Nejde facebook.....

[XNickX]

Dobrý den... dnes my kamarád napsal nějaký odkaz a psal anglicky....stáhnul jsem adobe flash ovladač a po několika minutách na netu jsem zjistil, že je to vir...Na několika stránkách jsem zjistil, že si mám stáhnout Spyware Doctor...stáhl jsem to a cracknul a nechal jse si prokontrolovat pc a falešný antivir zmizel...pc je úplně v pořádku...jen když dám facebook.com tak nenaběhne nic...
Jo a ještě mám nový pc...tak bych byl nerad kdybych musel provádět nějaký "nebezpečný" či závažný krok... děkuji...

Logfile of random's system information tool 1.09 (written by random/random)
Run by Alex at 2011-08-19 22:56:06
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 108 GB (70%) free of 154 GB
Total RAM: 4095 MB (56% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:56:15, on 19.8.2011
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Windows\PixArt\PAC7302\Monitor.exe
C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
C:\Program Files (x86)\uTorrent\uTorrent.exe
C:\Users\Alex\AppData\Roaming\cacaoweb\cacaoweb.exe
H:\XNickX\Applications\LOLReplay\LOLRecorder.exe
C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
C:\Program Files (x86)\PC Tools Security\pctsGui.exe
C:\Program Files (x86)\PowerISO\PWRISOVM.EXE
C:\Program Files (x86)\Opera\opera.exe
C:\Program Files\trend micro\Alex.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.hal3000.cz
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
R3 - URLSearchHook: uTorrentBar Toolbar - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\tbuTor.dll
R3 - URLSearchHook: (no name) - {472734EA-242A-422b-ADF8-83D1E48CC825} - (no file)
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Pomocná služba pro přihlášení ke službě Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: uTorrentBar Toolbar - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\tbuTor.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Microsoft Web Test Recorder 10.0 Helper - {DDA57003-0068-4ed2-9D32-4D1EC707D94D} - H:\XNickX\Applications\Microsoft Visual Studio 10.0\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.QualityTools.RecorderBarBHO100.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: VDownloader Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O3 - Toolbar: uTorrentBar Toolbar - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\tbuTor.dll
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files (x86)\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
O4 - HKLM\..\Run: [ISTray] "C:\Program Files (x86)\PC Tools Security\pctsGui.exe" /hideGUI
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files (x86)\uTorrent\uTorrent.exe" /MINIMIZED
O4 - HKCU\..\Run: [Pando Media Booster] C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
O4 - HKCU\..\Run: [cacaoweb] "C:\Users\Alex\AppData\Roaming\cacaoweb\cacaoweb.exe" -noplayer
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: LOLRecorder.lnk = H:\XNickX\Applications\LOLReplay\LOLRecorder.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: ddservice - Unknown owner - C:\Windows\update.7.1\svchostdriver.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: LogMeIn Hamachi Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files (x86)\PC Tools Security\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files (x86)\PC Tools Security\pctsSvc.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: ThreatFire - PC Tools - C:\Program Files (x86)\PC Tools Security\TFEngine\TFService.exe
O23 - Service: @C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 11880 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\AUDIODG.EXE 0x2cc
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\nvvsvc.exe -session -first
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"taskhost.exe"
"C:\Windows\system32\Dwm.exe"
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
C:\Windows\update.7.1\svchostdriver.exe srv
C:\Windows\Explorer.EXE
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe" -s
"C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe"
"C:\Program Files (x86)\PC Tools Security\pctsAuxs.exe"
"C:\Program Files (x86)\PC Tools Security\pctsSvc.exe"
"C:\Windows\PixArt\PAC7302\Monitor.exe"
"C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
"C:\Program Files (x86)\uTorrent\uTorrent.exe" /MINIMIZED
"C:\Users\Alex\AppData\Roaming\cacaoweb\cacaoweb.exe" -noplayer
"H:\XNickX\Applications\LOLReplay\LOLRecorder.exe"
"C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe"
"C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
"C:\Program Files (x86)\PC Tools Security\pctsGui.exe" /hideGUI
"C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe"
"C:\Program Files (x86)\PowerISO\PWRISOVM.EXE"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe"
"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"
"C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesApp64.exe" /TUStart /pid:2740
WLIDSvcM.exe 2784
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Program Files (x86)\PC Tools Security\TFEngine\TFService.exe" service
"C:\Program Files (x86)\Opera\opera.exe"
C:\Windows\system32\wbem\wmiprvse.exe
"taskhost.exe"
"C:\Windows\update.7.1\svchostdriver.exe" stand
"C:\Users\Alex\Desktop\RSITx64.exe"

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3133533038-1199205714-1137167784-1000Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3133533038-1199205714-1137167784-1000UA.job

=========Mozilla firefox=========

ProfilePath - C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\jays2ko2.default

prefs.js - "browser.startup.homepage" - "seznam.cz"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0]
"Description"=DivX Web Player
"Path"=C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3]
"Description"=Office Live Update v1.3
"Path"=C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeLive,version=1.4]
"Description"=Office Live Update v1.4
"Path"=C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@nvidia.com/3DVision]
"Description"=NVIDIA stereo images plugin for Mozilla browsers
"Path"=C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@nvidia.com/3DVisionStreaming]
"Description"=NVIDIA 3D Vision Streaming plugin for Mozilla browsers
"Path"=C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@pandonetworks.com/PandoWebPlugin]
"Description"=This plugin detects and launches Pando Media Booster
"Path"=C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.21.65\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.21.65\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18]
"Description"=Veetle TV Core
"Path"=C:\Program Files (x86)\Veetle\plugins\npVeetle.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18]
"Description"=Veetle TV Player
"Path"=C:\Program Files (x86)\Veetle\Player\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

C:\Program Files (x86)\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}

C:\Program Files (x86)\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files (x86)\Mozilla Firefox\plugins\
libdivx.dll
npdeployJava1.dll
npdivx32.dll
npdivx32.xpt
ssldivx.dll

C:\Program Files (x86)\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\jays2ko2.default\extensions\
cacaoweb@cacaoweb.org

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21 529280]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-06-06 63912]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
Search Helper - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll [2010-09-22 191792]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocná služba pro přihlášení ke službě Windows Live ID - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21 439168]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
uTorrentBar Toolbar - C:\Program Files (x86)\uTorrentBar\tbuTor.dll [2010-12-09 3911776]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
VDownloader Toolbar - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll [2011-02-01 1487240]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2011-08-03 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DDA57003-0068-4ed2-9D32-4D1EC707D94D}]
Microsoft Web Test Recorder 10.0 Helper - H:\XNickX\Applications\Microsoft Visual Studio 10.0\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.QualityTools.RecorderBarBHO100.dll [2010-03-19 61360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll [2010-03-25 1548096]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll [2010-03-25 968000]
{D4027C7F-154A-4066-A1AD-4243D8127440} - VDownloader Toolbar - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll [2011-02-01 1487240]
{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}
{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - uTorrentBar Toolbar - C:\Program Files (x86)\uTorrentBar\tbuTor.dll [2010-12-09 3911776]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2009-10-06 8158240]
"PAC7302_Monitor"=C:\Windows\PixArt\PAC7302\Monitor.exe [2007-12-10 323584]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2010-04-01 357696]
"uTorrent"=C:\Program Files (x86)\uTorrent\uTorrent.exe [2011-08-09 639864]
"Pando Media Booster"=C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [2011-08-11 3077528]
"cacaoweb"=C:\Users\Alex\AppData\Roaming\cacaoweb\cacaoweb.exe [2011-08-17 399088]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"PWRISOVM.EXE"=C:\Program Files (x86)\PowerISO\PWRISOVM.EXE [2009-11-09 180224]
"amd_dc_opt"=C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe [2008-07-22 77824]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-06-06 937920]
"GrooveMonitor"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]
"LogMeIn Hamachi Ui"=C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [2011-08-04 1955208]
"tray_ico"= []
"tray_ico2"= []
"tray_ico3"= []
"tray_ico4"= []
"ISTray"=C:\Program Files (x86)\PC Tools Security\pctsGui.exe [2011-05-13 1600984]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
LOLRecorder.lnk - H:\XNickX\Applications\LOLReplay\LOLRecorder.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2009-07-21 258560]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\wxpdrivers]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableSecureUIAPaths"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave5"=wdmaud.drv
"midi5"=wdmaud.drv
"mixer5"=wdmaud.drv
"aux1"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"wave7"=wdmaud.drv
"midi6"=wdmaud.drv
"mixer7"=wdmaud.drv
"aux2"=wdmaud.drv
"wave8"=wdmaud.drv
"midi7"=wdmaud.drv
"mixer8"=wdmaud.drv
"aux3"=wdmaud.drv
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave9"=wdmaud.drv
"midi8"=wdmaud.drv
"mixer9"=wdmaud.drv
"aux4"=wdmaud.drv
"VIDC.FPS1"=frapsv64.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2011-08-19 22:50:19 ----D---- C:\rsit
2011-08-19 22:50:19 ----D---- C:\Program Files\trend micro
2011-08-19 22:34:07 ----D---- C:\Program Files\CCleaner
2011-08-19 18:34:16 ----S---- C:\Windows\system32\drivers\TfSysMon.sys
2011-08-19 18:34:16 ----S---- C:\Windows\system32\drivers\TfNetMon.sys
2011-08-19 18:34:16 ----S---- C:\Windows\system32\drivers\TfFsMon.sys
2011-08-19 17:07:49 ----A---- C:\Windows\system32\drivers\Cat.DB
2011-08-19 17:07:47 ----A---- C:\Windows\system32\drivers\pctwfpfilter64.sys
2011-08-19 17:07:47 ----A---- C:\Windows\system32\drivers\pctgntdi64.sys
2011-08-19 17:07:47 ----A---- C:\Windows\system32\drivers\pctEFA64.sys
2011-08-19 17:07:47 ----A---- C:\Windows\system32\drivers\pctDS64.sys
2011-08-19 17:07:45 ----A---- C:\Windows\system32\drivers\PCTCore64.sys
2011-08-19 17:07:44 ----A---- C:\Windows\system32\drivers\PCTSD64.sys
2011-08-19 17:07:42 ----A---- C:\Windows\system32\drivers\pctplsg64.sys
2011-08-19 17:07:37 ----D---- C:\Program Files (x86)\PC Tools Security
2011-08-19 17:07:37 ----AD---- C:\ProgramData\TEMP
2011-08-19 16:55:27 ----D---- C:\ProgramData\PC Tools
2011-08-19 13:32:39 ----HD---- C:\Windows\update.7.1
2011-08-19 10:49:08 ----D---- C:\Windows\ufa
2011-08-19 10:45:23 ----A---- C:\Windows\unrar.exe
2011-08-19 10:44:14 ----D---- C:\Windows\av_ico
2011-08-19 10:42:49 ----HD---- C:\Windows\update.tray-3-0-lnk
2011-08-19 10:42:49 ----HD---- C:\Windows\update.tray-3-0
2011-08-19 10:42:49 ----HD---- C:\Windows\update.tray-10-0-lnk
2011-08-19 10:42:49 ----HD---- C:\Windows\update.tray-10-0
2011-08-19 10:30:56 ----A---- C:\Windows\winlog-ids.txt
2011-08-19 10:30:56 ----A---- C:\Windows\winlog-dirs.txt
2011-08-19 09:15:01 ----D---- C:\Program Files\Microsoft SQL Server
2011-08-19 09:14:46 ----D---- C:\Program Files (x86)\Microsoft SQL Server
2011-08-19 09:14:22 ----D---- C:\Program Files\Microsoft Sync Framework
2011-08-19 09:14:16 ----D---- C:\Program Files\Microsoft Synchronization Services
2011-08-19 09:14:16 ----D---- C:\Program Files\Microsoft SQL Server Compact Edition
2011-08-19 09:14:12 ----D---- C:\Program Files (x86)\Microsoft Synchronization Services
2011-08-19 09:11:43 ----D---- C:\Program Files (x86)\Microsoft ASP.NET
2011-08-19 09:11:39 ----D---- C:\Program Files\IIS
2011-08-19 09:11:39 ----D---- C:\Program Files (x86)\IIS
2011-08-19 09:07:19 ----D---- C:\Windows\SYSWOW64\1033
2011-08-19 09:07:11 ----D---- C:\Program Files (x86)\Microsoft F#
2011-08-19 09:07:11 ----D---- C:\Program Files (x86)\HTML Help Workshop
2011-08-19 09:05:24 ----D---- C:\Program Files (x86)\Microsoft Visual Studio 9.0
2011-08-19 09:05:14 ----D---- C:\Windows\system32\1033
2011-08-19 09:05:14 ----D---- C:\Windows\symbols
2011-08-19 09:05:14 ----D---- C:\Program Files\Microsoft Visual Studio 10.0
2011-08-19 09:05:14 ----D---- C:\Program Files\Microsoft Help Viewer
2011-08-19 09:05:14 ----D---- C:\Program Files (x86)\Microsoft SDKs
2011-08-19 09:04:38 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI
2011-08-17 23:52:55 ----D---- C:\Users\Alex\AppData\Roaming\runic games
2011-08-17 23:49:32 ----D---- C:\Users\Alex\AppData\Roaming\InstallShield
2011-08-14 19:29:29 ----D---- C:\Users\Alex\AppData\Roaming\cacaoweb
2011-08-11 12:47:26 ----D---- C:\Program Files (x86)\DivX
2011-08-11 12:09:29 ----D---- C:\Users\Alex\AppData\Roaming\LolClient
2011-08-11 11:15:25 ----A---- C:\Windows\SYSWOW64\d3dx10_39.dll
2011-08-11 11:15:25 ----A---- C:\Windows\SYSWOW64\D3DCompiler_39.dll
2011-08-11 11:15:24 ----A---- C:\Windows\SYSWOW64\D3DX9_39.dll
2011-08-11 09:41:06 ----D---- C:\ProgramData\PMB Files
2011-08-11 09:35:30 ----D---- C:\Program Files (x86)\Pando Networks
2011-08-10 18:11:02 ----D---- C:\Program Files (x86)\LogMeIn Hamachi
2011-08-10 16:36:38 ----A---- C:\Windows\system32\mshtmled.dll
2011-08-10 16:36:37 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2011-08-10 16:36:37 ----A---- C:\Windows\SYSWOW64\ieui.dll
2011-08-10 16:36:37 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2011-08-10 16:36:37 ----A---- C:\Windows\system32\ieui.dll
2011-08-10 16:36:37 ----A---- C:\Windows\system32\iertutil.dll
2011-08-10 16:36:36 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2011-08-10 16:36:36 ----A---- C:\Windows\SYSWOW64\url.dll
2011-08-10 16:36:36 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2011-08-10 16:36:36 ----A---- C:\Windows\SYSWOW64\jscript.dll
2011-08-10 16:36:36 ----A---- C:\Windows\system32\urlmon.dll
2011-08-10 16:36:36 ----A---- C:\Windows\system32\url.dll
2011-08-10 16:36:36 ----A---- C:\Windows\system32\jscript9.dll
2011-08-10 16:36:36 ----A---- C:\Windows\system32\jscript.dll
2011-08-10 16:36:35 ----A---- C:\Windows\SYSWOW64\wininet.dll
2011-08-10 16:36:35 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2011-08-10 16:36:35 ----A---- C:\Windows\system32\wininet.dll
2011-08-10 16:36:35 ----A---- C:\Windows\system32\jsproxy.dll
2011-08-10 16:36:34 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2011-08-10 16:36:33 ----A---- C:\Windows\system32\mshtml.dll
2011-08-10 16:36:32 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2011-08-10 16:36:32 ----A---- C:\Windows\system32\ieframe.dll
2011-08-10 14:10:40 ----A---- C:\Windows\SYSWOW64\xmllite.dll
2011-08-10 14:10:40 ----A---- C:\Windows\system32\xmllite.dll
2011-08-10 14:10:39 ----A---- C:\Windows\SYSWOW64\odbctrac.dll
2011-08-10 14:10:39 ----A---- C:\Windows\SYSWOW64\odbcjt32.dll
2011-08-10 14:10:39 ----A---- C:\Windows\SYSWOW64\odbccu32.dll
2011-08-10 14:10:39 ----A---- C:\Windows\SYSWOW64\odbccr32.dll
2011-08-10 14:10:39 ----A---- C:\Windows\SYSWOW64\odbccp32.dll
2011-08-10 14:10:39 ----A---- C:\Windows\system32\odbctrac.dll
2011-08-10 14:10:39 ----A---- C:\Windows\system32\odbccu32.dll
2011-08-10 14:10:39 ----A---- C:\Windows\system32\odbccr32.dll
2011-08-10 14:10:39 ----A---- C:\Windows\system32\odbccp32.dll
2011-08-10 14:10:38 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2011-08-10 14:10:38 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2011-08-10 14:10:38 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2011-08-10 14:10:36 ----A---- C:\Windows\SYSWOW64\setup16.exe
2011-08-10 14:10:36 ----A---- C:\Windows\system32\wow64.dll
2011-08-10 14:10:36 ----A---- C:\Windows\system32\winsrv.dll
2011-08-10 14:10:36 ----A---- C:\Windows\system32\KernelBase.dll
2011-08-10 14:10:36 ----A---- C:\Windows\system32\kernel32.dll
2011-08-10 14:10:36 ----A---- C:\Windows\system32\conhost.exe
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2011-08-10 14:10:35 ----A---- C:\Windows\SYSWOW64\wow32.dll
2011-08-10 14:10:35 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2011-08-10 14:10:35 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2011-08-10 14:10:35 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2011-08-10 14:10:35 ----A---- C:\Windows\system32\wow64win.dll
2011-08-10 14:10:35 ----A---- C:\Windows\system32\wow64cpu.dll
2011-08-10 14:10:35 ----A---- C:\Windows\system32\ntvdm64.dll
2011-08-10 14:10:34 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2011-08-10 14:10:34 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2011-08-10 14:10:34 ----A---- C:\Windows\SYSWOW64\user.exe
2011-08-10 14:10:34 ----A---- C:\Windows\SYSWOW64\instnm.exe
2011-08-10 14:10:33 ----A---- C:\Windows\system32\drivers\tcpip.sys
2011-08-10 14:10:31 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2011-08-10 14:10:31 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2011-08-10 14:10:31 ----A---- C:\Windows\system32\ntoskrnl.exe
2011-08-10 08:11:02 ----D---- C:\Program Files (x86)\Microsoft Works
2011-08-10 08:10:52 ----D---- C:\Program Files (x86)\Microsoft Visual Studio
2011-08-10 08:10:41 ----D---- C:\Windows\PCHEALTH
2011-08-10 08:08:50 ----D---- C:\Program Files\Microsoft Office
2011-08-10 08:08:45 ----D---- C:\Program Files (x86)\Microsoft Visual Studio 8
2011-08-10 08:08:19 ----D---- C:\Program Files (x86)\Microsoft Office
2011-08-10 08:07:50 ----RHD---- C:\MSOCache
2011-08-09 16:46:21 ----RHD---- C:\Users\Alex\AppData\Roaming\SecuROM
2011-08-09 16:31:33 ----D---- C:\Program Files (x86)\MiniTool Partition Wizard Home Edition 6.0
2011-08-09 16:16:05 ----A---- C:\Windows\system32\pwNative.exe
2011-08-09 16:16:04 ----N---- C:\Windows\system32\pwdspio.sys
2011-08-09 16:16:04 ----N---- C:\Windows\system32\pwdrvio.sys
2011-08-09 10:37:10 ----A---- C:\Windows\SYSWOW64\npptNT2.sys
2011-08-09 10:36:58 ----D---- C:\Program Files\Common Files\INCA Shared
2011-08-09 08:10:49 ----D---- C:\Users\Alex\AppData\Roaming\BSplayer Pro
2011-08-09 08:10:49 ----D---- C:\Users\Alex\AppData\Roaming\BSplayer
2011-08-09 08:10:49 ----D---- C:\Program Files (x86)\Webteh
2011-08-09 07:44:19 ----D---- C:\Users\Alex\AppData\Roaming\.minecraft
2011-08-08 23:11:28 ----RD---- C:\Program Files (x86)\Skype
2011-08-08 22:39:25 ----D---- C:\Users\Alex\AppData\Roaming\Mozilla
2011-08-08 22:39:13 ----D---- C:\Program Files (x86)\Mozilla Firefox
2011-08-08 22:13:45 ----A---- C:\Windows\system32\tquery.dll
2011-08-08 22:13:45 ----A---- C:\Windows\system32\mssrch.dll
2011-08-08 22:13:44 ----A---- C:\Windows\SYSWOW64\tquery.dll
2011-08-08 22:13:44 ----A---- C:\Windows\SYSWOW64\SearchProtocolHost.exe
2011-08-08 22:13:44 ----A---- C:\Windows\SYSWOW64\SearchIndexer.exe
2011-08-08 22:13:44 ----A---- C:\Windows\SYSWOW64\SearchFilterHost.exe
2011-08-08 22:13:44 ----A---- C:\Windows\SYSWOW64\mssvp.dll
2011-08-08 22:13:44 ----A---- C:\Windows\SYSWOW64\mssrch.dll
2011-08-08 22:13:44 ----A---- C:\Windows\SYSWOW64\mssphtb.dll
2011-08-08 22:13:44 ----A---- C:\Windows\SYSWOW64\mssph.dll
2011-08-08 22:13:44 ----A---- C:\Windows\SYSWOW64\msscntrs.dll
2011-08-08 22:13:44 ----A---- C:\Windows\system32\SearchProtocolHost.exe
2011-08-08 22:13:44 ----A---- C:\Windows\system32\SearchIndexer.exe
2011-08-08 22:13:44 ----A---- C:\Windows\system32\SearchFilterHost.exe
2011-08-08 22:13:44 ----A---- C:\Windows\system32\mssvp.dll
2011-08-08 22:13:44 ----A---- C:\Windows\system32\mssphtb.dll
2011-08-08 22:13:44 ----A---- C:\Windows\system32\mssph.dll
2011-08-08 22:13:44 ----A---- C:\Windows\system32\msscntrs.dll
2011-08-08 22:13:36 ----A---- C:\Windows\system32\drivers\afd.sys
2011-08-08 22:13:27 ----A---- C:\Windows\system32\drivers\srvnet.sys
2011-08-08 22:13:27 ----A---- C:\Windows\system32\drivers\srv2.sys
2011-08-08 22:13:27 ----A---- C:\Windows\system32\drivers\srv.sys
2011-08-08 22:12:59 ----A---- C:\Windows\SYSWOW64\oleaut32.dll
2011-08-08 22:12:59 ----A---- C:\Windows\system32\oleaut32.dll
2011-08-08 22:12:58 ----A---- C:\Windows\SYSWOW64\drvinst.exe
2011-08-08 22:12:58 ----A---- C:\Windows\SYSWOW64\devrtl.dll
2011-08-08 22:12:58 ----A---- C:\Windows\SYSWOW64\devobj.dll
2011-08-08 22:12:58 ----A---- C:\Windows\SYSWOW64\cfgmgr32.dll
2011-08-08 22:12:58 ----A---- C:\Windows\system32\umpnpmgr.dll
2011-08-08 22:12:57 ----A---- C:\Windows\system32\win32k.sys
2011-08-08 22:12:56 ----A---- C:\Windows\SYSWOW64\inetcomm.dll
2011-08-08 22:12:56 ----A---- C:\Windows\system32\inetcomm.dll

======List of files/folders modified in the last 1 month======

2011-08-19 22:56:14 ----D---- C:\Windows\Temp
2011-08-19 22:54:50 ----D---- C:\Users\Alex\AppData\Roaming\uTorrent
2011-08-19 22:50:32 ----D---- C:\Windows\Prefetch
2011-08-19 22:50:19 ----RD---- C:\Program Files
2011-08-19 22:36:34 ----D---- C:\Users\Alex\AppData\Roaming\Skype
2011-08-19 22:36:34 ----D---- C:\Users\Alex\AppData\Roaming\DAEMON Tools Lite
2011-08-19 22:36:27 ----D---- C:\Windows\Logs
2011-08-19 22:36:27 ----D---- C:\Windows\debug
2011-08-19 22:36:27 ----D---- C:\Windows
2011-08-19 22:36:01 ----SHD---- C:\System Volume Information
2011-08-19 21:13:44 ----D---- C:\Windows\system32\config
2011-08-19 21:03:21 ----D---- C:\ProgramData\NVIDIA
2011-08-19 18:34:16 ----D---- C:\Windows\system32\drivers
2011-08-19 17:31:14 ----RD---- C:\Program Files (x86)
2011-08-19 17:30:58 ----D---- C:\Windows\system32\drivers\etc
2011-08-19 17:07:46 ----SHD---- C:\Windows\Installer
2011-08-19 17:07:37 ----HD---- C:\ProgramData
2011-08-19 17:07:37 ----D---- C:\Program Files (x86)\Common Files
2011-08-19 16:08:09 ----RSD---- C:\Windows\assembly
2011-08-19 16:08:09 ----D---- C:\Windows\Microsoft.NET
2011-08-19 10:47:26 ----D---- C:\Windows\system32\catroot2
2011-08-19 09:15:34 ----D---- C:\Windows\winsxs
2011-08-19 09:15:01 ----D---- C:\Windows\System32
2011-08-19 09:14:51 ----D---- C:\Windows\SysWOW64
2011-08-19 09:14:12 ----D---- C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2011-08-19 09:12:55 ----D---- C:\Program Files\MSBuild
2011-08-19 09:12:36 ----D---- C:\Program Files\Common Files\Microsoft Shared
2011-08-19 09:11:00 ----SD---- C:\Users\Alex\AppData\Roaming\Microsoft
2011-08-19 09:11:00 ----SD---- C:\ProgramData\Microsoft
2011-08-19 09:07:11 ----D---- C:\Program Files (x86)\MSBuild
2011-08-19 09:04:38 ----D---- C:\Windows\inf
2011-08-19 09:04:28 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-08-19 08:07:48 ----D---- C:\Windows\system32\Tasks
2011-08-18 21:44:28 ----D---- C:\Program Files (x86)\Opera
2011-08-18 18:46:34 ----D---- C:\Windows\SYSWOW64\drivers
2011-08-18 09:49:21 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2011-08-15 16:13:07 ----D---- C:\Windows\Tasks
2011-08-14 18:21:12 ----D---- C:\Program Files (x86)\Java
2011-08-14 10:19:00 ----D---- C:\ProgramData\Microsoft Help
2011-08-13 19:14:54 ----A---- C:\Windows\win.ini
2011-08-12 00:34:31 ----D---- C:\Users\Alex\AppData\Roaming\vlc
2011-08-10 18:09:17 ----D---- C:\Windows\SYSWOW64\migration
2011-08-10 18:09:17 ----D---- C:\Windows\system32\migration
2011-08-10 18:09:17 ----D---- C:\Windows\AppPatch
2011-08-10 18:09:17 ----D---- C:\Program Files (x86)\Internet Explorer
2011-08-10 18:09:16 ----D---- C:\Program Files\Internet Explorer
2011-08-10 17:41:51 ----D---- C:\Windows\system32\catroot
2011-08-10 17:40:13 ----A---- C:\Windows\system32\MRT.exe
2011-08-10 08:10:51 ----D---- C:\Windows\ShellNew
2011-08-10 08:10:45 ----RSD---- C:\Windows\Fonts
2011-08-10 08:10:41 ----D---- C:\Program Files (x86)\Microsoft.NET
2011-08-10 08:02:13 ----D---- C:\ProgramData\Adobe
2011-08-10 08:02:12 ----D---- C:\Program Files (x86)\Adobe
2011-08-10 07:58:17 ----D---- C:\Windows\system32\DriverStore
2011-08-09 18:19:54 ----D---- C:\Program Files (x86)\Nexon
2011-08-09 10:36:58 ----D---- C:\Program Files\Common Files
2011-08-09 07:38:34 ----D---- C:\Program Files (x86)\uTorrent
2011-08-09 01:19:19 ----D---- C:\Program Files (x86)\Microsoft Silverlight
2011-08-08 23:11:28 ----D---- C:\ProgramData\Skype
2011-08-02 09:30:10 ----D---- C:\Windows\system32\wfp
2011-08-02 09:30:10 ----D---- C:\Windows\system32\wbem
2011-08-02 09:30:10 ----D---- C:\Windows\system32\drivers\UMDF
2011-08-02 09:30:07 ----D---- C:\Windows\registration

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 PCTCore;PCTools KDS; C:\Windows\system32\drivers\PCTCore64.sys [2011-05-11 282440]
R0 pctDS;PC Tools Data Store; C:\Windows\system32\drivers\pctDS64.sys [2010-06-29 452872]
R0 pctEFA;PC Tools Extended File Attributes; C:\Windows\system32\drivers\pctEFA64.sys [2010-07-16 816016]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-11-20 834544]
R0 SymDS;Symantec Data Store; C:\Windows\system32\drivers\NISx64\1206000.01D\SYMDS64.SYS [2011-01-27 450680]
R0 SymEFA;Symantec Extended File Attributes; C:\Windows\system32\drivers\NISx64\1206000.01D\SYMEFA64.SYS [2011-03-15 912504]
R0 TfFsMon;TfFsMon; C:\Windows\system32\drivers\TfFsMon.sys [2011-01-20 65072]
R0 TfSysMon;TfSysMon; C:\Windows\system32\drivers\TfSysMon.sys [2011-01-20 74824]
R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [2011-05-10 481912]
R1 ISODrive;ISO DVD/CD-ROM Device Driver; \??\C:\Program Files (x86)\UltraISO\drivers\ISODrv64.sys [2010-01-29 115600]
R1 pctgntdi;pctgntdi; \??\C:\Windows\System32\drivers\pctgntdi64.sys [2011-05-06 334976]
R1 PCTSD;PC Tools Spyware Doctor Driver; C:\Windows\System32\Drivers\PCTSD64.sys [2011-03-10 279344]
R1 SCDEmu;SCDEmu; C:\Windows\system32\drivers\SCDEmu.sys [2009-11-09 91568]
R1 SRTSPX;Symantec Real Time Storage Protection (PEL) x64; C:\Windows\system32\drivers\NISx64\1206000.01D\SRTSPX64.SYS [2011-03-31 40568]
R1 SymNetS;Symantec Network Security WFP Driver; C:\Windows\System32\Drivers\NISx64\1206000.01D\SYMNETS.SYS [2011-03-22 382584]
R2 npf;NetGroup Packet Filter Driver; C:\Windows\system32\drivers\npf.sys [2010-01-27 47632]
R3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2010-02-03 33856]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2009-10-06 2009376]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda64v.sys [2009-08-21 84512]
R3 pctplsg;pctplsg; \??\C:\Windows\System32\drivers\pctplsg64.sys [2011-05-06 92896]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2009-03-01 187392]
R3 SymEvent;SymEvent; \??\C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [2011-05-11 174200]
R3 TfNetMon;TfNetMon; \??\C:\Windows\system32\drivers\TfNetMon.sys [2011-01-20 41888]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv; \??\C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys [2009-10-14 11856]
S1 BHDrvx64;BHDrvx64; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20110430.001\BHDrvx64.sys []
S1 IDSVia64;IDSVia64; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20110509.001\IDSvia64.sys []
S1 SymIRON;Symantec Iron Driver; C:\Windows\system32\drivers\NISx64\1206000.01D\Ironx64.SYS [2011-01-27 171128]
S3 afmaargw;afmaargw; C:\Windows\system32\drivers\afmaargw.sys []
S3 dump_wmimmc;dump_wmimmc; \??\H:\XNickX\Games\Dragonica\Release\GameGuard\dump_wmimmc.sys []
S3 GMSIPCI;GMSIPCI; \??\D:\INSTALL\GMSIPCI.SYS []
S3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2009-07-21 7345344]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller; C:\Windows\system32\DRIVERS\L1C62x64.sys [2009-11-27 67072]
S3 NAVENG;NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20110510.024\ENG64.SYS []
S3 NAVEX15;NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20110510.024\EX64.SYS []
S3 NPPTNT2;NPPTNT2; \??\C:\Windows\syswow64\npptNT2.sys [2005-01-03 4682]
S3 PAC7302;Eye 312; C:\Windows\system32\DRIVERS\PAC7302.SYS [2009-04-28 532480]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 pwdrvio;pwdrvio; \??\C:\Windows\syswow64\pwdrvio.sys []
S3 pwdspio;pwdspio; \??\C:\Windows\syswow64\pwdspio.sys []
S3 SRTSP;Symantec Real Time Storage Protection x64; C:\Windows\System32\Drivers\NISx64\1206000.01D\SRTSP64.SYS [2011-03-31 744568]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 59392]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 41984]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service; C:\Windows\system32\drivers\viahduaa.sys [2009-09-17 1250816]
S3 VSPerfDrv100;Performance Tools Driver 10.0; \??\H:\XNickX\Applications\Microsoft Visual Studio 10.0\Team Tools\Performance Tools\x64\VSPerfDrv100.sys [2010-03-17 68440]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
R2 ddservice;ddservice; C:\Windows\update.7.1\svchostdriver.exe [2011-08-19 382464]
R2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine; C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe [2011-08-04 2329480]
R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe [2009-09-23 935208]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2010-07-09 159336]
R2 sdAuxService;PC Tools Auxiliary Service; C:\Program Files (x86)\PC Tools Security\pctsAuxs.exe [2011-02-18 371472]
R2 sdCoreService;PC Tools Security Service; C:\Program Files (x86)\PC Tools Security\pctsSvc.exe [2011-04-06 1117144]
R2 SeaPort;SeaPort; C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2010-09-22 249136]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-07-09 248936]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe [2009-11-17 1353544]
R2 UxTuneUp;@%SystemRoot%\System32\uxtuneup.dll,-4096; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2010-09-21 2286976]
R3 ThreatFire;ThreatFire; C:\Program Files (x86)\PC Tools Security\TFEngine\TFService.exe [2011-01-20 70928]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-12-04 136176]
S3 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2010-03-18 44376]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-12-04 136176]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 npggsvc;nProtect GameGuard Service; C:\Windows\syswow64\GameMon.des [2011-05-03 4092408]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2011-03-29 403240]
S3 TuneUp.Defrag;@C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe,-1; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe [2010-11-20 607048]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-11-20 1255736]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

-----------------EOF-----------------

[Caroprd111]

Zdravím a vítám vás na našem bezpečnostním fóru viry.cz

Můj nick je Caroprd111. Budu se vám v tomto topicu věnovat a snažit se odstranit všechny vaše problémy s počítačem.
Než začneme, přečtěte si prosím následující poznámky.

• Pokud nemáte, zálohujte si všechna důležitá data. Infikovaný počítač je nevyzpytatelný.
• Důsledně a pečlivě si přečtěte celý postup, poté pokračujte po jednotlivých krocích.
• Prosím, nespouštějte žádné další programy na vlastní pěst, zejména ComboFix. Zbytečně tím můžete zkomplikovat odvirování, dokonce i znefunkčnit systém.
• Absence příznaků nemusí vždy znamenat, že je počítač čistý, proto vždy spolupracujte až do doby, než vám napíšu, že je počítač v pořádku.
• V případě, že něčemu nerozumíte nebo si nejste jist, neváhejte se mě zeptat.
• Pokud bude log dlouhý a nevejde se do jednoho příspěvku, rozdělte jej do více příspěvků.

Příště žádné cracky.


Stáhněte OTL http://oldtimer.geekstogo.com/OTL.exe na plochu

• Spusťte, poté do spodního políčka vložte následující skript.

Kód: Vybrat vše

 
safebootminimal 
safebootnetwork
drivers32
savembr:0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s
/md5start
scecli.dll
autochk.exe
csrss.exe
explorer.exe
lsass.exe
services.exe
smss.exe
spoolsv.exe
svchost.exe
userinit.exe
winlogon.exe
atapi.sys
cdrom.sys 
ndis.sys
ntfs.sys
tcpip.sys
%SystemDrive%\PhysicalMBR.bin
/md5stop
C:\windows\system32\spool\prtprocs|dll;true;true;true /FP
%systemroot%\system32\drivers\*.sys /5
%systemroot%\system32\drivers\*.sys /X 
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\system32\*.* /5
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\system32\config\*.sav 
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\*.* /U /s
%systemroot%\*. /mp /s
%ALLUSERSPROFILE%\Data Aplikací\*.*
%ALLUSERSPROFILE%\Data Aplikací\*.exe /s
%ALLUSERSPROFILE%\Dáta aplikácií\*.*
%ALLUSERSPROFILE%\Dáta aplikácií\*.exe /s
%APPDATA%\*.
%APPDATA%\*.*
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /s
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon" /v GinaDLL /c
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv" /v ImagePath /c
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS" /v ImagePath /c
reg query "HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager" /v BootExecute /c
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager" /v "PendingFileRenameOperations" /c
type c:\boot.ini >> test.txt /c
*crack*
*keygen*

• Označte položku Pro všechny uživatele.
• Označte položky Kontrola na havěť "LOP" a Kontrola na havěť "Purity"
• Klikněte na tlačítko Prohledat
• Po dokončení, sem vložte logy OTL.Txt a Extras.txt

[XNickX]

Takže jsem udělal vše, co jste mi napsal....ale když to "scanuje" tak se sekne pc a myš na:

Kód: Vybrat vše

C:\Windows\SysNative\kernel32.dll

A pomůže jen restart pc...

[Caroprd111]

Zkuste OTL spustit bez prohledávacího skriptu - prostě jen vynechte krok vložení textu do bílého okna.

[XNickX]

Nejde to i bez toho kódu... Vždy s sekne pc na tom kernel32.dll.

[Caroprd111]

Pokračujte podle návodu http://www.bleepingcomputer.com/combofi ... t-combofix

[XNickX]

Zde log z ComboFixu:
ComboFix 11-08-21.01 - Alex 21.08.2011 20:01:20.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.4095.2879 [GMT 2:00]
Spuštěný z: c:\users\Alex\Desktop\ComboFix.exe
AV: Spyware Doctor with AntiVirus *Enabled/Updated* {2F668A56-D5E0-2DF1-A0AE-CB1284F42AB2}
SP: Spyware Doctor with AntiVirus *Disabled/Outdated* {94076BB2-F3DA-227F-9A1E-F060FF73600F}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Amazon.ico
c:\programdata\MercadoLivre.ico
c:\programdata\QuickStores.ico
c:\users\Alex\AppData\Roaming\cacaoweb
c:\users\Alex\AppData\Roaming\cacaoweb\ad96D9145E8C867A23E1125CAAA9681BE1.ad
c:\users\Alex\AppData\Roaming\cacaoweb\cacaoweb.exe
c:\users\Alex\AppData\Roaming\cacaoweb\errorlog.txt
c:\users\Alex\AppData\Roaming\cacaoweb\npdfile.dat
c:\users\Alex\AppData\Roaming\cacaoweb\storage.db
c:\users\Alex\AppData\Roaming\Microsoft\Iso64
c:\users\Alex\AppData\Roaming\Microsoft\Iso64\l.txt
c:\windows\1911.dll
c:\windows\iun6002.exe
c:\windows\system32\Startup.exe
c:\windows\SysWow64\Core.dll
c:\windows\SysWow64\Packet.dll
c:\windows\SysWow64\pthreadVC.dll
c:\windows\SysWow64\wpcap.dll
c:\windows\winlog-dirs.txt
c:\windows\winlog-ids.txt
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_NPF
-------\Service_npf
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-07-21 do 2011-08-21 )))))))))))))))))))))))))))))))
.
.
2011-08-21 18:08 . 2011-08-21 18:08 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-08-21 08:12 . 2011-08-21 08:55 512 ----a-w- C:\PhysicalMBR.bin
2011-08-21 07:05 . 2011-08-21 07:05 -------- d-----w- c:\users\Alex\AppData\Local\SKIDROW
2011-08-20 21:08 . 2011-08-20 21:08 -------- d-----w- c:\program files (x86)\SystemRequirementsLab
2011-08-20 21:08 . 2011-08-20 21:08 -------- d-----w- c:\users\Alex\SystemRequirementsLab
2011-08-20 21:08 . 2011-08-20 21:08 -------- d-----w- c:\windows\Sun
2011-08-19 20:50 . 2011-08-19 20:56 -------- d-----w- c:\program files\trend micro
2011-08-19 20:50 . 2011-08-19 20:50 -------- d-----w- C:\rsit
2011-08-19 20:34 . 2011-08-19 20:34 -------- d-----w- c:\program files\CCleaner
2011-08-19 16:34 . 2011-01-20 11:27 74824 --s---w- c:\windows\system32\drivers\TfSysMon.sys
2011-08-19 16:34 . 2011-01-20 11:27 65072 --s---w- c:\windows\system32\drivers\TfFsMon.sys
2011-08-19 16:34 . 2011-01-20 11:27 41888 --s---w- c:\windows\system32\drivers\TfNetMon.sys
2011-08-19 15:07 . 2011-05-12 06:59 140800 ----a-w- c:\windows\system32\drivers\pctwfpfilter64.sys
2011-08-19 15:07 . 2011-05-06 11:27 334976 ----a-w- c:\windows\system32\drivers\pctgntdi64.sys
2011-08-19 15:07 . 2010-07-16 12:53 816016 ----a-w- c:\windows\system32\drivers\pctEFA64.sys
2011-08-19 15:07 . 2010-06-29 08:35 452872 ----a-w- c:\windows\system32\drivers\pctDS64.sys
2011-08-19 15:07 . 2011-05-11 07:55 282440 ----a-w- c:\windows\system32\drivers\PCTCore64.sys
2011-08-19 15:07 . 2011-03-10 07:08 279344 ----a-w- c:\windows\system32\drivers\PCTSD64.sys
2011-08-19 15:07 . 2011-05-06 11:28 92896 ----a-w- c:\windows\system32\drivers\pctplsg64.sys
2011-08-19 15:07 . 2011-08-21 17:59 -------- d-----w- c:\program files (x86)\PC Tools Security
2011-08-19 15:07 . 2011-08-19 15:16 -------- d-----w- c:\program files (x86)\Common Files\PC Tools
2011-08-19 14:55 . 2011-08-19 15:30 -------- d-----w- c:\programdata\PC Tools
2011-08-19 11:32 . 2011-08-19 11:32 -------- d--h--w- c:\windows\update.7.1
2011-08-19 08:49 . 2011-08-19 15:35 -------- d-----w- c:\windows\ufa
2011-08-19 08:45 . 2011-08-19 08:49 246272 ----a-w- c:\windows\unrar.exe
2011-08-19 08:44 . 2011-08-19 08:44 -------- d-----w- c:\windows\av_ico
2011-08-19 08:42 . 2011-08-19 15:31 -------- d--h--w- c:\windows\update.tray-3-0
2011-08-19 08:42 . 2011-08-19 15:31 -------- d--h--w- c:\windows\update.tray-10-0
2011-08-19 08:42 . 2011-08-19 08:42 -------- d--h--w- c:\windows\update.tray-3-0-lnk
2011-08-19 08:42 . 2011-08-19 08:42 -------- d--h--w- c:\windows\update.tray-10-0-lnk
2011-08-19 07:15 . 2011-08-19 07:15 -------- d-----w- c:\program files\Microsoft SQL Server
2011-08-19 07:14 . 2011-08-19 07:14 -------- d-----w- c:\program files (x86)\Microsoft SQL Server
2011-08-19 07:14 . 2011-08-19 07:14 -------- d-----w- c:\program files\Microsoft Sync Framework
2011-08-19 07:05 . 2011-08-19 07:05 -------- d-----w- c:\windows\system32\1033
2011-08-19 07:05 . 2011-08-19 07:05 -------- d-----w- c:\windows\symbols
2011-08-19 07:05 . 2011-08-19 07:05 -------- d-----w- c:\program files\Microsoft Help Viewer
2011-08-17 21:52 . 2011-08-17 21:52 -------- d-----w- c:\users\Alex\AppData\Roaming\runic games
2011-08-17 21:49 . 2011-08-17 21:49 -------- d-----w- c:\users\Alex\AppData\Roaming\InstallShield
2011-08-17 03:35 . 2011-08-17 03:35 0 ---ha-w- c:\users\Alex\AppData\Local\BIT1361.tmp
2011-08-14 16:21 . 2011-08-14 16:21 -------- d-----w- c:\program files (x86)\Common Files\Java
2011-08-12 19:32 . 2011-08-12 19:32 331908 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\setup.dll
2011-08-12 19:32 . 2011-08-12 19:32 200836 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iGdi.dll
2011-08-12 19:32 . 2005-04-03 21:02 753664 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iKernel.dll
2011-08-12 19:32 . 2005-04-03 21:02 69714 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\ctor.dll
2011-08-12 19:32 . 2005-04-03 21:01 274432 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iscript.dll
2011-08-12 19:32 . 2005-04-03 21:00 184320 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iuser.dll
2011-08-12 19:32 . 2005-04-03 21:00 63488 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\ISBEW64.exe
2011-08-12 19:32 . 2005-04-03 20:59 5632 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\DotNetInstaller.exe
2011-08-12 19:32 . 2011-08-13 08:16 -------- d-----w- c:\users\Alex\AppData\Local\Oblivion
2011-08-11 10:47 . 2011-08-11 10:47 -------- d-----w- c:\program files (x86)\DivX
2011-08-11 10:47 . 2011-08-11 10:47 -------- d-----w- c:\program files (x86)\Common Files\DivX Shared
2011-08-11 10:39 . 2011-08-21 16:56 -------- d-----w- c:\users\Alex\riotsGamesLogs
2011-08-11 10:09 . 2011-08-11 10:09 -------- d-----w- c:\users\Alex\AppData\Roaming\LolClient
2011-08-11 09:15 . 2008-07-12 06:18 467984 ----a-w- c:\windows\SysWow64\d3dx10_39.dll
2011-08-11 09:15 . 2008-07-12 06:18 1493528 ----a-w- c:\windows\SysWow64\D3DCompiler_39.dll
2011-08-11 09:15 . 2008-07-12 06:18 3851784 ----a-w- c:\windows\SysWow64\D3DX9_39.dll
2011-08-11 07:41 . 2011-08-21 18:11 -------- d-----w- c:\users\Alex\AppData\Local\PMB Files
2011-08-11 07:41 . 2011-08-21 16:56 -------- d-----w- c:\programdata\PMB Files
2011-08-11 07:35 . 2011-08-11 07:35 -------- d-----w- c:\program files (x86)\Pando Networks
2011-08-10 16:11 . 2011-08-10 16:11 -------- d-----w- c:\program files (x86)\LogMeIn Hamachi
2011-08-10 15:42 . 2011-08-10 15:42 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help
2011-08-10 06:11 . 2011-08-13 17:15 -------- d-----w- c:\program files (x86)\Microsoft Works
2011-08-10 06:10 . 2011-08-10 06:10 -------- d-----w- c:\windows\PCHEALTH
2011-08-10 06:08 . 2011-08-10 06:08 -------- d-----w- c:\program files (x86)\Microsoft Visual Studio 8
2011-08-10 06:07 . 2011-08-10 06:07 -------- d-----r- C:\MSOCache
2011-08-10 06:02 . 2011-08-10 06:02 -------- d-----w- c:\program files (x86)\Common Files\Adobe
2011-08-09 14:47 . 2011-08-09 14:47 -------- d-----w- c:\users\Alex\AppData\Local\Aspyr
2011-08-09 14:46 . 2011-08-09 14:46 -------- d--h--r- c:\users\Alex\AppData\Roaming\SecuROM
2011-08-09 14:31 . 2011-08-09 14:31 -------- d-----w- c:\program files (x86)\MiniTool Partition Wizard Home Edition 6.0
2011-08-09 14:16 . 2011-05-06 12:30 821832 ----a-w- c:\windows\system32\pwNative.exe
2011-08-09 14:16 . 2011-05-06 12:30 19936 ------w- c:\windows\system32\pwdrvio.sys
2011-08-09 14:16 . 2011-05-06 12:30 13280 ------w- c:\windows\system32\pwdspio.sys
2011-08-09 08:38 . 2011-05-03 20:18 4092408 ----a-w- c:\windows\SysWow64\GameMon.des
2011-08-09 08:37 . 2005-01-03 15:43 4682 ----a-w- c:\windows\SysWow64\npptNT2.sys
2011-08-09 08:37 . 2003-07-20 00:17 5174 ----a-w- c:\windows\SysWow64\nppt9x.vxd
2011-08-09 08:36 . 2011-08-09 08:36 -------- d-----w- c:\program files\Common Files\INCA Shared
2011-08-09 06:10 . 2011-08-12 08:42 -------- d-----w- c:\users\Alex\AppData\Roaming\BSplayer
2011-08-09 06:10 . 2011-08-09 06:10 -------- d-----w- c:\users\Alex\AppData\Roaming\BSplayer Pro
2011-08-09 06:10 . 2011-08-09 06:10 -------- d-----w- c:\program files (x86)\Webteh
2011-08-09 05:44 . 2011-08-21 17:51 -------- d-----w- c:\users\Alex\AppData\Roaming\.minecraft
2011-08-09 05:38 . 2011-08-09 05:38 -------- d-----w- c:\users\Alex\AppData\Local\uTorrent
2011-08-08 21:22 . 2011-08-08 21:22 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll
2011-08-08 21:22 . 2011-08-08 21:22 484160 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-08-08 21:11 . 2011-08-08 21:11 -------- d-----r- c:\program files (x86)\Skype
2011-08-08 20:39 . 2011-08-08 20:39 -------- d-----w- c:\users\Alex\AppData\Local\Mozilla
2011-08-08 20:12 . 2011-02-25 06:22 861696 ----a-w- c:\windows\system32\oleaut32.dll
2011-08-08 20:12 . 2011-02-25 05:34 571904 ----a-w- c:\windows\SysWow64\oleaut32.dll
2011-08-08 20:12 . 2011-05-24 11:42 404480 ----a-w- c:\windows\system32\umpnpmgr.dll
2011-08-08 20:12 . 2011-05-24 10:40 64512 ----a-w- c:\windows\SysWow64\devobj.dll
2011-08-08 20:12 . 2011-05-24 10:40 44544 ----a-w- c:\windows\SysWow64\devrtl.dll
2011-08-08 20:12 . 2011-05-24 10:39 145920 ----a-w- c:\windows\SysWow64\cfgmgr32.dll
2011-08-08 20:12 . 2011-05-24 10:37 252928 ----a-w- c:\windows\SysWow64\drvinst.exe
2011-08-08 20:12 . 2011-06-11 03:07 3137536 ----a-w- c:\windows\system32\win32k.sys
2011-08-08 20:12 . 2011-05-03 05:29 976896 ----a-w- c:\windows\system32\inetcomm.dll
2011-08-08 20:12 . 2011-05-03 04:30 741376 ----a-w- c:\windows\SysWow64\inetcomm.dll
2011-08-08 05:46 . 2011-08-08 05:46 0 ---ha-w- c:\users\Alex\AppData\Local\BIT5DD6.tmp
2011-08-03 06:10 . 2011-08-03 06:10 0 ---ha-w- c:\users\Alex\AppData\Local\BITC5C2.tmp
2011-07-24 11:40 . 2011-07-24 11:40 0 ---ha-w- c:\users\Alex\AppData\Local\BIT24CA.tmp
2011-07-24 11:38 . 2011-07-24 11:38 0 ---ha-w- c:\users\Alex\AppData\Local\BIT3A1.tmp
2011-07-23 20:35 . 2011-07-23 20:35 0 ---ha-w- c:\users\Alex\AppData\Local\BITAA4A.tmp
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-16 04:26 . 2011-08-10 12:10 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2011-07-11 10:46 . 2011-07-11 10:46 0 ---ha-w- c:\users\Alex\AppData\Local\BIT362.tmp
2011-05-28 12:26 . 2011-05-28 12:26 71680 ----a-w- c:\windows\system32\frapsv64.dll
2011-05-28 12:26 . 2011-05-28 12:26 65536 ----a-w- c:\windows\SysWow64\frapsvid.dll
2010-10-16 10:50 . 2010-12-10 21:10 3056008 ----a-w- c:\program files (x86)\Common Files\AskToolbarInstaller.exe
2010-01-26 09:11 . 2010-12-10 21:10 444283 ----a-w- c:\program files (x86)\Common Files\WinPcapNmap.exe
2009-09-08 14:48 64735 --sha-r- c:\windows\ConfigSetRoot\command.com
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2011-02-01 1487240]
"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files (x86)\uTorrentBar\tbuTor.dll" [2010-12-09 3911776]
.
[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
.
[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
2010-12-09 10:51 3911776 ----a-w- c:\program files (x86)\uTorrentBar\tbuTor.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2011-02-01 17:17 1487240 ----a-w- c:\program files (x86)\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2011-02-01 1487240]
"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files (x86)\uTorrentBar\tbuTor.dll" [2010-12-09 3911776]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
"uTorrent"="c:\program files (x86)\uTorrent\uTorrent.exe" [2011-08-09 639864]
"Pando Media Booster"="c:\program files (x86)\Pando Networks\Media Booster\PMB.exe" [2011-08-11 3077528]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"PWRISOVM.EXE"="c:\program files (x86)\PowerISO\PWRISOVM.EXE" [2009-11-09 180224]
"amd_dc_opt"="c:\program files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2011-08-04 1955208]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
LOLRecorder.lnk - h:\xnickx\Applications\LOLReplay\LOLRecorder.exe [2011-8-16 360448]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableSecureUIAPaths"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux4"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"DisableThumbnailCache"=dword:00000001
.
R1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20110430.001\BHDrvx64.sys [x]
R1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20110509.001\IDSvia64.sys [x]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1206000.01D\Ironx64.SYS [x]
R2 ddservice;ddservice;c:\windows\update.7.1\svchostdriver.exe [2011-08-19 382464]
R2 gupdate;Služba Google Update (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-04 136176]
R3 dump_wmimmc;dump_wmimmc;h:\xnickx\Games\Dragonica\Release\GameGuard\dump_wmimmc.sys [x]
R3 gupdatem;Služba Google Update (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-04 136176]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [x]
R3 pctplsg;pctplsg;c:\windows\System32\drivers\pctplsg64.sys [x]
R3 pwdrvio;pwdrvio;c:\windows\system32\pwdrvio.sys [x]
R3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys [x]
R3 sdAuxService;PC Tools Auxiliary Service;c:\program files (x86)\PC Tools Security\pctsAuxs.exe [2011-02-18 371472]
R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [x]
R3 ThreatFire;ThreatFire;c:\program files (x86)\PC Tools Security\TFEngine\TFService.exe service [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [x]
R3 VSPerfDrv100;Performance Tools Driver 10.0;h:\xnickx\Applications\Microsoft Visual Studio 10.0\Team Tools\Performance Tools\x64\VSPerfDrv100.sys [2010-03-17 68440]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore64.sys [x]
S0 pctDS;PC Tools Data Store;c:\windows\system32\drivers\pctDS64.sys [x]
S0 pctEFA;PC Tools Extended File Attributes;c:\windows\system32\drivers\pctEFA64.sys [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1206000.01D\SYMDS64.SYS [x]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1206000.01D\SYMEFA64.SYS [x]
S0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [x]
S0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [x]
S1 pctgntdi;pctgntdi;c:\windows\System32\drivers\pctgntdi64.sys [x]
S1 PCTSD;PC Tools Spyware Doctor Driver;c:\windows\system32\Drivers\PCTSD64.sys [x]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NISx64\1206000.01D\SYMNETS.SYS [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [2011-08-04 2329480]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-07-09 248936]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe [2009-11-17 1353544]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys [2009-10-14 11856]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2011-08-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-04 21:07]
.
2011-08-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-04 21:07]
.
2011-08-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3133533038-1199205714-1137167784-1000Core.job
- c:\users\Alex\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-15 06:38]
.
2011-08-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3133533038-1199205714-1137167784-1000UA.job
- c:\users\Alex\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-15 06:38]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"combofix"="c:\combofix\CF443.cfxxe" [X]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-10-06 8158240]
"PAC7302_Monitor"="c:\windows\PixArt\PAC7302\Monitor.exe" [2007-12-10 323584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.seznam.cz/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
LSP: c:\program files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\jays2ko2.default\
FF - prefs.js: browser.startup.homepage - seznam.cz
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKCU-Run-cacaoweb - c:\users\Alex\AppData\Roaming\cacaoweb\cacaoweb.exe
Wow6432Node-HKLM-Run-tray_ico - (no file)
Wow6432Node-HKLM-Run-tray_ico2 - (no file)
Wow6432Node-HKLM-Run-tray_ico3 - (no file)
Wow6432Node-HKLM-Run-tray_ico4 - (no file)
Toolbar-Locked - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - (no file)
AddRemove-Cool's_Codec_pack_4.12 - c:\windows\iun6002.exe
AddRemove-NIS - c:\program files (x86)\NortonInstaller\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS\A5E82D02\18.6.0.29\InstStub.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{32099AAC-C132-4136-9E9A-4E364A424E17}"=hex:51,66,7a,6c,4c,1d,38,12,c2,99,1a,
36,00,8f,58,04,e1,8c,0d,76,4f,1c,0a,03
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=hex:51,66,7a,6c,4c,1d,38,12,11,7f,11,
d0,78,5b,08,05,de,bb,01,03,dd,4c,30,54
"{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC}"=hex:51,66,7a,6c,4c,1d,38,12,94,83,60,
bb,86,ad,dc,08,d0,28,de,c7,86,fa,1f,e8
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,
1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7
"{6EBF7485-159F-4BFF-A14F-B9E3AAC4465B}"=hex:51,66,7a,6c,4c,1d,38,12,eb,77,ac,
6a,ad,5b,91,0e,de,59,fa,a3,af,9a,02,4f
"{72853161-30C5-4D22-B7F9-0BBC1D38A37E}"=hex:51,66,7a,6c,4c,1d,38,12,0f,32,96,
76,f7,7e,4c,08,c8,ef,48,fc,18,66,e7,6a
"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,
94,30,02,d1,0f,f1,da,12,24,73,56,27,d2
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
"{DDA57003-0068-4ED2-9D32-4D1EC707D94D}"=hex:51,66,7a,6c,4c,1d,38,12,6d,73,b6,
d9,5a,4e,bc,0b,e2,24,0e,5e,c2,59,9d,59
"{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}"=hex:51,66,7a,6c,4c,1d,38,12,8f,19,47,
2e,c4,15,0b,03,d7,b5,8c,e9,62,70,06,85
"{5802D092-1784-4908-8CDB-99B6842D353D}"=hex:51,66,7a,6c,4c,1d,38,12,fc,d3,11,
5c,b6,59,66,0c,f3,cd,da,f6,81,73,71,29
"{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16,
fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17
"{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,38,12,11,dd,f9,
b9,57,8c,be,54,c3,fb,43,e0,cc,54,f1,1b
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:e1,2d,2c,c2,18,60,cc,01
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,9d,73,8e,1f,45,39,fd,44,bc,c1,27,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,9d,73,8e,1f,45,39,fd,44,bc,c1,27,\
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
c:\program files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
.
**************************************************************************
.
Celkový čas: 2011-08-21 20:24:04 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-08-21 18:23
.
Před spuštěním: Volných bajtů: 109 389 168 640
Po spuštění: Volných bajtů: 109 353 664 512
.
- - End Of File - - 5F998D1963502D2C5F996F5D114FD10F[/code]

Jinak: Čekám na další pokyny...a facebook.com už funguje ....Děkuji mnohokrát...teď už jen pokud potřebujete ještě něco zkontrolovat, nebo vymazat "zbytky" ne ?

[Caroprd111]

Co mi řeknete na SKIDROW

[XNickX]

SKIDROW? Pc je nové, koupili jsme ho přes inzerát...jen jsme vytvořili nový oddíl a přetáhly věci z C na H...Ještě jsme nějak netřídily věci co tam byli.

[Caroprd111]

No je to známý tvůrce cracků her.


Pokud nemáte, přesuňte Combofix na plochu

• Otevřete si Poznámkový blok a zkopírujte do něj text z bílého okénka.

Kód: Vybrat vše

File::
c:\windows\unrar.exe
c:\users\Alex\AppData\Local\BIT1361.tmp
c:\users\Alex\AppData\Local\BIT5DD6.tmp
c:\users\Alex\AppData\Local\BITC5C2.tmp
c:\users\Alex\AppData\Local\BIT24CA.tmp
c:\users\Alex\AppData\Local\BIT3A1.tmp
c:\users\Alex\AppData\Local\BITAA4A.tmp
c:\program files (x86)\Common Files\AskToolbarInstaller.exe
c:\users\Alex\AppData\Local\BIT362.tmp

Folder::
c:\users\Alex\AppData\Local\SKIDROW
c:\users\Default\AppData\Local\temp
c:\windows\update.7.1
c:\windows\ufa
c:\windows\av_ico
c:\windows\update.tray-3-0
c:\windows\update.tray-10-0
c:\windows\update.tray-3-0-lnk
c:\windows\update.tray-10-0-lnk
c:\windows\system32\1033
c:\program files (x86)\Ask.com
c:\program files (x86)\uTorrentBar

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"combofix"=-
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"=-
"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"=-
[-HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
[-HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
[-HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
[-HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

RegLock::
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

• Uložte Vámi vytvořený TXT soubor jako CFScript.txt na plochu
• Po uložení uchopte vámi vytvořený skript levým myšítkem a přesuňte ho nad ikonu Combofixu, kde ho upustíte:
  
  
• Po aplikaci na Vás vypadne další log,vložte ho sem

Může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou, v tom případě znovu restartujte a přitom mačkejte F8, pak zvolte Poslední známou funkční konfiguraci

[XNickX]

ComboFix 11-08-21.01 - Alex 21.08.2011 22:34:28.2.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.4095.2726 [GMT 2:00]
Spuštěný z: c:\users\Alex\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Alex\Desktop\CFScript.txt
AV: Spyware Doctor with AntiVirus *Disabled/Updated* {2F668A56-D5E0-2DF1-A0AE-CB1284F42AB2}
SP: Spyware Doctor with AntiVirus *Disabled/Outdated* {94076BB2-F3DA-227F-9A1E-F060FF73600F}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\program files (x86)\Common Files\AskToolbarInstaller.exe"
"c:\users\Alex\AppData\Local\BIT1361.tmp"
"c:\users\Alex\AppData\Local\BIT24CA.tmp"
"c:\users\Alex\AppData\Local\BIT362.tmp"
"c:\users\Alex\AppData\Local\BIT3A1.tmp"
"c:\users\Alex\AppData\Local\BIT5DD6.tmp"
"c:\users\Alex\AppData\Local\BITAA4A.tmp"
"c:\users\Alex\AppData\Local\BITC5C2.tmp"
"c:\windows\unrar.exe"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Ask.com
c:\program files (x86)\Ask.com\assets\oobe\b.png
c:\program files (x86)\Ask.com\assets\oobe\bl.png
c:\program files (x86)\Ask.com\assets\oobe\br.png
c:\program files (x86)\Ask.com\assets\oobe\l.png
c:\program files (x86)\Ask.com\assets\oobe\pointer.png
c:\program files (x86)\Ask.com\assets\oobe\r.png
c:\program files (x86)\Ask.com\assets\oobe\t.png
c:\program files (x86)\Ask.com\assets\oobe\tl.png
c:\program files (x86)\Ask.com\assets\oobe\tr.png
c:\program files (x86)\Ask.com\cobrand.ico
c:\program files (x86)\Ask.com\config.xml
c:\program files (x86)\Ask.com\favicon.ico
c:\program files (x86)\Ask.com\fv_67cf.ico
c:\program files (x86)\Ask.com\GenericAskToolbar.dll
c:\program files (x86)\Ask.com\mupcfg.xml
c:\program files (x86)\Ask.com\SaUpdate.exe
c:\program files (x86)\Ask.com\UpdateTask.exe
c:\program files (x86)\Common Files\AskToolbarInstaller.exe
c:\program files (x86)\uTorrentBar
c:\program files (x86)\uTorrentBar\GottenAppsContextMenu.xml
c:\program files (x86)\uTorrentBar\OtherAppsContextMenu.xml
c:\program files (x86)\uTorrentBar\SharedAppsContextMenu.xml
c:\program files (x86)\uTorrentBar\tbuTor.dll
c:\program files (x86)\uTorrentBar\toolbar.cfg
c:\program files (x86)\uTorrentBar\ToolbarContextMenu.xml
c:\program files (x86)\uTorrentBar\UNWISE.EXE
c:\program files (x86)\uTorrentBar\uTorrentBarToolbarHelper.exe
c:\users\Alex\AppData\Local\BIT1361.tmp
c:\users\Alex\AppData\Local\BIT24CA.tmp
c:\users\Alex\AppData\Local\BIT362.tmp
c:\users\Alex\AppData\Local\BIT3A1.tmp
c:\users\Alex\AppData\Local\BIT5DD6.tmp
c:\users\Alex\AppData\Local\BITAA4A.tmp
c:\users\Alex\AppData\Local\BITC5C2.tmp
c:\users\Alex\AppData\Local\SKIDROW
c:\users\Alex\AppData\Local\SKIDROW\620\Stats.bin
c:\users\Default\AppData\Local\temp
c:\windows\av_ico
c:\windows\av_ico\ico_NOD_SS_START.ico
c:\windows\av_ico\ico_NOD_SYSINSP.ico
c:\windows\av_ico\ico_NOD_SYSRESC.ico
c:\windows\av_ico\ico_NOD_TXT.ico
c:\windows\av_ico\ico_NOD_UNINSTALL.ico
c:\windows\av_ico\ico_norton_start.ico
c:\windows\system32\1033
c:\windows\system32\1033\vsjitdebuggerui.dll
c:\windows\ufa
c:\windows\unrar.exe
c:\windows\update.7.1
c:\windows\update.7.1\svchostdriver.exe
c:\windows\update.tray-10-0-lnk
c:\windows\update.tray-10-0-lnk\svchost.exe
c:\windows\update.tray-10-0
c:\windows\update.tray-3-0-lnk
c:\windows\update.tray-3-0-lnk\svchost.exe
c:\windows\update.tray-3-0
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_ddservice
-------\Service_ddservice
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-07-21 do 2011-08-21 )))))))))))))))))))))))))))))))
.
.
2011-08-21 08:12 . 2011-08-21 08:55 512 ----a-w- C:\PhysicalMBR.bin
2011-08-20 21:08 . 2011-08-20 21:08 -------- d-----w- c:\program files (x86)\SystemRequirementsLab
2011-08-20 21:08 . 2011-08-20 21:08 -------- d-----w- c:\users\Alex\SystemRequirementsLab
2011-08-20 21:08 . 2011-08-20 21:08 -------- d-----w- c:\windows\Sun
2011-08-19 20:50 . 2011-08-19 20:56 -------- d-----w- c:\program files\trend micro
2011-08-19 20:50 . 2011-08-19 20:50 -------- d-----w- C:\rsit
2011-08-19 20:34 . 2011-08-19 20:34 -------- d-----w- c:\program files\CCleaner
2011-08-19 16:34 . 2011-01-20 11:27 74824 --s---w- c:\windows\system32\drivers\TfSysMon.sys
2011-08-19 16:34 . 2011-01-20 11:27 65072 --s---w- c:\windows\system32\drivers\TfFsMon.sys
2011-08-19 16:34 . 2011-01-20 11:27 41888 --s---w- c:\windows\system32\drivers\TfNetMon.sys
2011-08-19 15:07 . 2011-05-12 06:59 140800 ----a-w- c:\windows\system32\drivers\pctwfpfilter64.sys
2011-08-19 15:07 . 2011-05-06 11:27 334976 ----a-w- c:\windows\system32\drivers\pctgntdi64.sys
2011-08-19 15:07 . 2010-07-16 12:53 816016 ----a-w- c:\windows\system32\drivers\pctEFA64.sys
2011-08-19 15:07 . 2010-06-29 08:35 452872 ----a-w- c:\windows\system32\drivers\pctDS64.sys
2011-08-19 15:07 . 2011-05-11 07:55 282440 ----a-w- c:\windows\system32\drivers\PCTCore64.sys
2011-08-19 15:07 . 2011-03-10 07:08 279344 ----a-w- c:\windows\system32\drivers\PCTSD64.sys
2011-08-19 15:07 . 2011-05-06 11:28 92896 ----a-w- c:\windows\system32\drivers\pctplsg64.sys
2011-08-19 15:07 . 2011-08-21 17:59 -------- d-----w- c:\program files (x86)\PC Tools Security
2011-08-19 15:07 . 2011-08-19 15:16 -------- d-----w- c:\program files (x86)\Common Files\PC Tools
2011-08-19 14:55 . 2011-08-19 15:30 -------- d-----w- c:\programdata\PC Tools
2011-08-19 07:15 . 2011-08-19 07:15 -------- d-----w- c:\program files\Microsoft SQL Server
2011-08-19 07:14 . 2011-08-19 07:14 -------- d-----w- c:\program files (x86)\Microsoft SQL Server
2011-08-19 07:14 . 2011-08-19 07:14 -------- d-----w- c:\program files\Microsoft Sync Framework
2011-08-19 07:05 . 2011-08-19 07:05 -------- d-----w- c:\windows\symbols
2011-08-19 07:05 . 2011-08-19 07:05 -------- d-----w- c:\program files\Microsoft Help Viewer
2011-08-17 21:52 . 2011-08-17 21:52 -------- d-----w- c:\users\Alex\AppData\Roaming\runic games
2011-08-17 21:49 . 2011-08-17 21:49 -------- d-----w- c:\users\Alex\AppData\Roaming\InstallShield
2011-08-14 16:21 . 2011-08-14 16:21 -------- d-----w- c:\program files (x86)\Common Files\Java
2011-08-12 19:32 . 2011-08-12 19:32 331908 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\setup.dll
2011-08-12 19:32 . 2011-08-12 19:32 200836 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iGdi.dll
2011-08-12 19:32 . 2005-04-03 21:02 753664 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iKernel.dll
2011-08-12 19:32 . 2005-04-03 21:02 69714 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\ctor.dll
2011-08-12 19:32 . 2005-04-03 21:01 274432 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iscript.dll
2011-08-12 19:32 . 2005-04-03 21:00 184320 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iuser.dll
2011-08-12 19:32 . 2005-04-03 21:00 63488 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\ISBEW64.exe
2011-08-12 19:32 . 2005-04-03 20:59 5632 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\DotNetInstaller.exe
2011-08-12 19:32 . 2011-08-13 08:16 -------- d-----w- c:\users\Alex\AppData\Local\Oblivion
2011-08-11 10:47 . 2011-08-11 10:47 -------- d-----w- c:\program files (x86)\DivX
2011-08-11 10:47 . 2011-08-11 10:47 -------- d-----w- c:\program files (x86)\Common Files\DivX Shared
2011-08-11 10:39 . 2011-08-21 16:56 -------- d-----w- c:\users\Alex\riotsGamesLogs
2011-08-11 10:09 . 2011-08-11 10:09 -------- d-----w- c:\users\Alex\AppData\Roaming\LolClient
2011-08-11 09:15 . 2008-07-12 06:18 467984 ----a-w- c:\windows\SysWow64\d3dx10_39.dll
2011-08-11 09:15 . 2008-07-12 06:18 1493528 ----a-w- c:\windows\SysWow64\D3DCompiler_39.dll
2011-08-11 09:15 . 2008-07-12 06:18 3851784 ----a-w- c:\windows\SysWow64\D3DX9_39.dll
2011-08-11 07:41 . 2011-08-21 20:38 -------- d-----w- c:\users\Alex\AppData\Local\PMB Files
2011-08-11 07:41 . 2011-08-21 16:56 -------- d-----w- c:\programdata\PMB Files
2011-08-11 07:35 . 2011-08-11 07:35 -------- d-----w- c:\program files (x86)\Pando Networks
2011-08-10 16:11 . 2011-08-10 16:11 -------- d-----w- c:\program files (x86)\LogMeIn Hamachi
2011-08-10 15:42 . 2011-08-10 15:42 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help
2011-08-10 06:11 . 2011-08-13 17:15 -------- d-----w- c:\program files (x86)\Microsoft Works
2011-08-10 06:10 . 2011-08-10 06:10 -------- d-----w- c:\windows\PCHEALTH
2011-08-10 06:08 . 2011-08-10 06:08 -------- d-----w- c:\program files (x86)\Microsoft Visual Studio 8
2011-08-10 06:07 . 2011-08-10 06:07 -------- d-----r- C:\MSOCache
2011-08-10 06:02 . 2011-08-10 06:02 -------- d-----w- c:\program files (x86)\Common Files\Adobe
2011-08-09 14:47 . 2011-08-09 14:47 -------- d-----w- c:\users\Alex\AppData\Local\Aspyr
2011-08-09 14:46 . 2011-08-09 14:46 -------- d--h--r- c:\users\Alex\AppData\Roaming\SecuROM
2011-08-09 14:31 . 2011-08-09 14:31 -------- d-----w- c:\program files (x86)\MiniTool Partition Wizard Home Edition 6.0
2011-08-09 14:16 . 2011-05-06 12:30 821832 ----a-w- c:\windows\system32\pwNative.exe
2011-08-09 14:16 . 2011-05-06 12:30 19936 ------w- c:\windows\system32\pwdrvio.sys
2011-08-09 14:16 . 2011-05-06 12:30 13280 ------w- c:\windows\system32\pwdspio.sys
2011-08-09 08:38 . 2011-05-03 20:18 4092408 ----a-w- c:\windows\SysWow64\GameMon.des
2011-08-09 08:37 . 2005-01-03 15:43 4682 ----a-w- c:\windows\SysWow64\npptNT2.sys
2011-08-09 08:37 . 2003-07-20 00:17 5174 ----a-w- c:\windows\SysWow64\nppt9x.vxd
2011-08-09 08:36 . 2011-08-09 08:36 -------- d-----w- c:\program files\Common Files\INCA Shared
2011-08-09 06:10 . 2011-08-12 08:42 -------- d-----w- c:\users\Alex\AppData\Roaming\BSplayer
2011-08-09 06:10 . 2011-08-09 06:10 -------- d-----w- c:\users\Alex\AppData\Roaming\BSplayer Pro
2011-08-09 06:10 . 2011-08-09 06:10 -------- d-----w- c:\program files (x86)\Webteh
2011-08-09 05:44 . 2011-08-21 17:51 -------- d-----w- c:\users\Alex\AppData\Roaming\.minecraft
2011-08-09 05:38 . 2011-08-09 05:38 -------- d-----w- c:\users\Alex\AppData\Local\uTorrent
2011-08-08 21:22 . 2011-08-08 21:22 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll
2011-08-08 21:22 . 2011-08-08 21:22 484160 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-08-08 21:11 . 2011-08-08 21:11 -------- d-----r- c:\program files (x86)\Skype
2011-08-08 20:39 . 2011-08-08 20:39 -------- d-----w- c:\users\Alex\AppData\Local\Mozilla
2011-08-08 20:12 . 2011-02-25 06:22 861696 ----a-w- c:\windows\system32\oleaut32.dll
2011-08-08 20:12 . 2011-02-25 05:34 571904 ----a-w- c:\windows\SysWow64\oleaut32.dll
2011-08-08 20:12 . 2011-05-24 11:42 404480 ----a-w- c:\windows\system32\umpnpmgr.dll
2011-08-08 20:12 . 2011-05-24 10:40 64512 ----a-w- c:\windows\SysWow64\devobj.dll
2011-08-08 20:12 . 2011-05-24 10:40 44544 ----a-w- c:\windows\SysWow64\devrtl.dll
2011-08-08 20:12 . 2011-05-24 10:39 145920 ----a-w- c:\windows\SysWow64\cfgmgr32.dll
2011-08-08 20:12 . 2011-05-24 10:37 252928 ----a-w- c:\windows\SysWow64\drvinst.exe
2011-08-08 20:12 . 2011-06-11 03:07 3137536 ----a-w- c:\windows\system32\win32k.sys
2011-08-08 20:12 . 2011-05-03 05:29 976896 ----a-w- c:\windows\system32\inetcomm.dll
2011-08-08 20:12 . 2011-05-03 04:30 741376 ----a-w- c:\windows\SysWow64\inetcomm.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-16 04:26 . 2011-08-10 12:10 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2011-05-28 12:26 . 2011-05-28 12:26 71680 ----a-w- c:\windows\system32\frapsv64.dll
2011-05-28 12:26 . 2011-05-28 12:26 65536 ----a-w- c:\windows\SysWow64\frapsvid.dll
2010-01-26 09:11 . 2010-12-10 21:10 444283 ----a-w- c:\program files (x86)\Common Files\WinPcapNmap.exe
2009-09-08 14:48 64735 --sha-r- c:\windows\ConfigSetRoot\command.com
.
.
((((((((((((((((((((((((((((( SnapShot@2011-08-21_18.10.39 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-07-14 05:10 . 2011-08-21 17:03 45440 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2011-08-21 18:11 45440 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2010-11-19 17:05 . 2011-08-21 18:11 18130 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3133533038-1199205714-1137167784-1000_UserData.bin
- 2011-08-21 18:09 . 2011-08-21 18:09 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-08-21 20:40 . 2011-08-21 20:40 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-08-21 18:09 . 2011-08-21 18:09 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-08-21 20:40 . 2011-08-21 20:40 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-07-14 05:01 . 2011-08-21 18:09 390900 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2011-08-21 20:39 390900 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2011-04-27 18:00 . 2011-08-21 20:39 7835512 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3133533038-1199205714-1137167784-1000-12288.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
"uTorrent"="c:\program files (x86)\uTorrent\uTorrent.exe" [2011-08-09 639864]
"Pando Media Booster"="c:\program files (x86)\Pando Networks\Media Booster\PMB.exe" [2011-08-11 3077528]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"PWRISOVM.EXE"="c:\program files (x86)\PowerISO\PWRISOVM.EXE" [2009-11-09 180224]
"amd_dc_opt"="c:\program files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2011-08-04 1955208]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
LOLRecorder.lnk - h:\xnickx\Applications\LOLReplay\LOLRecorder.exe [2011-8-16 360448]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableSecureUIAPaths"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux4"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"DisableThumbnailCache"=dword:00000001
.
R1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20110430.001\BHDrvx64.sys [x]
R1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20110509.001\IDSvia64.sys [x]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1206000.01D\Ironx64.SYS [x]
R2 gupdate;Služba Google Update (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-04 136176]
R3 dump_wmimmc;dump_wmimmc;h:\xnickx\Games\Dragonica\Release\GameGuard\dump_wmimmc.sys [x]
R3 gupdatem;Služba Google Update (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-04 136176]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [x]
R3 pctplsg;pctplsg;c:\windows\System32\drivers\pctplsg64.sys [x]
R3 pwdrvio;pwdrvio;c:\windows\system32\pwdrvio.sys [x]
R3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys [x]
R3 sdAuxService;PC Tools Auxiliary Service;c:\program files (x86)\PC Tools Security\pctsAuxs.exe [2011-02-18 371472]
R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [x]
R3 ThreatFire;ThreatFire;c:\program files (x86)\PC Tools Security\TFEngine\TFService.exe service [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [x]
R3 VSPerfDrv100;Performance Tools Driver 10.0;h:\xnickx\Applications\Microsoft Visual Studio 10.0\Team Tools\Performance Tools\x64\VSPerfDrv100.sys [2010-03-17 68440]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore64.sys [x]
S0 pctDS;PC Tools Data Store;c:\windows\system32\drivers\pctDS64.sys [x]
S0 pctEFA;PC Tools Extended File Attributes;c:\windows\system32\drivers\pctEFA64.sys [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1206000.01D\SYMDS64.SYS [x]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1206000.01D\SYMEFA64.SYS [x]
S0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [x]
S0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [x]
S1 pctgntdi;pctgntdi;c:\windows\System32\drivers\pctgntdi64.sys [x]
S1 PCTSD;PC Tools Spyware Doctor Driver;c:\windows\system32\Drivers\PCTSD64.sys [x]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NISx64\1206000.01D\SYMNETS.SYS [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [2011-08-04 2329480]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-07-09 248936]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe [2009-11-17 1353544]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys [2009-10-14 11856]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2011-08-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-04 21:07]
.
2011-08-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-04 21:07]
.
2011-08-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3133533038-1199205714-1137167784-1000Core.job
- c:\users\Alex\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-15 06:38]
.
2011-08-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3133533038-1199205714-1137167784-1000UA.job
- c:\users\Alex\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-15 06:38]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"combofix"="c:\combofix\CF30862.cfxxe" [X]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-10-06 8158240]
"PAC7302_Monitor"="c:\windows\PixArt\PAC7302\Monitor.exe" [2007-12-10 323584]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.seznam.cz/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
LSP: c:\program files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\jays2ko2.default\
FF - prefs.js: browser.startup.homepage - seznam.cz
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Toolbar-Locked - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
c:\program files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
.
**************************************************************************
.
Celkový čas: 2011-08-21 22:45:50 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-08-21 20:45
ComboFix2.txt 2011-08-21 18:24
.
Před spuštěním: Volných bajtů: 109 423 255 552
Po spuštění: Volných bajtů: 109 087 043 584
.
- - End Of File - - ACDC6847C7E84246EA8F0C6B36131B6D
[/code]

[Caroprd111]

Nedávejte prosím logy do code.

Jak se chová PC?

[XNickX]

Dobře
Pc se chová perfektně děkuji opravdu hodně za pomoc.

[Caroprd111]

Ještě nekončíme

Odinstalujte Spyware Doctor atp., ponechte si jen doporučené zabezpečení http://www.viry.cz/forum/viewtopic.php?f=29&t=6152


Odinstalujte ComboFix přes:
Start >> Spustit, zkopírujte do okénka:

ComboFix /Uninstall

stiskněte Enter



Stáhněte T-Cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe

• Spusťte, pro potvrzení volby mačkejte klávesu A, Enter
• Po použití program vymažte. Pozor, antiviry ho mohou falešně označit za vir.

Stáhněte TFC http://oldtimer.geekstogo.com/TFC.exe

• Spusťte.
• Klikněte na "Start". Potvrďte hlášku kliknutím na "Ok" (Bude následovat restart)

Stáhněte OTC http://oldtimer.geekstogo.com/OTC.exe

• Spusťte.
• Klikněte na "CleanUp!". Potvrďte hlášky kliknutím na "Yes" (Bude následovat restart)

Stáhněte Ccleaner http://viry.cz/forum/viewtopic.php?t=7478
Záložka Čistič

• Dejte analyzovat, po dokončení dejte Spustit Ccleaner.
  
  Záložka Registry
• Klikněte na Hledej problémy, po dokončení klikněte na Opravit problémy, zálohu dělat nemusíte, potom dejte Opravit všechny problémy.

OK Zavřít


Dejte nový log z RSIT.

[XNickX]

Logfile of random's system information tool 1.09 (written by random/random)
Run by Alex at 2011-08-22 00:33:30
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 110 GB (72%) free of 154 GB
Total RAM: 4095 MB (66% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 0:33:31, on 22.8.2011
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
C:\Windows\PixArt\PAC7302\Monitor.exe
C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
C:\Program Files (x86)\uTorrent\uTorrent.exe
C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
H:\XNickX\Applications\LOLReplay\LOLRecorder.exe
C:\Program Files (x86)\PowerISO\PWRISOVM.EXE
C:\Program Files\trend micro\Alex.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {472734EA-242A-422b-ADF8-83D1E48CC825} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Pomocná služba pro přihlášení ke službě Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Microsoft Web Test Recorder 10.0 Helper - {DDA57003-0068-4ed2-9D32-4D1EC707D94D} - H:\XNickX\Applications\Microsoft Visual Studio 10.0\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.QualityTools.RecorderBarBHO100.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files (x86)\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files (x86)\uTorrent\uTorrent.exe" /MINIMIZED
O4 - HKCU\..\Run: [Pando Media Booster] C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
O4 - Global Startup: LOLRecorder.lnk = H:\XNickX\Applications\LOLReplay\LOLRecorder.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: LogMeIn Hamachi Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: @C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 9404 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
winlogon.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\AUDIODG.EXE 0x2cc
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
taskeng.exe {9FEE83A7-4DD8-4637-8EEC-D2762052B03D}
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe" -s
C:\Windows\system32\nvvsvc.exe -session -first
"taskhost.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe"
"C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe"
"C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe"
"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"
WLIDSvcM.exe 2064
"C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesApp64.exe" /TUStart /pid:1328
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Windows\PixArt\PAC7302\Monitor.exe"
"C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
"C:\Program Files (x86)\uTorrent\uTorrent.exe" /MINIMIZED
"C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe"
"H:\XNickX\Applications\LOLReplay\LOLRecorder.exe"
"C:\Program Files (x86)\PowerISO\PWRISOVM.EXE"
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\system32\DllHost.exe /Processid:{30D49246-D217-465F-B00B-AC9DDD652EB7}
C:\Windows\system32\wbem\wmiprvse.exe
taskeng.exe {7DB91966-DF84-4636-81AD-516631B8EFE8}
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\system32\sppsvc.exe
C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding
C:\Windows\System32\svchost.exe -k WerSvcGroup
"C:\Users\Alex\Desktop\RSITx64.exe"

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3133533038-1199205714-1137167784-1000Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3133533038-1199205714-1137167784-1000UA.job

=========Mozilla firefox=========

ProfilePath - C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\jays2ko2.default

prefs.js - "browser.startup.homepage" - "seznam.cz"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0]
"Description"=DivX Web Player
"Path"=C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3]
"Description"=Office Live Update v1.3
"Path"=C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeLive,version=1.4]
"Description"=Office Live Update v1.4
"Path"=C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@nvidia.com/3DVision]
"Description"=NVIDIA stereo images plugin for Mozilla browsers
"Path"=C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@nvidia.com/3DVisionStreaming]
"Description"=NVIDIA 3D Vision Streaming plugin for Mozilla browsers
"Path"=C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@pandonetworks.com/PandoWebPlugin]
"Description"=This plugin detects and launches Pando Media Booster
"Path"=C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.21.65\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.21.65\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18]
"Description"=Veetle TV Core
"Path"=C:\Program Files (x86)\Veetle\plugins\npVeetle.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18]
"Description"=Veetle TV Player
"Path"=C:\Program Files (x86)\Veetle\Player\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

C:\Program Files (x86)\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}

C:\Program Files (x86)\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files (x86)\Mozilla Firefox\plugins\
libdivx.dll
npdeployJava1.dll
npdivx32.dll
npdivx32.xpt
ssldivx.dll

C:\Program Files (x86)\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\jays2ko2.default\extensions\
cacaoweb@cacaoweb.org

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21 529280]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-06-06 63912]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
Search Helper - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll [2010-09-22 191792]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocná služba pro přihlášení ke službě Windows Live ID - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21 439168]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2011-08-03 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DDA57003-0068-4ed2-9D32-4D1EC707D94D}]
Microsoft Web Test Recorder 10.0 Helper - H:\XNickX\Applications\Microsoft Visual Studio 10.0\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.QualityTools.RecorderBarBHO100.dll [2010-03-19 61360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll [2010-03-25 1548096]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll [2010-03-25 968000]
{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2009-10-06 8158240]
"PAC7302_Monitor"=C:\Windows\PixArt\PAC7302\Monitor.exe [2007-12-10 323584]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2010-04-01 357696]
"uTorrent"=C:\Program Files (x86)\uTorrent\uTorrent.exe [2011-08-09 639864]
"Pando Media Booster"=C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [2011-08-11 3077528]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"PWRISOVM.EXE"=C:\Program Files (x86)\PowerISO\PWRISOVM.EXE [2009-11-09 180224]
"amd_dc_opt"=C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe [2008-07-22 77824]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-06-06 937920]
"GrooveMonitor"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]
"LogMeIn Hamachi Ui"=C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [2011-08-15 1955208]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
LOLRecorder.lnk - H:\XNickX\Applications\LOLReplay\LOLRecorder.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2009-07-21 258560]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\system32\webcheck.dll [2011-04-26 249344]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableSecureUIAPaths"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave5"=wdmaud.drv
"midi5"=wdmaud.drv
"mixer5"=wdmaud.drv
"aux1"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"wave7"=wdmaud.drv
"midi6"=wdmaud.drv
"mixer7"=wdmaud.drv
"aux2"=wdmaud.drv
"wave8"=wdmaud.drv
"midi7"=wdmaud.drv
"mixer8"=wdmaud.drv
"aux3"=wdmaud.drv
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave9"=wdmaud.drv
"midi8"=wdmaud.drv
"mixer9"=wdmaud.drv
"aux4"=wdmaud.drv
"VIDC.FPS1"=frapsv64.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 month======

2011-08-22 00:31:09 ----D---- C:\rsit
2011-08-21 23:20:31 ----D---- C:\ProgramData\SplitMediaLabs
2011-08-21 23:20:31 ----D---- C:\Program Files (x86)\SplitMediaLabs
2011-08-21 22:59:27 ----D---- C:\Program Files (x86)\LogMeIn Hamachi
2011-08-21 22:45:52 ----D---- C:\Windows\temp
2011-08-21 22:40:20 ----SHD---- C:\$RECYCLE.BIN
2011-08-20 23:08:59 ----D---- C:\Program Files (x86)\SystemRequirementsLab
2011-08-20 23:08:45 ----D---- C:\Windows\Sun
2011-08-19 22:50:19 ----D---- C:\Program Files\trend micro
2011-08-19 22:34:07 ----D---- C:\Program Files\CCleaner
2011-08-19 17:07:49 ----A---- C:\Windows\system32\drivers\Cat.DB
2011-08-19 17:07:37 ----AD---- C:\ProgramData\TEMP
2011-08-19 16:55:27 ----D---- C:\ProgramData\PC Tools
2011-08-19 09:15:01 ----D---- C:\Program Files\Microsoft SQL Server
2011-08-19 09:14:46 ----D---- C:\Program Files (x86)\Microsoft SQL Server
2011-08-19 09:14:22 ----D---- C:\Program Files\Microsoft Sync Framework
2011-08-19 09:14:16 ----D---- C:\Program Files\Microsoft Synchronization Services
2011-08-19 09:14:16 ----D---- C:\Program Files\Microsoft SQL Server Compact Edition
2011-08-19 09:14:12 ----D---- C:\Program Files (x86)\Microsoft Synchronization Services
2011-08-19 09:11:43 ----D---- C:\Program Files (x86)\Microsoft ASP.NET
2011-08-19 09:11:39 ----D---- C:\Program Files\IIS
2011-08-19 09:11:39 ----D---- C:\Program Files (x86)\IIS
2011-08-19 09:07:19 ----D---- C:\Windows\SYSWOW64\1033
2011-08-19 09:07:11 ----D---- C:\Program Files (x86)\Microsoft F#
2011-08-19 09:07:11 ----D---- C:\Program Files (x86)\HTML Help Workshop
2011-08-19 09:05:24 ----D---- C:\Program Files (x86)\Microsoft Visual Studio 9.0
2011-08-19 09:05:14 ----D---- C:\Windows\symbols
2011-08-19 09:05:14 ----D---- C:\Program Files\Microsoft Visual Studio 10.0
2011-08-19 09:05:14 ----D---- C:\Program Files\Microsoft Help Viewer
2011-08-19 09:05:14 ----D---- C:\Program Files (x86)\Microsoft SDKs
2011-08-19 09:04:38 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI
2011-08-17 23:52:55 ----D---- C:\Users\Alex\AppData\Roaming\runic games
2011-08-17 23:49:32 ----D---- C:\Users\Alex\AppData\Roaming\InstallShield
2011-08-11 12:47:26 ----D---- C:\Program Files (x86)\DivX
2011-08-11 12:09:29 ----D---- C:\Users\Alex\AppData\Roaming\LolClient
2011-08-11 11:15:25 ----A---- C:\Windows\SYSWOW64\d3dx10_39.dll
2011-08-11 11:15:25 ----A---- C:\Windows\SYSWOW64\D3DCompiler_39.dll
2011-08-11 11:15:24 ----A---- C:\Windows\SYSWOW64\D3DX9_39.dll
2011-08-11 09:41:06 ----D---- C:\ProgramData\PMB Files
2011-08-11 09:35:30 ----D---- C:\Program Files (x86)\Pando Networks
2011-08-10 16:36:38 ----A---- C:\Windows\system32\mshtmled.dll
2011-08-10 16:36:37 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2011-08-10 16:36:37 ----A---- C:\Windows\SYSWOW64\ieui.dll
2011-08-10 16:36:37 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2011-08-10 16:36:37 ----A---- C:\Windows\system32\ieui.dll
2011-08-10 16:36:37 ----A---- C:\Windows\system32\iertutil.dll
2011-08-10 16:36:36 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2011-08-10 16:36:36 ----A---- C:\Windows\SYSWOW64\url.dll
2011-08-10 16:36:36 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2011-08-10 16:36:36 ----A---- C:\Windows\SYSWOW64\jscript.dll
2011-08-10 16:36:36 ----A---- C:\Windows\system32\urlmon.dll
2011-08-10 16:36:36 ----A---- C:\Windows\system32\url.dll
2011-08-10 16:36:36 ----A---- C:\Windows\system32\jscript9.dll
2011-08-10 16:36:36 ----A---- C:\Windows\system32\jscript.dll
2011-08-10 16:36:35 ----A---- C:\Windows\SYSWOW64\wininet.dll
2011-08-10 16:36:35 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2011-08-10 16:36:35 ----A---- C:\Windows\system32\wininet.dll
2011-08-10 16:36:35 ----A---- C:\Windows\system32\jsproxy.dll
2011-08-10 16:36:34 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2011-08-10 16:36:33 ----A---- C:\Windows\system32\mshtml.dll
2011-08-10 16:36:32 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2011-08-10 16:36:32 ----A---- C:\Windows\system32\ieframe.dll
2011-08-10 14:10:40 ----A---- C:\Windows\SYSWOW64\xmllite.dll
2011-08-10 14:10:40 ----A---- C:\Windows\system32\xmllite.dll
2011-08-10 14:10:39 ----A---- C:\Windows\SYSWOW64\odbctrac.dll
2011-08-10 14:10:39 ----A---- C:\Windows\SYSWOW64\odbcjt32.dll
2011-08-10 14:10:39 ----A---- C:\Windows\SYSWOW64\odbccu32.dll
2011-08-10 14:10:39 ----A---- C:\Windows\SYSWOW64\odbccr32.dll
2011-08-10 14:10:39 ----A---- C:\Windows\SYSWOW64\odbccp32.dll
2011-08-10 14:10:39 ----A---- C:\Windows\system32\odbctrac.dll
2011-08-10 14:10:39 ----A---- C:\Windows\system32\odbccu32.dll
2011-08-10 14:10:39 ----A---- C:\Windows\system32\odbccr32.dll
2011-08-10 14:10:39 ----A---- C:\Windows\system32\odbccp32.dll
2011-08-10 14:10:38 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2011-08-10 14:10:38 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2011-08-10 14:10:38 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2011-08-10 14:10:36 ----A---- C:\Windows\SYSWOW64\setup16.exe
2011-08-10 14:10:36 ----A---- C:\Windows\system32\wow64.dll
2011-08-10 14:10:36 ----A---- C:\Windows\system32\winsrv.dll
2011-08-10 14:10:36 ----A---- C:\Windows\system32\KernelBase.dll
2011-08-10 14:10:36 ----A---- C:\Windows\system32\kernel32.dll
2011-08-10 14:10:36 ----A---- C:\Windows\system32\conhost.exe
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2011-08-10 14:10:35 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2011-08-10 14:10:35 ----A---- C:\Windows\SYSWOW64\wow32.dll
2011-08-10 14:10:35 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2011-08-10 14:10:35 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2011-08-10 14:10:35 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2011-08-10 14:10:35 ----A---- C:\Windows\system32\wow64win.dll
2011-08-10 14:10:35 ----A---- C:\Windows\system32\wow64cpu.dll
2011-08-10 14:10:35 ----A---- C:\Windows\system32\ntvdm64.dll
2011-08-10 14:10:34 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2011-08-10 14:10:34 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2011-08-10 14:10:34 ----A---- C:\Windows\SYSWOW64\user.exe
2011-08-10 14:10:34 ----A---- C:\Windows\SYSWOW64\instnm.exe
2011-08-10 14:10:33 ----A---- C:\Windows\system32\drivers\tcpip.sys
2011-08-10 14:10:31 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2011-08-10 14:10:31 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2011-08-10 14:10:31 ----A---- C:\Windows\system32\ntoskrnl.exe
2011-08-10 08:11:02 ----D---- C:\Program Files (x86)\Microsoft Works
2011-08-10 08:10:52 ----D---- C:\Program Files (x86)\Microsoft Visual Studio
2011-08-10 08:10:41 ----D---- C:\Windows\PCHEALTH
2011-08-10 08:08:50 ----D---- C:\Program Files\Microsoft Office
2011-08-10 08:08:45 ----D---- C:\Program Files (x86)\Microsoft Visual Studio 8
2011-08-10 08:08:19 ----D---- C:\Program Files (x86)\Microsoft Office
2011-08-10 08:07:50 ----RD---- C:\MSOCache
2011-08-09 16:46:21 ----RHD---- C:\Users\Alex\AppData\Roaming\SecuROM
2011-08-09 16:31:33 ----D---- C:\Program Files (x86)\MiniTool Partition Wizard Home Edition 6.0
2011-08-09 16:16:05 ----A---- C:\Windows\system32\pwNative.exe
2011-08-09 16:16:04 ----N---- C:\Windows\system32\pwdspio.sys
2011-08-09 16:16:04 ----N---- C:\Windows\system32\pwdrvio.sys
2011-08-09 10:37:10 ----A---- C:\Windows\SYSWOW64\npptNT2.sys
2011-08-09 10:36:58 ----D---- C:\Program Files\Common Files\INCA Shared
2011-08-09 08:10:49 ----D---- C:\Users\Alex\AppData\Roaming\BSplayer Pro
2011-08-09 08:10:49 ----D---- C:\Users\Alex\AppData\Roaming\BSplayer
2011-08-09 08:10:49 ----D---- C:\Program Files (x86)\Webteh
2011-08-09 07:44:19 ----D---- C:\Users\Alex\AppData\Roaming\.minecraft
2011-08-08 23:11:28 ----RD---- C:\Program Files (x86)\Skype
2011-08-08 22:39:25 ----D---- C:\Users\Alex\AppData\Roaming\Mozilla
2011-08-08 22:39:13 ----D---- C:\Program Files (x86)\Mozilla Firefox
2011-08-08 22:13:45 ----A---- C:\Windows\system32\tquery.dll
2011-08-08 22:13:45 ----A---- C:\Windows\system32\mssrch.dll
2011-08-08 22:13:44 ----A---- C:\Windows\SYSWOW64\tquery.dll
2011-08-08 22:13:44 ----A---- C:\Windows\SYSWOW64\SearchProtocolHost.exe
2011-08-08 22:13:44 ----A---- C:\Windows\SYSWOW64\SearchIndexer.exe
2011-08-08 22:13:44 ----A---- C:\Windows\SYSWOW64\SearchFilterHost.exe
2011-08-08 22:13:44 ----A---- C:\Windows\SYSWOW64\mssvp.dll
2011-08-08 22:13:44 ----A---- C:\Windows\SYSWOW64\mssrch.dll
2011-08-08 22:13:44 ----A---- C:\Windows\SYSWOW64\mssphtb.dll
2011-08-08 22:13:44 ----A---- C:\Windows\SYSWOW64\mssph.dll
2011-08-08 22:13:44 ----A---- C:\Windows\SYSWOW64\msscntrs.dll
2011-08-08 22:13:44 ----A---- C:\Windows\system32\SearchProtocolHost.exe
2011-08-08 22:13:44 ----A---- C:\Windows\system32\SearchIndexer.exe
2011-08-08 22:13:44 ----A---- C:\Windows\system32\SearchFilterHost.exe
2011-08-08 22:13:44 ----A---- C:\Windows\system32\mssvp.dll
2011-08-08 22:13:44 ----A---- C:\Windows\system32\mssphtb.dll
2011-08-08 22:13:44 ----A---- C:\Windows\system32\mssph.dll
2011-08-08 22:13:44 ----A---- C:\Windows\system32\msscntrs.dll
2011-08-08 22:13:36 ----A---- C:\Windows\system32\drivers\afd.sys
2011-08-08 22:13:27 ----A---- C:\Windows\system32\drivers\srvnet.sys
2011-08-08 22:13:27 ----A---- C:\Windows\system32\drivers\srv2.sys
2011-08-08 22:13:27 ----A---- C:\Windows\system32\drivers\srv.sys
2011-08-08 22:12:59 ----A---- C:\Windows\SYSWOW64\oleaut32.dll
2011-08-08 22:12:59 ----A---- C:\Windows\system32\oleaut32.dll
2011-08-08 22:12:58 ----A---- C:\Windows\SYSWOW64\drvinst.exe
2011-08-08 22:12:58 ----A---- C:\Windows\SYSWOW64\devrtl.dll
2011-08-08 22:12:58 ----A---- C:\Windows\SYSWOW64\devobj.dll
2011-08-08 22:12:58 ----A---- C:\Windows\SYSWOW64\cfgmgr32.dll
2011-08-08 22:12:58 ----A---- C:\Windows\system32\umpnpmgr.dll
2011-08-08 22:12:57 ----A---- C:\Windows\system32\win32k.sys
2011-08-08 22:12:56 ----A---- C:\Windows\SYSWOW64\inetcomm.dll
2011-08-08 22:12:56 ----A---- C:\Windows\system32\inetcomm.dll

======List of files/folders modified in the last 1 month======

2011-08-22 00:33:26 ----D---- C:\Windows\Prefetch
2011-08-22 00:33:19 ----D---- C:\Users\Alex\AppData\Roaming\uTorrent
2011-08-22 00:32:14 ----D---- C:\Windows\SoftwareDistribution
2011-08-22 00:31:24 ----D---- C:\Windows
2011-08-22 00:30:22 ----D---- C:\Users\Alex\AppData\Roaming\Skype
2011-08-22 00:30:22 ----D---- C:\Users\Alex\AppData\Roaming\DAEMON Tools Lite
2011-08-22 00:30:20 ----D---- C:\Windows\Logs
2011-08-22 00:29:21 ----D---- C:\Windows\system32\config
2011-08-22 00:29:11 ----D---- C:\ProgramData\NVIDIA
2011-08-22 00:25:09 ----SHD---- C:\System Volume Information
2011-08-22 00:25:09 ----RD---- C:\Program Files (x86)
2011-08-22 00:25:09 ----D---- C:\Program Files (x86)\Common Files
2011-08-22 00:23:39 ----D---- C:\Program Files (x86)\Opera
2011-08-22 00:20:24 ----D---- C:\Windows\system32\drivers
2011-08-21 23:35:14 ----SD---- C:\ProgramData\Microsoft
2011-08-21 23:35:13 ----SHD---- C:\Windows\Installer
2011-08-21 23:20:31 ----D---- C:\ProgramData
2011-08-21 22:40:23 ----A---- C:\Windows\system.ini
2011-08-21 22:40:15 ----D---- C:\Windows\system32\drivers\etc
2011-08-21 22:38:51 ----D---- C:\Windows\System32
2011-08-21 22:36:25 ----D---- C:\Windows\SYSWOW64\drivers
2011-08-21 22:36:25 ----D---- C:\Windows\SysWOW64
2011-08-21 22:36:25 ----D---- C:\Windows\AppPatch
2011-08-21 22:36:21 ----D---- C:\Program Files\Common Files
2011-08-21 21:07:02 ----D---- C:\Windows\Microsoft.NET
2011-08-21 20:06:32 ----SD---- C:\Users\Alex\AppData\Roaming\Microsoft
2011-08-21 17:39:23 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-08-21 17:39:22 ----D---- C:\Windows\inf
2011-08-21 14:31:57 ----RSD---- C:\Windows\assembly
2011-08-21 01:46:48 ----D---- C:\Program Files\Common Files\Microsoft Shared
2011-08-20 17:14:52 ----D---- C:\Windows\system32\wdi
2011-08-19 22:50:19 ----RD---- C:\Program Files
2011-08-19 22:36:27 ----D---- C:\Windows\debug
2011-08-19 10:47:26 ----D---- C:\Windows\system32\catroot2
2011-08-19 09:15:34 ----D---- C:\Windows\winsxs
2011-08-19 09:14:12 ----D---- C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2011-08-19 09:12:55 ----D---- C:\Program Files\MSBuild
2011-08-19 09:07:11 ----D---- C:\Program Files (x86)\MSBuild
2011-08-19 08:07:48 ----D---- C:\Windows\system32\Tasks
2011-08-18 09:49:21 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2011-08-15 16:13:07 ----D---- C:\Windows\Tasks
2011-08-14 18:21:12 ----D---- C:\Program Files (x86)\Java
2011-08-14 10:19:00 ----D---- C:\ProgramData\Microsoft Help
2011-08-13 19:14:54 ----A---- C:\Windows\win.ini
2011-08-12 00:34:31 ----D---- C:\Users\Alex\AppData\Roaming\vlc
2011-08-10 18:09:17 ----D---- C:\Windows\SYSWOW64\migration
2011-08-10 18:09:17 ----D---- C:\Windows\system32\migration
2011-08-10 18:09:17 ----D---- C:\Program Files (x86)\Internet Explorer
2011-08-10 18:09:16 ----D---- C:\Program Files\Internet Explorer
2011-08-10 17:41:51 ----D---- C:\Windows\system32\catroot
2011-08-10 17:40:13 ----A---- C:\Windows\system32\MRT.exe
2011-08-10 08:10:51 ----D---- C:\Windows\ShellNew
2011-08-10 08:10:45 ----RSD---- C:\Windows\Fonts
2011-08-10 08:10:41 ----D---- C:\Program Files (x86)\Microsoft.NET
2011-08-10 08:02:13 ----D---- C:\ProgramData\Adobe
2011-08-10 08:02:12 ----D---- C:\Program Files (x86)\Adobe
2011-08-10 07:58:17 ----D---- C:\Windows\system32\DriverStore
2011-08-09 18:19:54 ----D---- C:\Program Files (x86)\Nexon
2011-08-09 07:38:34 ----D---- C:\Program Files (x86)\uTorrent
2011-08-09 01:19:19 ----D---- C:\Program Files (x86)\Microsoft Silverlight
2011-08-08 23:11:28 ----D---- C:\ProgramData\Skype
2011-08-02 09:30:10 ----D---- C:\Windows\system32\wfp
2011-08-02 09:30:10 ----D---- C:\Windows\system32\wbem
2011-08-02 09:30:10 ----D---- C:\Windows\system32\drivers\UMDF
2011-08-02 09:30:07 ----D---- C:\Windows\registration

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-11-20 834544]
R0 SymDS;Symantec Data Store; C:\Windows\system32\drivers\NISx64\1206000.01D\SYMDS64.SYS [2011-01-27 450680]
R0 SymEFA;Symantec Extended File Attributes; C:\Windows\system32\drivers\NISx64\1206000.01D\SYMEFA64.SYS [2011-03-15 912504]
R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [2011-05-10 481912]
R1 ISODrive;ISO DVD/CD-ROM Device Driver; \??\C:\Program Files (x86)\UltraISO\drivers\ISODrv64.sys [2010-01-29 115600]
R1 SCDEmu;SCDEmu; C:\Windows\system32\drivers\SCDEmu.sys [2009-11-09 91568]
R1 SRTSPX;Symantec Real Time Storage Protection (PEL) x64; C:\Windows\system32\drivers\NISx64\1206000.01D\SRTSPX64.SYS [2011-03-31 40568]
R1 SymNetS;Symantec Network Security WFP Driver; C:\Windows\System32\Drivers\NISx64\1206000.01D\SYMNETS.SYS [2011-03-22 382584]
R3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2009-03-18 33856]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2009-10-06 2009376]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda64v.sys [2009-08-21 84512]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2009-03-01 187392]
R3 SymEvent;SymEvent; \??\C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [2011-05-11 174200]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv; \??\C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys [2009-10-14 11856]
S0 TfFsMon;TfFsMon; C:\Windows\system32\drivers\TfFsMon.sys []
S0 TfSysMon;TfSysMon; C:\Windows\system32\drivers\TfSysMon.sys []
S1 BHDrvx64;BHDrvx64; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20110430.001\BHDrvx64.sys []
S1 IDSVia64;IDSVia64; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20110509.001\IDSvia64.sys []
S1 SymIRON;Symantec Iron Driver; C:\Windows\system32\drivers\NISx64\1206000.01D\Ironx64.SYS [2011-01-27 171128]
S3 awt0est8;awt0est8; C:\Windows\system32\drivers\awt0est8.sys []
S3 dump_wmimmc;dump_wmimmc; \??\H:\XNickX\Games\Dragonica\Release\GameGuard\dump_wmimmc.sys []
S3 GMSIPCI;GMSIPCI; \??\D:\INSTALL\GMSIPCI.SYS []
S3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2009-07-21 7345344]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller; C:\Windows\system32\DRIVERS\L1C62x64.sys [2009-11-27 67072]
S3 NAVENG;NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20110510.024\ENG64.SYS []
S3 NAVEX15;NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20110510.024\EX64.SYS []
S3 NPPTNT2;NPPTNT2; \??\C:\Windows\syswow64\npptNT2.sys [2005-01-03 4682]
S3 PAC7302;Eye 312; C:\Windows\system32\DRIVERS\PAC7302.SYS [2009-04-28 532480]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 pwdrvio;pwdrvio; \??\C:\Windows\syswow64\pwdrvio.sys []
S3 pwdspio;pwdspio; \??\C:\Windows\syswow64\pwdspio.sys []
S3 SRTSP;Symantec Real Time Storage Protection x64; C:\Windows\System32\Drivers\NISx64\1206000.01D\SRTSP64.SYS [2011-03-31 744568]
S3 TfNetMon;TfNetMon; \??\C:\Windows\system32\drivers\TfNetMon.sys []
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 59392]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 41984]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service; C:\Windows\system32\drivers\viahduaa.sys [2009-09-17 1250816]
S3 VSPerfDrv100;Performance Tools Driver 10.0; \??\H:\XNickX\Applications\Microsoft Visual Studio 10.0\Team Tools\Performance Tools\x64\VSPerfDrv100.sys [2010-03-17 68440]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine; C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe [2011-08-15 2329480]
R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe [2009-09-23 935208]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2010-07-09 159336]
R2 SeaPort;SeaPort; C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2010-09-22 249136]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-07-09 248936]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe [2009-11-17 1353544]
R2 UxTuneUp;@%SystemRoot%\System32\uxtuneup.dll,-4096; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2010-09-21 2286976]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-12-04 136176]
S3 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2010-03-18 44376]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-12-04 136176]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 npggsvc;nProtect GameGuard Service; C:\Windows\syswow64\GameMon.des [2011-05-03 4092408]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2011-03-29 403240]
S3 TuneUp.Defrag;@C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe,-1; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe [2010-11-20 607048]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-11-20 1255736]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

-----------------EOF-----------------