ESET nedokaze odstranit vir

[jacho6380]

Dobry den, poprosil by som s vycistenim mojho PC, ESET mi hadze tabulku o najdeni viru ale nejde ani odstranit ani liecit, poprosim o radu, ale zda sa mi ze je zavireny viac ako jednym virom. Prikladam log:


Logfile of random's system information tool 1.08 (written by random/random)
Run by Michal at 2010-11-22 18:07:40
Microsoft Windows 7 Ultimate
System drive C: has 13 GB (8%) free of 160 GB
Total RAM: 6142 MB (31% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:07:51, on 22. 11. 2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16671)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer.exe
C:\Program Files (x86)\PowerISO\PWRISOVM.EXE
C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
C:\Program Files (x86)\uTorrent\uTorrent.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files\trend micro\Michal.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://flvdirect.iamwired.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R3 - URLSearchHook: (no name) - - (no file)
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\TRANSLAT\WebIE.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~3\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\TRANSLAT\WebIE.dll
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [NokiaMServer] C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files (x86)\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [HTC Sync Loader] "C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe" -startup
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: Dropbox.lnk = Michal\AppData\Roaming\Dropbox\bin\Dropbox.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\TRANSLAT\WebIE.dll
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\TRANSLAT\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastaviť prekladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\TRANSLAT\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\TRANSLAT\WebIE.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\TRANSLAT\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\TRANSLAT\WebIE.dll
O9 - Extra 'Tools' menuitem: Preložiť &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\TRANSLAT\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\TRANSLAT\WebIE.dll
O9 - Extra 'Tools' menuitem: Preložiť &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\TRANSLAT\WebIE.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Acronis Nonstop Backup service (afcdpsrv) - Acronis - C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: DroidExplorer Service (DroidExplorerService) - Ryan Conrad - C:\Program Files\Droid Explorer\DroidExplorer.Service.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: FLEXnet Licensing Service 64 - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: LMIGuardianSvc - LogMeIn, Inc. - C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: ServiceLayer - Nokia - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 10998 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
"C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe"
C:\Windows\system32\nvvsvc.exe -session -first
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe"
"C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe"
"C:\Program Files\Droid Explorer\DroidExplorer.Service.exe"
"taskhost.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe"
"C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
"C:\Windows\WindowsMobile\wmdc.exe"
"C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
"C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe"
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
"C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer.exe" /watchfiles startup
"C:\Program Files (x86)\PowerISO\PWRISOVM.EXE"
"C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe" -startup
"C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe"
C:\Windows\system32\sppsvc.exe
"C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe"
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\SearchIndexer.exe /Embedding
C:\Windows\system32\svchost.exe -k WindowsMobile
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe" -auto
"taskhost.exe"
"C:\Program Files (x86)\uTorrent\uTorrent.exe" "C:\Users\Michal\AppData\Local\Temp\Need.for.Speed.Hot.Pursuit-RELOADED.5964640.TPB.torrent"
"C:\Windows\system32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-1862af07-8c53-46d5-9581-e50a75f27f06 -SystemEventPortName:HostProcess-c6a8793f-87ca-40c2-8824-2f6fce5a3133 -IoCancelEventPortName:HostProcess-36a7433f-9c5d-49ca-9272-bd7234a9dad1 -NonStateChangingEventPortName:HostProcess-166b7b8a-f5bf-4c34-8dad-29f7cb2cab26 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:6e0d9617-7dd1-41a2-b5b5-75140dbde0a9
"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
"C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel=5600.4726520.1006385137 "C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll" 5600 plugin \\.\pipe\gecko-crash-server-pipe.5600
adb fork-server server
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe175_ Global\UsGthrCtrlFltPipeMssGthrPipe175 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 512 516 524 65536 520
"C:\Users\Michal\Downloads\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe

======Scheduled tasks folder======

C:\Windows\tasks\At1.job
C:\Windows\tasks\At2.job
C:\Windows\tasks\At3.job
C:\Windows\tasks\At4.job
C:\Windows\tasks\At5.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL [2010-02-28 688528]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2DB66063-BB98-466A-AA0D-3E7ACF5ED853}]
WebTransBHO Class - C:\TRANSLAT\WebIE.dll [2010-09-24 503808]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype add-on for Internet Explorer - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-02-08 804136]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~3\Office14\URLREDIR.DLL [2010-02-28 561552]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2010-09-10 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{BFC32E1D-EE75-4A48-BC60-104E11EE2431} - WebTranslator - C:\TRANSLAT\WebIE.dll [2010-09-24 503808]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Acronis Scheduler2 Service"=C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [2009-09-12 357384]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2010-08-12 2916584]
"BCSSync"=C:\Program Files\Microsoft Office\Office14\BCSSync.exe [2010-03-13 112512]
"Windows Mobile Device Center"=C:\Windows\WindowsMobile\wmdc.exe [2007-05-31 660360]
"LogMeIn GUI"=C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe [2010-05-31 57928]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2010-04-01 357696]
"Nektra OEAPI"= []
"OEXPRESS"= []
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-07-14 1475072]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"TrueImageMonitor.exe"=C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [2009-09-12 5048488]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2010-05-14 248552]
"AdobeCS4ServiceManager"=C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe [2008-08-14 611712]
"NokiaMServer"=C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup []
"QuickTime Task"=C:\Program Files (x86)\QuickTime\QTTask.exe [2010-09-08 421888]
"PWRISOVM.EXE"=C:\Program Files (x86)\PowerISO\PWRISOVM.EXE [2009-11-09 180224]
"HTC Sync Loader"=C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe [2010-08-18 249856]

C:\Users\Michal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Dropbox.lnk - C:\Users\Michal\AppData\Roaming\Dropbox\bin\Dropbox.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-11-22 18:07:41 ----D---- C:\Program Files\trend micro
2010-11-22 18:07:40 ----D---- C:\rsit
2010-11-20 18:00:02 ----D---- C:\Users\Michal\AppData\Roaming\Media Player Classic
2010-11-20 08:58:14 ----D---- C:\ProgramData\EA Core
2010-11-20 08:34:31 ----A---- C:\Windows\SYSWOW64\XAudio2_6.dll
2010-11-20 08:34:31 ----A---- C:\Windows\SYSWOW64\XAPOFX1_4.dll
2010-11-20 08:34:31 ----A---- C:\Windows\SYSWOW64\xactengine3_6.dll
2010-11-20 08:34:31 ----A---- C:\Windows\SYSWOW64\X3DAudio1_7.dll
2010-11-20 08:34:31 ----A---- C:\Windows\system32\XAudio2_6.dll
2010-11-20 08:34:31 ----A---- C:\Windows\system32\XAPOFX1_4.dll
2010-11-20 08:34:31 ----A---- C:\Windows\system32\xactengine3_6.dll
2010-11-20 08:34:31 ----A---- C:\Windows\system32\X3DAudio1_7.dll
2010-11-20 08:34:30 ----A---- C:\Windows\SYSWOW64\XAudio2_5.dll
2010-11-20 08:34:30 ----A---- C:\Windows\SYSWOW64\xactengine3_5.dll
2010-11-20 08:34:30 ----A---- C:\Windows\SYSWOW64\D3DCompiler_42.dll
2010-11-20 08:34:30 ----A---- C:\Windows\system32\XAudio2_5.dll
2010-11-20 08:34:30 ----A---- C:\Windows\system32\xactengine3_5.dll
2010-11-20 08:34:30 ----A---- C:\Windows\system32\D3DCompiler_42.dll
2010-11-20 08:34:29 ----A---- C:\Windows\SYSWOW64\d3dcsx_42.dll
2010-11-20 08:34:29 ----A---- C:\Windows\system32\d3dcsx_42.dll
2010-11-20 08:34:28 ----A---- C:\Windows\SYSWOW64\D3DX9_42.dll
2010-11-20 08:34:28 ----A---- C:\Windows\SYSWOW64\d3dx11_42.dll
2010-11-20 08:34:28 ----A---- C:\Windows\SYSWOW64\d3dx10_42.dll
2010-11-20 08:34:28 ----A---- C:\Windows\system32\D3DX9_42.dll
2010-11-20 08:34:28 ----A---- C:\Windows\system32\d3dx11_42.dll
2010-11-20 08:34:28 ----A---- C:\Windows\system32\d3dx10_42.dll
2010-11-20 08:34:27 ----A---- C:\Windows\SYSWOW64\d3dx10_41.dll
2010-11-20 08:34:27 ----A---- C:\Windows\SYSWOW64\D3DCompiler_41.dll
2010-11-20 08:34:27 ----A---- C:\Windows\system32\d3dx10_41.dll
2010-11-20 08:34:27 ----A---- C:\Windows\system32\D3DCompiler_41.dll
2010-11-20 08:34:26 ----A---- C:\Windows\SYSWOW64\XAudio2_4.dll
2010-11-20 08:34:26 ----A---- C:\Windows\SYSWOW64\XAPOFX1_3.dll
2010-11-20 08:34:26 ----A---- C:\Windows\SYSWOW64\D3DX9_41.dll
2010-11-20 08:34:26 ----A---- C:\Windows\system32\XAudio2_4.dll
2010-11-20 08:34:26 ----A---- C:\Windows\system32\XAPOFX1_3.dll
2010-11-20 08:34:26 ----A---- C:\Windows\system32\D3DX9_41.dll
2010-11-20 08:34:25 ----A---- C:\Windows\SYSWOW64\xactengine3_4.dll
2010-11-20 08:34:25 ----A---- C:\Windows\SYSWOW64\X3DAudio1_6.dll
2010-11-20 08:34:25 ----A---- C:\Windows\system32\xactengine3_4.dll
2010-11-20 08:34:25 ----A---- C:\Windows\system32\X3DAudio1_6.dll
2010-11-20 08:34:24 ----A---- C:\Windows\SYSWOW64\d3dx10_40.dll
2010-11-20 08:34:24 ----A---- C:\Windows\SYSWOW64\D3DCompiler_40.dll
2010-11-20 08:34:24 ----A---- C:\Windows\system32\d3dx10_40.dll
2010-11-20 08:34:24 ----A---- C:\Windows\system32\D3DCompiler_40.dll
2010-11-20 08:34:23 ----A---- C:\Windows\SYSWOW64\D3DX9_40.dll
2010-11-20 08:34:23 ----A---- C:\Windows\system32\D3DX9_40.dll
2010-11-20 08:34:22 ----A---- C:\Windows\SYSWOW64\XAudio2_3.dll
2010-11-20 08:34:22 ----A---- C:\Windows\SYSWOW64\XAPOFX1_2.dll
2010-11-20 08:34:22 ----A---- C:\Windows\SYSWOW64\xactengine3_3.dll
2010-11-20 08:34:22 ----A---- C:\Windows\SYSWOW64\X3DAudio1_5.dll
2010-11-20 08:34:22 ----A---- C:\Windows\system32\XAudio2_3.dll
2010-11-20 08:34:22 ----A---- C:\Windows\system32\XAPOFX1_2.dll
2010-11-20 08:34:22 ----A---- C:\Windows\system32\xactengine3_3.dll
2010-11-20 08:34:22 ----A---- C:\Windows\system32\X3DAudio1_5.dll
2010-11-20 08:34:21 ----A---- C:\Windows\SYSWOW64\XAudio2_2.dll
2010-11-20 08:34:21 ----A---- C:\Windows\SYSWOW64\XAPOFX1_1.dll
2010-11-20 08:34:21 ----A---- C:\Windows\SYSWOW64\xactengine3_2.dll
2010-11-20 08:34:21 ----A---- C:\Windows\system32\XAudio2_2.dll
2010-11-20 08:34:21 ----A---- C:\Windows\system32\XAPOFX1_1.dll
2010-11-20 08:34:21 ----A---- C:\Windows\system32\xactengine3_2.dll
2010-11-20 08:34:20 ----A---- C:\Windows\SYSWOW64\d3dx10_39.dll
2010-11-20 08:34:20 ----A---- C:\Windows\SYSWOW64\D3DCompiler_39.dll
2010-11-20 08:34:20 ----A---- C:\Windows\system32\d3dx10_39.dll
2010-11-20 08:34:20 ----A---- C:\Windows\system32\D3DCompiler_39.dll
2010-11-20 08:34:19 ----A---- C:\Windows\SYSWOW64\D3DX9_39.dll
2010-11-20 08:34:19 ----A---- C:\Windows\system32\D3DX9_39.dll
2010-11-20 08:34:18 ----A---- C:\Windows\SYSWOW64\XAudio2_1.dll
2010-11-20 08:34:18 ----A---- C:\Windows\SYSWOW64\XAPOFX1_0.dll
2010-11-20 08:34:18 ----A---- C:\Windows\SYSWOW64\xactengine3_1.dll
2010-11-20 08:34:18 ----A---- C:\Windows\system32\XAudio2_1.dll
2010-11-20 08:34:18 ----A---- C:\Windows\system32\XAPOFX1_0.dll
2010-11-20 08:34:18 ----A---- C:\Windows\system32\xactengine3_1.dll
2010-11-20 08:34:17 ----A---- C:\Windows\SYSWOW64\X3DAudio1_4.dll
2010-11-20 08:34:17 ----A---- C:\Windows\system32\X3DAudio1_4.dll
2010-11-20 08:34:16 ----A---- C:\Windows\SYSWOW64\d3dx10_38.dll
2010-11-20 08:34:16 ----A---- C:\Windows\SYSWOW64\D3DCompiler_38.dll
2010-11-20 08:34:16 ----A---- C:\Windows\system32\d3dx10_38.dll
2010-11-20 08:34:16 ----A---- C:\Windows\system32\D3DCompiler_38.dll
2010-11-20 08:34:15 ----A---- C:\Windows\SYSWOW64\D3DX9_38.dll
2010-11-20 08:34:15 ----A---- C:\Windows\system32\D3DX9_38.dll
2010-11-20 08:34:14 ----A---- C:\Windows\SYSWOW64\XAudio2_0.dll
2010-11-20 08:34:14 ----A---- C:\Windows\SYSWOW64\xactengine3_0.dll
2010-11-20 08:34:14 ----A---- C:\Windows\SYSWOW64\X3DAudio1_3.dll
2010-11-20 08:34:14 ----A---- C:\Windows\system32\XAudio2_0.dll
2010-11-20 08:34:14 ----A---- C:\Windows\system32\xactengine3_0.dll
2010-11-20 08:34:14 ----A---- C:\Windows\system32\X3DAudio1_3.dll
2010-11-20 08:34:12 ----A---- C:\Windows\SYSWOW64\d3dx10_37.dll
2010-11-20 08:34:12 ----A---- C:\Windows\SYSWOW64\D3DCompiler_37.dll
2010-11-20 08:34:12 ----A---- C:\Windows\system32\d3dx10_37.dll
2010-11-20 08:34:12 ----A---- C:\Windows\system32\D3DCompiler_37.dll
2010-11-20 08:34:10 ----A---- C:\Windows\SYSWOW64\xactengine2_10.dll
2010-11-20 08:34:10 ----A---- C:\Windows\SYSWOW64\D3DX9_37.dll
2010-11-20 08:34:10 ----A---- C:\Windows\system32\xactengine2_10.dll
2010-11-20 08:34:10 ----A---- C:\Windows\system32\D3DX9_37.dll
2010-11-20 08:34:08 ----A---- C:\Windows\SYSWOW64\d3dx10_36.dll
2010-11-20 08:34:08 ----A---- C:\Windows\SYSWOW64\D3DCompiler_36.dll
2010-11-20 08:34:08 ----A---- C:\Windows\system32\d3dx10_36.dll
2010-11-20 08:34:08 ----A---- C:\Windows\system32\D3DCompiler_36.dll
2010-11-20 08:34:07 ----A---- C:\Windows\SYSWOW64\xactengine2_9.dll
2010-11-20 08:34:07 ----A---- C:\Windows\SYSWOW64\d3dx9_36.dll
2010-11-20 08:34:07 ----A---- C:\Windows\system32\xactengine2_9.dll
2010-11-20 08:34:07 ----A---- C:\Windows\system32\d3dx9_36.dll
2010-11-20 08:34:06 ----A---- C:\Windows\SYSWOW64\d3dx10_35.dll
2010-11-20 08:34:06 ----A---- C:\Windows\SYSWOW64\D3DCompiler_35.dll
2010-11-20 08:34:06 ----A---- C:\Windows\system32\d3dx10_35.dll
2010-11-20 08:34:06 ----A---- C:\Windows\system32\D3DCompiler_35.dll
2010-11-20 08:34:05 ----A---- C:\Windows\SYSWOW64\d3dx9_35.dll
2010-11-20 08:34:05 ----A---- C:\Windows\system32\d3dx9_35.dll
2010-11-20 08:34:04 ----A---- C:\Windows\SYSWOW64\xactengine2_8.dll
2010-11-20 08:34:04 ----A---- C:\Windows\SYSWOW64\X3DAudio1_2.dll
2010-11-20 08:34:04 ----A---- C:\Windows\SYSWOW64\d3dx10_34.dll
2010-11-20 08:34:04 ----A---- C:\Windows\SYSWOW64\D3DCompiler_34.dll
2010-11-20 08:34:04 ----A---- C:\Windows\system32\xactengine2_8.dll
2010-11-20 08:34:04 ----A---- C:\Windows\system32\X3DAudio1_2.dll
2010-11-20 08:34:04 ----A---- C:\Windows\system32\d3dx10_34.dll
2010-11-20 08:34:04 ----A---- C:\Windows\system32\D3DCompiler_34.dll
2010-11-20 08:34:03 ----A---- C:\Windows\SYSWOW64\xinput1_3.dll
2010-11-20 08:34:03 ----A---- C:\Windows\SYSWOW64\xactengine2_7.dll
2010-11-20 08:34:03 ----A---- C:\Windows\SYSWOW64\d3dx9_34.dll
2010-11-20 08:34:03 ----A---- C:\Windows\system32\xinput1_3.dll
2010-11-20 08:34:03 ----A---- C:\Windows\system32\xactengine2_7.dll
2010-11-20 08:34:03 ----A---- C:\Windows\system32\d3dx9_34.dll
2010-11-20 08:34:02 ----A---- C:\Windows\SYSWOW64\d3dx10_33.dll
2010-11-20 08:34:02 ----A---- C:\Windows\SYSWOW64\D3DCompiler_33.dll
2010-11-20 08:34:02 ----A---- C:\Windows\system32\d3dx10_33.dll
2010-11-20 08:34:02 ----A---- C:\Windows\system32\D3DCompiler_33.dll
2010-11-20 08:34:01 ----A---- C:\Windows\SYSWOW64\xactengine2_6.dll
2010-11-20 08:34:01 ----A---- C:\Windows\SYSWOW64\d3dx9_33.dll
2010-11-20 08:34:01 ----A---- C:\Windows\system32\xactengine2_6.dll
2010-11-20 08:34:01 ----A---- C:\Windows\system32\d3dx9_33.dll
2010-11-20 08:34:00 ----A---- C:\Windows\SYSWOW64\xactengine2_5.dll
2010-11-20 08:34:00 ----A---- C:\Windows\SYSWOW64\d3dx9_32.dll
2010-11-20 08:34:00 ----A---- C:\Windows\SYSWOW64\d3dx10.dll
2010-11-20 08:34:00 ----A---- C:\Windows\system32\xactengine2_5.dll
2010-11-20 08:34:00 ----A---- C:\Windows\system32\d3dx9_32.dll
2010-11-20 08:34:00 ----A---- C:\Windows\system32\d3dx10.dll
2010-11-20 08:33:59 ----A---- C:\Windows\SYSWOW64\xactengine2_4.dll
2010-11-20 08:33:59 ----A---- C:\Windows\SYSWOW64\xactengine2_3.dll
2010-11-20 08:33:59 ----A---- C:\Windows\SYSWOW64\x3daudio1_1.dll
2010-11-20 08:33:59 ----A---- C:\Windows\SYSWOW64\d3dx9_31.dll
2010-11-20 08:33:59 ----A---- C:\Windows\system32\xactengine2_4.dll
2010-11-20 08:33:59 ----A---- C:\Windows\system32\xactengine2_3.dll
2010-11-20 08:33:59 ----A---- C:\Windows\system32\x3daudio1_1.dll
2010-11-20 08:33:59 ----A---- C:\Windows\system32\d3dx9_31.dll
2010-11-20 08:33:58 ----A---- C:\Windows\SYSWOW64\xinput1_2.dll
2010-11-20 08:33:58 ----A---- C:\Windows\SYSWOW64\xinput1_1.dll
2010-11-20 08:33:58 ----A---- C:\Windows\SYSWOW64\xactengine2_2.dll
2010-11-20 08:33:58 ----A---- C:\Windows\SYSWOW64\xactengine2_1.dll
2010-11-20 08:33:58 ----A---- C:\Windows\system32\xinput1_2.dll
2010-11-20 08:33:58 ----A---- C:\Windows\system32\xinput1_1.dll
2010-11-20 08:33:58 ----A---- C:\Windows\system32\xactengine2_2.dll
2010-11-20 08:33:58 ----A---- C:\Windows\system32\xactengine2_1.dll
2010-11-20 08:33:54 ----A---- C:\Windows\SYSWOW64\xactengine2_0.dll
2010-11-20 08:33:54 ----A---- C:\Windows\SYSWOW64\x3daudio1_0.dll
2010-11-20 08:33:54 ----A---- C:\Windows\SYSWOW64\d3dx9_30.dll
2010-11-20 08:33:54 ----A---- C:\Windows\system32\xactengine2_0.dll
2010-11-20 08:33:54 ----A---- C:\Windows\system32\x3daudio1_0.dll
2010-11-20 08:33:54 ----A---- C:\Windows\system32\d3dx9_30.dll
2010-11-20 08:33:53 ----A---- C:\Windows\SYSWOW64\d3dx9_29.dll
2010-11-20 08:33:53 ----A---- C:\Windows\SYSWOW64\d3dx9_28.dll
2010-11-20 08:33:53 ----A---- C:\Windows\system32\d3dx9_29.dll
2010-11-20 08:33:53 ----A---- C:\Windows\system32\d3dx9_28.dll
2010-11-20 08:33:52 ----A---- C:\Windows\SYSWOW64\d3dx9_27.dll
2010-11-20 08:33:52 ----A---- C:\Windows\SYSWOW64\d3dx9_26.dll
2010-11-20 08:33:52 ----A---- C:\Windows\system32\d3dx9_27.dll
2010-11-20 08:33:52 ----A---- C:\Windows\system32\d3dx9_26.dll
2010-11-20 08:33:50 ----A---- C:\Windows\SYSWOW64\d3dx9_25.dll
2010-11-20 08:33:50 ----A---- C:\Windows\SYSWOW64\d3dx9_24.dll
2010-11-20 08:33:50 ----A---- C:\Windows\system32\d3dx9_25.dll
2010-11-20 08:33:50 ----A---- C:\Windows\system32\d3dx9_24.dll
2010-11-14 16:00:12 ----D---- C:\Program Files (x86)\Activision
2010-11-13 12:33:25 ----D---- C:\Games
2010-11-12 13:26:25 ----D---- C:\Program Files (x86)\RapidShareManager
2010-11-10 20:08:47 ----D---- C:\Users\Michal\AppData\Roaming\HTC.388BC06ACDAB6261375BCE37FBA2E023C0D7EE34.1
2010-11-10 20:08:16 ----D---- C:\Users\Michal\AppData\Roaming\HTC
2010-11-03 18:07:00 ----D---- C:\Windows\Minidump
2010-11-02 18:14:10 ----A---- C:\Windows\SYSWOW64\OpenCL.dll
2010-11-02 18:14:10 ----A---- C:\Windows\SYSWOW64\nvwgf2um.dll
2010-11-02 18:14:10 ----A---- C:\Windows\SYSWOW64\nvoglv32.dll
2010-11-02 18:14:10 ----A---- C:\Windows\SYSWOW64\nvdecodemft.dll
2010-11-02 18:14:10 ----A---- C:\Windows\SYSWOW64\nvcuvid.dll
2010-11-02 18:14:10 ----A---- C:\Windows\SYSWOW64\nvcuvenc.dll
2010-11-02 18:14:10 ----A---- C:\Windows\SYSWOW64\nvcuda.dll
2010-11-02 18:14:10 ----A---- C:\Windows\SYSWOW64\nvcompiler.dll
2010-11-02 18:14:10 ----A---- C:\Windows\SYSWOW64\nvapi.dll
2010-11-02 18:14:10 ----A---- C:\Windows\system32\OpenCL.dll
2010-11-02 18:14:10 ----A---- C:\Windows\system32\nvoglv64.dll
2010-11-02 18:14:10 ----A---- C:\Windows\system32\nvgenco642030.dll
2010-11-02 18:14:10 ----A---- C:\Windows\system32\nvdispco642050.dll
2010-11-02 18:14:10 ----A---- C:\Windows\system32\nvdecodemft.dll
2010-11-02 18:14:10 ----A---- C:\Windows\system32\nvd3dumx.dll
2010-11-02 18:14:10 ----A---- C:\Windows\system32\nvcuvid.dll
2010-11-02 18:14:10 ----A---- C:\Windows\system32\nvcuvenc.dll
2010-11-02 18:14:10 ----A---- C:\Windows\system32\nvcuda.dll
2010-11-02 18:14:10 ----A---- C:\Windows\system32\nvcompiler.dll
2010-11-02 18:14:10 ----A---- C:\Windows\system32\drivers\nvlddmkm.sys
2010-10-28 10:19:36 ----A---- C:\Windows\system32\systemcpl.dll
2010-10-27 10:46:24 ----D---- C:\Program Files (x86)\Spirent Communications
2010-10-27 10:46:07 ----D---- C:\Program Files (x86)\HTC
2010-10-27 05:24:08 ----D---- C:\Program Files (x86)\PowerISO
2010-10-27 05:24:08 ----A---- C:\Windows\system32\drivers\scdemu.sys
2010-10-27 03:01:47 ----A---- C:\Windows\SYSWOW64\CPFilters.dll
2010-10-27 03:01:47 ----A---- C:\Windows\system32\msdri.dll
2010-10-27 03:01:47 ----A---- C:\Windows\system32\CPFilters.dll
2010-10-27 03:01:13 ----A---- C:\Windows\system32\drivers\Diskdump.sys
2010-10-23 08:14:11 ----D---- C:\Users\Michal\AppData\Roaming\BlackBean

======List of files/folders modified in the last 1 months======

2010-11-22 18:07:52 ----D---- C:\Windows\Temp
2010-11-22 18:07:41 ----RD---- C:\Program Files
2010-11-22 18:01:36 ----D---- C:\Users\Michal\AppData\Roaming\uTorrent
2010-11-22 13:59:57 ----D---- C:\Windows\System32
2010-11-22 13:59:57 ----D---- C:\Windows\inf
2010-11-22 13:59:57 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-11-22 06:16:27 ----D---- C:\Windows\system32\config
2010-11-20 19:55:33 ----D---- C:\Windows
2010-11-20 08:58:14 ----HD---- C:\ProgramData
2010-11-20 08:45:38 ----SHD---- C:\Windows\Installer
2010-11-20 08:45:38 ----SHD---- C:\Config.Msi
2010-11-20 08:34:32 ----D---- C:\Windows\SysWOW64
2010-11-20 08:33:58 ----RSD---- C:\Windows\assembly
2010-11-20 08:33:13 ----SHD---- C:\System Volume Information
2010-11-20 08:31:13 ----D---- C:\ProgramData\Solidshield
2010-11-19 10:11:47 ----D---- C:\Windows\Prefetch
2010-11-17 20:52:37 ----D---- C:\Windows\debug
2010-11-17 05:08:59 ----D---- C:\Users\Michal\AppData\Roaming\Dropbox
2010-11-17 05:08:52 ----D---- C:\ProgramData\NVIDIA
2010-11-17 00:00:36 ----D---- C:\Program Files (x86)\LogMeIn
2010-11-16 21:17:48 ----D---- C:\Windows\system32\catroot2
2010-11-14 16:00:12 ----D---- C:\Program Files (x86)
2010-11-13 03:01:59 ----D---- C:\ProgramData\Microsoft Help
2010-11-13 03:00:41 ----A---- C:\Windows\system32\MRT.exe
2010-11-10 18:56:38 ----D---- C:\Windows\system32\drivers
2010-11-02 18:14:31 ----D---- C:\Program Files\NVIDIA Corporation
2010-11-02 18:14:29 ----D---- C:\Windows\system32\DriverStore
2010-11-02 18:14:29 ----D---- C:\Windows\system32\catroot
2010-10-29 11:51:39 ----D---- C:\Windows\rescache
2010-10-29 02:00:31 ----D---- C:\Windows\winsxs
2010-10-29 02:00:28 ----D---- C:\Windows\AppPatch
2010-10-28 13:54:36 ----D---- C:\Program Files (x86)\Mozilla Firefox
2010-10-28 10:42:22 ----D---- C:\Windows\system32\oobe
2010-10-28 10:19:38 ----D---- C:\Windows\SYSWOW64\sk-SK
2010-10-28 10:19:38 ----D---- C:\Windows\system32\sk-SK
2010-10-28 10:19:36 ----A---- C:\Windows\SYSWOW64\slwga.dll
2010-10-28 10:19:36 ----A---- C:\Windows\system32\slwga.dll
2010-10-27 22:05:28 ----D---- C:\Windows\Microsoft.NET
2010-10-27 21:43:56 ----SD---- C:\Users\Michal\AppData\Roaming\Microsoft
2010-10-27 21:25:42 ----D---- C:\Users\Michal\AppData\Roaming\Nokia
2010-10-27 21:24:42 ----D---- C:\ProgramData\Installations
2010-10-27 21:19:10 ----DC---- C:\Windows\system32\DRVSTORE
2010-10-27 16:34:22 ----D---- C:\Windows\ehome
2010-10-27 15:01:36 ----D---- C:\Windows\Tasks
2010-10-27 15:01:36 ----D---- C:\Windows\system32\Tasks
2010-10-23 08:09:06 ----HD---- C:\Program Files (x86)\InstallShield Installation Information

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 hotcore3;hc3ServiceName; C:\Windows\system32\DRIVERS\hotcore3.sys [2010-01-17 37392]
R0 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 214096]
R0 snapman;Acronis Snapshots Manager; C:\Windows\system32\DRIVERS\snapman.sys [2010-09-10 254496]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-09-10 834544]
R0 tdrpman251;Acronis Try&Decide and Restore Points filter (build 251); C:\Windows\system32\DRIVERS\tdrpm251.sys [2010-09-10 1455648]
R0 timounter;Acronis Backup Archive Explorer; C:\Windows\system32\DRIVERS\timntr.sys [2010-09-10 929312]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 514048]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2010-07-29 141264]
R1 SCDEmu;SCDEmu; C:\Windows\system32\drivers\SCDEmu.sys [2009-11-09 91568]
R1 Uim_IM;Universal Image Mounter Plugin; C:\Windows\System32\Drivers\Uim_IMx64.sys [2010-01-17 158736]
R1 UimBus;Universal Image Mounter Controller; C:\Windows\system32\DRIVERS\uimx64.sys [2010-01-17 48144]
R2 adfs;adfs; C:\Windows\system32\drivers\adfs.sys [2008-06-27 88632]
R2 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2010-07-29 168544]
R2 epfwwfpr;epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys [2010-07-29 126320]
R2 LMIRfsDriver;LogMeIn Remote File System Driver; \??\C:\Windows\system32\drivers\LMIRfsDriver.sys [2010-05-31 72216]
R3 afcdp;afcdp; C:\Windows\system32\DRIVERS\afcdp.sys [2010-09-10 250400]
R3 lmimirr;lmimirr; C:\Windows\system32\DRIVERS\lmimirr.sys [2010-05-31 11552]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2009-03-01 187392]
R3 seehcri;Sony Ericsson seehcri Device Driver; C:\Windows\system32\DRIVERS\seehcri.sys [2010-09-26 34032]
S2 LMIInfo;LogMeIn Kernel Information Provider; \??\C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys [2010-05-31 15928]
S3 androidusb;ADB Interface Driver; C:\Windows\System32\Drivers\androidusb.sys [2009-11-01 33736]
S3 aqr9r6gt;aqr9r6gt; C:\Windows\system32\drivers\aqr9r6gt.sys []
S3 ggflt;SEMC USB Flash Driver Filter; C:\Windows\system32\DRIVERS\ggflt.sys [2010-09-26 13352]
S3 ggsemc;SEMC USB Flash Driver; C:\Windows\system32\DRIVERS\ggsemc.sys [2010-09-26 27176]
S3 HTCAND64;HTC Device Driver; C:\Windows\System32\Drivers\ANDROIDUSB.sys [2009-11-01 33736]
S3 nmwcdcx64;Nokia USB Generic; C:\Windows\system32\drivers\ccdcmbox64.sys []
S3 nmwcdnsucx64;Nokia USB Flashing Generic; C:\Windows\system32\drivers\nmwcdnsucx64.sys []
S3 nmwcdnsux64;Nokia USB Flashing Phone Parent; C:\Windows\system32\drivers\nmwcdnsux64.sys []
S3 nmwcdx64;Nokia USB Phone Parent; C:\Windows\system32\drivers\ccdcmbx64.sys []
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfdx64.sys [2008-08-28 25600]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 165376]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 6656]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 34896]
S3 upperdev;upperdev; C:\Windows\system32\DRIVERS\usbser_lowerfltx64.sys []
S3 usb_rndisx;USB RNDIS Adapter; C:\Windows\system32\DRIVERS\usb8023x.sys [2009-07-14 19968]
S3 usbscan;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 41984]
S3 usbser;USB Modem Driver; C:\Windows\system32\DRIVERS\usbser.sys [2009-07-14 32768]
S3 UsbserFilt;UsbserFilt; C:\Windows\system32\DRIVERS\usbser_lowerfltx64j.sys []
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 200272]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 21760]
S3 WinUsb;Android USB Driver; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-14 40448]
S4 LMIRfsClientNP;LMIRfsClientNP; C:\Windows\system32\drivers\LMIRfsClientNP.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AcrSch2Svc;Acronis Scheduler2 Service; C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe [2009-09-12 891432]
R2 afcdpsrv;Acronis Nonstop Backup service; C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe [2010-09-10 2326920]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 DroidExplorerService;DroidExplorer Service; C:\Program Files\Droid Explorer\DroidExplorer.Service.exe [2010-08-21 253440]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2010-08-12 810144]
R2 LMIGuardianSvc;LMIGuardianSvc; C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [2010-09-27 373640]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2010-10-16 989800]
R2 RapiMgr;@%windir%\WindowsMobile\rapimgr.dll,-104; C:\Windows\system32\svchost.exe [2009-07-14 27136]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-10-16 369256]
R2 WcesComm;@%windir%\WindowsMobile\wcescomm.dll,-40079; C:\Windows\system32\svchost.exe [2009-07-14 27136]
R3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 LMIMaint;LogMeIn Maintenance Service; C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe [2010-09-27 120712]
S2 LogMeIn;LogMeIn; C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe [2010-05-31 57920]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2010-08-12 42360]
S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2010-09-26 1038088]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2010-09-26 655624]
S3 ose64;Office 64 Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 ServiceLayer;ServiceLayer; C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe [2010-06-14 615936]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-09-11 1255736]

-----------------EOF-----------------

[Rudy]

Udělejte kompletní sken MBAM: http://www.malwarebytes.org/mbam.php a dejte log. Předem nic nemažte.

[jacho6380]

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verzia databázy: 4052

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

23. 11. 2010 12:35:06
mbam-log-2010-11-23 (12-35-06).txt

Typ kontroly: Úplná kontrola (C:\|D:\|F:\|G:\|)
Objektov kontrolovaných: 342889
Uplynulý čas: 44 min, 35 sek

Infikované služby pamäte: 0
Infikované moduly pamäte: 0
Infikované registračné kľúče: 1
Infikované registračné hodnoty: 0
Infikované položky registračných dát: 1
Infikované priečinky: 0
Infikované súbory: 4

Infikované služby pamäte:
(Škodlivé položky neboli zistené)

Infikované moduly pamäte:
(Škodlivé položky neboli zistené)

Infikované registračné kľúče:
HKEY_CURRENT_USER\SOFTWARE\AppDataLow\HavingFunOnline (Adware.BHO.FL) -> No action taken.

Infikované registračné hodnoty:
(Škodlivé položky neboli zistené)

Infikované položky registračných dát:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page (Hijack.StartPage) -> Bad: (http://flvdirect.iamwired.net/) Good: (http://www.google.com) -> No action taken.

Infikované priečinky:
(Škodlivé položky neboli zistené)

Infikované súbory:
C:\Users\Michal\Downloads\Adobe.Photoshop.CS4.CZ\APCS4EX_KGN.exe (Trojan.Downloader) -> No action taken.
C:\Users\Michal\Downloads\Pat.a.Mat.2010.TheTA.up.by.MiPe\Pat.a.Mat.2010.TheTA.up.by.MiPe\NFOviewer.exe (Malware.Packer.Krunchy) -> No action taken.
D:\Lara\Uninstall.exe (Malware.Packer.Krunchy) -> No action taken.
D:\Pat a Mat\Uninstall.exe (Malware.Packer.Krunchy) -> No action taken.

[Rudy]

Vše, co MBAM nalezl, smažte.

[jacho6380]

stale tam mam toto

[Rudy]

Toto MBR rootkit. Připravte si instalační médium Win7 a použijte bootkit remover: http://www.malwarebytes.org/mbam.php a použijte. Na systému Win7 se často stane, že po použití BR, nenastartuje systém. Ten pak budete muset opravit z instal. média.

[jacho6380]

Bootkit Remover
(c) 2009 eSage Lab
www.esagelab.com

Program version: 1.2.0.0
OS Version: Microsoft Windows 7 Ultimate Edition (build 7600), 64-bit

System volume is \\.\C:
\\.\C: -> \\.\PhysicalDrive1 at offset 0x00000000`06500000
Boot sector MD5 is: bc3a483da6e5c3ac44723f8d118141eb

Size Device Name MBR Status
--------------------------------------------
298 GB \\.\PhysicalDrive1 Unknown boot code

Unknown boot code has been found on some of your physical disks.
To inspect the boot code manually, dump the master boot sector:
remover.exe dump <device_name> [output_file]
To disinfect the master boot sector, use the following command:
remover.exe fix <device_name>


Done;
Press any key to quit...

[Rudy]

Otevřte poznámkový blok a zkopírujte do něj:

@ECHO OFF
remover.exe fix \\.\PhysicalDrive1

EXIT

Klikněte na soubor>uložit jako:
Název: fix.bat
Typ souboru: Všechny soubory
Uložte na plochu, zavřete všechna okna a poklepejte na fix.bat. Soubor se spustí a bakonec by měl restartovat PC. Pokud se tak nestane, proveďte restart ručně. Příkaz smaže vir z MBR.

[jacho6380]

to okno mi len preblikne a nic... vir je stale tam

[Rudy]

Udělejte sken MBR: http://www2.gmer.net/mbr/mbr.exe . Dejte log.

[jacho6380]

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 6.1.7600

device: opened successfully
user: error reading MBR
error: Read Popisovač nie je platný.
kernel: error reading MBR

[Rudy]

Připravte si instalační médium Win7. Buď můžete provést opravu přímo z něho, nebo použijte BootkitRemover: http://www.esagelab.com/resources.php?s=bootkit_remover . Po jeho použití ve Win7 může nastat stav, po němž systém nepůjde spustit a budete tak, jako tak nucen provést jeho opravu.

[jacho6380]

Bohuzial ho tam mam stale

[Rudy]

Zkuste opravu systému z instal. média. Někdy se podaří korektně přepsat MBR.

[jacho6380]

Aj to som skusal a je tam stale