Dobry den, mam problem s odstranenim v9.com, mohl by mi nekdo pomoci?
Logfile of random's system information tool 1.09 (written by random/random)
Run by Ondrash at 2012-11-06 10:02:20
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 23 GB (19%) free of 120 GB
Total RAM: 3198 MB (77% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:02:39, on 6.11.2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16450)
Boot mode: Safe mode with network support
Running processes:
C:\Windows\Explorer.EXE
C:\Windows\system32\ctfmon.exe
C:\Users\Ondrash\Downloads\RSIT.exe
C:\Program Files\trend micro\Ondrash.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.v9.com/?utm_source=b&utm_med ... 1351636914
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.v9.com/?utm_source=b&utm_med ... 1351636914
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.v9.com/?utm_source=b&utm_med ... 1351636914
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.v9.com/?utm_source=b&utm_med ... 1351636914
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.v9.com/web/?q={searchTerms}
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://search.v9.com/web/?q={searchTerms}
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Proxy Help - {F386E548-C533-472E-8C61-C026FB14FEA9} - C:\Windows\system32\Newtabs_v9.dll
O4 - HKLM\..\Run: [USBToolTip] C:\PROGRA~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Ad-Aware Antivirus] "C:\Program Files\Ad-Aware Antivirus\AdAwareLauncher" --windows-run
O4 - HKLM\..\Run: [Ad-Aware Browsing Protection] "C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [emsisoft anti-malware] "c:\program files\emsisoft anti-malware\a2guard.exe" /d=60
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: CineForm Status.lnk = C:\Program Files\CineForm\Tools\GoProCineFormStatusViewer.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Emsisoft Anti-Malware 6.6 - Service (a2AntiMalware) - Emsisoft GmbH - C:\Program Files\Emsisoft Anti-Malware\a2service.exe
O23 - Service: Ad-Aware Service - Lavasoft Limited - C:\Program Files\Ad-Aware Antivirus\AdAwareService.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Ad-Aware (SBAMSvc) - GFI Software - C:\Program Files\Ad-Aware Antivirus\SBAMSvc.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
--
End of file - 5539 bytes
======Scheduled tasks folder======
C:\Windows\tasks\GlaryInitialize.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F386E548-C533-472E-8C61-C026FB14FEA9}]
Proxy Help - C:\Windows\system32\Newtabs_v9.dll [2012-08-01 66984]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"USBToolTip"=C:\PROGRA~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe [2007-02-20 199752]
"NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2007-03-09 153136]
"Ad-Aware Antivirus"=C:\Program Files\Ad-Aware Antivirus\AdAwareLauncher --windows-run []
"Ad-Aware Browsing Protection"=C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe [2011-10-21 198032]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2012-03-07 3117344]
"emsisoft anti-malware"=c:\program files\emsisoft anti-malware\a2guard.exe [2012-11-05 3364264]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [2007-03-12 153136]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
CineForm Status.lnk - C:\Program Files\CineForm\Tools\GoProCineFormStatusViewer.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ad-Aware Service]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBAMSvc]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Ad-Aware Service]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MSIServer]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SBAMSvc]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"VIDC.WMV3"=wmv9vcm.dll
"VIDC.CFHD"=CFHD.DLL
======File associations======
.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*
.scr - open - C:\Windows\system32\notepad.exe "%1"
.scr - install -
.scr - config -
======List of files/folders created in the last 1 month======
2012-11-06 10:02:20 ----D---- C:\rsit
2012-11-06 10:02:20 ----D---- C:\Program Files\trend micro
2012-11-06 10:00:47 ----A---- C:\Windows\ntbtlog.txt
2012-11-05 12:27:33 ----D---- C:\Program Files\Emsisoft Anti-Malware
2012-11-05 12:17:18 ----D---- C:\Users\Ondrash\AppData\Roaming\GlarySoft
2012-11-05 12:17:17 ----D---- C:\Program Files\Glary Utilities
2012-11-03 12:53:41 ----D---- C:\Program Files\ESET
2012-11-03 12:53:40 ----D---- C:\ProgramData\ESET
2012-11-01 00:50:33 ----RA---- C:\Windows\system32\SZIO5.dll
2012-11-01 00:50:33 ----RA---- C:\Windows\system32\IS3HTUI5.dll
2012-11-01 00:50:32 ----RA---- C:\Windows\system32\SZComp5.dll
2012-11-01 00:50:32 ----RA---- C:\Windows\system32\SZBase5.dll
2012-11-01 00:50:32 ----RA---- C:\Windows\system32\IS3Win325.dll
2012-11-01 00:50:32 ----RA---- C:\Windows\system32\IS3UI5.dll
2012-11-01 00:50:32 ----RA---- C:\Windows\system32\IS3Svc5.dll
2012-11-01 00:50:32 ----RA---- C:\Windows\system32\IS3Hks5.dll
2012-11-01 00:50:32 ----RA---- C:\Windows\system32\IS3DBA5.dll
2012-11-01 00:50:31 ----RA---- C:\Windows\system32\IS3Base5.dll
2012-10-31 23:02:46 ----D---- C:\ProgramData\Ad-Aware Browsing Protection
2012-10-31 23:02:38 ----A---- C:\Windows\system32\drivers\sbhips.sys
2012-10-31 23:02:37 ----D---- C:\ProgramData\Lavasoft
2012-10-31 23:02:34 ----D---- C:\Windows\system32\drivers\VDD
2012-10-31 23:02:34 ----D---- C:\Program Files\Ad-Aware Antivirus
2012-10-31 23:00:33 ----D---- C:\Users\Ondrash\AppData\Roaming\Ad-Aware Antivirus
2012-10-31 20:22:22 ----D---- C:\Program Files\Enigma Software Group
2012-10-31 20:22:00 ----D---- C:\Windows\DDABC66756B3412282B02F5782EA2F9A.TMP
2012-10-31 20:21:59 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2012-10-31 18:06:04 ----D---- C:\ProgramData\Spybot - Search & Destroy
2012-10-31 18:06:04 ----D---- C:\Program Files\Spybot - Search & Destroy
2012-10-31 17:06:53 ----D---- C:\ProgramData\STOPzilla!
2012-10-31 17:06:53 ----D---- C:\Program Files\STOPzilla!
2012-10-30 23:41:52 ----D---- C:\Program Files\newtabs
2012-10-30 23:41:52 ----A---- C:\Windows\system32\Newtabs_v9.dll
2012-10-30 23:41:23 ----D---- C:\Program Files\Foxit Software
2012-10-30 10:20:19 ----D---- C:\ProgramData\FLEXnet
2012-10-30 10:04:28 ----D---- C:\Program Files\Mozilla Thunderbird
2012-10-30 09:11:24 ----D---- C:\Program Files\Common Files\Macrovision Shared
2012-10-30 09:10:09 ----D---- C:\Program Files\Autodesk
2012-10-30 09:09:09 ----D---- C:\Program Files\Common Files\Autodesk Shared
2012-10-30 09:08:56 ----A---- C:\Windows\system32\d3dx10_41.dll
2012-10-30 09:08:56 ----A---- C:\Windows\system32\D3DCompiler_41.dll
2012-10-30 09:08:55 ----A---- C:\Windows\system32\D3DX9_41.dll
2012-10-30 09:05:48 ----D---- C:\Users\Ondrash\AppData\Roaming\Autodesk
2012-10-30 09:05:48 ----D---- C:\ProgramData\Autodesk
2012-10-18 08:53:24 ----D---- C:\Users\Ondrash\AppData\Roaming\Skype
2012-10-18 08:53:19 ----D---- C:\Program Files\Common Files\Skype
2012-10-18 08:53:18 ----RD---- C:\Program Files\Skype
2012-10-18 08:53:12 ----D---- C:\ProgramData\Skype
2012-10-17 09:13:30 ----D---- C:\ProgramData\Mozilla
2012-10-17 09:13:30 ----D---- C:\Program Files\Mozilla Maintenance Service
2012-10-12 09:30:19 ----D---- C:\ProgramData\Blizzard Entertainment
2012-10-12 08:25:15 ----D---- C:\ProgramData\Battle.net
2012-10-11 17:34:34 ----D---- C:\ProgramData\Blizzard
2012-10-11 17:29:17 ----D---- C:\Program Files\Common Files\Blizzard Entertainment
2012-10-11 10:06:36 ----RA---- C:\Windows\system32\IS3XDat5.dll
2012-10-11 10:06:26 ----RA---- C:\Windows\system32\IS3Inet5.dll
2012-10-09 20:30:54 ----A---- C:\Windows\system32\wintrust.dll
2012-10-09 20:30:49 ----A---- C:\Windows\system32\tzres.dll
2012-10-09 20:30:36 ----A---- C:\Windows\system32\winsrv.dll
2012-10-09 20:30:36 ----A---- C:\Windows\system32\KernelBase.dll
2012-10-09 20:30:36 ----A---- C:\Windows\system32\kernel32.dll
2012-10-09 20:30:36 ----A---- C:\Windows\system32\conhost.exe
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2012-10-09 20:30:22 ----A---- C:\Windows\system32\cryptsvc.dll
2012-10-09 20:30:22 ----A---- C:\Windows\system32\cryptnet.dll
2012-10-09 20:30:22 ----A---- C:\Windows\system32\crypt32.dll
2012-10-09 20:30:15 ----A---- C:\Windows\system32\drivers\ntfs.sys
2012-10-09 20:30:14 ----A---- C:\Windows\system32\kerberos.dll
2012-10-09 20:30:11 ----A---- C:\Windows\system32\ntoskrnl.exe
2012-10-09 20:30:10 ----A---- C:\Windows\system32\ntkrnlpa.exe
======List of files/folders modified in the last 1 month======
2012-11-06 10:02:20 ----RD---- C:\Program Files
2012-11-06 10:00:47 ----D---- C:\Windows
2012-11-06 09:39:12 ----D---- C:\Windows\Prefetch
2012-11-06 09:36:24 ----D---- C:\Windows\Temp
2012-11-06 09:36:23 ----D---- C:\ProgramData\NVIDIA
2012-11-06 09:28:09 ----D---- C:\Windows\system32\config
2012-11-05 12:17:23 ----D---- C:\Windows\system32\Tasks
2012-11-05 12:17:22 ----D---- C:\Windows\Tasks
2012-11-05 08:32:40 ----D---- C:\Windows\System32
2012-11-05 08:32:06 ----A---- C:\Windows\system32\PerfStringBackup.INI
2012-11-05 08:31:32 ----D---- C:\Windows\inf
2012-11-03 12:56:29 ----SHD---- C:\Windows\Installer
2012-11-03 12:54:28 ----D---- C:\Windows\system32\DriverStore
2012-11-03 12:54:28 ----D---- C:\Windows\system32\drivers
2012-11-03 12:54:28 ----D---- C:\Windows\system32\catroot
2012-11-03 12:53:40 ----HD---- C:\ProgramData
2012-11-03 12:38:40 ----D---- C:\Users\Ondrash\AppData\Roaming\vlc
2012-11-01 13:11:53 ----SHD---- C:\System Volume Information
2012-10-31 23:02:34 ----D---- C:\Program Files\Common Files\microsoft shared
2012-10-31 20:49:11 ----D---- C:\Program Files\Google
2012-10-31 20:21:59 ----D---- C:\Program Files\Common Files
2012-10-31 17:21:28 ----D---- C:\Windows\system32\catroot2
2012-10-31 17:07:17 ----D---- C:\Windows\winsxs
2012-10-30 09:15:59 ----D---- C:\Windows\Downloaded Program Files
2012-10-30 09:12:25 ----RSD---- C:\Windows\assembly
2012-10-30 09:12:25 ----D---- C:\Windows\Microsoft.NET
2012-10-30 09:10:56 ----RSD---- C:\Windows\Fonts
2012-10-30 00:44:57 ----D---- C:\Users\Ondrash\AppData\Roaming\uTorrent
2012-10-10 02:43:41 ----D---- C:\Windows\rescache
2012-10-10 02:17:08 ----D---- C:\Windows\system32\cs-CZ
2012-10-10 02:01:06 ----A---- C:\Windows\system32\MRT.exe
2012-10-09 20:18:36 ----D---- C:\Windows\system32\FxsTmp
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 AtiPcie;AMD PCI Express (3GIO) Filter; C:\Windows\system32\DRIVERS\AtiPcie.sys [2009-08-23 14392]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 388096]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2011-12-27 239168]
R3 asmthub3;ASMedia USB3 Hub Service; C:\Windows\system32\DRIVERS\asmthub3.sys [2011-06-02 101352]
R3 asmtxhci;ASMEDIA XHCI Service; C:\Windows\system32\DRIVERS\asmtxhci.sys [2011-06-02 317416]
R3 MarvinBus;Pinnacle Marvin Bus; C:\Windows\system32\DRIVERS\MarvinBus.sys [2005-09-23 171520]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\Windows\system32\DRIVERS\ASACPI.sys [2009-07-16 13216]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt86win7.sys [2011-06-10 394856]
S1 A2DDA;A2 Direct Disk Access Support Driver; \??\C:\Program Files\Emsisoft Anti-Malware\a2ddax86.sys [2011-05-19 17904]
S1 a2injectiondriver;a2injectiondriver; \??\C:\Program Files\Emsisoft Anti-Malware\a2dix86.sys [2012-04-30 37856]
S1 a2util;a-squared Malware-IDS utility driver; \??\C:\Program Files\Emsisoft Anti-Malware\a2util32.sys [2010-05-05 11776]
S1 AsIO;AsIO; C:\Windows\system32\drivers\AsIO.sys [2009-08-04 11296]
S1 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2012-03-14 169080]
S1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2012-03-14 120152]
S1 SBRE;SBRE; \??\C:\Windows\system32\drivers\SBREdrv.sys []
S2 epfwwfpr;epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys [2012-03-14 103112]
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S2 sbapifs;sbapifs; C:\Windows\system32\DRIVERS\sbapifs.sys [2011-11-29 77816]
S3 a2acc;a2acc; \??\C:\PROGRAM FILES\EMSISOFT ANTI-MALWARE\a2accx86.sys [2012-04-30 54072]
S3 aic78xx;aic78xx; C:\Windows\system32\drivers\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-20 62464]
S3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2011-06-28 3525352]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda32v.sys [2011-03-03 139368]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 133632]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 5632]
S3 sbhips;sbhips; C:\Windows\system32\drivers\sbhips.sys [2011-12-19 93816]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 28032]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 52224]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\drivers\viac7.sys [2009-07-14 52736]
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 175360]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 17920]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 Ad-Aware Service;Ad-Aware Service; C:\Program Files\Ad-Aware Antivirus\AdAwareService.exe [2012-07-12 1239952]
S2 a2AntiMalware;Emsisoft Anti-Malware 6.6 - Service; C:\Program Files\Emsisoft Anti-Malware\a2service.exe [2012-11-05 3084176]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2012-03-07 913144]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2012-10-31 116648]
S2 NVSvc;NVIDIA Driver Helper Service; C:\Windows\system32\nvvsvc.exe [2011-03-24 608872]
S2 SBAMSvc;Ad-Aware; C:\Program Files\Ad-Aware Antivirus\SBAMSvc.exe [2011-12-19 3289032]
S2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2012-07-13 160944]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-03-23 378472]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2012-10-30 1045256]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2012-10-31 116648]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2012-10-30 115168]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-01-15 774144]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-03-12 271920]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2011-12-28 1343400]
-----------------EOF-----------------
v9.com hack
Moderátor: Moderátoři
Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Vážení uživaterlé!
Ve dnech 4. - 6-9.2026 budou někteříí naši členové na každoročním srazu fóra. Žádáme vás, abyste měli strpení, nemusí se na na řešení vašeho problému dostat hned. Děkujeme za pochopení.
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Vážení uživaterlé!
Ve dnech 4. - 6-9.2026 budou někteříí naši členové na každoročním srazu fóra. Žádáme vás, abyste měli strpení, nemusí se na na řešení vašeho problému dostat hned. Děkujeme za pochopení.
Re: v9.com hack
odinstaluj Ad-aware + SpyBot
+
restart
+
spust C:\Program Files\trend micro\Ondrash.exe
a FIXni nasledovne:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.v9.com/?utm_source=b&utm_med ... 1351636914
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.v9.com/?utm_source=b&utm_med ... 1351636914
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.v9.com/?utm_source=b&utm_med ... 1351636914
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.v9.com/?utm_source=b&utm_med ... 1351636914
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.v9.com/web/?q={searchTerms}
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://search.v9.com/web/?q={searchTerms}
+ restart a novy RSIT
+
restart
+
spust C:\Program Files\trend micro\Ondrash.exe
a FIXni nasledovne:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.v9.com/?utm_source=b&utm_med ... 1351636914
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.v9.com/?utm_source=b&utm_med ... 1351636914
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.v9.com/?utm_source=b&utm_med ... 1351636914
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.v9.com/?utm_source=b&utm_med ... 1351636914
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.v9.com/web/?q={searchTerms}
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://search.v9.com/web/?q={searchTerms}
+ restart a novy RSIT
FRST |ADWCleaner |MBAM |CCleaner |AVPTool
V prípade spokojnosti je možné podporiť fórum https://platba.viry.cz/payment/
V prípade spokojnosti je možné podporiť fórum https://platba.viry.cz/payment/
Re: v9.com hack
Provedeno, novy log...
Logfile of random's system information tool 1.09 (written by random/random)
Run by Ondrash at 2012-11-06 10:26:38
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 24 GB (20%) free of 120 GB
Total RAM: 3198 MB (75% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:26:51, on 6.11.2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16450)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskhost.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\ASUS\EPU-4 Engine\FourEngine.exe
C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\CineForm\Tools\GoProCineFormStatusViewer.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Ondrash\Downloads\RSIT.exe
C:\Program Files\trend micro\Ondrash.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.v9.com/?utm_source=b&utm_med ... 1351636914
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.v9.com/?utm_source=b&utm_med ... 1351636914
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.v9.com/web/?q={searchTerms}
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://search.v9.com/web/?q={searchTerms}
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Proxy Help - {F386E548-C533-472E-8C61-C026FB14FEA9} - C:\Windows\system32\Newtabs_v9.dll
O4 - HKLM\..\Run: [USBToolTip] C:\PROGRA~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Ad-Aware Browsing Protection] "C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: CineForm Status.lnk = C:\Program Files\CineForm\Tools\GoProCineFormStatusViewer.exe
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
--
End of file - 4652 bytes
======Scheduled tasks folder======
C:\Windows\tasks\GlaryInitialize.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F386E548-C533-472E-8C61-C026FB14FEA9}]
Proxy Help - C:\Windows\system32\Newtabs_v9.dll [2012-08-01 66984]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"USBToolTip"=C:\PROGRA~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe [2007-02-20 199752]
"NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2007-03-09 153136]
"Ad-Aware Browsing Protection"=C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe [2011-10-21 198032]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2012-03-07 3117344]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [2007-03-12 153136]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
CineForm Status.lnk - C:\Program Files\CineForm\Tools\GoProCineFormStatusViewer.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"VIDC.WMV3"=wmv9vcm.dll
"VIDC.CFHD"=CFHD.DLL
======File associations======
.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*
.scr - open - C:\Windows\system32\notepad.exe "%1"
.scr - install -
.scr - config -
======List of files/folders created in the last 1 month======
2012-11-06 10:11:34 ----D---- C:\ProgramData\GFI Software
2012-11-06 10:02:20 ----D---- C:\rsit
2012-11-06 10:02:20 ----D---- C:\Program Files\trend micro
2012-11-06 10:00:47 ----A---- C:\Windows\ntbtlog.txt
2012-11-05 12:27:33 ----D---- C:\Program Files\Emsisoft Anti-Malware
2012-11-05 12:17:18 ----D---- C:\Users\Ondrash\AppData\Roaming\GlarySoft
2012-11-05 12:17:17 ----D---- C:\Program Files\Glary Utilities
2012-11-03 12:53:41 ----D---- C:\Program Files\ESET
2012-11-03 12:53:40 ----D---- C:\ProgramData\ESET
2012-11-01 00:50:33 ----RA---- C:\Windows\system32\SZIO5.dll
2012-11-01 00:50:33 ----RA---- C:\Windows\system32\IS3HTUI5.dll
2012-11-01 00:50:32 ----RA---- C:\Windows\system32\SZComp5.dll
2012-11-01 00:50:32 ----RA---- C:\Windows\system32\SZBase5.dll
2012-11-01 00:50:32 ----RA---- C:\Windows\system32\IS3Win325.dll
2012-11-01 00:50:32 ----RA---- C:\Windows\system32\IS3UI5.dll
2012-11-01 00:50:32 ----RA---- C:\Windows\system32\IS3Svc5.dll
2012-11-01 00:50:32 ----RA---- C:\Windows\system32\IS3Hks5.dll
2012-11-01 00:50:32 ----RA---- C:\Windows\system32\IS3DBA5.dll
2012-11-01 00:50:31 ----RA---- C:\Windows\system32\IS3Base5.dll
2012-10-31 23:02:46 ----D---- C:\ProgramData\Ad-Aware Browsing Protection
2012-10-31 23:02:34 ----D---- C:\Program Files\Ad-Aware Antivirus
2012-10-31 20:22:22 ----D---- C:\Program Files\Enigma Software Group
2012-10-31 20:22:00 ----D---- C:\Windows\DDABC66756B3412282B02F5782EA2F9A.TMP
2012-10-31 20:21:59 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2012-10-31 18:06:04 ----D---- C:\ProgramData\Spybot - Search & Destroy
2012-10-31 18:06:04 ----D---- C:\Program Files\Spybot - Search & Destroy
2012-10-31 17:06:53 ----D---- C:\ProgramData\STOPzilla!
2012-10-31 17:06:53 ----D---- C:\Program Files\STOPzilla!
2012-10-30 23:41:52 ----D---- C:\Program Files\newtabs
2012-10-30 23:41:52 ----A---- C:\Windows\system32\Newtabs_v9.dll
2012-10-30 23:41:23 ----D---- C:\Program Files\Foxit Software
2012-10-30 10:20:19 ----D---- C:\ProgramData\FLEXnet
2012-10-30 10:04:28 ----D---- C:\Program Files\Mozilla Thunderbird
2012-10-30 09:11:24 ----D---- C:\Program Files\Common Files\Macrovision Shared
2012-10-30 09:10:09 ----D---- C:\Program Files\Autodesk
2012-10-30 09:09:09 ----D---- C:\Program Files\Common Files\Autodesk Shared
2012-10-30 09:08:56 ----A---- C:\Windows\system32\d3dx10_41.dll
2012-10-30 09:08:56 ----A---- C:\Windows\system32\D3DCompiler_41.dll
2012-10-30 09:08:55 ----A---- C:\Windows\system32\D3DX9_41.dll
2012-10-30 09:05:48 ----D---- C:\Users\Ondrash\AppData\Roaming\Autodesk
2012-10-30 09:05:48 ----D---- C:\ProgramData\Autodesk
2012-10-18 08:53:24 ----D---- C:\Users\Ondrash\AppData\Roaming\Skype
2012-10-18 08:53:19 ----D---- C:\Program Files\Common Files\Skype
2012-10-18 08:53:18 ----RD---- C:\Program Files\Skype
2012-10-18 08:53:12 ----D---- C:\ProgramData\Skype
2012-10-17 09:13:30 ----D---- C:\ProgramData\Mozilla
2012-10-17 09:13:30 ----D---- C:\Program Files\Mozilla Maintenance Service
2012-10-12 09:30:19 ----D---- C:\ProgramData\Blizzard Entertainment
2012-10-12 08:25:15 ----D---- C:\ProgramData\Battle.net
2012-10-11 17:34:34 ----D---- C:\ProgramData\Blizzard
2012-10-11 17:29:17 ----D---- C:\Program Files\Common Files\Blizzard Entertainment
2012-10-11 10:06:36 ----RA---- C:\Windows\system32\IS3XDat5.dll
2012-10-11 10:06:26 ----RA---- C:\Windows\system32\IS3Inet5.dll
2012-10-09 20:30:54 ----A---- C:\Windows\system32\wintrust.dll
2012-10-09 20:30:49 ----A---- C:\Windows\system32\tzres.dll
2012-10-09 20:30:36 ----A---- C:\Windows\system32\winsrv.dll
2012-10-09 20:30:36 ----A---- C:\Windows\system32\KernelBase.dll
2012-10-09 20:30:36 ----A---- C:\Windows\system32\kernel32.dll
2012-10-09 20:30:36 ----A---- C:\Windows\system32\conhost.exe
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2012-10-09 20:30:22 ----A---- C:\Windows\system32\cryptsvc.dll
2012-10-09 20:30:22 ----A---- C:\Windows\system32\cryptnet.dll
2012-10-09 20:30:22 ----A---- C:\Windows\system32\crypt32.dll
2012-10-09 20:30:15 ----A---- C:\Windows\system32\drivers\ntfs.sys
2012-10-09 20:30:14 ----A---- C:\Windows\system32\kerberos.dll
2012-10-09 20:30:11 ----A---- C:\Windows\system32\ntoskrnl.exe
2012-10-09 20:30:10 ----A---- C:\Windows\system32\ntkrnlpa.exe
======List of files/folders modified in the last 1 month======
2012-11-06 10:25:35 ----D---- C:\ProgramData\NVIDIA
2012-11-06 10:24:51 ----D---- C:\Windows\Temp
2012-11-06 10:24:11 ----D---- C:\Windows\Prefetch
2012-11-06 10:23:02 ----D---- C:\Windows\System32
2012-11-06 10:23:02 ----D---- C:\Windows\inf
2012-11-06 10:23:02 ----A---- C:\Windows\system32\PerfStringBackup.INI
2012-11-06 10:19:45 ----D---- C:\Windows\system32\config
2012-11-06 10:12:34 ----SHD---- C:\Windows\Installer
2012-11-06 10:11:37 ----D---- C:\Windows\system32\drivers
2012-11-06 10:11:35 ----HD---- C:\ProgramData
2012-11-06 10:02:20 ----RD---- C:\Program Files
2012-11-06 10:00:47 ----D---- C:\Windows
2012-11-05 12:17:23 ----D---- C:\Windows\system32\Tasks
2012-11-05 12:17:22 ----D---- C:\Windows\Tasks
2012-11-03 12:54:28 ----D---- C:\Windows\system32\DriverStore
2012-11-03 12:54:28 ----D---- C:\Windows\system32\catroot
2012-11-03 12:38:40 ----D---- C:\Users\Ondrash\AppData\Roaming\vlc
2012-11-01 13:11:53 ----SHD---- C:\System Volume Information
2012-10-31 23:02:34 ----D---- C:\Program Files\Common Files\microsoft shared
2012-10-31 20:49:11 ----D---- C:\Program Files\Google
2012-10-31 20:21:59 ----D---- C:\Program Files\Common Files
2012-10-31 17:21:28 ----D---- C:\Windows\system32\catroot2
2012-10-31 17:07:17 ----D---- C:\Windows\winsxs
2012-10-30 09:15:59 ----D---- C:\Windows\Downloaded Program Files
2012-10-30 09:12:25 ----RSD---- C:\Windows\assembly
2012-10-30 09:12:25 ----D---- C:\Windows\Microsoft.NET
2012-10-30 09:10:56 ----RSD---- C:\Windows\Fonts
2012-10-30 00:44:57 ----D---- C:\Users\Ondrash\AppData\Roaming\uTorrent
2012-10-10 02:43:41 ----D---- C:\Windows\rescache
2012-10-10 02:17:08 ----D---- C:\Windows\system32\cs-CZ
2012-10-10 02:01:06 ----A---- C:\Windows\system32\MRT.exe
2012-10-09 20:18:36 ----D---- C:\Windows\system32\FxsTmp
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 AtiPcie;AMD PCI Express (3GIO) Filter; C:\Windows\system32\DRIVERS\AtiPcie.sys [2009-08-23 14392]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R1 AsIO;AsIO; C:\Windows\system32\drivers\AsIO.sys [2009-08-04 11296]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 388096]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2011-12-27 239168]
R1 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2012-03-14 169080]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2012-03-14 120152]
R2 epfwwfpr;epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys [2012-03-14 103112]
R2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
R3 asmthub3;ASMedia USB3 Hub Service; C:\Windows\system32\DRIVERS\asmthub3.sys [2011-06-02 101352]
R3 asmtxhci;ASMEDIA XHCI Service; C:\Windows\system32\DRIVERS\asmtxhci.sys [2011-06-02 317416]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2011-06-28 3525352]
R3 MarvinBus;Pinnacle Marvin Bus; C:\Windows\system32\DRIVERS\MarvinBus.sys [2005-09-23 171520]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\Windows\system32\DRIVERS\ASACPI.sys [2009-07-16 13216]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda32v.sys [2011-03-03 139368]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt86win7.sys [2011-06-10 394856]
S1 A2DDA;A2 Direct Disk Access Support Driver; \??\C:\Program Files\Emsisoft Anti-Malware\a2ddax86.sys []
S1 SBRE;SBRE; \??\C:\Windows\system32\drivers\SBREdrv.sys []
S3 aic78xx;aic78xx; C:\Windows\system32\drivers\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-20 62464]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 133632]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 5632]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 28032]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 52224]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\drivers\viac7.sys [2009-07-14 52736]
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 175360]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 17920]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2012-03-07 913144]
R2 NVSvc;NVIDIA Driver Helper Service; C:\Windows\system32\nvvsvc.exe [2011-03-24 608872]
R2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2012-07-13 160944]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-03-23 378472]
R3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-03-12 271920]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2012-10-31 116648]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2012-10-30 1045256]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2012-10-31 116648]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2012-10-30 115168]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-01-15 774144]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2011-12-28 1343400]
-----------------EOF-----------------
Logfile of random's system information tool 1.09 (written by random/random)
Run by Ondrash at 2012-11-06 10:26:38
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 24 GB (20%) free of 120 GB
Total RAM: 3198 MB (75% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:26:51, on 6.11.2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16450)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskhost.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\ASUS\EPU-4 Engine\FourEngine.exe
C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\CineForm\Tools\GoProCineFormStatusViewer.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Ondrash\Downloads\RSIT.exe
C:\Program Files\trend micro\Ondrash.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.v9.com/?utm_source=b&utm_med ... 1351636914
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.v9.com/?utm_source=b&utm_med ... 1351636914
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.v9.com/web/?q={searchTerms}
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://search.v9.com/web/?q={searchTerms}
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Proxy Help - {F386E548-C533-472E-8C61-C026FB14FEA9} - C:\Windows\system32\Newtabs_v9.dll
O4 - HKLM\..\Run: [USBToolTip] C:\PROGRA~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Ad-Aware Browsing Protection] "C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: CineForm Status.lnk = C:\Program Files\CineForm\Tools\GoProCineFormStatusViewer.exe
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
--
End of file - 4652 bytes
======Scheduled tasks folder======
C:\Windows\tasks\GlaryInitialize.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F386E548-C533-472E-8C61-C026FB14FEA9}]
Proxy Help - C:\Windows\system32\Newtabs_v9.dll [2012-08-01 66984]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"USBToolTip"=C:\PROGRA~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe [2007-02-20 199752]
"NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2007-03-09 153136]
"Ad-Aware Browsing Protection"=C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe [2011-10-21 198032]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2012-03-07 3117344]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [2007-03-12 153136]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
CineForm Status.lnk - C:\Program Files\CineForm\Tools\GoProCineFormStatusViewer.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"VIDC.WMV3"=wmv9vcm.dll
"VIDC.CFHD"=CFHD.DLL
======File associations======
.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*
.scr - open - C:\Windows\system32\notepad.exe "%1"
.scr - install -
.scr - config -
======List of files/folders created in the last 1 month======
2012-11-06 10:11:34 ----D---- C:\ProgramData\GFI Software
2012-11-06 10:02:20 ----D---- C:\rsit
2012-11-06 10:02:20 ----D---- C:\Program Files\trend micro
2012-11-06 10:00:47 ----A---- C:\Windows\ntbtlog.txt
2012-11-05 12:27:33 ----D---- C:\Program Files\Emsisoft Anti-Malware
2012-11-05 12:17:18 ----D---- C:\Users\Ondrash\AppData\Roaming\GlarySoft
2012-11-05 12:17:17 ----D---- C:\Program Files\Glary Utilities
2012-11-03 12:53:41 ----D---- C:\Program Files\ESET
2012-11-03 12:53:40 ----D---- C:\ProgramData\ESET
2012-11-01 00:50:33 ----RA---- C:\Windows\system32\SZIO5.dll
2012-11-01 00:50:33 ----RA---- C:\Windows\system32\IS3HTUI5.dll
2012-11-01 00:50:32 ----RA---- C:\Windows\system32\SZComp5.dll
2012-11-01 00:50:32 ----RA---- C:\Windows\system32\SZBase5.dll
2012-11-01 00:50:32 ----RA---- C:\Windows\system32\IS3Win325.dll
2012-11-01 00:50:32 ----RA---- C:\Windows\system32\IS3UI5.dll
2012-11-01 00:50:32 ----RA---- C:\Windows\system32\IS3Svc5.dll
2012-11-01 00:50:32 ----RA---- C:\Windows\system32\IS3Hks5.dll
2012-11-01 00:50:32 ----RA---- C:\Windows\system32\IS3DBA5.dll
2012-11-01 00:50:31 ----RA---- C:\Windows\system32\IS3Base5.dll
2012-10-31 23:02:46 ----D---- C:\ProgramData\Ad-Aware Browsing Protection
2012-10-31 23:02:34 ----D---- C:\Program Files\Ad-Aware Antivirus
2012-10-31 20:22:22 ----D---- C:\Program Files\Enigma Software Group
2012-10-31 20:22:00 ----D---- C:\Windows\DDABC66756B3412282B02F5782EA2F9A.TMP
2012-10-31 20:21:59 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2012-10-31 18:06:04 ----D---- C:\ProgramData\Spybot - Search & Destroy
2012-10-31 18:06:04 ----D---- C:\Program Files\Spybot - Search & Destroy
2012-10-31 17:06:53 ----D---- C:\ProgramData\STOPzilla!
2012-10-31 17:06:53 ----D---- C:\Program Files\STOPzilla!
2012-10-30 23:41:52 ----D---- C:\Program Files\newtabs
2012-10-30 23:41:52 ----A---- C:\Windows\system32\Newtabs_v9.dll
2012-10-30 23:41:23 ----D---- C:\Program Files\Foxit Software
2012-10-30 10:20:19 ----D---- C:\ProgramData\FLEXnet
2012-10-30 10:04:28 ----D---- C:\Program Files\Mozilla Thunderbird
2012-10-30 09:11:24 ----D---- C:\Program Files\Common Files\Macrovision Shared
2012-10-30 09:10:09 ----D---- C:\Program Files\Autodesk
2012-10-30 09:09:09 ----D---- C:\Program Files\Common Files\Autodesk Shared
2012-10-30 09:08:56 ----A---- C:\Windows\system32\d3dx10_41.dll
2012-10-30 09:08:56 ----A---- C:\Windows\system32\D3DCompiler_41.dll
2012-10-30 09:08:55 ----A---- C:\Windows\system32\D3DX9_41.dll
2012-10-30 09:05:48 ----D---- C:\Users\Ondrash\AppData\Roaming\Autodesk
2012-10-30 09:05:48 ----D---- C:\ProgramData\Autodesk
2012-10-18 08:53:24 ----D---- C:\Users\Ondrash\AppData\Roaming\Skype
2012-10-18 08:53:19 ----D---- C:\Program Files\Common Files\Skype
2012-10-18 08:53:18 ----RD---- C:\Program Files\Skype
2012-10-18 08:53:12 ----D---- C:\ProgramData\Skype
2012-10-17 09:13:30 ----D---- C:\ProgramData\Mozilla
2012-10-17 09:13:30 ----D---- C:\Program Files\Mozilla Maintenance Service
2012-10-12 09:30:19 ----D---- C:\ProgramData\Blizzard Entertainment
2012-10-12 08:25:15 ----D---- C:\ProgramData\Battle.net
2012-10-11 17:34:34 ----D---- C:\ProgramData\Blizzard
2012-10-11 17:29:17 ----D---- C:\Program Files\Common Files\Blizzard Entertainment
2012-10-11 10:06:36 ----RA---- C:\Windows\system32\IS3XDat5.dll
2012-10-11 10:06:26 ----RA---- C:\Windows\system32\IS3Inet5.dll
2012-10-09 20:30:54 ----A---- C:\Windows\system32\wintrust.dll
2012-10-09 20:30:49 ----A---- C:\Windows\system32\tzres.dll
2012-10-09 20:30:36 ----A---- C:\Windows\system32\winsrv.dll
2012-10-09 20:30:36 ----A---- C:\Windows\system32\KernelBase.dll
2012-10-09 20:30:36 ----A---- C:\Windows\system32\kernel32.dll
2012-10-09 20:30:36 ----A---- C:\Windows\system32\conhost.exe
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2012-10-09 20:30:35 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2012-10-09 20:30:22 ----A---- C:\Windows\system32\cryptsvc.dll
2012-10-09 20:30:22 ----A---- C:\Windows\system32\cryptnet.dll
2012-10-09 20:30:22 ----A---- C:\Windows\system32\crypt32.dll
2012-10-09 20:30:15 ----A---- C:\Windows\system32\drivers\ntfs.sys
2012-10-09 20:30:14 ----A---- C:\Windows\system32\kerberos.dll
2012-10-09 20:30:11 ----A---- C:\Windows\system32\ntoskrnl.exe
2012-10-09 20:30:10 ----A---- C:\Windows\system32\ntkrnlpa.exe
======List of files/folders modified in the last 1 month======
2012-11-06 10:25:35 ----D---- C:\ProgramData\NVIDIA
2012-11-06 10:24:51 ----D---- C:\Windows\Temp
2012-11-06 10:24:11 ----D---- C:\Windows\Prefetch
2012-11-06 10:23:02 ----D---- C:\Windows\System32
2012-11-06 10:23:02 ----D---- C:\Windows\inf
2012-11-06 10:23:02 ----A---- C:\Windows\system32\PerfStringBackup.INI
2012-11-06 10:19:45 ----D---- C:\Windows\system32\config
2012-11-06 10:12:34 ----SHD---- C:\Windows\Installer
2012-11-06 10:11:37 ----D---- C:\Windows\system32\drivers
2012-11-06 10:11:35 ----HD---- C:\ProgramData
2012-11-06 10:02:20 ----RD---- C:\Program Files
2012-11-06 10:00:47 ----D---- C:\Windows
2012-11-05 12:17:23 ----D---- C:\Windows\system32\Tasks
2012-11-05 12:17:22 ----D---- C:\Windows\Tasks
2012-11-03 12:54:28 ----D---- C:\Windows\system32\DriverStore
2012-11-03 12:54:28 ----D---- C:\Windows\system32\catroot
2012-11-03 12:38:40 ----D---- C:\Users\Ondrash\AppData\Roaming\vlc
2012-11-01 13:11:53 ----SHD---- C:\System Volume Information
2012-10-31 23:02:34 ----D---- C:\Program Files\Common Files\microsoft shared
2012-10-31 20:49:11 ----D---- C:\Program Files\Google
2012-10-31 20:21:59 ----D---- C:\Program Files\Common Files
2012-10-31 17:21:28 ----D---- C:\Windows\system32\catroot2
2012-10-31 17:07:17 ----D---- C:\Windows\winsxs
2012-10-30 09:15:59 ----D---- C:\Windows\Downloaded Program Files
2012-10-30 09:12:25 ----RSD---- C:\Windows\assembly
2012-10-30 09:12:25 ----D---- C:\Windows\Microsoft.NET
2012-10-30 09:10:56 ----RSD---- C:\Windows\Fonts
2012-10-30 00:44:57 ----D---- C:\Users\Ondrash\AppData\Roaming\uTorrent
2012-10-10 02:43:41 ----D---- C:\Windows\rescache
2012-10-10 02:17:08 ----D---- C:\Windows\system32\cs-CZ
2012-10-10 02:01:06 ----A---- C:\Windows\system32\MRT.exe
2012-10-09 20:18:36 ----D---- C:\Windows\system32\FxsTmp
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 AtiPcie;AMD PCI Express (3GIO) Filter; C:\Windows\system32\DRIVERS\AtiPcie.sys [2009-08-23 14392]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R1 AsIO;AsIO; C:\Windows\system32\drivers\AsIO.sys [2009-08-04 11296]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 388096]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2011-12-27 239168]
R1 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2012-03-14 169080]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2012-03-14 120152]
R2 epfwwfpr;epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys [2012-03-14 103112]
R2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
R3 asmthub3;ASMedia USB3 Hub Service; C:\Windows\system32\DRIVERS\asmthub3.sys [2011-06-02 101352]
R3 asmtxhci;ASMEDIA XHCI Service; C:\Windows\system32\DRIVERS\asmtxhci.sys [2011-06-02 317416]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2011-06-28 3525352]
R3 MarvinBus;Pinnacle Marvin Bus; C:\Windows\system32\DRIVERS\MarvinBus.sys [2005-09-23 171520]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\Windows\system32\DRIVERS\ASACPI.sys [2009-07-16 13216]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda32v.sys [2011-03-03 139368]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt86win7.sys [2011-06-10 394856]
S1 A2DDA;A2 Direct Disk Access Support Driver; \??\C:\Program Files\Emsisoft Anti-Malware\a2ddax86.sys []
S1 SBRE;SBRE; \??\C:\Windows\system32\drivers\SBREdrv.sys []
S3 aic78xx;aic78xx; C:\Windows\system32\drivers\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-20 62464]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 133632]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 5632]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 28032]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 52224]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\drivers\viac7.sys [2009-07-14 52736]
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 175360]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 17920]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2012-03-07 913144]
R2 NVSvc;NVIDIA Driver Helper Service; C:\Windows\system32\nvvsvc.exe [2011-03-24 608872]
R2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2012-07-13 160944]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-03-23 378472]
R3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-03-12 271920]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2012-10-31 116648]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2012-10-30 1045256]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2012-10-31 116648]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2012-10-30 115168]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-01-15 774144]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2011-12-28 1343400]
-----------------EOF-----------------
Re: v9.com hack
pouzi http://forum.viry.cz/viewtopic.php?f=24&t=120452 volba prohledat
FRST |ADWCleaner |MBAM |CCleaner |AVPTool
V prípade spokojnosti je možné podporiť fórum https://platba.viry.cz/payment/
V prípade spokojnosti je možné podporiť fórum https://platba.viry.cz/payment/
Re: v9.com hack
¤¤¤ Škodlivé procesy: : 0 ¤¤¤
¤¤¤ ¤¤¤ Záznamy Registrů: : 3 ¤¤¤
[HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> NALEZENO
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> NALEZENO
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> NALEZENO
¤¤¤ Zvláštní soubory / Složky: ¤¤¤
¤¤¤ Ovladač : [NAHRÁNO] ¤¤¤
¤¤¤ Soubor HOSTS: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts
127.0.0.1 localhost
::1 localhost
¤¤¤ Kontrola MBR: ¤¤¤
+++++ PhysicalDrive0: WDC WD2500AVJS-63B6A0 ATA Device +++++
--- User ---
[MBR] dc7d8469e23fd5910a083ea40471671b
[BSP] 70dd35a313b0f57e6958034fde2a41cc : Windows 7 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 120100 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 245966848 | Size: 118373 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Dokončeno : << RKreport[2]_S_11062012_02d1653.txt >>
¤¤¤ ¤¤¤ Záznamy Registrů: : 3 ¤¤¤
[HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> NALEZENO
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> NALEZENO
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> NALEZENO
¤¤¤ Zvláštní soubory / Složky: ¤¤¤
¤¤¤ Ovladač : [NAHRÁNO] ¤¤¤
¤¤¤ Soubor HOSTS: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts
127.0.0.1 localhost
::1 localhost
¤¤¤ Kontrola MBR: ¤¤¤
+++++ PhysicalDrive0: WDC WD2500AVJS-63B6A0 ATA Device +++++
--- User ---
[MBR] dc7d8469e23fd5910a083ea40471671b
[BSP] 70dd35a313b0f57e6958034fde2a41cc : Windows 7 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 120100 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 245966848 | Size: 118373 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Dokončeno : << RKreport[2]_S_11062012_02d1653.txt >>
Re: v9.com hack
pouzi volbu zmazat
+
prescanuj PC s MBAM - uplna kontrola
+
prescanuj PC s MBAM - uplna kontrola
FRST |ADWCleaner |MBAM |CCleaner |AVPTool
V prípade spokojnosti je možné podporiť fórum https://platba.viry.cz/payment/
V prípade spokojnosti je možné podporiť fórum https://platba.viry.cz/payment/
Přispějete na provoz fóra?