Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz

win32:malware-gen

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Odpovědět
Zpráva
Autor
kaspy
Návštěvník
Návštěvník
Příspěvky: 8
Registrován: 11 bře 2010 11:47

win32:malware-gen

#1 Příspěvek od kaspy »

Zdravim
avastom najdeny win32:malware-gen
avast ho dal do truhly no clovek nikdy nevie...

Dakujem

Logfile of random's system information tool 1.06 (written by random/random)
Run by Marco at 2010-03-11 11:44:29
Microsoft Windows 7 Ultimate
System drive C: has 25 GB (63%) free of 40 GB
Total RAM: 1024 MB (32% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:44:44, on 11. 3. 2010
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe
C:\Windows\FixCamera.exe
C:\Windows\tsnpstd3.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\ICQ7.0\ICQ.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Windows\system32\taskhost.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Secunia\PSI\psi.exe
C:\Program Files\Opera\opera.exe
C:\totalcmd\TOTALCMD.EXE
C:\Users\Marco\Desktop\RSIT.exe
C:\Program Files\trend micro\Marco.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: flashget2 urlcatch - {1F364306-AA45-47B5-9F9D-39A8B94E7EF1} - C:\Program Files\FlashGet Network\FlashGet universal\ComDlls\bhoCATCH.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GR469A~1.DLL
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\PROGRA~1\PCTRAN~1\webie.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [Device Detector] DevDetect.exe -autorun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [FixCamera] C:\Windows\FixCamera.exe
O4 - HKLM\..\Run: [tsnpstd3] C:\Windows\tsnpstd3.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ7.0\ICQ.exe" silent loginmode=4
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: Picture Motion Browser Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O8 - Extra context menu item: &Download All by FlashGet - C:\Program Files\FlashGet Network\FlashGet universal\ComDlls\Bhoall.htm
O8 - Extra context menu item: &Download by FlashGet - C:\Program Files\FlashGet Network\FlashGet universal\ComDlls\Bholink.htm
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Prevést cíl vazby do Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Prevést cíl vazby do existujícího PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Prevést do Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Pridat do stávajícího PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: WebTran - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\PROGRA~1\PCTRAN~1\webie.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\PROGRA~1\PCTRAN~1\webie.dll
O9 - Extra 'Tools' menuitem: &Nastaviť prekladač - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\PROGRA~1\PCTRAN~1\webie.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\PROGRA~1\PCTRAN~1\webie.dll
O9 - Extra 'Tools' menuitem: Preložiť &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\PROGRA~1\PCTRAN~1\webie.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\PROGRA~1\PCTRAN~1\webie.dll
O9 - Extra 'Tools' menuitem: Preložiť &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\PROGRA~1\PCTRAN~1\webie.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GRA32A~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe

--
End of file - 9228 bytes

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-12-21 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1F364306-AA45-47B5-9F9D-39A8B94E7EF1}]
FG2CatchUrl - C:\Program Files\FlashGet Network\FlashGet universal\ComDlls\bhoCATCH.dll [2008-08-19 104016]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office12\GR469A~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
Adobe PDF Conversion Toolbar Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2009-12-21 349640]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-02-26 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F4971EE7-DAA0-4053-9964-665D8EE6A077}]
SmartSelect Class - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2009-12-21 349640]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{855F3B16-6D32-4FE6-8A56-BBB695989046} - ICQToolBar - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll [2010-01-03 1019128]
{BFC32E1D-EE75-4A48-BC60-104E11EE2431} - WebTranslator - C:\PROGRA~1\PCTRAN~1\webie.dll [2004-05-13 319488]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2009-12-21 349640]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"avast5"=C:\Program Files\Alwil Software\Avast5\avastUI.exe [2010-03-09 2769336]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [2009-12-08 8120864]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"=C:\Program Files\Google\Gmail Notifier\gnotify.exe [2005-07-15 479232]
"Device Detector"=DevDetect.exe -autorun []
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2010-02-15 417792]
"FixCamera"=C:\Windows\FixCamera.exe [2007-02-10 20480]
"tsnpstd3"=C:\Windows\tsnpstd3.exe [2007-02-07 262144]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-01-11 246504]
"Adobe Acrobat Speed Launcher"=C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe [2009-12-22 38840]
""= []
"Acrobat Assistant 8.0"=C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe [2009-12-21 640440]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-12-11 948672]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-07-14 1173504]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2009-10-09 25623336]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480]
"ICQ"=C:\Program Files\ICQ7.0\ICQ.exe [2010-02-10 133368]

C:\Users\Marco\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Picture Motion Browser Media Check Tool.lnk - C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office12\GR469A~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppMgmt]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Base]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Boot Bus Extender]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Boot file system]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CryptSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\DcomLaunch]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\EFS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\EventLog]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\File system]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Filter]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HelpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Netlogon]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PCI Configuration]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PlugPlay]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PNP Filter]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Power]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Primary disk]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\RpcEptMapper]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\RpcSs]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SCSI Class]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sermouse.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\System Bus Extender]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vga.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vgasave.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vmms]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinMgmt]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{36FC9E60-C465-11CF-8056-444553540000}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E965-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E969-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E977-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97B-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E980-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AppInfo]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AppMgmt]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Base]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\BFE]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Boot Bus Extender]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Boot file system]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\bowser]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Browser]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\CryptSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\DcomLaunch]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\dfsc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Dhcp]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\DnsCache]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Dot3Svc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Eaphost]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\EFS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\EventLog]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\File system]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Filter]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\HelpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\IKEEXT]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\ipnat.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\KeyIso]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\LanmanServer]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\LanmanWorkstation]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\LmHosts]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Messenger]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MPSDrv]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MPSSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mrxsmb]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mrxsmb10]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mrxsmb20]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NativeWifiP]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NDIS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NDIS Wrapper]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\ndiscap]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Ndisuio]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetBIOS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetBIOSGroup]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetBT]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetDDEGroup]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Netlogon]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetMan]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\netprofm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Network]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetworkProvider]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NlaSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Nsi]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nsiproxy.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NTDS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PCI Configuration]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PlugPlay]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PNP Filter]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PNP_TDI]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PolicyAgent]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Power]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Primary disk]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\ProfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\rdbss]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\rdpencdd.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\rdsessmgr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\RpcEptMapper]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\RpcSs]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sacsvr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SCardSvr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SCSI Class]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sermouse.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SharedAccess]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Streams Drivers]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SWPRV]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\System Bus Extender]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TabletInputService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TBS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Tcpip]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TDI]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TrustedInstaller]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\VaultSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\VDS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vga.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vgasave.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vmms]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\volmgr.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\volmgrx.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WinMgmt]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wlansvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{36FC9E60-C465-11CF-8056-444553540000}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E965-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E967-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E969-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E96A-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E96B-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E96F-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E972-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E973-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E974-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E975-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E977-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E97B-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E97D-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E980-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{50DD5230-BA8A-11D1-BF5D-0000F805F530}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\FlashGet Network\FlashGet universal\FlashGet.exe"="C:\Program Files\FlashGet Network\FlashGet universal\FlashGet.exe:*:Enabled:Flashget2"
"C:\Program Files\FlashGet Network\FlashGet universal\LiveUpdate.exe"="C:\Program Files\FlashGet Network\FlashGet universal\LiveUpdate.exe:*:Enabled:FGLiveUpdate"
"C:\Program Files\FlashGet Network\FlashGet universal\LiveUpdateEx.exe"="C:\Program Files\FlashGet Network\FlashGet universal\LiveUpdateEx.exe:*:Enabled:FGLiveUpdateEx"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-03-11 11:42:53 ----D---- C:\Program Files\trend micro
2010-03-11 11:42:50 ----D---- C:\rsit
2010-03-10 16:15:45 ----D---- C:\Windows\Sun
2010-03-04 16:44:04 ----D---- C:\Program Files\Winamp Detect
2010-02-28 16:58:38 ----A---- C:\Windows\cdplayer.ini
2010-02-28 16:58:05 ----D---- C:\Program Files\Audiograbber
2010-02-28 16:01:57 ----RA---- C:\Windows\system32\AdobePDFUI.dll
2010-02-28 16:01:57 ----RA---- C:\Windows\system32\AdobePDF.dll
2010-02-26 12:03:01 ----D---- C:\Users\Marco\AppData\Roaming\BITS
2010-02-26 11:53:29 ----D---- C:\Program Files\Secunia
2010-02-26 11:38:41 ----D---- C:\ProgramData\FLEXnet
2010-02-26 11:37:37 ----D---- C:\Program Files\Common Files\Macrovision Shared
2010-02-26 11:33:11 ----D---- C:\ProgramData\Adobe
2010-02-26 11:33:11 ----D---- C:\Program Files\Common Files\Adobe
2010-02-26 11:33:10 ----D---- C:\Program Files\Adobe
2010-02-26 10:10:11 ----D---- C:\ProgramData\Sun
2010-02-26 10:10:10 ----D---- C:\Program Files\Common Files\Java
2010-02-26 10:07:12 ----A---- C:\Windows\system32\javaws.exe
2010-02-26 10:07:12 ----A---- C:\Windows\system32\javaw.exe
2010-02-26 10:07:12 ----A---- C:\Windows\system32\java.exe
2010-02-26 10:07:12 ----A---- C:\Windows\system32\deploytk.dll
2010-02-26 10:06:55 ----D---- C:\Program Files\Java
2010-02-26 10:04:20 ----D---- C:\Users\Marco\AppData\Roaming\ACD Systems
2010-02-25 16:07:14 ----D---- C:\Windows\system32\custom matrices
2010-02-25 16:07:10 ----D---- C:\Windows\system32\QuickTime
2010-02-25 16:07:10 ----D---- C:\Windows\system32\C2MP
2010-02-25 16:03:23 ----D---- C:\Users\Marco\AppData\Roaming\BSplayer Pro
2010-02-25 16:03:23 ----D---- C:\Users\Marco\AppData\Roaming\BSplayer
2010-02-25 16:03:22 ----D---- C:\Program Files\Webteh
2010-02-25 15:22:15 ----A---- C:\Windows\FixCamera.exe
2010-02-25 15:22:15 ----A---- C:\Windows\amcap.exe
2010-02-25 15:22:14 ----A---- C:\Windows\vsnpstd3.exe
2010-02-25 15:22:14 ----A---- C:\Windows\tsnpstd3.exe
2010-02-25 15:22:13 ----A---- C:\Windows\snpstd3.ini
2010-02-25 15:22:11 ----A---- C:\Windows\system32\vsnpstd3.dll
2010-02-25 15:22:11 ----A---- C:\Windows\system32\rsnpstd3.dll
2010-02-25 15:22:11 ----A---- C:\Windows\csnpstd3.dll
2010-02-25 15:22:10 ----D---- C:\Program Files\Common Files\snpstd3
2010-02-25 15:22:10 ----A---- C:\Windows\system32\csnpstd3.dll
2010-02-25 15:21:49 ----D---- C:\Users\Marco\AppData\Roaming\InstallShield
2010-02-25 15:06:58 ----A---- C:\Windows\wdict32.INI
2010-02-25 15:06:13 ----D---- C:\Program Files\Apple Software Update
2010-02-25 15:05:51 ----D---- C:\Program Files\Common Files\Apple
2010-02-25 15:05:34 ----D---- C:\Users\Marco\AppData\Roaming\Sony Corporation
2010-02-25 15:05:12 ----D---- C:\ProgramData\Apple Computer
2010-02-25 15:05:12 ----D---- C:\Program Files\QuickTime
2010-02-25 14:49:01 ----D---- C:\Drivers
2010-02-25 14:49:01 ----A---- C:\Windows\system32\SONYHCY.DLL
2010-02-25 14:47:49 ----D---- C:\Windows\system32\Iosubsys
2010-02-25 14:47:49 ----A---- C:\Windows\system32\PxInsI64.exe
2010-02-25 14:47:49 ----A---- C:\Windows\system32\PxCpyI64.exe
2010-02-25 14:45:11 ----D---- C:\Program Files\Sony
2010-02-25 13:50:14 ----D---- C:\Program Files\CCleaner
2010-02-25 13:47:11 ----D---- C:\ProgramData\ACD Systems
2010-02-25 13:47:09 ----D---- C:\Program Files\Common Files\ACD Systems
2010-02-25 13:47:09 ----D---- C:\Program Files\ACD Systems
2010-02-25 13:45:47 ----D---- C:\Windows\Downloaded Installations
2010-02-25 13:45:28 ----A---- C:\Windows\system32\BASSMOD.dll
2010-02-25 13:29:42 ----D---- C:\ProgramData\Apple
2010-02-25 13:28:33 ----D---- C:\Program Files\SuperDVD Player 5.0
2010-02-25 13:27:35 ----D---- C:\Program Files\WinRAR
2010-02-25 13:26:24 ----D---- C:\ProgramData\Spybot - Search & Destroy
2010-02-25 13:26:24 ----D---- C:\Program Files\Spybot - Search & Destroy
2010-02-25 13:23:14 ----D---- C:\profiles
2010-02-25 13:22:53 ----D---- C:\Program Files\FlashGet Network
2010-02-25 13:04:46 ----A---- C:\Windows\wtran32.INI
2010-02-25 12:49:01 ----D---- C:\Users\Marco\AppData\Roaming\GHISLER
2010-02-25 12:49:01 ----D---- C:\totalcmd
2010-02-25 12:05:34 ----D---- C:\Users\Marco\AppData\Roaming\TrueCrypt
2010-02-25 12:05:25 ----D---- C:\ProgramData\TrueCrypt
2010-02-25 12:04:59 ----D---- C:\Program Files\TrueCrypt
2010-02-25 11:52:05 ----A---- C:\Windows\system32\XAudio2_5.dll
2010-02-25 11:52:05 ----A---- C:\Windows\system32\xactengine3_5.dll
2010-02-25 11:52:04 ----A---- C:\Windows\system32\D3DCompiler_42.dll
2010-02-25 11:52:02 ----A---- C:\Windows\system32\d3dcsx_42.dll
2010-02-25 11:52:01 ----A---- C:\Windows\system32\D3DX9_42.dll
2010-02-25 11:52:01 ----A---- C:\Windows\system32\D3DX9_41.dll
2010-02-25 11:52:01 ----A---- C:\Windows\system32\d3dx11_42.dll
2010-02-25 11:52:01 ----A---- C:\Windows\system32\d3dx10_42.dll
2010-02-25 11:52:01 ----A---- C:\Windows\system32\d3dx10_41.dll
2010-02-25 11:52:01 ----A---- C:\Windows\system32\D3DCompiler_41.dll
2010-02-25 11:52:00 ----A---- C:\Windows\system32\XAudio2_4.dll
2010-02-25 11:52:00 ----A---- C:\Windows\system32\XAPOFX1_3.dll
2010-02-25 11:52:00 ----A---- C:\Windows\system32\xactengine3_4.dll
2010-02-25 11:52:00 ----A---- C:\Windows\system32\X3DAudio1_6.dll
2010-02-25 11:52:00 ----A---- C:\Windows\system32\d3dx10_40.dll
2010-02-25 11:52:00 ----A---- C:\Windows\system32\D3DCompiler_40.dll
2010-02-25 11:51:59 ----A---- C:\Windows\system32\XAudio2_3.dll
2010-02-25 11:51:59 ----A---- C:\Windows\system32\XAudio2_2.dll
2010-02-25 11:51:59 ----A---- C:\Windows\system32\XAPOFX1_2.dll
2010-02-25 11:51:59 ----A---- C:\Windows\system32\XAPOFX1_1.dll
2010-02-25 11:51:59 ----A---- C:\Windows\system32\xactengine3_3.dll
2010-02-25 11:51:59 ----A---- C:\Windows\system32\xactengine3_2.dll
2010-02-25 11:51:59 ----A---- C:\Windows\system32\X3DAudio1_5.dll
2010-02-25 11:51:59 ----A---- C:\Windows\system32\D3DX9_40.dll
2010-02-25 11:51:58 ----A---- C:\Windows\system32\XAudio2_1.dll
2010-02-25 11:51:58 ----A---- C:\Windows\system32\XAPOFX1_0.dll
2010-02-25 11:51:58 ----A---- C:\Windows\system32\D3DX9_39.dll
2010-02-25 11:51:58 ----A---- C:\Windows\system32\d3dx10_39.dll
2010-02-25 11:51:58 ----A---- C:\Windows\system32\D3DCompiler_39.dll
2010-02-25 11:51:57 ----A---- C:\Windows\system32\xactengine3_1.dll
2010-02-25 11:51:57 ----A---- C:\Windows\system32\X3DAudio1_4.dll
2010-02-25 11:51:57 ----A---- C:\Windows\system32\D3DCompiler_38.dll
2010-02-25 11:51:56 ----A---- C:\Windows\system32\XAudio2_0.dll
2010-02-25 11:51:56 ----A---- C:\Windows\system32\xactengine3_0.dll
2010-02-25 11:51:56 ----A---- C:\Windows\system32\X3DAudio1_3.dll
2010-02-25 11:51:56 ----A---- C:\Windows\system32\D3DX9_38.dll
2010-02-25 11:51:56 ----A---- C:\Windows\system32\d3dx10_38.dll
2010-02-25 11:51:56 ----A---- C:\Windows\system32\d3dx10_37.dll
2010-02-25 11:51:56 ----A---- C:\Windows\system32\D3DCompiler_37.dll
2010-02-25 11:51:55 ----A---- C:\Windows\system32\xactengine2_10.dll
2010-02-25 11:51:55 ----A---- C:\Windows\system32\D3DX9_37.dll
2010-02-25 11:51:55 ----A---- C:\Windows\system32\d3dx10_36.dll
2010-02-25 11:51:55 ----A---- C:\Windows\system32\D3DCompiler_36.dll
2010-02-25 11:51:54 ----A---- C:\Windows\system32\xactengine2_9.dll
2010-02-25 11:51:54 ----A---- C:\Windows\system32\d3dx9_36.dll
2010-02-25 11:51:54 ----A---- C:\Windows\system32\d3dx9_35.dll
2010-02-25 11:51:54 ----A---- C:\Windows\system32\d3dx10_35.dll
2010-02-25 11:51:54 ----A---- C:\Windows\system32\D3DCompiler_35.dll
2010-02-25 11:51:53 ----A---- C:\Windows\system32\xinput1_3.dll
2010-02-25 11:51:53 ----A---- C:\Windows\system32\xactengine2_8.dll
2010-02-25 11:51:53 ----A---- C:\Windows\system32\xactengine2_7.dll
2010-02-25 11:51:53 ----A---- C:\Windows\system32\X3DAudio1_2.dll
2010-02-25 11:51:53 ----A---- C:\Windows\system32\d3dx9_34.dll
2010-02-25 11:51:53 ----A---- C:\Windows\system32\d3dx10_34.dll
2010-02-25 11:51:53 ----A---- C:\Windows\system32\D3DCompiler_34.dll
2010-02-25 11:51:52 ----A---- C:\Windows\system32\xactengine2_6.dll
2010-02-25 11:51:52 ----A---- C:\Windows\system32\xactengine2_5.dll
2010-02-25 11:51:52 ----A---- C:\Windows\system32\d3dx9_33.dll
2010-02-25 11:51:52 ----A---- C:\Windows\system32\d3dx10_33.dll
2010-02-25 11:51:52 ----A---- C:\Windows\system32\d3dx10.dll
2010-02-25 11:51:52 ----A---- C:\Windows\system32\D3DCompiler_33.dll
2010-02-25 11:51:51 ----A---- C:\Windows\system32\xinput1_2.dll
2010-02-25 11:51:51 ----A---- C:\Windows\system32\xactengine2_4.dll
2010-02-25 11:51:51 ----A---- C:\Windows\system32\xactengine2_3.dll
2010-02-25 11:51:51 ----A---- C:\Windows\system32\x3daudio1_1.dll
2010-02-25 11:51:51 ----A---- C:\Windows\system32\d3dx9_32.dll
2010-02-25 11:51:51 ----A---- C:\Windows\system32\d3dx9_31.dll
2010-02-25 11:51:50 ----A---- C:\Windows\system32\xinput1_1.dll
2010-02-25 11:51:50 ----A---- C:\Windows\system32\xactengine2_2.dll
2010-02-25 11:51:50 ----A---- C:\Windows\system32\xactengine2_1.dll
2010-02-25 11:51:47 ----A---- C:\Windows\system32\d3dx9_30.dll
2010-02-25 11:51:46 ----A---- C:\Windows\system32\xactengine2_0.dll
2010-02-25 11:51:46 ----A---- C:\Windows\system32\x3daudio1_0.dll
2010-02-25 11:51:46 ----A---- C:\Windows\system32\d3dx9_29.dll
2010-02-25 11:51:46 ----A---- C:\Windows\system32\d3dx9_28.dll
2010-02-25 11:51:46 ----A---- C:\Windows\system32\d3dx9_27.dll
2010-02-25 11:51:45 ----A---- C:\Windows\system32\d3dx9_26.dll
2010-02-25 11:51:45 ----A---- C:\Windows\system32\d3dx9_25.dll
2010-02-25 11:51:44 ----A---- C:\Windows\system32\d3dx9_24.dll
2010-02-25 11:47:46 ----D---- C:\Program Files\PC Translator
2010-02-25 11:37:28 ----D---- C:\Users\Marco\AppData\Roaming\skypePM
2010-02-25 11:34:58 ----D---- C:\Users\Marco\AppData\Roaming\Skype
2010-02-25 11:34:49 ----D---- C:\Program Files\Common Files\Skype
2010-02-25 11:34:45 ----RD---- C:\Program Files\Skype
2010-02-25 11:34:43 ----D---- C:\ProgramData\Skype
2010-02-25 11:33:10 ----N---- C:\Windows\system32\pxinsa64.exe
2010-02-25 11:33:10 ----N---- C:\Windows\system32\pxhpinst.exe
2010-02-25 11:33:10 ----N---- C:\Windows\system32\pxcpya64.exe
2010-02-25 11:33:10 ----N---- C:\Windows\system32\pxafs.dll
2010-02-25 11:33:09 ----N---- C:\Windows\system32\vxblock.dll
2010-02-25 11:33:09 ----N---- C:\Windows\system32\pxwave.dll
2010-02-25 11:33:09 ----N---- C:\Windows\system32\pxsfs.dll
2010-02-25 11:33:09 ----N---- C:\Windows\system32\pxmas.dll
2010-02-25 11:33:09 ----N---- C:\Windows\system32\pxdrv.dll
2010-02-25 11:33:09 ----N---- C:\Windows\system32\px.dll
2010-02-25 11:33:08 ----D---- C:\Users\Marco\AppData\Roaming\Winamp
2010-02-25 11:33:08 ----D---- C:\Program Files\Winamp
2010-02-25 11:26:10 ----D---- C:\Program Files\Mozilla Firefox
2010-02-25 11:13:16 ----D---- C:\Users\Marco\AppData\Roaming\Lavasoft
2010-02-25 11:13:05 ----D---- C:\Program Files\Lavasoft
2010-02-25 10:53:01 ----A---- C:\Windows\system32\msonpmon.dll
2010-02-25 10:50:08 ----D---- C:\Program Files\Microsoft Works
2010-02-25 10:49:35 ----D---- C:\Program Files\Microsoft Visual Studio
2010-02-25 10:49:35 ----D---- C:\Program Files\Common Files\DESIGNER
2010-02-25 10:48:49 ----D---- C:\Windows\PCHEALTH
2010-02-25 10:48:48 ----D---- C:\Program Files\Microsoft.NET
2010-02-25 10:46:42 ----D---- C:\Program Files\Microsoft Visual Studio 8
2010-02-25 10:45:47 ----D---- C:\ProgramData\Microsoft Help
2010-02-25 10:45:47 ----D---- C:\Program Files\Microsoft Office
2010-02-25 10:44:41 ----RHD---- C:\MSOCache
2010-02-25 10:43:36 ----D---- C:\Windows\system32\ShellExt
2010-02-25 10:42:05 ----D---- C:\Program Files\LG Electronics
2010-02-25 10:33:33 ----D---- C:\Windows\system32\RTCOM
2010-02-25 10:33:11 ----A---- C:\Windows\system32\WavesLib.dll
2010-02-25 10:33:11 ----A---- C:\Windows\system32\SRSWOW.dll
2010-02-25 10:33:11 ----A---- C:\Windows\system32\SRSTSXT.dll
2010-02-25 10:33:11 ----A---- C:\Windows\system32\SRSTSHD.dll
2010-02-25 10:33:11 ----A---- C:\Windows\system32\SRSHP360.dll
2010-02-25 10:33:10 ----A---- C:\Windows\system32\RtkPgExt.dll
2010-02-25 10:33:10 ----A---- C:\Windows\system32\RtkCoInst.dll
2010-02-25 10:33:10 ----A---- C:\Windows\system32\RtkApoApi.dll
2010-02-25 10:33:10 ----A---- C:\Windows\system32\RtkAPO.dll
2010-02-25 10:33:09 ----A---- C:\Windows\system32\RTEEP32A.dll
2010-02-25 10:33:09 ----A---- C:\Windows\system32\RTEEL32A.dll
2010-02-25 10:33:09 ----A---- C:\Windows\system32\RTEEG32A.dll
2010-02-25 10:33:09 ----A---- C:\Windows\system32\RTEED32A.dll
2010-02-25 10:33:09 ----A---- C:\Windows\system32\RP3DHT32.dll
2010-02-25 10:33:09 ----A---- C:\Windows\system32\RP3DAA32.dll
2010-02-25 10:33:09 ----A---- C:\Windows\system32\MaxxAudioEQ.dll
2010-02-25 10:33:09 ----A---- C:\Windows\system32\MaxxAudioAPO20.dll
2010-02-25 10:33:09 ----A---- C:\Windows\system32\MaxxAudioAPO.dll
2010-02-25 10:33:08 ----D---- C:\Program Files\Realtek
2010-02-25 10:33:08 ----A---- C:\Windows\system32\FMAPO.dll
2010-02-25 10:33:08 ----A---- C:\Windows\system32\AERTARen.dll
2010-02-25 10:33:08 ----A---- C:\Windows\system32\AERTACap.dll
2010-02-25 10:33:05 ----HD---- C:\Program Files\Temp
2010-02-25 10:33:05 ----A---- C:\Windows\RtlExUpd.dll
2010-02-25 10:25:12 ----D---- C:\Users\Marco\AppData\Roaming\Macromedia
2010-02-25 10:25:12 ----D---- C:\Users\Marco\AppData\Roaming\Adobe
2010-02-25 10:25:05 ----D---- C:\Windows\system32\Macromed
2010-02-25 10:22:42 ----D---- C:\Users\Marco\AppData\Roaming\GetRightToGo
2010-02-25 10:19:24 ----D---- C:\Program Files\LizardTech
2010-02-25 10:04:14 ----D---- C:\Program Files\Google
2010-02-25 10:03:34 ----A---- C:\Windows\system32\aswBoot.exe
2010-02-25 10:03:32 ----D---- C:\ProgramData\Alwil Software
2010-02-25 10:03:32 ----D---- C:\Program Files\Alwil Software
2010-02-25 09:58:42 ----A---- C:\Windows\IsUninst.exe
2010-02-25 09:57:40 ----D---- C:\Program Files\ATI Technologies
2010-02-25 09:57:22 ----D---- C:\Program Files\Common Files\InstallShield
2010-02-25 09:50:19 ----N---- C:\Windows\system32\MpSigStub.exe
2010-02-25 09:43:25 ----D---- C:\Program Files\ICQ6Toolbar
2010-02-25 09:43:23 ----HD---- C:\Program Files\InstallShield Installation Information
2010-02-25 09:43:23 ----D---- C:\Users\Marco\AppData\Roaming\Mozilla
2010-02-25 09:43:23 ----D---- C:\ProgramData\ICQ
2010-02-25 09:43:19 ----D---- C:\Users\Marco\AppData\Roaming\ICQ
2010-02-25 09:43:12 ----D---- C:\Program Files\ICQ7.0
2010-02-25 09:42:34 ----D---- C:\Users\Marco\AppData\Roaming\Opera
2010-02-25 09:42:29 ----D---- C:\Program Files\Opera
2010-02-25 09:40:29 ----SHD---- C:\Windows\Installer
2010-02-25 09:38:15 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-02-25 09:29:18 ----D---- C:\Users\Marco\AppData\Roaming\Identities
2010-02-25 09:29:04 ----SD---- C:\Users\Marco\AppData\Roaming\Microsoft
2010-02-25 09:29:04 ----D---- C:\Users\Marco\AppData\Roaming\Media Center Programs
2010-02-25 09:28:59 ----SHD---- C:\Recovery
2010-02-25 09:22:18 ----D---- C:\Windows\SoftwareDistribution
2010-02-25 09:19:29 ----D---- C:\Windows\Prefetch
2010-02-25 09:19:22 ----SHD---- C:\System Volume Information
2010-02-25 09:18:39 ----D---- C:\Windows\Panther
2010-02-25 09:18:27 ----RASH---- C:\BOOTSECT.BAK
2010-02-25 09:18:25 ----SHD---- C:\Boot

======List of files/folders modified in the last 1 months======

2010-03-11 11:44:30 ----D---- C:\Windows\Temp
2010-03-11 11:42:53 ----RD---- C:\Program Files
2010-03-11 07:56:31 ----D---- C:\Windows\System32
2010-03-11 07:56:31 ----D---- C:\Windows\inf
2010-03-10 18:05:38 ----D---- C:\Windows\system32\catroot2
2010-03-10 17:56:27 ----D---- C:\Windows\system32\config
2010-03-10 16:15:45 ----D---- C:\Windows
2010-03-09 13:01:48 ----D---- C:\Windows\system32\wdi
2010-03-08 17:29:23 ----D---- C:\Windows\rescache
2010-03-08 17:27:43 ----D---- C:\Windows\Logs
2010-03-01 17:35:55 ----HD---- C:\ProgramData
2010-02-28 16:02:30 ----D---- C:\Windows\system32\DriverStore
2010-02-26 13:41:37 ----SD---- C:\ProgramData\Microsoft
2010-02-26 13:41:37 ----D---- C:\Windows\system32\drivers
2010-02-26 13:36:26 ----D---- C:\Windows\winsxs
2010-02-26 12:20:12 ----D---- C:\Program Files\Internet Explorer
2010-02-26 11:59:13 ----D---- C:\Windows\system32\Tasks
2010-02-26 11:37:37 ----D---- C:\Program Files\Common Files
2010-02-26 11:33:45 ----RSD---- C:\Windows\Fonts
2010-02-25 15:24:53 ----D---- C:\Windows\system32\catroot
2010-02-25 15:22:15 ----A---- C:\Windows\win.ini
2010-02-25 15:22:14 ----D---- C:\Windows\twain_32
2010-02-25 13:50:52 ----D---- C:\Windows\debug
2010-02-25 13:13:16 ----HD---- C:\Windows\system32\GroupPolicy
2010-02-25 12:40:49 ----D---- C:\Windows\Microsoft.NET
2010-02-25 12:40:46 ----RSD---- C:\Windows\assembly
2010-02-25 12:15:30 ----SHD---- C:\$Recycle.Bin
2010-02-25 12:15:20 ----RD---- C:\Users
2010-02-25 11:44:34 ----D---- C:\Windows\Downloaded Program Files
2010-02-25 11:40:23 ----D---- C:\Windows\LiveKernelReports
2010-02-25 10:50:04 ----D---- C:\Program Files\Common Files\microsoft shared
2010-02-25 10:49:58 ----D---- C:\Program Files\MSBuild
2010-02-25 10:49:31 ----D---- C:\Windows\ShellNew
2010-02-25 10:46:11 ----D---- C:\Program Files\Common Files\System
2010-02-25 10:04:19 ----D---- C:\Windows\Tasks
2010-02-25 09:42:15 ----D---- C:\Windows\system32\CodeIntegrity
2010-02-25 09:42:03 ----D---- C:\Windows\system32\restore
2010-02-25 09:37:38 ----D---- C:\Windows\system32\wbem
2010-02-25 09:28:59 ----D---- C:\Windows\system32\Recovery
2010-02-25 09:24:45 ----D---- C:\Windows\system32\sysprep
2010-02-25 09:20:07 ----D---- C:\Windows\CSC
Nahoru
kaspy
Návštěvník
Návštěvník
Příspěvky: 8
Registrován: 11 bře 2010 11:47

Re: win32:malware-gen

#2 Příspěvek od kaspy »

este raz log z rsit, po nastaveni kompatibility pre win 7
rozdeleny napoli...sprava ma vela znakov

Logfile of random's system information tool 1.06 (written by random/random)
Run by Marco at 2010-03-11 12:11:53
Microsoft Windows 7 Ultimate Service Pack 3
System drive C: has 25 GB (63%) free of 40 GB
Total RAM: 1024 MB (30% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:15:41, on 11. 3. 2010
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe
C:\Windows\FixCamera.exe
C:\Windows\tsnpstd3.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\ICQ7.0\ICQ.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Windows\system32\taskhost.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Secunia\PSI\psi.exe
C:\Program Files\Opera\opera.exe
C:\totalcmd\TOTALCMD.EXE
C:\Users\Marco\Desktop\RSIT.exe
C:\Program Files\trend micro\Marco.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: flashget2 urlcatch - {1F364306-AA45-47B5-9F9D-39A8B94E7EF1} - C:\Program Files\FlashGet Network\FlashGet universal\ComDlls\bhoCATCH.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GR469A~1.DLL
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\PROGRA~1\PCTRAN~1\webie.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [Device Detector] DevDetect.exe -autorun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [FixCamera] C:\Windows\FixCamera.exe
O4 - HKLM\..\Run: [tsnpstd3] C:\Windows\tsnpstd3.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ7.0\ICQ.exe" silent loginmode=4
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: Picture Motion Browser Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O8 - Extra context menu item: &Download All by FlashGet - C:\Program Files\FlashGet Network\FlashGet universal\ComDlls\Bhoall.htm
O8 - Extra context menu item: &Download by FlashGet - C:\Program Files\FlashGet Network\FlashGet universal\ComDlls\Bholink.htm
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Prevést cíl vazby do Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Prevést cíl vazby do existujícího PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Prevést do Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Pridat do stávajícího PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: WebTran - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\PROGRA~1\PCTRAN~1\webie.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\PROGRA~1\PCTRAN~1\webie.dll
O9 - Extra 'Tools' menuitem: &Nastaviť prekladač - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\PROGRA~1\PCTRAN~1\webie.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\PROGRA~1\PCTRAN~1\webie.dll
O9 - Extra 'Tools' menuitem: Preložiť &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\PROGRA~1\PCTRAN~1\webie.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\PROGRA~1\PCTRAN~1\webie.dll
O9 - Extra 'Tools' menuitem: Preložiť &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\PROGRA~1\PCTRAN~1\webie.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GRA32A~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe

--
End of file - 9228 bytes

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-12-21 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1F364306-AA45-47B5-9F9D-39A8B94E7EF1}]
FG2CatchUrl - C:\Program Files\FlashGet Network\FlashGet universal\ComDlls\bhoCATCH.dll [2008-08-19 104016]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office12\GR469A~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
Adobe PDF Conversion Toolbar Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2009-12-21 349640]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-02-26 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F4971EE7-DAA0-4053-9964-665D8EE6A077}]
SmartSelect Class - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2009-12-21 349640]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{855F3B16-6D32-4FE6-8A56-BBB695989046} - ICQToolBar - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll [2010-01-03 1019128]
{BFC32E1D-EE75-4A48-BC60-104E11EE2431} - WebTranslator - C:\PROGRA~1\PCTRAN~1\webie.dll [2004-05-13 319488]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2009-12-21 349640]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"avast5"=C:\Program Files\Alwil Software\Avast5\avastUI.exe [2010-03-09 2769336]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [2009-12-08 8120864]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"=C:\Program Files\Google\Gmail Notifier\gnotify.exe [2005-07-15 479232]
"Device Detector"=DevDetect.exe -autorun []
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2010-02-15 417792]
"FixCamera"=C:\Windows\FixCamera.exe [2007-02-10 20480]
"tsnpstd3"=C:\Windows\tsnpstd3.exe [2007-02-07 262144]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-01-11 246504]
"Adobe Acrobat Speed Launcher"=C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe [2009-12-22 38840]
""= []
"Acrobat Assistant 8.0"=C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe [2009-12-21 640440]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-12-11 948672]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-07-14 1173504]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2009-10-09 25623336]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480]
"ICQ"=C:\Program Files\ICQ7.0\ICQ.exe [2010-02-10 133368]

C:\Users\Marco\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Picture Motion Browser Media Check Tool.lnk - C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office12\GR469A~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\EFS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Power]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\RpcEptMapper]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vmms]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AppInfo]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\BFE]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\bowser]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\dfsc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Dot3Svc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Eaphost]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\EFS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\IKEEXT]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\KeyIso]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MPSDrv]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MPSSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mrxsmb]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mrxsmb10]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mrxsmb20]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NativeWifiP]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\ndiscap]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\netprofm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NlaSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Nsi]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nsiproxy.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NTDS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PolicyAgent]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Power]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\ProfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\rdbss]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\rdpencdd.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\RpcEptMapper]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sacsvr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SCardSvr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SWPRV]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TabletInputService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TBS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TrustedInstaller]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\VaultSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\VDS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vmms]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\volmgr.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\volmgrx.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wlansvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{50DD5230-BA8A-11D1-BF5D-0000F805F530}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\FlashGet Network\FlashGet universal\FlashGet.exe"="C:\Program Files\FlashGet Network\FlashGet universal\FlashGet.exe:*:Enabled:Flashget2"
"C:\Program Files\FlashGet Network\FlashGet universal\LiveUpdate.exe"="C:\Program Files\FlashGet Network\FlashGet universal\LiveUpdate.exe:*:Enabled:FGLiveUpdate"
"C:\Program Files\FlashGet Network\FlashGet universal\LiveUpdateEx.exe"="C:\Program Files\FlashGet Network\FlashGet universal\LiveUpdateEx.exe:*:Enabled:FGLiveUpdateEx"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-03-11 11:42:53 ----D---- C:\Program Files\trend micro
2010-03-11 11:42:50 ----D---- C:\rsit
2010-03-10 16:15:45 ----D---- C:\Windows\Sun
2010-03-04 16:44:04 ----D---- C:\Program Files\Winamp Detect
2010-02-28 16:58:38 ----A---- C:\Windows\cdplayer.ini
2010-02-28 16:58:05 ----D---- C:\Program Files\Audiograbber
2010-02-28 16:01:57 ----RA---- C:\Windows\system32\AdobePDFUI.dll
2010-02-28 16:01:57 ----RA---- C:\Windows\system32\AdobePDF.dll
2010-02-26 12:03:01 ----D---- C:\Users\Marco\AppData\Roaming\BITS
2010-02-26 11:53:29 ----D---- C:\Program Files\Secunia
2010-02-26 11:38:41 ----D---- C:\ProgramData\FLEXnet
2010-02-26 11:37:37 ----D---- C:\Program Files\Common Files\Macrovision Shared
2010-02-26 11:33:11 ----D---- C:\ProgramData\Adobe
2010-02-26 11:33:11 ----D---- C:\Program Files\Common Files\Adobe
2010-02-26 11:33:10 ----D---- C:\Program Files\Adobe
2010-02-26 10:10:11 ----D---- C:\ProgramData\Sun
2010-02-26 10:10:10 ----D---- C:\Program Files\Common Files\Java
2010-02-26 10:07:12 ----A---- C:\Windows\system32\javaws.exe
2010-02-26 10:07:12 ----A---- C:\Windows\system32\javaw.exe
2010-02-26 10:07:12 ----A---- C:\Windows\system32\java.exe
2010-02-26 10:07:12 ----A---- C:\Windows\system32\deploytk.dll
2010-02-26 10:06:55 ----D---- C:\Program Files\Java
2010-02-26 10:04:20 ----D---- C:\Users\Marco\AppData\Roaming\ACD Systems
2010-02-25 16:07:14 ----D---- C:\Windows\system32\custom matrices
2010-02-25 16:07:10 ----D---- C:\Windows\system32\QuickTime
2010-02-25 16:07:10 ----D---- C:\Windows\system32\C2MP
2010-02-25 16:03:23 ----D---- C:\Users\Marco\AppData\Roaming\BSplayer Pro
2010-02-25 16:03:23 ----D---- C:\Users\Marco\AppData\Roaming\BSplayer
2010-02-25 16:03:22 ----D---- C:\Program Files\Webteh
2010-02-25 15:22:15 ----A---- C:\Windows\FixCamera.exe
2010-02-25 15:22:15 ----A---- C:\Windows\amcap.exe
2010-02-25 15:22:14 ----A---- C:\Windows\vsnpstd3.exe
2010-02-25 15:22:14 ----A---- C:\Windows\tsnpstd3.exe
2010-02-25 15:22:13 ----A---- C:\Windows\snpstd3.ini
2010-02-25 15:22:11 ----A---- C:\Windows\system32\vsnpstd3.dll
2010-02-25 15:22:11 ----A---- C:\Windows\system32\rsnpstd3.dll
2010-02-25 15:22:11 ----A---- C:\Windows\csnpstd3.dll
2010-02-25 15:22:10 ----D---- C:\Program Files\Common Files\snpstd3
2010-02-25 15:22:10 ----A---- C:\Windows\system32\csnpstd3.dll
2010-02-25 15:21:49 ----D---- C:\Users\Marco\AppData\Roaming\InstallShield
2010-02-25 15:06:58 ----A---- C:\Windows\wdict32.INI
2010-02-25 15:06:13 ----D---- C:\Program Files\Apple Software Update
2010-02-25 15:05:51 ----D---- C:\Program Files\Common Files\Apple
2010-02-25 15:05:34 ----D---- C:\Users\Marco\AppData\Roaming\Sony Corporation
2010-02-25 15:05:12 ----D---- C:\ProgramData\Apple Computer
2010-02-25 15:05:12 ----D---- C:\Program Files\QuickTime
2010-02-25 14:49:01 ----D---- C:\Drivers
2010-02-25 14:49:01 ----A---- C:\Windows\system32\SONYHCY.DLL
2010-02-25 14:47:49 ----D---- C:\Windows\system32\Iosubsys
2010-02-25 14:47:49 ----A---- C:\Windows\system32\PxInsI64.exe
2010-02-25 14:47:49 ----A---- C:\Windows\system32\PxCpyI64.exe
2010-02-25 14:45:11 ----D---- C:\Program Files\Sony
2010-02-25 13:50:14 ----D---- C:\Program Files\CCleaner
2010-02-25 13:47:11 ----D---- C:\ProgramData\ACD Systems
2010-02-25 13:47:09 ----D---- C:\Program Files\Common Files\ACD Systems
2010-02-25 13:47:09 ----D---- C:\Program Files\ACD Systems
2010-02-25 13:45:47 ----D---- C:\Windows\Downloaded Installations
2010-02-25 13:45:28 ----A---- C:\Windows\system32\BASSMOD.dll
2010-02-25 13:29:42 ----D---- C:\ProgramData\Apple
2010-02-25 13:28:33 ----D---- C:\Program Files\SuperDVD Player 5.0
2010-02-25 13:27:35 ----D---- C:\Program Files\WinRAR
2010-02-25 13:26:24 ----D---- C:\ProgramData\Spybot - Search & Destroy
2010-02-25 13:26:24 ----D---- C:\Program Files\Spybot - Search & Destroy
2010-02-25 13:23:14 ----D---- C:\profiles
2010-02-25 13:22:53 ----D---- C:\Program Files\FlashGet Network
2010-02-25 13:04:46 ----A---- C:\Windows\wtran32.INI
2010-02-25 12:49:01 ----D---- C:\Users\Marco\AppData\Roaming\GHISLER
2010-02-25 12:49:01 ----D---- C:\totalcmd
2010-02-25 12:05:34 ----D---- C:\Users\Marco\AppData\Roaming\TrueCrypt
2010-02-25 12:05:25 ----D---- C:\ProgramData\TrueCrypt
2010-02-25 12:04:59 ----D---- C:\Program Files\TrueCrypt
2010-02-25 11:52:05 ----A---- C:\Windows\system32\XAudio2_5.dll
2010-02-25 11:52:05 ----A---- C:\Windows\system32\xactengine3_5.dll
2010-02-25 11:52:04 ----A---- C:\Windows\system32\D3DCompiler_42.dll
2010-02-25 11:52:02 ----A---- C:\Windows\system32\d3dcsx_42.dll
2010-02-25 11:52:01 ----A---- C:\Windows\system32\D3DX9_42.dll
2010-02-25 11:52:01 ----A---- C:\Windows\system32\D3DX9_41.dll
2010-02-25 11:52:01 ----A---- C:\Windows\system32\d3dx11_42.dll
2010-02-25 11:52:01 ----A---- C:\Windows\system32\d3dx10_42.dll
2010-02-25 11:52:01 ----A---- C:\Windows\system32\d3dx10_41.dll
2010-02-25 11:52:01 ----A---- C:\Windows\system32\D3DCompiler_41.dll
2010-02-25 11:52:00 ----A---- C:\Windows\system32\XAudio2_4.dll
2010-02-25 11:52:00 ----A---- C:\Windows\system32\XAPOFX1_3.dll
2010-02-25 11:52:00 ----A---- C:\Windows\system32\xactengine3_4.dll
2010-02-25 11:52:00 ----A---- C:\Windows\system32\X3DAudio1_6.dll
2010-02-25 11:52:00 ----A---- C:\Windows\system32\d3dx10_40.dll
2010-02-25 11:52:00 ----A---- C:\Windows\system32\D3DCompiler_40.dll
2010-02-25 11:51:59 ----A---- C:\Windows\system32\XAudio2_3.dll
2010-02-25 11:51:59 ----A---- C:\Windows\system32\XAudio2_2.dll
2010-02-25 11:51:59 ----A---- C:\Windows\system32\XAPOFX1_2.dll
2010-02-25 11:51:59 ----A---- C:\Windows\system32\XAPOFX1_1.dll
2010-02-25 11:51:59 ----A---- C:\Windows\system32\xactengine3_3.dll
2010-02-25 11:51:59 ----A---- C:\Windows\system32\xactengine3_2.dll
2010-02-25 11:51:59 ----A---- C:\Windows\system32\X3DAudio1_5.dll
2010-02-25 11:51:59 ----A---- C:\Windows\system32\D3DX9_40.dll
2010-02-25 11:51:58 ----A---- C:\Windows\system32\XAudio2_1.dll
2010-02-25 11:51:58 ----A---- C:\Windows\system32\XAPOFX1_0.dll
2010-02-25 11:51:58 ----A---- C:\Windows\system32\D3DX9_39.dll
2010-02-25 11:51:58 ----A---- C:\Windows\system32\d3dx10_39.dll
2010-02-25 11:51:58 ----A---- C:\Windows\system32\D3DCompiler_39.dll
2010-02-25 11:51:57 ----A---- C:\Windows\system32\xactengine3_1.dll
2010-02-25 11:51:57 ----A---- C:\Windows\system32\X3DAudio1_4.dll
2010-02-25 11:51:57 ----A---- C:\Windows\system32\D3DCompiler_38.dll
2010-02-25 11:51:56 ----A---- C:\Windows\system32\XAudio2_0.dll
2010-02-25 11:51:56 ----A---- C:\Windows\system32\xactengine3_0.dll
2010-02-25 11:51:56 ----A---- C:\Windows\system32\X3DAudio1_3.dll
2010-02-25 11:51:56 ----A---- C:\Windows\system32\D3DX9_38.dll
2010-02-25 11:51:56 ----A---- C:\Windows\system32\d3dx10_38.dll
2010-02-25 11:51:56 ----A---- C:\Windows\system32\d3dx10_37.dll
2010-02-25 11:51:56 ----A---- C:\Windows\system32\D3DCompiler_37.dll
2010-02-25 11:51:55 ----A---- C:\Windows\system32\xactengine2_10.dll
2010-02-25 11:51:55 ----A---- C:\Windows\system32\D3DX9_37.dll
2010-02-25 11:51:55 ----A---- C:\Windows\system32\d3dx10_36.dll
2010-02-25 11:51:55 ----A---- C:\Windows\system32\D3DCompiler_36.dll
2010-02-25 11:51:54 ----A---- C:\Windows\system32\xactengine2_9.dll
2010-02-25 11:51:54 ----A---- C:\Windows\system32\d3dx9_36.dll
2010-02-25 11:51:54 ----A---- C:\Windows\system32\d3dx9_35.dll
2010-02-25 11:51:54 ----A---- C:\Windows\system32\d3dx10_35.dll
2010-02-25 11:51:54 ----A---- C:\Windows\system32\D3DCompiler_35.dll
2010-02-25 11:51:53 ----A---- C:\Windows\system32\xinput1_3.dll
2010-02-25 11:51:53 ----A---- C:\Windows\system32\xactengine2_8.dll
2010-02-25 11:51:53 ----A---- C:\Windows\system32\xactengine2_7.dll
2010-02-25 11:51:53 ----A---- C:\Windows\system32\X3DAudio1_2.dll
2010-02-25 11:51:53 ----A---- C:\Windows\system32\d3dx9_34.dll
2010-02-25 11:51:53 ----A---- C:\Windows\system32\d3dx10_34.dll
2010-02-25 11:51:53 ----A---- C:\Windows\system32\D3DCompiler_34.dll
2010-02-25 11:51:52 ----A---- C:\Windows\system32\xactengine2_6.dll
2010-02-25 11:51:52 ----A---- C:\Windows\system32\xactengine2_5.dll
2010-02-25 11:51:52 ----A---- C:\Windows\system32\d3dx9_33.dll
2010-02-25 11:51:52 ----A---- C:\Windows\system32\d3dx10_33.dll
2010-02-25 11:51:52 ----A---- C:\Windows\system32\d3dx10.dll
2010-02-25 11:51:52 ----A---- C:\Windows\system32\D3DCompiler_33.dll
2010-02-25 11:51:51 ----A---- C:\Windows\system32\xinput1_2.dll
2010-02-25 11:51:51 ----A---- C:\Windows\system32\xactengine2_4.dll
2010-02-25 11:51:51 ----A---- C:\Windows\system32\xactengine2_3.dll
2010-02-25 11:51:51 ----A---- C:\Windows\system32\x3daudio1_1.dll
2010-02-25 11:51:51 ----A---- C:\Windows\system32\d3dx9_32.dll
2010-02-25 11:51:51 ----A---- C:\Windows\system32\d3dx9_31.dll
2010-02-25 11:51:50 ----A---- C:\Windows\system32\xinput1_1.dll
2010-02-25 11:51:50 ----A---- C:\Windows\system32\xactengine2_2.dll
2010-02-25 11:51:50 ----A---- C:\Windows\system32\xactengine2_1.dll
2010-02-25 11:51:47 ----A---- C:\Windows\system32\d3dx9_30.dll
2010-02-25 11:51:46 ----A---- C:\Windows\system32\xactengine2_0.dll
2010-02-25 11:51:46 ----A---- C:\Windows\system32\x3daudio1_0.dll
2010-02-25 11:51:46 ----A---- C:\Windows\system32\d3dx9_29.dll
2010-02-25 11:51:46 ----A---- C:\Windows\system32\d3dx9_28.dll
2010-02-25 11:51:46 ----A---- C:\Windows\system32\d3dx9_27.dll
2010-02-25 11:51:45 ----A---- C:\Windows\system32\d3dx9_26.dll
2010-02-25 11:51:45 ----A---- C:\Windows\system32\d3dx9_25.dll
2010-02-25 11:51:44 ----A---- C:\Windows\system32\d3dx9_24.dll
2010-02-25 11:47:46 ----D---- C:\Program Files\PC Translator
2010-02-25 11:37:28 ----D---- C:\Users\Marco\AppData\Roaming\skypePM
2010-02-25 11:34:58 ----D---- C:\Users\Marco\AppData\Roaming\Skype
2010-02-25 11:34:49 ----D---- C:\Program Files\Common Files\Skype
2010-02-25 11:34:45 ----RD---- C:\Program Files\Skype
2010-02-25 11:34:43 ----D---- C:\ProgramData\Skype
2010-02-25 11:33:10 ----N---- C:\Windows\system32\pxinsa64.exe
2010-02-25 11:33:10 ----N---- C:\Windows\system32\pxhpinst.exe
2010-02-25 11:33:10 ----N---- C:\Windows\system32\pxcpya64.exe
2010-02-25 11:33:10 ----N---- C:\Windows\system32\pxafs.dll
2010-02-25 11:33:09 ----N---- C:\Windows\system32\vxblock.dll
2010-02-25 11:33:09 ----N---- C:\Windows\system32\pxwave.dll
2010-02-25 11:33:09 ----N---- C:\Windows\system32\pxsfs.dll
2010-02-25 11:33:09 ----N---- C:\Windows\system32\pxmas.dll
2010-02-25 11:33:09 ----N---- C:\Windows\system32\pxdrv.dll
2010-02-25 11:33:09 ----N---- C:\Windows\system32\px.dll
2010-02-25 11:33:08 ----D---- C:\Users\Marco\AppData\Roaming\Winamp
2010-02-25 11:33:08 ----D---- C:\Program Files\Winamp
2010-02-25 11:26:10 ----D---- C:\Program Files\Mozilla Firefox
2010-02-25 11:13:16 ----D---- C:\Users\Marco\AppData\Roaming\Lavasoft
2010-02-25 11:13:05 ----D---- C:\Program Files\Lavasoft
2010-02-25 10:53:01 ----A---- C:\Windows\system32\msonpmon.dll
2010-02-25 10:50:08 ----D---- C:\Program Files\Microsoft Works
2010-02-25 10:49:35 ----D---- C:\Program Files\Microsoft Visual Studio
2010-02-25 10:49:35 ----D---- C:\Program Files\Common Files\DESIGNER
2010-02-25 10:48:49 ----D---- C:\Windows\PCHEALTH
2010-02-25 10:48:48 ----D---- C:\Program Files\Microsoft.NET
2010-02-25 10:46:42 ----D---- C:\Program Files\Microsoft Visual Studio 8
2010-02-25 10:45:47 ----D---- C:\ProgramData\Microsoft Help
2010-02-25 10:45:47 ----D---- C:\Program Files\Microsoft Office
2010-02-25 10:44:41 ----RHD---- C:\MSOCache
2010-02-25 10:43:36 ----D---- C:\Windows\system32\ShellExt
2010-02-25 10:42:05 ----D---- C:\Program Files\LG Electronics
2010-02-25 10:33:33 ----D---- C:\Windows\system32\RTCOM
2010-02-25 10:33:11 ----A---- C:\Windows\system32\WavesLib.dll
2010-02-25 10:33:11 ----A---- C:\Windows\system32\SRSWOW.dll
2010-02-25 10:33:11 ----A---- C:\Windows\system32\SRSTSXT.dll
2010-02-25 10:33:11 ----A---- C:\Windows\system32\SRSTSHD.dll
2010-02-25 10:33:11 ----A---- C:\Windows\system32\SRSHP360.dll
2010-02-25 10:33:10 ----A---- C:\Windows\system32\RtkPgExt.dll
2010-02-25 10:33:10 ----A---- C:\Windows\system32\RtkCoInst.dll
2010-02-25 10:33:10 ----A---- C:\Windows\system32\RtkApoApi.dll
2010-02-25 10:33:10 ----A---- C:\Windows\system32\RtkAPO.dll
2010-02-25 10:33:09 ----A---- C:\Windows\system32\RTEEP32A.dll
2010-02-25 10:33:09 ----A---- C:\Windows\system32\RTEEL32A.dll
2010-02-25 10:33:09 ----A---- C:\Windows\system32\RTEEG32A.dll
2010-02-25 10:33:09 ----A---- C:\Windows\system32\RTEED32A.dll
2010-02-25 10:33:09 ----A---- C:\Windows\system32\RP3DHT32.dll
2010-02-25 10:33:09 ----A---- C:\Windows\system32\RP3DAA32.dll
2010-02-25 10:33:09 ----A---- C:\Windows\system32\MaxxAudioEQ.dll
2010-02-25 10:33:09 ----A---- C:\Windows\system32\MaxxAudioAPO20.dll
2010-02-25 10:33:09 ----A---- C:\Windows\system32\MaxxAudioAPO.dll
2010-02-25 10:33:08 ----D---- C:\Program Files\Realtek
2010-02-25 10:33:08 ----A---- C:\Windows\system32\FMAPO.dll
2010-02-25 10:33:08 ----A---- C:\Windows\system32\AERTARen.dll
2010-02-25 10:33:08 ----A---- C:\Windows\system32\AERTACap.dll
2010-02-25 10:33:05 ----HD---- C:\Program Files\Temp
2010-02-25 10:33:05 ----A---- C:\Windows\RtlExUpd.dll
2010-02-25 10:25:12 ----D---- C:\Users\Marco\AppData\Roaming\Macromedia
2010-02-25 10:25:12 ----D---- C:\Users\Marco\AppData\Roaming\Adobe
2010-02-25 10:25:05 ----D---- C:\Windows\system32\Macromed
2010-02-25 10:22:42 ----D---- C:\Users\Marco\AppData\Roaming\GetRightToGo
2010-02-25 10:19:24 ----D---- C:\Program Files\LizardTech
2010-02-25 10:04:14 ----D---- C:\Program Files\Google
2010-02-25 10:03:34 ----A---- C:\Windows\system32\aswBoot.exe
2010-02-25 10:03:32 ----D---- C:\ProgramData\Alwil Software
2010-02-25 10:03:32 ----D---- C:\Program Files\Alwil Software
2010-02-25 09:58:42 ----A---- C:\Windows\IsUninst.exe
2010-02-25 09:57:40 ----D---- C:\Program Files\ATI Technologies
2010-02-25 09:57:22 ----D---- C:\Program Files\Common Files\InstallShield
2010-02-25 09:50:19 ----N---- C:\Windows\system32\MpSigStub.exe
2010-02-25 09:43:25 ----D---- C:\Program Files\ICQ6Toolbar
2010-02-25 09:43:23 ----HD---- C:\Program Files\InstallShield Installation Information
2010-02-25 09:43:23 ----D---- C:\Users\Marco\AppData\Roaming\Mozilla
2010-02-25 09:43:23 ----D---- C:\ProgramData\ICQ
2010-02-25 09:43:19 ----D---- C:\Users\Marco\AppData\Roaming\ICQ
2010-02-25 09:43:12 ----D---- C:\Program Files\ICQ7.0
2010-02-25 09:42:34 ----D---- C:\Users\Marco\AppData\Roaming\Opera
2010-02-25 09:42:29 ----D---- C:\Program Files\Opera
2010-02-25 09:40:29 ----SHD---- C:\Windows\Installer
2010-02-25 09:38:15 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-02-25 09:29:18 ----D---- C:\Users\Marco\AppData\Roaming\Identities
2010-02-25 09:29:04 ----SD---- C:\Users\Marco\AppData\Roaming\Microsoft
2010-02-25 09:29:04 ----D---- C:\Users\Marco\AppData\Roaming\Media Center Programs
2010-02-25 09:28:59 ----SHD---- C:\Recovery
2010-02-25 09:22:18 ----D---- C:\Windows\SoftwareDistribution
2010-02-25 09:19:29 ----D---- C:\Windows\Prefetch
2010-02-25 09:19:22 ----SHD---- C:\System Volume Information
2010-02-25 09:18:39 ----D---- C:\Windows\Panther
2010-02-25 09:18:27 ----RASH---- C:\BOOTSECT.BAK
2010-02-25 09:18:25 ----SHD---- C:\Boot
Nahoru
kaspy
Návštěvník
Návštěvník
Příspěvky: 8
Registrován: 11 bře 2010 11:47

Re: win32:malware-gen

#3 Příspěvek od kaspy »

======List of files/folders modified in the last 1 months======

2010-03-11 12:13:15 ----D---- C:\Windows\Temp
2010-03-11 11:57:23 ----D---- C:\Windows\system32\Tasks
2010-03-11 11:42:53 ----RD---- C:\Program Files
2010-03-11 07:56:31 ----D---- C:\Windows\System32
2010-03-11 07:56:31 ----D---- C:\Windows\inf
2010-03-10 18:05:38 ----D---- C:\Windows\system32\catroot2
2010-03-10 17:56:27 ----D---- C:\Windows\system32\config
2010-03-10 16:15:45 ----D---- C:\Windows
2010-03-09 13:01:48 ----D---- C:\Windows\system32\wdi
2010-03-08 17:29:23 ----D---- C:\Windows\rescache
2010-03-08 17:27:43 ----D---- C:\Windows\Logs
2010-03-01 17:35:55 ----HD---- C:\ProgramData
2010-02-28 16:02:30 ----D---- C:\Windows\system32\DriverStore
2010-02-26 13:41:37 ----SD---- C:\ProgramData\Microsoft
2010-02-26 13:41:37 ----D---- C:\Windows\system32\drivers
2010-02-26 13:36:26 ----D---- C:\Windows\winsxs
2010-02-26 12:20:12 ----D---- C:\Program Files\Internet Explorer
2010-02-26 11:37:37 ----D---- C:\Program Files\Common Files
2010-02-26 11:33:45 ----RSD---- C:\Windows\Fonts
2010-02-25 15:24:53 ----D---- C:\Windows\system32\catroot
2010-02-25 15:22:15 ----A---- C:\Windows\win.ini
2010-02-25 15:22:14 ----D---- C:\Windows\twain_32
2010-02-25 13:50:52 ----D---- C:\Windows\debug
2010-02-25 13:13:16 ----HD---- C:\Windows\system32\GroupPolicy
2010-02-25 12:40:49 ----D---- C:\Windows\Microsoft.NET
2010-02-25 12:40:46 ----RSD---- C:\Windows\assembly
2010-02-25 12:15:30 ----SHD---- C:\$Recycle.Bin
2010-02-25 12:15:20 ----RD---- C:\Users
2010-02-25 11:44:34 ----D---- C:\Windows\Downloaded Program Files
2010-02-25 11:40:23 ----D---- C:\Windows\LiveKernelReports
2010-02-25 10:50:04 ----D---- C:\Program Files\Common Files\microsoft shared
2010-02-25 10:49:58 ----D---- C:\Program Files\MSBuild
2010-02-25 10:49:31 ----D---- C:\Windows\ShellNew
2010-02-25 10:46:11 ----D---- C:\Program Files\Common Files\System
2010-02-25 10:04:19 ----D---- C:\Windows\Tasks
2010-02-25 09:42:15 ----D---- C:\Windows\system32\CodeIntegrity
2010-02-25 09:42:03 ----D---- C:\Windows\system32\restore
2010-02-25 09:37:38 ----D---- C:\Windows\system32\wbem
2010-02-25 09:28:59 ----D---- C:\Windows\system32\Recovery
2010-02-25 09:24:45 ----D---- C:\Windows\system32\sysprep
2010-02-25 09:20:07 ----D---- C:\Windows\CSC

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2010-03-09 23376]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2010-03-09 162640]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2010-03-09 46672]
R1 blbdrive;blbdrive; C:\Windows\system32\DRIVERS\blbdrive.sys [2009-07-14 35328]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 387584]
R1 DfsC;@%systemroot%\system32\drivers\dfsc.sys,-101; C:\Windows\System32\Drivers\dfsc.sys [2009-07-14 78336]
R1 discache;@%systemroot%\system32\drivers\discache.sys,-102; C:\Windows\System32\drivers\discache.sys [2009-07-14 32256]
R1 nsiproxy;@%SystemRoot%\system32\drivers\nsiproxy.sys,-2; C:\Windows\system32\drivers\nsiproxy.sys [2009-07-14 16896]
R1 RDPENCDD;@%systemroot%\system32\drivers\RDPENCDD.sys,-101; C:\Windows\system32\drivers\rdpencdd.sys [2009-07-14 6656]
R1 RDPREFMP;@%systemroot%\system32\drivers\RdpRefMp.sys,-101; C:\Windows\system32\drivers\rdprefmp.sys [2009-07-14 7168]
R1 tdx;@%SystemRoot%\system32\tcpipcfg.dll,-50004; C:\Windows\system32\DRIVERS\tdx.sys [2009-07-14 74240]
R1 truecrypt;truecrypt; C:\Windows\System32\drivers\truecrypt.sys [2010-02-25 223440]
R1 Wanarpv6;@%systemroot%\system32\rascfg.dll,-32012; C:\Windows\system32\DRIVERS\wanarp.sys [2009-07-14 63488]
R1 WfpLwf;WFP Lightweight Filter; C:\Windows\system32\DRIVERS\wfplwf.sys [2009-07-14 9728]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2010-03-09 19024]
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2010-03-09 51792]
R2 lltdio;Link-Layer Topology Discovery Mapper I/O Driver; C:\Windows\system32\DRIVERS\lltdio.sys [2009-07-14 48128]
R2 luafv;@%systemroot%\system32\drivers\luafv.sys,-100; C:\Windows\system32\drivers\luafv.sys [2009-07-14 86528]
R2 PEAUTH;PEAUTH; C:\Windows\system32\drivers\peauth.sys [2009-07-14 586752]
R2 rspndr;Link-Layer Topology Discovery Responder; C:\Windows\system32\DRIVERS\rspndr.sys [2009-07-14 60928]
R2 tcpipreg;TCP/IP Registry Compatibility; C:\Windows\System32\drivers\tcpipreg.sys [2009-07-14 34816]
R3 1394ohci;1394 OHCI Compliant Host Controller; C:\Windows\system32\DRIVERS\1394ohci.sys [2009-07-14 163328]
R3 AmdK8;AMD K8 Processor Driver; C:\Windows\system32\DRIVERS\amdk8.sys [2009-07-14 55296]
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2009-07-13 4194816]
R3 bowser;@%systemroot%\system32\browser.dll,-102; C:\Windows\system32\DRIVERS\bowser.sys [2009-07-14 69632]
R3 CompositeBus;Composite Bus Enumerator Driver; C:\Windows\system32\DRIVERS\CompositeBus.sys [2009-07-14 31232]
R3 DXGKrnl;LDDM Graphics Subsystem; C:\Windows\System32\drivers\dxgkrnl.sys [2009-07-14 720896]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\Windows\system32\DRIVERS\HDAudBus.sys [2009-07-14 108544]
R3 HidUsb;Microsoft HID Class Driver; C:\Windows\system32\DRIVERS\hidusb.sys [2009-07-14 24064]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2009-12-08 2975776]
R3 kbdhid;Keyboard HID Driver; C:\Windows\system32\DRIVERS\kbdhid.sys [2009-07-14 28160]
R3 monitor;Microsoft Monitor Class Function Driver Service; C:\Windows\system32\DRIVERS\monitor.sys [2009-07-14 23552]
R3 mouhid;Mouse HID Driver; C:\Windows\system32\DRIVERS\mouhid.sys [2009-07-14 26112]
R3 mpsdrv;@%SystemRoot%\system32\FirewallAPI.dll,-23092; C:\Windows\System32\drivers\mpsdrv.sys [2009-07-14 60416]
R3 mrxsmb10;@%systemroot%\system32\wkssvc.dll,-1004; C:\Windows\system32\DRIVERS\mrxsmb10.sys [2009-07-14 221184]
R3 mrxsmb20;@%systemroot%\system32\wkssvc.dll,-1006; C:\Windows\system32\DRIVERS\mrxsmb20.sys [2009-07-14 95744]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvm62x32.sys [2009-07-13 347264]
R3 pfc;Padus ASPI Shell; C:\Windows\system32\drivers\pfc.sys [2010-02-25 10368]
R3 PSI;PSI; C:\Windows\system32\DRIVERS\psi_mf.sys [2009-06-17 12648]
R3 RasAgileVpn;WAN Miniport (IKEv2); C:\Windows\system32\DRIVERS\AgileVpn.sys [2009-07-14 49152]
R3 RasSstp;@%systemroot%\system32\sstpsvc.dll,-202; C:\Windows\system32\DRIVERS\rassstp.sys [2009-07-14 75264]
R3 rdpbus;Remote Desktop Device Redirector Bus Driver; C:\Windows\system32\DRIVERS\rdpbus.sys [2009-07-14 18944]
R3 srv2;@%systemroot%\system32\srvsvc.dll,-104; C:\Windows\System32\DRIVERS\srv2.sys [2009-07-14 306688]
R3 srvnet;srvnet; C:\Windows\System32\DRIVERS\srvnet.sys [2009-07-14 113664]
R3 tunnel;Microsoft Tunnel Miniport Adapter Driver; C:\Windows\system32\DRIVERS\tunnel.sys [2009-07-14 108544]
R3 umbus;UMBus Enumerator Driver; C:\Windows\system32\DRIVERS\umbus.sys [2009-07-14 39936]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\Windows\system32\DRIVERS\usbccgp.sys [2009-07-14 75264]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\Windows\system32\DRIVERS\usbehci.sys [2009-07-14 41472]
R3 usbhub;Microsoft USB Standard Hub Driver; C:\Windows\system32\DRIVERS\usbhub.sys [2009-07-14 258560]
R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\Windows\system32\DRIVERS\usbohci.sys [2009-07-14 20480]
R3 WudfPf;User Mode Driver Frameworks Platform Driver; C:\Windows\system32\drivers\WudfPf.sys [2009-07-14 92672]
S3 AcpiPmi;ACPI Power Meter Driver; C:\Windows\system32\DRIVERS\acpipmi.sys [2009-07-14 9728]
S3 adp94xx;adp94xx; C:\Windows\system32\DRIVERS\adp94xx.sys [2009-07-14 422976]
S3 adpahci;adpahci; C:\Windows\system32\DRIVERS\adpahci.sys [2009-07-14 297552]
S3 adpu320;adpu320; C:\Windows\system32\DRIVERS\adpu320.sys [2009-07-14 146512]
S3 agp440;Intel AGP Bus Filter; C:\Windows\system32\DRIVERS\agp440.sys [2009-07-14 53312]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 amdide;amdide; C:\Windows\system32\DRIVERS\amdide.sys [2009-07-14 14912]
S3 AmdPPM;AMD Processor Driver; C:\Windows\system32\DRIVERS\amdppm.sys [2009-07-14 52736]
S3 amdsata;amdsata; C:\Windows\system32\DRIVERS\amdsata.sys [2009-07-14 79952]
S3 amdsbs;amdsbs; C:\Windows\system32\DRIVERS\amdsbs.sys [2009-07-14 159312]
S3 AppID;@%systemroot%\system32\appidsvc.dll,-102; C:\Windows\system32\drivers\appid.sys [2009-07-14 50176]
S3 arc;arc; C:\Windows\system32\DRIVERS\arc.sys [2009-07-14 76368]
S3 arcsas;arcsas; C:\Windows\system32\DRIVERS\arcsas.sys [2009-07-14 86608]
S3 b06bdrv;Broadcom NetXtreme II VBD; C:\Windows\system32\DRIVERS\bxvbdx.sys [2009-07-13 430080]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 BrFiltLo;Brother USB Mass-Storage Lower Filter Driver; C:\Windows\system32\DRIVERS\BrFiltLo.sys [2009-07-13 13568]
S3 BrFiltUp;Brother USB Mass-Storage Upper Filter Driver; C:\Windows\system32\DRIVERS\BrFiltUp.sys [2009-07-13 5248]
S3 Brserid;Brother MFC Serial Port Interface Driver (WDM); C:\Windows\System32\Drivers\Brserid.sys [2009-07-14 272128]
S3 BrSerWdm;Brother WDM Serial driver; C:\Windows\System32\Drivers\BrSerWdm.sys [2009-07-13 62336]
S3 BrUsbMdm;Brother MFC USB Fax Only Modem; C:\Windows\System32\Drivers\BrUsbMdm.sys [2009-07-13 12160]
S3 BrUsbSer;Brother MFC USB Serial WDM Driver; C:\Windows\System32\Drivers\BrUsbSer.sys [2009-07-13 11904]
S3 BTHMODEM;Bluetooth Serial Communications Driver; C:\Windows\system32\DRIVERS\bthmodem.sys [2009-07-14 56320]
S3 circlass;Consumer IR Devices; C:\Windows\system32\DRIVERS\circlass.sys [2009-07-14 37888]
S3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\Windows\system32\DRIVERS\CmBatt.sys [2009-07-14 14080]
S3 Compbatt;Compbatt; C:\Windows\system32\DRIVERS\compbatt.sys [2009-07-14 19024]
S3 ebdrv;Broadcom NetXtreme II 10 GigE VBD; C:\Windows\system32\DRIVERS\evbdx.sys [2009-07-13 3100160]
S3 elxstor;elxstor; C:\Windows\system32\DRIVERS\elxstor.sys [2009-07-14 453712]
S3 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\DRIVERS\errdev.sys [2009-07-14 7168]
S3 exfat;exFAT File System Driver; C:\Windows\system32\drivers\exfat.sys [2009-07-14 142336]
S3 Filetrace;@%SystemRoot%\system32\drivers\filetrace.sys,-10001; C:\Windows\system32\drivers\filetrace.sys [2009-07-14 28160]
S3 FsDepends;@%SystemRoot%\system32\drivers\fsdepends.sys,-10001; C:\Windows\System32\drivers\FsDepends.sys [2009-07-14 46160]
S3 gagp30kx;Microsoft Generic AGPv3.0 Filter for K8 Processor Platforms; C:\Windows\system32\DRIVERS\gagp30kx.sys [2009-07-14 57936]
S3 hcw85cir;Hauppauge Consumer Infrared Receiver; C:\Windows\system32\drivers\hcw85cir.sys [2009-07-13 26624]
S3 HdAudAddService;Microsoft 1.1 UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\HdAudio.sys [2009-07-14 304128]
S3 HidBatt;HID UPS Battery Driver; C:\Windows\system32\DRIVERS\HidBatt.sys [2009-07-14 21504]
S3 HidBth;Microsoft Bluetooth HID Miniport; C:\Windows\system32\DRIVERS\hidbth.sys [2009-07-14 91136]
S3 HidIr;Microsoft Infrared HID Driver; C:\Windows\system32\DRIVERS\hidir.sys [2009-07-14 37888]
S3 HpSAMD;HpSAMD; C:\Windows\system32\DRIVERS\HpSAMD.sys [2009-07-14 67152]
S3 iaStorV;iaStorV; C:\Windows\system32\DRIVERS\iaStorV.sys [2009-07-14 332352]
S3 iirsp;iirsp; C:\Windows\system32\DRIVERS\iirsp.sys [2009-07-14 41040]
S3 intelide;intelide; C:\Windows\system32\DRIVERS\intelide.sys [2009-07-14 15424]
S3 intelppm;Intel Processor Driver; C:\Windows\system32\DRIVERS\intelppm.sys [2009-07-14 53760]
S3 IPMIDRV;IPMIDRV; C:\Windows\system32\DRIVERS\IPMIDrv.sys [2009-07-14 65536]
S3 isapnp;isapnp; C:\Windows\system32\DRIVERS\isapnp.sys [2009-07-14 46656]
S3 iScsiPrt;iScsiPort Driver; C:\Windows\system32\DRIVERS\msiscsi.sys [2009-07-14 186960]
S3 LSI_FC;LSI_FC; C:\Windows\system32\DRIVERS\lsi_fc.sys [2009-07-14 95824]
S3 LSI_SAS;LSI_SAS; C:\Windows\system32\DRIVERS\lsi_sas.sys [2009-07-14 89168]
S3 LSI_SAS2;LSI_SAS2; C:\Windows\system32\DRIVERS\lsi_sas2.sys [2009-07-14 54864]
S3 LSI_SCSI;LSI_SCSI; C:\Windows\system32\DRIVERS\lsi_scsi.sys [2009-07-14 96848]
S3 megasas;megasas; C:\Windows\system32\DRIVERS\megasas.sys [2009-07-14 30800]
S3 MegaSR;MegaSR; C:\Windows\system32\DRIVERS\MegaSR.sys [2009-07-14 235584]
S3 mpio;mpio; C:\Windows\system32\DRIVERS\mpio.sys [2009-07-14 130624]
S3 msahci;msahci; C:\Windows\system32\DRIVERS\msahci.sys [2009-07-14 27712]
S3 msdsm;msdsm; C:\Windows\system32\DRIVERS\msdsm.sys [2009-07-14 115792]
S3 mshidkmdf;@%SystemRoot%\system32\drivers\mshidkmdf.sys,-100; C:\Windows\System32\drivers\mshidkmdf.sys [2009-07-14 4096]
S3 MsRPC;MsRPC; C:\Windows\system32\drivers\MsRPC.sys [2009-07-14 162896]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2009-07-14 6144]
S3 MTConfig;Microsoft Input Configuration Driver; C:\Windows\system32\DRIVERS\MTConfig.sys [2009-07-14 12288]
S3 NativeWifiP;NativeWiFi Filter; C:\Windows\system32\DRIVERS\nwifi.sys [2009-07-14 267264]
S3 NdisCap;NDIS Capture LightWeight Filter; C:\Windows\system32\DRIVERS\ndiscap.sys [2009-07-14 27136]
S3 nfrd960;nfrd960; C:\Windows\system32\DRIVERS\nfrd960.sys [2009-07-14 44624]
S3 nv_agp;NVIDIA nForce AGP Bus Filter; C:\Windows\system32\DRIVERS\nv_agp.sys [2009-07-14 105024]
S3 nvraid;nvraid; C:\Windows\system32\DRIVERS\nvraid.sys [2009-07-14 117312]
S3 ohci1394;1394 OHCI Compliant Host Controller (Legacy); C:\Windows\system32\DRIVERS\ohci1394.sys [2009-07-14 62464]
S3 ql2300;ql2300; C:\Windows\system32\DRIVERS\ql2300.sys [2009-07-14 1383488]
S3 ql40xx;ql40xx; C:\Windows\system32\DRIVERS\ql40xx.sys [2009-07-14 106064]
S3 QWAVEdrv;@%SystemRoot%\system32\drivers\qwavedrv.sys,-1; C:\Windows\system32\drivers\qwavedrv.sys [2009-07-14 31744]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 5632]
S3 sbp2port;sbp2port; C:\Windows\system32\DRIVERS\sbp2port.sys [2009-07-14 85568]
S3 scfilter;@%SystemRoot%\System32\drivers\scfilter.sys,-11; C:\Windows\System32\DRIVERS\scfilter.sys [2009-07-14 26624]
S3 sermouse;Serial Mouse Driver; C:\Windows\system32\DRIVERS\sermouse.sys [2009-07-14 19968]
S3 sffdisk;SFF Storage Class Driver; C:\Windows\system32\DRIVERS\sffdisk.sys [2009-07-14 11264]
S3 sffp_mmc;SFF Storage Protocol Driver for MMC; C:\Windows\system32\DRIVERS\sffp_mmc.sys [2009-07-14 12288]
S3 sffp_sd;SFF Storage Protocol Driver for SDBus; C:\Windows\system32\DRIVERS\sffp_sd.sys [2009-07-14 12800]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 SiSRaid2;SiSRaid2; C:\Windows\system32\DRIVERS\SiSRaid2.sys [2009-07-14 40016]
S3 SiSRaid4;SiSRaid4; C:\Windows\system32\DRIVERS\sisraid4.sys [2009-07-14 77888]
S3 Smb;@%SystemRoot%\system32\tcpipcfg.dll,-50005; C:\Windows\system32\DRIVERS\smb.sys [2009-07-14 71168]
S3 stexstor;stexstor; C:\Windows\system32\DRIVERS\stexstor.sys [2009-07-14 21072]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 28224]
S3 TCPIP6;Microsoft IPv6 Protocol Driver; C:\Windows\system32\DRIVERS\tcpip.sys [2009-07-14 1285712]
S3 tssecsrv;@%SystemRoot%\System32\DRIVERS\tssecsrv.sys,-101; C:\Windows\System32\DRIVERS\tssecsrv.sys [2009-07-14 30208]
S3 uagp35;Microsoft AGPv3.5 Filter; C:\Windows\system32\DRIVERS\uagp35.sys [2009-07-14 55888]
S3 uliagpkx;Uli AGP Bus Filter; C:\Windows\system32\DRIVERS\uliagpkx.sys [2009-07-14 57424]
S3 UmPass;Microsoft UMPass Driver; C:\Windows\system32\DRIVERS\umpass.sys [2009-07-14 8192]
S3 usbcir;eHome Infrared Receiver (USBCIR); C:\Windows\system32\DRIVERS\usbcir.sys [2009-07-14 86016]
S3 usbprint;Microsoft USB PRINTER Class; C:\Windows\system32\DRIVERS\usbprint.sys [2009-07-14 19968]
S3 USBSTOR;USB Mass Storage Driver; C:\Windows\system32\DRIVERS\USBSTOR.SYS [2009-07-14 74752]
S3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\Windows\system32\DRIVERS\usbuhci.sys [2009-07-14 24064]
S3 vga;vga; C:\Windows\system32\DRIVERS\vgapnp.sys [2009-07-14 26112]
S3 vhdmp;vhdmp; C:\Windows\system32\DRIVERS\vhdmp.sys [2009-07-14 159824]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 175824]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 17920]
S3 vsmraid;vsmraid; C:\Windows\system32\DRIVERS\vsmraid.sys [2009-07-14 141904]
S3 vwifibus;@%SystemRoot%\System32\drivers\vwifibus.sys,-257; C:\Windows\System32\drivers\vwifibus.sys [2009-07-14 19968]
S3 WacomPen;Wacom Serial Pen HID Driver; C:\Windows\system32\DRIVERS\wacompen.sys [2009-07-14 21632]
S3 Wd;Wd; C:\Windows\system32\DRIVERS\wd.sys [2009-07-14 19024]
S3 WIMMount;WIMMount; C:\Windows\system32\drivers\wimmount.sys [2009-07-14 19008]
S3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\DRIVERS\wmiacpi.sys [2009-07-14 11264]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2009-07-14 132224]
S4 crcdisk;Crcdisk Filter Driver; C:\Windows\system32\DRIVERS\crcdisk.sys [2009-07-14 22096]
S4 ws2ifsl;@%systemroot%\System32\drivers\ws2ifsl.sys,-1000; C:\Windows\system32\drivers\ws2ifsl.sys [2009-07-14 16384]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AudioEndpointBuilder;@%SystemRoot%\system32\audiosrv.dll,-204; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-03-09 40384]
R2 BFE;@%SystemRoot%\system32\bfe.dll,-1001; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 DPS;@%systemroot%\system32\dps.dll,-500; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 gpsvc;@gpapi.dll,-112; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 ICQ Service;ICQ Service; C:\Program Files\ICQ6Toolbar\ICQ Service.exe [2010-01-03 246520]
R2 IKEEXT;@%SystemRoot%\system32\ikeext.dll,-501; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 iphlpsvc;@%SystemRoot%\system32\iphlpsvc.dll,-500; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 MpsSvc;@%SystemRoot%\system32\FirewallAPI.dll,-23090; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 NlaSvc;@%SystemRoot%\System32\nlasvc.dll,-1; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 nsi;@%SystemRoot%\system32\nsisvc.dll,-200; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 Power;@%SystemRoot%\system32\umpo.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 ProfSvc;@%systemroot%\system32\profsvc.dll,-300; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 RpcEptMapper;@%windir%\system32\RpcEpMap.dll,-1001; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 SBSDWSCService;SBSD Security Center Service; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
R2 SysMain;@%SystemRoot%\system32\sysmain.dll,-1000; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 UxSms;@%SystemRoot%\system32\dwm.exe,-2000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 WinDefend;@%ProgramFiles%\Windows Defender\MsMpRes.dll,-103; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 WMPNetworkSvc;@%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101; C:\Program Files\Windows Media Player\wmpnetwk.exe [2009-07-14 1121280]
R2 WSearch;@%systemroot%\system32\SearchIndexer.exe,-103; C:\Windows\system32\SearchIndexer.exe [2009-07-14 428032]
R2 wudfsvc;@%SystemRoot%\system32\wudfsvc.dll,-1000; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-03-09 40384]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-03-09 40384]
R3 fdPHost;@%systemroot%\system32\fdPHost.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R3 FDResPub;@%systemroot%\system32\fdrespub.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R3 HomeGroupListener;@%SystemRoot%\System32\ListSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R3 HomeGroupProvider;@%SystemRoot%\System32\provsvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R3 KeyIso;@keyiso.dll,-100; C:\Windows\system32\lsass.exe [2009-07-14 22528]
R3 netprofm;@%SystemRoot%\system32\netprofm.dll,-202; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R3 p2pimsvc;@%SystemRoot%\system32\pnrpsvc.dll,-8004; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R3 p2psvc;@%SystemRoot%\system32\p2psvc.dll,-8006; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R3 PcaSvc;@%SystemRoot%\system32\pcasvc.dll,-1; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R3 PNRPsvc;@%SystemRoot%\system32\pnrpsvc.dll,-8000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R3 WdiServiceHost;@%systemroot%\system32\wdi.dll,-502; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-02-25 133104]
S2 MMCSS;@%systemroot%\system32\mmcss.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S2 sppsvc;@%SystemRoot%\system32\sppsvc.exe,-101; C:\Windows\system32\sppsvc.exe [2009-07-14 3179520]
S3 AeLookupSvc;@%SystemRoot%\system32\aelupsvc.dll,-1; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 AppIDSvc;@%systemroot%\system32\appidsvc.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 Appinfo;@%systemroot%\system32\appinfo.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 AxInstSV;@%SystemRoot%\system32\AxInstSV.dll,-103; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 BDESVC;@%SystemRoot%\system32\bdesvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 bthserv;@%SystemRoot%\System32\bthserv.dll,-101; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 CertPropSvc;@%SystemRoot%\System32\certprop.dll,-11; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 clr_optimization_v2.0.50727_32;Microsoft .NET Framework NGEN v2.0.50727_X86; C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2009-06-10 66384]
S3 defragsvc;@%SystemRoot%\system32\defragsvc.dll,-101; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 EFS;@%SystemRoot%\system32\efssvc.dll,-100; C:\Windows\System32\lsass.exe [2009-07-14 22528]
S3 ehRecvr;@%SystemRoot%\ehome\ehrecvr.exe,-101; C:\Windows\ehome\ehRecvr.exe [2009-07-14 557056]
S3 ehSched;@%SystemRoot%\ehome\ehsched.exe,-101; C:\Windows\ehome\ehsched.exe [2009-07-14 94720]
S3 Fax;@%systemroot%\system32\fxsresm.dll,-118; C:\Windows\system32\fxssvc.exe [2009-07-14 522752]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2010-02-26 651720]
S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 FontCache3.0.0.0;@%SystemRoot%\system32\PresentationHost.exe,-3309; C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2009-06-10 42856]
S3 idsvc;@%systemroot%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelInstallRC.dll,-8193; C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2009-06-10 878416]
S3 IPBusEnum;@%systemroot%\system32\IPBusEnum.dll,-102; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 KtmRm;@comres.dll,-2946; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 lltdsvc;@%SystemRoot%\system32\lltdres.dll,-1; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 MSiSCSI;@%SystemRoot%\system32\iscsidsc.dll,-5000; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 pla;@%systemroot%\system32\pla.dll,-500; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 PNRPAutoReg;@%SystemRoot%\system32\pnrpauto.dll,-8002; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 QWAVE;@%SystemRoot%\system32\qwave.dll,-1; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 SCPolicySvc;@%SystemRoot%\System32\certprop.dll,-13; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 SDRSVC;@%SystemRoot%\system32\sdrsvc.dll,-107; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 SensrSvc;@%SystemRoot%\System32\sensrsvc.dll,-1000; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 SessionEnv;@%SystemRoot%\System32\SessEnv.dll,-1026; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 SNMPTRAP;@%SystemRoot%\system32\snmptrap.exe,-3; C:\Windows\System32\snmptrap.exe [2009-07-14 12800]
S3 sppuinotify;@%SystemRoot%\system32\sppuinotify.dll,-103; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 SstpSvc;@%SystemRoot%\system32\sstpsvc.dll,-200; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 TabletInputService;@%SystemRoot%\system32\TabSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 TBS;@%SystemRoot%\system32\tbssvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 THREADORDER;@%systemroot%\system32\mmcss.dll,-102; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 TrustedInstaller;@%SystemRoot%\servicing\TrustedInstaller.exe,-100; C:\Windows\servicing\TrustedInstaller.exe [2009-07-14 204800]
S3 UI0Detect;@%SystemRoot%\system32\ui0detect.exe,-101; C:\Windows\system32\UI0Detect.exe [2009-07-14 35840]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 VaultSvc;@%SystemRoot%\system32\vaultsvc.dll,-1003; C:\Windows\system32\lsass.exe [2009-07-14 22528]
S3 vds;@%SystemRoot%\system32\vds.exe,-100; C:\Windows\System32\vds.exe [2009-07-14 452608]
S3 wbengine;@%systemroot%\system32\wbengine.exe,-104; C:\Windows\system32\wbengine.exe [2009-07-14 1202688]
S3 WbioSrvc;@%systemroot%\system32\wbiosrvc.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 wcncsvc;@%SystemRoot%\system32\wcncsvc.dll,-3; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WcsPlugInService;@%SystemRoot%\system32\WcsPlugInService.dll,-200; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 WdiSystemHost;@%systemroot%\system32\wdi.dll,-500; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 Wecsvc;@%SystemRoot%\system32\wecsvc.dll,-200; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 wercplsupport;@%SystemRoot%\System32\wercplsupport.dll,-101; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WerSvc;@%SystemRoot%\System32\wersvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WinHttpAutoProxySvc;@%SystemRoot%\system32\winhttp.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 WinRM;@%Systemroot%\system32\wsmsvc.dll,-101; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 Wlansvc;@%SystemRoot%\System32\wlansvc.dll,-257; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 WPCSvc;@%SystemRoot%\system32\wpcsvc.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 WPDBusEnum;@%SystemRoot%\system32\wpdbusenum.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 WwanSvc;@%SystemRoot%\System32\wwansvc.dll,-257; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S4 Mcx2Svc;@%SystemRoot%\ehome\ehres.dll,-15501; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S4 NetTcpPortSharing;@%systemroot%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelInstallRC.dll,-8201; C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2009-06-10 128848]

-----------------EOF-----------------
Nahoru
Uživatelský avatar
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 říj 2008 08:02

Re: win32:malware-gen

#4 Příspěvek od motji »

Dobrý večer :)

V jakém souboru vir hlásil?
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
kaspy
Návštěvník
Návštěvník
Příspěvky: 8
Registrován: 11 bře 2010 11:47

Re: win32:malware-gen

#5 Příspěvek od kaspy »

ACDSeeQV.exe
Nahoru
Uživatelský avatar
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 říj 2008 08:02

Re: win32:malware-gen

#6 Příspěvek od motji »

Nepoužíváte program od ACD Systems?
http://www.slunecnice.cz/autori/acdsystems/
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
kaspy
Návštěvník
Návštěvník
Příspěvky: 8
Registrován: 11 bře 2010 11:47

Re: win32:malware-gen

#7 Příspěvek od kaspy »

ACDSee 9 Photo manager

po uvedeni hore spominaneho suboru do truhly je prezeranie fotiek nefunkcne...
Nahoru
Uživatelský avatar
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 říj 2008 08:02

Re: win32:malware-gen

#8 Příspěvek od motji »

Soubor bude od tohoto programu. Může to být falešná detekce Avastu. Obnovte ho zpět do původního umístění, nebo chcete li, někam na plochu, a pak ho otestujte na www.virustotal.com
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
kaspy
Návštěvník
Návštěvník
Příspěvky: 8
Registrován: 11 bře 2010 11:47

Re: win32:malware-gen

#9 Příspěvek od kaspy »

File ACDSeeQV.exe.vir received on 2010.03.12 04:07:19 (UTC)Antivirus Version Last Update Result
Avast5 5.0.332.0 2010.03.12 Win32:Malware-gen
CAT-QuickHeal 10.00 2010.03.11 TrojanDownloader.Agent.dhpl
McAfee+Artemis 5917 2010.03.11 Artemis!983C29C0D441
TheHacker 6.5.2.0.231 2010.03.12 Trojan/Downloader.Agent.dhpl

Additional information
File size: 512000 bytes
MD5 : 983c29c0d441f981bd25abb4e2a3de4c
SHA1 : a9c27f43cb0bc5a137ab5b599ae83eff136b733e
SHA256: 9cd963b1ceef27f353263cd08930a43030f84a720df8e0ee17f502613ce7c060
PEInfo: PE Structure information<BR> <BR> ( base data )<BR> entrypointaddress.: 0x53F29<BR> timedatestamp.....: 0x45006CF4 (Thu Sep 7 21:03:16 2006)<BR> machinetype.......: 0x14C (Intel I386)<BR> <BR> ( 5 sections )<BR> name viradd virsiz rawdsiz ntrpy md5<BR> .text 0x1000 0x55439 0x56000 6.44 5ecec127bf40580a55c3f119a438920e<BR>.rdata 0x57000 0xA2D4 0xB000 4.73 7f39f3b36e5e3d584e163b9243007d1f<BR>.data 0x62000 0x6470 0x4000 3.24 0b4d1d77f47a5d8dbf0aae71ef75d42f<BR>.tls 0x69000 0x4 0x1000 0.00 620f0b67a91f7f74151bc5be745b7110<BR>.rsrc 0x6A000 0x15918 0x16000 5.30 47e76fe31404f66b1ae55d2cb62d9a3b<BR> <BR> ( 15 imports )<BR> <BR>> advapi32.dll: RegCreateKeyExA, RegDeleteKeyA, RegEnumKeyA, RegDeleteValueA, RegisterEventSourceA, ReportEventA, DeregisterEventSource, RegEnumKeyExA, RegCloseKey, RegOpenKeyA, RegSetValueExA, RegOpenKeyExA, RegQueryValueExA<BR>> comctl32.dll: _TrackMouseEvent, ImageList_Draw, ImageList_Create, ImageList_AddMasked, ImageList_Destroy, -<BR>> comdlg32.dll: GetOpenFileNameA, ChooseColorA, GetFileTitleA, GetSaveFileNameA<BR>> gdi32.dll: SaveDC, CreateCompatibleDC, CreateBitmap, MaskBlt, RestoreDC, GetDeviceCaps, DeleteDC, GetObjectA, SetTextColor, SetBkMode, GetTextExtentPoint32A, SelectObject, CreatePen, MoveToEx, LineTo, CreateFontIndirectA, CreateSolidBrush, DeleteObject, GetStockObject, CreatePalette, DeleteEnhMetaFile, CreateDIBSection, GetDIBColorTable, SetStretchBltMode, SetDIBitsToDevice, SelectClipRgn, CombineRgn, CreateRectRgn, BitBlt, SetBrushOrgEx, Rectangle, SetBkColor, PlayEnhMetaFile, RealizePalette, SelectPalette, SetEnhMetaFileBits, GetEnhMetaFileBits, SetDIBColorTable, GetPaletteEntries, GetCurrentObject, StretchBlt, Arc, CreateEllipticRgn, CreateCompatibleBitmap<BR>> imagehlp.dll: ImageEnumerateCertificates, ImageGetCertificateHeader, ImageGetCertificateData, ImageGetDigestStream<BR>> kernel32.dll: WideCharToMultiByte, FindResourceExA, FindResourceA, LoadResource, FreeLibrary, CloseHandle, GetTickCount, FindFirstFileA, FindNextFileA, FindClose, Sleep, GetCurrentProcessId, TlsAlloc, TlsFree, GetCurrentThreadId, TlsGetValue, TlsSetValue, SetEvent, FindFirstChangeNotificationA, WaitForMultipleObjects, FindNextChangeNotification, FindCloseChangeNotification, EnterCriticalSection, LeaveCriticalSection, GetFileAttributesA, SystemTimeToTzSpecificLocalTime, GetDateFormatA, GetTimeFormatA, FileTimeToSystemTime, LockResource, CreateEventA, CreateSemaphoreA, ReleaseSemaphore, lstrcpynA, GetModuleFileNameA, ExitProcess, GetProcessHeap, HeapSize, HeapReAlloc, HeapFree, HeapAlloc, HeapDestroy, TerminateThread, SuspendThread, GetCurrentThread, SetFileTime, GetUserDefaultLangID, GetWindowsDirectoryA, MoveFileA, SetFileAttributesA, FreeResource, GetTempFileNameA, DeleteFileA, LocalFree, FormatMessageA, GetFullPathNameA, GetFileTime, LoadLibraryExA, ResetEvent, SetThreadPriority, ResumeThread, QueryPerformanceFrequency, QueryPerformanceCounter, GlobalAlloc, UnmapViewOfFile, CreateFileMappingA, MapViewOfFile, GetFileSize, MulDiv, GetCurrentDirectoryA, SetCurrentDirectoryA, GlobalLock, GlobalUnlock, GlobalFree, WaitForSingleObject, SystemTimeToFileTime, GetSystemTimeAsFileTime, CompareFileTime, LoadLibraryA, SetThreadLocale, lstrcpyA, GetModuleHandleA, GetProcAddress, lstrlenA, lstrcmpiA, DeleteCriticalSection, InitializeCriticalSection, RaiseException, MultiByteToWideChar, CreateMutexA, GetStartupInfoA, lstrcmpA, lstrcatA, SizeofResource, GetVersionExA, GetThreadLocale, GetLocaleInfoA, GetACP, InterlockedExchange, CreateFileA, GetLastError<BR>> msimg32.dll: GradientFill<BR>> msvcp71.dll: __Nomemory@std@@YAXXZ, __1_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAE@XZ, __0_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAE@ABV01@@Z, __0_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAE@PBD@Z, __Y_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAEAAV01@PBD@Z, _c_str@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QBEPBDXZ, __$_8DU_$char_traits@D@std@@V_$allocator@D@1@@std@@YA_NABV_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@0@0@Z<BR>> msvcr71.dll: _itoa, _strcmpi, _controlfp, _hypot, _stricmp, __3@YAXPAX@Z, _vscprintf, vsprintf, memmove, _CxxThrowException, __CxxFrameHandler, malloc, free, _except_handler3, __0exception@@QAE@ABV0@@Z, _mbsrchr, sscanf, ___V@YAXPAX@Z, qsort, strrchr, _mbscmp, sprintf, _stat, __1exception@@UAE@XZ, __0exception@@QAE@XZ, atof, strstr, strchr, _mbsstr, floor, _mbsicmp, _splitpath, _mbschr, rand, _mbsnbicmp, atoi, _purecall, _beginthreadex, realloc, printf, __RTDynamicCast, _CIpow, ceil, calloc, strncpy, wcslen, _mbsbtype, _stricoll, _strnicoll, isleadbyte, memchr, _endthreadex, _callnewh, memset, __security_error_handler, __1type_info@@UAE@XZ, __dllonexit, _onexit, _c_exit, _exit, _XcptFilter, _ismbblead, _cexit, exit, _acmdln, _amsg_exit, __getmainargs, _initterm, __setusermatherr, _adjust_fdiv, __p__commode, __p__fmode, __set_app_type, _terminate@@YAXXZ<BR>> ole32.dll: CoCreateInstance<BR>> shell32.dll: SHFileOperationA, SHGetPathFromIDListA, SHGetSpecialFolderLocation, ExtractIconExA, ShellExecuteA, SHGetFileInfoA, -, -, SHGetMalloc<BR>> shellintmgr31.dll: ShlInt_VerifyAssociations_XMLFile, ShlInt_PerformAssociations_XMLFile<BR>> shlwapi.dll: PathFileExistsA<BR>> user32.dll: ReleaseCapture, RegisterWindowMessageA, SetWindowTextA, IsRectEmpty, ClientToScreen, DrawFrameControl, TrackPopupMenu, TrackPopupMenuEx, GetMenuItemInfoA, SetMenuItemInfoA, EnumWindows, GetWindowThreadProcessId, MapWindowPoints, GetSubMenu, GetFocus, CallWindowProcA, ScreenToClient, GetMenuItemCount, GetMenuStringA, GetClassNameA, GetSysColor, PostMessageA, GetDC, ReleaseDC, GetKeyState, GetCursorPos, SetFocus, LockWindowUpdate, SetWindowPos, KillTimer, GetCursor, SetCursor, CheckMenuItem, GetClassInfoA, RegisterClassA, DestroyMenu, LoadMenuA, MonitorFromWindow, GetMonitorInfoA, EnableMenuItem, LoadBitmapA, SetRect, SetWindowPlacement, GetClientRect, IsWindowVisible, DialogBoxParamA, FillRect, FrameRect, SetWindowLongA, GetWindowLongA, CheckDlgButton, EnableWindow, GetDlgItem, wsprintfA, SetDlgItemTextA, SendDlgItemMessageA, GetDlgItemTextA, EndDialog, IsDlgButtonChecked, InvalidateRect, SetWindowsHookExA, CallNextHookEx, CreateWindowExA, LoadIconA, LoadCursorA, GetClassInfoExA, RegisterClassExA, CreateDialogParamA, SetRectEmpty, PtInRect, SetCursorPos, MessageBeep, ShowCursor, DestroyCursor, InflateRect, DrawFocusRect, SetCapture, DrawTextA, GetCapture, GetUpdateRect, CloseClipboard, RegisterClipboardFormatA, SetClipboardData, EmptyClipboard, OpenClipboard, EqualRect, SetWindowRgn, GetSysColorBrush, GetDesktopWindow, CharNextA, InvalidateRgn, ScrollWindowEx, DialogBoxIndirectParamA, IsDialogMessageA, SetParent, GetParent, IsChild, MoveWindow, ShowWindow, UpdateWindow, DefWindowProcA, BeginPaint, EndPaint, LoadImageA, DestroyIcon, DestroyWindow, UnhookWindowsHookEx, TranslateMessage, DispatchMessageA, PeekMessageA, SendMessageA, GetMessageA, LoadStringA, MessageBoxA, PostQuitMessage, SetTimer, OffsetRect, SystemParametersInfoA, IsIconic, GetWindowPlacement, GetWindowRect, GetSystemMetrics, SetForegroundWindow, IsWindow, CharUpperA, CharLowerA, FindWindowA<BR>> version.dll: GetFileVersionInfoSizeA, GetFileVersionInfoA, VerQueryValueA<BR> <BR> ( 0 exports )<BR>
TrID : File type identification<BR>Win32 Executable MS Visual C++ (generic) (75.0%)<BR>Win32 Executable Generic (16.9%)<BR>Generic Win/DOS Executable (3.9%)<BR>DOS Executable Generic (3.9%)<BR>Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
ssdeep: 6144:Q1Q6EId4s8/jgoXiQa/fJIvGUctmOFTcuvwDT5w1x/gygs3CRAP14dAIpgNu:QGcd4s8/jg9/RI0tmO6rDTWeLhKIuNu
sigcheck: publisher....: ACD Systems Ltd.<BR>copyright....: Copyright (C) 2006<BR>product......: ACDSee Quick View<BR>description..: ACDSee 9 Photo Manager<BR>original name: QuickView.exe<BR>internal name: ACDSee<BR>file version.: 1,0,68,1<BR>comments.....: Comments<BR>signers......: -<BR>signing date.: -<BR>verified.....: Unsigned<BR>
PEiD : -
RDS : NSRL Reference Data Set<BR>-
Nahoru
Uživatelský avatar
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 říj 2008 08:02

Re: win32:malware-gen

#10 Příspěvek od motji »

:D tak o moc chytřejší nejsem.
4 detekce jsou docela dost, i když známé AV firmy mlčí.

Já bych Vám doporučila soubor odeslat na analýzu do Avastu, ta možnost tam je. Počkejte tak týden a přímo ve virové truhle se dá otestovat znovu.
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
kaspy
Návštěvník
Návštěvník
Příspěvky: 8
Registrován: 11 bře 2010 11:47

Re: win32:malware-gen

#11 Příspěvek od kaspy »

Avast pri opatovnom teste virus nehlasi...
dakujem za pomoc
Nahoru
Uživatelský avatar
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 říj 2008 08:02

Re: win32:malware-gen

#12 Příspěvek od motji »

:)

:arrow: spusťte přejmenované HJT C:\Program Files\trend micro\Marco.exe , má tuto ikonku Obrázek

- Klikněte na "Do a system scan only"
- U řádku
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - - (no file)

- Dejte fajfku do čtverečku a zmáčkněte Fix checked
- restartujte pc


:arrow: pokud nepoužíváte,odinstalujte přes přidat/odebrat programy ICQ TOOLBAR


:arrow: Z mého podpisu stahněte Ccleaner
- nainstalujte, při výběru, co se má nainstalovat, dejte pryč fajfku u instalace yahoo toolbaru

Obrázekzáložka čistič
-nechejte v levém sloupečku zatrhnuté vše jak je, klikněte na analyzovat
-po analýze klikněte na Spustit Ccleaner

Obrázekzáložka Registry
- klikněte na hledej problémy
- pak klikněte na opravit vybrané problémy -- udělat zálohu registrů - nemusíte
- kliknete opravit všechny problémy :arrow: ok :arrow: zavřít

Obrázek Záložka Nástroje
- zde můžete odinstalovat programy. Je to důkladnější odinstalace než u přidat/odebrat programy ve Windows.

Ccleaner - čistič doporučuji používat, krásně pročistí pc od dočasných souborů.
Registry pročistí třeba po odinstalaci nějakého programu.


Jsou s počítačem nějaké problémy? :) . Pokud ne, je to vše.
Není zač :)
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
kaspy
Návštěvník
Návštěvník
Příspěvky: 8
Registrován: 11 bře 2010 11:47

Re: win32:malware-gen

#13 Příspěvek od kaspy »

Dakujem za pomoc, pocitac bezi ako ma :)
CCleaner pouzivam uz dlhsiu dobu no sem tam nanho zabudnem :)

Este raz vdaka
Nahoru
Uživatelský avatar
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 říj 2008 08:02

Re: win32:malware-gen

#14 Příspěvek od motji »

Není zač :)
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
Odpovědět

Zpět na „Řešení problémů, logy“