csrss.exe

[Jiří Havel]

Dobrý den, díval sem se do procesů a tam sem našel tohle na netu sem si našel, že je to vir děkuji za pomoc



RSIT
Logfile of random's system information tool 1.07 (written by random/random)
Run by Daniel at 2010-06-29 16:11:31
Microsoft Windows 7 Home Premium
System drive C: has 21 GB (21%) free of 100 GB
Total RAM: 4094 MB (48% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 16:11:33, on 29.6.2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
C:\Program Files (x86)\Common Files\Nero\Lib\NMBgMonitor.exe
C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
C:\Program Files (x86)\DAEMON Tools Lite\DTShellHlp.exe
C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Windows Media Player\wmplayer.exe
C:\Program Files (x86)\Nero\Nero 10\Nero Burning ROM\nero.exe
C:\Program Files (x86)\Nero\Nero 10\Nero StartSmart\NeroStartSmart.exe
C:\Program Files (x86)\Nero\Nero 10\Nero StartSmart\NMDllHost.exe
C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\BackItUp.exe
C:\Windows\SysWOW64\DllHost.exe
C:\Program Files (x86)\Nero\Nero 10\Nero RescueAgent\NeroRescueAgent.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Users\Daniel\Desktop\Download\KillBox.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\Daniel\Desktop\Download\RSIT.exe
C:\Program Files (x86)\trend micro\Daniel.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource= ... =CT2014090
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Ask Toolbar BHO - {FE063DB1-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files (x86)\AskTBar\bar\1.bin\ASKTBAR.DLL (file missing)
O3 - Toolbar: Ask Toolbar - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files (x86)\AskTBar\bar\1.bin\ASKTBAR.DLL (file missing)
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [NBAgent] "C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe" /WinStart
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files (x86)\Common Files\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: Registrace Need for Speed™ Undercover.lnk = C:\Program Files (x86)\EA Games\Need for Speed Undercover\Support\EAregister.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @C:\Program Files (x86)\Nero\Update\NASvc.exe,-200 (NAUpdate) - Nero AG - C:\Program Files (x86)\Nero\Update\NASvc.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NMIndexingService - Nero AG - C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 8220 bytes

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FE063DB1-4EC0-403e-8DD8-394C54984B2C}]
Ask Toolbar BHO - C:\Program Files (x86)\AskTBar\bar\1.bin\ASKTBAR.DLL []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{FE063DB9-4EC0-403e-8DD8-394C54984B2C} - Ask Toolbar - C:\Program Files (x86)\AskTBar\bar\1.bin\ASKTBAR.DLL []

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-11-10 98304]
"avast5"=C:\Program Files\Alwil Software\Avast5\avastUI.exe [2010-06-28 2837864]
"LogMeIn Hamachi Ui"=C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [2010-03-30 1820040]
"NBKeyScan"=C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [2007-08-08 1828136]
"DivXUpdate"=C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [2010-06-03 1144104]
"NBAgent"=C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe [2010-04-03 1234216]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2010-04-01 357696]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files (x86)\Common Files\Nero\Lib\NMBgMonitor.exe [2007-08-03 202024]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-07-14 1475072]

C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Registrace Need for Speed™ Undercover.lnk - C:\Program Files (x86)\EA Games\Need for Speed Undercover\Support\EAregister.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppMgmt]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Base]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Boot Bus Extender]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Boot file system]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CryptSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\DcomLaunch]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\EFS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\EventLog]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\File system]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Filter]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HelpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Netlogon]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PCI Configuration]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PlugPlay]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PNP Filter]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Power]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Primary disk]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\RpcEptMapper]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\RpcSs]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SCSI Class]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sermouse.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\System Bus Extender]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vga.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vgasave.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vmms]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinMgmt]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{36FC9E60-C465-11CF-8056-444553540000}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E965-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E969-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E977-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97B-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E980-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AppInfo]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AppMgmt]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Base]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\BFE]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Boot Bus Extender]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Boot file system]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\bowser]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Browser]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\CryptSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\DcomLaunch]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\dfsc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Dhcp]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\DnsCache]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Dot3Svc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Eaphost]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\EFS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\EventLog]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\File system]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Filter]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\HelpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\IKEEXT]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\ipnat.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\KeyIso]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\LanmanServer]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\LanmanWorkstation]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\LmHosts]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Messenger]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MPSDrv]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MPSSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mrxsmb]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mrxsmb10]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mrxsmb20]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NativeWifiP]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NDIS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NDIS Wrapper]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\ndiscap]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Ndisuio]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetBIOS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetBIOSGroup]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetBT]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetDDEGroup]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Netlogon]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetMan]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\netprofm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Network]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetworkProvider]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NlaSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Nsi]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nsiproxy.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NTDS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PCI Configuration]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PlugPlay]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PNP Filter]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PNP_TDI]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PolicyAgent]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Power]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Primary disk]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\ProfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\rdbss]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\rdpencdd.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\rdsessmgr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\RpcEptMapper]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\RpcSs]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sacsvr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SCardSvr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SCSI Class]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sermouse.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SharedAccess]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Streams Drivers]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SWPRV]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\System Bus Extender]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TabletInputService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TBS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Tcpip]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TDI]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TrustedInstaller]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\VaultSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\VDS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vga.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vgasave.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vmms]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\volmgr.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\volmgrx.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WinMgmt]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wlansvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{36FC9E60-C465-11CF-8056-444553540000}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E965-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E967-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E969-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E96A-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E96B-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E96F-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E972-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E973-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E974-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E975-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E977-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E97B-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E97D-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E980-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{50DD5230-BA8A-11D1-BF5D-0000F805F530}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableLinkedConnections"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=
"NoActiveDesktopChanges"=
"ForceActiveDesktopOn"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e1d4b566-7959-11df-8ca7-6cf04905c3e7}]
shell\AutoRun\command - I:\Autorun.exe


======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-06-29 16:10:55 ----D---- C:\Program Files (x86)\trend micro
2010-06-29 16:10:54 ----D---- C:\rsit
2010-06-29 15:44:28 ----D---- C:\!KillBox
2010-06-29 15:14:29 ----D---- C:\NTFS 3.1
2010-06-29 14:36:08 ----D---- C:\ProgramData\Azureus
2010-06-29 14:36:07 ----D---- C:\Users\Daniel\AppData\Roaming\Azureus
2010-06-29 14:34:57 ----D---- C:\Program Files (x86)\Isohunt-vuze
2010-06-29 14:34:57 ----D---- C:\Program Files (x86)\Conduit
2010-06-29 14:34:26 ----D---- C:\Program Files (x86)\Vuze
2010-06-29 14:34:26 ----D---- C:\Program Files (x86)\Common Files\i4j_jres
2010-06-28 21:03:16 ----HD---- C:\ProgramData\CanonBJ
2010-06-27 21:42:11 ----SHD---- C:\Config.Msi
2010-06-27 21:21:59 ----D---- C:\Program Files (x86)\Microsoft.NET
2010-06-27 21:21:48 ----A---- C:\Windows\SysWOW64\D3DCompiler_42.dll
2010-06-27 21:21:39 ----A---- C:\Windows\SysWOW64\D3DX9_42.dll
2010-06-27 21:21:30 ----A---- C:\Windows\SysWOW64\D3DX9_40.dll
2010-06-27 14:18:49 ----D---- C:\Program Files (x86)\GNU
2010-06-26 15:55:52 ----D---- C:\Program Files (x86)\AC3File
2010-06-26 09:17:22 ----D---- C:\Users\Daniel\AppData\Roaming\DivX
2010-06-26 09:17:17 ----D---- C:\Program Files (x86)\Common Files\PX Storage Engine
2010-06-26 09:16:55 ----D---- C:\Program Files (x86)\Common Files\DivX Shared
2010-06-26 09:16:50 ----D---- C:\Program Files (x86)\DivX
2010-06-26 09:16:31 ----D---- C:\ProgramData\DivX
2010-06-24 17:21:07 ----D---- C:\Program Files (x86)\MSXML 4.0
2010-06-24 15:57:55 ----D---- C:\Users\Daniel\AppData\Roaming\GRETECH
2010-06-24 15:57:26 ----D---- C:\Program Files (x86)\GRETECH
2010-06-23 21:04:42 ----D---- C:\Users\Daniel\AppData\Roaming\Simple Star
2010-06-23 19:22:27 ----D---- C:\Users\Daniel\AppData\Roaming\Nero
2010-06-23 19:22:23 ----A---- C:\Windows\Irremote.ini
2010-06-23 19:19:47 ----D---- C:\ProgramData\Nero
2010-06-23 19:19:47 ----D---- C:\Program Files (x86)\Nero
2010-06-23 19:19:47 ----D---- C:\Program Files (x86)\Common Files\Nero
2010-06-23 19:00:00 ----D---- C:\Windows\SysWOW64\Wat
2010-06-23 16:51:41 ----A---- C:\Windows\SysWOW64\PresentationHostProxy.dll
2010-06-23 16:51:41 ----A---- C:\Windows\SysWOW64\PresentationHost.exe
2010-06-23 16:51:41 ----A---- C:\Windows\SysWOW64\netfxperf.dll
2010-06-23 16:51:41 ----A---- C:\Windows\SysWOW64\mscoree.dll
2010-06-23 16:51:41 ----A---- C:\Windows\SysWOW64\dfshim.dll
2010-06-23 16:42:18 ----A---- C:\Windows\SysWOW64\ntdll.dll
2010-06-23 16:42:12 ----A---- C:\Windows\SysWOW64\CPFilters.dll
2010-06-22 14:22:30 ----A---- C:\Windows\SysWOW64\PnkBstrA.exe
2010-06-22 14:22:13 ----A---- C:\Windows\SysWOW64\PnkBstrB.exe
2010-06-22 14:20:54 ----RHD---- C:\Users\Daniel\AppData\Roaming\SecuROM
2010-06-22 14:17:15 ----D---- C:\Users\Daniel\AppData\Roaming\Leadertech
2010-06-22 14:14:10 ----D---- C:\Program Files (x86)\EA Games
2010-06-22 14:14:09 ----A---- C:\Windows\SysWOW64\XAudio2_0.dll
2010-06-22 14:14:09 ----A---- C:\Windows\SysWOW64\xactengine3_0.dll
2010-06-22 14:14:09 ----A---- C:\Windows\SysWOW64\X3DAudio1_3.dll
2010-06-22 14:14:09 ----A---- C:\Windows\SysWOW64\d3dx10_37.dll
2010-06-22 14:14:09 ----A---- C:\Windows\SysWOW64\D3DCompiler_37.dll
2010-06-22 14:14:08 ----A---- C:\Windows\SysWOW64\xactengine2_10.dll
2010-06-22 14:14:08 ----A---- C:\Windows\SysWOW64\D3DX9_37.dll
2010-06-22 14:14:08 ----A---- C:\Windows\SysWOW64\d3dx9_36.dll
2010-06-22 14:14:08 ----A---- C:\Windows\SysWOW64\d3dx10_36.dll
2010-06-22 14:14:08 ----A---- C:\Windows\SysWOW64\D3DCompiler_36.dll
2010-06-22 14:14:07 ----A---- C:\Windows\SysWOW64\xactengine2_9.dll
2010-06-22 14:14:07 ----A---- C:\Windows\SysWOW64\xactengine2_8.dll
2010-06-22 14:14:07 ----A---- C:\Windows\SysWOW64\X3DAudio1_2.dll
2010-06-22 14:14:07 ----A---- C:\Windows\SysWOW64\d3dx9_35.dll
2010-06-22 14:14:07 ----A---- C:\Windows\SysWOW64\d3dx10_35.dll
2010-06-22 14:14:07 ----A---- C:\Windows\SysWOW64\D3DCompiler_35.dll
2010-06-22 14:14:06 ----A---- C:\Windows\SysWOW64\xinput1_3.dll
2010-06-22 14:14:06 ----A---- C:\Windows\SysWOW64\xactengine2_7.dll
2010-06-22 14:14:06 ----A---- C:\Windows\SysWOW64\d3dx9_34.dll
2010-06-22 14:14:06 ----A---- C:\Windows\SysWOW64\d3dx10_34.dll
2010-06-22 14:14:06 ----A---- C:\Windows\SysWOW64\d3dx10_33.dll
2010-06-22 14:14:06 ----A---- C:\Windows\SysWOW64\D3DCompiler_34.dll
2010-06-22 14:14:06 ----A---- C:\Windows\SysWOW64\D3DCompiler_33.dll
2010-06-22 14:14:05 ----A---- C:\Windows\SysWOW64\xactengine2_6.dll
2010-06-22 14:14:05 ----A---- C:\Windows\SysWOW64\d3dx9_33.dll
2010-06-22 14:14:04 ----A---- C:\Windows\SysWOW64\xactengine2_5.dll
2010-06-22 14:14:04 ----A---- C:\Windows\SysWOW64\xactengine2_4.dll
2010-06-22 14:14:04 ----A---- C:\Windows\SysWOW64\x3daudio1_1.dll
2010-06-22 14:14:04 ----A---- C:\Windows\SysWOW64\d3dx9_32.dll
2010-06-22 14:14:04 ----A---- C:\Windows\SysWOW64\d3dx9_31.dll
2010-06-22 14:14:04 ----A---- C:\Windows\SysWOW64\d3dx10.dll
2010-06-22 14:14:03 ----A---- C:\Windows\SysWOW64\xinput1_2.dll
2010-06-22 14:14:03 ----A---- C:\Windows\SysWOW64\xactengine2_3.dll
2010-06-22 14:14:03 ----A---- C:\Windows\SysWOW64\xactengine2_2.dll
2010-06-18 15:36:53 ----D---- C:\Program Files (x86)\Hamachi
2010-06-18 15:27:42 ----D---- C:\Program Files (x86)\LogMeIn Hamachi
2010-06-18 13:53:02 ----D---- C:\Users\Daniel\AppData\Roaming\Hamachi
2010-06-17 07:04:50 ----D---- C:\Users\Daniel\AppData\Roaming\WinRAR
2010-06-17 07:04:32 ----D---- C:\Program Files (x86)\WinRAR
2010-06-16 18:04:58 ----A---- C:\Windows\SysWOW64\msv1_0.dll
2010-06-16 17:38:12 ----D---- C:\ProgramData\Firefly Studios
2010-06-16 17:33:25 ----D---- C:\Program Files (x86)\GameShadow
2010-06-16 17:33:09 ----D---- C:\Windows\Downloaded Installations
2010-06-16 17:32:56 ----A---- C:\Windows\SysWOW64\xinput1_1.dll
2010-06-16 17:32:56 ----A---- C:\Windows\SysWOW64\xactengine2_1.dll
2010-06-16 17:32:54 ----A---- C:\Windows\SysWOW64\d3dx9_30.dll
2010-06-16 17:32:53 ----A---- C:\Windows\SysWOW64\xactengine2_0.dll
2010-06-16 17:32:53 ----A---- C:\Windows\SysWOW64\x3daudio1_0.dll
2010-06-16 17:32:53 ----A---- C:\Windows\SysWOW64\d3dx9_29.dll
2010-06-16 17:32:53 ----A---- C:\Windows\SysWOW64\d3dx9_28.dll
2010-06-16 17:32:52 ----A---- C:\Windows\SysWOW64\d3dx9_27.dll
2010-06-16 17:32:52 ----A---- C:\Windows\SysWOW64\d3dx9_26.dll
2010-06-16 17:32:52 ----A---- C:\Windows\SysWOW64\d3dx9_25.dll
2010-06-16 17:32:51 ----A---- C:\Windows\SysWOW64\d3dx9_24.dll
2010-06-16 17:29:42 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2010-06-16 17:29:42 ----D---- C:\Program Files (x86)\Firefly Studios
2010-06-16 17:29:22 ----D---- C:\Program Files (x86)\Common Files\InstallShield
2010-06-16 17:22:39 ----D---- C:\Program Files (x86)\Google
2010-06-16 17:21:57 ----A---- C:\Windows\SysWOW64\aswBoot.exe
2010-06-16 17:21:56 ----D---- C:\ProgramData\Alwil Software
2010-06-16 17:12:57 ----D---- C:\Program Files (x86)\DAEMON Tools Lite
2010-06-16 17:12:28 ----D---- C:\Users\Daniel\AppData\Roaming\DAEMON Tools Lite
2010-06-16 17:12:26 ----D---- C:\ProgramData\DAEMON Tools Lite
2010-06-16 16:51:36 ----D---- C:\Users\Daniel\AppData\Roaming\uTorrent
2010-06-16 16:51:04 ----D---- C:\Users\Daniel\AppData\Roaming\Mozilla
2010-06-16 16:50:48 ----D---- C:\Program Files (x86)\uTorrent
2010-06-16 16:49:53 ----D---- C:\Program Files (x86)\Mozilla Firefox
2010-06-16 16:35:42 ----A---- C:\Windows\SysWOW64\asycfilt.dll
2010-06-16 16:35:41 ----A---- C:\Windows\SysWOW64\vbscript.dll
2010-06-16 16:35:40 ----A---- C:\Windows\SysWOW64\wmp.dll
2010-06-16 16:35:39 ----A---- C:\Windows\SysWOW64\wmploc.DLL
2010-06-16 16:35:39 ----A---- C:\Windows\SysWOW64\CertEnroll.dll
2010-06-16 16:35:38 ----A---- C:\Windows\SysWOW64\secproc_ssp_isv.dll
2010-06-16 16:35:38 ----A---- C:\Windows\SysWOW64\secproc_ssp.dll
2010-06-16 16:35:38 ----A---- C:\Windows\SysWOW64\secproc_isv.dll
2010-06-16 16:35:38 ----A---- C:\Windows\SysWOW64\secproc.dll
2010-06-16 16:35:38 ----A---- C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2010-06-16 16:35:38 ----A---- C:\Windows\SysWOW64\RMActivate_ssp.exe
2010-06-16 16:35:38 ----A---- C:\Windows\SysWOW64\RMActivate_isv.exe
2010-06-16 16:35:38 ----A---- C:\Windows\SysWOW64\RMActivate.exe
2010-06-16 16:35:37 ----A---- C:\Windows\SysWOW64\t2embed.dll
2010-06-16 16:35:37 ----A---- C:\Windows\SysWOW64\inetcomm.dll
2010-06-16 16:35:35 ----A---- C:\Windows\explorer.exe
2010-06-16 16:35:34 ----A---- C:\Windows\SysWOW64\explorer.exe
2010-06-16 16:35:33 ----A---- C:\Windows\SysWOW64\wow32.dll
2010-06-16 16:35:33 ----A---- C:\Windows\SysWOW64\user.exe
2010-06-16 16:35:33 ----A---- C:\Windows\SysWOW64\setup16.exe
2010-06-16 16:35:33 ----A---- C:\Windows\SysWOW64\ntvdm64.dll
2010-06-16 16:35:33 ----A---- C:\Windows\SysWOW64\instnm.exe
2010-06-16 16:35:32 ----A---- C:\Windows\SysWOW64\quartz.dll
2010-06-16 16:35:31 ----A---- C:\Windows\SysWOW64\tsbyuv.dll
2010-06-16 16:35:31 ----A---- C:\Windows\SysWOW64\msyuv.dll
2010-06-16 16:35:31 ----A---- C:\Windows\SysWOW64\msvidc32.dll
2010-06-16 16:35:31 ----A---- C:\Windows\SysWOW64\msrle32.dll
2010-06-16 16:35:31 ----A---- C:\Windows\SysWOW64\mciavi32.dll
2010-06-16 16:35:31 ----A---- C:\Windows\SysWOW64\iyuv_32.dll
2010-06-16 16:35:31 ----A---- C:\Windows\SysWOW64\avifil32.dll
2010-06-16 16:35:30 ----A---- C:\Windows\SysWOW64\ntoskrnl.exe
2010-06-16 16:35:30 ----A---- C:\Windows\SysWOW64\ntkrnlpa.exe
2010-06-16 16:35:30 ----A---- C:\Windows\SysWOW64\jscript.dll
2010-06-16 16:35:29 ----A---- C:\Windows\SysWOW64\shell32.dll
2010-06-16 16:35:28 ----A---- C:\Windows\SysWOW64\sspicli.dll
2010-06-16 16:35:28 ----A---- C:\Windows\SysWOW64\secur32.dll
2010-06-16 16:35:27 ----A---- C:\Windows\SysWOW64\psisdecd.dll
2010-06-16 16:35:26 ----A---- C:\Windows\SysWOW64\msasn1.dll
2010-06-16 16:35:26 ----A---- C:\Windows\SysWOW64\fontsub.dll
2010-06-16 16:35:26 ----A---- C:\Windows\SysWOW64\atmlib.dll
2010-06-16 16:35:26 ----A---- C:\Windows\SysWOW64\atmfd.dll
2010-06-16 16:35:22 ----A---- C:\Windows\SysWOW64\tzres.dll
2010-06-16 16:35:19 ----A---- C:\Windows\SysWOW64\mshtml.dll
2010-06-16 16:35:18 ----A---- C:\Windows\SysWOW64\wininet.dll
2010-06-16 16:35:18 ----A---- C:\Windows\SysWOW64\urlmon.dll
2010-06-16 16:35:18 ----A---- C:\Windows\SysWOW64\mstime.dll
2010-06-16 16:35:18 ----A---- C:\Windows\SysWOW64\msfeedsbs.dll
2010-06-16 16:35:18 ----A---- C:\Windows\SysWOW64\jsproxy.dll
2010-06-16 16:35:18 ----A---- C:\Windows\SysWOW64\ieframe.dll
2010-06-16 16:35:18 ----A---- C:\Windows\SysWOW64\iedkcs32.dll
2010-06-14 20:03:41 ----D---- C:\Windows\Panther
2010-06-14 19:24:32 ----D---- C:\Users\Daniel\AppData\Roaming\ATI
2010-06-14 19:24:32 ----D---- C:\ProgramData\ATI
2010-06-14 19:22:53 ----D---- C:\Program Files (x86)\Common Files\ATI Technologies
2010-06-14 19:22:28 ----D---- C:\Users\Daniel\AppData\Roaming\Macromedia
2010-06-14 19:22:28 ----D---- C:\Users\Daniel\AppData\Roaming\Adobe
2010-06-14 19:22:26 ----D---- C:\Windows\SysWOW64\Macromed
2010-06-14 19:20:29 ----D---- C:\Program Files (x86)\ATI Technologies
2010-06-14 19:20:13 ----SHD---- C:\Windows\Installer
2010-06-14 19:15:47 ----A---- C:\Windows\SysWOW64\wintrust.dll
2010-06-14 19:15:46 ----A---- C:\Windows\SysWOW64\cabview.dll
2010-06-14 19:15:05 ----D---- C:\Users\Daniel\AppData\Roaming\Identities
2010-06-14 19:14:51 ----SD---- C:\Users\Daniel\AppData\Roaming\Microsoft
2010-06-14 19:14:51 ----D---- C:\Users\Daniel\AppData\Roaming\Media Center Programs
2010-06-14 19:14:40 ----SHD---- C:\ProgramData\Šablony
2010-06-14 19:14:39 ----SHD---- C:\ProgramData\Plocha
2010-06-14 19:14:39 ----SHD---- C:\ProgramData\Oblíbené položky
2010-06-14 19:14:39 ----SHD---- C:\ProgramData\Nabídka Start
2010-06-14 19:14:39 ----SHD---- C:\ProgramData\Dokumenty
2010-06-14 19:14:39 ----SHD---- C:\ProgramData\Data aplikací
2010-06-14 19:07:23 ----D---- C:\Windows\SoftwareDistribution
2010-06-14 19:04:45 ----D---- C:\Windows\Prefetch
2010-06-14 18:26:48 ----D---- C:\WinFast
2010-06-12 20:50:46 ----D---- C:\ClearViewRC

======List of files/folders modified in the last 1 months======

2010-06-29 16:11:32 ----D---- C:\Windows\Temp
2010-06-29 16:10:55 ----RD---- C:\Program Files (x86)
2010-06-29 14:36:08 ----HD---- C:\ProgramData
2010-06-29 14:34:57 ----RD---- C:\Users
2010-06-29 14:34:57 ----D---- C:\Windows\SysWOW64
2010-06-29 14:34:26 ----D---- C:\Program Files (x86)\Common Files
2010-06-29 14:17:28 ----D---- C:\Windows\System32
2010-06-29 14:17:27 ----D---- C:\Windows\inf
2010-06-29 14:10:37 ----D---- C:\Windows
2010-06-29 07:07:02 ----SHD---- C:\System Volume Information
2010-06-27 21:37:15 ----D---- C:\Windows\winsxs
2010-06-27 21:22:01 ----RSD---- C:\Windows\assembly
2010-06-27 21:21:22 ----D---- C:\Windows\Logs
2010-06-26 09:17:14 ----RD---- C:\Program Files
2010-06-23 21:35:54 ----D---- C:\Windows\Microsoft.NET
2010-06-23 18:22:58 ----D---- C:\Windows\AppPatch
2010-06-23 16:51:34 ----D---- C:\Windows\ehome
2010-06-22 22:01:55 ----D---- C:\Windows\rescache
2010-06-22 21:15:04 ----D---- C:\Windows\debug
2010-06-21 20:44:03 ----SD---- C:\ProgramData\Microsoft
2010-06-16 18:08:05 ----D---- C:\Program Files (x86)\Windows Media Player
2010-06-16 18:08:04 ----D---- C:\Program Files (x86)\Windows Mail
2010-06-16 18:08:03 ----D---- C:\Windows\SysWOW64\cs-CZ
2010-06-16 18:07:59 ----D---- C:\Program Files (x86)\Internet Explorer
2010-06-16 18:07:57 ----D---- C:\Windows\SysWOW64\migration
2010-06-16 17:22:43 ----D---- C:\Windows\Tasks
2010-06-16 17:22:08 ----D---- C:\Program Files (x86)\Common Files\microsoft shared
2010-06-14 19:22:28 ----D---- C:\Windows\Downloaded Program Files
2010-06-14 19:15:02 ----SHD---- C:\$Recycle.Bin
2010-06-14 19:14:40 ----SHD---- C:\Recovery

[Jiří Havel]

MBAM něco našel

1. cast http://2i.cz/f08db69c4f

2 cast http://2i.cz/c3be85af7c

[Jiří Havel]

ja taky nemám křištálovou kouli mbam skenuje

[Jiří Havel]

[Jiří Havel]

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verze databáze: 4255

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

29.6.2010 18:15:09
mbam-log-2010-06-29 (18-15-09).txt

Typ skenu: Úplný sken (C:\|)
Skenované objekty: 289048
Uplynulý čas: 55 minuta(y), 55 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 1
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované složky: 0
Infikované soubory: 1

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> No action taken.

Infikované hodnoty registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
C:\Program Files (x86)\RegGenie\RegGenieOnUninstall.exe (Spyware.Passwords) -> No action taken.