Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz

Vir C:\Windows\assembly\GAC_32\Desktop.ini

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Odpovědět
Zpráva
Autor
VilikCZ
Návštěvník
Návštěvník
Příspěvky: 12
Registrován: 30 lis 2011 19:17

Vir C:\Windows\assembly\GAC_32\Desktop.ini

#1 Příspěvek od VilikCZ »

Dobrý den marně se snažim dostat zmeho počitače vir C:\Windows\assembly\GAC_32\Desktop.ini Nod 32 5
Piše že vylečení bude po restartování pc ale když tak udělam tak se zase oběví... doufam že mi pomužete děkuju :?: Logfile of random's system information tool 1.09 (written by random/random)
Run by vilik at 2011-11-30 19:30:53
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 341 GB (74%) free of 461 GB
Total RAM: 4025 MB (52% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:30:57, on 30.11.2011
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Steam\Steam.exe
C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Program Files (x86)\Launch Manager\LManager.exe
C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe
C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe
C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Launch Manager\LMworker.exe
C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Microsoft\BingBar\BingBar.exe
C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe
C:\Program Files (x86)\Microsoft\BingBar\BingApp.exe
C:\Program Files (x86)\Acer\Registration\GREG.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashUtil11e_ActiveX.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files\trend micro\vilik.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://acer.msn.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://acer.msn.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Movier-media Toolbar - {ce10bf86-da68-441e-91fa-38336363e3cd} - C:\Program Files (x86)\Movier-media\tbMovi.dll
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Movier-media Toolbar - {ce10bf86-da68-441e-91fa-38336363e3cd} - C:\Program Files (x86)\Movier-media\tbMovi.dll
O2 - BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll" (file missing)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll" (file missing)
O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: Movier-media Toolbar - {ce10bf86-da68-441e-91fa-38336363e3cd} - C:\Program Files (x86)\Movier-media\tbMovi.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
O4 - HKLM\..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe
O4 - HKLM\..\Run: [SuiteTray] "C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe"
O4 - HKLM\..\Run: [EgisTecPMMUpdate] "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe"
O4 - HKLM\..\Run: [EgisUpdate] "C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe" -d
O4 - HKLM\..\Run: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BackupManagerTray] "C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" -h -k
O4 - HKLM\..\Run: [SweetIM] C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [H2O] C:\Program Files (x86)\SyncroSoft\Pos\H2O\cledx.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKCU\..\Run: [Steam] "C:\Program Files (x86)\Steam\steam.exe" -silent
O4 - HKCU\..\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [IsMyWinLockerReboot] msiexec.exe /qn /x{voidguid} (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [IsMyWinLockerReboot] msiexec.exe /qn /x{voidguid} (User 'Default user')
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Dritek WMI Service (DsiWMIService) - Dritek System Inc. - C:\Program Files (x86)\Launch Manager\dsiwmis.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: EgisTec Ticket Service - Egis Technology Inc. - C:\Program Files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
O23 - Service: Acer ePower Service (ePowerSvc) - Acer Incorporated - C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Freemake Improver - Freemake - C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe
O23 - Service: GREGService - Acer Incorporated - C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Live Updater Service - Acer Incorporated - C:\Program Files\Acer\Acer Updater\UpdaterService.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NMIndexingService - Nero AG - C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: Norton Online Backup (NOBU) - Symantec Corporation - C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
O23 - Service: NTI IScheduleSvc - NewTech Infosystems, Inc. - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\SysWOW64\IoctlSvc.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 12282 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=consrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=consrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
winlogon.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Launch Manager\dsiwmis.exe"
"C:\Windows\system32\Dwm.exe"
"taskhost.exe"
"C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe"
C:\Windows\Explorer.EXE
"C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe"
"C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe"
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Windows\System32\igfxtray.exe"
"C:\Windows\System32\hkcmd.exe"
"C:\Windows\System32\igfxpers.exe"
"C:\Program Files\Elantech\ETDCtrl.exe"
C:\Windows\system32\igfxsrvc.exe -Embedding
"C:\Program Files (x86)\Acer\Registration\GREGsvc.exe"
"C:\Program Files\Acer\Acer Updater\UpdaterService.exe"
"C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe"
"C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe" SERVICE
"C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe"
"C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe"
C:\Windows\SysWOW64\IoctlSvc.exe
"C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE"
"C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"
"C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe"
WLIDSvcM.exe 2552
"C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
"C:\Program Files (x86)\Steam\Steam.exe" -silent
"C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
"C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe"
"C:\Program Files (x86)\Launch Manager\LManager.exe"
"C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe"
"C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe"
C:\Windows\system32\igfxext.exe -Embedding
C:\Windows\system32\wbem\unsecapp.exe -Embedding
"C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe"
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" -h -k
"C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe"
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
"C:\Program Files (x86)\Launch Manager\LMworker.exe"
"C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE"
"C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe"
"C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
"C:\Program Files\Elantech\ETDCtrlHelper.exe"
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
"C:\Program Files (x86)\Common Files\Steam\SteamService.exe" /RunAsService
"C:\Program Files (x86)\Microsoft\BingBar\BingBar.exe" -Embedding
"C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe"
"C:\Program Files (x86)\Microsoft\BingBar\BingApp.exe" -Embedding
"C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe"
C:\Windows\System32\svchost.exe -k secsvcs
"C:\ProgramData\Google\Google Toolbar\Update\GoogleToolbarInstaller_updater_signed.exe" /au /q /child
taskeng.exe {A4925BB7-A95D-4070-8672-9C54951C38B9}
"C:\Program Files (x86)\Acer\Registration\GREG.exe" /RR
"C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:5108 CREDAT:137479
C:\Windows\SysWOW64\Macromed\Flash\FlashUtil11e_ActiveX.exe -Embedding
"C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:5108 CREDAT:203017
"C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:5108 CREDAT:203037
"C:\Users\vilik\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8FFQO05V\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe

======Scheduled tasks folder======

C:\Windows\tasks\Acer Registration - Reminder Recall task.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21 529280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2011-11-10 458416]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21 439168]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2011-11-10 342192]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ce10bf86-da68-441e-91fa-38336363e3cd}]
Movier-media Toolbar - C:\Program Files (x86)\Movier-media\tbMovi.dll [2010-03-09 2355224]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d2ce3e00-f94a-4740-988e-03dc2f38c34f}]
Bing Bar Helper - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll [2011-03-02 1089288]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2011-10-18 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}]
SweetIM Toolbar Helper - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll [2011-08-24 1299248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2011-11-10 458416]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{8dcb7100-df86-4384-8842-8fa844297b3f} - Bing Bar - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll [2011-03-02 1089288]
{EEE6C35B-6118-11DC-9C72-001320C79847} - SweetIM Toolbar for Internet Explorer - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll [2011-08-24 1299248]
{ce10bf86-da68-441e-91fa-38336363e3cd} - Movier-media Toolbar - C:\Program Files (x86)\Movier-media\tbMovi.dll [2010-03-09 2355224]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2011-11-10 342192]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2010-07-06 11057768]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2010-06-14 165912]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2010-06-14 387608]
"Persistence"=C:\Windows\system32\igfxpers.exe [2010-06-14 365592]
"ETDWare"=C:\Program Files\Elantech\ETDCtrl.exe [2010-04-13 649608]
"Acer ePower Management"=C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [2011-01-05 860040]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2011-09-22 4035152]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Steam"=C:\Program Files (x86)\Steam\steam.exe [2011-09-19 1242448]
"swg"=C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2011-09-20 39408]
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2011-08-02 4910912]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe [2008-02-28 1828136]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"=C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [2010-04-13 284696]
"LManager"=C:\Program Files (x86)\Launch Manager\LManager.exe [2010-08-10 975952]
"SuiteTray"=C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [2010-09-28 340336]
"EgisTecPMMUpdate"=C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe [2010-09-18 407920]
"EgisUpdate"=C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe [2010-09-18 201584]
"Norton Online Backup"=C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [2010-06-01 1155928]
"Adobe Reader Speed Launcher"=C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-28 35696]
"BackupManagerTray"=C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [2010-06-28 265984]
"SweetIM"=C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe [2011-08-01 114992]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2011-06-09 254696]
"H2O"=C:\Program Files (x86)\SyncroSoft\Pos\H2O\cledx.exe [2005-05-11 200069]
"NBKeyScan"=C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [2008-02-18 2221352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2009-09-02 259584]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\McMPFSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MCODS]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"MSVideo8"=VfWWDM32.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 3 months======

2011-11-27 17:11:05 ----D---- C:\rsit
2011-11-27 17:11:05 ----D---- C:\Program Files\trend micro
2011-11-26 15:34:32 ----D---- C:\Program Files (x86)\Counter-Strike Source
2011-11-26 11:51:43 ----D---- C:\ProgramData\Ask
2011-11-26 11:51:05 ----A---- C:\Windows\SYSWOW64\javaws.exe
2011-11-26 11:51:05 ----A---- C:\Windows\SYSWOW64\javaw.exe
2011-11-26 11:51:05 ----A---- C:\Windows\SYSWOW64\java.exe
2011-11-23 22:41:54 ----D---- C:\Program Files\CCleaner
2011-11-22 20:18:37 ----SHD---- C:\Windows\system32\%APPDATA%
2011-11-22 19:39:30 ----D---- C:\Windows\system32\Macromed
2011-11-22 19:35:06 ----D---- C:\ProgramData\ESET
2011-11-22 19:35:06 ----D---- C:\Program Files\ESET
2011-11-11 10:29:51 ----D---- C:\Users\vilik\AppData\Roaming\Windows Live Writer
2011-11-11 08:47:26 ----HD---- C:\Windows\msdownld.tmp
2011-11-11 08:47:21 ----D---- C:\Windows\SYSWOW64\directx
2011-11-09 19:42:50 ----D---- C:\Users\vilik\AppData\Roaming\CAD-KAS
2011-11-09 19:42:40 ----D---- C:\Program Files (x86)\PDF Editor 3
2011-11-09 19:42:40 ----A---- C:\Windows\cadkasdeinst01e.exe
2011-11-09 19:11:48 ----D---- C:\ProgramData\Freemake
2011-11-09 19:11:38 ----D---- C:\Program Files (x86)\Freemake
2011-11-09 18:28:02 ----A---- C:\Windows\system32\drivers\tcpip.sys
2011-11-09 18:27:46 ----A---- C:\Windows\system32\win32k.sys
2011-10-30 02:00:41 ----D---- C:\Program Files (x86)\MSXML 4.0
2011-10-29 20:48:11 ----D---- C:\Users\vilik\AppData\Roaming\Image-Line
2011-10-28 22:10:09 ----A---- C:\Windows\NeroDigital.ini
2011-10-28 18:35:44 ----A---- C:\Windows\SYSWOW64\mfc71.dll
2011-10-28 18:35:44 ----A---- C:\Windows\SYSWOW64\gdiplus.dll
2011-10-28 18:33:00 ----D---- C:\Program Files (x86)\ASIO4ALL v2
2011-10-28 18:32:46 ----A---- C:\Windows\SYSWOW64\rewire.dll
2011-10-28 18:32:30 ----D---- C:\Program Files (x86)\Outsim
2011-10-28 18:30:20 ----D---- C:\Program Files (x86)\Image-Line
2011-10-28 11:50:36 ----D---- C:\Users\vilik\AppData\Roaming\Nero
2011-10-28 11:30:26 ----D---- C:\Program Files (x86)\NeroInstall.bak
2011-10-28 11:28:57 ----A---- C:\Windows\Irremote.ini
2011-10-28 11:27:13 ----D---- C:\ProgramData\Nero
2011-10-28 11:27:13 ----D---- C:\Program Files (x86)\Nero
2011-10-28 11:25:30 ----A---- C:\Windows\SYSWOW64\d3dx9_30.dll
2011-10-28 11:25:30 ----A---- C:\Windows\SYSWOW64\d3dx9_28.dll
2011-10-26 18:31:24 ----A---- C:\Windows\SYSWOW64\ra32sipr.dll
2011-10-26 18:31:24 ----A---- C:\Windows\SYSWOW64\ra32dnet.dll
2011-10-26 18:31:24 ----A---- C:\Windows\SYSWOW64\ra3228_8.dll
2011-10-26 18:31:23 ----A---- C:\Windows\SYSWOW64\rmbe3260.dll
2011-10-26 18:31:23 ----A---- C:\Windows\SYSWOW64\ra3214_4.dll
2011-10-26 18:31:23 ----A---- C:\Windows\SYSWOW64\pngu3263.dll
2011-10-26 18:31:23 ----A---- C:\Windows\SYSWOW64\pneng50.dll
2011-10-26 18:31:23 ----A---- C:\Windows\SYSWOW64\pncrt.dll
2011-10-26 18:31:23 ----A---- C:\Windows\SYSWOW64\pnc3250.dll
2011-10-26 18:31:23 ----A---- C:\Windows\SYSWOW64\msvcp70.dll
2011-10-26 18:31:23 ----A---- C:\Windows\SYSWOW64\encdnet.dll
2011-10-26 18:31:23 ----A---- C:\Windows\SYSWOW64\decdnet.dll
2011-10-26 18:30:50 ----D---- C:\Program Files (x86)\Steinberg
2011-10-26 18:29:38 ----A---- C:\Windows\SYSWOW64\Synsopos.exe
2011-10-26 18:29:38 ----A---- C:\Windows\SYSWOW64\drivers\synUSB64.sys
2011-10-26 18:29:37 ----A---- C:\Windows\SYSWOW64\SynsoLChk.dll
2011-10-26 18:29:37 ----A---- C:\Windows\SYSWOW64\SYNSOACC.dll
2011-10-26 18:29:35 ----D---- C:\Program Files (x86)\Syncrosoft
2011-10-26 18:29:35 ----A---- C:\Windows\SYSWOW64\drivers\NSynas32.sys
2011-10-16 15:32:32 ----D---- C:\Users\vilik\AppData\Roaming\Intermedia Software
2011-10-16 15:31:16 ----D---- C:\ProgramData\Intermedia Software
2011-10-16 15:31:07 ----D---- C:\Program Files (x86)\Intermedia Software
2011-10-16 12:10:03 ----D---- C:\Users\vilik\AppData\Roaming\Desktopicon
2011-10-16 12:09:55 ----D---- C:\Program Files (x86)\VDOWNLOADER
2011-10-14 02:10:14 ----A---- C:\Windows\system32\mshtmled.dll
2011-10-14 02:10:13 ----A---- C:\Windows\SYSWOW64\url.dll
2011-10-14 02:10:13 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2011-10-14 02:10:13 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2011-10-14 02:10:13 ----A---- C:\Windows\system32\url.dll
2011-10-14 02:10:13 ----A---- C:\Windows\system32\iertutil.dll
2011-10-14 02:10:12 ----A---- C:\Windows\SYSWOW64\wininet.dll
2011-10-14 02:10:12 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2011-10-14 02:10:12 ----A---- C:\Windows\system32\wininet.dll
2011-10-14 02:10:12 ----A---- C:\Windows\system32\urlmon.dll
2011-10-14 02:10:12 ----A---- C:\Windows\system32\jsproxy.dll
2011-10-14 02:10:11 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2011-10-14 02:10:11 ----A---- C:\Windows\SYSWOW64\jscript.dll
2011-10-14 02:10:11 ----A---- C:\Windows\SYSWOW64\ieui.dll
2011-10-14 02:10:11 ----A---- C:\Windows\system32\jscript9.dll
2011-10-14 02:10:11 ----A---- C:\Windows\system32\ieui.dll
2011-10-14 02:10:10 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2011-10-14 02:10:10 ----A---- C:\Windows\system32\jscript.dll
2011-10-14 02:10:09 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2011-10-14 02:10:08 ----A---- C:\Windows\system32\mshtml.dll
2011-10-14 02:10:07 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2011-10-14 02:10:06 ----A---- C:\Windows\system32\ieframe.dll
2011-10-13 10:51:05 ----A---- C:\Windows\SYSWOW64\psisdecd.dll
2011-10-13 10:51:05 ----A---- C:\Windows\system32\psisdecd.dll
2011-10-13 10:40:43 ----A---- C:\Windows\SYSWOW64\oleaut32.dll
2011-10-13 10:40:43 ----A---- C:\Windows\SYSWOW64\oleacc.dll
2011-10-13 10:40:43 ----A---- C:\Windows\system32\oleaut32.dll
2011-10-13 10:40:43 ----A---- C:\Windows\system32\oleacc.dll
2011-10-12 02:00:58 ----D---- C:\Program Files (x86)\Microsoft.NET
2011-10-06 20:14:39 ----A---- C:\Users\vilik\AppData\Roaming\room_v3.dat
2011-10-05 18:32:09 ----D---- C:\Windows\Sun
2011-10-05 18:07:45 ----D---- C:\ProgramData\Sun
2011-10-05 18:07:29 ----A---- C:\Windows\SYSWOW64\deployJava1.dll
2011-10-05 18:07:14 ----D---- C:\Program Files (x86)\Java
2011-10-01 18:09:34 ----D---- C:\Program Files (x86)\Garena Classic
2011-09-30 16:02:06 ----D---- C:\ProgramData\VirtualizedApplications
2011-09-30 10:35:23 ----D---- C:\Users\vilik\AppData\Roaming\SoftGrid Client
2011-09-30 10:34:49 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI
2011-09-30 10:34:40 ----D---- C:\Program Files\Microsoft Office
2011-09-30 10:34:40 ----D---- C:\Program Files (x86)\Microsoft Application Virtualization Client
2011-09-30 10:34:25 ----D---- C:\Users\vilik\AppData\Roaming\TP
2011-09-29 20:15:20 ----D---- C:\tmpDownload
2011-09-29 20:15:20 ----D---- C:\Download
2011-09-29 20:15:03 ----D---- C:\YouTubeMP3Downloader
2011-09-29 19:58:10 ----D---- C:\Users\vilik\AppData\Roaming\ProgSense
2011-09-29 19:58:08 ----D---- C:\Users\vilik\AppData\Roaming\GrabPro
2011-09-29 19:58:08 ----D---- C:\downloads
2011-09-29 19:58:04 ----D---- C:\Users\vilik\AppData\Roaming\Orbit
2011-09-28 19:12:57 ----HD---- C:\ProgramData\CanonBJ
2011-09-25 16:30:00 ----D---- C:\Program Files (x86)\World of Warcraft
2011-09-25 16:26:13 ----A---- C:\Windows\system32\drivers\dtsoftbus01.sys
2011-09-25 16:26:06 ----D---- C:\Program Files (x86)\DAEMON Tools Lite
2011-09-25 16:25:39 ----D---- C:\Users\vilik\AppData\Roaming\DAEMON Tools Lite
2011-09-25 16:25:37 ----D---- C:\ProgramData\DAEMON Tools Lite
2011-09-23 17:53:25 ----D---- C:\Program Files (x86)\DsNET Corp
2011-09-22 19:22:27 ----D---- C:\Users\vilik\AppData\Roaming\Movier
2011-09-22 19:22:00 ----D---- C:\Program Files (x86)\Conduit
2011-09-22 19:21:59 ----D---- C:\Program Files (x86)\Movier-media
2011-09-22 19:21:57 ----D---- C:\Program Files (x86)\Movier
2011-09-20 19:31:18 ----D---- C:\ProgramData\Blizzard
2011-09-20 18:13:07 ----D---- C:\ProgramData\SweetIM
2011-09-20 18:13:07 ----D---- C:\Program Files (x86)\SweetIM
2011-09-20 18:10:40 ----D---- C:\ProgramData\Premium
2011-09-20 18:10:38 ----D---- C:\ProgramData\InstallMate
2011-09-20 15:20:57 ----D---- C:\Program Files (x86)\Codemasters
2011-09-20 11:09:07 ----A---- C:\Windows\system32\fsutil.exe
2011-09-20 11:09:07 ----A---- C:\Windows\system32\esent.dll
2011-09-20 11:09:07 ----A---- C:\Windows\system32\drivers\amdxata.sys
2011-09-20 11:09:06 ----A---- C:\Windows\SYSWOW64\fsutil.exe
2011-09-20 11:09:06 ----A---- C:\Windows\SYSWOW64\esent.dll
2011-09-20 11:09:06 ----A---- C:\Windows\system32\drivers\storport.sys
2011-09-20 11:09:06 ----A---- C:\Windows\system32\drivers\nvstor.sys
2011-09-20 11:09:06 ----A---- C:\Windows\system32\drivers\nvraid.sys
2011-09-20 11:09:06 ----A---- C:\Windows\system32\drivers\ntfs.sys
2011-09-20 11:09:06 ----A---- C:\Windows\system32\drivers\iaStorV.sys
2011-09-20 11:09:06 ----A---- C:\Windows\system32\drivers\amdsata.sys
2011-09-20 11:09:05 ----A---- C:\Windows\system32\drivers\USBSTOR.SYS
2011-09-20 11:09:00 ----A---- C:\Windows\system32\drivers\usbport.sys
2011-09-20 11:09:00 ----A---- C:\Windows\system32\drivers\usbhub.sys
2011-09-20 11:09:00 ----A---- C:\Windows\system32\drivers\usbehci.sys
2011-09-20 11:08:59 ----A---- C:\Windows\system32\drivers\usbuhci.sys
2011-09-20 11:08:59 ----A---- C:\Windows\system32\drivers\usbohci.sys
2011-09-20 11:08:59 ----A---- C:\Windows\system32\drivers\usbd.sys
2011-09-20 11:08:59 ----A---- C:\Windows\system32\drivers\usbccgp.sys
2011-09-20 08:09:21 ----D---- C:\ProgramData\TrackMania
2011-09-20 07:52:28 ----D---- C:\Users\vilik\AppData\Roaming\Google
2011-09-20 07:51:11 ----D---- C:\Program Files\Google
2011-09-20 07:50:53 ----D---- C:\ProgramData\Google
2011-09-20 07:50:53 ----D---- C:\Program Files (x86)\Google
2011-09-20 01:00:11 ----D---- C:\Windows\SYSWOW64\Wat
2011-09-20 01:00:11 ----D---- C:\Windows\system32\Wat
2011-09-19 21:50:55 ----D---- C:\Program Files (x86)\VirtualDJ
2011-09-19 21:49:29 ----D---- C:\Users\vilik\AppData\Roaming\WinRAR
2011-09-19 21:49:25 ----D---- C:\Program Files (x86)\WinRAR
2011-09-19 20:52:08 ----AD---- C:\book
2011-09-19 20:41:39 ----A---- C:\Windows\SYSWOW64\wextract.exe
2011-09-19 20:41:39 ----A---- C:\Windows\SYSWOW64\webcheck.dll
2011-09-19 20:41:39 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2011-09-19 20:41:39 ----A---- C:\Windows\SYSWOW64\SetIEInstalledDate.exe
2011-09-19 20:41:39 ----A---- C:\Windows\SYSWOW64\RegisterIEPKEYs.exe
2011-09-19 20:41:39 ----A---- C:\Windows\SYSWOW64\pngfilt.dll
2011-09-19 20:41:39 ----A---- C:\Windows\SYSWOW64\occache.dll
2011-09-19 20:41:39 ----A---- C:\Windows\SYSWOW64\msrating.dll
2011-09-19 20:41:39 ----A---- C:\Windows\SYSWOW64\msls31.dll
2011-09-19 20:41:39 ----A---- C:\Windows\SYSWOW64\mshtmler.dll
2011-09-19 20:41:39 ----A---- C:\Windows\SYSWOW64\mshta.exe
2011-09-19 20:41:39 ----A---- C:\Windows\SYSWOW64\msfeedssync.exe
2011-09-19 20:41:39 ----A---- C:\Windows\SYSWOW64\msfeedsbs.dll
2011-09-19 20:41:39 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2011-09-19 20:41:39 ----A---- C:\Windows\SYSWOW64\licmgr10.dll
2011-09-19 20:41:39 ----A---- C:\Windows\SYSWOW64\inseng.dll
2011-09-19 20:41:39 ----A---- C:\Windows\SYSWOW64\imgutil.dll
2011-09-19 20:41:39 ----A---- C:\Windows\SYSWOW64\iexpress.exe
2011-09-19 20:41:39 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2011-09-19 20:41:39 ----A---- C:\Windows\SYSWOW64\iesysprep.dll
2011-09-19 20:41:39 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2011-09-19 20:41:39 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2011-09-19 20:41:39 ----A---- C:\Windows\SYSWOW64\iepeers.dll
2011-09-19 20:41:39 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2011-09-19 20:41:39 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2011-09-19 20:41:39 ----A---- C:\Windows\SYSWOW64\ieapfltr.dat
2011-09-19 20:41:39 ----A---- C:\Windows\SYSWOW64\ieakui.dll
2011-09-19 20:41:39 ----A---- C:\Windows\SYSWOW64\ieaksie.dll
2011-09-19 20:41:39 ----A---- C:\Windows\SYSWOW64\ieakeng.dll
2011-09-19 20:41:39 ----A---- C:\Windows\SYSWOW64\IEAdvpack.dll
2011-09-19 20:41:39 ----A---- C:\Windows\SYSWOW64\ie4uinit.exe
2011-09-19 20:41:39 ----A---- C:\Windows\SYSWOW64\icardie.dll
2011-09-19 20:41:39 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2011-09-19 20:41:39 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2011-09-19 20:41:39 ----A---- C:\Windows\SYSWOW64\admparse.dll
2011-09-19 20:41:39 ----A---- C:\Windows\system32\wextract.exe
2011-09-19 20:41:39 ----A---- C:\Windows\system32\webcheck.dll
2011-09-19 20:41:39 ----A---- C:\Windows\system32\vbscript.dll
2011-09-19 20:41:39 ----A---- C:\Windows\system32\SetIEInstalledDate.exe
2011-09-19 20:41:39 ----A---- C:\Windows\system32\RegisterIEPKEYs.exe
2011-09-19 20:41:39 ----A---- C:\Windows\system32\pngfilt.dll
2011-09-19 20:41:39 ----A---- C:\Windows\system32\occache.dll
2011-09-19 20:41:39 ----A---- C:\Windows\system32\msrating.dll
2011-09-19 20:41:39 ----A---- C:\Windows\system32\msls31.dll
2011-09-19 20:41:39 ----A---- C:\Windows\system32\mshtmler.dll
2011-09-19 20:41:39 ----A---- C:\Windows\system32\mshta.exe
2011-09-19 20:41:39 ----A---- C:\Windows\system32\msfeedssync.exe
2011-09-19 20:41:39 ----A---- C:\Windows\system32\msfeedsbs.dll
2011-09-19 20:41:39 ----A---- C:\Windows\system32\msfeeds.dll
2011-09-19 20:41:39 ----A---- C:\Windows\system32\licmgr10.dll
2011-09-19 20:41:39 ----A---- C:\Windows\system32\inseng.dll
2011-09-19 20:41:39 ----A---- C:\Windows\system32\imgutil.dll
2011-09-19 20:41:39 ----A---- C:\Windows\system32\iexpress.exe
2011-09-19 20:41:39 ----A---- C:\Windows\system32\ieUnatt.exe
2011-09-19 20:41:39 ----A---- C:\Windows\system32\iesysprep.dll
2011-09-19 20:41:39 ----A---- C:\Windows\system32\iesetup.dll
2011-09-19 20:41:39 ----A---- C:\Windows\system32\iernonce.dll
2011-09-19 20:41:39 ----A---- C:\Windows\system32\iepeers.dll
2011-09-19 20:41:39 ----A---- C:\Windows\system32\iedkcs32.dll
2011-09-19 20:41:39 ----A---- C:\Windows\system32\ieapfltr.dll
2011-09-19 20:41:39 ----A---- C:\Windows\system32\ieapfltr.dat
2011-09-19 20:41:39 ----A---- C:\Windows\system32\ieakui.dll
2011-09-19 20:41:39 ----A---- C:\Windows\system32\ieaksie.dll
2011-09-19 20:41:39 ----A---- C:\Windows\system32\ieakeng.dll
2011-09-19 20:41:39 ----A---- C:\Windows\system32\IEAdvpack.dll
2011-09-19 20:41:39 ----A---- C:\Windows\system32\ie4uinit.exe
2011-09-19 20:41:39 ----A---- C:\Windows\system32\icardie.dll
2011-09-19 20:41:39 ----A---- C:\Windows\system32\dxtrans.dll
2011-09-19 20:41:39 ----A---- C:\Windows\system32\dxtmsft.dll
2011-09-19 20:41:39 ----A---- C:\Windows\system32\admparse.dll
2011-09-19 20:40:15 ----D---- C:\Program Files (x86)\Microsoft Office
2011-09-19 20:38:06 ----D---- C:\ProgramData\boost_interprocess
2011-09-19 20:33:18 ----SD---- C:\Users\vilik\AppData\Roaming\Microsoft
2011-09-19 20:33:18 ----D---- C:\Users\vilik\AppData\Roaming\Macromedia
2011-09-19 20:33:18 ----D---- C:\Users\vilik\AppData\Roaming\Intel Corporation
2011-09-19 20:33:18 ----D---- C:\Users\vilik\AppData\Roaming\InstallShield
2011-09-19 20:33:18 ----D---- C:\Users\vilik\AppData\Roaming\Identities
2011-09-19 20:33:18 ----D---- C:\Users\vilik\AppData\Roaming\Adobe
2011-09-19 20:31:49 ----SHD---- C:\Recovery
2011-09-19 18:59:57 ----A---- C:\Windows\system32\MRT.exe
2011-09-19 18:57:58 ----A---- C:\Windows\SYSWOW64\prevhost.exe
2011-09-19 18:57:58 ----A---- C:\Windows\system32\prevhost.exe
2011-09-19 18:52:36 ----A---- C:\Windows\SYSWOW64\tzres.dll
2011-09-19 18:52:36 ----A---- C:\Windows\system32\tzres.dll
2011-09-19 18:52:00 ----A---- C:\Windows\SYSWOW64\setup16.exe
2011-09-19 18:52:00 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2011-09-19 18:52:00 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2011-09-19 18:52:00 ----A---- C:\Windows\system32\wow64win.dll
2011-09-19 18:52:00 ----A---- C:\Windows\system32\wow64.dll
2011-09-19 18:52:00 ----A---- C:\Windows\system32\winsrv.dll
2011-09-19 18:52:00 ----A---- C:\Windows\system32\KernelBase.dll
2011-09-19 18:52:00 ----A---- C:\Windows\system32\kernel32.dll
2011-09-19 18:52:00 ----A---- C:\Windows\system32\conhost.exe
2011-09-19 18:51:59 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2011-09-19 18:51:59 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2011-09-19 18:51:59 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2011-09-19 18:51:59 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2011-09-19 18:51:59 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-09-19 18:51:59 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2011-09-19 18:51:59 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2011-09-19 18:51:59 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2011-09-19 18:51:59 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2011-09-19 18:51:59 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2011-09-19 18:51:59 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2011-09-19 18:51:59 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2011-09-19 18:51:59 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2011-09-19 18:51:59 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2011-09-19 18:51:59 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2011-09-19 18:51:59 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2011-09-19 18:51:59 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2011-09-19 18:51:59 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2011-09-19 18:51:59 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2011-09-19 18:51:59 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2011-09-19 18:51:59 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2011-09-19 18:51:59 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2011-09-19 18:51:59 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2011-09-19 18:51:59 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2011-09-19 18:51:59 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2011-09-19 18:51:59 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-09-19 18:51:59 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2011-09-19 18:51:59 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2011-09-19 18:51:59 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2011-09-19 18:51:59 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2011-09-19 18:51:59 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2011-09-19 18:51:59 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2011-09-19 18:51:59 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2011-09-19 18:51:59 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2011-09-19 18:51:59 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2011-09-19 18:51:59 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2011-09-19 18:51:59 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2011-09-19 18:51:59 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2011-09-19 18:51:59 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2011-09-19 18:51:59 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2011-09-19 18:51:59 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2011-09-19 18:51:59 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2011-09-19 18:51:59 ----A---- C:\Windows\SYSWOW64\wow32.dll
2011-09-19 18:51:59 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2011-09-19 18:51:59 ----A---- C:\Windows\SYSWOW64\instnm.exe
2011-09-19 18:51:59 ----A---- C:\Windows\system32\wow64cpu.dll
2011-09-19 18:51:59 ----A---- C:\Windows\system32\ntvdm64.dll
2011-09-19 18:51:58 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2011-09-19 18:51:58 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2011-09-19 18:51:58 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2011-09-19 18:51:58 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2011-09-19 18:51:58 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2011-09-19 18:51:58 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2011-09-19 18:51:58 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2011-09-19 18:51:58 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2011-09-19 18:51:58 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2011-09-19 18:51:58 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2011-09-19 18:51:58 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2011-09-19 18:51:58 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2011-09-19 18:51:58 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2011-09-19 18:51:58 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2011-09-19 18:51:58 ----A---- C:\Windows\SYSWOW64\user.exe
2011-09-19 18:51:45 ----A---- C:\Windows\SYSWOW64\mssrch.dll
2011-09-19 18:51:45 ----A---- C:\Windows\system32\tquery.dll
2011-09-19 18:51:45 ----A---- C:\Windows\system32\SearchProtocolHost.exe
2011-09-19 18:51:45 ----A---- C:\Windows\system32\SearchIndexer.exe
2011-09-19 18:51:45 ----A---- C:\Windows\system32\mssrch.dll
2011-09-19 18:51:44 ----A---- C:\Windows\SYSWOW64\tquery.dll
2011-09-19 18:51:44 ----A---- C:\Windows\SYSWOW64\SearchProtocolHost.exe
2011-09-19 18:51:44 ----A---- C:\Windows\SYSWOW64\SearchIndexer.exe
2011-09-19 18:51:44 ----A---- C:\Windows\SYSWOW64\mssph.dll
2011-09-19 18:51:44 ----A---- C:\Windows\system32\SearchFilterHost.exe
2011-09-19 18:51:44 ----A---- C:\Windows\system32\mssvp.dll
2011-09-19 18:51:44 ----A---- C:\Windows\system32\mssphtb.dll
2011-09-19 18:51:44 ----A---- C:\Windows\system32\mssph.dll
2011-09-19 18:51:43 ----A---- C:\Windows\SYSWOW64\SearchFilterHost.exe
2011-09-19 18:51:43 ----A---- C:\Windows\SYSWOW64\mssvp.dll
2011-09-19 18:51:43 ----A---- C:\Windows\SYSWOW64\mssphtb.dll
2011-09-19 18:51:43 ----A---- C:\Windows\SYSWOW64\msscntrs.dll
2011-09-19 18:51:43 ----A---- C:\Windows\system32\msscntrs.dll
2011-09-19 18:51:39 ----A---- C:\Windows\SYSWOW64\poqexec.exe
2011-09-19 18:51:39 ----A---- C:\Windows\system32\poqexec.exe
2011-09-19 18:51:37 ----A---- C:\Windows\SYSWOW64\xmllite.dll
2011-09-19 18:51:37 ----A---- C:\Windows\system32\xmllite.dll
2011-09-19 18:51:32 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2011-09-19 18:51:31 ----A---- C:\Windows\system32\ntoskrnl.exe
2011-09-19 18:51:30 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2011-09-19 18:51:28 ----A---- C:\Windows\SYSWOW64\mfc42u.dll
2011-09-19 18:51:28 ----A---- C:\Windows\SYSWOW64\mfc42.dll
2011-09-19 18:51:28 ----A---- C:\Windows\system32\mfc42u.dll
2011-09-19 18:51:28 ----A---- C:\Windows\system32\mfc42.dll
2011-09-19 18:51:20 ----A---- C:\Windows\system32\odbctrac.dll
2011-09-19 18:51:20 ----A---- C:\Windows\system32\odbccu32.dll
2011-09-19 18:51:20 ----A---- C:\Windows\system32\odbccr32.dll
2011-09-19 18:51:20 ----A---- C:\Windows\system32\odbccp32.dll
2011-09-19 18:51:19 ----A---- C:\Windows\SYSWOW64\odbctrac.dll
2011-09-19 18:51:19 ----A---- C:\Windows\SYSWOW64\odbcjt32.dll
2011-09-19 18:51:19 ----A---- C:\Windows\SYSWOW64\odbccu32.dll
2011-09-19 18:51:19 ----A---- C:\Windows\SYSWOW64\odbccr32.dll
2011-09-19 18:51:19 ----A---- C:\Windows\SYSWOW64\odbccp32.dll
2011-09-19 18:51:18 ----A---- C:\Windows\system32\drivers\afd.sys
2011-09-19 18:51:17 ----A---- C:\Windows\system32\winresume.exe
2011-09-19 18:51:17 ----A---- C:\Windows\system32\winload.exe
2011-09-19 18:51:16 ----A---- C:\Windows\system32\kdusb.dll
2011-09-19 18:51:16 ----A---- C:\Windows\system32\kdcom.dll
2011-09-19 18:51:16 ----A---- C:\Windows\system32\kd1394.dll
2011-09-19 18:51:14 ----A---- C:\Windows\SYSWOW64\atmlib.dll
2011-09-19 18:51:14 ----A---- C:\Windows\SYSWOW64\atmfd.dll
2011-09-19 18:51:14 ----A---- C:\Windows\system32\atmlib.dll
2011-09-19 18:51:14 ----A---- C:\Windows\system32\atmfd.dll
2011-09-19 18:51:13 ----A---- C:\Windows\SYSWOW64\XpsPrint.dll
2011-09-19 18:51:13 ----A---- C:\Windows\system32\XpsPrint.dll
2011-09-19 18:51:12 ----A---- C:\Windows\explorer.exe
2011-09-19 18:51:11 ----A---- C:\Windows\SYSWOW64\explorer.exe
2011-09-19 18:51:10 ----A---- C:\Windows\SYSWOW64\drvinst.exe
2011-09-19 18:51:10 ----A---- C:\Windows\SYSWOW64\devrtl.dll
2011-09-19 18:51:10 ----A---- C:\Windows\SYSWOW64\devobj.dll
2011-09-19 18:51:10 ----A---- C:\Windows\SYSWOW64\cfgmgr32.dll
2011-09-19 18:51:10 ----A---- C:\Windows\system32\umpnpmgr.dll
2011-09-19 18:51:09 ----A---- C:\Windows\system32\dnsapi.dll
2011-09-19 18:51:08 ----A---- C:\Windows\SYSWOW64\dnscacheugc.exe
2011-09-19 18:51:08 ----A---- C:\Windows\SYSWOW64\dnsapi.dll
2011-09-19 18:51:08 ----A---- C:\Windows\system32\drivers\srv2.sys
2011-09-19 18:51:08 ----A---- C:\Windows\system32\dnsrslvr.dll
2011-09-19 18:51:08 ----A---- C:\Windows\system32\dnscacheugc.exe
2011-09-19 18:51:07 ----A---- C:\Windows\system32\drivers\srvnet.sys
2011-09-19 18:51:07 ----A---- C:\Windows\system32\drivers\srv.sys
2011-09-19 18:51:06 ----A---- C:\Windows\system32\FXSCOVER.exe
2011-09-19 18:51:05 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2011-09-19 18:51:05 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2011-09-19 18:51:05 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2011-09-19 18:51:04 ----A---- C:\Windows\SYSWOW64\XpsGdiConverter.dll
2011-09-19 18:51:04 ----A---- C:\Windows\system32\XpsGdiConverter.dll
2011-09-19 18:51:03 ----A---- C:\Windows\system32\inetcomm.dll
2011-09-19 18:51:02 ----A---- C:\Windows\SYSWOW64\inetcomm.dll
2011-09-19 18:51:02 ----A---- C:\Windows\system32\drivers\Diskdump.sys
2011-09-19 18:51:01 ----A---- C:\Windows\system32\drivers\bowser.sys
2011-09-19 16:26:32 ----D---- C:\Program Files (x86)\Steam
2011-09-19 15:27:23 ----RD---- C:\Program Files (x86)\Skype
2011-09-19 15:27:23 ----D---- C:\Users\vilik\AppData\Roaming\Skype

======List of files/folders modified in the last 3 months======

2011-11-30 19:30:57 ----D---- C:\Windows\Temp
2011-11-30 19:30:42 ----D---- C:\Windows\Prefetch
2011-11-30 18:07:04 ----D---- C:\Windows\system32\config
2011-11-29 17:54:43 ----RD---- C:\Program Files (x86)
2011-11-29 17:51:46 ----D---- C:\Windows\System32
2011-11-29 17:51:46 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-11-29 17:51:45 ----D---- C:\Windows\inf
2011-11-29 17:28:42 ----D---- C:\Windows\Tasks
2011-11-29 17:18:18 ----SHD---- C:\System Volume Information
2011-11-28 18:21:03 ----D---- C:\Windows\system32\drivers
2011-11-27 17:11:05 ----RD---- C:\Program Files
2011-11-26 15:52:48 ----D---- C:\Windows
2011-11-26 12:22:22 ----SHD---- C:\Windows\Installer
2011-11-26 12:22:21 ----D---- C:\Windows\system32\Tasks
2011-11-26 11:51:43 ----HD---- C:\ProgramData
2011-11-26 11:51:05 ----D---- C:\Windows\SysWOW64
2011-11-23 22:45:20 ----D---- C:\Windows\Panther
2011-11-23 22:45:19 ----D---- C:\Windows\Logs
2011-11-23 22:45:18 ----D---- C:\Windows\debug
2011-11-23 19:39:34 ----D---- C:\Windows\system32\DriverStore
2011-11-23 19:39:34 ----D---- C:\Windows\system32\catroot
2011-11-22 19:32:41 ----D---- C:\ProgramData\Skype
2011-11-11 08:48:05 ----D---- C:\Windows\winsxs
2011-11-10 03:18:46 ----D---- C:\Program Files\Common Files\System
2011-11-09 18:23:21 ----D---- C:\Windows\system32\catroot2
2011-10-28 18:35:23 ----SD---- C:\ProgramData\Microsoft
2011-10-28 11:28:20 ----RSD---- C:\Windows\assembly
2011-10-28 11:27:13 ----D---- C:\Program Files (x86)\Common Files
2011-10-28 11:27:11 ----D---- C:\Windows\Cursors
2011-10-28 10:20:53 ----D---- C:\ProgramData\NTI Launcher
2011-10-26 18:31:23 ----RSD---- C:\Windows\Fonts
2011-10-26 18:29:39 ----D---- C:\Windows\SYSWOW64\drivers
2011-10-15 21:11:36 ----D---- C:\Windows\Microsoft.NET
2011-10-14 02:33:42 ----D---- C:\Program Files (x86)\Microsoft Silverlight
2011-10-14 02:32:50 ----D---- C:\Windows\SYSWOW64\migration
2011-10-14 02:32:50 ----D---- C:\Windows\system32\migration
2011-10-14 02:32:50 ----D---- C:\Windows\ehome
2011-10-14 02:32:50 ----D---- C:\Program Files\Internet Explorer
2011-10-14 02:32:50 ----D---- C:\Program Files (x86)\Internet Explorer
2011-10-12 02:04:20 ----D---- C:\Windows\SYSWOW64\cs-CZ
2011-10-12 02:04:20 ----D---- C:\Windows\system32\cs-CZ
2011-10-12 02:01:00 ----D---- C:\Windows\SYSWOW64\en-US
2011-10-12 02:01:00 ----D---- C:\Windows\system32\en-US
2011-09-30 10:34:42 ----D---- C:\Program Files\Common Files\Microsoft Shared
2011-09-23 12:17:24 ----D---- C:\Windows\system32\wdi
2011-09-22 19:22:00 ----RD---- C:\Users
2011-09-21 16:45:20 ----D---- C:\Windows\system32\LogFiles
2011-09-20 21:27:22 ----D---- C:\Windows\rescache
2011-09-20 16:41:49 ----D---- C:\Windows\LiveKernelReports
2011-09-20 01:00:12 ----D---- C:\Windows\AppPatch
2011-09-20 01:00:08 ----D---- C:\Program Files\Windows Sidebar
2011-09-20 01:00:08 ----D---- C:\Program Files\Windows Media Player
2011-09-20 01:00:08 ----D---- C:\Program Files\Windows Mail
2011-09-20 01:00:08 ----D---- C:\Program Files\Windows Journal
2011-09-20 01:00:07 ----D---- C:\Windows\SYSWOW64\winrm
2011-09-20 01:00:07 ----D---- C:\Windows\SYSWOW64\slmgr
2011-09-20 01:00:07 ----D---- C:\Windows\SYSWOW64\sk-SK
2011-09-20 01:00:07 ----D---- C:\Windows\SYSWOW64\migwiz
2011-09-20 01:00:07 ----D---- C:\Windows\SYSWOW64\en
2011-09-20 01:00:07 ----D---- C:\Windows\servicing
2011-09-20 01:00:07 ----D---- C:\Program Files\Windows Photo Viewer
2011-09-20 01:00:07 ----D---- C:\Program Files\Windows Defender
2011-09-20 01:00:07 ----D---- C:\Program Files (x86)\Windows Sidebar
2011-09-20 01:00:07 ----D---- C:\Program Files (x86)\Windows Photo Viewer
2011-09-20 01:00:07 ----D---- C:\Program Files (x86)\Windows Media Player
2011-09-20 01:00:07 ----D---- C:\Program Files (x86)\Windows Mail
2011-09-20 01:00:07 ----D---- C:\Program Files (x86)\Windows Defender
2011-09-20 01:00:04 ----D---- C:\Windows\SYSWOW64\drivers\en-US
2011-09-20 00:59:59 ----D---- C:\Windows\SYSWOW64\WCN
2011-09-20 00:59:59 ----D---- C:\Windows\SYSWOW64\wbem
2011-09-20 00:59:59 ----D---- C:\Windows\SYSWOW64\Printing_Admin_Scripts
2011-09-20 00:59:59 ----D---- C:\Windows\SYSWOW64\DriverStore
2011-09-20 00:59:59 ----D---- C:\Windows\SYSWOW64\Dism
2011-09-20 00:59:58 ----D---- C:\Windows\system32\winrm
2011-09-20 00:59:58 ----D---- C:\Windows\system32\sysprep
2011-09-20 00:59:58 ----D---- C:\Windows\system32\slmgr
2011-09-20 00:59:58 ----D---- C:\Windows\system32\sk-SK
2011-09-20 00:59:58 ----D---- C:\Windows\system32\oobe
2011-09-20 00:59:58 ----D---- C:\Windows\system32\migwiz
2011-09-20 00:59:58 ----D---- C:\Windows\system32\en
2011-09-20 00:59:58 ----D---- C:\Windows\system32\Boot
2011-09-20 00:59:58 ----D---- C:\Windows\PolicyDefinitions
2011-09-20 00:59:58 ----D---- C:\Windows\en-US
2011-09-20 00:59:52 ----D---- C:\Windows\system32\drivers\en-US
2011-09-20 00:59:51 ----D---- C:\Windows\system32\WCN
2011-09-20 00:59:51 ----D---- C:\Windows\system32\Dism
2011-09-20 00:59:49 ----D---- C:\Windows\system32\Printing_Admin_Scripts
2011-09-20 00:59:39 ----D---- C:\Program Files\DVD Maker
2011-09-20 00:59:24 ----D---- C:\Windows\Speech
2011-09-19 21:22:55 ----D---- C:\Windows\SoftwareDistribution
2011-09-19 20:59:04 ----AD---- C:\ProgramData\Temp
2011-09-19 20:54:06 ----D---- C:\Windows\system32\OEM
2011-09-19 20:52:18 ----HD---- C:\OEM
2011-09-19 20:49:54 ----D---- C:\Program Files (x86)\Windows Live
2011-09-19 20:39:32 ----D---- C:\Windows\system32\restore
2011-09-19 20:38:49 ----AD---- C:\Windows\DeployWinRE2
2011-09-19 20:35:26 ----D---- C:\ProgramData\oem
2011-09-19 20:35:06 ----SHD---- C:\$Recycle.Bin
2011-09-19 20:31:49 ----D---- C:\Windows\system32\Recovery
2011-09-19 15:53:09 ----D---- C:\ProgramData\McAfee
2011-09-19 15:53:09 ----D---- C:\Program Files\Common Files

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iaStor;Intel AHCI Controller; C:\Windows\system32\drivers\iaStor.sys [2010-04-13 540696]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2011-09-25 270912]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2011-08-04 146432]
R1 mwlPSDFilter;mwlPSDFilter; C:\Windows\system32\DRIVERS\mwlPSDFilter.sys [2011-03-23 22912]
R1 mwlPSDNServ;mwlPSDNServ; C:\Windows\system32\DRIVERS\mwlPSDNServ.sys [2011-03-23 20328]
R1 mwlPSDVDisk;mwlPSDVDisk; C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys [2011-03-23 62584]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2011-08-09 202576]
R2 epfwwfpr;epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys [2011-08-04 137144]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athrx.sys [2010-05-11 2229608]
R3 ETD;ELAN PS/2 Port Input Device; C:\Windows\system32\DRIVERS\ETD.sys [2010-04-13 135560]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2009-09-02 7369728]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2010-07-06 2419176]
R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI; C:\Windows\system32\drivers\IntcHdmi.sys [2009-07-09 139264]
R3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\k57nd60a.sys [2010-05-14 384040]
R3 NTIDrvr;NTIDrvr; \??\C:\Windows\system32\drivers\NTIDrvr.sys [2011-03-10 18432]
R3 Sftfs;Sftfs; C:\Windows\system32\DRIVERS\Sftfslh.sys [2009-12-02 721768]
R3 Sftplay;Sftplay; C:\Windows\system32\DRIVERS\Sftplaylh.sys [2009-12-02 269672]
R3 Sftredir;Sftredir; C:\Windows\system32\DRIVERS\Sftredirlh.sys [2009-12-02 25960]
R3 Sftvol;Sftvol; C:\Windows\system32\DRIVERS\Sftvollh.sys [2009-12-02 22376]
R3 UBHelper;UBHelper; \??\C:\Windows\system32\drivers\UBHelper.sys [2011-03-10 17408]
S2 Nsynas32;Nsynas32; C:\Windows\system32\drivers\Nsynas32.sys []
S3 GGSAFERDriver;GGSAFER Driver; \??\C:\Program Files (x86)\Garena Classic\safedrv.sys []
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader; C:\Windows\System32\Drivers\RtsUStor.sys [2010-05-24 246304]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 cvhsvc;Client Virtualization Handler; C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2010-02-28 821664]
R2 DsiWMIService;Dritek WMI Service; C:\Program Files (x86)\Launch Manager\dsiwmis.exe [2010-08-10 321104]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2011-09-22 974944]
R2 ePowerSvc;Acer ePower Service; C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe [2011-01-05 867712]
R2 Freemake Improver;Freemake Improver; C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [2011-10-26 74752]
R2 GREGService;GREGService; C:\Program Files (x86)\Acer\Registration\GREGsvc.exe [2010-01-08 23584]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology; C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-04-13 13336]
R2 Live Updater Service;Live Updater Service; C:\Program Files\Acer\Acer Updater\UpdaterService.exe [2011-01-31 244624]
R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe [2008-02-18 877864]
R2 NOBU;Norton Online Backup; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2010-06-01 2804568]
R2 NTI IScheduleSvc;NTI IScheduleSvc; C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2010-06-28 255744]
R2 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; C:\Windows\SysWOW64\IoctlSvc.exe [2006-12-19 81920]
R2 SeaPort;SeaPort; C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE [2011-02-25 249648]
R2 sftlist;Application Virtualization Client; C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2009-12-02 483688]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2010-09-21 2286976]
R3 NMIndexingService;NMIndexingService; C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe [2008-02-28 529704]
R3 sftvsa;Application Virtualization Service Agent; C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2009-12-02 209768]
R3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2011-11-14 419624]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-09-20 136176]
S3 BBSvc;Bing Bar Update Service; C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-03-02 183560]
S3 EgisTec Ticket Service;EgisTec Ticket Service; C:\Program Files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe [2010-09-28 172912]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2011-07-30 655624]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-09-20 136176]
S3 gusvc;Google Software Updater; C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe [2011-09-20 182768]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2009-11-19 4925184]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2011-09-20 1255736]
S4 wlcrasvc;Windows Live Mesh remote connections service; C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]

-----------------EOF-----------------
Nahoru
Uživatelský avatar
chodnik74
Přítel fóra
Přítel fóra
Příspěvky: 4975
Registrován: 13 zář 2010 21:30
Bydliště: Napajedla
Kontaktovat uživatele:
Kontaktovat uživatele chodnik74

Re: Vir C:\Windows\assembly\GAC_32\Desktop.ini

#2 Příspěvek od chodnik74 »

Dobrý večer :welcome:
:arrow: ESET licence je zakoupená? :)

:arrow: Malwarebytes' Anti-Malware Obrázek
  • Stáhneme,nainstalujeme a spustíme(pokud si nevíte rady jak,klikněte ZDE)
  • Vybereme Úplná kontrola a klikneme na tlačítko ProhledatObrázek
  • Program provede kontrolu počítače a na konci se vám objeví hláska,že bylo skenování dokončeno,tak potvrdíme tlačítkem OK
  • Objeví se vám log,který mi sem vložte
  • NIC NEMAZAT!!Program mívá občas falešné detekce,takže mazat budeme až po konzultaci :twisted:
Napiš mi: chodnik74@gmail.com nebo Obrázek

>RSIT<>MBAM<>VirusTotal

Doporučuji:Obrázek | Obrázek

:!: Postup si raději vícekrát přečtěte a v případě jakýchkoliv nejasností či pochybností se ptejte. ;-) Pokud máte infikovaný počítač nebo se nechová jako obvykle, tak si zálohujte všechny data a pozorně postupujte dle pokynů rádce! :!:

:!: Nepoužívejte utilitu Combofix bez dohledu a doporučení rádce!

:idea: Jste s naší pomocí spokojeni :???: Neváhejte a podpořte forum ZDE.

Pravidla fora: č.1 a č.2
Nahoru
VilikCZ
Návštěvník
Návštěvník
Příspěvky: 12
Registrován: 30 lis 2011 19:17

Re: Vir C:\Windows\assembly\GAC_32\Desktop.ini

#3 Příspěvek od VilikCZ »

Fajn tak jdu nato :thumbsup: Licence neni zakoupena každej měsic instaluju znovu a znovu :)
jinak Malwarebytes' Anti-Malware
•Stáhneme,nainstalujeme a spustíme(pokud si nevíte rady jak,klikněte ZDE)
Když kliknu na ZDE tak nemam opravnění :roll:
Nahoru
Uživatelský avatar
vyosek
VIP
VIP
Příspěvky: 56373
Registrován: 07 lis 2006 15:24
Bydliště: Šalingrad - Brno

Re: Vir C:\Windows\assembly\GAC_32\Desktop.ini

#4 Příspěvek od vyosek »

Zdravim a pekny vecer preji :)

:arrow: Jako MODerator fora si dovolim zasahnout, omlouvam se kolegovi za vstup
VilikCZ píše:Licence neni zakoupena každej měsic instaluju znovu a znovu :)
Toto ovsem odporuje licencnim podminkam spolecnosti ESET (se kterymi jste mimochodem souhlasil pri instalaci)

Cituji licencni podminky ESETu
6. Omezení práv Koncového uživatele.
g) Nesmíte používat Software získaný jako zkušební verze nebo Not-For-Resale (dále jen „NFR“) v rozporu s dobrými mravy za účelem vyhnutí se zaplacení Licenčního poplatku dle článku 17.
18. NFR a zkušební verze.
Software dodaný jako NFR nebo zkušební verze můžete použít výhradně na ověření a testování vlastností Software.
Tudiz tam mate ESS nelegalne - dle pravidel fora (viz zde a a zde bod c.3 a zde bod 2) se vsak nelegalnim SW nezabyvame, jelikoz nelegalni programy jsou vetsinou zdrojem haveti. Navic tim porusujete i autorska prava Obrázek, pachate trestny cin a ten jako takovy nebude nasim forem podporovan. Uvedomte si, ze jste na bezpecnostnim foru - podpora warezu (zvlaste bezpecnostnich programu) by byla zcela proti logice fora :!:

:arrow: Odinstalujte nelegalni ESET

:arrow: Nainstalujte free reseni (Avast, Avira ci MSE)

:arrow: Dejte novy log z RSIT a pak bude kolega pripadne pokracovat
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
VilikCZ
Návštěvník
Návštěvník
Příspěvky: 12
Registrován: 30 lis 2011 19:17

Re: Vir C:\Windows\assembly\GAC_32\Desktop.ini

#5 Příspěvek od VilikCZ »

TADY TO JE :arrow:
Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Verze databáze: 8279

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

30.11.2011 21:25:08
mbam-log-2011-11-30 (21-25-00).txt

Typ: Úplná kontrola (C:\|D:\|E:\|Q:\|)
Kontrolované objekty: 390321
Uplynulý čas: 55 minut, 51 sekund

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 0
Infikované hodnoty v registru: 0
Infikované datové položky v registru: 0
Infikované složky: 0
Infikované soubory: 1

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
c:\Users\vilik\documents\fastdownload.exe (Affiliate.Downloader) -> No action taken.
Nahoru
Uživatelský avatar
vyosek
VIP
VIP
Příspěvky: 56373
Registrován: 07 lis 2006 15:24
Bydliště: Šalingrad - Brno

Re: Vir C:\Windows\assembly\GAC_32\Desktop.ini

#6 Příspěvek od vyosek »

Log z MBAM je zbytecny, dokud bude na PC nelegalni ESET - to jsem ale psal - ze kolega nebude pokracovat nez splnite podminky pomoci...
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Uživatelský avatar
chodnik74
Přítel fóra
Přítel fóra
Příspěvky: 4975
Registrován: 13 zář 2010 21:30
Bydliště: Napajedla
Kontaktovat uživatele:
Kontaktovat uživatele chodnik74

Re: Vir C:\Windows\assembly\GAC_32\Desktop.ini

#7 Příspěvek od chodnik74 »

Přesně tak, jak již psal kolega ;-)
Napiš mi: chodnik74@gmail.com nebo Obrázek

>RSIT<>MBAM<>VirusTotal

Doporučuji:Obrázek | Obrázek

:!: Postup si raději vícekrát přečtěte a v případě jakýchkoliv nejasností či pochybností se ptejte. ;-) Pokud máte infikovaný počítač nebo se nechová jako obvykle, tak si zálohujte všechny data a pozorně postupujte dle pokynů rádce! :!:

:!: Nepoužívejte utilitu Combofix bez dohledu a doporučení rádce!

:idea: Jste s naší pomocí spokojeni :???: Neváhejte a podpořte forum ZDE.

Pravidla fora: č.1 a č.2
Nahoru
VilikCZ
Návštěvník
Návštěvník
Příspěvky: 12
Registrován: 30 lis 2011 19:17

Re: Vir C:\Windows\assembly\GAC_32\Desktop.ini

#8 Příspěvek od VilikCZ »

Logfile of random's system information tool 1.09 (written by random/random)
Run by vilik at 2011-11-30 21:53:52
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 342 GB (74%) free of 461 GB
Total RAM: 4025 MB (27% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 21:54:05, on 30.11.2011
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Steam\Steam.exe
C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Program Files (x86)\Launch Manager\LManager.exe
C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe
C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe
C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Launch Manager\LMworker.exe
C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Microsoft\BingBar\BingBar.exe
C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe
C:\Program Files (x86)\Microsoft\BingBar\BingApp.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashUtil11e_ActiveX.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Garena Classic\Garena.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\trend micro\vilik.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://acer.msn.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://acer.msn.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Movier-media Toolbar - {ce10bf86-da68-441e-91fa-38336363e3cd} - C:\Program Files (x86)\Movier-media\tbMovi.dll
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Movier-media Toolbar - {ce10bf86-da68-441e-91fa-38336363e3cd} - C:\Program Files (x86)\Movier-media\tbMovi.dll
O2 - BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll" (file missing)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll" (file missing)
O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: Movier-media Toolbar - {ce10bf86-da68-441e-91fa-38336363e3cd} - C:\Program Files (x86)\Movier-media\tbMovi.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
O4 - HKLM\..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe
O4 - HKLM\..\Run: [SuiteTray] "C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe"
O4 - HKLM\..\Run: [EgisTecPMMUpdate] "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe"
O4 - HKLM\..\Run: [EgisUpdate] "C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe" -d
O4 - HKLM\..\Run: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BackupManagerTray] "C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" -h -k
O4 - HKLM\..\Run: [SweetIM] C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [H2O] C:\Program Files (x86)\SyncroSoft\Pos\H2O\cledx.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [Steam] "C:\Program Files (x86)\Steam\steam.exe" -silent
O4 - HKCU\..\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [IsMyWinLockerReboot] msiexec.exe /qn /x{voidguid} (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [IsMyWinLockerReboot] msiexec.exe /qn /x{voidguid} (User 'Default user')
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Dritek WMI Service (DsiWMIService) - Dritek System Inc. - C:\Program Files (x86)\Launch Manager\dsiwmis.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: EgisTec Ticket Service - Egis Technology Inc. - C:\Program Files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe
O23 - Service: Acer ePower Service (ePowerSvc) - Acer Incorporated - C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Freemake Improver - Freemake - C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe
O23 - Service: GREGService - Acer Incorporated - C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Live Updater Service - Acer Incorporated - C:\Program Files\Acer\Acer Updater\UpdaterService.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NMIndexingService - Nero AG - C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: Norton Online Backup (NOBU) - Symantec Corporation - C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
O23 - Service: NTI IScheduleSvc - NewTech Infosystems, Inc. - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\SysWOW64\IoctlSvc.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 12625 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=consrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=consrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
winlogon.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Launch Manager\dsiwmis.exe"
"C:\Windows\system32\Dwm.exe"
"taskhost.exe"
C:\Windows\Explorer.EXE
"C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe"
"C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe"
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Windows\System32\igfxtray.exe"
"C:\Windows\System32\hkcmd.exe"
"C:\Windows\System32\igfxpers.exe"
"C:\Program Files\Elantech\ETDCtrl.exe"
C:\Windows\system32\igfxsrvc.exe -Embedding
"C:\Program Files (x86)\Acer\Registration\GREGsvc.exe"
"C:\Program Files\Acer\Acer Updater\UpdaterService.exe"
"C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe"
"C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe" SERVICE
"C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe"
"C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe"
C:\Windows\SysWOW64\IoctlSvc.exe
"C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE"
"C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"
"C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe"
WLIDSvcM.exe 2552
"C:\Program Files (x86)\Steam\Steam.exe" -silent
"C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
"C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe"
"C:\Program Files (x86)\Launch Manager\LManager.exe"
"C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe"
"C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe"
C:\Windows\system32\igfxext.exe -Embedding
C:\Windows\system32\wbem\unsecapp.exe -Embedding
"C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe"
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" -h -k
"C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe"
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
"C:\Program Files (x86)\Launch Manager\LMworker.exe"
"C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE"
"C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe"
"C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
"C:\Program Files\Elantech\ETDCtrlHelper.exe"
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
"C:\Program Files (x86)\Common Files\Steam\SteamService.exe" /RunAsService
"C:\Program Files (x86)\Microsoft\BingBar\BingBar.exe" -Embedding
"C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe"
"C:\Program Files (x86)\Microsoft\BingBar\BingApp.exe" -Embedding
"C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe"
C:\Windows\System32\svchost.exe -k secsvcs
"C:\ProgramData\Google\Google Toolbar\Update\GoogleToolbarInstaller_updater_signed.exe" /au /q /child
"C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:5108 CREDAT:137479
C:\Windows\SysWOW64\Macromed\Flash\FlashUtil11e_ActiveX.exe -Embedding
"C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:5108 CREDAT:203037
"C:\Program Files (x86)\Garena Classic\Garena.exe"
"C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe"
"C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe"
"C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /startalways
"C:\Users\vilik\Desktop\Warcraft III\war3.exe"
C:\Windows\system32\msiexec.exe /V
"c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe"
"C:\Program Files\Microsoft Security Client\msseces.exe" /UpdateAndQuickScan /OpenWebPageOnClose
"c:\Program Files\Microsoft Security Client\Antimalware\MpCmdRun.exe" SignaturesUpdateService -UnmanagedUpdate
\??\C:\Windows\system32\conhost.exe "-1747269448-20397031711528351519-12147568501560288448-165703984814647887011009874430
C:\Windows\system32\sppsvc.exe
"C:\Users\vilik\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8FFQO05V\RSITx64 (1).exe"
C:\Windows\system32\wbem\wmiprvse.exe

======Scheduled tasks folder======

C:\Windows\tasks\Acer Registration - Reminder Recall task.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21 529280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2011-11-10 458416]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21 439168]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2011-11-10 342192]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ce10bf86-da68-441e-91fa-38336363e3cd}]
Movier-media Toolbar - C:\Program Files (x86)\Movier-media\tbMovi.dll [2010-03-09 2355224]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d2ce3e00-f94a-4740-988e-03dc2f38c34f}]
Bing Bar Helper - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll [2011-03-02 1089288]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2011-10-18 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}]
SweetIM Toolbar Helper - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll [2011-08-24 1299248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2011-11-10 458416]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{8dcb7100-df86-4384-8842-8fa844297b3f} - Bing Bar - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll [2011-03-02 1089288]
{EEE6C35B-6118-11DC-9C72-001320C79847} - SweetIM Toolbar for Internet Explorer - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll [2011-08-24 1299248]
{ce10bf86-da68-441e-91fa-38336363e3cd} - Movier-media Toolbar - C:\Program Files (x86)\Movier-media\tbMovi.dll [2010-03-09 2355224]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2011-11-10 342192]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2010-07-06 11057768]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2010-06-14 165912]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2010-06-14 387608]
"Persistence"=C:\Windows\system32\igfxpers.exe [2010-06-14 365592]
"ETDWare"=C:\Program Files\Elantech\ETDCtrl.exe [2010-04-13 649608]
"Acer ePower Management"=C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [2011-01-05 860040]
"MSC"=c:\Program Files\Microsoft Security Client\msseces.exe [2011-06-15 1436736]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Steam"=C:\Program Files (x86)\Steam\steam.exe [2011-09-19 1242448]
"swg"=C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2011-09-20 39408]
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2011-08-02 4910912]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe [2008-02-28 1828136]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"=C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [2010-04-13 284696]
"LManager"=C:\Program Files (x86)\Launch Manager\LManager.exe [2010-08-10 975952]
"SuiteTray"=C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [2010-09-28 340336]
"EgisTecPMMUpdate"=C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe [2010-09-18 407920]
"EgisUpdate"=C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe [2010-09-18 201584]
"Norton Online Backup"=C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [2010-06-01 1155928]
"Adobe Reader Speed Launcher"=C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-28 35696]
"BackupManagerTray"=C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [2010-06-28 265984]
"SweetIM"=C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe [2011-08-01 114992]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2011-06-09 254696]
"H2O"=C:\Program Files (x86)\SyncroSoft\Pos\H2O\cledx.exe [2005-05-11 200069]
"NBKeyScan"=C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [2008-02-18 2221352]
"Malwarebytes' Anti-Malware"=C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe [2011-08-31 449608]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\RunOnce]
"Malwarebytes' Anti-Malware"=C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe [2011-08-31 449608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2009-09-02 259584]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\McMPFSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"MSVideo8"=VfWWDM32.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2011-11-30 21:51:46 ----D---- C:\Program Files (x86)\Microsoft Security Client
2011-11-30 21:51:41 ----D---- C:\Program Files\Microsoft Security Client
2011-11-30 21:50:40 ----D---- C:\983d50b5efc59239b9
2011-11-30 20:01:40 ----A---- C:\Windows\SYSWOW64\drivers\mbamswissarmy.sys
2011-11-30 20:00:34 ----D---- C:\Users\vilik\AppData\Roaming\Malwarebytes
2011-11-30 19:59:45 ----D---- C:\ProgramData\Malwarebytes
2011-11-30 19:59:41 ----D---- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2011-11-30 19:59:41 ----A---- C:\Windows\system32\drivers\mbam.sys
2011-11-27 17:11:05 ----D---- C:\rsit
2011-11-27 17:11:05 ----D---- C:\Program Files\trend micro
2011-11-26 15:34:32 ----D---- C:\Program Files (x86)\Counter-Strike Source
2011-11-26 11:51:43 ----D---- C:\ProgramData\Ask
2011-11-26 11:51:05 ----A---- C:\Windows\SYSWOW64\javaws.exe
2011-11-26 11:51:05 ----A---- C:\Windows\SYSWOW64\javaw.exe
2011-11-26 11:51:05 ----A---- C:\Windows\SYSWOW64\java.exe
2011-11-23 22:41:54 ----D---- C:\Program Files\CCleaner
2011-11-22 20:18:37 ----SHD---- C:\Windows\system32\%APPDATA%
2011-11-22 19:39:30 ----D---- C:\Windows\system32\Macromed
2011-11-11 10:29:51 ----D---- C:\Users\vilik\AppData\Roaming\Windows Live Writer
2011-11-11 08:47:26 ----HD---- C:\Windows\msdownld.tmp
2011-11-11 08:47:21 ----D---- C:\Windows\SYSWOW64\directx
2011-11-09 19:42:50 ----D---- C:\Users\vilik\AppData\Roaming\CAD-KAS
2011-11-09 19:42:40 ----D---- C:\Program Files (x86)\PDF Editor 3
2011-11-09 19:42:40 ----A---- C:\Windows\cadkasdeinst01e.exe
2011-11-09 19:11:48 ----D---- C:\ProgramData\Freemake
2011-11-09 19:11:38 ----D---- C:\Program Files (x86)\Freemake
2011-11-09 18:28:02 ----A---- C:\Windows\system32\drivers\tcpip.sys
2011-11-09 18:27:46 ----A---- C:\Windows\system32\win32k.sys

======List of files/folders modified in the last 1 month======

2011-11-30 21:53:58 ----D---- C:\Windows\Temp
2011-11-30 21:52:01 ----D---- C:\Windows
2011-11-30 21:51:57 ----SHD---- C:\Windows\Installer
2011-11-30 21:51:47 ----D---- C:\Windows\SysWOW64
2011-11-30 21:51:47 ----D---- C:\Windows\system32\drivers
2011-11-30 21:51:47 ----D---- C:\Windows\system32\catroot
2011-11-30 21:51:47 ----D---- C:\Windows\inf
2011-11-30 21:51:47 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI
2011-11-30 21:51:46 ----SD---- C:\ProgramData\Microsoft
2011-11-30 21:51:46 ----RD---- C:\Program Files (x86)
2011-11-30 21:51:41 ----RD---- C:\Program Files
2011-11-30 21:50:56 ----HD---- C:\ProgramData
2011-11-30 21:50:40 ----D---- C:\Windows\system32\DriverStore
2011-11-30 20:02:21 ----D---- C:\Windows\SYSWOW64\drivers
2011-11-30 19:58:56 ----D---- C:\Windows\Prefetch
2011-11-30 19:33:55 ----D---- C:\Program Files (x86)\Garena Classic
2011-11-30 19:33:42 ----D---- C:\Windows\Tasks
2011-11-30 18:07:04 ----D---- C:\Windows\system32\config
2011-11-30 17:53:55 ----D---- C:\Program Files (x86)\Steam
2011-11-29 22:35:17 ----D---- C:\Users\vilik\AppData\Roaming\SoftGrid Client
2011-11-29 22:35:09 ----D---- C:\Users\vilik\AppData\Roaming\Skype
2011-11-29 17:51:46 ----D---- C:\Windows\System32
2011-11-29 17:51:46 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-11-29 17:18:18 ----SHD---- C:\System Volume Information
2011-11-26 12:22:21 ----D---- C:\Windows\system32\Tasks
2011-11-26 11:51:00 ----D---- C:\Program Files (x86)\Java
2011-11-23 22:45:20 ----D---- C:\Windows\Panther
2011-11-23 22:45:20 ----D---- C:\Users\vilik\AppData\Roaming\DAEMON Tools Lite
2011-11-23 22:45:19 ----D---- C:\Windows\Logs
2011-11-23 22:45:18 ----D---- C:\Windows\debug
2011-11-22 19:32:41 ----RD---- C:\Program Files (x86)\Skype
2011-11-22 19:32:41 ----D---- C:\ProgramData\Skype
2011-11-18 23:10:45 ----D---- C:\ProgramData\boost_interprocess
2011-11-18 19:40:24 ----A---- C:\Windows\NeroDigital.ini
2011-11-13 21:52:46 ----D---- C:\Program Files (x86)\World of Warcraft
2011-11-11 08:48:05 ----D---- C:\Windows\winsxs
2011-11-10 03:18:46 ----D---- C:\Program Files\Common Files\System
2011-11-10 03:00:51 ----A---- C:\Windows\system32\MRT.exe
2011-11-09 18:23:21 ----D---- C:\Windows\system32\catroot2
2011-11-04 16:49:37 ----D---- C:\ProgramData\TrackMania

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iaStor;Intel AHCI Controller; C:\Windows\system32\drivers\iaStor.sys [2010-04-13 540696]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2011-09-25 270912]
R1 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2011-04-18 189440]
R1 mwlPSDFilter;mwlPSDFilter; C:\Windows\system32\DRIVERS\mwlPSDFilter.sys [2011-03-23 22912]
R1 mwlPSDNServ;mwlPSDNServ; C:\Windows\system32\DRIVERS\mwlPSDNServ.sys [2011-03-23 20328]
R1 mwlPSDVDisk;mwlPSDVDisk; C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys [2011-03-23 62584]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athrx.sys [2010-05-11 2229608]
R3 ETD;ELAN PS/2 Port Input Device; C:\Windows\system32\DRIVERS\ETD.sys [2010-04-13 135560]
R3 GGSAFERDriver;GGSAFER Driver; \??\C:\Program Files (x86)\Garena Classic\safedrv.sys []
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2009-09-02 7369728]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2010-07-06 2419176]
R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI; C:\Windows\system32\drivers\IntcHdmi.sys [2009-07-09 139264]
R3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\k57nd60a.sys [2010-05-14 384040]
R3 MBAMProtector;MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [2011-08-31 25416]
R3 NTIDrvr;NTIDrvr; \??\C:\Windows\system32\drivers\NTIDrvr.sys [2011-03-10 18432]
R3 Sftfs;Sftfs; C:\Windows\system32\DRIVERS\Sftfslh.sys [2009-12-02 721768]
R3 Sftplay;Sftplay; C:\Windows\system32\DRIVERS\Sftplaylh.sys [2009-12-02 269672]
R3 Sftredir;Sftredir; C:\Windows\system32\DRIVERS\Sftredirlh.sys [2009-12-02 25960]
R3 Sftvol;Sftvol; C:\Windows\system32\DRIVERS\Sftvollh.sys [2009-12-02 22376]
R3 UBHelper;UBHelper; \??\C:\Windows\system32\drivers\UBHelper.sys [2011-03-10 17408]
R4 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys []
R4 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys []
R4 epfwwfpr;epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys []
S2 Nsynas32;Nsynas32; C:\Windows\system32\drivers\Nsynas32.sys []
S3 MpNWMon;Microsoft Malware Protection Network Driver; C:\Windows\system32\DRIVERS\MpNWMon.sys [2011-04-18 40832]
S3 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2011-04-27 84864]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader; C:\Windows\System32\Drivers\RtsUStor.sys [2010-05-24 246304]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 cvhsvc;Client Virtualization Handler; C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2010-02-28 821664]
R2 DsiWMIService;Dritek WMI Service; C:\Program Files (x86)\Launch Manager\dsiwmis.exe [2010-08-10 321104]
R2 ePowerSvc;Acer ePower Service; C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe [2011-01-05 867712]
R2 Freemake Improver;Freemake Improver; C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [2011-10-26 74752]
R2 GREGService;GREGService; C:\Program Files (x86)\Acer\Registration\GREGsvc.exe [2010-01-08 23584]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology; C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-04-13 13336]
R2 Live Updater Service;Live Updater Service; C:\Program Files\Acer\Acer Updater\UpdaterService.exe [2011-01-31 244624]
R2 MBAMService;MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152]
R2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe [2011-04-27 12784]
R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe [2008-02-18 877864]
R2 NOBU;Norton Online Backup; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2010-06-01 2804568]
R2 NTI IScheduleSvc;NTI IScheduleSvc; C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2010-06-28 255744]
R2 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; C:\Windows\SysWOW64\IoctlSvc.exe [2006-12-19 81920]
R2 SeaPort;SeaPort; C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE [2011-02-25 249648]
R2 sftlist;Application Virtualization Client; C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2009-12-02 483688]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2010-09-21 2286976]
R3 NMIndexingService;NMIndexingService; C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe [2008-02-28 529704]
R3 sftvsa;Application Virtualization Service Agent; C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2009-12-02 209768]
R3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2011-11-14 419624]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-09-20 136176]
S3 BBSvc;Bing Bar Update Service; C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-03-02 183560]
S3 EgisTec Ticket Service;EgisTec Ticket Service; C:\Program Files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe [2010-09-28 172912]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2011-07-30 655624]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-09-20 136176]
S3 gusvc;Google Software Updater; C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe [2011-09-20 182768]
S3 NisSrv;@c:\Program Files\Microsoft Security Client\Antimalware\MpAsDesc.dll,-243; c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 288272]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2009-11-19 4925184]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2011-09-20 1255736]
S4 wlcrasvc;Windows Live Mesh remote connections service; C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]

-----------------EOF-----------------
Nahoru
VilikCZ
Návštěvník
Návštěvník
Příspěvky: 12
Registrován: 30 lis 2011 19:17

Re: Vir C:\Windows\assembly\GAC_32\Desktop.ini

#9 Příspěvek od VilikCZ »

Už to je správně? :mrgreen:
Nahoru
Uživatelský avatar
chodnik74
Přítel fóra
Přítel fóra
Příspěvky: 4975
Registrován: 13 zář 2010 21:30
Bydliště: Napajedla
Kontaktovat uživatele:
Kontaktovat uživatele chodnik74

Re: Vir C:\Windows\assembly\GAC_32\Desktop.ini

#10 Příspěvek od chodnik74 »

Ano, pokud se to bude opakovat, budeteme tento přestupek řešit radikalněji ;-)

Nalezenou položku MBAM dejte smazat.. Otestujeme vámi označený soubor..

:arrow: Ověřte tento soubor na VIRUSTOTAL Obrázek
  • klikneme na "Procházet" a do zadávacího pole "Název souboru" jen zkopírujeme(pokud nepůjde tak najdeme tento soubor):

    Kód: Vybrat vše

    C:\Windows\assembly\GAC_32\Desktop.ini
  • soubor odešleme tak,že klikneme na "Send file" (pokud byl již testován, nechte testovat znovu - Reanalyse)
  • Trpělivě vyčkej dokončení scanu dokud se neobjeví konečný výsledek např.0/41
  • Do fóra zkopíruj výsledný log. nebo odkaz z adresního řádku na stránku.
Napiš mi: chodnik74@gmail.com nebo Obrázek

>RSIT<>MBAM<>VirusTotal

Doporučuji:Obrázek | Obrázek

:!: Postup si raději vícekrát přečtěte a v případě jakýchkoliv nejasností či pochybností se ptejte. ;-) Pokud máte infikovaný počítač nebo se nechová jako obvykle, tak si zálohujte všechny data a pozorně postupujte dle pokynů rádce! :!:

:!: Nepoužívejte utilitu Combofix bez dohledu a doporučení rádce!

:idea: Jste s naší pomocí spokojeni :???: Neváhejte a podpořte forum ZDE.

Pravidla fora: č.1 a č.2
Nahoru
VilikCZ
Návštěvník
Návštěvník
Příspěvky: 12
Registrován: 30 lis 2011 19:17

Re: Vir C:\Windows\assembly\GAC_32\Desktop.ini

#11 Příspěvek od VilikCZ »

tohle jsem našel C:\Windows\assembly ale tohle už vte složce neni \GAC_32\Desktop.ini
:cry:
Nahoru
Uživatelský avatar
chodnik74
Přítel fóra
Přítel fóra
Příspěvky: 4975
Registrován: 13 zář 2010 21:30
Bydliště: Napajedla
Kontaktovat uživatele:
Kontaktovat uživatele chodnik74

Re: Vir C:\Windows\assembly\GAC_32\Desktop.ini

#12 Příspěvek od chodnik74 »

Čili je soubor již smazaný.. jak se chová pc?
Napiš mi: chodnik74@gmail.com nebo Obrázek

>RSIT<>MBAM<>VirusTotal

Doporučuji:Obrázek | Obrázek

:!: Postup si raději vícekrát přečtěte a v případě jakýchkoliv nejasností či pochybností se ptejte. ;-) Pokud máte infikovaný počítač nebo se nechová jako obvykle, tak si zálohujte všechny data a pozorně postupujte dle pokynů rádce! :!:

:!: Nepoužívejte utilitu Combofix bez dohledu a doporučení rádce!

:idea: Jste s naší pomocí spokojeni :???: Neváhejte a podpořte forum ZDE.

Pravidla fora: č.1 a č.2
Nahoru
VilikCZ
Návštěvník
Návštěvník
Příspěvky: 12
Registrován: 30 lis 2011 19:17

Re: Vir C:\Windows\assembly\GAC_32\Desktop.ini

#13 Příspěvek od VilikCZ »

Dam restart. Podivam se :?:
Nahoru
Uživatelský avatar
chodnik74
Přítel fóra
Přítel fóra
Příspěvky: 4975
Registrován: 13 zář 2010 21:30
Bydliště: Napajedla
Kontaktovat uživatele:
Kontaktovat uživatele chodnik74

Re: Vir C:\Windows\assembly\GAC_32\Desktop.ini

#14 Příspěvek od chodnik74 »

Já valím spat.. takže pokračujeme zítra :)
Napiš mi: chodnik74@gmail.com nebo Obrázek

>RSIT<>MBAM<>VirusTotal

Doporučuji:Obrázek | Obrázek

:!: Postup si raději vícekrát přečtěte a v případě jakýchkoliv nejasností či pochybností se ptejte. ;-) Pokud máte infikovaný počítač nebo se nechová jako obvykle, tak si zálohujte všechny data a pozorně postupujte dle pokynů rádce! :!:

:!: Nepoužívejte utilitu Combofix bez dohledu a doporučení rádce!

:idea: Jste s naší pomocí spokojeni :???: Neváhejte a podpořte forum ZDE.

Pravidla fora: č.1 a č.2
Nahoru
VilikCZ
Návštěvník
Návštěvník
Příspěvky: 12
Registrován: 30 lis 2011 19:17

Re: Vir C:\Windows\assembly\GAC_32\Desktop.ini

#15 Příspěvek od VilikCZ »

ehm.....takže System nešel opakovaně spustit...takže jsem musel dat obnovu systemu a smazal se mi Microsoft Security :idea:
Nahoru
Odpovědět

Zpět na „Řešení problémů, logy“