kontrola
Napsal: 14 úno 2015 13:55
dobry den chtěl bych požadat o kontrolu díky Logfile of random's system information tool 1.10 (written by random/random)
Run by adminn at 2015-02-14 13:54:01
Microsoft Windows 8 Enterprise
System drive C: has 44 GB (18%) free of 238 GB
Total RAM: 2048 MB (31% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:54:04, on 14. 2. 2015
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v10.0 (10.00.9200.17183)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskhostex.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe
C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
C:\Program Files\WinTools Software\RAM Saver Professional\RAMSaverPro.exe
C:\Program Files\Wondershare\MobileGo for Android\MobileGoService.exe
C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe
C:\Windows\system32\taskhost.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\adminn\Downloads\RSIT.exe
C:\Program Files\trend micro\adminn.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {C9C42510-9B41-42c1-9DCD-7282A2D07C61}C - (no file)
O4 - HKLM\..\Run: [Nvtmru] "C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"
O4 - HKLM\..\Run: [ShadowPlay] C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap.dll,ShadowPlayOnSystemStart
O4 - HKLM\..\Run: [NvBackend] "C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe"
O4 - HKLM\..\Run: [Wondershare Helper Compact.exe] C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
O4 - HKLM\..\Run: [WSHelperSetup.exe] C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
O4 - HKLM\..\Run: [Wondershare Helper Compact] "C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe"
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [WSHelperSetup.exe] C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
O4 - HKCU\..\Run: [RAMSaverPro] C:\Program Files\WinTools Software\RAM Saver Professional\ramsaverpro.exe
O4 - HKCU\..\Run: [Wondershare Helper Compact] "C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe"
O4 - HKUS\S-1-5-21-4280434948-3349374226-233984325-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun (User '?')
O4 - HKUS\S-1-5-21-4280434948-3349374226-233984325-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\..\Run: [WSHelperSetup.exe] C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe (User '?')
O4 - HKUS\S-1-5-21-4280434948-3349374226-233984325-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\..\Run: [RAMSaverPro] C:\Program Files\WinTools Software\RAM Saver Professional\ramsaverpro.exe (User '?')
O4 - HKUS\S-1-5-21-4280434948-3349374226-233984325-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\..\Run: [Wondershare Helper Compact] "C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe" (User '?')
O4 - Global Startup: MobileGo Service.lnk = C:\Program Files\Wondershare\MobileGo for Android\MobileGoService.exe
O4 - Global Startup: RealPlayer Cloud Service UI.lnk = C:\Program Files\Real\RealPlayer\RPDS\Bin\rpsystray.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {C8BC46C7-921C-4102-B67D-F1F7E65FB0BE} - https://battlefield.play4free.com/stati ... 0.96.0.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B6A028C3-FAEC-429E-9D39-D048A71D2B9E}: NameServer = 8.8.8.8,8.8.4.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1
O20 - Winlogon Notify: SDWinLogon - SDWinLogon.dll (file missing)
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Clean Master Core Service (cmcore) - Kingsoft Corporation - c:\program files\cmcm\Clean Master\cmcore.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: McAfee Validation Trust Protection Service (mfevtp) - Unknown owner - C:\Windows\system32\mfevtps.exe (file missing)
O23 - Service: NVIDIA Network Service (NvNetworkService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe
O23 - Service: NVIDIA Streamer Service (NvStreamSvc) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Origin Client Service - Electronic Arts - C:\Program Files\Origin\OriginClientService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: RealPlayer Cloud Service - RealNetworks, Inc. - C:\Program Files\Real\RealPlayer\RPDS\Bin\rpdsvc.exe
O23 - Service: Spybot-S&D 2 Scanner Service (SDScannerService) - Safer-Networking Ltd. - C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe
O23 - Service: Spybot-S&D 2 Updating Service (SDUpdateService) - Safer-Networking Ltd. - C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe
O23 - Service: Spybot-S&D 2 Security Center Service (SDWSCService) - Safer-Networking Ltd. - C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe
O23 - Service: Splashtop® Remote Service (SplashtopRemoteService) - Splashtop Inc. - C:\Program Files\Splashtop\Splashtop Remote\Server\SRService.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
--
End of file - 7158 bytes
======Scheduled tasks folder======
C:\Windows\tasks\Adobe Flash Player Updater.job - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job - C:\Program Files\Google\Update\GoogleUpdate.exe /c
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job - C:\Program Files\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C9C42510-9B41-42c1-9DCD-7282A2D07C61}C]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Nvtmru"=C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [2013-11-14 1028384]
"ShadowPlay"=C:\Windows\system32\nvspcap.dll [2013-12-10 982232]
"NvBackend"=C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe [2013-12-10 2279712]
"Wondershare Helper Compact.exe"=C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2014-06-25 2020192]
"WSHelperSetup.exe"=C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2014-06-25 2020192]
"Wondershare Helper Compact"=C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2014-06-25 2020192]
"SDTray"=C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe [2014-06-24 4101576]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2013-10-28 3675352]
"WSHelperSetup.exe"=C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2014-06-25 2020192]
"RAMSaverPro"=C:\Program Files\WinTools Software\RAM Saver Professional\ramsaverpro.exe [2014-10-08 250880]
"Wondershare Helper Compact"=C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2014-06-25 2020192]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
MobileGo Service.lnk - C:\Program Files\Wondershare\MobileGo for Android\MobileGoService.exe
RealPlayer Cloud Service UI.lnk - C:\Program Files\Real\RealPlayer\RPDS\Bin\rpsystray.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SDWinLogon]
SDWinLogon.dll []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\Windows\system32\wpdshserviceobj.dll [2012-07-26 73728]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\CleanHlp]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\CleanHlp.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SplashtopRemoteService]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=0
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"PromptOnSecureDesktop"=0
"ConsentPromptBehaviorAdmin"=0
"disablecad"=1
"SoftwareSASGeneration"=1
"DisableTaskMgr"=0
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0
"NoRun"=0
"NoFolderOptions"=0
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0
"NoRun"=0
"NoFolderOptions"=0
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe"="C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot - Search & Destroy tray access"
"C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe"="C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Enabled:Spybot-S&D 2 Scanner Service"
"C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe"="C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D 2 Updater"
"C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe"="C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D 2 Background update service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"msacm.msgsm610"=msgsm32.acm
"msacm.msg711"=msg711.acm
"msacm.l3acm"=l3codecp.acm
"vidc.yuy2"=msyuv.dll
"vidc.i420"=iyuv_32.dll
"vidc.cvid"=iccvid.dll
"vidc.yvyu"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"wavemapper"=msacm32.drv
"midimapper"=midimap.dll
"vidc.uyvy"=msyuv.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"VIDC.FMVC"=fmcodec.dll
"vidc.iv50"=C:\Windows\system32\ir50_32original.dll
======File associations======
.js - edit - C:\Windows\System32\Notepad.exe %1
======List of files/folders created in the last 1 month======
2015-02-14 13:34:50 ----D---- C:\Quarantine
2015-02-14 13:33:03 ----A---- C:\Windows\system32\drivers\tmcomm.sys
2015-02-14 13:14:56 ----D---- C:\Program Files\stinger
2015-02-14 13:00:50 ----A---- C:\Windows\system32\drivers\SMR430.SYS
2015-02-14 13:00:50 ----A---- C:\Windows\system32\drivers\SMR430.dat
2015-02-14 12:39:19 ----A---- C:\Windows\system32\sdnclean.exe
2015-02-13 10:52:47 ----D---- C:\ProgramData\Kaspersky Lab Setup Files
2015-02-07 20:18:02 ----D---- C:\Program Files\trend micro
2015-02-07 20:18:01 ----D---- C:\rsit
2015-02-04 14:30:37 ----A---- C:\Windows\system32\FNTCACHE.DAT
2015-02-04 14:30:34 ----A---- C:\Windows\ntbtlog.txt
2015-02-03 11:10:21 ----A---- C:\Windows\system32\drivers\01B24779.sys
2015-01-29 22:13:32 ----SHD---- C:\$RECYCLE.BIN
2015-01-29 22:09:35 ----D---- C:\Windows\temp
2015-01-29 21:53:01 ----D---- C:\ComboFix
2015-01-26 17:21:15 ----D---- C:\Users\adminn\AppData\Roaming\Steam
2015-01-26 17:03:20 ----D---- C:\Program Files\The Walking Dead Season 2
2015-01-24 15:18:38 ----A---- C:\Windows\system32\msvcr71.dll
2015-01-23 23:35:03 ----A---- C:\Windows\system32\wucltux.dll
2015-01-23 23:35:03 ----A---- C:\Windows\system32\wuaueng.dll
2015-01-23 23:35:03 ----A---- C:\Windows\system32\wuauclt.exe
2015-01-23 23:35:02 ----A---- C:\Windows\system32\wuwebv.dll
2015-01-23 23:35:02 ----A---- C:\Windows\system32\WUSettingsProvider.dll
2015-01-23 23:35:02 ----A---- C:\Windows\system32\wudriver.dll
2015-01-23 23:35:02 ----A---- C:\Windows\system32\wuapp.exe
2015-01-23 23:35:02 ----A---- C:\Windows\system32\wuapi.dll
2015-01-23 23:35:02 ----A---- C:\Windows\system32\storewuauth.dll
2015-01-23 23:34:48 ----A---- C:\Windows\system32\services.exe
2015-01-23 23:34:48 ----A---- C:\Windows\system32\localspl.dll
2015-01-23 23:34:47 ----A---- C:\Windows\system32\win32spl.dll
2015-01-23 23:34:47 ----A---- C:\Windows\system32\drivers\vhdmp.sys
2015-01-23 23:34:40 ----A---- C:\Windows\system32\WerFaultSecure.exe
2015-01-23 23:34:40 ----A---- C:\Windows\system32\wer.dll
2015-01-23 23:34:40 ----A---- C:\Windows\system32\Faultrep.dll
2015-01-23 23:34:40 ----A---- C:\Windows\system32\EncDump.dll
2015-01-23 23:33:16 ----A---- C:\Windows\system32\profsvc.dll
2015-01-23 23:32:56 ----A---- C:\Windows\system32\TSWbPrxy.exe
2015-01-23 23:32:56 ----A---- C:\Windows\system32\nlasvc.dll
2015-01-23 23:32:56 ----A---- C:\Windows\system32\nlaapi.dll
2015-01-23 23:32:56 ----A---- C:\Windows\system32\ncsi.dll
2015-01-23 23:32:54 ----A---- C:\Windows\system32\vbscript.dll
2015-01-23 23:32:53 ----A---- C:\Windows\system32\drivers\mrxdav.sys
2015-01-23 23:32:52 ----A---- C:\Windows\system32\ntoskrnl.exe
======List of files/folders modified in the last 1 month======
2015-02-14 13:51:03 ----D---- C:\Windows\Prefetch
2015-02-14 13:42:02 ----D---- C:\Windows\system32\Drivers
2015-02-14 13:34:13 ----D---- C:\Windows
2015-02-14 13:34:07 ----D---- C:\Windows\System32
2015-02-14 13:14:56 ----RD---- C:\Program Files
2015-02-14 13:00:09 ----D---- C:\Windows\system32\sru
2015-02-14 12:44:58 ----D---- C:\Program Files\Spybot - Search & Destroy 2
2015-02-14 12:39:17 ----D---- C:\ProgramData\Spybot - Search & Destroy
2015-02-14 12:35:19 ----D---- C:\ProgramData\NVIDIA
2015-02-14 12:17:02 ----D---- C:\Program Files\Steam
2015-02-13 15:01:48 ----D---- C:\Windows\Microsoft.NET
2015-02-13 10:52:47 ----D---- C:\ProgramData
2015-02-11 17:57:36 ----D---- C:\ProgramData\Origin
2015-02-11 17:52:28 ----D---- C:\Program Files\Origin
2015-02-11 11:07:02 ----D---- C:\Windows\system32\config
2015-02-09 16:38:06 ----D---- C:\AdwCleaner
2015-02-09 16:27:15 ----D---- C:\Windows\system32\catroot2
2015-02-09 11:29:59 ----D---- C:\Windows\WinSxS
2015-02-09 00:31:44 ----D---- C:\Users\adminn\AppData\Roaming\uTorrent
2015-02-08 18:38:30 ----SHD---- C:\Windows\Installer
2015-02-08 17:58:24 ----D---- C:\Windows\system32\Tasks
2015-02-08 13:42:05 ----SHD---- C:\System Volume Information
2015-02-08 11:29:23 ----HD---- C:\Program Files\InstallShield Installation Information
2015-02-04 15:41:38 ----D---- C:\Windows\debug
2015-02-03 13:47:04 ----D---- C:\Program Files\Comodo
2015-02-03 11:09:08 ----D---- C:\Windows\inf
2015-01-30 15:45:53 ----D---- C:\ProgramData\Malwarebytes Anti-Exploit
2015-01-30 15:40:20 ----D---- C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-01-29 22:12:00 ----A---- C:\Windows\system.ini
2015-01-29 22:11:58 ----D---- C:\Windows\erdnt
2015-01-29 22:11:57 ----D---- C:\Windows\system32\drivers\etc
2015-01-29 22:05:09 ----D---- C:\Windows\apppatch
2015-01-29 22:05:08 ----D---- C:\Program Files\Common Files
2015-01-29 21:49:31 ----D---- C:\Windows\SoftwareDistribution
2015-01-29 21:34:39 ----D---- C:\Qoobox
2015-01-24 16:42:15 ----D---- C:\Windows\rescache
2015-01-24 11:55:59 ----D---- C:\Program Files\Common Files\Steam
2015-01-24 11:12:24 ----D---- C:\Windows\system32\cs-CZ
2015-01-24 11:12:15 ----D---- C:\Windows\system32\DriverStore
2015-01-23 23:50:23 ----D---- C:\Windows\system32\MRT
2015-01-23 23:39:08 ----A---- C:\Windows\system32\MRT.exe
2015-01-23 23:38:59 ----D---- C:\Windows\CbsTemp
2015-01-19 22:30:58 ----A---- C:\Windows\system32\FlashPlayerApp.exe
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 mfehidk;McAfee Inc. mfehidk; C:\Windows\system32\drivers\mfehidk.sys []
R1 ElRawDisk;ElRawDisk; \??\C:\Windows\system32\drivers\ElRawDsk.sys [2013-12-03 26248]
R1 SMR430;Symantec SMR Utility Service 4.3.0; C:\Windows\System32\drivers\SMR430.SYS [2015-02-14 104120]
R1 tmcomm;tmcomm; C:\Windows\system32\DRIVERS\tmcomm.sys [2013-09-28 289352]
R1 VBoxDrv;VirtualBox Service; C:\Windows\system32\DRIVERS\VBoxDrv.sys [2013-11-01 203024]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver; C:\Windows\system32\DRIVERS\VBoxUSBMon.sys [2013-11-01 103696]
R3 dtsoftbus01;@oem8.inf,%DTSoftBus.SVCDESC%;DAEMON Tools Virtual Bus Driver; C:\Windows\System32\drivers\dtsoftbus01.sys [2013-11-11 243128]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2013-11-05 2888536]
R3 ksapi;ksapi; \??\C:\Windows\system32\drivers\ksapi.sys [2014-11-15 81768]
R3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [2015-02-14 114904]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2013-11-14 10446112]
R3 NVNET;@netnvm32.inf,%NVENETFD.Service.DispName%;Ovladač Ethernet NVIDIA nForce; C:\Windows\system32\DRIVERS\nvmf6232.sys [2012-06-02 291456]
R3 nvvad_WaveExtensible;@oem17.inf,%nvvad_WaveExtensible.SvcDesc%;NVIDIA Virtual Audio Device (Wave Extensible) (WDM); C:\Windows\system32\drivers\nvvad32v.sys [2013-12-05 34080]
R3 sthid;@oem100.inf,%splashtop.SvcDesc%;Splashtop Virtual Hid; C:\Windows\System32\drivers\sthid.sys [2014-10-22 18144]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter; C:\Windows\system32\DRIVERS\VBoxNetAdp.sys [2013-11-01 114960]
R3 VBoxNetFlt;@oem10.inf,%VBoxNetFltService_Desc%;VirtualBox Bridged Networking Service; C:\Windows\system32\DRIVERS\VBoxNetFlt.sys [2013-11-01 126224]
S0 gtqhfpgp;gtqhfpgp; C:\Windows\System32\drivers\oyuax.sys []
S0 mferkdet;McAfee Inc. mferkdet; C:\Windows\system32\drivers\mferkdet.sys []
S1 A2DDA;A2 Direct Disk Access Support Driver; \??\C:\Program Files\Emsisoft Anti-Malware\a2ddax86.sys []
S1 a2injectiondriver;a2injectiondriver; \??\C:\Program Files\Emsisoft Anti-Malware\a2dix86.sys []
S1 a2util;a-squared Malware-IDS utility driver; \??\C:\Program Files\Emsisoft Anti-Malware\a2util32.sys []
S3 androidusb;@oem93.inf,%androidusb.SvcDesc%;ADB Interface Driver; C:\Windows\System32\Drivers\androidusb.sys [2010-04-29 26112]
S3 catchme;catchme; \??\C:\Users\adminn\AppData\Local\Temp\catchme.sys []
S3 cleanhlp;cleanhlp; \??\C:\Program Files\Emsisoft Anti-Malware\cleanhlp32.sys []
S3 DrvAgent32;DrvAgent32; \??\C:\Windows\system32\Drivers\DrvAgent32.sys [2013-10-01 30504]
S3 EagleXNt;EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys []
S3 easytether;easytether; C:\Windows\system32\DRIVERS\easytthr.sys []
S3 qrkis;@oem98.inf,%qrkis.Service.DispName%;Tether Miniport; C:\Windows\system32\DRIVERS\qrkis.sys [2010-11-17 45608]
S3 usb_rndisx;@netrndis.inf,%usb_rndis.Service.DispName%;Adaptér USB RNDIS; C:\Windows\system32\DRIVERS\usb8023x.sys [2013-02-12 15872]
S3 WinUsb;@oem96.inf,%WINUSB_SERVICE%;ADB USB driver; C:\Windows\system32\DRIVERS\WinUsb.sys [2012-07-26 46592]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 cmcore;Clean Master Core Service; c:\program files\cmcm\Clean Master\cmcore.exe [2014-11-15 315240]
R2 NvNetworkService;NVIDIA Network Service; C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe [2013-12-10 1494304]
R2 SDScannerService;Spybot-S&D 2 Scanner Service; C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe [2014-06-24 1738168]
R2 SDUpdateService;Spybot-S&D 2 Updating Service; C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe [2014-06-27 2088408]
R2 SDWSCService;Spybot-S&D 2 Security Center Service; C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe [2014-04-25 171928]
R2 SplashtopRemoteService;Splashtop® Remote Service; C:\Program Files\Splashtop\Splashtop Remote\Server\SRService.exe [2014-11-20 792928]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2013-11-11 414496]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2014-04-08 116648]
S2 mfevtp;McAfee Validation Trust Protection Service; C:\Windows\system32\mfevtps.exe []
S2 NvStreamSvc;NVIDIA Streamer Service; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [2013-12-10 14658848]
S2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2013-11-11 664352]
S2 PnkBstrA;PnkBstrA; C:\Windows\system32\PnkBstrA.exe [2014-11-30 76152]
S2 RealPlayer Cloud Service;RealPlayer Cloud Service; C:\Program Files\Real\RealPlayer\RPDS\Bin\rpdsvc.exe [2014-12-06 1141848]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-04 267440]
S3 FontCache3.0.0.0;@%SystemRoot%\system32\PresentationHost.exe,-3309; C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2012-07-06 43616]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2014-04-08 116648]
S3 Origin Client Service;Origin Client Service; C:\Program Files\Origin\OriginClientService.exe [2015-01-30 1910128]
S3 Steam Client Service;Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe [2015-01-23 834752]
-----------------EOF-----------------
Run by adminn at 2015-02-14 13:54:01
Microsoft Windows 8 Enterprise
System drive C: has 44 GB (18%) free of 238 GB
Total RAM: 2048 MB (31% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:54:04, on 14. 2. 2015
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v10.0 (10.00.9200.17183)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskhostex.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe
C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
C:\Program Files\WinTools Software\RAM Saver Professional\RAMSaverPro.exe
C:\Program Files\Wondershare\MobileGo for Android\MobileGoService.exe
C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe
C:\Windows\system32\taskhost.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\adminn\Downloads\RSIT.exe
C:\Program Files\trend micro\adminn.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {C9C42510-9B41-42c1-9DCD-7282A2D07C61}C - (no file)
O4 - HKLM\..\Run: [Nvtmru] "C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"
O4 - HKLM\..\Run: [ShadowPlay] C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap.dll,ShadowPlayOnSystemStart
O4 - HKLM\..\Run: [NvBackend] "C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe"
O4 - HKLM\..\Run: [Wondershare Helper Compact.exe] C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
O4 - HKLM\..\Run: [WSHelperSetup.exe] C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
O4 - HKLM\..\Run: [Wondershare Helper Compact] "C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe"
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [WSHelperSetup.exe] C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
O4 - HKCU\..\Run: [RAMSaverPro] C:\Program Files\WinTools Software\RAM Saver Professional\ramsaverpro.exe
O4 - HKCU\..\Run: [Wondershare Helper Compact] "C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe"
O4 - HKUS\S-1-5-21-4280434948-3349374226-233984325-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun (User '?')
O4 - HKUS\S-1-5-21-4280434948-3349374226-233984325-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\..\Run: [WSHelperSetup.exe] C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe (User '?')
O4 - HKUS\S-1-5-21-4280434948-3349374226-233984325-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\..\Run: [RAMSaverPro] C:\Program Files\WinTools Software\RAM Saver Professional\ramsaverpro.exe (User '?')
O4 - HKUS\S-1-5-21-4280434948-3349374226-233984325-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\..\Run: [Wondershare Helper Compact] "C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe" (User '?')
O4 - Global Startup: MobileGo Service.lnk = C:\Program Files\Wondershare\MobileGo for Android\MobileGoService.exe
O4 - Global Startup: RealPlayer Cloud Service UI.lnk = C:\Program Files\Real\RealPlayer\RPDS\Bin\rpsystray.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {C8BC46C7-921C-4102-B67D-F1F7E65FB0BE} - https://battlefield.play4free.com/stati ... 0.96.0.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B6A028C3-FAEC-429E-9D39-D048A71D2B9E}: NameServer = 8.8.8.8,8.8.4.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1
O20 - Winlogon Notify: SDWinLogon - SDWinLogon.dll (file missing)
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Clean Master Core Service (cmcore) - Kingsoft Corporation - c:\program files\cmcm\Clean Master\cmcore.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: McAfee Validation Trust Protection Service (mfevtp) - Unknown owner - C:\Windows\system32\mfevtps.exe (file missing)
O23 - Service: NVIDIA Network Service (NvNetworkService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe
O23 - Service: NVIDIA Streamer Service (NvStreamSvc) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Origin Client Service - Electronic Arts - C:\Program Files\Origin\OriginClientService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: RealPlayer Cloud Service - RealNetworks, Inc. - C:\Program Files\Real\RealPlayer\RPDS\Bin\rpdsvc.exe
O23 - Service: Spybot-S&D 2 Scanner Service (SDScannerService) - Safer-Networking Ltd. - C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe
O23 - Service: Spybot-S&D 2 Updating Service (SDUpdateService) - Safer-Networking Ltd. - C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe
O23 - Service: Spybot-S&D 2 Security Center Service (SDWSCService) - Safer-Networking Ltd. - C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe
O23 - Service: Splashtop® Remote Service (SplashtopRemoteService) - Splashtop Inc. - C:\Program Files\Splashtop\Splashtop Remote\Server\SRService.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
--
End of file - 7158 bytes
======Scheduled tasks folder======
C:\Windows\tasks\Adobe Flash Player Updater.job - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job - C:\Program Files\Google\Update\GoogleUpdate.exe /c
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job - C:\Program Files\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C9C42510-9B41-42c1-9DCD-7282A2D07C61}C]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Nvtmru"=C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [2013-11-14 1028384]
"ShadowPlay"=C:\Windows\system32\nvspcap.dll [2013-12-10 982232]
"NvBackend"=C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe [2013-12-10 2279712]
"Wondershare Helper Compact.exe"=C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2014-06-25 2020192]
"WSHelperSetup.exe"=C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2014-06-25 2020192]
"Wondershare Helper Compact"=C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2014-06-25 2020192]
"SDTray"=C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe [2014-06-24 4101576]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2013-10-28 3675352]
"WSHelperSetup.exe"=C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2014-06-25 2020192]
"RAMSaverPro"=C:\Program Files\WinTools Software\RAM Saver Professional\ramsaverpro.exe [2014-10-08 250880]
"Wondershare Helper Compact"=C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2014-06-25 2020192]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
MobileGo Service.lnk - C:\Program Files\Wondershare\MobileGo for Android\MobileGoService.exe
RealPlayer Cloud Service UI.lnk - C:\Program Files\Real\RealPlayer\RPDS\Bin\rpsystray.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SDWinLogon]
SDWinLogon.dll []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\Windows\system32\wpdshserviceobj.dll [2012-07-26 73728]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\CleanHlp]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\CleanHlp.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SplashtopRemoteService]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=0
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"PromptOnSecureDesktop"=0
"ConsentPromptBehaviorAdmin"=0
"disablecad"=1
"SoftwareSASGeneration"=1
"DisableTaskMgr"=0
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0
"NoRun"=0
"NoFolderOptions"=0
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0
"NoRun"=0
"NoFolderOptions"=0
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe"="C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot - Search & Destroy tray access"
"C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe"="C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Enabled:Spybot-S&D 2 Scanner Service"
"C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe"="C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D 2 Updater"
"C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe"="C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D 2 Background update service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"msacm.msgsm610"=msgsm32.acm
"msacm.msg711"=msg711.acm
"msacm.l3acm"=l3codecp.acm
"vidc.yuy2"=msyuv.dll
"vidc.i420"=iyuv_32.dll
"vidc.cvid"=iccvid.dll
"vidc.yvyu"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"wavemapper"=msacm32.drv
"midimapper"=midimap.dll
"vidc.uyvy"=msyuv.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"VIDC.FMVC"=fmcodec.dll
"vidc.iv50"=C:\Windows\system32\ir50_32original.dll
======File associations======
.js - edit - C:\Windows\System32\Notepad.exe %1
======List of files/folders created in the last 1 month======
2015-02-14 13:34:50 ----D---- C:\Quarantine
2015-02-14 13:33:03 ----A---- C:\Windows\system32\drivers\tmcomm.sys
2015-02-14 13:14:56 ----D---- C:\Program Files\stinger
2015-02-14 13:00:50 ----A---- C:\Windows\system32\drivers\SMR430.SYS
2015-02-14 13:00:50 ----A---- C:\Windows\system32\drivers\SMR430.dat
2015-02-14 12:39:19 ----A---- C:\Windows\system32\sdnclean.exe
2015-02-13 10:52:47 ----D---- C:\ProgramData\Kaspersky Lab Setup Files
2015-02-07 20:18:02 ----D---- C:\Program Files\trend micro
2015-02-07 20:18:01 ----D---- C:\rsit
2015-02-04 14:30:37 ----A---- C:\Windows\system32\FNTCACHE.DAT
2015-02-04 14:30:34 ----A---- C:\Windows\ntbtlog.txt
2015-02-03 11:10:21 ----A---- C:\Windows\system32\drivers\01B24779.sys
2015-01-29 22:13:32 ----SHD---- C:\$RECYCLE.BIN
2015-01-29 22:09:35 ----D---- C:\Windows\temp
2015-01-29 21:53:01 ----D---- C:\ComboFix
2015-01-26 17:21:15 ----D---- C:\Users\adminn\AppData\Roaming\Steam
2015-01-26 17:03:20 ----D---- C:\Program Files\The Walking Dead Season 2
2015-01-24 15:18:38 ----A---- C:\Windows\system32\msvcr71.dll
2015-01-23 23:35:03 ----A---- C:\Windows\system32\wucltux.dll
2015-01-23 23:35:03 ----A---- C:\Windows\system32\wuaueng.dll
2015-01-23 23:35:03 ----A---- C:\Windows\system32\wuauclt.exe
2015-01-23 23:35:02 ----A---- C:\Windows\system32\wuwebv.dll
2015-01-23 23:35:02 ----A---- C:\Windows\system32\WUSettingsProvider.dll
2015-01-23 23:35:02 ----A---- C:\Windows\system32\wudriver.dll
2015-01-23 23:35:02 ----A---- C:\Windows\system32\wuapp.exe
2015-01-23 23:35:02 ----A---- C:\Windows\system32\wuapi.dll
2015-01-23 23:35:02 ----A---- C:\Windows\system32\storewuauth.dll
2015-01-23 23:34:48 ----A---- C:\Windows\system32\services.exe
2015-01-23 23:34:48 ----A---- C:\Windows\system32\localspl.dll
2015-01-23 23:34:47 ----A---- C:\Windows\system32\win32spl.dll
2015-01-23 23:34:47 ----A---- C:\Windows\system32\drivers\vhdmp.sys
2015-01-23 23:34:40 ----A---- C:\Windows\system32\WerFaultSecure.exe
2015-01-23 23:34:40 ----A---- C:\Windows\system32\wer.dll
2015-01-23 23:34:40 ----A---- C:\Windows\system32\Faultrep.dll
2015-01-23 23:34:40 ----A---- C:\Windows\system32\EncDump.dll
2015-01-23 23:33:16 ----A---- C:\Windows\system32\profsvc.dll
2015-01-23 23:32:56 ----A---- C:\Windows\system32\TSWbPrxy.exe
2015-01-23 23:32:56 ----A---- C:\Windows\system32\nlasvc.dll
2015-01-23 23:32:56 ----A---- C:\Windows\system32\nlaapi.dll
2015-01-23 23:32:56 ----A---- C:\Windows\system32\ncsi.dll
2015-01-23 23:32:54 ----A---- C:\Windows\system32\vbscript.dll
2015-01-23 23:32:53 ----A---- C:\Windows\system32\drivers\mrxdav.sys
2015-01-23 23:32:52 ----A---- C:\Windows\system32\ntoskrnl.exe
======List of files/folders modified in the last 1 month======
2015-02-14 13:51:03 ----D---- C:\Windows\Prefetch
2015-02-14 13:42:02 ----D---- C:\Windows\system32\Drivers
2015-02-14 13:34:13 ----D---- C:\Windows
2015-02-14 13:34:07 ----D---- C:\Windows\System32
2015-02-14 13:14:56 ----RD---- C:\Program Files
2015-02-14 13:00:09 ----D---- C:\Windows\system32\sru
2015-02-14 12:44:58 ----D---- C:\Program Files\Spybot - Search & Destroy 2
2015-02-14 12:39:17 ----D---- C:\ProgramData\Spybot - Search & Destroy
2015-02-14 12:35:19 ----D---- C:\ProgramData\NVIDIA
2015-02-14 12:17:02 ----D---- C:\Program Files\Steam
2015-02-13 15:01:48 ----D---- C:\Windows\Microsoft.NET
2015-02-13 10:52:47 ----D---- C:\ProgramData
2015-02-11 17:57:36 ----D---- C:\ProgramData\Origin
2015-02-11 17:52:28 ----D---- C:\Program Files\Origin
2015-02-11 11:07:02 ----D---- C:\Windows\system32\config
2015-02-09 16:38:06 ----D---- C:\AdwCleaner
2015-02-09 16:27:15 ----D---- C:\Windows\system32\catroot2
2015-02-09 11:29:59 ----D---- C:\Windows\WinSxS
2015-02-09 00:31:44 ----D---- C:\Users\adminn\AppData\Roaming\uTorrent
2015-02-08 18:38:30 ----SHD---- C:\Windows\Installer
2015-02-08 17:58:24 ----D---- C:\Windows\system32\Tasks
2015-02-08 13:42:05 ----SHD---- C:\System Volume Information
2015-02-08 11:29:23 ----HD---- C:\Program Files\InstallShield Installation Information
2015-02-04 15:41:38 ----D---- C:\Windows\debug
2015-02-03 13:47:04 ----D---- C:\Program Files\Comodo
2015-02-03 11:09:08 ----D---- C:\Windows\inf
2015-01-30 15:45:53 ----D---- C:\ProgramData\Malwarebytes Anti-Exploit
2015-01-30 15:40:20 ----D---- C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-01-29 22:12:00 ----A---- C:\Windows\system.ini
2015-01-29 22:11:58 ----D---- C:\Windows\erdnt
2015-01-29 22:11:57 ----D---- C:\Windows\system32\drivers\etc
2015-01-29 22:05:09 ----D---- C:\Windows\apppatch
2015-01-29 22:05:08 ----D---- C:\Program Files\Common Files
2015-01-29 21:49:31 ----D---- C:\Windows\SoftwareDistribution
2015-01-29 21:34:39 ----D---- C:\Qoobox
2015-01-24 16:42:15 ----D---- C:\Windows\rescache
2015-01-24 11:55:59 ----D---- C:\Program Files\Common Files\Steam
2015-01-24 11:12:24 ----D---- C:\Windows\system32\cs-CZ
2015-01-24 11:12:15 ----D---- C:\Windows\system32\DriverStore
2015-01-23 23:50:23 ----D---- C:\Windows\system32\MRT
2015-01-23 23:39:08 ----A---- C:\Windows\system32\MRT.exe
2015-01-23 23:38:59 ----D---- C:\Windows\CbsTemp
2015-01-19 22:30:58 ----A---- C:\Windows\system32\FlashPlayerApp.exe
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 mfehidk;McAfee Inc. mfehidk; C:\Windows\system32\drivers\mfehidk.sys []
R1 ElRawDisk;ElRawDisk; \??\C:\Windows\system32\drivers\ElRawDsk.sys [2013-12-03 26248]
R1 SMR430;Symantec SMR Utility Service 4.3.0; C:\Windows\System32\drivers\SMR430.SYS [2015-02-14 104120]
R1 tmcomm;tmcomm; C:\Windows\system32\DRIVERS\tmcomm.sys [2013-09-28 289352]
R1 VBoxDrv;VirtualBox Service; C:\Windows\system32\DRIVERS\VBoxDrv.sys [2013-11-01 203024]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver; C:\Windows\system32\DRIVERS\VBoxUSBMon.sys [2013-11-01 103696]
R3 dtsoftbus01;@oem8.inf,%DTSoftBus.SVCDESC%;DAEMON Tools Virtual Bus Driver; C:\Windows\System32\drivers\dtsoftbus01.sys [2013-11-11 243128]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2013-11-05 2888536]
R3 ksapi;ksapi; \??\C:\Windows\system32\drivers\ksapi.sys [2014-11-15 81768]
R3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [2015-02-14 114904]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2013-11-14 10446112]
R3 NVNET;@netnvm32.inf,%NVENETFD.Service.DispName%;Ovladač Ethernet NVIDIA nForce; C:\Windows\system32\DRIVERS\nvmf6232.sys [2012-06-02 291456]
R3 nvvad_WaveExtensible;@oem17.inf,%nvvad_WaveExtensible.SvcDesc%;NVIDIA Virtual Audio Device (Wave Extensible) (WDM); C:\Windows\system32\drivers\nvvad32v.sys [2013-12-05 34080]
R3 sthid;@oem100.inf,%splashtop.SvcDesc%;Splashtop Virtual Hid; C:\Windows\System32\drivers\sthid.sys [2014-10-22 18144]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter; C:\Windows\system32\DRIVERS\VBoxNetAdp.sys [2013-11-01 114960]
R3 VBoxNetFlt;@oem10.inf,%VBoxNetFltService_Desc%;VirtualBox Bridged Networking Service; C:\Windows\system32\DRIVERS\VBoxNetFlt.sys [2013-11-01 126224]
S0 gtqhfpgp;gtqhfpgp; C:\Windows\System32\drivers\oyuax.sys []
S0 mferkdet;McAfee Inc. mferkdet; C:\Windows\system32\drivers\mferkdet.sys []
S1 A2DDA;A2 Direct Disk Access Support Driver; \??\C:\Program Files\Emsisoft Anti-Malware\a2ddax86.sys []
S1 a2injectiondriver;a2injectiondriver; \??\C:\Program Files\Emsisoft Anti-Malware\a2dix86.sys []
S1 a2util;a-squared Malware-IDS utility driver; \??\C:\Program Files\Emsisoft Anti-Malware\a2util32.sys []
S3 androidusb;@oem93.inf,%androidusb.SvcDesc%;ADB Interface Driver; C:\Windows\System32\Drivers\androidusb.sys [2010-04-29 26112]
S3 catchme;catchme; \??\C:\Users\adminn\AppData\Local\Temp\catchme.sys []
S3 cleanhlp;cleanhlp; \??\C:\Program Files\Emsisoft Anti-Malware\cleanhlp32.sys []
S3 DrvAgent32;DrvAgent32; \??\C:\Windows\system32\Drivers\DrvAgent32.sys [2013-10-01 30504]
S3 EagleXNt;EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys []
S3 easytether;easytether; C:\Windows\system32\DRIVERS\easytthr.sys []
S3 qrkis;@oem98.inf,%qrkis.Service.DispName%;Tether Miniport; C:\Windows\system32\DRIVERS\qrkis.sys [2010-11-17 45608]
S3 usb_rndisx;@netrndis.inf,%usb_rndis.Service.DispName%;Adaptér USB RNDIS; C:\Windows\system32\DRIVERS\usb8023x.sys [2013-02-12 15872]
S3 WinUsb;@oem96.inf,%WINUSB_SERVICE%;ADB USB driver; C:\Windows\system32\DRIVERS\WinUsb.sys [2012-07-26 46592]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 cmcore;Clean Master Core Service; c:\program files\cmcm\Clean Master\cmcore.exe [2014-11-15 315240]
R2 NvNetworkService;NVIDIA Network Service; C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe [2013-12-10 1494304]
R2 SDScannerService;Spybot-S&D 2 Scanner Service; C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe [2014-06-24 1738168]
R2 SDUpdateService;Spybot-S&D 2 Updating Service; C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe [2014-06-27 2088408]
R2 SDWSCService;Spybot-S&D 2 Security Center Service; C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe [2014-04-25 171928]
R2 SplashtopRemoteService;Splashtop® Remote Service; C:\Program Files\Splashtop\Splashtop Remote\Server\SRService.exe [2014-11-20 792928]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2013-11-11 414496]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2014-04-08 116648]
S2 mfevtp;McAfee Validation Trust Protection Service; C:\Windows\system32\mfevtps.exe []
S2 NvStreamSvc;NVIDIA Streamer Service; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [2013-12-10 14658848]
S2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2013-11-11 664352]
S2 PnkBstrA;PnkBstrA; C:\Windows\system32\PnkBstrA.exe [2014-11-30 76152]
S2 RealPlayer Cloud Service;RealPlayer Cloud Service; C:\Program Files\Real\RealPlayer\RPDS\Bin\rpdsvc.exe [2014-12-06 1141848]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-04 267440]
S3 FontCache3.0.0.0;@%SystemRoot%\system32\PresentationHost.exe,-3309; C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2012-07-06 43616]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2014-04-08 116648]
S3 Origin Client Service;Origin Client Service; C:\Program Files\Origin\OriginClientService.exe [2015-01-30 1910128]
S3 Steam Client Service;Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe [2015-01-23 834752]
-----------------EOF-----------------
Jedna se o domaci PC nebo nejaky pracovni\firemni???