VIRUS - Skryte subory na usb
Napsal: 21 dub 2013 12:59
Zdravím Vás,
chcel by som poprosiť o radu...opätovne som dostal vírus s týmto popisom:
USB som pichol do notebooku a USB-cko sa mi otvorilo takým spôsobom, že sa mi tam nezobrazili súbory ako by sa mali normálne zobraziť, ale nezobrazilo absolútne nič. žiadne súbory --- Ako keby na ňom nebolo nič nahraté...pritom, keď si otvorím vlastnosti USB tak mi píše, že využité miesto 2 Gb z 3 ... čiže súbory by tam mali byť, akurát sa k nim neviem dostať.
Vďaka za pomoc .
Logfile of random's system information tool 1.09 (written by random/random)
Run by Marek at 2013-04-21 13:49:14
Microsoft Windows 7 Home Basic Service Pack 1
System drive C: has 18 GB (44%) free of 41 GB
Total RAM: 1014 MB (45% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:49:27, on 21. 4. 2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v8.00 (8.00.7601.17514)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Users\Marek\Downloads\RSIT.exe
C:\Program Files\trend micro\Marek.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL
O2 - BHO: QUICKfind BHO Object - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - C:\PROGRA~1\IDM\QUICKF~1\PlugIns\IEHelp.dll
O4 - HKLM\..\Run: [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
--
End of file - 1984 bytes
======Scheduled tasks folder======
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4041266699-321728482-1265548969-1000Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4041266699-321728482-1265548969-1000UA.job
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL [2010-02-28 561552]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C08DF07A-3E49-4E25-9AB0-D3882835F153}]
QUICKfind BHO Object - C:\PROGRA~1\IDM\QUICKF~1\PlugIns\IEHelp.dll [2007-02-16 457216]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"BCSSync"=C:\Program Files\Microsoft Office\Office14\BCSSync.exe [2010-03-13 91520]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2013-03-04 5078504]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-20 1174016]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=3
"NoDriveTypeAutoRun"=0
"NoDrives"=0
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=3
"NoDriveTypeAutoRun"=0
"NoDrives"=0
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=l3codecp.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"VIDC.XVID"=xvidvfw.dll
"VIDC.YV12"=xvidvfw.dll
"msacm.ac3acm"=ac3acm.acm
"msacm.lameacm"=lameACM.acm
"VIDC.FFDS"=ff_vfw.dll
======File associations======
.js - edit - C:\Windows\System32\Notepad.exe %1
======List of files/folders created in the last 1 month======
2013-03-31 11:58:34 ----SHD---- C:\$RECYCLE.BIN
2013-03-31 11:58:24 ----A---- C:\ComboFix.txt
2013-03-31 11:53:02 ----D---- C:\Windows\temp
2013-03-31 11:38:26 ----A---- C:\Windows\zip.exe
2013-03-31 11:38:26 ----A---- C:\Windows\SWSC.exe
2013-03-31 11:38:26 ----A---- C:\Windows\SWREG.exe
2013-03-31 11:38:26 ----A---- C:\Windows\sed.exe
2013-03-31 11:38:26 ----A---- C:\Windows\PEV.exe
2013-03-31 11:38:26 ----A---- C:\Windows\NIRCMD.exe
2013-03-31 11:38:26 ----A---- C:\Windows\MBR.exe
2013-03-31 11:38:26 ----A---- C:\Windows\grep.exe
2013-03-31 11:38:03 ----D---- C:\Qoobox
2013-03-31 11:37:32 ----D---- C:\Windows\erdnt
2013-03-31 11:33:14 ----RAD---- C:\Autorun.inf
2013-03-31 11:24:55 ----A---- C:\UsbFix.txt
2013-03-31 11:24:52 ----D---- C:\UsbFix
2013-03-31 11:05:52 ----A---- C:\Windows\system32\drivers\mbamswissarmy.sys
2013-03-30 18:35:10 ----D---- C:\Program Files\trend micro
2013-03-30 18:35:04 ----D---- C:\rsit
2013-03-29 16:11:19 ----D---- C:\Users\Marek\AppData\Roaming\Malwarebytes
2013-03-29 16:10:49 ----D---- C:\ProgramData\Malwarebytes
2013-03-29 15:12:50 ----D---- C:\Program Files\Recuva
2013-03-29 14:52:21 ----D---- C:\ProgramData\ESET
2013-03-29 14:52:21 ----D---- C:\Program Files\ESET
2013-03-26 10:50:17 ----D---- C:\Users\Marek\AppData\Roaming\{4C766D83-785B-4C68-8FFF-64FFE9A5AFE9}
2013-03-26 10:49:33 ----D---- C:\Users\Marek\AppData\Roaming\{E287A29A-E0C0-4805-9623-C43280552DDA}
2013-03-26 10:48:48 ----D---- C:\Temp
======List of files/folders modified in the last 1 month======
2013-04-21 06:15:39 ----D---- C:\Windows\system32\config
2013-04-21 06:07:15 ----D---- C:\Windows\System32
2013-04-21 06:07:15 ----D---- C:\Windows\inf
2013-04-21 06:07:15 ----A---- C:\Windows\system32\PerfStringBackup.INI
2013-04-19 18:44:42 ----D---- C:\Users\Marek\AppData\Roaming\AIMP3
2013-04-18 17:53:03 ----D---- C:\Users\Marek\AppData\Roaming\vlc
2013-04-15 13:12:04 ----D---- C:\Windows\system32\FxsTmp
2013-04-03 19:38:34 ----D---- C:\Windows\system32\catroot2
2013-03-31 11:57:13 ----SHD---- C:\System Volume Information
2013-03-31 11:53:56 ----D---- C:\Windows
2013-03-31 11:53:56 ----A---- C:\Windows\system.ini
2013-03-31 11:53:36 ----D---- C:\Windows\system32\drivers\etc
2013-03-31 11:51:27 ----D---- C:\Program Files
2013-03-31 11:47:17 ----D---- C:\Windows\system32\drivers
2013-03-31 11:47:17 ----D---- C:\Windows\AppPatch
2013-03-31 11:47:10 ----D---- C:\Program Files\Common Files
2013-03-29 16:10:49 ----D---- C:\ProgramData
2013-03-29 15:58:13 ----SD---- C:\ProgramData\Microsoft
2013-03-29 15:57:42 ----SD---- C:\Users\Marek\AppData\Roaming\Microsoft
2013-03-29 14:54:45 ----SHD---- C:\Windows\Installer
2013-03-29 14:53:59 ----D---- C:\Windows\system32\DriverStore
2013-03-29 14:53:59 ----D---- C:\Windows\system32\catroot
2013-03-29 14:36:49 ----D---- C:\Windows\Prefetch
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R1 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2013-02-14 171680]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2013-01-10 122240]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R2 epfwwfpr;epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys [2013-01-10 105760]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athr.sys [2009-07-14 1096704]
R3 BthEnum;Bluetooth Request Block Driver; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 34816]
R3 BthPan;Bluetooth Device (Personal Area Network); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 93696]
R3 BTHUSB;Bluetooth Radio USB Driver; C:\Windows\System32\Drivers\BTHUSB.sys [2010-11-20 60416]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2009-06-10 4756480]
R3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20); C:\Windows\system32\DRIVERS\L1C62x86.sys [2009-07-14 50688]
R3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 129536]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2010-11-20 84992]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 14336]
S2 Parvdm;Parvdm; C:\Windows\system32\drivers\parvdm.sys [2009-07-14 8704]
S3 aic78xx;aic78xx; C:\Windows\system32\drivers\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-14 229888]
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 78336]
S3 BTHPORT;Bluetooth Port Driver; C:\Windows\System32\Drivers\BTHport.sys [2010-11-20 393216]
S3 catchme;catchme; \??\C:\Users\Marek\AppData\Local\Temp\catchme.sys []
S3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\Windows\system32\drivers\mbamswissarmy.sys [2013-03-31 40776]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 52224]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
S3 usbscan;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 35840]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\drivers\viac7.sys [2009-07-14 52736]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 35968]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2013-03-04 1341664]
R3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
-----------------EOF-----------------
chcel by som poprosiť o radu...opätovne som dostal vírus s týmto popisom:
USB som pichol do notebooku a USB-cko sa mi otvorilo takým spôsobom, že sa mi tam nezobrazili súbory ako by sa mali normálne zobraziť, ale nezobrazilo absolútne nič. žiadne súbory --- Ako keby na ňom nebolo nič nahraté...pritom, keď si otvorím vlastnosti USB tak mi píše, že využité miesto 2 Gb z 3 ... čiže súbory by tam mali byť, akurát sa k nim neviem dostať.
Vďaka za pomoc .
Logfile of random's system information tool 1.09 (written by random/random)
Run by Marek at 2013-04-21 13:49:14
Microsoft Windows 7 Home Basic Service Pack 1
System drive C: has 18 GB (44%) free of 41 GB
Total RAM: 1014 MB (45% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:49:27, on 21. 4. 2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v8.00 (8.00.7601.17514)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Users\Marek\Downloads\RSIT.exe
C:\Program Files\trend micro\Marek.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL
O2 - BHO: QUICKfind BHO Object - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - C:\PROGRA~1\IDM\QUICKF~1\PlugIns\IEHelp.dll
O4 - HKLM\..\Run: [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
--
End of file - 1984 bytes
======Scheduled tasks folder======
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4041266699-321728482-1265548969-1000Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4041266699-321728482-1265548969-1000UA.job
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL [2010-02-28 561552]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C08DF07A-3E49-4E25-9AB0-D3882835F153}]
QUICKfind BHO Object - C:\PROGRA~1\IDM\QUICKF~1\PlugIns\IEHelp.dll [2007-02-16 457216]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"BCSSync"=C:\Program Files\Microsoft Office\Office14\BCSSync.exe [2010-03-13 91520]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2013-03-04 5078504]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-20 1174016]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=3
"NoDriveTypeAutoRun"=0
"NoDrives"=0
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=3
"NoDriveTypeAutoRun"=0
"NoDrives"=0
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=l3codecp.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"VIDC.XVID"=xvidvfw.dll
"VIDC.YV12"=xvidvfw.dll
"msacm.ac3acm"=ac3acm.acm
"msacm.lameacm"=lameACM.acm
"VIDC.FFDS"=ff_vfw.dll
======File associations======
.js - edit - C:\Windows\System32\Notepad.exe %1
======List of files/folders created in the last 1 month======
2013-03-31 11:58:34 ----SHD---- C:\$RECYCLE.BIN
2013-03-31 11:58:24 ----A---- C:\ComboFix.txt
2013-03-31 11:53:02 ----D---- C:\Windows\temp
2013-03-31 11:38:26 ----A---- C:\Windows\zip.exe
2013-03-31 11:38:26 ----A---- C:\Windows\SWSC.exe
2013-03-31 11:38:26 ----A---- C:\Windows\SWREG.exe
2013-03-31 11:38:26 ----A---- C:\Windows\sed.exe
2013-03-31 11:38:26 ----A---- C:\Windows\PEV.exe
2013-03-31 11:38:26 ----A---- C:\Windows\NIRCMD.exe
2013-03-31 11:38:26 ----A---- C:\Windows\MBR.exe
2013-03-31 11:38:26 ----A---- C:\Windows\grep.exe
2013-03-31 11:38:03 ----D---- C:\Qoobox
2013-03-31 11:37:32 ----D---- C:\Windows\erdnt
2013-03-31 11:33:14 ----RAD---- C:\Autorun.inf
2013-03-31 11:24:55 ----A---- C:\UsbFix.txt
2013-03-31 11:24:52 ----D---- C:\UsbFix
2013-03-31 11:05:52 ----A---- C:\Windows\system32\drivers\mbamswissarmy.sys
2013-03-30 18:35:10 ----D---- C:\Program Files\trend micro
2013-03-30 18:35:04 ----D---- C:\rsit
2013-03-29 16:11:19 ----D---- C:\Users\Marek\AppData\Roaming\Malwarebytes
2013-03-29 16:10:49 ----D---- C:\ProgramData\Malwarebytes
2013-03-29 15:12:50 ----D---- C:\Program Files\Recuva
2013-03-29 14:52:21 ----D---- C:\ProgramData\ESET
2013-03-29 14:52:21 ----D---- C:\Program Files\ESET
2013-03-26 10:50:17 ----D---- C:\Users\Marek\AppData\Roaming\{4C766D83-785B-4C68-8FFF-64FFE9A5AFE9}
2013-03-26 10:49:33 ----D---- C:\Users\Marek\AppData\Roaming\{E287A29A-E0C0-4805-9623-C43280552DDA}
2013-03-26 10:48:48 ----D---- C:\Temp
======List of files/folders modified in the last 1 month======
2013-04-21 06:15:39 ----D---- C:\Windows\system32\config
2013-04-21 06:07:15 ----D---- C:\Windows\System32
2013-04-21 06:07:15 ----D---- C:\Windows\inf
2013-04-21 06:07:15 ----A---- C:\Windows\system32\PerfStringBackup.INI
2013-04-19 18:44:42 ----D---- C:\Users\Marek\AppData\Roaming\AIMP3
2013-04-18 17:53:03 ----D---- C:\Users\Marek\AppData\Roaming\vlc
2013-04-15 13:12:04 ----D---- C:\Windows\system32\FxsTmp
2013-04-03 19:38:34 ----D---- C:\Windows\system32\catroot2
2013-03-31 11:57:13 ----SHD---- C:\System Volume Information
2013-03-31 11:53:56 ----D---- C:\Windows
2013-03-31 11:53:56 ----A---- C:\Windows\system.ini
2013-03-31 11:53:36 ----D---- C:\Windows\system32\drivers\etc
2013-03-31 11:51:27 ----D---- C:\Program Files
2013-03-31 11:47:17 ----D---- C:\Windows\system32\drivers
2013-03-31 11:47:17 ----D---- C:\Windows\AppPatch
2013-03-31 11:47:10 ----D---- C:\Program Files\Common Files
2013-03-29 16:10:49 ----D---- C:\ProgramData
2013-03-29 15:58:13 ----SD---- C:\ProgramData\Microsoft
2013-03-29 15:57:42 ----SD---- C:\Users\Marek\AppData\Roaming\Microsoft
2013-03-29 14:54:45 ----SHD---- C:\Windows\Installer
2013-03-29 14:53:59 ----D---- C:\Windows\system32\DriverStore
2013-03-29 14:53:59 ----D---- C:\Windows\system32\catroot
2013-03-29 14:36:49 ----D---- C:\Windows\Prefetch
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R1 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2013-02-14 171680]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2013-01-10 122240]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R2 epfwwfpr;epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys [2013-01-10 105760]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athr.sys [2009-07-14 1096704]
R3 BthEnum;Bluetooth Request Block Driver; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 34816]
R3 BthPan;Bluetooth Device (Personal Area Network); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 93696]
R3 BTHUSB;Bluetooth Radio USB Driver; C:\Windows\System32\Drivers\BTHUSB.sys [2010-11-20 60416]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2009-06-10 4756480]
R3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20); C:\Windows\system32\DRIVERS\L1C62x86.sys [2009-07-14 50688]
R3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 129536]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2010-11-20 84992]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 14336]
S2 Parvdm;Parvdm; C:\Windows\system32\drivers\parvdm.sys [2009-07-14 8704]
S3 aic78xx;aic78xx; C:\Windows\system32\drivers\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-14 229888]
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 78336]
S3 BTHPORT;Bluetooth Port Driver; C:\Windows\System32\Drivers\BTHport.sys [2010-11-20 393216]
S3 catchme;catchme; \??\C:\Users\Marek\AppData\Local\Temp\catchme.sys []
S3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\Windows\system32\drivers\mbamswissarmy.sys [2013-03-31 40776]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 52224]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
S3 usbscan;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 35840]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\drivers\viac7.sys [2009-07-14 52736]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 35968]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2013-03-04 1341664]
R3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
-----------------EOF-----------------