Dobry den, mam problem s odstranenim v9.com, mohl by mi nekdo pomoci?
Logfile of random's system information tool 1.09 (written by random/random)
Run by Ondrash at 2012-11-06 10:02:20
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 23 GB (19%) free of 120 GB
Total RAM: 3198 MB (77% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:02:39, on 6.11.2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16450)
Boot mode: Safe mode with network support
Running processes:
C:\Windows\Explorer.EXE
C:\Windows\system32\ctfmon.exe
C:\Users\Ondrash\Downloads\RSIT.exe
C:\Program Files\trend micro\Ondrash.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.v9.com/?utm_source=b&utm_med ... 1351636914
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.v9.com/?utm_source=b&utm_med ... 1351636914
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.v9.com/?utm_source=b&utm_med ... 1351636914
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.v9.com/?utm_source=b&utm_med ... 1351636914
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.v9.com/web/?q={searchTerms}
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://search.v9.com/web/?q={searchTerms}
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Proxy Help - {F386E548-C533-472E-8C61-C026FB14FEA9} - C:\Windows\system32\Newtabs_v9.dll
O4 - HKLM\..\Run: [USBToolTip] C:\PROGRA~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Ad-Aware Antivirus] "C:\Program Files\Ad-Aware Antivirus\AdAwareLauncher" --windows-run
O4 - HKLM\..\Run: [Ad-Aware Browsing Protection] "C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [emsisoft anti-malware] "c:\program files\emsisoft anti-malware\a2guard.exe" /d=60
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: CineForm Status.lnk = C:\Program Files\CineForm\Tools\GoProCineFormStatusViewer.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Emsisoft Anti-Malware 6.6 - Service (a2AntiMalware) - Emsisoft GmbH - C:\Program Files\Emsisoft Anti-Malware\a2service.exe
O23 - Service: Ad-Aware Service - Lavasoft Limited - C:\Program Files\Ad-Aware Antivirus\AdAwareService.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Ad-Aware (SBAMSvc) - GFI Software - C:\Program Files\Ad-Aware Antivirus\SBAMSvc.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
--
End of file - 5539 bytes
======Scheduled tasks folder======
C:\Windows\tasks\GlaryInitialize.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F386E548-C533-472E-8C61-C026FB14FEA9}]
Proxy Help - C:\Windows\system32\Newtabs_v9.dll [2012-08-01 66984]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"USBToolTip"=C:\PROGRA~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe [2007-02-20 199752]
"NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2007-03-09 153136]
"Ad-Aware Antivirus"=C:\Program Files\Ad-Aware Antivirus\AdAwareLauncher --windows-run []
"Ad-Aware Browsing Protection"=C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe [2011-10-21 198032]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2012-03-07 3117344]
"emsisoft anti-malware"=c:\program files\emsisoft anti-malware\a2guard.exe [2012-11-05 3364264]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [2007-03-12 153136]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
CineForm Status.lnk - C:\Program Files\CineForm\Tools\GoProCineFormStatusViewer.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ad-Aware Service]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBAMSvc]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Ad-Aware Service]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MSIServer]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SBAMSvc]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"VIDC.WMV3"=wmv9vcm.dll
"VIDC.CFHD"=CFHD.DLL
======File associations======
.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*
.scr - open - C:\Windows\system32\notepad.exe "%1"
.scr - install -
.scr - config -
======List of files/folders created in the last 1 month======
2012-11-06 10:02:20 ----D---- C:\rsit
2012-11-06 10:02:20 ----D---- C:\Program Files\trend micro
2012-11-06 10:00:47 ----A---- C:\Windows\ntbtlog.txt
2012-11-05 12:27:33 ----D---- C:\Program Files\Emsisoft Anti-Malware
2012-11-05 12:17:18 ----D---- C:\Users\Ondrash\AppData\Roaming\GlarySoft
2012-11-05 12:17:17 ----D---- C:\Program Files\Glary Utilities
2012-11-03 12:53:41 ----D---- C:\Program Files\ESET
2012-11-03 12:53:40 ----D---- C:\ProgramData\ESET
2012-11-01 00:50:33 ----RA---- C:\Windows\system32\SZIO5.dll
2012-11-01 00:50:33 ----RA---- C:\Windows\system32\IS3HTUI5.dll
2012-11-01 00:50:32 ----RA---- C:\Windows\system32\SZComp5.dll
2012-11-01 00:50:32 ----RA---- C:\Windows\system32\SZBase5.dll
2012-11-01 00:50:32 ----RA---- C:\Windows\system32\IS3Win325.dll
2012-11-01 00:50:32 ----RA---- C:\Windows\system32\IS3UI5.dll
2012-11-01 00:50:32 ----RA---- C:\Windows\system32\IS3Svc5.dll
2012-11-01 00:50:32 ----RA---- C:\Windows\system32\IS3Hks5.dll
2012-11-01 00:50:32 ----RA---- C:\Windows\system32\IS3DBA5.dll
2012-11-01 00:50:31 ----RA---- C:\Windows\system32\IS3Base5.dll
2012-10-31 23:02:46 ----D---- C:\ProgramData\Ad-Aware Browsing Protection
2012-10-31 23:02:38 ----A---- C:\Windows\system32\drivers\sbhips.sys
2012-10-31 23:02:37 ----D---- C:\ProgramData\Lavasoft
2012-10-31 23:02:34 ----D---- C:\Windows\system32\drivers\VDD
2012-10-31 23:02:34 ----D---- C:\Program Files\Ad-Aware Antivirus
2012-10-31 23:00:33 ----D---- C:\Users\Ondrash\AppData\Roaming\Ad-Aware Antivirus
2012-10-31 20:22:22 ----D---- C:\Program Files\Enigma Software Group
2012-10-31 20:22:00 ----D---- C:\Windows\DDABC66756B3412282B02F5782EA2F9A.TMP
2012-10-31 20:21:59 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2012-10-31 18:06:04 ----D---- C:\ProgramData\Spybot - Search & Destroy
2012-10-31 18:06:04 ----D---- C:\Program Files\Spybot - Search & Destroy
2012-10-31 17:06:53 ----D---- C:\ProgramData\STOPzilla!
2012-10-31 17:06:53 ----D---- C:\Program Files\STOPzilla!
2012-10-30 23:41:52 ----D---- C:\Program Files\newtabs
2012-10-30 23:41:52 ----A---- C:\Windows\system32\Newtabs_v9.dll
2012-10-30 23:41:23 ----D---- C:\Program Files\Foxit Software
2012-10-30 10:20:19 ----D---- C:\ProgramData\FLEXnet
2012-10-30 10:04:28 ----D---- C:\Program Files\Mozilla Thunderbird
2012-10-30 09:11:24 ----D---- C:\Program Files\Common Files\Macrovision Shared
2012-10-30 09:10:09 ----D---- C:\Program Files\Autodesk
2012-10-30 09:09:09 ----D---- C:\Program Files\Common Files\Autodesk Shared
2012-10-30 09:08:56 ----A---- C:\Windows\system32\d3dx10_41.dll
2012-10-30 09:08:56 ----A---- C:\Windows\system32\D3DCompiler_41.dll
2012-10-30 09:08:55 ----A---- C:\Windows\system32\D3DX9_41.dll
2012-10-30 09:05:48 ----D---- C:\Users\Ondrash\AppData\Roaming\Autodesk
2012-10-30 09:05:48 ----D---- C:\ProgramData\Autodesk
2012-10-18 08:53:24 ----D---- C:\Users\Ondrash\AppData\Roaming\Skype
2012-10-18 08:53:19 ----D---- C:\Program Files\Common Files\Skype
2012-10-18 08:53:18 ----RD---- C:\Program Files\Skype
2012-10-18 08:53:12 ----D---- C:\ProgramData\Skype
2012-10-17 09:13:30 ----D---- C:\ProgramData\Mozilla
2012-10-17 09:13:30 ----D---- C:\Program Files\Mozilla Maintenance Service
2012-10-12 09:30:19 ----D---- C:\ProgramData\Blizzard Entertainment
2012-10-12 08:25:15 ----D---- C:\ProgramData\Battle.net
2012-10-11 17:34:34 ----D---- C:\ProgramData\Blizzard
2012-10-11 17:29:17 ----D---- C:\Program Files\Common Files\Blizzard Entertainment
2012-10-11 10:06:36 ----RA---- C:\Windows\system32\IS3XDat5.dll
2012-10-11 10:06:26 ----RA---- C:\Windows\system32\IS3Inet5.dll
2012-10-09 20:30:54 ----A---- C:\Windows\system32\wintrust.dll
2012-10-09 20:30:49 ----A---- C:\Windows\system32\tzres.dll
2012-10-09 20:30:36 ----A---- C:\Windows\system32\winsrv.dll
2012-10-09 20:30:36 ----A---- C:\Windows\system32\KernelBase.dll
2012-10-09 20:30:36 ----A---- C:\Windows\system32\kernel32.dll
2012-10-09 20:30:36 ----A---- C:\Windows\system32\conhost.exe
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2012-10-09 20:30:22 ----A---- C:\Windows\system32\cryptsvc.dll
2012-10-09 20:30:22 ----A---- C:\Windows\system32\cryptnet.dll
2012-10-09 20:30:22 ----A---- C:\Windows\system32\crypt32.dll
2012-10-09 20:30:15 ----A---- C:\Windows\system32\drivers\ntfs.sys
2012-10-09 20:30:14 ----A---- C:\Windows\system32\kerberos.dll
2012-10-09 20:30:11 ----A---- C:\Windows\system32\ntoskrnl.exe
2012-10-09 20:30:10 ----A---- C:\Windows\system32\ntkrnlpa.exe
======List of files/folders modified in the last 1 month======
2012-11-06 10:02:20 ----RD---- C:\Program Files
2012-11-06 10:00:47 ----D---- C:\Windows
2012-11-06 09:39:12 ----D---- C:\Windows\Prefetch
2012-11-06 09:36:24 ----D---- C:\Windows\Temp
2012-11-06 09:36:23 ----D---- C:\ProgramData\NVIDIA
2012-11-06 09:28:09 ----D---- C:\Windows\system32\config
2012-11-05 12:17:23 ----D---- C:\Windows\system32\Tasks
2012-11-05 12:17:22 ----D---- C:\Windows\Tasks
2012-11-05 08:32:40 ----D---- C:\Windows\System32
2012-11-05 08:32:06 ----A---- C:\Windows\system32\PerfStringBackup.INI
2012-11-05 08:31:32 ----D---- C:\Windows\inf
2012-11-03 12:56:29 ----SHD---- C:\Windows\Installer
2012-11-03 12:54:28 ----D---- C:\Windows\system32\DriverStore
2012-11-03 12:54:28 ----D---- C:\Windows\system32\drivers
2012-11-03 12:54:28 ----D---- C:\Windows\system32\catroot
2012-11-03 12:53:40 ----HD---- C:\ProgramData
2012-11-03 12:38:40 ----D---- C:\Users\Ondrash\AppData\Roaming\vlc
2012-11-01 13:11:53 ----SHD---- C:\System Volume Information
2012-10-31 23:02:34 ----D---- C:\Program Files\Common Files\microsoft shared
2012-10-31 20:49:11 ----D---- C:\Program Files\Google
2012-10-31 20:21:59 ----D---- C:\Program Files\Common Files
2012-10-31 17:21:28 ----D---- C:\Windows\system32\catroot2
2012-10-31 17:07:17 ----D---- C:\Windows\winsxs
2012-10-30 09:15:59 ----D---- C:\Windows\Downloaded Program Files
2012-10-30 09:12:25 ----RSD---- C:\Windows\assembly
2012-10-30 09:12:25 ----D---- C:\Windows\Microsoft.NET
2012-10-30 09:10:56 ----RSD---- C:\Windows\Fonts
2012-10-30 00:44:57 ----D---- C:\Users\Ondrash\AppData\Roaming\uTorrent
2012-10-10 02:43:41 ----D---- C:\Windows\rescache
2012-10-10 02:17:08 ----D---- C:\Windows\system32\cs-CZ
2012-10-10 02:01:06 ----A---- C:\Windows\system32\MRT.exe
2012-10-09 20:18:36 ----D---- C:\Windows\system32\FxsTmp
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 AtiPcie;AMD PCI Express (3GIO) Filter; C:\Windows\system32\DRIVERS\AtiPcie.sys [2009-08-23 14392]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 388096]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2011-12-27 239168]
R3 asmthub3;ASMedia USB3 Hub Service; C:\Windows\system32\DRIVERS\asmthub3.sys [2011-06-02 101352]
R3 asmtxhci;ASMEDIA XHCI Service; C:\Windows\system32\DRIVERS\asmtxhci.sys [2011-06-02 317416]
R3 MarvinBus;Pinnacle Marvin Bus; C:\Windows\system32\DRIVERS\MarvinBus.sys [2005-09-23 171520]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\Windows\system32\DRIVERS\ASACPI.sys [2009-07-16 13216]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt86win7.sys [2011-06-10 394856]
S1 A2DDA;A2 Direct Disk Access Support Driver; \??\C:\Program Files\Emsisoft Anti-Malware\a2ddax86.sys [2011-05-19 17904]
S1 a2injectiondriver;a2injectiondriver; \??\C:\Program Files\Emsisoft Anti-Malware\a2dix86.sys [2012-04-30 37856]
S1 a2util;a-squared Malware-IDS utility driver; \??\C:\Program Files\Emsisoft Anti-Malware\a2util32.sys [2010-05-05 11776]
S1 AsIO;AsIO; C:\Windows\system32\drivers\AsIO.sys [2009-08-04 11296]
S1 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2012-03-14 169080]
S1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2012-03-14 120152]
S1 SBRE;SBRE; \??\C:\Windows\system32\drivers\SBREdrv.sys []
S2 epfwwfpr;epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys [2012-03-14 103112]
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S2 sbapifs;sbapifs; C:\Windows\system32\DRIVERS\sbapifs.sys [2011-11-29 77816]
S3 a2acc;a2acc; \??\C:\PROGRAM FILES\EMSISOFT ANTI-MALWARE\a2accx86.sys [2012-04-30 54072]
S3 aic78xx;aic78xx; C:\Windows\system32\drivers\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-20 62464]
S3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2011-06-28 3525352]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda32v.sys [2011-03-03 139368]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 133632]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 5632]
S3 sbhips;sbhips; C:\Windows\system32\drivers\sbhips.sys [2011-12-19 93816]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 28032]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 52224]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\drivers\viac7.sys [2009-07-14 52736]
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 175360]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 17920]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 Ad-Aware Service;Ad-Aware Service; C:\Program Files\Ad-Aware Antivirus\AdAwareService.exe [2012-07-12 1239952]
S2 a2AntiMalware;Emsisoft Anti-Malware 6.6 - Service; C:\Program Files\Emsisoft Anti-Malware\a2service.exe [2012-11-05 3084176]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2012-03-07 913144]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2012-10-31 116648]
S2 NVSvc;NVIDIA Driver Helper Service; C:\Windows\system32\nvvsvc.exe [2011-03-24 608872]
S2 SBAMSvc;Ad-Aware; C:\Program Files\Ad-Aware Antivirus\SBAMSvc.exe [2011-12-19 3289032]
S2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2012-07-13 160944]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-03-23 378472]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2012-10-30 1045256]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2012-10-31 116648]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2012-10-30 115168]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-01-15 774144]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-03-12 271920]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2011-12-28 1343400]
-----------------EOF-----------------
Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz
v9.com hack
Moderátor: Moderátoři
Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Re: v9.com hack
odinstaluj Ad-aware + SpyBot
+
restart
+
spust C:\Program Files\trend micro\Ondrash.exe
a FIXni nasledovne:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.v9.com/?utm_source=b&utm_med ... 1351636914
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.v9.com/?utm_source=b&utm_med ... 1351636914
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.v9.com/?utm_source=b&utm_med ... 1351636914
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.v9.com/?utm_source=b&utm_med ... 1351636914
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.v9.com/web/?q={searchTerms}
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://search.v9.com/web/?q={searchTerms}
+ restart a novy RSIT
+
restart
+
spust C:\Program Files\trend micro\Ondrash.exe
a FIXni nasledovne:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.v9.com/?utm_source=b&utm_med ... 1351636914
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.v9.com/?utm_source=b&utm_med ... 1351636914
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.v9.com/?utm_source=b&utm_med ... 1351636914
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.v9.com/?utm_source=b&utm_med ... 1351636914
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.v9.com/web/?q={searchTerms}
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://search.v9.com/web/?q={searchTerms}
+ restart a novy RSIT
FRST |ADWCleaner |MBAM |CCleaner |AVPTool
V prípade spokojnosti je možné podporiť fórum https://platba.viry.cz/payment/
V prípade spokojnosti je možné podporiť fórum https://platba.viry.cz/payment/
Re: v9.com hack
Provedeno, novy log...
Logfile of random's system information tool 1.09 (written by random/random)
Run by Ondrash at 2012-11-06 10:26:38
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 24 GB (20%) free of 120 GB
Total RAM: 3198 MB (75% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:26:51, on 6.11.2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16450)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskhost.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\ASUS\EPU-4 Engine\FourEngine.exe
C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\CineForm\Tools\GoProCineFormStatusViewer.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Ondrash\Downloads\RSIT.exe
C:\Program Files\trend micro\Ondrash.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.v9.com/?utm_source=b&utm_med ... 1351636914
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.v9.com/?utm_source=b&utm_med ... 1351636914
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.v9.com/web/?q={searchTerms}
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://search.v9.com/web/?q={searchTerms}
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Proxy Help - {F386E548-C533-472E-8C61-C026FB14FEA9} - C:\Windows\system32\Newtabs_v9.dll
O4 - HKLM\..\Run: [USBToolTip] C:\PROGRA~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Ad-Aware Browsing Protection] "C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: CineForm Status.lnk = C:\Program Files\CineForm\Tools\GoProCineFormStatusViewer.exe
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
--
End of file - 4652 bytes
======Scheduled tasks folder======
C:\Windows\tasks\GlaryInitialize.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F386E548-C533-472E-8C61-C026FB14FEA9}]
Proxy Help - C:\Windows\system32\Newtabs_v9.dll [2012-08-01 66984]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"USBToolTip"=C:\PROGRA~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe [2007-02-20 199752]
"NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2007-03-09 153136]
"Ad-Aware Browsing Protection"=C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe [2011-10-21 198032]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2012-03-07 3117344]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [2007-03-12 153136]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
CineForm Status.lnk - C:\Program Files\CineForm\Tools\GoProCineFormStatusViewer.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"VIDC.WMV3"=wmv9vcm.dll
"VIDC.CFHD"=CFHD.DLL
======File associations======
.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*
.scr - open - C:\Windows\system32\notepad.exe "%1"
.scr - install -
.scr - config -
======List of files/folders created in the last 1 month======
2012-11-06 10:11:34 ----D---- C:\ProgramData\GFI Software
2012-11-06 10:02:20 ----D---- C:\rsit
2012-11-06 10:02:20 ----D---- C:\Program Files\trend micro
2012-11-06 10:00:47 ----A---- C:\Windows\ntbtlog.txt
2012-11-05 12:27:33 ----D---- C:\Program Files\Emsisoft Anti-Malware
2012-11-05 12:17:18 ----D---- C:\Users\Ondrash\AppData\Roaming\GlarySoft
2012-11-05 12:17:17 ----D---- C:\Program Files\Glary Utilities
2012-11-03 12:53:41 ----D---- C:\Program Files\ESET
2012-11-03 12:53:40 ----D---- C:\ProgramData\ESET
2012-11-01 00:50:33 ----RA---- C:\Windows\system32\SZIO5.dll
2012-11-01 00:50:33 ----RA---- C:\Windows\system32\IS3HTUI5.dll
2012-11-01 00:50:32 ----RA---- C:\Windows\system32\SZComp5.dll
2012-11-01 00:50:32 ----RA---- C:\Windows\system32\SZBase5.dll
2012-11-01 00:50:32 ----RA---- C:\Windows\system32\IS3Win325.dll
2012-11-01 00:50:32 ----RA---- C:\Windows\system32\IS3UI5.dll
2012-11-01 00:50:32 ----RA---- C:\Windows\system32\IS3Svc5.dll
2012-11-01 00:50:32 ----RA---- C:\Windows\system32\IS3Hks5.dll
2012-11-01 00:50:32 ----RA---- C:\Windows\system32\IS3DBA5.dll
2012-11-01 00:50:31 ----RA---- C:\Windows\system32\IS3Base5.dll
2012-10-31 23:02:46 ----D---- C:\ProgramData\Ad-Aware Browsing Protection
2012-10-31 23:02:34 ----D---- C:\Program Files\Ad-Aware Antivirus
2012-10-31 20:22:22 ----D---- C:\Program Files\Enigma Software Group
2012-10-31 20:22:00 ----D---- C:\Windows\DDABC66756B3412282B02F5782EA2F9A.TMP
2012-10-31 20:21:59 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2012-10-31 18:06:04 ----D---- C:\ProgramData\Spybot - Search & Destroy
2012-10-31 18:06:04 ----D---- C:\Program Files\Spybot - Search & Destroy
2012-10-31 17:06:53 ----D---- C:\ProgramData\STOPzilla!
2012-10-31 17:06:53 ----D---- C:\Program Files\STOPzilla!
2012-10-30 23:41:52 ----D---- C:\Program Files\newtabs
2012-10-30 23:41:52 ----A---- C:\Windows\system32\Newtabs_v9.dll
2012-10-30 23:41:23 ----D---- C:\Program Files\Foxit Software
2012-10-30 10:20:19 ----D---- C:\ProgramData\FLEXnet
2012-10-30 10:04:28 ----D---- C:\Program Files\Mozilla Thunderbird
2012-10-30 09:11:24 ----D---- C:\Program Files\Common Files\Macrovision Shared
2012-10-30 09:10:09 ----D---- C:\Program Files\Autodesk
2012-10-30 09:09:09 ----D---- C:\Program Files\Common Files\Autodesk Shared
2012-10-30 09:08:56 ----A---- C:\Windows\system32\d3dx10_41.dll
2012-10-30 09:08:56 ----A---- C:\Windows\system32\D3DCompiler_41.dll
2012-10-30 09:08:55 ----A---- C:\Windows\system32\D3DX9_41.dll
2012-10-30 09:05:48 ----D---- C:\Users\Ondrash\AppData\Roaming\Autodesk
2012-10-30 09:05:48 ----D---- C:\ProgramData\Autodesk
2012-10-18 08:53:24 ----D---- C:\Users\Ondrash\AppData\Roaming\Skype
2012-10-18 08:53:19 ----D---- C:\Program Files\Common Files\Skype
2012-10-18 08:53:18 ----RD---- C:\Program Files\Skype
2012-10-18 08:53:12 ----D---- C:\ProgramData\Skype
2012-10-17 09:13:30 ----D---- C:\ProgramData\Mozilla
2012-10-17 09:13:30 ----D---- C:\Program Files\Mozilla Maintenance Service
2012-10-12 09:30:19 ----D---- C:\ProgramData\Blizzard Entertainment
2012-10-12 08:25:15 ----D---- C:\ProgramData\Battle.net
2012-10-11 17:34:34 ----D---- C:\ProgramData\Blizzard
2012-10-11 17:29:17 ----D---- C:\Program Files\Common Files\Blizzard Entertainment
2012-10-11 10:06:36 ----RA---- C:\Windows\system32\IS3XDat5.dll
2012-10-11 10:06:26 ----RA---- C:\Windows\system32\IS3Inet5.dll
2012-10-09 20:30:54 ----A---- C:\Windows\system32\wintrust.dll
2012-10-09 20:30:49 ----A---- C:\Windows\system32\tzres.dll
2012-10-09 20:30:36 ----A---- C:\Windows\system32\winsrv.dll
2012-10-09 20:30:36 ----A---- C:\Windows\system32\KernelBase.dll
2012-10-09 20:30:36 ----A---- C:\Windows\system32\kernel32.dll
2012-10-09 20:30:36 ----A---- C:\Windows\system32\conhost.exe
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2012-10-09 20:30:22 ----A---- C:\Windows\system32\cryptsvc.dll
2012-10-09 20:30:22 ----A---- C:\Windows\system32\cryptnet.dll
2012-10-09 20:30:22 ----A---- C:\Windows\system32\crypt32.dll
2012-10-09 20:30:15 ----A---- C:\Windows\system32\drivers\ntfs.sys
2012-10-09 20:30:14 ----A---- C:\Windows\system32\kerberos.dll
2012-10-09 20:30:11 ----A---- C:\Windows\system32\ntoskrnl.exe
2012-10-09 20:30:10 ----A---- C:\Windows\system32\ntkrnlpa.exe
======List of files/folders modified in the last 1 month======
2012-11-06 10:25:35 ----D---- C:\ProgramData\NVIDIA
2012-11-06 10:24:51 ----D---- C:\Windows\Temp
2012-11-06 10:24:11 ----D---- C:\Windows\Prefetch
2012-11-06 10:23:02 ----D---- C:\Windows\System32
2012-11-06 10:23:02 ----D---- C:\Windows\inf
2012-11-06 10:23:02 ----A---- C:\Windows\system32\PerfStringBackup.INI
2012-11-06 10:19:45 ----D---- C:\Windows\system32\config
2012-11-06 10:12:34 ----SHD---- C:\Windows\Installer
2012-11-06 10:11:37 ----D---- C:\Windows\system32\drivers
2012-11-06 10:11:35 ----HD---- C:\ProgramData
2012-11-06 10:02:20 ----RD---- C:\Program Files
2012-11-06 10:00:47 ----D---- C:\Windows
2012-11-05 12:17:23 ----D---- C:\Windows\system32\Tasks
2012-11-05 12:17:22 ----D---- C:\Windows\Tasks
2012-11-03 12:54:28 ----D---- C:\Windows\system32\DriverStore
2012-11-03 12:54:28 ----D---- C:\Windows\system32\catroot
2012-11-03 12:38:40 ----D---- C:\Users\Ondrash\AppData\Roaming\vlc
2012-11-01 13:11:53 ----SHD---- C:\System Volume Information
2012-10-31 23:02:34 ----D---- C:\Program Files\Common Files\microsoft shared
2012-10-31 20:49:11 ----D---- C:\Program Files\Google
2012-10-31 20:21:59 ----D---- C:\Program Files\Common Files
2012-10-31 17:21:28 ----D---- C:\Windows\system32\catroot2
2012-10-31 17:07:17 ----D---- C:\Windows\winsxs
2012-10-30 09:15:59 ----D---- C:\Windows\Downloaded Program Files
2012-10-30 09:12:25 ----RSD---- C:\Windows\assembly
2012-10-30 09:12:25 ----D---- C:\Windows\Microsoft.NET
2012-10-30 09:10:56 ----RSD---- C:\Windows\Fonts
2012-10-30 00:44:57 ----D---- C:\Users\Ondrash\AppData\Roaming\uTorrent
2012-10-10 02:43:41 ----D---- C:\Windows\rescache
2012-10-10 02:17:08 ----D---- C:\Windows\system32\cs-CZ
2012-10-10 02:01:06 ----A---- C:\Windows\system32\MRT.exe
2012-10-09 20:18:36 ----D---- C:\Windows\system32\FxsTmp
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 AtiPcie;AMD PCI Express (3GIO) Filter; C:\Windows\system32\DRIVERS\AtiPcie.sys [2009-08-23 14392]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R1 AsIO;AsIO; C:\Windows\system32\drivers\AsIO.sys [2009-08-04 11296]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 388096]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2011-12-27 239168]
R1 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2012-03-14 169080]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2012-03-14 120152]
R2 epfwwfpr;epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys [2012-03-14 103112]
R2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
R3 asmthub3;ASMedia USB3 Hub Service; C:\Windows\system32\DRIVERS\asmthub3.sys [2011-06-02 101352]
R3 asmtxhci;ASMEDIA XHCI Service; C:\Windows\system32\DRIVERS\asmtxhci.sys [2011-06-02 317416]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2011-06-28 3525352]
R3 MarvinBus;Pinnacle Marvin Bus; C:\Windows\system32\DRIVERS\MarvinBus.sys [2005-09-23 171520]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\Windows\system32\DRIVERS\ASACPI.sys [2009-07-16 13216]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda32v.sys [2011-03-03 139368]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt86win7.sys [2011-06-10 394856]
S1 A2DDA;A2 Direct Disk Access Support Driver; \??\C:\Program Files\Emsisoft Anti-Malware\a2ddax86.sys []
S1 SBRE;SBRE; \??\C:\Windows\system32\drivers\SBREdrv.sys []
S3 aic78xx;aic78xx; C:\Windows\system32\drivers\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-20 62464]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 133632]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 5632]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 28032]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 52224]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\drivers\viac7.sys [2009-07-14 52736]
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 175360]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 17920]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2012-03-07 913144]
R2 NVSvc;NVIDIA Driver Helper Service; C:\Windows\system32\nvvsvc.exe [2011-03-24 608872]
R2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2012-07-13 160944]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-03-23 378472]
R3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-03-12 271920]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2012-10-31 116648]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2012-10-30 1045256]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2012-10-31 116648]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2012-10-30 115168]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-01-15 774144]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2011-12-28 1343400]
-----------------EOF-----------------
Logfile of random's system information tool 1.09 (written by random/random)
Run by Ondrash at 2012-11-06 10:26:38
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 24 GB (20%) free of 120 GB
Total RAM: 3198 MB (75% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:26:51, on 6.11.2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16450)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskhost.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\ASUS\EPU-4 Engine\FourEngine.exe
C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\CineForm\Tools\GoProCineFormStatusViewer.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Ondrash\Downloads\RSIT.exe
C:\Program Files\trend micro\Ondrash.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.v9.com/?utm_source=b&utm_med ... 1351636914
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.v9.com/?utm_source=b&utm_med ... 1351636914
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.v9.com/web/?q={searchTerms}
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://search.v9.com/web/?q={searchTerms}
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Proxy Help - {F386E548-C533-472E-8C61-C026FB14FEA9} - C:\Windows\system32\Newtabs_v9.dll
O4 - HKLM\..\Run: [USBToolTip] C:\PROGRA~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Ad-Aware Browsing Protection] "C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: CineForm Status.lnk = C:\Program Files\CineForm\Tools\GoProCineFormStatusViewer.exe
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
--
End of file - 4652 bytes
======Scheduled tasks folder======
C:\Windows\tasks\GlaryInitialize.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F386E548-C533-472E-8C61-C026FB14FEA9}]
Proxy Help - C:\Windows\system32\Newtabs_v9.dll [2012-08-01 66984]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"USBToolTip"=C:\PROGRA~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe [2007-02-20 199752]
"NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2007-03-09 153136]
"Ad-Aware Browsing Protection"=C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe [2011-10-21 198032]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2012-03-07 3117344]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [2007-03-12 153136]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
CineForm Status.lnk - C:\Program Files\CineForm\Tools\GoProCineFormStatusViewer.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"VIDC.WMV3"=wmv9vcm.dll
"VIDC.CFHD"=CFHD.DLL
======File associations======
.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*
.scr - open - C:\Windows\system32\notepad.exe "%1"
.scr - install -
.scr - config -
======List of files/folders created in the last 1 month======
2012-11-06 10:11:34 ----D---- C:\ProgramData\GFI Software
2012-11-06 10:02:20 ----D---- C:\rsit
2012-11-06 10:02:20 ----D---- C:\Program Files\trend micro
2012-11-06 10:00:47 ----A---- C:\Windows\ntbtlog.txt
2012-11-05 12:27:33 ----D---- C:\Program Files\Emsisoft Anti-Malware
2012-11-05 12:17:18 ----D---- C:\Users\Ondrash\AppData\Roaming\GlarySoft
2012-11-05 12:17:17 ----D---- C:\Program Files\Glary Utilities
2012-11-03 12:53:41 ----D---- C:\Program Files\ESET
2012-11-03 12:53:40 ----D---- C:\ProgramData\ESET
2012-11-01 00:50:33 ----RA---- C:\Windows\system32\SZIO5.dll
2012-11-01 00:50:33 ----RA---- C:\Windows\system32\IS3HTUI5.dll
2012-11-01 00:50:32 ----RA---- C:\Windows\system32\SZComp5.dll
2012-11-01 00:50:32 ----RA---- C:\Windows\system32\SZBase5.dll
2012-11-01 00:50:32 ----RA---- C:\Windows\system32\IS3Win325.dll
2012-11-01 00:50:32 ----RA---- C:\Windows\system32\IS3UI5.dll
2012-11-01 00:50:32 ----RA---- C:\Windows\system32\IS3Svc5.dll
2012-11-01 00:50:32 ----RA---- C:\Windows\system32\IS3Hks5.dll
2012-11-01 00:50:32 ----RA---- C:\Windows\system32\IS3DBA5.dll
2012-11-01 00:50:31 ----RA---- C:\Windows\system32\IS3Base5.dll
2012-10-31 23:02:46 ----D---- C:\ProgramData\Ad-Aware Browsing Protection
2012-10-31 23:02:34 ----D---- C:\Program Files\Ad-Aware Antivirus
2012-10-31 20:22:22 ----D---- C:\Program Files\Enigma Software Group
2012-10-31 20:22:00 ----D---- C:\Windows\DDABC66756B3412282B02F5782EA2F9A.TMP
2012-10-31 20:21:59 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2012-10-31 18:06:04 ----D---- C:\ProgramData\Spybot - Search & Destroy
2012-10-31 18:06:04 ----D---- C:\Program Files\Spybot - Search & Destroy
2012-10-31 17:06:53 ----D---- C:\ProgramData\STOPzilla!
2012-10-31 17:06:53 ----D---- C:\Program Files\STOPzilla!
2012-10-30 23:41:52 ----D---- C:\Program Files\newtabs
2012-10-30 23:41:52 ----A---- C:\Windows\system32\Newtabs_v9.dll
2012-10-30 23:41:23 ----D---- C:\Program Files\Foxit Software
2012-10-30 10:20:19 ----D---- C:\ProgramData\FLEXnet
2012-10-30 10:04:28 ----D---- C:\Program Files\Mozilla Thunderbird
2012-10-30 09:11:24 ----D---- C:\Program Files\Common Files\Macrovision Shared
2012-10-30 09:10:09 ----D---- C:\Program Files\Autodesk
2012-10-30 09:09:09 ----D---- C:\Program Files\Common Files\Autodesk Shared
2012-10-30 09:08:56 ----A---- C:\Windows\system32\d3dx10_41.dll
2012-10-30 09:08:56 ----A---- C:\Windows\system32\D3DCompiler_41.dll
2012-10-30 09:08:55 ----A---- C:\Windows\system32\D3DX9_41.dll
2012-10-30 09:05:48 ----D---- C:\Users\Ondrash\AppData\Roaming\Autodesk
2012-10-30 09:05:48 ----D---- C:\ProgramData\Autodesk
2012-10-18 08:53:24 ----D---- C:\Users\Ondrash\AppData\Roaming\Skype
2012-10-18 08:53:19 ----D---- C:\Program Files\Common Files\Skype
2012-10-18 08:53:18 ----RD---- C:\Program Files\Skype
2012-10-18 08:53:12 ----D---- C:\ProgramData\Skype
2012-10-17 09:13:30 ----D---- C:\ProgramData\Mozilla
2012-10-17 09:13:30 ----D---- C:\Program Files\Mozilla Maintenance Service
2012-10-12 09:30:19 ----D---- C:\ProgramData\Blizzard Entertainment
2012-10-12 08:25:15 ----D---- C:\ProgramData\Battle.net
2012-10-11 17:34:34 ----D---- C:\ProgramData\Blizzard
2012-10-11 17:29:17 ----D---- C:\Program Files\Common Files\Blizzard Entertainment
2012-10-11 10:06:36 ----RA---- C:\Windows\system32\IS3XDat5.dll
2012-10-11 10:06:26 ----RA---- C:\Windows\system32\IS3Inet5.dll
2012-10-09 20:30:54 ----A---- C:\Windows\system32\wintrust.dll
2012-10-09 20:30:49 ----A---- C:\Windows\system32\tzres.dll
2012-10-09 20:30:36 ----A---- C:\Windows\system32\winsrv.dll
2012-10-09 20:30:36 ----A---- C:\Windows\system32\KernelBase.dll
2012-10-09 20:30:36 ----A---- C:\Windows\system32\kernel32.dll
2012-10-09 20:30:36 ----A---- C:\Windows\system32\conhost.exe
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2012-10-09 20:30:22 ----A---- C:\Windows\system32\cryptsvc.dll
2012-10-09 20:30:22 ----A---- C:\Windows\system32\cryptnet.dll
2012-10-09 20:30:22 ----A---- C:\Windows\system32\crypt32.dll
2012-10-09 20:30:15 ----A---- C:\Windows\system32\drivers\ntfs.sys
2012-10-09 20:30:14 ----A---- C:\Windows\system32\kerberos.dll
2012-10-09 20:30:11 ----A---- C:\Windows\system32\ntoskrnl.exe
2012-10-09 20:30:10 ----A---- C:\Windows\system32\ntkrnlpa.exe
======List of files/folders modified in the last 1 month======
2012-11-06 10:25:35 ----D---- C:\ProgramData\NVIDIA
2012-11-06 10:24:51 ----D---- C:\Windows\Temp
2012-11-06 10:24:11 ----D---- C:\Windows\Prefetch
2012-11-06 10:23:02 ----D---- C:\Windows\System32
2012-11-06 10:23:02 ----D---- C:\Windows\inf
2012-11-06 10:23:02 ----A---- C:\Windows\system32\PerfStringBackup.INI
2012-11-06 10:19:45 ----D---- C:\Windows\system32\config
2012-11-06 10:12:34 ----SHD---- C:\Windows\Installer
2012-11-06 10:11:37 ----D---- C:\Windows\system32\drivers
2012-11-06 10:11:35 ----HD---- C:\ProgramData
2012-11-06 10:02:20 ----RD---- C:\Program Files
2012-11-06 10:00:47 ----D---- C:\Windows
2012-11-05 12:17:23 ----D---- C:\Windows\system32\Tasks
2012-11-05 12:17:22 ----D---- C:\Windows\Tasks
2012-11-03 12:54:28 ----D---- C:\Windows\system32\DriverStore
2012-11-03 12:54:28 ----D---- C:\Windows\system32\catroot
2012-11-03 12:38:40 ----D---- C:\Users\Ondrash\AppData\Roaming\vlc
2012-11-01 13:11:53 ----SHD---- C:\System Volume Information
2012-10-31 23:02:34 ----D---- C:\Program Files\Common Files\microsoft shared
2012-10-31 20:49:11 ----D---- C:\Program Files\Google
2012-10-31 20:21:59 ----D---- C:\Program Files\Common Files
2012-10-31 17:21:28 ----D---- C:\Windows\system32\catroot2
2012-10-31 17:07:17 ----D---- C:\Windows\winsxs
2012-10-30 09:15:59 ----D---- C:\Windows\Downloaded Program Files
2012-10-30 09:12:25 ----RSD---- C:\Windows\assembly
2012-10-30 09:12:25 ----D---- C:\Windows\Microsoft.NET
2012-10-30 09:10:56 ----RSD---- C:\Windows\Fonts
2012-10-30 00:44:57 ----D---- C:\Users\Ondrash\AppData\Roaming\uTorrent
2012-10-10 02:43:41 ----D---- C:\Windows\rescache
2012-10-10 02:17:08 ----D---- C:\Windows\system32\cs-CZ
2012-10-10 02:01:06 ----A---- C:\Windows\system32\MRT.exe
2012-10-09 20:18:36 ----D---- C:\Windows\system32\FxsTmp
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 AtiPcie;AMD PCI Express (3GIO) Filter; C:\Windows\system32\DRIVERS\AtiPcie.sys [2009-08-23 14392]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R1 AsIO;AsIO; C:\Windows\system32\drivers\AsIO.sys [2009-08-04 11296]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 388096]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2011-12-27 239168]
R1 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2012-03-14 169080]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2012-03-14 120152]
R2 epfwwfpr;epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys [2012-03-14 103112]
R2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
R3 asmthub3;ASMedia USB3 Hub Service; C:\Windows\system32\DRIVERS\asmthub3.sys [2011-06-02 101352]
R3 asmtxhci;ASMEDIA XHCI Service; C:\Windows\system32\DRIVERS\asmtxhci.sys [2011-06-02 317416]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2011-06-28 3525352]
R3 MarvinBus;Pinnacle Marvin Bus; C:\Windows\system32\DRIVERS\MarvinBus.sys [2005-09-23 171520]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\Windows\system32\DRIVERS\ASACPI.sys [2009-07-16 13216]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda32v.sys [2011-03-03 139368]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt86win7.sys [2011-06-10 394856]
S1 A2DDA;A2 Direct Disk Access Support Driver; \??\C:\Program Files\Emsisoft Anti-Malware\a2ddax86.sys []
S1 SBRE;SBRE; \??\C:\Windows\system32\drivers\SBREdrv.sys []
S3 aic78xx;aic78xx; C:\Windows\system32\drivers\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-20 62464]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 133632]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 5632]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 28032]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 52224]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\drivers\viac7.sys [2009-07-14 52736]
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 175360]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 17920]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2012-03-07 913144]
R2 NVSvc;NVIDIA Driver Helper Service; C:\Windows\system32\nvvsvc.exe [2011-03-24 608872]
R2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2012-07-13 160944]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-03-23 378472]
R3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-03-12 271920]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2012-10-31 116648]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2012-10-30 1045256]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2012-10-31 116648]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2012-10-30 115168]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-01-15 774144]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2011-12-28 1343400]
-----------------EOF-----------------
Re: v9.com hack
pouzi http://forum.viry.cz/viewtopic.php?f=24&t=120452 volba prohledat
FRST |ADWCleaner |MBAM |CCleaner |AVPTool
V prípade spokojnosti je možné podporiť fórum https://platba.viry.cz/payment/
V prípade spokojnosti je možné podporiť fórum https://platba.viry.cz/payment/
Re: v9.com hack
¤¤¤ Škodlivé procesy: : 0 ¤¤¤
¤¤¤ ¤¤¤ Záznamy Registrů: : 3 ¤¤¤
[HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> NALEZENO
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> NALEZENO
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> NALEZENO
¤¤¤ Zvláštní soubory / Složky: ¤¤¤
¤¤¤ Ovladač : [NAHRÁNO] ¤¤¤
¤¤¤ Soubor HOSTS: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts
127.0.0.1 localhost
::1 localhost
¤¤¤ Kontrola MBR: ¤¤¤
+++++ PhysicalDrive0: WDC WD2500AVJS-63B6A0 ATA Device +++++
--- User ---
[MBR] dc7d8469e23fd5910a083ea40471671b
[BSP] 70dd35a313b0f57e6958034fde2a41cc : Windows 7 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 120100 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 245966848 | Size: 118373 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Dokončeno : << RKreport[2]_S_11062012_02d1653.txt >>
¤¤¤ ¤¤¤ Záznamy Registrů: : 3 ¤¤¤
[HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> NALEZENO
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> NALEZENO
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> NALEZENO
¤¤¤ Zvláštní soubory / Složky: ¤¤¤
¤¤¤ Ovladač : [NAHRÁNO] ¤¤¤
¤¤¤ Soubor HOSTS: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts
127.0.0.1 localhost
::1 localhost
¤¤¤ Kontrola MBR: ¤¤¤
+++++ PhysicalDrive0: WDC WD2500AVJS-63B6A0 ATA Device +++++
--- User ---
[MBR] dc7d8469e23fd5910a083ea40471671b
[BSP] 70dd35a313b0f57e6958034fde2a41cc : Windows 7 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 120100 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 245966848 | Size: 118373 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Dokončeno : << RKreport[2]_S_11062012_02d1653.txt >>
Re: v9.com hack
pouzi volbu zmazat
+
prescanuj PC s MBAM - uplna kontrola
+
prescanuj PC s MBAM - uplna kontrola
FRST |ADWCleaner |MBAM |CCleaner |AVPTool
V prípade spokojnosti je možné podporiť fórum https://platba.viry.cz/payment/
V prípade spokojnosti je možné podporiť fórum https://platba.viry.cz/payment/
Přispějete na provoz fóra?