboli zistené)

Infikované položky registračných dát:
(Škodlivé položky neboli zistené)

Infikované priečinky:
(Škodlivé položky neboli zistené)

Infikované súbory:
(Škodlivé položky neboli zistené)

Re: pomale pc prosim o preventivku

Napsal: 04 zář 2011 18:51
od RGCOM
Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org

Verzia databázy: 7650

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

4. 9. 2011 18:03:47
mbam-log-2011-09-04 (18-03-47).txt

Typ kontroly: Rýchla kontrola
Objektov kontrolovaných: 175275
Uplynutý čas: 2 min, 57 sek

Infikované služby pamäte: 0
Infikované moduly pamäte: 0
Infikované registračné kľúče: 1
Infikované registračné hodnoty: 0
Infikované položky registračných dát: 0
Infikované priečinky: 0
Infikované súbory: 0

Infikované služby pamäte:
(Škodlivé položky neboli zistené)

Infikované moduly pamäte:
(Škodlivé položky neboli zistené)

Infikované registračné kľúče:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831} (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.

Infikované registračné hodnoty:
(Škodlivé položky neboli zistené)

Infikované položky registračných dát:
(Škodlivé položky neboli zistené)

Infikované priečinky:
(Škodlivé položky neboli zistené)

Infikované súbory:
(Škodlivé položky neboli zistené)

Re: pomale pc prosim o preventivku

Napsal: 04 zář 2011 19:02
od chodnik74
:arrow: Odinstalujte Malwarebytes :)

:arrow: Obrázek TFC
  • Stáhneme a spustíme program
  • Klikneme na Start a potvrdíme OK
  • Program začne uklízet,poté restartuje pc
  • po použití program smažte

Údržba PC:

1)Čištění dočasných složek + neplatné registry
:arrow: ObrázekCcleaner
  • Stáhneme a nainstalujeme program
  • Spustíme program
  • ČISTIČ
    Windows zde necháme vše jak je (pokud používáme IE,tak odškrkneme jeho položky) a zaškrkneme položky Start Menu zástupci a Zástupci na ploše
    Aplikace - necháme jak je,ale pokud používáme nějaký prohlížeč (Google chrome,Firefox,Opera..) tak odškrkneme jeho položky
    >Stiskeneme tlačítko Analyzovat a poté Spustit Cleaner
  • Registry
    >Stiskneme tlačítko Hledej problémy,program začne hledat neplatné registry..podé zvolíme Opravit vybrané problémy..
    >Program se zeptá,zda chceme vytvořit zálohu registrů,zvolíme ano a uložíme si někde zálohu(kdyby byli po opravení registru s něčím problémy,tak zálohu obnovíme tak,že spustíme uloženou zálohu a potvrdíme ano),dále zvolíme Opravit všechny problémy a Zavřít
    >opakujte dokud nebude registr bez problémů
  • Program používáme 1x 14dní (záleží na používání pc,můžeme i jednou týdně)
2)Defragmentace disku
:arrow: ObrázekDefraggler
  • Stáhneme a nainstalujeme program
  • Spustíme program
  • Vybereme disk ( C:,D:..prostě který používáme)
  • Pokud je ve sloupci Fragmentace více než 5% dejte Defragmentovat
  • Proveďte se všemi používanými disky
  • Provádíme 1x za měsíc
3)Aktualizace programů
:arrow: ObrázekFileHippo.com Update Checker
  • Stáhneme a nainstalujeme program(Při instalaci odškrkneme volbu Run at Startup )
  • Spustíme program
  • Program vyhledá nainstalované programy v PC a zjistí dostupné aktualizace
  • Poté se vám otevře internetová stránka,kde budou nabídnuté aplikace k aktualizování
    >X Updates Detected..to jsou dostupné aktualizace..
    > klikneme na zelenou šipečku a stáhneme program,poté nainstalujeme jeho aktuální verzi
    > :!: X Beta Updates Detected..tyto aktualizace nestahujte,jedná se o betaverze,které jsou ve vývoji a jsou nestabilní :)
  • Provádíme 1x za 14 dní nebo jednou za měsíc
:arrow: Jak se chová PC :???: + nový RSIT
Všechny časy jsou v UTC+01:00
Stránka 1 z 1

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz