log HJT - pomaly PC

willy51 · Příspěvekod **willy51** » 20 pro 2010 17:21

Ahoj,
pripajam log z HJT, prosim o pomoc... pocitac pracuje vcelku pomaly, AVIRA nasla a pravdepodobne uspesne zlikvidovala dva viry, no PC stale ostava dost nemotorny

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:18:38, on 20.12.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
H:\WINDOWS\System32\smss.exe
H:\WINDOWS\system32\winlogon.exe
H:\WINDOWS\system32\services.exe
H:\WINDOWS\system32\lsass.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\System32\svchost.exe
H:\WINDOWS\system32\spoolsv.exe
H:\Program Files\Avira\AntiVir Desktop\sched.exe
H:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
H:\Program Files\Avira\AntiVir Desktop\avguard.exe
H:\WINDOWS\ATKKBService.exe
H:\Program Files\Java\jre6\bin\jqs.exe
H:\WINDOWS\runservice.exe
H:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
H:\Program Files\CDBurnerXP\NMSAccessU.exe
H:\WINDOWS\system32\nvsvc32.exe
H:\Program Files\Avira\AntiVir Desktop\avshadow.exe
H:\WINDOWS\Explorer.EXE
H:\WINDOWS\system32\PnkBstrA.exe
H:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
H:\WINDOWS\system32\svchost.exe
H:\PROGRA~1\MEDIAK~1\MagicKey.exe
H:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe
H:\Program Files\ASUS\GamerOSD\GamerOSD.exe
H:\Program Files\Winamp\winampa.exe
H:\PROGRA~1\MEDIAK~1\OSD.exe
H:\WINDOWS\system32\RUNDLL32.EXE
H:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
H:\Program Files\Avira\AntiVir Desktop\avgnt.exe
H:\Program Files\Java\jre6\bin\jusched.exe
H:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
H:\hry\warcraft 3\Warcraft III\w3dr.exe
H:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
H:\WINDOWS\PixArt\PAC207\Monitor.exe
H:\WINDOWS\system32\ctfmon.exe
H:\Program Files\DAEMON Tools Lite\DTLite.exe
H:\Program Files\Light Downloader\ldm.exe
H:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
H:\Program Files\PC Connectivity Solution\ServiceLayer.exe
H:\Program Files\Opera\opera.exe
H:\Program Files\Java\jre6\bin\jucheck.exe
H:\WINDOWS\system32\msiexec.exe
H:\Program Files\hijackthis\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.facemoods.com/?a=ppcb
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=ppcb&s={searchTerms}&f=4
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 200.242.2.162:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - H:\Program Files\Ask.com\GenericAskToolbar.dll
R3 - URLSearchHook: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - H:\Program Files\free-downloads.net\tbfre2.dll
R3 - URLSearchHook: DVDVideoSoftTB Toolbar - {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - H:\Program Files\DVDVideoSoft\tbDVD2.dll
R3 - URLSearchHook: Free Lunch Design Toolbar - {57cc715d-37ca-44e4-9ec2-8c2cbddb25ec} - H:\Program Files\Free_Lunch_Design\tbFre2.dll
R3 - URLSearchHook: Movier-media Toolbar - {ce10bf86-da68-441e-91fa-38336363e3cd} - H:\Program Files\Movier-media\tbMovi.dll
R3 - URLSearchHook: Softonic-Eng7 Toolbar - {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - H:\Program Files\Softonic-Eng7\tbSoft.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - H:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - H:\Program Files\ConduitEngine\ConduitEngine.dll
O2 - BHO: Softonic-Eng7 Toolbar - {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - H:\Program Files\Softonic-Eng7\tbSoft.dll
O2 - BHO: Free Lunch Design Toolbar - {57cc715d-37ca-44e4-9ec2-8c2cbddb25ec} - H:\Program Files\Free_Lunch_Design\tbFre2.dll
O2 - BHO: FDMIECookiesBHO Class - {7A780B7B-DCF1-4ec4-BB13-2DF92CAD27DB} - H:\Program Files\Light Downloader\ldmie2.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - h:\program files\google\googletoolbar1.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - H:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Movier-media Toolbar - {ce10bf86-da68-441e-91fa-38336363e3cd} - H:\Program Files\Movier-media\tbMovi.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - H:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - H:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - H:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: DVDVideoSoftTB Toolbar - {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - H:\Program Files\DVDVideoSoft\tbDVD2.dll
O2 - BHO: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - H:\Program Files\free-downloads.net\tbfre2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - h:\program files\google\googletoolbar1.dll
O3 - Toolbar: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - H:\Program Files\free-downloads.net\tbfre2.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - H:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: DVDVideoSoftTB Toolbar - {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - H:\Program Files\DVDVideoSoft\tbDVD2.dll
O3 - Toolbar: Free Lunch Design Toolbar - {57cc715d-37ca-44e4-9ec2-8c2cbddb25ec} - H:\Program Files\Free_Lunch_Design\tbFre2.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - H:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: Movier-media Toolbar - {ce10bf86-da68-441e-91fa-38336363e3cd} - H:\Program Files\Movier-media\tbMovi.dll
O3 - Toolbar: Softonic-Eng7 Toolbar - {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - H:\Program Files\Softonic-Eng7\tbSoft.dll
O3 - Toolbar: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - H:\Program Files\ConduitEngine\ConduitEngine.dll
O4 - HKLM\..\Run: [MagicKey] H:\PROGRA~1\MEDIAK~1\MagicKey.exe
O4 - HKLM\..\Run: [HDAudDeck] H:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1
O4 - HKLM\..\Run: [ASUSGamerOSD] H:\Program Files\ASUS\GamerOSD\GamerOSD.exe
O4 - HKLM\..\Run: [WinampAgent] "H:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE H:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE H:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PCSuiteTrayApplication] H:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [Adobe Photo Downloader] "H:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [avgnt] "H:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "H:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "H:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [QuickTime Task] "H:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [w3dr.exe] H:\hry\warcraft 3\Warcraft III\w3dr.exe
O4 - HKLM\..\Run: [ArcSoft Connection Service] H:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [PAC207_Monitor] H:\WINDOWS\PixArt\PAC207\Monitor.exe
O4 - HKLM\..\Run: [Monitor] H:\WINDOWS\PixArt\PAC207\Monitor.exe
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "H:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKCU\..\Run: [ctfmon.exe] H:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "H:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [DAEMON Tools Lite] "H:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [Light Downloader] "H:\Program Files\Light Downloader\ldm.exe" -autorun
O4 - HKCU\..\Run: [Google Update] "H:\Documents and Settings\Vilo\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] H:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = H:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = H:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = H:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O8 - Extra context menu item: &Google Search - res://H:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://H:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://H:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Download all with Light Downloader - file://H:\Program Files\Light Downloader\dlall.htm
O8 - Extra context menu item: Download selected with Light Downloader - file://H:\Program Files\Light Downloader\dlselected.htm
O8 - Extra context menu item: Download video with Light Downloader - file://H:\Program Files\Light Downloader\dlfvideo.htm
O8 - Extra context menu item: Download with Light Downloader - file://H:\Program Files\Light Downloader\dllink.htm
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://H:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://H:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://H:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - H:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - H:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Zdroje informácií - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - H:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - H:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - H:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://icq.oberon-media.com/Gameshell/G ... meHost.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{41C04E3C-606D-4C4E-8D6C-3E91063BB482}: NameServer = 208.67.222.222,208.67.220.220
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - H:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - H:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: H:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - H:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - H:\WINDOWS\system32\browseui.dll
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - H:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Adobe LM Service - Adobe Systems - H:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - H:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - H:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - H:\WINDOWS\ATKKBService.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - H:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Desktop Manager 5.9.1005.12335 (GoogleDesktopManager-051210-111108) - Google - H:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - H:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - H:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - H:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - H:\WINDOWS\runservice.exe
O23 - Service: NMSAccessU - Unknown owner - H:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - H:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - H:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia. - H:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - H:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

--
End of file - 14167 bytes

Reklama

Příspěvekod **jaro3** » 21 pro 2010 17:30

Odinstaluj:
Ask.com,GenericAskToolbar
Free Lunch Design Toolbar
free-downloads.net Toolbar
DVDVideoSoftTB Toolbar
Movier-media Toolbar
Softonic-Eng7 Toolbar
DAEMON Tools Toolbar

Používáš tuto proxy:
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 200.242.2.162:8080??

Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:
Návod

Kód: Vybrat vše

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.facemoods.com/?a=ppcb
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=ppcb&s={searchTerms}&f=4
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - H:\Program Files\Ask.com\GenericAskToolbar.dll
R3 - URLSearchHook: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - H:\Program Files\free-downloads.net\tbfre2.dll
R3 - URLSearchHook: DVDVideoSoftTB Toolbar - {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - H:\Program Files\DVDVideoSoft\tbDVD2.dll
R3 - URLSearchHook: Free Lunch Design Toolbar - {57cc715d-37ca-44e4-9ec2-8c2cbddb25ec} - H:\Program Files\Free_Lunch_Design\tbFre2.dll
R3 - URLSearchHook: Movier-media Toolbar - {ce10bf86-da68-441e-91fa-38336363e3cd} - H:\Program Files\Movier-media\tbMovi.dll
R3 - URLSearchHook: Softonic-Eng7 Toolbar - {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - H:\Program Files\Softonic-Eng7\tbSoft.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - H:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Softonic-Eng7 Toolbar - {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - H:\Program Files\Softonic-Eng7\tbSoft.dll
O2 - BHO: Free Lunch Design Toolbar - {57cc715d-37ca-44e4-9ec2-8c2cbddb25ec} - H:\Program Files\Free_Lunch_Design\tbFre2.dll
O2 - BHO: Movier-media Toolbar - {ce10bf86-da68-441e-91fa-38336363e3cd} - H:\Program Files\Movier-media\tbMovi.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - H:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: DVDVideoSoftTB Toolbar - {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - H:\Program Files\DVDVideoSoft\tbDVD2.dll
O2 - BHO: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - H:\Program Files\free-downloads.net\tbfre2.dll
O3 - Toolbar: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - H:\Program Files\free-downloads.net\tbfre2.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - H:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: DVDVideoSoftTB Toolbar - {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - H:\Program Files\DVDVideoSoft\tbDVD2.dll
O3 - Toolbar: Free Lunch Design Toolbar - {57cc715d-37ca-44e4-9ec2-8c2cbddb25ec} - H:\Program Files\Free_Lunch_Design\tbFre2.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - H:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: Movier-media Toolbar - {ce10bf86-da68-441e-91fa-38336363e3cd} - H:\Program Files\Movier-media\tbMovi.dll
O3 - Toolbar: Softonic-Eng7 Toolbar - {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - H:\Program Files\Softonic-Eng7\tbSoft.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "H:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "H:\Program Files\QuickTime\QTTask.exe" –atboottime
O4 - Global Startup: Adobe Reader Speed Launch.lnk = H:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://icq.oberon-media.com/Gameshell/G ... meHost.cab

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

Vypni si rez.ochrany i firewall.
Stáhni si Dr. Web CureIt
dej update , po aktualizaci dej start.
Tlacitky dole můzeš soubor léčit(systémové soubory), smazat, přesunout nebo přejmenovat

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

Pokud budou problémy , spusť v nouz. režimu.

willy51 · Příspěvekod **willy51** » 21 pro 2010 21:35

proxy vedome pokial viem nepouzivam

tu je mbam log:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Verze databáze: 5367

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

21.12.2010 21:32:04
mbam-log-2010-12-21 (21-32-01).txt

Typ kontroly: Rychlý test
Testované objekty: 168003
Uplynulý čas: 19 minut, 41 sekund

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 0
Infikované hodnoty v registru: 0
Infikované datové položky v registru: 0
Infikované složky: 0
Infikované soubory: 1

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
h:\documents and settings\Vilo\data aplikací\wiaserva.log (Malware.Trace) -> No action taken.

Příspěvekod **memphisto** » 21 pro 2010 21:41

- Takže spusť znovu MbAM a dej Scan
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Show Results
- ujistit se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Remove Selected
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Exit

Vypni rezidentní štít antiviru a antispywaru
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

willy51 · Příspěvekod **willy51** » 21 pro 2010 22:44

mbam log:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Verze databáze: 5367

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

21.12.2010 22:06:21
mbam-log-2010-12-21 (22-06-21).txt

Typ kontroly: Rychlý test
Testované objekty: 167930
Uplynulý čas: 20 minut, 4 sekund

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 0
Infikované hodnoty v registru: 0
Infikované datové položky v registru: 0
Infikované složky: 0
Infikované soubory: 1

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
h:\documents and settings\Vilo\data aplikací\wiaserva.log (Malware.Trace) -> Quarantined and deleted successfully.

combofix log:

ComboFix 10-12-21.01 - Vilo 21.12.2010 22:25:56.3.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.2047.1544 [GMT 1:00]
Spuštěný z: h:\documents and settings\Vilo\Plocha\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

h:\documents and settings\Vilo\Data aplikací\facemoods.com
h:\documents and settings\Vilo\Data aplikací\facemoods.com\facemoods\Online Games.ico
h:\documents and settings\Vilo\Data aplikací\PriceGong
h:\documents and settings\Vilo\Data aplikací\PriceGong\Data\1.xml
h:\documents and settings\Vilo\Data aplikací\PriceGong\Data\a.xml
h:\documents and settings\Vilo\Data aplikací\PriceGong\Data\b.xml
h:\documents and settings\Vilo\Data aplikací\PriceGong\Data\c.xml
h:\documents and settings\Vilo\Data aplikací\PriceGong\Data\d.xml
h:\documents and settings\Vilo\Data aplikací\PriceGong\Data\e.xml
h:\documents and settings\Vilo\Data aplikací\PriceGong\Data\f.xml
h:\documents and settings\Vilo\Data aplikací\PriceGong\Data\g.xml
h:\documents and settings\Vilo\Data aplikací\PriceGong\Data\h.xml
h:\documents and settings\Vilo\Data aplikací\PriceGong\Data\i.xml
h:\documents and settings\Vilo\Data aplikací\PriceGong\Data\J.xml
h:\documents and settings\Vilo\Data aplikací\PriceGong\Data\k.xml
h:\documents and settings\Vilo\Data aplikací\PriceGong\Data\l.xml
h:\documents and settings\Vilo\Data aplikací\PriceGong\Data\m.xml
h:\documents and settings\Vilo\Data aplikací\PriceGong\Data\mru.xml
h:\documents and settings\Vilo\Data aplikací\PriceGong\Data\n.xml
h:\documents and settings\Vilo\Data aplikací\PriceGong\Data\o.xml
h:\documents and settings\Vilo\Data aplikací\PriceGong\Data\p.xml
h:\documents and settings\Vilo\Data aplikací\PriceGong\Data\q.xml
h:\documents and settings\Vilo\Data aplikací\PriceGong\Data\r.xml
h:\documents and settings\Vilo\Data aplikací\PriceGong\Data\s.xml
h:\documents and settings\Vilo\Data aplikací\PriceGong\Data\t.xml
h:\documents and settings\Vilo\Data aplikací\PriceGong\Data\u.xml
h:\documents and settings\Vilo\Data aplikací\PriceGong\Data\v.xml
h:\documents and settings\Vilo\Data aplikací\PriceGong\Data\w.xml
h:\documents and settings\Vilo\Data aplikací\PriceGong\Data\x.xml
h:\documents and settings\Vilo\Data aplikací\PriceGong\Data\y.xml
h:\documents and settings\Vilo\Data aplikací\PriceGong\Data\z.xml
h:\documents and settings\Vilo\Recent\Thumbs.db
h:\program files\INSTALL.LOG

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-11-21 do 2010-12-21 )))))))))))))))))))))))))))))))
.

2010-12-21 20:10 . 2010-12-21 20:10 -------- d-----w- h:\documents and settings\Vilo\Data aplikací\Malwarebytes
2010-12-21 20:09 . 2010-12-20 17:09 38224 ----a-w- h:\windows\system32\drivers\mbamswissarmy.sys
2010-12-21 20:09 . 2010-12-21 20:09 -------- d-----w- h:\documents and settings\All Users\Data aplikací\Malwarebytes
2010-12-21 20:09 . 2010-12-21 20:09 -------- d-----w- h:\program files\Malwarebytes' Anti-Malware
2010-12-21 20:09 . 2010-12-20 17:08 20952 ----a-w- h:\windows\system32\drivers\mbam.sys
2010-12-21 18:55 . 2010-12-21 19:40 -------- d-----w- h:\documents and settings\Vilo\DoctorWeb
2010-12-20 16:17 . 2010-12-20 16:17 388096 ----a-r- h:\documents and settings\Vilo\Data aplikací\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-12-17 09:07 . 2010-12-17 09:07 -------- d-----w- h:\documents and settings\skúška\Data aplikací\ArcSoft
2010-12-12 17:25 . 2010-12-18 19:36 -------- d---a-w- h:\documents and settings\All Users\Data aplikací\TEMP
2010-12-12 17:20 . 2010-12-12 17:20 -------- d-----w- h:\program files\Vstplugins
2010-12-11 12:07 . 2010-12-11 12:07 -------- d-----w- h:\program files\Common Files\Macrovision Shared
2010-12-11 11:13 . 2010-12-11 11:13 -------- d-----w- h:\program files\Common Files\Skype
2010-12-05 20:55 . 2010-12-05 20:55 -------- d-----w- h:\documents and settings\Vilo\Data aplikací\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2010-11-27 18:39 . 2010-11-27 18:39 -------- d-----w- h:\program files\Adobe Media Player
2010-11-27 18:33 . 2010-11-27 18:33 -------- d-----w- h:\program files\Common Files\Adobe AIR

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-21 17:31 . 2008-07-31 17:44 196608 ----a-w- h:\windows\system32\drivers\nStandard.bin
2010-12-12 12:01 . 2009-08-08 08:01 135096 ----a-w- h:\windows\system32\drivers\avipbb.sys
2010-11-25 13:46 . 2009-08-08 08:01 61960 ----a-w- h:\windows\system32\drivers\avgntflt.sys
2010-02-10 14:18 . 2010-03-30 12:02 2131336 ----a-w- h:\program files\Common Files\AskToolbarInstaller.exe
2010-07-20 09:47 . 2009-11-28 12:29 119808 ----a-w- h:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AlcoholAutomount"="h:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2009-04-24 203928]
"DAEMON Tools Lite"="h:\program files\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200]
"Light Downloader"="h:\program files\Light Downloader\ldm.exe" [2010-02-01 3264583]
"Google Update"="h:\documents and settings\Vilo\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" [2010-06-15 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MagicKey"="h:\progra~1\MEDIAK~1\MagicKey.exe" [2004-03-15 45056]
"HDAudDeck"="h:\program files\VIA\VIAudioi\HDADeck\HDeck.exe" [2008-01-14 29753344]
"ASUSGamerOSD"="h:\program files\ASUS\GamerOSD\GamerOSD.exe" [2007-09-13 380928]
"WinampAgent"="h:\program files\Winamp\winampa.exe" [2008-01-15 37376]
"NvCplDaemon"="h:\windows\system32\NvCpl.dll" [2007-09-16 8491008]
"nwiz"="nwiz.exe" [2007-09-16 1626112]
"NvMediaCenter"="h:\windows\system32\NvMcTray.dll" [2007-09-16 81920]
"PCSuiteTrayApplication"="h:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 227328]
"Adobe Photo Downloader"="h:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 57344]
"avgnt"="h:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-04 281768]
"Google Desktop Search"="h:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-07-20 30192]
"w3dr.exe"="h:\hry\warcraft 3\Warcraft III\w3dr.exe" [2008-08-03 61440]
"ArcSoft Connection Service"="h:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-27 207424]
"PAC207_Monitor"="h:\windows\PixArt\PAC207\Monitor.exe" [2007-12-10 323584]
"Monitor"="h:\windows\PixArt\PAC207\Monitor.exe" [2007-12-10 323584]
"AdobeCS4ServiceManager"="h:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="h:\windows\system32\CTFMON.EXE" [2004-08-17 15360]
"Nokia.PCSync"="h:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 1744896]

h:\documents and settings\Vilo\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Gamma.lnk - h:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]

h:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
InterVideo WinCinema Manager.lnk - h:\program files\InterVideo\Common\Bin\WinCinemaMgr.exe [2008-7-31 303104]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"h:\\WINDOWS\\system32\\PnkBstrA.exe"=
"h:\\WINDOWS\\system32\\PnkBstrB.exe"=
"h:\\Program Files\\ICQ6.5\\ICQ.exe"=
"h:\\hry\\warcraft 3\\Warcraft III\\war3.exe"=
"h:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"h:\\WINDOWS\\system32\\dplaysvr.exe"=
"h:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"h:\\Program Files\\Opera\\opera.exe"=
"h:\\Program Files\\uTorrent\\utorrent.exe"=
"h:\\Program Files\\QIP\\qip.exe"=
"h:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
"h:\\Program Files\\Sierra\\Homeworld2\\Bin\\Release\\Homeworld2.exe"=
"h:\\WINDOWS\\system32\\dpnsvr.exe"=
"h:\\hry\\wesnoth\\wesnothd.exe"=
"h:\\Documents and Settings\\Vilo\\Plocha\\Age_of_empires_II\\Age of empires\\age2_x1.exe"=
"h:\\Documents and Settings\\Vilo\\Plocha\\Age_of_empires_II\\Age of empires\\empires2.exe"=
"h:\\hry\\warcraft 3\\Warcraft III\\Warcraft III.exe"=
"h:\\Program Files\\Skype\\Phone\\Skype.exe"=
"h:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"h:\\Program Files\\Sony\\Vegas Pro 8.0\\VegSrv80.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\globallyopenports\list]
"6112:UDP"= 6112:UDP:w3
"5353:TCP"= 5353:TCP:Adobe CSI CS4

R0 sptd;sptd;h:\windows\system32\drivers\sptd.sys [29.10.2008 17:06 691696]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;h:\program files\Avira\AntiVir Desktop\sched.exe [8.8.2009 9:01 135336]
R2 LicCtrlService;LicCtrl Service;h:\windows\Runservice.exe [24.2.2009 11:44 2560]
R3 PAC207;PC Camer@;h:\windows\system32\drivers\PFC027.SYS [8.11.2010 17:57 618112]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;h:\windows\system32\drivers\viahduaa.sys [31.7.2008 18:36 215936]
S0 xsxfycwp;xsxfycwp;h:\windows\system32\drivers\xqlma.sys --> h:\windows\system32\drivers\xqlma.sys [?]
S2 gupdate;Google Update Service (gupdate);h:\program files\Google\Update\GoogleUpdate.exe [8.11.2009 19:29 135664]
S3 androidusb;ADB Interface Driver;h:\windows\system32\drivers\fxxandroidusb.sys [16.7.2010 19:02 25728]
S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;h:\program files\Google\Google Desktop Search\GoogleDesktop.exe [31.7.2008 18:53 30192]
S3 qcusbser;Qualcomm USB Device for Legacy Serial Communication;h:\windows\system32\drivers\FXX\qcusbser.sys [16.7.2010 19:04 103424]
S3 wip0204;Wippien Network Adapter 2.4;h:\windows\system32\drivers\wip0204.sys [8.6.2010 12:18 23480]
.
Obsah adresáře 'Naplánované úlohy'

2010-11-03 h:\windows\Tasks\AppleSoftwareUpdate.job
- h:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2010-12-21 h:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- h:\program files\Google\Update\GoogleUpdate.exe [2009-11-08 18:28]

2010-12-21 h:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- h:\program files\Google\Update\GoogleUpdate.exe [2009-11-08 18:28]
.
.
------- Doplňkový sken -------
.
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyServer = 200.242.2.162:8080
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: &Google Search - h:\program files\Google\GoogleToolbar1.dll/cmsearch.html
IE: Backward Links - h:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - h:\program files\Google\GoogleToolbar1.dll/cmcache.html
IE: Download all with Light Downloader - file://h:\program files\Light Downloader\dlall.htm
IE: Download selected with Light Downloader - file://h:\program files\Light Downloader\dlselected.htm
IE: Download video with Light Downloader - file://h:\program files\Light Downloader\dlfvideo.htm
IE: Download with Light Downloader - file://h:\program files\Light Downloader\dllink.htm
IE: E&xportovať do programu Microsoft Excel - h:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Similar Pages - h:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate into English - h:\program files\Google\GoogleToolbar1.dll/cmtrans.html
TCP: {41C04E3C-606D-4C4E-8D6C-3E91063BB482} = 208.67.222.222,208.67.220.220
FF - ProfilePath - h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.as ... ource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: browser.startup.homepage - hxxp://start.facemoods.com/?a=ppcb
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - h:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - h:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - Ext: Conduit Engine : engine@conduit.com - %profile%\extensions\engine@conduit.com
FF - Ext: Facemoods: ffxtlbr@Facemoods.com - %profile%\extensions\ffxtlbr@Facemoods.com
FF - Ext: TVU Web Player: firefox@tvunetworks.com - %profile%\extensions\firefox@tvunetworks.com
FF - Ext: Softonic-Eng7 Community Toolbar: {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - %profile%\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}
FF - Ext: Free Lunch Design Toolbar: {57cc715d-37ca-44e4-9ec2-8c2cbddb25ec} - %profile%\extensions\{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}
FF - Ext: DVDVideoSoftTB Toolbar: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - %profile%\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
FF - Ext: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - %profile%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF - Ext: Greasemonkey: {e4a8a97b-f2ed-450b-b12d-ee082ba24781} - %profile%\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
FF - Ext: DVDVideoSoft Toolbar: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - %profile%\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}
FF - Ext: Java Quick Starter: jqs@sun.com - h:\program files\Java\jre6\lib\deploy\jqs\ff
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKCU-Run-AdobeBridge - (no file)
AddRemove-82A44D22-9452-49FB-00FB-CEC7DCAF7E23 - h:\program files\EA SPORTS\EA SPORTS online\EASOUNInstaller.exe
AddRemove-Free Audio CD Burner_is1 - h:\program files\DVDVideoSoft\Free Audio CD Burner\unins000.exe
AddRemove-Free Video to Flash Converter_is1 - h:\program files\DVDVideoSoft\Free Video to Flash Converter\unins000.exe
AddRemove-Free Video to MP3 Converter_is1 - h:\program files\DVDVideoSoft\Free Video to MP3 Converter\unins000.exe
AddRemove-Free YouTube to MP3 Converter_is1 - h:\program files\DVDVideoSoft\Free YouTube to MP3 Converter\unins000.exe
AddRemove-{F596C356-BF35-4ED7-981C-CC791461A8F0} - h:\program files\InstallShield Installation Information\{F596C356-BF35-4ED7-981C-CC791461A8F0}\setup.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-12-21 22:35
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HDAudDeck = h:\program files\VIA\VIAudioi\HDADeck\HDeck.exe 1????????????????????????????????????????????????

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1606980848-1788223648-725345543-1003\Software\SecuROM\License information*]
"datasecu"=hex:be,65,53,a6,6b,f7,c5,df,5b,2a,a7,9f,66,b0,b3,15,c6,99,8f,04,4d,
d3,a5,69,30,bb,70,d3,f6,7f,c4,f7,87,33,ba,38,9b,5d,2f,c4,c1,43,dc,52,a7,17,\
"rkeysecu"=hex:5c,03,2c,c7,5f,4f,87,31,f0,70,e3,22,4f,fc,8b,86

[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \EC1A69D1C0948222]
"1"=hex:b0,cd,e0,26,42,20,9e,7c,08,f1,c1,23,e7,41,66,ec,c9,e0,20,43,a1,23,f2,
e3
"2"=hex:f1,df,16,de,80,08,0e,2a,78,a4,28,cb,d2,56,ff,58,a6,09,d8,fb,43,e9,d5,
e7,16,83,71,61,5d,be,d8,25
"3"=hex:b0,cd,e0,26,42,20,9e,7c,08,f1,c1,23,e7,41,66,ec,2b,92,4b,0d,22,14,9d,
cb,e3,f8,73,90,7d,a4,36,0d,7e,db,3a,16,4c,1a,45,81,b1,a5,77,31,f5,50,d6,e8

[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \EC1A69D1C0948222\48236A7EED3B8895E98434D6DCE253AC]
"1"=hex:08,26,de,b9,bd,1e,cc,2a,55,96,fd,b8,7e,1b,23,82,71,bb,5a,5f,e0,12,25,
42,0c,3f,30,d4,d3,b8,cd,35,d5,a9,6f,e0,2c,05,4e,14
"2"=hex:58,92,5a,34,3f,c6,a5,c5
"3"=hex:a3,4d,5c,d2,fe,75,65,8b,5a,3b,ad,16,6a,47,58,cb,e7,12,90,e7,19,31,d3,
4e,6a,6c,45,01,9a,bb,9c,94,70,38,3d,f8,02,58,8f,c7,65,6c,33,6e,01,ab,24,e9,\
"4"=hex:2f,ad,a2,e7,8a,bf,05,5e
"5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55,
1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\
"6"=hex:bf,e5,23,7b,b0,66,d6,fc,bc,64,22,fb,7e,d3,39,3e,a3,00,33,13,c0,21,f4,
51,6c,4e,0c,96,e2,dd,ad,8a,b6,c4,05,e8,5a,bd,9a,e9,d4,1a,3d,68,9d,00,32,20
"7"=hex:08,26,de,b9,bd,1e,cc,2a,55,96,fd,b8,7e,1b,23,82,71,bb,5a,5f,e0,12,25,
42,0c,3f,30,d4,d3,b8,cd,35,61,5a,c0,6c,22,7e,83,13,6e,44,91,28,69,cc,01,dd
"8"=hex:f2,80,0d,7f,fe,b9,cf,0a,62,bc,95,c6,fe,82,c9,e7,7a,39,50,43,38,08,ae,
25,34,fe,c5,b3,14,04,32,c8
"9"=hex:81,20,8f,ab,28,6a,52,9c
"18"=hex:70,56,26,33,e3,20,f8,ab
"10"=hex:a7,d5,9c,a7,24,6a,5a,bc
"11"=hex:81,20,8f,ab,28,6a,52,9c
"12"=hex:81,20,8f,ab,28,6a,52,9c
"13"=hex:81,20,8f,ab,28,6a,52,9c
"14"=hex:81,20,8f,ab,28,6a,52,9c
"24"=hex:81,20,8f,ab,28,6a,52,9c
"26"=hex:81,20,8f,ab,28,6a,52,9c
"27"=hex:81,20,8f,ab,28,6a,52,9c
"19"=hex:81,20,8f,ab,28,6a,52,9c
"22"=hex:81,20,8f,ab,28,6a,52,9c

[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \EC1A69D1C0948222\B144CCE307E78EB6EE53CA2196E4D0A2]
"1"=hex:97,5e,49,d3,7c,a0,18,18,10,c9,e3,e3,c1,ae,57,ed,60,42,a5,db,24,eb,e2,
b0,36,d7,56,53,fe,9f,3d,f9
"2"=hex:8c,23,2d,03,75,bd,a0,cd
"3"=hex:89,8a,74,86,09,98,71,d4,16,e8,e2,9b,1e,d2,90,60,88,3e,e0,61,4a,a1,c5,
59,3f,e9,d9,46,57,4a,8d,d8,50,05,f4,b6,c1,b6,2d,ee,67,48,fe,54,df,a8,d1,7d,\
"4"=hex:2f,ad,a2,e7,8a,bf,05,5e
"5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55,
1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\
"6"=hex:bf,e5,23,7b,b0,66,d6,fc,bc,64,22,fb,7e,d3,39,3e,a3,00,33,13,c0,21,f4,
51,6c,4e,0c,96,e2,dd,ad,8a,b6,c4,05,e8,5a,bd,9a,e9,d4,1a,3d,68,9d,00,32,20
"7"=hex:6b,96,68,24,0f,2f,9e,94,e8,ce,54,f3,3b,80,63,3a,1b,c3,e7,ed,44,3a,1d,
97,9f,f9,03,77,68,81,1b,0c,34,a2,88,30,12,be,09,a0
"8"=hex:be,1e,1b,5b,46,ce,bd,af,06,c0,57,de,a3,1c,52,0a,b6,95,00,63,ba,3d,d1,
21,f3,59,b1,30,47,70,f4,7c
"9"=hex:81,20,8f,ab,28,6a,52,9c
"18"=hex:70,56,26,33,e3,20,f8,ab
"10"=hex:07,96,b3,35,9e,5a,1a,0b
"11"=hex:81,20,8f,ab,28,6a,52,9c
"12"=hex:81,20,8f,ab,28,6a,52,9c
"13"=hex:81,20,8f,ab,28,6a,52,9c
"14"=hex:81,20,8f,ab,28,6a,52,9c
"24"=hex:81,20,8f,ab,28,6a,52,9c
"26"=hex:81,20,8f,ab,28,6a,52,9c
"27"=hex:81,20,8f,ab,28,6a,52,9c
"19"=hex:81,20,8f,ab,28,6a,52,9c
"22"=hex:81,20,8f,ab,28,6a,52,9c
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(796)
h:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll

- - - - - - - > 'explorer.exe'(2396)
h:\windows\system32\msi.dll
h:\windows\system32\WPDShServiceObj.dll
h:\program files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll
h:\program files\Nokia\Nokia PC Suite 6\PCSCM.dll
h:\program files\Nokia\Nokia PC Suite 6\Lang\PhoneBrowser_slk.nlr
h:\program files\Nokia\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr
h:\windows\system32\PortableDeviceTypes.dll
h:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
h:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
h:\program files\Avira\AntiVir Desktop\avguard.exe
h:\windows\ATKKBService.exe
h:\program files\Java\jre6\bin\jqs.exe
h:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
h:\program files\CDBurnerXP\NMSAccessU.exe
h:\windows\system32\nvsvc32.exe
h:\program files\Avira\AntiVir Desktop\avshadow.exe
h:\windows\system32\PnkBstrA.exe
h:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
h:\progra~1\MEDIAK~1\OSD.exe
h:\windows\system32\RUNDLL32.EXE
h:\windows\system32\wscntfy.exe
h:\program files\PC Connectivity Solution\ServiceLayer.exe
.
**************************************************************************
.
Celkový čas: 2010-12-21 22:42:11 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-12-21 21:42

Před spuštěním: Volných bajtů: 16 330 350 592
Po spuštění: Volných bajtů: 22 434 197 504

- - End Of File - - 0D8F03B82921E6A03D0DDCF9E60DECEC

Příspěvekod **memphisto** » 21 pro 2010 23:19

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

File::
h:\program files\Common Files\AskToolbarInstaller.exe
h:\windows\system32\drivers\xqlma.sys

Driver::
xsxfycwp

Firefox::
FF - ProfilePath - h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.as ... ource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: browser.startup.homepage - hxxp://start.facemoods.com/?a=ppcb
FF - Ext: Conduit Engine : engine@conduit.com - %profile%\extensions\engine@conduit.com
FF - Ext: Facemoods: ffxtlbr@Facemoods.com - %profile%\extensions\ffxtlbr@Facemoods.com
FF - Ext: Softonic-Eng7 Community Toolbar: {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - %profile%\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}
FF - Ext: Free Lunch Design Toolbar: {57cc715d-37ca-44e4-9ec2-8c2cbddb25ec} - %profile%\extensions\{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}
FF - Ext: DVDVideoSoftTB Toolbar: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - %profile%\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
FF - Ext: DVDVideoSoft Toolbar: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - %profile%\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu

willy51 · Příspěvekod **willy51** » 21 pro 2010 23:52

ComboFix 10-12-21.01 - Vilo 21.12.2010 23:34:38.4.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.2047.1528 [GMT 1:00]
Spuštěný z: h:\documents and settings\Vilo\Plocha\ComboFix.exe
Použité ovládací přepínače :: h:\documents and settings\Vilo\Plocha\CFScript.txt
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}

FILE ::
"h:\program files\Common Files\AskToolbarInstaller.exe"
"h:\windows\system32\drivers\xqlma.sys"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}\components\ConduitAutoCompleteSearch.js
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}\components\ConduitAutoCompleteSearch.xpt
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}\components\ConduitToolbar.idl
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}\components\ConduitToolbar.js
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}\components\ConduitToolbar.xpt
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}\components\FFExternalAlert.dll
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}\components\FFExternalAlert.xpt
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}\components\RadioWMPCore.dll
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}\components\RadioWMPCore.xpt
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}\defaults\alertSettingsComponent.xml
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}\defaults\appContextMenu.xml
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}\defaults\engineContextMenu.xml
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}\defaults\engineSettings.json
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}\defaults\fbAlert.js
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}\defaults\getAppsContextMenu.xml
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}\defaults\postAppsContextMenu.xml
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}\defaults\toolbarContextMenu.xml
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}\defaults\unsharedAppsContextMenu.xml
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}\chrome.manifest
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}\chrome\softonic-eng7.jar
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}\install.rdf
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}\lib\xpcom.js
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}\META-INF\manifest.mf
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}\META-INF\zigbert.rsa
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}\META-INF\zigbert.sf
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}\searchplugin\conduit.gif
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}\searchplugin\conduit.ico
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}\searchplugin\conduit.PNG
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}\searchplugin\conduit.src
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}\searchplugin\conduit.xml
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}\setup.ini
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}\version.txt
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}\components\ConduitAutoCompleteSearch.js
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}\components\ConduitAutoCompleteSearch.xpt
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}\components\ConduitToolbar.idl
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}\components\ConduitToolbar.js
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}\components\ConduitToolbar.xpt
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}\components\FFExternalAlert.dll
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}\components\FFExternalAlert.xpt
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}\components\RadioWMPCore.dll
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}\components\RadioWMPCore.xpt
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}\defaults\default_radio_skin.xml
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}\defaults\fbAlert.js
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}\chrome.manifest
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}\chrome\free_lunch_design.jar
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}\install.rdf
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}\lib\xpcom.js
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}\META-INF\manifest.mf
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}\META-INF\zigbert.rsa
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}\META-INF\zigbert.sf
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}\searchplugin\conduit.gif
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}\searchplugin\conduit.ico
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}\searchplugin\conduit.PNG
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}\searchplugin\conduit.src
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}\searchplugin\conduit.xml
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}\version.txt
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\ConduitAutoCompleteSearch.js
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\ConduitAutoCompleteSearch.xpt
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\ConduitToolbar.idl
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\ConduitToolbar.js
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\ConduitToolbar.xpt
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\FFExternalAlert.dll
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\FFExternalAlert.xpt
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\RadioWMPCore.dll
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\RadioWMPCore.xpt
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\defaults\default_radio_skin.xml
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\chrome.manifest
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\chrome\dvdvideosofttb.jar
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\install.rdf
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\lib\xpcom.js
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\META-INF\manifest.mf
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\META-INF\zigbert.rsa
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\META-INF\zigbert.sf
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\searchplugin\conduit.gif
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\searchplugin\conduit.ico
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\searchplugin\conduit.PNG
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\searchplugin\conduit.src
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\searchplugin\conduit.xml
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\setup.ini
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\version.txt
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\components\ConduitAutoCompleteSearch.js
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\components\ConduitAutoCompleteSearch.xpt
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\components\ConduitToolbar.idl
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\components\ConduitToolbar.js
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\components\ConduitToolbar.xpt
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\components\FFExternalAlert.dll
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\components\FFExternalAlert.xpt
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\components\RadioWMPCore.dll
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\components\RadioWMPCore.xpt
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\defaults\default_radio_skin.xml
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\chrome.manifest
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\chrome\dvdvideosoft.jar
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\install.rdf
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\lib\xpcom.js
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\META-INF\manifest.mf
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\META-INF\zigbert.rsa
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\META-INF\zigbert.sf
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\searchplugin\conduit.gif
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\searchplugin\conduit.ico
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\searchplugin\conduit.PNG
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\searchplugin\conduit.src
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\searchplugin\conduit.xml
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\setup.ini
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\version.txt
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\engine@conduit.com
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\engine@conduit.com\components\ConduitAutoCompleteSearch.js
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\engine@conduit.com\components\ConduitAutoCompleteSearch.xpt
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\engine@conduit.com\components\ConduitToolbar.idl
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\engine@conduit.com\components\ConduitToolbar.js
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\engine@conduit.com\components\ConduitToolbar.xpt
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\engine@conduit.com\components\FFExternalAlert.dll
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\engine@conduit.com\components\FFExternalAlert.xpt
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\engine@conduit.com\components\RadioWMPCore.dll
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\engine@conduit.com\components\RadioWMPCore.xpt
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\engine@conduit.com\defaults\alertSettingsComponent.xml
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\engine@conduit.com\defaults\appContextMenu.xml
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\engine@conduit.com\defaults\engineContextMenu.xml
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\engine@conduit.com\defaults\engineSettings.json
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\engine@conduit.com\defaults\fbAlert.js
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\engine@conduit.com\defaults\getAppsContextMenu.xml
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\engine@conduit.com\defaults\postAppsContextMenu.xml
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\engine@conduit.com\defaults\toolbarContextMenu.xml
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\engine@conduit.com\defaults\unsharedAppsContextMenu.xml
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\engine@conduit.com\DualPackage\install.rdf
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\engine@conduit.com\chrome.manifest
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\engine@conduit.com\chrome\conduitengine.jar
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\engine@conduit.com\install.rdf
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\engine@conduit.com\lib\xpcom.js
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\engine@conduit.com\META-INF\manifest.mf
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\engine@conduit.com\META-INF\zigbert.rsa
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\engine@conduit.com\META-INF\zigbert.sf
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\engine@conduit.com\searchplugin\conduit.gif
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\engine@conduit.com\searchplugin\conduit.ico
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\engine@conduit.com\searchplugin\conduit.PNG
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\engine@conduit.com\searchplugin\conduit.src
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\engine@conduit.com\searchplugin\conduit.xml
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\engine@conduit.com\version.txt
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\components\FFHst.dll
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\components\FFHst.xpt
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\content\facemoods.css
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\content\facemoods.png
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\content\facemoods.xul
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\content\fcmdDef.js
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\content\images\facebook_But.png
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\content\images\facebook_But2.png
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\content\images\facemoods.png
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\content\images\fb.gif
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\content\images\fbhome.gif
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\content\images\fbmsgs.gif
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\content\images\fbphotos.gif
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\content\images\fbprofile.gif
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\content\images\fbsettings.gif
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\content\images\fbshare.gif
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\content\images\fbuploads.gif
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\content\images\help_16.gif
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\content\images\home.gif
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\content\images\ibario_ball.png
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\content\images\logo.png
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\content\images\moodsIcon.png
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\content\images\pref.jpg
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\content\images\privecy_16_hot.gif
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\content\images\stripicons.png
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\content\images\tellafriend.gif
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\content\images\Thumbs.db
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\content\images\vssver.scc
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\content\instlgc.js
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\content\JSonButtons.js
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\content\Loader.js
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\content\mtrprt.js
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\content\newTabLgc.js
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\content\PPCB.js
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\content\preferences\preferences.js
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\content\preferences\preferences.xul
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\content\prefman.js
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\content\script-compiler.js
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\content\Thumbs.db
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\content\utils.js
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\content\vssver.scc
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\content\xmlhttprequester.js
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\content\xpiInstallLgc.js
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\defaults\preferences\instlPref.js
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\defaults\preferences\vssver.scc
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\chrome.manifest
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\install.rdf
h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\extensions\ffxtlbr@Facemoods.com\vssver.scc
h:\program files\Common Files\AskToolbarInstaller.exe

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_xsxfycwp

((((((((((((((((((((((((( Soubory vytvořené od 2010-11-21 do 2010-12-21 )))))))))))))))))))))))))))))))
.

2010-12-21 20:10 . 2010-12-21 20:10 -------- d-----w- h:\documents and settings\Vilo\Data aplikací\Malwarebytes
2010-12-21 20:09 . 2010-12-20 17:09 38224 ----a-w- h:\windows\system32\drivers\mbamswissarmy.sys
2010-12-21 20:09 . 2010-12-21 20:09 -------- d-----w- h:\documents and settings\All Users\Data aplikací\Malwarebytes
2010-12-21 20:09 . 2010-12-21 20:09 -------- d-----w- h:\program files\Malwarebytes' Anti-Malware
2010-12-21 20:09 . 2010-12-20 17:08 20952 ----a-w- h:\windows\system32\drivers\mbam.sys
2010-12-21 18:55 . 2010-12-21 19:40 -------- d-----w- h:\documents and settings\Vilo\DoctorWeb
2010-12-20 16:17 . 2010-12-20 16:17 388096 ----a-r- h:\documents and settings\Vilo\Data aplikací\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-12-17 09:07 . 2010-12-17 09:07 -------- d-----w- h:\documents and settings\skúška\Data aplikací\ArcSoft
2010-12-12 17:25 . 2010-12-18 19:36 -------- d---a-w- h:\documents and settings\All Users\Data aplikací\TEMP
2010-12-12 17:20 . 2010-12-12 17:20 -------- d-----w- h:\program files\Vstplugins
2010-12-11 12:07 . 2010-12-11 12:07 -------- d-----w- h:\program files\Common Files\Macrovision Shared
2010-12-11 11:13 . 2010-12-11 11:13 -------- d-----w- h:\program files\Common Files\Skype
2010-12-05 20:55 . 2010-12-05 20:55 -------- d-----w- h:\documents and settings\Vilo\Data aplikací\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2010-11-27 18:39 . 2010-11-27 18:39 -------- d-----w- h:\program files\Adobe Media Player
2010-11-27 18:33 . 2010-11-27 18:33 -------- d-----w- h:\program files\Common Files\Adobe AIR

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-21 17:31 . 2008-07-31 17:44 196608 ----a-w- h:\windows\system32\drivers\nStandard.bin
2010-12-12 12:01 . 2009-08-08 08:01 135096 ----a-w- h:\windows\system32\drivers\avipbb.sys
2010-11-25 13:46 . 2009-08-08 08:01 61960 ----a-w- h:\windows\system32\drivers\avgntflt.sys
2010-07-20 09:47 . 2009-11-28 12:29 119808 ----a-w- h:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-12-21_21.34.51 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-12-21 22:44 . 2010-12-21 22:44 16384 h:\windows\temp\Perflib_Perfdata_79c.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AlcoholAutomount"="h:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2009-04-24 203928]
"DAEMON Tools Lite"="h:\program files\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200]
"Light Downloader"="h:\program files\Light Downloader\ldm.exe" [2010-02-01 3264583]
"Google Update"="h:\documents and settings\Vilo\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" [2010-06-15 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MagicKey"="h:\progra~1\MEDIAK~1\MagicKey.exe" [2004-03-15 45056]
"HDAudDeck"="h:\program files\VIA\VIAudioi\HDADeck\HDeck.exe" [2008-01-14 29753344]
"ASUSGamerOSD"="h:\program files\ASUS\GamerOSD\GamerOSD.exe" [2007-09-13 380928]
"WinampAgent"="h:\program files\Winamp\winampa.exe" [2008-01-15 37376]
"NvCplDaemon"="h:\windows\system32\NvCpl.dll" [2007-09-16 8491008]
"nwiz"="nwiz.exe" [2007-09-16 1626112]
"NvMediaCenter"="h:\windows\system32\NvMcTray.dll" [2007-09-16 81920]
"PCSuiteTrayApplication"="h:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 227328]
"Adobe Photo Downloader"="h:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 57344]
"avgnt"="h:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-04 281768]
"Google Desktop Search"="h:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-07-20 30192]
"w3dr.exe"="h:\hry\warcraft 3\Warcraft III\w3dr.exe" [2008-08-03 61440]
"ArcSoft Connection Service"="h:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-27 207424]
"PAC207_Monitor"="h:\windows\PixArt\PAC207\Monitor.exe" [2007-12-10 323584]
"Monitor"="h:\windows\PixArt\PAC207\Monitor.exe" [2007-12-10 323584]
"AdobeCS4ServiceManager"="h:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="h:\windows\system32\CTFMON.EXE" [2004-08-17 15360]
"Nokia.PCSync"="h:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 1744896]

h:\documents and settings\Vilo\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Gamma.lnk - h:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]

h:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
InterVideo WinCinema Manager.lnk - h:\program files\InterVideo\Common\Bin\WinCinemaMgr.exe [2008-7-31 303104]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"h:\\WINDOWS\\system32\\PnkBstrA.exe"=
"h:\\WINDOWS\\system32\\PnkBstrB.exe"=
"h:\\Program Files\\ICQ6.5\\ICQ.exe"=
"h:\\hry\\warcraft 3\\Warcraft III\\war3.exe"=
"h:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"h:\\WINDOWS\\system32\\dplaysvr.exe"=
"h:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"h:\\Program Files\\Opera\\opera.exe"=
"h:\\Program Files\\uTorrent\\utorrent.exe"=
"h:\\Program Files\\QIP\\qip.exe"=
"h:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
"h:\\Program Files\\Sierra\\Homeworld2\\Bin\\Release\\Homeworld2.exe"=
"h:\\WINDOWS\\system32\\dpnsvr.exe"=
"h:\\hry\\wesnoth\\wesnothd.exe"=
"h:\\Documents and Settings\\Vilo\\Plocha\\Age_of_empires_II\\Age of empires\\age2_x1.exe"=
"h:\\Documents and Settings\\Vilo\\Plocha\\Age_of_empires_II\\Age of empires\\empires2.exe"=
"h:\\hry\\warcraft 3\\Warcraft III\\Warcraft III.exe"=
"h:\\Program Files\\Skype\\Phone\\Skype.exe"=
"h:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"h:\\Program Files\\Sony\\Vegas Pro 8.0\\VegSrv80.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\globallyopenports\list]
"6112:UDP"= 6112:UDP:w3
"5353:TCP"= 5353:TCP:Adobe CSI CS4

R0 sptd;sptd;h:\windows\system32\drivers\sptd.sys [29.10.2008 17:06 691696]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;h:\program files\Avira\AntiVir Desktop\sched.exe [8.8.2009 9:01 135336]
R2 LicCtrlService;LicCtrl Service;h:\windows\Runservice.exe [24.2.2009 11:44 2560]
R3 PAC207;PC Camer@;h:\windows\system32\drivers\PFC027.SYS [8.11.2010 17:57 618112]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;h:\windows\system32\drivers\viahduaa.sys [31.7.2008 18:36 215936]
S2 gupdate;Google Update Service (gupdate);h:\program files\Google\Update\GoogleUpdate.exe [8.11.2009 19:29 135664]
S3 androidusb;ADB Interface Driver;h:\windows\system32\drivers\fxxandroidusb.sys [16.7.2010 19:02 25728]
S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;h:\program files\Google\Google Desktop Search\GoogleDesktop.exe [31.7.2008 18:53 30192]
S3 qcusbser;Qualcomm USB Device for Legacy Serial Communication;h:\windows\system32\drivers\FXX\qcusbser.sys [16.7.2010 19:04 103424]
S3 wip0204;Wippien Network Adapter 2.4;h:\windows\system32\drivers\wip0204.sys [8.6.2010 12:18 23480]
.
Obsah adresáře 'Naplánované úlohy'

2010-11-03 h:\windows\Tasks\AppleSoftwareUpdate.job
- h:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2010-12-21 h:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- h:\program files\Google\Update\GoogleUpdate.exe [2009-11-08 18:28]

2010-12-21 h:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- h:\program files\Google\Update\GoogleUpdate.exe [2009-11-08 18:28]
.
.
------- Doplňkový sken -------
.
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyServer = 200.242.2.162:8080
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: &Google Search - h:\program files\Google\GoogleToolbar1.dll/cmsearch.html
IE: Backward Links - h:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - h:\program files\Google\GoogleToolbar1.dll/cmcache.html
IE: Download all with Light Downloader - file://h:\program files\Light Downloader\dlall.htm
IE: Download selected with Light Downloader - file://h:\program files\Light Downloader\dlselected.htm
IE: Download video with Light Downloader - file://h:\program files\Light Downloader\dlfvideo.htm
IE: Download with Light Downloader - file://h:\program files\Light Downloader\dllink.htm
IE: E&xportovať do programu Microsoft Excel - h:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Similar Pages - h:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate into English - h:\program files\Google\GoogleToolbar1.dll/cmtrans.html
TCP: {41C04E3C-606D-4C4E-8D6C-3E91063BB482} = 208.67.222.222,208.67.220.220
FF - ProfilePath - h:\documents and settings\Vilo\Data aplikací\Mozilla\Firefox\Profiles\mbijfjh8.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - h:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - h:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - Ext: TVU Web Player: firefox@tvunetworks.com - %profile%\extensions\firefox@tvunetworks.com
FF - Ext: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - %profile%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF - Ext: Greasemonkey: {e4a8a97b-f2ed-450b-b12d-ee082ba24781} - %profile%\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
FF - Ext: Java Quick Starter: jqs@sun.com - h:\program files\Java\jre6\lib\deploy\jqs\ff
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-12-21 23:45
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HDAudDeck = h:\program files\VIA\VIAudioi\HDADeck\HDeck.exe 1????????????????????????????????????????????????

skenování skrytých souborů ...

h:\windows\system.ini 272 bytes

sken byl úspešně dokončen
skryté soubory: 1

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1606980848-1788223648-725345543-1003\Software\SecuROM\License information*]
"datasecu"=hex:be,65,53,a6,6b,f7,c5,df,5b,2a,a7,9f,66,b0,b3,15,c6,99,8f,04,4d,
d3,a5,69,30,bb,70,d3,f6,7f,c4,f7,87,33,ba,38,9b,5d,2f,c4,c1,43,dc,52,a7,17,\
"rkeysecu"=hex:5c,03,2c,c7,5f,4f,87,31,f0,70,e3,22,4f,fc,8b,86

[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \EC1A69D1C0948222]
"1"=hex:b0,cd,e0,26,42,20,9e,7c,08,f1,c1,23,e7,41,66,ec,c9,e0,20,43,a1,23,f2,
e3
"2"=hex:f1,df,16,de,80,08,0e,2a,78,a4,28,cb,d2,56,ff,58,a6,09,d8,fb,43,e9,d5,
e7,16,83,71,61,5d,be,d8,25
"3"=hex:b0,cd,e0,26,42,20,9e,7c,08,f1,c1,23,e7,41,66,ec,2b,92,4b,0d,22,14,9d,
cb,e3,f8,73,90,7d,a4,36,0d,7e,db,3a,16,4c,1a,45,81,b1,a5,77,31,f5,50,d6,e8

[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \EC1A69D1C0948222\48236A7EED3B8895E98434D6DCE253AC]
"1"=hex:08,26,de,b9,bd,1e,cc,2a,55,96,fd,b8,7e,1b,23,82,71,bb,5a,5f,e0,12,25,
42,0c,3f,30,d4,d3,b8,cd,35,d5,a9,6f,e0,2c,05,4e,14
"2"=hex:58,92,5a,34,3f,c6,a5,c5
"3"=hex:a3,4d,5c,d2,fe,75,65,8b,5a,3b,ad,16,6a,47,58,cb,e7,12,90,e7,19,31,d3,
4e,6a,6c,45,01,9a,bb,9c,94,70,38,3d,f8,02,58,8f,c7,65,6c,33,6e,01,ab,24,e9,\
"4"=hex:2f,ad,a2,e7,8a,bf,05,5e
"5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55,
1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\
"6"=hex:bf,e5,23,7b,b0,66,d6,fc,bc,64,22,fb,7e,d3,39,3e,a3,00,33,13,c0,21,f4,
51,6c,4e,0c,96,e2,dd,ad,8a,b6,c4,05,e8,5a,bd,9a,e9,d4,1a,3d,68,9d,00,32,20
"7"=hex:08,26,de,b9,bd,1e,cc,2a,55,96,fd,b8,7e,1b,23,82,71,bb,5a,5f,e0,12,25,
42,0c,3f,30,d4,d3,b8,cd,35,61,5a,c0,6c,22,7e,83,13,6e,44,91,28,69,cc,01,dd
"8"=hex:f2,80,0d,7f,fe,b9,cf,0a,62,bc,95,c6,fe,82,c9,e7,7a,39,50,43,38,08,ae,
25,34,fe,c5,b3,14,04,32,c8
"9"=hex:81,20,8f,ab,28,6a,52,9c
"18"=hex:70,56,26,33,e3,20,f8,ab
"10"=hex:a7,d5,9c,a7,24,6a,5a,bc
"11"=hex:81,20,8f,ab,28,6a,52,9c
"12"=hex:81,20,8f,ab,28,6a,52,9c
"13"=hex:81,20,8f,ab,28,6a,52,9c
"14"=hex:81,20,8f,ab,28,6a,52,9c
"24"=hex:81,20,8f,ab,28,6a,52,9c
"26"=hex:81,20,8f,ab,28,6a,52,9c
"27"=hex:81,20,8f,ab,28,6a,52,9c
"19"=hex:81,20,8f,ab,28,6a,52,9c
"22"=hex:81,20,8f,ab,28,6a,52,9c

[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \EC1A69D1C0948222\B144CCE307E78EB6EE53CA2196E4D0A2]
"1"=hex:97,5e,49,d3,7c,a0,18,18,10,c9,e3,e3,c1,ae,57,ed,60,42,a5,db,24,eb,e2,
b0,36,d7,56,53,fe,9f,3d,f9
"2"=hex:8c,23,2d,03,75,bd,a0,cd
"3"=hex:89,8a,74,86,09,98,71,d4,16,e8,e2,9b,1e,d2,90,60,88,3e,e0,61,4a,a1,c5,
59,3f,e9,d9,46,57,4a,8d,d8,50,05,f4,b6,c1,b6,2d,ee,67,48,fe,54,df,a8,d1,7d,\
"4"=hex:2f,ad,a2,e7,8a,bf,05,5e
"5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55,
1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\
"6"=hex:bf,e5,23,7b,b0,66,d6,fc,bc,64,22,fb,7e,d3,39,3e,a3,00,33,13,c0,21,f4,
51,6c,4e,0c,96,e2,dd,ad,8a,b6,c4,05,e8,5a,bd,9a,e9,d4,1a,3d,68,9d,00,32,20
"7"=hex:6b,96,68,24,0f,2f,9e,94,e8,ce,54,f3,3b,80,63,3a,1b,c3,e7,ed,44,3a,1d,
97,9f,f9,03,77,68,81,1b,0c,34,a2,88,30,12,be,09,a0
"8"=hex:be,1e,1b,5b,46,ce,bd,af,06,c0,57,de,a3,1c,52,0a,b6,95,00,63,ba,3d,d1,
21,f3,59,b1,30,47,70,f4,7c
"9"=hex:81,20,8f,ab,28,6a,52,9c
"18"=hex:70,56,26,33,e3,20,f8,ab
"10"=hex:07,96,b3,35,9e,5a,1a,0b
"11"=hex:81,20,8f,ab,28,6a,52,9c
"12"=hex:81,20,8f,ab,28,6a,52,9c
"13"=hex:81,20,8f,ab,28,6a,52,9c
"14"=hex:81,20,8f,ab,28,6a,52,9c
"24"=hex:81,20,8f,ab,28,6a,52,9c
"26"=hex:81,20,8f,ab,28,6a,52,9c
"27"=hex:81,20,8f,ab,28,6a,52,9c
"19"=hex:81,20,8f,ab,28,6a,52,9c
"22"=hex:81,20,8f,ab,28,6a,52,9c
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(784)
h:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll

- - - - - - - > 'explorer.exe'(2296)
h:\windows\system32\msi.dll
h:\windows\system32\mmfinfo.dll
h:\windows\system32\mkunicode.dll
h:\program files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll
h:\windows\system32\WPDShServiceObj.dll
h:\program files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll
h:\program files\Nokia\Nokia PC Suite 6\PCSCM.dll
h:\program files\Nokia\Nokia PC Suite 6\Lang\PhoneBrowser_slk.nlr
h:\program files\Nokia\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr
h:\windows\system32\PortableDeviceTypes.dll
h:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
h:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
h:\program files\Avira\AntiVir Desktop\avguard.exe
h:\windows\ATKKBService.exe
h:\program files\Java\jre6\bin\jqs.exe
h:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
h:\program files\CDBurnerXP\NMSAccessU.exe
h:\windows\system32\nvsvc32.exe
h:\windows\system32\PnkBstrA.exe
h:\program files\Avira\AntiVir Desktop\avshadow.exe
h:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
h:\windows\system32\wscntfy.exe
h:\windows\system32\RUNDLL32.EXE
h:\program files\PC Connectivity Solution\ServiceLayer.exe
.
**************************************************************************
.
Celkový čas: 2010-12-21 23:50:43 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-12-21 22:50
ComboFix2.txt 2010-12-21 21:42

Před spuštěním: Volných bajtů: 22 413 807 616
Po spuštění: Volných bajtů: 22 397 595 648

- - End Of File - - 818E86A22A30295F0E38B393330E65BF

Příspěvekod **memphisto** » 22 pro 2010 00:17

ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix /Uninstall

vyčisti systém CCleanerem

a použij i T-Cleaner
smaže vše po Combu,MWAVu atd.-stáhneš>spustíš

pozn. před stažením T-Cleaneru a po dobu čištění deaktivuj AVG , Avast,Avira či Microsoft Security Essentials následně T-Cleaner smaž a zapni si AVG , Avast, Avira či Microsoft Security Essentials

+ HJT

Jak se chová PC?

willy51 · Příspěvekod **willy51** » 22 pro 2010 00:44

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 0:43:42, on 22.12.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
H:\WINDOWS\System32\smss.exe
H:\WINDOWS\system32\winlogon.exe
H:\WINDOWS\system32\services.exe
H:\WINDOWS\system32\lsass.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\System32\svchost.exe
H:\WINDOWS\system32\spoolsv.exe
H:\Program Files\Avira\AntiVir Desktop\sched.exe
H:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
H:\Program Files\Avira\AntiVir Desktop\avguard.exe
H:\WINDOWS\ATKKBService.exe
H:\Program Files\Java\jre6\bin\jqs.exe
H:\WINDOWS\runservice.exe
H:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
H:\Program Files\CDBurnerXP\NMSAccessU.exe
H:\WINDOWS\system32\nvsvc32.exe
H:\WINDOWS\system32\PnkBstrA.exe
H:\Program Files\Avira\AntiVir Desktop\avshadow.exe
H:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
H:\WINDOWS\system32\svchost.exe
H:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe
H:\Program Files\ASUS\GamerOSD\GamerOSD.exe
H:\Program Files\Winamp\winampa.exe
H:\WINDOWS\system32\RUNDLL32.EXE
H:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
H:\Program Files\Avira\AntiVir Desktop\avgnt.exe
H:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
H:\hry\warcraft 3\Warcraft III\w3dr.exe
H:\Program Files\PC Connectivity Solution\ServiceLayer.exe
H:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
H:\WINDOWS\PixArt\PAC207\Monitor.exe
H:\Program Files\DAEMON Tools Lite\DTLite.exe
H:\Program Files\Light Downloader\ldm.exe
H:\Documents and Settings\Vilo\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe
H:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
H:\WINDOWS\explorer.exe
H:\WINDOWS\system32\wscntfy.exe
H:\Program Files\Opera\opera.exe
H:\Program Files\hijackthis\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 200.242.2.162:8080
O2 - BHO: FDMIECookiesBHO Class - {7A780B7B-DCF1-4ec4-BB13-2DF92CAD27DB} - H:\Program Files\Light Downloader\ldmie2.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - h:\program files\google\googletoolbar1.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - H:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - H:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - H:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - h:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [MagicKey] H:\PROGRA~1\MEDIAK~1\MagicKey.exe
O4 - HKLM\..\Run: [HDAudDeck] H:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1
O4 - HKLM\..\Run: [ASUSGamerOSD] H:\Program Files\ASUS\GamerOSD\GamerOSD.exe
O4 - HKLM\..\Run: [WinampAgent] "H:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE H:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE H:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PCSuiteTrayApplication] H:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [Adobe Photo Downloader] "H:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [avgnt] "H:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Google Desktop Search] "H:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [w3dr.exe] H:\hry\warcraft 3\Warcraft III\w3dr.exe
O4 - HKLM\..\Run: [ArcSoft Connection Service] H:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [PAC207_Monitor] H:\WINDOWS\PixArt\PAC207\Monitor.exe
O4 - HKLM\..\Run: [Monitor] H:\WINDOWS\PixArt\PAC207\Monitor.exe
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "H:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKCU\..\Run: [AlcoholAutomount] "H:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [DAEMON Tools Lite] "H:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [Light Downloader] "H:\Program Files\Light Downloader\ldm.exe" -autorun
O4 - HKCU\..\Run: [Google Update] "H:\Documents and Settings\Vilo\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] H:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = H:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = H:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O8 - Extra context menu item: &Google Search - res://H:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://H:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://H:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Download all with Light Downloader - file://H:\Program Files\Light Downloader\dlall.htm
O8 - Extra context menu item: Download selected with Light Downloader - file://H:\Program Files\Light Downloader\dlselected.htm
O8 - Extra context menu item: Download video with Light Downloader - file://H:\Program Files\Light Downloader\dlfvideo.htm
O8 - Extra context menu item: Download with Light Downloader - file://H:\Program Files\Light Downloader\dllink.htm
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://H:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://H:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://H:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - H:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - H:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Zdroje informácií - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - H:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - H:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - H:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{41C04E3C-606D-4C4E-8D6C-3E91063BB482}: NameServer = 208.67.222.222,208.67.220.220
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - H:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - H:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - H:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - H:\WINDOWS\system32\browseui.dll
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - H:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Adobe LM Service - Adobe Systems - H:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - H:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - H:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - H:\WINDOWS\ATKKBService.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - H:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Desktop Manager 5.9.1005.12335 (GoogleDesktopManager-051210-111108) - Google - H:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - H:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - H:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - H:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - H:\WINDOWS\runservice.exe
O23 - Service: NMSAccessU - Unknown owner - H:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - H:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - H:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia. - H:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - H:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

--
End of file - 10346 bytes

pocitac sa podla prveho dojmu chova ovela sviznejsie....velka vdaka :smile:

Příspěvekod **memphisto** » 22 pro 2010 00:48

Vypadá to čistě. Pokud nejsou problémy,tak můžeš téma označit za vyřešené kliknutím na zelenou fajku vpravo nahoře

log HJT - pomaly PC Vyřešeno

log HJT - pomaly PC Vyřešeno

Re: log HJT - pomaly PC

Re: log HJT - pomaly PC

Re: log HJT - pomaly PC

Re: log HJT - pomaly PC

Re: log HJT - pomaly PC

Re: log HJT - pomaly PC

Re: log HJT - pomaly PC

Re: log HJT - pomaly PC

Re: log HJT - pomaly PC

Kdo je online