PC-HELP.CZ

České diskuzní fórum o počítačích
https://pc-help.cnews.cz/

Log HIJACKTHISU-kontrola

https://pc-help.cnews.cz/viewtopic.php?f=70&t=21368

Stránka 1 z 1

Log HIJACKTHISU-kontrola

Napsal: 08 pro 2007 19:50
od clikck
Moc prosím o kontrolu logu hijackthisu. Do pc se mi dostal spyware a nejde odstranit skoušel jsem na to spyware terminator a avast ale nic, oni ho najdou ale nedokážou smazat předem díky (Je to noutbok ale to je asi jedno)


Logfile of HijackThis v1.99.1
Scan saved at 16:40:43, on 8.12.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\shell.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\PCPRIV~1\UGDCcw.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\DOCUME~1\dalibor\LOCALS~1\Temp\Dočasný adresář 5 pro hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\shell.exe
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: (no name) - {2F02D978-0FF6-80F7-60BB-0426224AB7B3} - C:\Program Files\wwgdbscz\eswecdbg.dll
O2 - BHO: Flash Module - {B9249083-6055-476c-A69D-13E110BFEA91} - tconn1.dll (file missing)
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O3 - Toolbar: &Crawler Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O4 - HKLM\..\Run: [mouseElf] C:\PROGRA~1\SCROLL~1\MouseElf.EXE
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Printer] C:\WINDOWS\system32\printer.exe
O4 - HKLM\..\Run: [ugdccw] "C:\PROGRA~1\PCPRIV~1\UGDCcw.exe" -start
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [timeNoticeSL001] c:\syssyuw.exe net
O4 - HKCU\..\Run: [Spoolsv] C:\WINDOWS\system32\spoolvs.exe
O4 - Startup: .protected
O4 - Startup: CCC.lnk = ?
O4 - Startup: findfast.exe
O4 - Global Startup: .protected
O4 - Global Startup: autorun.exe
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'wsock3.dll' missing
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{7FF306BA-E8ED-4A77-A4B3-43861ABCC112}: NameServer = 85.255.113.146,85.255.112.173
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.146 85.255.112.173
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.113.146 85.255.112.173
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.146 85.255.112.173
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O20 - AppInit_DLLs: C:\WINDOWS\system32\append.dll
O23 - Service: Atheros Configuration Service (ACS) - Atheros - C:\WINDOWS\system32\acs.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

Napsal: 08 pro 2007 20:12
od fredik
Vítej na fóru.

Je tam toho krapet víc, tak se to vezme po částech.

1)
Použij Fixwareoutpodle návodu a vlož sem z něho log.

2)
Stáhni si tento program
Spusť ho, po proběhnutí první části se ti objeví hláška tak ji povol a Pc se restartuje.
Po opětovném najetí do Windows se program spustí znovu a dokončí svoji činnost a zobrazí log. Zavři ho.

3)
Stáhni si ComboFix (by sUBs) a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem klávesy 1
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

V následujícím příspěvku sem vlož tyto logy/výsledky:
- log z Fixwareout
- log z ComboFix

Napsal: 08 pro 2007 20:56
od clikck
díky za přivítání tady sou ty logy

Z FIXWAREOUTU:

Username "Administrator" - 08.12.2007 20:32:39 [Fixwareout edited 9/01/2007]

~~~~~ Prerun check

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
"nameserver"="85.255.113.146 85.255.112.173" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{7FF306BA-E8ED-4A77-A4B3-43861ABCC112}
"nameserver"="85.255.113.146,85.255.112.173" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{CC409C12-9085-4F08-9833-77DAF927ECFB}
"DhcpNameServer"="85.255.113.146,85.255.112.173" <Value cleared.


Z COMBOFIXU:


ComboFix 07-12-09.1 - dalibor 2007-12-08 20:39:44.1 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.1.1029.18.134 [GMT 1:00]
Running from: C:\Documents and Settings\dalibor\Plocha\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\.protected
C:\B.tmp
C:\Documents and Settings\Administrator\Nabídka Start\Programy\Po spuštění\findfast.exe
C:\Documents and Settings\All Users\Data aplikací\PCPrivacyTool
C:\Documents and Settings\All Users\Data aplikací\PCPrivacyTool\Abbr
C:\Documents and Settings\All Users\Data aplikací\PCPrivacyTool\ProdCode
C:\Documents and Settings\All Users\Nabídka Start\Programy.\PCPrivacyTool
C:\Documents and Settings\All Users\Nabídka Start\Programy.\PCPrivacyTool\Contact Customer Service.lnk
C:\Documents and Settings\All Users\Nabídka Start\Programy.\PCPrivacyTool\PCPrivacyTool unregistered.lnk
C:\Documents and Settings\All Users\Nabídka Start\Programy.\PCPrivacyTool\PCPrivacyTool web page.lnk
C:\Documents and Settings\All Users\Nabídka Start\Programy.\PCPrivacyTool\Uninstall PCPrivacyTool.lnk
C:\Documents and Settings\All Users\Nabídka Start\Programy\AVSystemCare
C:\Documents and Settings\All Users\Nabídka Start\Programy\AVSystemCare\AVSystemCare.lnk
C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\.protected
C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\autorun.exe
C:\Documents and Settings\All Users\Plocha\AVSystemCare.lnk
C:\Documents and Settings\dalibor\Data aplikacˇ\microsoft\internet explorer\quick launch\PCPrivacyTool unregistered.lnk
C:\Documents and Settings\dalibor\Data aplikací\pcpriv.exe
C:\Documents and Settings\dalibor\Data aplikací\PCPrivacyTool
C:\Documents and Settings\dalibor\Data aplikací\PCPrivacyTool\Logs\update.log
C:\Documents and Settings\dalibor\Data aplikací\printer.exe
C:\Documents and Settings\dalibor\Data aplikací\trant.exe
C:\Documents and Settings\dalibor\Data aplikací\ultra
C:\Documents and Settings\dalibor\Data aplikací\ultra\uninstall.bat
C:\Documents and Settings\dalibor\Nabídka Start\Programy\Po spuštění\.protected
C:\Documents and Settings\dalibor\Nabídka Start\Programy\Po spuštění\findfast.exe
C:\Documents and Settings\dalibor\Plocha\PCPrivacyTool unregistered.lnk
C:\Program Files\Common Files\PCPrivacyTool
C:\Program Files\Common Files\PCPrivacyTool\mc.exe
C:\Program Files\PCPrivacyTool
C:\Program Files\PCPrivacyTool\config.ini
C:\Program Files\PCPrivacyTool\data\application\7-Zip Compression Pgm.scr
C:\Program Files\PCPrivacyTool\data\application\AbsoluteFTP.scr
C:\Program Files\PCPrivacyTool\data\application\ACDSee32.scr
C:\Program Files\PCPrivacyTool\data\application\Acoustica CD Label Maker.scr
C:\Program Files\PCPrivacyTool\data\application\Ad-aware SE.scr
C:\Program Files\PCPrivacyTool\data\application\Adaptec's Audio CD.scr
C:\Program Files\PCPrivacyTool\data\application\Adaptec Easy CD Creator v4.scr
C:\Program Files\PCPrivacyTool\data\application\Addsoft.scr
C:\Program Files\PCPrivacyTool\data\application\AddWeb 3.0.scr
C:\Program Files\PCPrivacyTool\data\application\Adobe Acrobat Reader v3.0.scr
C:\Program Files\PCPrivacyTool\data\application\Adobe Acrobat Reader v3.1.scr
C:\Program Files\PCPrivacyTool\data\application\Adobe Acrobat Reader v4.0.scr
C:\Program Files\PCPrivacyTool\data\application\Adobe Acrobat Reader v5.0.scr
C:\Program Files\PCPrivacyTool\data\application\Adobe Acrobat Reader v6.0.scr
C:\Program Files\PCPrivacyTool\data\application\Adobe Acrobat Reader v7.0.scr
C:\Program Files\PCPrivacyTool\data\application\Adobe Photoshop v5.0 LE.scr
C:\Program Files\PCPrivacyTool\data\application\Adobe Photoshop v5.5.scr
C:\Program Files\PCPrivacyTool\data\application\Adobe Photoshop v6.0.scr
C:\Program Files\PCPrivacyTool\data\application\Adobe Photoshop v7.0.scr
C:\Program Files\PCPrivacyTool\data\application\Advanced Disk Catalog.scr
C:\Program Files\PCPrivacyTool\data\application\Advanced MP3 Catalog.scr
C:\Program Files\PCPrivacyTool\data\application\Advanced Password Recovery.scr
C:\Program Files\PCPrivacyTool\data\application\ahead cover designer.scr
C:\Program Files\PCPrivacyTool\data\application\Albatros ADGaspect.scr
C:\Program Files\PCPrivacyTool\data\application\Albatros ADGpano.scr
C:\Program Files\PCPrivacyTool\data\application\Albatros ADGview.scr
C:\Program Files\PCPrivacyTool\data\application\Alcohol MRU List.scr
C:\Program Files\PCPrivacyTool\data\application\Animation Shop 1.x.scr
C:\Program Files\PCPrivacyTool\data\application\Animation Shop 3.x.scr
C:\Program Files\PCPrivacyTool\data\application\AOL - Spool.scr
C:\Program Files\PCPrivacyTool\data\application\ASPack.scr
C:\Program Files\PCPrivacyTool\data\application\Avant Browser.scr
C:\Program Files\PCPrivacyTool\data\application\AX-Icons 4.x.scr
C:\Program Files\PCPrivacyTool\data\application\Axialis Icon Workshop 5.x.scr
C:\Program Files\PCPrivacyTool\data\application\Axialis Media Browser.scr
C:\Program Files\PCPrivacyTool\data\application\Babylon Builder 2.2.scr
C:\Program Files\PCPrivacyTool\data\application\Babylon Translator.scr
C:\Program Files\PCPrivacyTool\data\application\BlazeDVD 2.0.scr
C:\Program Files\PCPrivacyTool\data\application\Bookreader.scr
C:\Program Files\PCPrivacyTool\data\application\C++ Builder.scr
C:\Program Files\PCPrivacyTool\data\application\Cabinet Manager.scr
C:\Program Files\PCPrivacyTool\data\application\Classify 98.scr
C:\Program Files\PCPrivacyTool\data\application\Clicktionary 2000.scr
C:\Program Files\PCPrivacyTool\data\application\CoffeeCup DirectFTP.scr
C:\Program Files\PCPrivacyTool\data\application\CoffeeCup GIF Animator.scr
C:\Program Files\PCPrivacyTool\data\application\Cool Edit 2000 1.1.scr
C:\Program Files\PCPrivacyTool\data\application\Cool Edit Pro.scr
C:\Program Files\PCPrivacyTool\data\application\Corel PhotoPaint 8.scr
C:\Program Files\PCPrivacyTool\data\application\CrissCross.scr
C:\Program Files\PCPrivacyTool\data\application\CRT 2.x.scr
C:\Program Files\PCPrivacyTool\data\application\Cute FTP v3.0.scr
C:\Program Files\PCPrivacyTool\data\application\Cute FTP v4.0.scr
C:\Program Files\PCPrivacyTool\data\application\Cute MX.scr
C:\Program Files\PCPrivacyTool\data\application\CuteFTP.scr
C:\Program Files\PCPrivacyTool\data\application\CuteHTML.scr
C:\Program Files\PCPrivacyTool\data\application\DataRescue_IDA.scr
C:\Program Files\PCPrivacyTool\data\application\Delphi v3.scr
C:\Program Files\PCPrivacyTool\data\application\Delphi v4.scr
C:\Program Files\PCPrivacyTool\data\application\Delphi v5.scr
C:\Program Files\PCPrivacyTool\data\application\Delphi v7.scr
C:\Program Files\PCPrivacyTool\data\application\Disk Explorer Professional 3.scr
C:\Program Files\PCPrivacyTool\data\application\Diskeeper 5.0.scr
C:\Program Files\PCPrivacyTool\data\application\DivX Player.scr
C:\Program Files\PCPrivacyTool\data\application\Download Accelerator.scr
C:\Program Files\PCPrivacyTool\data\application\Ebay Toolbar.scr
C:\Program Files\PCPrivacyTool\data\application\EditPad.scr
C:\Program Files\PCPrivacyTool\data\application\EditPlus 2.scr
C:\Program Files\PCPrivacyTool\data\application\edonkey2000.scr
C:\Program Files\PCPrivacyTool\data\application\eMule.scr
C:\Program Files\PCPrivacyTool\data\application\Enfish Onespace.scr
C:\Program Files\PCPrivacyTool\data\application\Enigma Browser.scr
C:\Program Files\PCPrivacyTool\data\application\F-Secure SSH 2.x.scr
C:\Program Files\PCPrivacyTool\data\application\Fix-It 2000.scr
C:\Program Files\PCPrivacyTool\data\application\FlashGet.scr
C:\Program Files\PCPrivacyTool\data\application\FotoCanvas 2.0.scr
C:\Program Files\PCPrivacyTool\data\application\Fotostation 4.0.scr
C:\Program Files\PCPrivacyTool\data\application\foxit reader.scr
C:\Program Files\PCPrivacyTool\data\application\Free Download Manager 1.x.scr
C:\Program Files\PCPrivacyTool\data\application\FTP Explorer.scr
C:\Program Files\PCPrivacyTool\data\application\FTP Voyager.scr
C:\Program Files\PCPrivacyTool\data\application\Fun CD.scr
C:\Program Files\PCPrivacyTool\data\application\Gator.scr
C:\Program Files\PCPrivacyTool\data\application\GeoVid Video to Flash Batch Converter.scr
C:\Program Files\PCPrivacyTool\data\application\GetRight ExplorerBar.scr
C:\Program Files\PCPrivacyTool\data\application\GetRight.scr
C:\Program Files\PCPrivacyTool\data\application\Go!Zilla.scr
C:\Program Files\PCPrivacyTool\data\application\Google Deskbar.scr
C:\Program Files\PCPrivacyTool\data\application\Google Desktop Search History.scr
C:\Program Files\PCPrivacyTool\data\application\Google Toolbar.scr
C:\Program Files\PCPrivacyTool\data\application\Google Video Player 1.x.scr
C:\Program Files\PCPrivacyTool\data\application\GoZilla.scr
C:\Program Files\PCPrivacyTool\data\application\Gravity Newsreader.scr
C:\Program Files\PCPrivacyTool\data\application\hardcopy.scr
C:\Program Files\PCPrivacyTool\data\application\Helios TextPad v3.scr
C:\Program Files\PCPrivacyTool\data\application\Helios TextPad v4.scr
C:\Program Files\PCPrivacyTool\data\application\HelpWriter.scr
C:\Program Files\PCPrivacyTool\data\application\hexworkshop.scr
C:\Program Files\PCPrivacyTool\data\application\Homesite 4.0.scr
C:\Program Files\PCPrivacyTool\data\application\Hotbar 3.0.scr
C:\Program Files\PCPrivacyTool\data\application\HotJava Browser.scr
C:\Program Files\PCPrivacyTool\data\application\HTML Help Workshop.scr
C:\Program Files\PCPrivacyTool\data\application\Chameleon Web Browser.scr
C:\Program Files\PCPrivacyTool\data\application\Icon Extractor.scr
C:\Program Files\PCPrivacyTool\data\application\iMesh.scr
C:\Program Files\PCPrivacyTool\data\application\InoculatelT PE Antivirus.scr
C:\Program Files\PCPrivacyTool\data\application\InstallShield Express.scr
C:\Program Files\PCPrivacyTool\data\application\InterQuick.scr
C:\Program Files\PCPrivacyTool\data\application\Irfanview.scr
C:\Program Files\PCPrivacyTool\data\application\Iso Buster.scr
C:\Program Files\PCPrivacyTool\data\application\Jasc Animation Shop 3.scr
C:\Program Files\PCPrivacyTool\data\application\JASC Paintshop Pro v5.scr
C:\Program Files\PCPrivacyTool\data\application\JASC Paintshop Pro v6.scr
C:\Program Files\PCPrivacyTool\data\application\JASC Paintshop Pro v7.scr
C:\Program Files\PCPrivacyTool\data\application\JASC Paintshop Pro v8.scr
C:\Program Files\PCPrivacyTool\data\application\Jet Photo Shell.scr
C:\Program Files\PCPrivacyTool\data\application\juno.scr
C:\Program Files\PCPrivacyTool\data\application\K-Lite Codec Pack.scr
C:\Program Files\PCPrivacyTool\data\application\Kazaa Media Desktop.scr
C:\Program Files\PCPrivacyTool\data\application\Kodak Imaging.scr
C:\Program Files\PCPrivacyTool\data\application\LeapFTP 2.6.scr
C:\Program Files\PCPrivacyTool\data\application\LeechFTP.scr
C:\Program Files\PCPrivacyTool\data\application\Letterbox.scr
C:\Program Files\PCPrivacyTool\data\application\LViewPro 2.x.scr
C:\Program Files\PCPrivacyTool\data\application\Macromedia Dreamweaver MX.scr
C:\Program Files\PCPrivacyTool\data\application\Macromedia Dreamweaver Ultradev 4.scr
C:\Program Files\PCPrivacyTool\data\application\Macromedia Firework MX.scr
C:\Program Files\PCPrivacyTool\data\application\Macromedia Fireworks 3.scr
C:\Program Files\PCPrivacyTool\data\application\Macromedia Flash MX.scr
C:\Program Files\PCPrivacyTool\data\application\Macromedia Flash Player.scr
C:\Program Files\PCPrivacyTool\data\application\Macromedia Flash v4.0.scr
C:\Program Files\PCPrivacyTool\data\application\Magic ISO Maker 4.6.scr
C:\Program Files\PCPrivacyTool\data\application\mapinfo mapmarker.scr
C:\Program Files\PCPrivacyTool\data\application\Mass Download.scr
C:\Program Files\PCPrivacyTool\data\application\MasterSplitter v2.1.scr
C:\Program Files\PCPrivacyTool\data\application\McAfee Virus Scan.scr
C:\Program Files\PCPrivacyTool\data\application\MEDA MP3 Splitter.scr
C:\Program Files\PCPrivacyTool\data\application\Metapad.scr
C:\Program Files\PCPrivacyTool\data\application\MGI PHOTOSUITE SE 1.x.scr
C:\Program Files\PCPrivacyTool\data\application\MGUSOFT Setup Builder.scr
C:\Program Files\PCPrivacyTool\data\application\Microangelo 98.scr
C:\Program Files\PCPrivacyTool\data\application\MicroAngelo.scr
C:\Program Files\PCPrivacyTool\data\application\Micrografx Picture Publisher v7.scr
C:\Program Files\PCPrivacyTool\data\application\Micrografx Picture Publisher v8.scr
C:\Program Files\PCPrivacyTool\data\application\Microsoft FrontPage Express.scr
C:\Program Files\PCPrivacyTool\data\application\Microsoft FrontPage.scr
C:\Program Files\PCPrivacyTool\data\application\Microsoft Help Workshop.scr
C:\Program Files\PCPrivacyTool\data\application\Microsoft HTML Help.scr
C:\Program Files\PCPrivacyTool\data\application\Microsoft Imaging.scr
C:\Program Files\PCPrivacyTool\data\application\Microsoft Managemant Console.scr
C:\Program Files\PCPrivacyTool\data\application\Microsoft Netmeeting.scr
C:\Program Files\PCPrivacyTool\data\application\Microsoft Office 2000.scr
C:\Program Files\PCPrivacyTool\data\application\Microsoft Office 2003.scr
C:\Program Files\PCPrivacyTool\data\application\Microsoft Office 97.scr
C:\Program Files\PCPrivacyTool\data\application\Microsoft Office InfoPath 2003.scr
C:\Program Files\PCPrivacyTool\data\application\Microsoft Office XP.scr
C:\Program Files\PCPrivacyTool\data\application\Microsoft Office.scr
C:\Program Files\PCPrivacyTool\data\application\Microsoft Outlook Express 5.0.scr
C:\Program Files\PCPrivacyTool\data\application\Microsoft Photo Editor 3.x.scr
C:\Program Files\PCPrivacyTool\data\application\MicroSoft PhotoDraw.scr
C:\Program Files\PCPrivacyTool\data\application\Microsoft Picture It Publishing.scr
C:\Program Files\PCPrivacyTool\data\application\Microsoft Publisher 2000.scr
C:\Program Files\PCPrivacyTool\data\application\Microsoft Visual Studio 6.scr
C:\Program Files\PCPrivacyTool\data\application\Microsoft Windows Paint.scr
C:\Program Files\PCPrivacyTool\data\application\Microsoft Windows WordPad.scr
C:\Program Files\PCPrivacyTool\data\application\Microsoft Word 2000.scr
C:\Program Files\PCPrivacyTool\data\application\Microsoft Word Backup Files.scr
C:\Program Files\PCPrivacyTool\data\application\Microsoft Works 4.0.scr
C:\Program Files\PCPrivacyTool\data\application\Mijenix Powerdesk 4.0.scr
C:\Program Files\PCPrivacyTool\data\application\MIRC.scr
C:\Program Files\PCPrivacyTool\data\application\miroMEDIA PCTV.scr
C:\Program Files\PCPrivacyTool\data\application\mixmeister.scr
C:\Program Files\PCPrivacyTool\data\application\Morpheus.scr
C:\Program Files\PCPrivacyTool\data\application\MovieXone 1.0.scr
C:\Program Files\PCPrivacyTool\data\application\Mozart 4.0.scr
C:\Program Files\PCPrivacyTool\data\application\ms autoroute express.scr
C:\Program Files\PCPrivacyTool\data\application\MS WORD.scr
C:\Program Files\PCPrivacyTool\data\application\MSE.scr
C:\Program Files\PCPrivacyTool\data\application\MSN Toolbar.scr
C:\Program Files\PCPrivacyTool\data\application\Music Match Jukebox.scr
C:\Program Files\PCPrivacyTool\data\application\MyWay Advertising.scr
C:\Program Files\PCPrivacyTool\data\application\Napster Music Community.scr
C:\Program Files\PCPrivacyTool\data\application\Naviscope.scr
C:\Program Files\PCPrivacyTool\data\application\NEATO Labels.scr
C:\Program Files\PCPrivacyTool\data\application\nero burning rom.scr
C:\Program Files\PCPrivacyTool\data\application\Nero Vision.scr
C:\Program Files\PCPrivacyTool\data\application\Net Vampire 3.x.scr
C:\Program Files\PCPrivacyTool\data\application\netants.scr
C:\Program Files\PCPrivacyTool\data\application\NetCaptor.scr
C:\Program Files\PCPrivacyTool\data\application\netmeeting.scr
C:\Program Files\PCPrivacyTool\data\application\Netsonic.scr
C:\Program Files\PCPrivacyTool\data\application\Netzip Download Demon 3.x.scr
C:\Program Files\PCPrivacyTool\data\application\NewsBin Pro 4.scr
C:\Program Files\PCPrivacyTool\data\application\Norton AntiVirus 2000 (v6).scr
C:\Program Files\PCPrivacyTool\data\application\Norton AntiVirus 2003.scr
C:\Program Files\PCPrivacyTool\data\application\Norton Commander.scr
C:\Program Files\PCPrivacyTool\data\application\Norton File Manager.scr
C:\Program Files\PCPrivacyTool\data\application\Norton Firewall.scr
C:\Program Files\PCPrivacyTool\data\application\Norton Internet Security.scr
C:\Program Files\PCPrivacyTool\data\application\Norton LiveUpdate.scr
C:\Program Files\PCPrivacyTool\data\application\Norton Utilities 2000.scr
C:\Program Files\PCPrivacyTool\data\application\NotePad Plus.scr
C:\Program Files\PCPrivacyTool\data\application\notetab lite.scr
C:\Program Files\PCPrivacyTool\data\application\NoteTab Pro.scr
C:\Program Files\PCPrivacyTool\data\application\Object Rescue.scr
C:\Program Files\PCPrivacyTool\data\application\OmniPage 10.0.scr
C:\Program Files\PCPrivacyTool\data\application\OnTrack Powerdesk 4.scr
C:\Program Files\PCPrivacyTool\data\application\Ontrack PowerDesk 5.scr
C:\Program Files\PCPrivacyTool\data\application\PackageForTheWeb.scr
C:\Program Files\PCPrivacyTool\data\application\Paint Shop Pro 5.0.scr
C:\Program Files\PCPrivacyTool\data\application\Paint Shop Pro 7.0.scr
C:\Program Files\PCPrivacyTool\data\application\Password Safe.scr
C:\Program Files\PCPrivacyTool\data\application\PE Explorer 1.95.scr
C:\Program Files\PCPrivacyTool\data\application\Personal Ancestral File.scr
C:\Program Files\PCPrivacyTool\data\application\photo magic 4.0.scr
C:\Program Files\PCPrivacyTool\data\application\PhotoCanvas 2.0.scr
C:\Program Files\PCPrivacyTool\data\application\Photodex Compupic Pro.scr
C:\Program Files\PCPrivacyTool\data\application\PhotoDraw 2000.scr
C:\Program Files\PCPrivacyTool\data\application\PhotoImpact 8.0.scr
C:\Program Files\PCPrivacyTool\data\application\PhotoImpact Viewer 4.0.scr
C:\Program Files\PCPrivacyTool\data\application\PicoZip.scr
C:\Program Files\PCPrivacyTool\data\application\PictureIt Digital Image Pro 7.0.scr
C:\Program Files\PCPrivacyTool\data\application\PKZip for Windows v2.60.03+.scr
C:\Program Files\PCPrivacyTool\data\application\PolyView.scr
C:\Program Files\PCPrivacyTool\data\application\Popup Purger.scr
C:\Program Files\PCPrivacyTool\data\application\PopUpCop.scr
C:\Program Files\PCPrivacyTool\data\application\Power archiver.scr
C:\Program Files\PCPrivacyTool\data\application\PowerArc.scr
C:\Program Files\PCPrivacyTool\data\application\PowerDVD.scr
C:\Program Files\PCPrivacyTool\data\application\PowerZip.scr
C:\Program Files\PCPrivacyTool\data\application\Privacy Eraser Pro.scr
C:\Program Files\PCPrivacyTool\data\application\Putty hostkeys.scr
C:\Program Files\PCPrivacyTool\data\application\PYTHON.scr
C:\Program Files\PCPrivacyTool\data\application\QuickTime.scr
C:\Program Files\PCPrivacyTool\data\application\Real Audio Player v6 v7 v8.scr
C:\Program Files\PCPrivacyTool\data\application\Real Download v4.scr
C:\Program Files\PCPrivacyTool\data\application\RealNetworks Real Download.scr
C:\Program Files\PCPrivacyTool\data\application\RealOne & RealPlayer.scr
C:\Program Files\PCPrivacyTool\data\application\RealVNC.scr
C:\Program Files\PCPrivacyTool\data\application\RegEdit.scr
C:\Program Files\PCPrivacyTool\data\application\Roxio Easy CD Creator.scr
C:\Program Files\PCPrivacyTool\data\application\Save Now.scr
C:\Program Files\PCPrivacyTool\data\application\Scour Exchange.scr
C:\Program Files\PCPrivacyTool\data\application\Seal Module Mlayer.scr
C:\Program Files\PCPrivacyTool\data\application\SearchAndBrowse.scr
C:\Program Files\PCPrivacyTool\data\application\SearchAnt.scr
C:\Program Files\PCPrivacyTool\data\application\SearchV.scr
C:\Program Files\PCPrivacyTool\data\application\SearchWolf.scr
C:\Program Files\PCPrivacyTool\data\application\SearchWWW.scr
C:\Program Files\PCPrivacyTool\data\application\SideStep.scr
C:\Program Files\PCPrivacyTool\data\application\Skype.scr
C:\Program Files\PCPrivacyTool\data\application\Smart Explorer.scr
C:\Program Files\PCPrivacyTool\data\application\SmartDraw 6.scr
C:\Program Files\PCPrivacyTool\data\application\smartftp.scr
C:\Program Files\PCPrivacyTool\data\application\SmartPops.scr
C:\Program Files\PCPrivacyTool\data\application\Sonic Foundry's Acid 2.0.scr
C:\Program Files\PCPrivacyTool\data\application\Sonique Player.scr
C:\Program Files\PCPrivacyTool\data\application\Spinner Plus.scr
C:\Program Files\PCPrivacyTool\data\application\SpotOn Browser plugin.scr
C:\Program Files\PCPrivacyTool\data\application\Staff-FTP.scr
C:\Program Files\PCPrivacyTool\data\application\Star Downloader.scr
C:\Program Files\PCPrivacyTool\data\application\Stardialer.scr
C:\Program Files\PCPrivacyTool\data\application\StarOffice 5.x.scr
C:\Program Files\PCPrivacyTool\data\application\SubmitWolf Pro.scr
C:\Program Files\PCPrivacyTool\data\application\Sun Java Cache.scr
C:\Program Files\PCPrivacyTool\data\application\SureThing CD Labeler.scr
C:\Program Files\PCPrivacyTool\data\application\SVAPlayer.scr
C:\Program Files\PCPrivacyTool\data\application\SWiSH 2.0.scr
C:\Program Files\PCPrivacyTool\data\application\Teleport Pro.scr
C:\Program Files\PCPrivacyTool\data\application\Telnet.scr
C:\Program Files\PCPrivacyTool\data\application\Text Pad 4.x.scr
C:\Program Files\PCPrivacyTool\data\application\The Playa.scr
C:\Program Files\PCPrivacyTool\data\application\Third Voice 1.x.scr
C:\Program Files\PCPrivacyTool\data\application\Thumbs Plus 4.scr
C:\Program Files\PCPrivacyTool\data\application\Timesink.scr
C:\Program Files\PCPrivacyTool\data\application\TinyBar.scr
C:\Program Files\PCPrivacyTool\data\application\TOPicks.scr
C:\Program Files\PCPrivacyTool\data\application\Total Commander.scr
C:\Program Files\PCPrivacyTool\data\application\transponder.scr
C:\Program Files\PCPrivacyTool\data\application\Trellians Classify 98.scr
C:\Program Files\PCPrivacyTool\data\application\Tribal Voice's PowWow.scr
C:\Program Files\PCPrivacyTool\data\application\Trojan Remover.scr
C:\Program Files\PCPrivacyTool\data\application\TSADBOT.scr
C:\Program Files\PCPrivacyTool\data\application\UCmore toolbar.scr
C:\Program Files\PCPrivacyTool\data\application\Ulead Gif Animator v4.0.scr
C:\Program Files\PCPrivacyTool\data\application\Ulead GIF Animator v5.0.scr
C:\Program Files\PCPrivacyTool\data\application\Ulead Photo Explorer v4.2.scr
C:\Program Files\PCPrivacyTool\data\application\Ulead Photo Express.scr
C:\Program Files\PCPrivacyTool\data\application\Ulead PhotoImpact v5.scr
C:\Program Files\PCPrivacyTool\data\application\Ulead VideoStudio 4.0.scr
C:\Program Files\PCPrivacyTool\data\application\Ultimate Paint.scr
C:\Program Files\PCPrivacyTool\data\application\ULTImate Technology BV v5.5.scr
C:\Program Files\PCPrivacyTool\data\application\UltraEdit v4.scr
C:\Program Files\PCPrivacyTool\data\application\UltraEdit v7.scr
C:\Program Files\PCPrivacyTool\data\application\UltraEdit.scr
C:\Program Files\PCPrivacyTool\data\application\UltraISO 7.x.scr
C:\Program Files\PCPrivacyTool\data\application\uTorrent 1.x.scr
C:\Program Files\PCPrivacyTool\data\application\VBoxEdit.scr
C:\Program Files\PCPrivacyTool\data\application\VirtualDub.scr
C:\Program Files\PCPrivacyTool\data\application\VMWARE.scr
C:\Program Files\PCPrivacyTool\data\application\Vueprint.scr
C:\Program Files\PCPrivacyTool\data\application\VX2 Respondmiter.scr
C:\Program Files\PCPrivacyTool\data\application\W32Dasm.scr
C:\Program Files\PCPrivacyTool\data\application\Web Ferret v3.scr
C:\Program Files\PCPrivacyTool\data\application\WebFerret.scr
C:\Program Files\PCPrivacyTool\data\application\webhancer.scr
C:\Program Files\PCPrivacyTool\data\application\Wildstylz.scr
C:\Program Files\PCPrivacyTool\data\application\WildTangent.scr
C:\Program Files\PCPrivacyTool\data\application\WinAce.scr
C:\Program Files\PCPrivacyTool\data\application\winamp.scr
C:\Program Files\PCPrivacyTool\data\application\Windows Commander.scr
C:\Program Files\PCPrivacyTool\data\application\WinHTTrack Website Copier.scr
C:\Program Files\PCPrivacyTool\data\application\WinOnCD.scr
C:\Program Files\PCPrivacyTool\data\application\WinRar.scr
C:\Program Files\PCPrivacyTool\data\application\Winshow.scr
C:\Program Files\PCPrivacyTool\data\application\WinUAE.scr
C:\Program Files\PCPrivacyTool\data\application\Winupie.scr
C:\Program Files\PCPrivacyTool\data\application\WinVNC.scr
C:\Program Files\PCPrivacyTool\data\application\WinZip v8.scr
C:\Program Files\PCPrivacyTool\data\application\Wise Installer.scr
C:\Program Files\PCPrivacyTool\data\application\Worm.Sobig.scr
C:\Program Files\PCPrivacyTool\data\application\WurldMedia.scr
C:\Program Files\PCPrivacyTool\data\application\Xara 3D v4.x.scr
C:\Program Files\PCPrivacyTool\data\application\Xara Webstyle.scr
C:\Program Files\PCPrivacyTool\data\application\XDialer.scr
C:\Program Files\PCPrivacyTool\data\application\XING MP3 PLAYER.scr
C:\Program Files\PCPrivacyTool\data\application\XLoader.scr
C:\Program Files\PCPrivacyTool\data\application\Xolox.scr
C:\Program Files\PCPrivacyTool\data\application\Xrenoder.scr
C:\Program Files\PCPrivacyTool\data\application\Xupiter toolbar.scr
C:\Program Files\PCPrivacyTool\data\application\Xzoomy.scr
C:\Program Files\PCPrivacyTool\data\application\Yahoo Player.scr
C:\Program Files\PCPrivacyTool\data\application\Yahoo! Toolbar.scr
C:\Program Files\PCPrivacyTool\data\application\Yamaha S-YXG100.scr
C:\Program Files\PCPrivacyTool\data\application\ZeroPopup.scr
C:\Program Files\PCPrivacyTool\data\application\ZipMagic 2000.scr
C:\Program Files\PCPrivacyTool\data\application\Zone Alarm.scr
C:\Program Files\PCPrivacyTool\data\brand.dat
C:\Program Files\PCPrivacyTool\data\firefox\firefox - cache.scr
C:\Program Files\PCPrivacyTool\data\firefox\firefox - cookies.scr
C:\Program Files\PCPrivacyTool\data\firefox\firefox - history.scr
C:\Program Files\PCPrivacyTool\data\ie\ie cookies.scr
C:\Program Files\PCPrivacyTool\data\ie\ie internet cache.scr
C:\Program Files\PCPrivacyTool\data\ie\ie privacy history.scr
C:\Program Files\PCPrivacyTool\data\ie\ie typed urls.scr
C:\Program Files\PCPrivacyTool\data\ie\ie url history.scr
C:\Program Files\PCPrivacyTool\data\ie\windows autocomplete.scr
C:\Program Files\PCPrivacyTool\data\ie\windows downloaded files.scr
C:\Program Files\PCPrivacyTool\data\ie\windows favorites order.scr
C:\Program Files\PCPrivacyTool\data\ie\windows passwords.scr
C:\Program Files\PCPrivacyTool\data\messanger\aim.scr
C:\Program Files\PCPrivacyTool\data\messanger\AOL Bart.scr
C:\Program Files\PCPrivacyTool\data\messanger\AOL Instant Messenger.scr
C:\Program Files\PCPrivacyTool\data\messanger\aolim.scr
C:\Program Files\PCPrivacyTool\data\messanger\icq - download.scr
C:\Program Files\PCPrivacyTool\data\messanger\icq - logs.scr
C:\Program Files\PCPrivacyTool\data\messanger\Miranda ICQ.scr
C:\Program Files\PCPrivacyTool\data\messanger\MSN Messenger User Account.scr
C:\Program Files\PCPrivacyTool\data\messanger\Trillian cache.scr
C:\Program Files\PCPrivacyTool\data\messanger\trillian downloads.scr
C:\Program Files\PCPrivacyTool\data\messanger\trillian logs.scr
C:\Program Files\PCPrivacyTool\data\messanger\yahoo messenger logs.scr
C:\Program Files\PCPrivacyTool\data\messanger\Yahoo! Messenger.scr
C:\Program Files\PCPrivacyTool\data\mozilla\mozilla - autocomplete.scr
C:\Program Files\PCPrivacyTool\data\mozilla\mozilla - cache.scr
C:\Program Files\PCPrivacyTool\data\mozilla\mozilla - cookies.scr
C:\Program Files\PCPrivacyTool\data\mozilla\Mozilla - history.scr
C:\Program Files\PCPrivacyTool\data\mozilla\mozilla - saved passwords.scr
C:\Program Files\PCPrivacyTool\data\mozilla\Mozilla - typed urls.scr
C:\Program Files\PCPrivacyTool\data\netscape\netscape - cache.scr
C:\Program Files\PCPrivacyTool\data\netscape\netscape - cookies.scr
C:\Program Files\PCPrivacyTool\data\netscape\netscape - history.scr
C:\Program Files\PCPrivacyTool\data\netscape\Netscape Navigator - last trusted apps.scr
C:\Program Files\PCPrivacyTool\data\opera\Opera Browser - cache.scr
C:\Program Files\PCPrivacyTool\data\opera\Opera Browser - cookies.scr
C:\Program Files\PCPrivacyTool\data\opera\Opera Browser - Download.scr
C:\Program Files\PCPrivacyTool\data\opera\Opera Browser - history.scr
C:\Program Files\PCPrivacyTool\data\opera\Opera Browser - misc.scr
C:\Program Files\PCPrivacyTool\data\opera\Opera Browser - mru.scr
C:\Program Files\PCPrivacyTool\data\opera\Opera Browser - visited.scr
C:\Program Files\PCPrivacyTool\data\sfl.dat
C:\Program Files\PCPrivacyTool\data\skin.skn
C:\Program Files\PCPrivacyTool\data\srl.dat
C:\Program Files\PCPrivacyTool\data\windows\Direct Draw.scr
C:\Program Files\PCPrivacyTool\data\windows\direct input.scr
C:\Program Files\PCPrivacyTool\data\windows\last files.scr
C:\Program Files\PCPrivacyTool\data\windows\Microsoft Send-To Extensions.scr
C:\Program Files\PCPrivacyTool\data\windows\windows applog.scr
C:\Program Files\PCPrivacyTool\data\windows\windows documents.scr
C:\Program Files\PCPrivacyTool\data\windows\Windows Downloaded Installations.scr
C:\Program Files\PCPrivacyTool\data\windows\windows empty recylcing bin.scr
C:\Program Files\PCPrivacyTool\data\windows\Windows Explorer User Assistant history.scr
C:\Program Files\PCPrivacyTool\data\windows\windows findfile.scr
C:\Program Files\PCPrivacyTool\data\windows\Windows FTP Accounts.scr
C:\Program Files\PCPrivacyTool\data\windows\windows hotfix uninstall.scr
C:\Program Files\PCPrivacyTool\data\windows\windows logfiles.scr
C:\Program Files\PCPrivacyTool\data\windows\Windows Mapped Drives.scr
C:\Program Files\PCPrivacyTool\data\windows\windows media player 7.scr
C:\Program Files\PCPrivacyTool\data\windows\windows minidump.scr
C:\Program Files\PCPrivacyTool\data\windows\windows MUICache.scr
C:\Program Files\PCPrivacyTool\data\windows\windows network links.scr
C:\Program Files\PCPrivacyTool\data\windows\windows opensave.scr
C:\Program Files\PCPrivacyTool\data\windows\windows openwith.scr
C:\Program Files\PCPrivacyTool\data\windows\windows prefetch.scr
C:\Program Files\PCPrivacyTool\data\windows\windows reg history.scr
C:\Program Files\PCPrivacyTool\data\windows\windows run history.scr
C:\Program Files\PCPrivacyTool\data\windows\windows search.scr
C:\Program Files\PCPrivacyTool\data\windows\windows start menu order.scr
C:\Program Files\PCPrivacyTool\data\windows\windows stream history.scr
C:\Program Files\PCPrivacyTool\data\windows\windows temp.scr
C:\Program Files\PCPrivacyTool\data\windows\windows update.scr
C:\Program Files\PCPrivacyTool\data\windows\Windows XP Unread Mail Count.scr
C:\Program Files\PCPrivacyTool\default.ini
C:\Program Files\PCPrivacyTool\diagnosis.dat
C:\Program Files\PCPrivacyTool\GDC.exe
C:\Program Files\PCPrivacyTool\GDC.url
C:\Program Files\PCPrivacyTool\GDCPatch.exe
C:\Program Files\PCPrivacyTool\gfx\button_arrow.bmp
C:\Program Files\PCPrivacyTool\gfx\button_arrow2.bmp
C:\Program Files\PCPrivacyTool\gfx\buy.bmp
C:\Program Files\PCPrivacyTool\gfx\custom.bmp
C:\Program Files\PCPrivacyTool\gfx\customcleanup.bmp
C:\Program Files\PCPrivacyTool\gfx\header.bmp
C:\Program Files\PCPrivacyTool\gfx\checked.bmp
C:\Program Files\PCPrivacyTool\gfx\icon.ico
C:\Program Files\PCPrivacyTool\gfx\icon_about.ico
C:\Program Files\PCPrivacyTool\gfx\icon_grayed.ico
C:\Program Files\PCPrivacyTool\gfx\icon_checked.ico
C:\Program Files\PCPrivacyTool\gfx\icon_link.ico
C:\Program Files\PCPrivacyTool\gfx\icon_manual.ico
C:\Program Files\PCPrivacyTool\gfx\icon_quit.ico
C:\Program Files\PCPrivacyTool\gfx\icon_support.ico
C:\Program Files\PCPrivacyTool\gfx\icon_unchecked.ico
C:\Program Files\PCPrivacyTool\gfx\icon_uncheked.ico
C:\Program Files\PCPrivacyTool\gfx\icon_uninstall.ico
C:\Program Files\PCPrivacyTool\gfx\icon_update.ico
C:\Program Files\PCPrivacyTool\gfx\log.bmp
C:\Program Files\PCPrivacyTool\gfx\logo.bmp
C:\Program Files\PCPrivacyTool\gfx\register.bmp
C:\Program Files\PCPrivacyTool\gfx\settings.bmp
C:\Program Files\PCPrivacyTool\gfx\sign_green.bmp
C:\Program Files\PCPrivacyTool\gfx\sign_green_big.bmp
C:\Program Files\PCPrivacyTool\gfx\sign_red.bmp
C:\Program Files\PCPrivacyTool\gfx\sign_red_big.bmp
C:\Program Files\PCPrivacyTool\gfx\sign_yellow.bmp
C:\Program Files\PCPrivacyTool\gfx\splash.bmp
C:\Program Files\PCPrivacyTool\gfx\status_good.bmp
C:\Program Files\PCPrivacyTool\gfx\status_risk.bmp
C:\Program Files\PCPrivacyTool\gfx\support.bmp
C:\Program Files\PCPrivacyTool\gfx\sys_shield.bmp
C:\Program Files\PCPrivacyTool\gfx\sys_update.bmp
C:\Program Files\PCPrivacyTool\gfx\sysstatus.bmp
C:\Program Files\PCPrivacyTool\gfx\unchecked.bmp
C:\Program Files\PCPrivacyTool\gfx\update.bmp
C:\Program Files\PCPrivacyTool\lang\Arabic.lng
C:\Program Files\PCPrivacyTool\lang\Brazilian.lng
C:\Program Files\PCPrivacyTool\lang\Catalan.lng
C:\Program Files\PCPrivacyTool\lang\Czech.lng
C:\Program Files\PCPrivacyTool\lang\Danish.lng
C:\Program Files\PCPrivacyTool\lang\Dutch.lng
C:\Program Files\PCPrivacyTool\lang\English.lng
C:\Program Files\PCPrivacyTool\lang\Finnish.lng
C:\Program Files\PCPrivacyTool\lang\French.lng
C:\Program Files\PCPrivacyTool\lang\German.lng
C:\Program Files\PCPrivacyTool\lang\Greek.lng
C:\Program Files\PCPrivacyTool\lang\Hebrew.lng
C:\Program Files\PCPrivacyTool\lang\Chinese.lng
C:\Program Files\PCPrivacyTool\lang\Italian.lng
C:\Program Files\PCPrivacyTool\lang\Japanese.lng
C:\Program Files\PCPrivacyTool\lang\Malayan.lng
C:\Program Files\PCPrivacyTool\lang\Norwegian.lng
C:\Program Files\PCPrivacyTool\lang\Polish.lng
C:\Program Files\PCPrivacyTool\lang\Portuguese.lng
C:\Program Files\PCPrivacyTool\lang\Russian.lng
C:\Program Files\PCPrivacyTool\lang\Slovenian.lng
C:\Program Files\PCPrivacyTool\lang\Spanish.lng
C:\Program Files\PCPrivacyTool\lang\Swedish.lng
C:\Program Files\PCPrivacyTool\lang\Thai.lng
C:\Program Files\PCPrivacyTool\lang\Turkish.lng
C:\Program Files\PCPrivacyTool\License.rtf
C:\Program Files\PCPrivacyTool\Readme.rtf
C:\Program Files\PCPrivacyTool\secure_del.dll
C:\Program Files\PCPrivacyTool\sr.log
C:\Program Files\PCPrivacyTool\support.url
C:\Program Files\PCPrivacyTool\UGDCcw.exe
C:\Program Files\PCPrivacyTool\unins000.dat
C:\Program Files\PCPrivacyTool\unins000.exe
C:\Program Files\PCPrivacyTool\updater.dat
C:\Program Files\PCPrivacyTool\updater.exe
C:\Program Files\PCPrivacyTool\ver.dat
C:\Program Files\wwgdbscz
C:\Program Files\wwgdbscz\eswecdbg.dll
C:\WINDOWS\.protected
C:\WINDOWS\regedit.com
C:\WINDOWS\shell.exe
C:\WINDOWS\svhost.exe
C:\WINDOWS\system32\append.dll
C:\WINDOWS\system32\conf.dat
C:\WINDOWS\system32\drivers\etc\.protected
C:\WINDOWS\system32\drivers\fmtr.sys
C:\WINDOWS\system32\drivers\protect.sys
C:\WINDOWS\system32\kernel32.exe
C:\WINDOWS\system32\mcrupdate.exe
C:\WINDOWS\system32\printer.exe
C:\WINDOWS\system32\spoolvs.exe
C:\WINDOWS\system32\taskmgr.com
C:\WINDOWS\system32\wsnpoem
C:\WINDOWS\system32\wsnpoem\audio.dll
C:\WINDOWS\system32\wsnpoem\audio.dll.cla
C:\WINDOWS\system32\wsnpoem\video.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_FMTR
-------\LEGACY_SYSLIBRARY
-------\fmtr
-------\protect
-------\SysLibrary


((((((((((((((((((((((((( Files Created from 2007-11-09 to 2007-12-09 )))))))))))))))))))))))))))))))
.

2007-12-08 20:36 . 2007-12-08 20:37 <DIR> d-------- C:\PrinterBegone
2007-12-08 20:00 . 2007-12-08 20:00 0 --a------ C:\WINDOWS\msnetgh.exe
2007-12-08 16:19 . 2007-12-08 16:19 0 --a------ C:\WINDOWS\msnetws.exe
2007-12-08 16:08 . 2007-12-08 16:08 0 --a------ C:\23990098.$$$
2007-12-08 16:07 . 2007-12-08 16:07 <DIR> d-a------ C:\WINDOWS\zts2.exe
2007-12-08 16:07 . 2007-12-08 16:07 <DIR> d-a------ C:\WINDOWS\system32\vcmgcd32.dll
2007-12-08 16:07 . 2007-12-08 16:07 <DIR> d-a------ C:\WINDOWS\system32\iifgfgf.dll
2007-12-08 16:07 . 2007-12-08 16:07 <DIR> d-a------ C:\WINDOWS\rundll16.exe
2007-12-08 16:07 . 2007-12-08 16:07 <DIR> d-a------ C:\WINDOWS\rundl132.dll
2007-12-08 16:07 . 2007-12-08 16:07 <DIR> d-a------ C:\WINDOWS\logo1_.exe
2007-12-08 16:06 . 2007-12-08 16:06 26 --a------ C:\WINDOWS\Lic.xxx
2007-12-08 16:05 . 2004-08-17 14:49 147,968 --a------ C:\WINDOWS\R.COM
2007-12-08 16:05 . 2004-08-17 14:49 137,216 --a------ C:\WINDOWS\system32\T.COM
2007-12-08 14:59 . 2007-09-10 05:27 <DIR> d--h----- C:\Documents and Settings\Administrator\ćablony
2007-12-08 14:59 . 2007-09-10 07:18 <DIR> d-------- C:\Documents and Settings\Administrator\Plocha
2007-12-08 14:59 . 2007-09-10 07:18 <DIR> d--h----- C:\Documents and Settings\Administrator\Okolnˇ tisk rny
2007-12-08 14:59 . 2007-09-10 07:18 <DIR> d--h----- C:\Documents and Settings\Administrator\Okolnˇ sˇś
2007-12-08 14:59 . 2007-12-08 15:43 <DIR> d-------- C:\Documents and Settings\Administrator\Oblˇben‚ polo§ky
2007-12-08 14:59 . 2007-09-10 07:18 <DIR> dr------- C:\Documents and Settings\Administrator\Nabˇdka Start
2007-12-08 14:59 . 2007-09-10 07:18 <DIR> d-------- C:\Documents and Settings\Administrator\Dokumenty
2007-12-08 14:59 . 2007-09-10 07:18 <DIR> dr-h----- C:\Documents and Settings\Administrator\Data aplikacˇ
2007-12-08 14:32 . 2007-12-08 14:32 37,473 --a------ C:\WINDOWS\system32\muzika.xm
2007-12-08 14:29 . 2006-05-31 11:02 624,640 --a------ C:\WINDOWS\system32\aswBoot.exe
2007-12-08 14:29 . 2004-01-09 11:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2007-12-08 14:29 . 2006-05-31 10:54 90,112 --a------ C:\WINDOWS\system32\AVASTSS.scr
2007-12-08 14:29 . 2006-05-31 10:58 87,424 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-08 14:29 . 2006-05-31 10:58 85,760 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-08 14:29 . 2006-05-31 10:56 36,176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-08 14:29 . 2006-05-31 10:55 24,304 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-08 14:29 . 2006-05-31 10:56 16,352 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-08 14:13 . 2007-12-08 14:13 0 --a------ C:\WINDOWS\msnetuw.exe
2007-12-08 13:54 . 2007-12-08 13:54 138,624 --a------ C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
2007-12-08 13:49 . 2007-12-08 20:03 <DIR> d-------- C:\Program Files\Spyware Terminator
2007-12-08 13:49 . 2007-12-08 13:50 <DIR> d-------- C:\Program Files\Crawler
2007-12-08 13:29 . 2007-12-08 13:29 0 --a------ C:\WINDOWS\msnetgt.exe
2007-12-08 13:16 . 2007-12-08 13:16 <DIR> d-------- C:\Program Files\CCleaner
2007-12-08 13:14 . 2007-12-08 16:05 <DIR> d-------- C:\instal
2007-12-07 18:20 . 2007-12-07 18:20 0 --a------ C:\WINDOWS\msnetmx.exe
2007-12-07 06:49 . 2007-12-07 06:49 0 --a------ C:\WINDOWS\msnetim.exe
2007-12-04 14:42 . 2007-12-04 14:42 0 --a------ C:\WINDOWS\msnetln.exe
2007-12-04 07:15 . 2007-12-04 07:15 0 --a------ C:\WINDOWS\msnetex.exe
2007-12-04 07:06 . 2007-02-13 08:09 388,126 --a------ C:\WINDOWS\system32\sqlite3.dll
2007-12-03 12:29 . 2007-12-03 12:29 0 --a------ C:\WINDOWS\msnetbt.exe
2007-12-03 11:31 . 2007-12-03 11:31 0 --a------ C:\WINDOWS\msnetqo.exe
2007-12-03 08:57 . 2007-12-03 08:57 0 --a------ C:\WINDOWS\msnetdn.exe
2007-12-03 01:46 . 2007-12-03 01:46 10,240 --a------ C:\WINDOWS\system32\wsock3.dll
2007-12-03 01:46 . 2007-12-03 01:46 1 --a------ C:\WINDOWS\system32\tb.dr
2007-12-03 01:46 . 2007-12-03 01:46 1 --a------ C:\WINDOWS\system32\rc.dat
2007-12-03 01:46 . 2007-12-03 01:46 1 --a------ C:\WINDOWS\system32\ps1.dat
2007-12-03 01:46 . 2007-12-03 01:46 1 --a------ C:\WINDOWS\system32\cs.dat
2007-12-03 01:46 . 2007-12-03 01:46 1 --a------ C:\WINDOWS\system32\cookie1.dat
2007-12-03 01:32 . 2007-12-03 01:32 53,760 --a------ C:\WINDOWS\system32\tconn1.dll
2007-12-03 01:32 . 2007-12-03 01:32 11,876 --a------ C:\WINDOWS\msnetig.exe
2007-11-27 14:46 . 2007-11-27 14:46 35,328 --a------ C:\WINDOWS\msnetkn.exe
2007-11-26 12:10 . 2007-11-26 12:11 12,783 --a------ C:\WINDOWS\msnetqj.exe
2007-11-25 16:35 . 2007-11-25 16:35 0 --a------ C:\WINDOWS\msnetly.exe
2007-11-25 16:13 . 2007-11-25 16:13 <DIR> d-------- C:\Program Files\Elaborate Bytes
2007-11-24 13:24 . 2007-11-24 13:24 17,628 --a------ C:\WINDOWS\msnetby.exe
2007-11-19 08:31 . 2007-11-19 08:31 13,569 --a------ C:\syssyuw.exe
2007-11-19 07:17 . 2007-11-19 07:17 42,496 --a------ C:\wndosgy.exe
2007-11-14 07:43 . 2007-11-14 07:43 46,592 --a------ C:\wndvgzb.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-08 13:26 --------- d-----w C:\Program Files\ICQToolbar
2007-11-25 14:43 --------- d-----w C:\Program Files\ICQ6
2007-10-23 00:20 --------- d-----w C:\Program Files\Microsoft Games
2004-10-01 13:00 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B9249083-6055-476c-A69D-13E110BFEA91}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2005-06-02 15:03]
"timeNoticeSL001"="c:\syssyuw.exe" [2007-11-19 08:31]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"mouseElf"="C:\PROGRA~1\SCROLL~1\MouseElf.EXE" [2005-12-16 09:00]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-05-25 19:02]
"RTHDCPL"="RTHDCPL.EXE" [2006-10-30 18:49 C:\WINDOWS\RTHDCPL.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2006-05-31 12:02]
"SpywareTerminator"="C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe" [2007-12-08 13:50]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-17 14:49]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, xlibgfl254.dll

R1 sp_rsdrv2;Spyware Terminator Driver 2;\??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
R3 PSched;Plánovač paketů technologie QoS;C:\WINDOWS\system32\DRIVERS\psched.sys
S3 athr;Atheros Extensible Wireless LAN device driver;C:\WINDOWS\system32\DRIVERS\athr.sys
S3 genmcmn;Scroll Mouse Driver;C:\WINDOWS\system32\DRIVERS\gmfiltr.sys
S3 genmcmnUSB;USB Scroll Mouse Driver;C:\WINDOWS\system32\DRIVERS\gflmouhid.sys
S3 R300;R300;C:\WINDOWS\system32\DRIVERS\atikmdag.sys

.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180]
-> C:\WINDOWS\system32\wsock3.dll

PROCESS: C:\WINDOWS\Explorer.exe [6.00.2900.2180]
-> C:\DOCUME~1\dalibor\LOCALS~1\Temp\sgfujesrD306BFA.dll
.
**************************************************************************

catchme 0.3.1331 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-09 20:46:40
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-09 20:47:18 - machine was rebooted
.
--- E O F ---

Napsal: 09 pro 2007 13:01
od fredik
Dodrž prosím tě přesné pořadí kroků:

1)
Než budeme pokračovat, udělej prosím tě toto:

Stáhni si Suspicious File Packer
Rozbal ho a spusť ho (soubor sfp.exe)
Do okna které se ti zobrazí zkopíruj a vlož tento tučně označený text:
C:\WINDOWS\system32\tb.dr
C:\WINDOWS\system32\rc.dat
C:\WINDOWS\system32\ps1.dat
C:\WINDOWS\system32\cs.dat
C:\WINDOWS\system32\cookie1.dat
C:\WINDOWS\system32\tconn1.dll
C:\WINDOWS\msnetig.exe
C:\WINDOWS\msnetkn.exe
C:\WINDOWS\msnetqj.exe
C:\WINDOWS\msnetby.exe
C:\syssyuw.exe
C:\wndosgy.exe
C:\wndvgzb.exe

pak klikni na tlačítko Continue
Program se ti přepne do druhého okna Step2: Create archive
Zavři program.
Na ploše se ti vytvoří soubor requested-files[2007-07-30_HH_MM].cab (místo 2007-07-30 budeš mít aktuální datum a kde HH - hodina a MM minuty)

Pokud se ti daný soubor vytvoří zabal ho např. do zipu a vlož ho ke svému příspěvku jako přílohu.

Poznámka: Je možné že už dané soubory nebudeš mít na disku, takže se ti nemusí vytvořit archiv.

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
2)
Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok)
Zkopíruj do něj následující text označený zeleně:

Kód: Vybrat vše

File::
C:\WINDOWS\msnetgh.exe
C:\WINDOWS\msnetws.exe
C:\WINDOWS\msnetuw.exe
C:\WINDOWS\msnetgt.exe
C:\WINDOWS\msnetmx.exe
C:\WINDOWS\msnetim.exe
C:\WINDOWS\msnetln.exe
C:\WINDOWS\msnetex.exe
C:\WINDOWS\msnetbt.exe
C:\WINDOWS\msnetqo.exe
C:\WINDOWS\msnetdn.exe
C:\WINDOWS\msnetly.exe
C:\DOCUME~1\dalibor\LOCALS~1\Temp\sgfujesrD306BFA.dll

Folder::
C:\PrinterBegone

FileLook::
C:\WINDOWS\system32\wsock3.dll

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B9249083-6055-476c-A69D-13E110BFEA91}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"timeNoticeSL001"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť
Obrázek
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu

Poznámka:
Používáš starší verzi HijackThis, stáhni si aktuální verzi zde a tu starou před použitím vymaž.

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
V následujícím příspěvku sem vlož tyto logy/výsledky:
- vlož ke svému příspěvku archiv z Suspicious File Packer
- vlož sem log z ComboFix po použití skriptu, který se ti zobrazí
- nový log z HJT z aktuální verze.
Časové pásmo: UTC+02:00
Stránka 1 z 1
Powered by phpBB® Forum Software © phpBB Limited
https://www.phpbb.com/