Prosim o kontrolu Logu - PC nepracuje spravne.

kanister · Příspěvekod **kanister** » 30 bře 2011 04:09

Dobry den,

prosim o pomoc, PC nepracuje spravne. Nabiha silene dlouho & obecne je vice vytizene nez bylo v minulosti + uz mi zacinaji vyskakovat ruzne hlasky typu certifikat & outbound traffic. Mam ESET antivirus a ten nic nenasel ale presto mam "tusaka".

Dekuji!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:07:18, on 30.3.2011
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16722)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\Steam\Steam.exe
C:\Program Files (x86)\MagicTune Premium\GammaTray.exe
C:\Program Files (x86)\Java\jre6\bin\jusched.exe
C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe
C:\Program Files (x86)\Sony\Marketing Tools\MarketingTools.exe
C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Razer\DeathAdder\razerofa.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Users\Kanister_2\Documents\===PC===\Programs\HiJackThis\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.cz/ig
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Pomocník pro přihlášení ke službě Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ISBMgr.exe] "C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [MarketingTools] C:\Program Files (x86)\Sony\Marketing Tools\MarketingTools.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files (x86)\Winamp\winampa.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [DeathAdder] C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe
O4 - HKLM\..\Run: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Steam] "C:\Program Files (x86)\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe
O4 - Startup: Sticky Notes.lnk = ?
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: GammaTray.lnk = ?
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: Odeslat obrázek do zařízení &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Odeslat stránku do zařízení &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Send To Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: Send to &Bluetooth Device... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Absolute Poker - {1FBA04EE-3024-11d2-8F1F-0000F87ABD16} - C:\Users\Kanister_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Absolute Poker - {1FBA04EE-3024-11d2-8F1F-0000F87ABD16} - C:\Users\Kanister_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk (file missing) (HKCU)
O13 - Gopher Prefix:
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: FLEXnet Licensing Service 64 - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: MagicTuneEngine - Unknown owner - C:\Program Files (x86)\MagicTune Premium\MagicTuneEngine.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: PostgreSQL Database Server 8.3 (pgsql-8.3) - PostgreSQL Global Development Group - C:\Program Files (x86)\PostgreSQL\8.3\bin\pg_ctl.exe
O23 - Service: PostgreSQL Server 8.4 (postgresql-8.4) - PostgreSQL Global Development Group - C:/Program Files (x86)/PostgreSQL/8.4/bin/pg_ctl.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Roxio UPnP Renderer 10 - Sonic Solutions - C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe
O23 - Service: Roxio Upnp Server 10 - Sonic Solutions - C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: Realtek Audio Service (RtkAudioService) - Realtek Semiconductor - C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: VAIO Media plus Content Importer (SOHCImp) - Sony Corporation - C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe
O23 - Service: VAIO Media plus Database Manager (SOHDBSvr) - Sony Corporation - C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe
O23 - Service: VAIO Media plus Digital Media Server (SOHDms) - Sony Corporation - C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe
O23 - Service: VAIO Media plus Device Searcher (SOHDs) - Sony Corporation - C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe
O23 - Service: VAIO Media plus Playlist Manager (SOHPlMgr) - Sony Corporation - C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: TeamViewer 5 (TeamViewer5) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Service.exe
O23 - Service: CamMonitor (uCamMonitor) - ArcSoft, Inc. - C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe
O23 - Service: VAIO Power Management - Sony Corporation - C:\Program Files\Sony\VAIO Power Management\SPMService.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: VAIO Content Folder Watcher (VCFw) - Sony Corporation - C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe
O23 - Service: VAIO Content Metadata Intelligent Analyzing Manager (VcmIAlzMgr) - Sony Corporation - C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
O23 - Service: VAIO Content Metadata Intelligent Network Service Manager (VcmINSMgr) - Sony Corporation - C:\Program Files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe
O23 - Service: VAIO Content Metadata XML Interface (VcmXmlIfHelper) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: VSNService - Sony Corporation - C:\Program Files\Sony\VAIO Smart Network\VSNService.exe
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 13602 bytes

Reklama

bledulka · Příspěvekod **bledulka** » 30 bře 2011 11:49

Ahoj,

Stáhni na plochu ComboFix - http://download.bleepingcomputer.com/sUBs/ComboFix.exe
- Před použitím vypni všechny rezidentní bezpečnostní programy - antiviry, firewally, antispywary
-Zavři všechna aktivní okna a spusť ho pod učtem s právy administrátora
- Po spuštění se zobrazí podmínky použití, potvrď je stiskem tlačítka Ano

- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna

- Po dokončení skenování, se vytvoří log C:\ComboFix.txt, zkopíruj celý jeho obsah sem.

kanister · Příspěvekod **kanister** » 30 bře 2011 15:07

Diky, da, vedet.

bledulka · Příspěvekod **bledulka** » 30 bře 2011 22:05

Pak sem vlož log.

kanister · Příspěvekod **kanister** » 05 dub 2011 10:50

ComboFix 11-04-04.02 - Kanister 05.04.2011 18:29:11.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7600.0.1250.420.1029.18.4063.2133 [GMT 10:00]
Spuštěný z: c:\users\Public\Documents\ComboFix.exe
AV: ESET Smart Security 4.0 *Disabled/Updated* {CB0F8167-5331-BA19-698E-64816B6801A5}
FW: ESET Personal firewall *Disabled* {F3340042-195E-BB41-42D1-CDB495BB46DE}
SP: ESET Smart Security 4.0 *Disabled/Updated* {706E6083-750B-B597-533E-5FF310EF4B18}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Kanister_2\AppData\Roaming\.#
c:\users\Kanister_2\AppData\Roaming\.#\MBX@910@3B2740.###
c:\users\Kanister_2\AppData\Roaming\.#\MBX@910@3B2770.###
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-03-05 do 2011-04-05 )))))))))))))))))))))))))))))))
.
.
2011-04-05 08:37 . 2011-04-05 08:37 -------- d-----w- c:\users\postgres\AppData\Local\temp
2011-04-05 08:37 . 2011-04-05 08:37 -------- d-----w- c:\users\postgres.Kanister-VAIO\AppData\Local\temp
2011-04-05 08:37 . 2011-04-05 08:37 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-04-04 04:56 . 2011-04-04 12:43 -------- d-----w- c:\users\Kanister_2\AppData\Roaming\Xfire
2011-04-04 04:56 . 2011-04-05 08:24 -------- d-----w- c:\users\Kanister\AppData\Roaming\Xfire
2011-04-04 04:56 . 2011-04-04 05:02 -------- d-----w- c:\programdata\Xfire
2011-04-04 04:56 . 2011-04-04 04:56 -------- d-----w- c:\program files (x86)\Xfire
2011-04-03 00:39 . 2011-04-03 00:50 -------- d-----w- c:\program files (x86)\Rise of Flight
2011-04-02 03:02 . 2011-03-15 05:17 8424784 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{E08CBCFA-A094-4F26-9130-E395466C591F}\mpengine.dll
2011-03-31 02:25 . 2011-03-31 03:13 -------- d-----w- C:\IL-2UP
2011-03-25 01:18 . 2011-03-25 01:18 -------- d-----w- c:\programdata\ALM
2011-03-25 00:57 . 2011-03-25 00:58 -------- d-----w- c:\windows\system32\drivers\etc\backup
2011-03-18 01:55 . 2011-04-04 15:56 -------- d-----w- c:\program files (x86)\TableNinja
2011-03-13 07:02 . 2011-03-13 07:03 -------- d-----w- C:\yu
2011-03-11 11:33 . 2011-03-11 11:33 36352 ----a-w- c:\windows\SysWow64\xfcodec.dll
2011-03-11 11:30 . 2011-03-11 11:30 22016 ----a-w- c:\windows\system32\xfcodec64.dll
2011-03-10 09:55 . 2011-03-10 09:55 -------- d-----w- c:\programdata\Solidshield
2011-03-10 09:55 . 2008-07-11 21:18 3851784 ----a-w- c:\windows\SysWow64\D3DX9_39.dll
2011-03-10 09:53 . 2011-04-02 15:09 -------- d-----w- c:\users\Kanister_2\AppData\Local\Wings of Prey
2011-03-10 09:48 . 2011-03-10 09:48 -------- d-----w- c:\users\Kanister_2\AppData\Local\WOP
2011-03-10 09:48 . 2011-03-10 09:48 -------- d-----w- c:\programdata\WOP
2011-03-10 01:02 . 2011-04-05 05:08 -------- d-----w- c:\program files (x86)\Steam
2011-03-10 01:02 . 2011-03-24 13:38 -------- d-----w- c:\program files (x86)\Common Files\Steam
2011-03-07 22:27 . 2011-03-07 22:27 -------- d-----w- c:\program files (x86)\Common Files\Skype
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-02-02 07:11 . 2009-11-25 12:25 270720 ------w- c:\windows\system32\MpSigStub.exe
2011-01-26 06:53 . 2011-02-10 03:53 982912 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2011-01-26 06:53 . 2011-02-10 03:53 265088 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2011-01-26 06:31 . 2011-02-10 03:53 144384 ----a-w- c:\windows\system32\cdd.dll
2011-01-07 08:07 . 2011-02-24 04:36 662528 ----a-w- c:\windows\system32\XpsPrint.dll
2011-01-07 08:07 . 2011-02-24 04:36 475648 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2011-01-07 08:06 . 2011-02-10 03:52 46080 ----a-w- c:\windows\system32\atmlib.dll
2011-01-07 07:31 . 2011-02-24 04:36 442880 ----a-w- c:\windows\SysWow64\XpsPrint.dll
2011-01-07 07:31 . 2011-02-24 04:36 288256 ----a-w- c:\windows\SysWow64\XpsGdiConverter.dll
2011-01-07 07:27 . 2011-02-10 03:52 34304 ----a-w- c:\windows\SysWow64\atmlib.dll
2011-01-07 05:49 . 2011-02-10 03:52 366080 ----a-w- c:\windows\system32\atmfd.dll
2011-01-07 05:33 . 2011-02-10 03:52 294400 ----a-w- c:\windows\SysWow64\atmfd.dll
2010-05-17 15:03 . 2010-05-16 01:22 706084 ----a-w- c:\program files (x86)\unins000.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-02-04 05:50 1197448 ----a-w- c:\program files (x86)\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2010-02-04 1197448]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files (x86)\Java\jre6\bin\jusched.exe" [2009-08-19 148888]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]
"ISBMgr.exe"="c:\program files (x86)\Sony\ISB Utility\ISBMgr.exe" [2009-05-26 317288]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-07-10 98304]
"MarketingTools"="c:\program files (x86)\Sony\Marketing Tools\MarketingTools.exe" [2009-09-06 26624]
"AdobeCS4ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"DeathAdder"="c:\program files (x86)\Razer\DeathAdder\razerhid.exe" [2007-09-07 159744]
"AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-21 406992]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2010-11-17 421160]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
.
c:\users\Kanister\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Xfire.lnk - c:\program files (x86)\Xfire\Xfire.exe [2011-3-11 3498496]
.
c:\users\Kanister_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Sticky Notes.lnk - c:\windows\system32\StikyNot.exe [2009-7-14 427520]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-7-2 1079584]
GammaTray.lnk - c:\program files (x86)\MagicTune Premium\GammaTray.exe [2010-12-8 36864]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2009-07-01 18:49 98304 ----a-w- c:\windows\System32\VESWinlogon.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer3"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-09-05 133104]
R2 pgsql-8.3;PostgreSQL Database Server 8.3;c:\program files (x86)\PostgreSQL\8.3\bin\pg_ctl.exe [2009-03-13 65536]
R2 Roxio Upnp Server 10;Roxio Upnp Server 10;c:\program files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe [2009-06-26 362992]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]
R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2009-11-27 1038088]
R3 Roxio UPnP Renderer 10;Roxio UPnP Renderer 10;c:\program files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [2009-06-26 313840]
R3 SOHCImp;VAIO Media plus Content Importer;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe [2009-07-27 120104]
R3 SOHDBSvr;VAIO Media plus Database Manager;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe [2009-07-27 70952]
R3 SOHDms;VAIO Media plus Digital Media Server;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe [2009-07-27 427304]
R3 SOHDs;VAIO Media plus Device Searcher;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe [2009-07-27 75048]
R3 SOHPlMgr;VAIO Media plus Playlist Manager;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe [2009-07-27 91432]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2009-06-26 468264]
R3 VcmINSMgr;VAIO Content Metadata Intelligent Network Service Manager;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [2009-06-26 357672]
R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [2009-06-18 110888]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 27136]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe [2009-09-11 735960]
S2 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [x]
S2 postgresql-8.4;PostgreSQL Server 8.4;C:/Program Files (x86)/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N postgresql-8.4 -D C:/Program Files (x86)/PostgreSQL/8.4/data -w [x]
S2 regi;regi;c:\windows\system32\drivers\regi.sys [x]
S2 RtkAudioService;Realtek Audio Service;c:\program files\Realtek\Audio\HDA\RtkAudioService64.exe [2009-07-24 189984]
S2 TeamViewer5;TeamViewer 5;c:\program files (x86)\TeamViewer\Version5\TeamViewer_Service.exe [2010-02-11 172328]
S2 uCamMonitor;CamMonitor;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [2008-09-18 104960]
S2 VAIO Power Management;VAIO Power Management;c:\program files\Sony\VAIO Power Management\SPMService.exe [2009-08-22 411496]
S2 VCFw;VAIO Content Folder Watcher;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [2009-07-22 642920]
S2 VSNService;VSNService;c:\program files\Sony\VAIO Smart Network\VSNService.exe [2009-08-13 522240]
S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys [x]
S3 DAdderFltr;DeathAdder Mouse;c:\windows\system32\drivers\dadder.sys [x]
S3 KeyScrambler;KeyScrambler;c:\windows\system32\drivers\keyscrambler.sys [x]
S3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [x]
S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\DRIVERS\SFEP.sys [x]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
Obsah adresáře 'Naplánované úlohy'
.
2011-04-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-09-05 23:39]
.
2011-04-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-09-05 23:39]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-05 186904]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-07-24 7938080]
"Skytel"="c:\program files\Realtek\Audio\HDA\Skytel.exe" [2009-07-24 1833504]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-19 171520]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-09-11 2716216]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-05 500208]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com/ig/redirectdomain ... &bmod=EU01
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Odeslat obrázek do zařízení &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Odeslat stránku do zařízení &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: 242756E647F6E66265562757 = 10.0.0.138
TCP: 5586562736963656026333 = 10.0.0.138
TCP: 94E6475627E65647 = 10.0.0.138
TCP: B604E69637475627 = 10.0.0.138
TCP: C4546554C4F534146454 = 10.0.0.138
FF - ProfilePath - c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Ask Toolbar: toolbar@ask.com - %profile%\extensions\toolbar@ask.com
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Wow6432Node-HKLM-Run-WinampAgent - c:\program files (x86)\Winamp\winampa.exe
SafeBoot-mcmscsvc
SafeBoot-MCODS
BHO-{F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - c:\program files (x86)\Hotspot Shield\hssie\HssIE_64.dll
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKLM-Run-Apoint - %ProgramFiles%\Apoint\Apoint.exe
AddRemove-{FD6D6470-152B-11DE-41BB-045169885AF1} - c:\program files (x86)\1C Company\Men of War\Uninst_Men of War_CZ_1.11.3_patch.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\postgresql-8.4]
"ImagePath"="C:/Program Files (x86)/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N \"postgresql-8.4\" -D \"C:/Program Files (x86)/PostgreSQL/8.4/data\" -w"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\postgresql-8.4]
"ImagePath"="C:/Program Files (x86)/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N \"postgresql-8.4\" -D \"C:/Program Files (x86)/PostgreSQL/8.4/data\" -w"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-594707659-3842835383-1869680338-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:c2,de,7d,3f,20,81,d2,b4,1a,08,95,48,74,1f,7f,84,81,61,d3,76,23,c3,99,
18,4d,7b,e6,e8,ac,51,0c,6e,cc,e1,0f,a6,16,0f,f8,c8,fa,5e,8a,84,09,de,a1,d8,\
"??"=hex:34,bc,6e,28,7d,21,bd,ff,ea,46,46,bd,e1,0e,2f,80
.
[HKEY_USERS\S-1-5-21-594707659-3842835383-1869680338-1003\Software\SecuROM\License information*]
"datasecu"=hex:2a,35,9b,ca,7f,0d,de,d9,17,22,71,70,a6,f8,52,78,8d,71,f8,99,89,
7b,50,6b,33,c8,11,52,b2,94,73,a9,ae,8f,e1,59,fb,56,f3,dd,3d,1b,29,88,8f,fb,\
"rkeysecu"=hex:b6,04,8d,c4,1b,d5,5b,db,93,70,ba,6b,1a,74,1f,27
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10i.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10i.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10i.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10i.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Cryptography\RNG*]
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2011-04-05 18:42:01
ComboFix-quarantined-files.txt 2011-04-05 08:42
.
Před spuštěním: Volných bajtů: 137 873 264 640
Po spuštění: Volných bajtů: 144 278 478 848
.
- - End Of File - - 3E04B6613E049B3FD7A0DAA9D4D53F83

dekuji

Příspěvekod **memphisto** » 05 dub 2011 18:23

Opět vypni rezidentní ochrany antiviru a firewallu a dále:
Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

KillAll::
File::
c:\program files (x86)\unins000.exe
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

Folder::
c:\program files (x86)\Ask.com

Registry::
[-HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"=-
"EnableUIADesktopToggle"=-

DDS::
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local

Firefox::
FF - ProfilePath - c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\
FF - Ext: Ask Toolbar: toolbar@ask.com - %profile%\extensions\toolbar@ask.com

RegLock::
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu

Co ukrýváš v této složce? :smile:

C:\yu

Znáš tyhle IP?
TCP: 242756E647F6E66265562757 = 10.0.0.138
TCP: 5586562736963656026333 = 10.0.0.138
TCP: 94E6475627E65647 = 10.0.0.138
TCP: B604E69637475627 = 10.0.0.138
TCP: C4546554C4F534146454 = 10.0.0.138

kanister · Příspěvekod **kanister** » 06 dub 2011 07:48

Provedu, diky.

C:\yu > nevim, je tam nejaky .exe soubor a myslim, ze je to z YuPlay (nejaka online herna)
IP adresy neznam ... ale ja neznam zadnou IP adresu (ani moji) ? :)

Koukal jsem, ze je tam dost her v logech, potrebuju akorat IL2 & Fifa Manager ... Mam to nejak resit?

Dekuji, postnu log.

Příspěvekod **memphisto** » 06 dub 2011 08:41

Tak pokud je nehraješ, tak je odinstaluj. Dodej logy a uvidíme co dál

kanister · Příspěvekod **kanister** » 13 dub 2011 07:43

ComboFix 11-04-12.02 - Kanister 13.04.2011 15:15:55.2.2 - x64
Microsoft Windows 7 Home Premium 6.1.7600.0.1250.420.1029.18.4063.2439 [GMT 10:00]
Spuštěný z: c:\users\Kanister_2\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Kanister_2\Desktop\CFScript.txt
AV: ESET Smart Security 4.0 *Disabled/Updated* {CB0F8167-5331-BA19-698E-64816B6801A5}
FW: ESET Personal firewall *Disabled* {F3340042-195E-BB41-42D1-CDB495BB46DE}
SP: ESET Smart Security 4.0 *Disabled/Updated* {706E6083-750B-B597-533E-5FF310EF4B18}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\program files (x86)\unins000.exe"
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Ask.com
c:\program files (x86)\Ask.com\cobrand.ico
c:\program files (x86)\Ask.com\config.xml
c:\program files (x86)\Ask.com\favicon.ico
c:\program files (x86)\Ask.com\GenericAskToolbar.dll
c:\program files (x86)\Ask.com\mupcfg.xml
c:\program files (x86)\Ask.com\SaUpdate.exe
c:\program files (x86)\Ask.com\UpdateTask.exe
c:\program files (x86)\unins000.exe
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\datastore\cache.sqlite
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\defaults.js.bak
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\defaults\preferences\defaults.js
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome.manifest
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\content\about.js
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\content\about.xul
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\content\constants.js
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\content\db.js
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\content\events.js
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\content\json.js
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\content\lifecycle.js
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\content\listeners.js
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\content\logger.js
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\content\network.js
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\content\observer.js
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\content\options.js
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\content\options.xul
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\content\preferences.js
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\content\toolbar.js
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\content\utilities.js
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\content\widget-controller.js
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\content\widget-frame.xul
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\content\widget-popup.xul
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\content\widgets.js
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\abc.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\amazon_16x.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\as.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\ask_16x16.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\ask_32x32.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\ask_browser_ff_chrome.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\asklogo.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\bbc_news.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\beppe_grillo.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\bild.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\blogs.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\business.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\Close.gif
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\cnn_16x.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\corriere_della_sera.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\dictionary.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\el_mundo.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\email_16x.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\expansion.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\facebook_16x.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\folha.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\ft.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\ftd.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\g1.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\games_16x.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\gazzetta_dello_sport.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\gripper.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\highlight_16x.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\highlighter_off.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\highlighter_on.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\chevron.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\images.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\kicker.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\labels-de.properties
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\labels-en.properties
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\labels-es.properties
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\labels-fr.properties
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\labels-it.properties
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\labels-nl.properties
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\labels-pt.properties
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\labels-ru.properties
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\laposte.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\lemonde.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\lequipe.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\libero_it.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\links-BR.properties
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\links-DE.properties
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\links-ES.properties
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\links-EU.properties
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\links-FR.properties
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\links-IT.properties
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\links-NL.properties
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\links-RU.properties
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\links-UK.properties
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\links-US.properties
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\magnify_search.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\magnify_search_grey_16x.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\maps.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\marmiton.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\mtv.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\news.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\oglobo.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\orkut.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\preferences.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\search.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\search_ask.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\search_ask_de.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\search_ask_es.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\search_ask_fr.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\search_ask_it.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\search_ask_nl.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\search_ask_pl.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\search_ask_pt.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\search_ask_ru.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\search_cobrand.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\search_current_site.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\search_de.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\search_es.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\search_fr.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\search_it.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\search_nl.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\search_pl.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\search_pt.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\search_ru.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\shopping.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\sports.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\stocks.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\terra.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\toolbar.css
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\toolbar.xul
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\tv.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\tv_movie_de.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\uol.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\weather.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\weather_16x.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\web.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\web_de.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\widget-popup.css
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\WindowTop.gif
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\wordoftheday_16x.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\youtube_16x.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\skin\zoomall.png
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\temp\askToolbar.exe
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Sun-21-Nov-2010-11-04-06-GMT\ff-config.zip
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Tue-06-Apr-2010-06-03-30-GMT\ff-config.zip
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\install.rdf
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\logs\asktb-log-1270533809942.html
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\logs\asktb-log-1270533813189.html
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\logs\asktb-log-1270631532764.html
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\logs\asktb-log-1271252709772.html
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\logs\asktb-log-1275484055796.html
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\logs\asktb-log-1290337445749.html
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\logs\asktb-log-1290554607778.html
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\logs\asktb-log-1290554658037.html
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\logs\asktb-log-1290556633132.html
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\logs\asktb-log-1290651810463.html
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\logs\asktb-log-1290839662987.html
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\logs\asktb-log-1290938256523.html
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\logs\asktb-log-1291026482896.html
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\logs\asktb-log-1291340014719.html
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\logs\asktb-log-1293882039376.html
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\logs\asktb-log-1293882065626.html
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\logs\asktb-log-1294897598876.html
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\logs\asktb-log-1297781720596.html
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\logs\asktb-log-1297781721452.html
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\logs\asktb-log-1298171300315.html
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\logs\asktb-log-1300415100056.html
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\logs\asktb-log-1300415843276.html
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\logs\asktb-log-1301405696122.html
c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\extensions\toolbar@ask.com\logs\asktb-log-1302618970767.html
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-03-13 do 2011-04-13 )))))))))))))))))))))))))))))))
.
.
2011-04-13 05:23 . 2011-04-13 05:23 -------- d-----w- c:\users\postgres\AppData\Local\temp
2011-04-13 05:23 . 2011-04-13 05:23 -------- d-----w- c:\users\postgres.Kanister-VAIO\AppData\Local\temp
2011-04-13 05:23 . 2011-04-13 05:23 -------- d-----w- c:\users\Kanister\AppData\Local\temp
2011-04-13 05:23 . 2011-04-13 05:23 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-04-12 16:21 . 2011-03-18 17:55 781272 ----a-w- c:\program files (x86)\Mozilla Firefox\mozsqlite3.dll
2011-04-12 16:21 . 2011-03-18 17:55 728024 ----a-w- c:\program files (x86)\Mozilla Firefox\libGLESv2.dll
2011-04-12 16:21 . 2011-03-18 17:55 719832 ----a-w- c:\program files (x86)\Mozilla Firefox\mozcpp19.dll
2011-04-12 16:21 . 2011-03-18 17:55 1893336 ----a-w- c:\program files (x86)\Mozilla Firefox\d3dx9_42.dll
2011-04-12 16:21 . 2011-03-18 17:55 1874904 ----a-w- c:\program files (x86)\Mozilla Firefox\mozjs.dll
2011-04-12 16:21 . 2011-03-18 17:55 16856 ----a-w- c:\program files (x86)\Mozilla Firefox\plugin-container.exe
2011-04-12 16:21 . 2011-03-18 17:55 15832 ----a-w- c:\program files (x86)\Mozilla Firefox\mozalloc.dll
2011-04-12 16:21 . 2011-03-18 17:55 142296 ----a-w- c:\program files (x86)\Mozilla Firefox\libEGL.dll
2011-04-12 16:21 . 2011-03-18 17:55 142296 ----a-w- c:\program files (x86)\Mozilla Firefox\components\browsercomps.dll
2011-04-12 16:21 . 2011-03-18 17:55 1975768 ----a-w- c:\program files (x86)\Mozilla Firefox\D3DCompiler_42.dll
2011-04-11 07:59 . 2011-04-11 07:59 -------- d-----w- c:\program files\iPod
2011-04-11 07:59 . 2011-04-11 08:00 -------- d-----w- c:\program files\iTunes
2011-04-11 07:59 . 2011-04-11 08:00 -------- d-----w- c:\program files (x86)\iTunes
2011-04-11 07:58 . 2011-04-11 07:58 -------- d-----w- c:\users\Kanister\AppData\Local\Apple Computer
2011-04-09 02:05 . 2011-03-15 05:17 8424784 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{934343F8-BC5E-4821-B13A-3D0DD4822844}\mpengine.dll
2011-04-08 11:28 . 2011-04-08 11:28 41872 ----a-w- c:\windows\SysWow64\xfcodec.dll
2011-04-08 11:28 . 2011-04-08 11:28 27536 ----a-w- c:\windows\system32\xfcodec64.dll
2011-04-04 04:56 . 2011-04-12 14:34 -------- d-----w- c:\users\Kanister_2\AppData\Roaming\Xfire
2011-04-04 04:56 . 2011-04-05 08:24 -------- d-----w- c:\users\Kanister\AppData\Roaming\Xfire
2011-04-04 04:56 . 2011-04-13 02:48 -------- d-----w- c:\programdata\Xfire
2011-04-04 04:56 . 2011-04-12 14:34 -------- d-----w- c:\program files (x86)\Xfire
2011-04-03 00:39 . 2011-04-03 00:50 -------- d-----w- c:\program files (x86)\Rise of Flight
2011-03-31 02:25 . 2011-03-31 03:13 -------- d-----w- C:\IL-2UP
2011-03-25 23:48 . 2011-03-25 23:48 4284416 ----a-w- c:\windows\SysWow64\GPhotos.scr
2011-03-25 01:18 . 2011-03-25 01:18 -------- d-----w- c:\programdata\ALM
2011-03-25 00:57 . 2011-03-25 00:58 -------- d-----w- c:\windows\system32\drivers\etc\backup
2011-03-18 01:55 . 2011-04-12 14:20 -------- d-----w- c:\program files (x86)\TableNinja
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-02-19 06:37 . 2011-03-09 05:43 1135104 ----a-w- c:\windows\system32\FntCache.dll
2011-02-19 06:37 . 2011-03-09 05:43 1540608 ----a-w- c:\windows\system32\DWrite.dll
2011-02-19 06:36 . 2011-03-09 05:43 902656 ----a-w- c:\windows\system32\d2d1.dll
2011-02-19 05:32 . 2011-03-09 05:43 1074176 ----a-w- c:\windows\SysWow64\DWrite.dll
2011-02-19 05:32 . 2011-03-09 05:43 739840 ----a-w- c:\windows\SysWow64\d2d1.dll
2011-02-18 06:36 . 2011-02-18 06:36 51712 ----a-w- c:\windows\system32\drivers\usbaapl64.sys
2011-02-18 06:36 . 2011-02-18 06:36 4184352 ----a-w- c:\windows\system32\usbaaplrc.dll
2011-02-02 07:11 . 2009-11-25 12:25 270720 ------w- c:\windows\system32\MpSigStub.exe
2011-01-26 06:53 . 2011-02-10 03:53 982912 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2011-01-26 06:53 . 2011-02-10 03:53 265088 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2011-01-26 06:31 . 2011-02-10 03:53 144384 ----a-w- c:\windows\system32\cdd.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-04-05_08.38.15 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-07-14 05:30 . 2011-03-31 02:22 86016 c:\windows\system32\DriverStore\infpub.dat
+ 2009-07-14 05:30 . 2011-04-11 08:23 86016 c:\windows\system32\DriverStore\infpub.dat
+ 2011-02-18 06:36 . 2011-02-18 06:36 51712 c:\windows\system32\DriverStore\FileRepository\usbaapl64.inf_amd64_neutral_c169b6211f782a21\usbaapl64.sys
+ 2010-04-19 09:29 . 2010-04-19 09:29 22528 c:\windows\system32\DriverStore\FileRepository\netaapl64.inf_amd64_neutral_f28869b47dd68105\netaapl64.sys
+ 2009-11-25 18:27 . 2011-04-12 02:34 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-11-25 18:27 . 2011-03-30 02:48 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-11-25 18:27 . 2011-04-12 02:34 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-11-25 18:27 . 2011-03-30 02:48 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2011-03-30 02:48 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2011-04-12 02:34 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 02:36 . 2011-04-05 05:16 620150 c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2011-04-13 04:59 620150 c:\windows\system32\perfh009.dat
- 2009-08-18 23:43 . 2011-04-05 05:16 635232 c:\windows\system32\perfh005.dat
+ 2009-08-18 23:43 . 2011-04-13 04:59 635232 c:\windows\system32\perfh005.dat
- 2009-07-14 02:36 . 2011-04-05 05:16 108332 c:\windows\system32\perfc009.dat
+ 2009-07-14 02:36 . 2011-04-13 04:59 108332 c:\windows\system32\perfc009.dat
- 2009-08-18 23:43 . 2011-04-05 05:16 123974 c:\windows\system32\perfc005.dat
+ 2009-08-18 23:43 . 2011-04-13 04:59 123974 c:\windows\system32\perfc005.dat
- 2009-07-14 05:30 . 2011-03-31 02:22 143360 c:\windows\system32\DriverStore\infstrng.dat
+ 2009-07-14 05:30 . 2011-04-11 08:23 143360 c:\windows\system32\DriverStore\infstrng.dat
- 2009-07-14 05:30 . 2011-03-31 02:22 143360 c:\windows\system32\DriverStore\infstor.dat
+ 2009-07-14 05:30 . 2011-04-11 07:53 143360 c:\windows\system32\DriverStore\infstor.dat
- 2009-07-14 05:12 . 2011-01-01 11:27 262144 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2009-07-14 05:12 . 2011-04-12 01:39 262144 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2011-04-11 08:00 . 2011-04-11 08:00 380928 c:\windows\Installer\{9545E9DB-6F4C-4404-BF25-E221BE8B44C5}\iTunesIco.exe
+ 2011-02-18 06:36 . 2011-02-18 06:36 4184352 c:\windows\system32\DriverStore\FileRepository\usbaapl64.inf_amd64_neutral_c169b6211f782a21\usbaaplrc.dll
+ 2010-04-19 09:29 . 2010-04-19 09:29 1721576 c:\windows\system32\DriverStore\FileRepository\netaapl64.inf_amd64_neutral_f28869b47dd68105\wdfcoinstaller01009.dll
+ 2011-04-12 05:08 . 2011-04-12 05:08 1722880 c:\windows\Installer\c549c7.msi
+ 2009-07-14 02:34 . 2011-04-13 03:05 10223616 c:\windows\system32\SMI\Store\Machine\schema.dat
- 2009-07-14 02:34 . 2011-04-05 05:24 10223616 c:\windows\system32\SMI\Store\Machine\schema.dat
+ 2011-04-11 07:51 . 2011-04-11 07:51 38646784 c:\windows\Installer\4e4888c.msi
+ 2011-04-11 07:50 . 2011-04-11 07:50 26896384 c:\windows\Installer\4e47fea.msi
+ 2011-04-11 07:50 . 2011-04-11 07:50 10654208 c:\windows\Installer\4e47cf8.msi
+ 2011-04-11 07:49 . 2011-04-11 07:49 17840128 c:\windows\Installer\4e47c94.msi
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files (x86)\Java\jre6\bin\jusched.exe" [2009-08-19 148888]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]
"ISBMgr.exe"="c:\program files (x86)\Sony\ISB Utility\ISBMgr.exe" [2009-05-26 317288]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-07-10 98304]
"MarketingTools"="c:\program files (x86)\Sony\Marketing Tools\MarketingTools.exe" [2009-09-06 26624]
"AdobeCS4ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"DeathAdder"="c:\program files (x86)\Razer\DeathAdder\razerhid.exe" [2007-09-07 159744]
"AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-21 406992]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-29 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-03-07 421160]
.
c:\users\Kanister\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Xfire.lnk - c:\program files (x86)\Xfire\Xfire.exe [2011-4-8 3510160]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
GammaTray.lnk - c:\program files (x86)\MagicTune Premium\GammaTray.exe [2010-12-8 36864]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2009-07-01 18:49 98304 ----a-w- c:\windows\System32\VESWinlogon.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer3"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-09-05 133104]
R2 pgsql-8.3;PostgreSQL Database Server 8.3;c:\program files (x86)\PostgreSQL\8.3\bin\pg_ctl.exe [2009-03-13 65536]
R2 Roxio Upnp Server 10;Roxio Upnp Server 10;c:\program files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe [2009-06-26 362992]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]
R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2009-11-27 1038088]
R3 Roxio UPnP Renderer 10;Roxio UPnP Renderer 10;c:\program files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [2009-06-26 313840]
R3 SOHCImp;VAIO Media plus Content Importer;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe [2009-07-27 120104]
R3 SOHDBSvr;VAIO Media plus Database Manager;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe [2009-07-27 70952]
R3 SOHDms;VAIO Media plus Digital Media Server;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe [2009-07-27 427304]
R3 SOHDs;VAIO Media plus Device Searcher;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe [2009-07-27 75048]
R3 SOHPlMgr;VAIO Media plus Playlist Manager;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe [2009-07-27 91432]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2009-06-26 468264]
R3 VcmINSMgr;VAIO Content Metadata Intelligent Network Service Manager;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [2009-06-26 357672]
R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [2009-06-18 110888]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 27136]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe [2009-09-11 735960]
S2 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [x]
S2 postgresql-8.4;PostgreSQL Server 8.4;C:/Program Files (x86)/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N postgresql-8.4 -D C:/Program Files (x86)/PostgreSQL/8.4/data -w [x]
S2 regi;regi;c:\windows\system32\drivers\regi.sys [x]
S2 RtkAudioService;Realtek Audio Service;c:\program files\Realtek\Audio\HDA\RtkAudioService64.exe [2009-07-24 189984]
S2 TeamViewer5;TeamViewer 5;c:\program files (x86)\TeamViewer\Version5\TeamViewer_Service.exe [2010-02-11 172328]
S2 uCamMonitor;CamMonitor;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [2008-09-18 104960]
S2 VAIO Power Management;VAIO Power Management;c:\program files\Sony\VAIO Power Management\SPMService.exe [2009-08-22 411496]
S2 VCFw;VAIO Content Folder Watcher;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [2009-07-22 642920]
S2 VSNService;VSNService;c:\program files\Sony\VAIO Smart Network\VSNService.exe [2009-08-13 522240]
S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys [x]
S3 DAdderFltr;DeathAdder Mouse;c:\windows\system32\drivers\dadder.sys [x]
S3 KeyScrambler;KeyScrambler;c:\windows\system32\drivers\keyscrambler.sys [x]
S3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [x]
S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\DRIVERS\SFEP.sys [x]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]
c:\program files (x86)\Hotspot Shield\hssie\HssIE_64.dll [BU]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="%ProgramFiles%\Apoint\Apoint.exe" [BU]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-05 186904]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-07-24 7938080]
"Skytel"="c:\program files\Realtek\Audio\HDA\Skytel.exe" [2009-07-24 1833504]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-19 171520]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-09-11 2716216]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-05 500208]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"NCInstallQueue"="netman.dll" [2009-07-14 360448]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com/ig/redirectdomain ... &bmod=EU01
mLocal Page = %SystemRoot%\system32\blank.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Odeslat obrázek do zařízení &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Odeslat stránku do zařízení &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: 242756E647F6E66265562757 = 10.0.0.138
TCP: 5586562736963656026333 = 10.0.0.138
TCP: 94E6475627E65647 = 10.0.0.138
TCP: B604E69637475627 = 10.0.0.138
TCP: C4546554C4F534146454 = 10.0.0.138
FF - ProfilePath - c:\users\Kanister\AppData\Roaming\Mozilla\Firefox\Profiles\x3qegxl4.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
AddRemove-Patch for "Men of War"_is1 - c:\program files (x86)\unins000.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\postgresql-8.4]
"ImagePath"="C:/Program Files (x86)/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N \"postgresql-8.4\" -D \"C:/Program Files (x86)/PostgreSQL/8.4/data\" -w"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\postgresql-8.4]
"ImagePath"="C:/Program Files (x86)/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N \"postgresql-8.4\" -D \"C:/Program Files (x86)/PostgreSQL/8.4/data\" -w"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-594707659-3842835383-1869680338-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:36,6e,1b,33,42,e9,25,2b,34,ae,18,ec,01,dd,82,dd,89,a0,f0,1a,79,9c,73,
7a,52,3b,65,f5,00,17,bc,6d,b7,72,e0,d9,4a,97,5c,53,83,25,fc,29,44,4f,fd,d1,\
"??"=hex:34,bc,6e,28,7d,21,bd,ff,ea,46,46,bd,e1,0e,2f,80
.
[HKEY_USERS\S-1-5-21-594707659-3842835383-1869680338-1003\Software\SecuROM\License information*]
"datasecu"=hex:2a,35,9b,ca,7f,0d,de,d9,17,22,71,70,a6,f8,52,78,8d,71,f8,99,89,
7b,50,6b,33,c8,11,52,b2,94,73,a9,ae,8f,e1,59,fb,56,f3,dd,3d,1b,29,88,8f,fb,\
"rkeysecu"=hex:b6,04,8d,c4,1b,d5,5b,db,93,70,ba,6b,1a,74,1f,27
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Cryptography\RNG*]
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Bonjour\mDNSResponder.exe
c:\program files (x86)\Skype\Phone\Skype.exe
c:\program files (x86)\Steam\Steam.exe
c:\program files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe
c:\program files (x86)\MagicTune Premium\MagicTuneEngine.exe
c:\program files (x86)\PostgreSQL\8.4\bin\pg_ctl.exe
c:\program files (x86)\PostgreSQL\8.4\bin\postgres.exe
c:\program files (x86)\Razer\DeathAdder\razerofa.exe
c:\program files (x86)\Sony\VAIO Event Service\VESMgr.exe
c:\program files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
c:\windows\SysWOW64\DllHost.exe
c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files (x86)\PostgreSQL\8.4\bin\postgres.exe
c:\program files (x86)\PostgreSQL\8.4\bin\postgres.exe
c:\program files (x86)\PostgreSQL\8.4\bin\postgres.exe
c:\program files (x86)\PostgreSQL\8.4\bin\postgres.exe
c:\program files (x86)\Sony\VAIO Event Service\VESMgrSub.exe
c:\program files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
c:\program files (x86)\Common Files\Steam\SteamService.exe
.
**************************************************************************
.
Celkový čas: 2011-04-13 15:41:26 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-04-13 05:41
ComboFix2.txt 2011-04-05 08:42
.
Před spuštěním: Volných bajtů: 131 402 248 192
Po spuštění: Volných bajtů: 131 298 226 176
.
- - End Of File - - 66360C98AD27BA88FD534BCB50E0D3FA

there we go.

kanister · Příspěvekod **kanister** » 13 dub 2011 07:48

A dekuji!

Příspěvekod **memphisto** » 13 dub 2011 10:16

ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix /Uninstall

vyčisti systém CCleanerem

a použij i T-Cleaner
smaže vše po Combu,MWAVu atd.-stáhneš>spustíš

pozn. před stažením T-Cleaneru a po dobu čištění deaktivuj AVG , Avast,Avira či Microsoft Security Essentials následně T-Cleaner smaž a zapni si AVG , Avast, Avira či Microsoft Security Essentials

+ HJT

Jak se chová PC?

kanister · Příspěvekod **kanister** » 14 dub 2011 08:39

Chapu to dobre, ze mam vse vycistit a pak pustit HiJackThis & hdit log sem?

PC asi je to lepsi trosku, ale pri spusteni porad cekam vecnost ... cca 10min nez to vsechno dobehne & procesor nebezi na 100%.

Prosim o kontrolu Logu - PC nepracuje spravne.

Prosim o kontrolu Logu - PC nepracuje spravne.

Re: Prosim o kontrolu Logu - PC nepracuje spravne.

Re: Prosim o kontrolu Logu - PC nepracuje spravne.

Re: Prosim o kontrolu Logu - PC nepracuje spravne.

Re: Prosim o kontrolu Logu - PC nepracuje spravne.

Re: Prosim o kontrolu Logu - PC nepracuje spravne.

Re: Prosim o kontrolu Logu - PC nepracuje spravne.

Re: Prosim o kontrolu Logu - PC nepracuje spravne.

Re: Prosim o kontrolu Logu - PC nepracuje spravne.

Re: Prosim o kontrolu Logu - PC nepracuje spravne.

Re: Prosim o kontrolu Logu - PC nepracuje spravne.

Re: Prosim o kontrolu Logu - PC nepracuje spravne.

Kdo je online