upm log, mbr rootkit detected

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz

Vážení uživaterlé!
Ve dnech 4. - 6-9.2026 budou někteříí naši členové na každoročním srazu fóra. Žádáme vás, abyste měli strpení, nemusí se na na řešení vašeho problému dostat hned. Děkujeme za pochopení.
Odpovědět
Zpráva
Autor
aenneus
Návštěvník
Návštěvník
Příspěvky: 5
Registrován: 27 Srp 2011 18:17

upm log, mbr rootkit detected

#1 Příspěvek od aenneus »

ahoj,
počítač byl v poslední době velmi zpomalený, internet skoro neběžel (narozdíl od ostatních ntb na stejné síti)
tady je log z upm, momentálně mám ještě service pack 2
všechno je asi v logu (?)
předem díky za radu, jak comp vyčistit .-)
adam

LOG:

Kód: Vybrat vše

Windows XP SP 2 (build 2600)
Boot Mode: Normal
Ověření souborů Microsoftu: Ano
Whitelist: Ano
Internet Explorer v6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)
Log vygenerován: 27.8.2011 19:08:20
================================================================

SmallARK
================================================================
[R]NtCreateKey                      -> C:\WINDOWS\system32\drivers\Lbd.sys
[R]NtSetValueKey                    -> C:\WINDOWS\system32\drivers\Lbd.sys

MBR ROOTKIT DETECTED!

Běžící procesy
================================================================

C:\WINDOWS\SYSTEM32\ATI2EVXX.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\DRIVE ENCRYPTION\HPFKCRYPT.EXE
C:\PROGRAM FILES\WIDCOMM\BLUETOOTH SOFTWARE\BIN\BTWDINS.EXE
C:\WINDOWS\SYSTEM32\ATI2EVXX.EXE
C:\PROGRAM FILES\ESET\ESET SMART SECURITY\EKRN.EXE
C:\WINDOWS\SYSTEM32\FUSSERVICES.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\SHARED\HPQWMIEX.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\IAM\BIN\ASGHOST.EXE
C:\PROGRAM FILES\ANALOG DEVICES\CORE\SMAX4PNP.EXE
C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPENH.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\HP QUICK LAUNCH BUTTONS\QLBCTRL.EXE
C:\WINDOWS\SYSTEM32\ACCELEROMETERST.EXE
C:\PROGRAM FILES\XEROX COMPANION SUITE\MFFSUM.EXE
C:\PROGRAM FILES\XEROX COMPANION SUITE\MFPRINTSERVER.EXE
C:\PROGRAM FILES\ZYXEL\NETUSB SHARE CENTER\SHARE CENTER.EXE
C:\PROGRAM FILES\XEROX COMPANION SUITE\MFSERVICES.EXE
C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI.ACE\CORE-STATIC\MOM.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\SHARED\HPQTOASTER.EXE
C:\PROGRAM FILES\WIDCOMM\BLUETOOTH SOFTWARE\BTTRAY.EXE
C:\PROGRAM FILES\OPENOFFICE.ORG 3\PROGRAM\SOFFICE.EXE
C:\PROGRAM FILES\OPENOFFICE.ORG 3\PROGRAM\SOFFICE.BIN
C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI.ACE\CORE-STATIC\CCC.EXE
C:\WINDOWS\SYSTEM32\LF2GRPOW.EXE
C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI.ACE\CORE-STATIC\CCC.EXE

Scanner
================================================================
[?] ati2evxx.exe                                                                          
Non Microsoft v System32:                                                                 
                                                      
[?] HpFkCrypt.exe                                                                         
Nemá okno                                                                                 
Soubor                              7%
                                                      
[?] btwdins.exe                                                                           
Nemá okno                                                                                 
Soubor                              7%
                                                      
[?] ati2evxx.exe                                                                          
Non Microsoft v System32:                                                                 
                                                      
[R] Ad-AwareAdmin.exe                                                                     
Spouští se po startu                Job [AD-AWA~1.JOB]
                                                      
[?] ekrn.exe                                                                              
Soubor                              7%
                                                      
[?] FUSServices.exe                                                                       
Bez výrobce v System32                                                                    
Nemá okno                                                                                 
Soubor                              12%
                                                      
[R] pdfsvc.exe                                                                            
EntryPoint v sekci:                 CODE
|_ Celkový počet sekcí:             8
                                                      
[?] hpqWmiEx.exe                                                                          
Nemá okno                                                                                 
Soubor                              7%
                                                      
[?] asghost.exe                                                                           
Soubor                              7%
                                                      
[S] explorer.exe                                                                          
Spouští se po startu                HKLM Winlogon [Shell]
                                                      
[?] smax4pnp.exe                                                                          
Spouští se po startu                HKLM Run [SoundMAXPnP]
                                                      
[R] pdfsty.exe                                                                            
Spouští se po startu                HKLM Run [PDF Complete]
EntryPoint v sekci:                 CODE
|_ Celkový počet sekcí:             8
                                                      
[R] pthosttr.exe                                                                          
Spouští se po startu                HKLM Run [PTHOSTTR]
                                                      
[?] SynTPEnh.exe                                                                          
Spouští se po startu                HKLM Run [SynTPEnh]
                                                      
[R] HPWAMain.exe                                                                          
Spouští se po startu                HKLM Run [hpWirelessAssistant]
                                                      
[R] jusched.exe                                                                           
Spouští se po startu                HKLM Run [SunJavaUpdateSched]
                                                      
[?] QLBCTRL.exe                                                                           
Spouští se po startu                HKLM Run [QlbCtrl]
Soubor                              7%
                                                      
[R] Scheduler.exe                                                                         
Spouští se po startu                HKLM Run [Scheduler]
                                                      
[R] hpwuSchd2.exe                                                                         
Spouští se po startu                HKLM Run [HP Software Update]
                                                      
[?] accelerometerST.exe                                                                   
Non Microsoft v System32:                                                                 
Spouští se po startu                HKLM Run [AccelerometerSysTrayApplet]
Soubor                              14%
                                                      
[?] MFFSUM.exe                                                                            
Spouští se po startu                HKLM Run [MFFSum_Pro_LL2]
Soubor                              7%
                                                      
[?] MFPrintServer.exe                                                                     
Spouští se po startu                HKLM Run [MFPrintServer_Pro_LL2]
Soubor                              7%
                                                      
[?] Share Center.exe                                                                      
Bez výrobce                                                                               
Spouští se po startu                HKLM Run [ZyXEL USB Share Center]
Soubor                              25%
                                                      
[?] MFServices.exe                                                                        
Soubor                              7%
                                                      
[R] egui.exe                                                                              
Spouští se po startu                HKLM Run [egui]
                                                      
[S] ctfmon.exe                                                                            
Spouští se po startu                HKCU Run [CTFMON.EXE]
                                                      
[R] LightScribeControlPanel.exe                                                           
Spouští se po startu                HKCU Run [LightScribe Control Panel]
                                                      
[?] MOM.exe                                                                               
EntryPoint v sekci:                                                                       
|_ Celkový počet sekcí:             3
Podvržená cesta modulu:             (01130000) [DLL] ?
Soubor                              14%
                                                      
[R] Skype.exe                                                                             
Spouští se po startu                HKCU Run [Skype]
Podvržená cesta modulu:             (00400000) C:\Program Files\Skype\Phone\Skype.exe
                                                      
[?] HpqToaster.exe                                                                        
Bez výrobce                                                                               
Nemá okno                                                                                 
Soubor                              12%
                                                      
[R] PMB.exe                                                                               
Spouští se po startu                HKCU Run [Pando Media Booster]
                                                      
[?] BTTray.exe                                                                            
Spouští se po startu                Po spuštění []
Soubor                              7%
                                                      
[?] soffice.exe                                                                           
Nemá okno                                                                                 
Soubor                              14%
                                                      
[?] soffice.bin                                                                           
Soubor                              14%
                                                      
[?] CCC.exe                                                                               
Spouští se po startu                Po spuštění [CCC.lnk]
EntryPoint v sekci:                                                                       
|_ Celkový počet sekcí:             3
Podvržená cesta modulu:             (00DB0000) [DLL] ?
Podvržená cesta modulu:             (011F0000) [DLL] ?
Podvržená cesta modulu:             (012C0000) [DLL] ?
Podvržená cesta modulu:             (03770000) [DLL] ?
Podvržená cesta modulu:             (03C30000) [DLL] ?
Podvržená cesta modulu:             (03CF0000) [DLL] ?
Podvržená cesta modulu:             (03D10000) [DLL] ?
Podvržená cesta modulu:             (04170000) [DLL] ?
Podvržená cesta modulu:             (04960000) [DLL] ?
Podvržená cesta modulu:             (04FB0000) [DLL] ?
Soubor                              14%
                                                      
[?] LF2GRPOW.EXE                                                                          
Bez výrobce v System32                                                                    
                                                      
[?] CCC.exe                                                                               
Spouští se po startu                Po spuštění [CCC.lnk]
EntryPoint v sekci:                                                                       
|_ Celkový počet sekcí:             3
Podvržená cesta modulu:             (00DB0000) [DLL] ?
Podvržená cesta modulu:             (03420000) [DLL] ?
Podvržená cesta modulu:             (03670000) [DLL] ?
Podvržená cesta modulu:             (036C0000) [DLL] ?
Podvržená cesta modulu:             (03DD0000) [DLL] ?
Nemá okno                                                                                 
Soubor                              14%
                                                      

Po spuštění
================================================================

HKCU Run
 |_  (Soubor nenalezen)
 |_ [?][StartCCC]                    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
 |_ [R][LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
 |_ [R][Google Update] C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe /c
 |_ [R][Skype]                       C:\Program Files\Skype\Phone\Skype.exe /nosplash /minimized

HKLM Run
 |_ [X][MsmqIntCert] regsvr32 /s mqrt.dll (Soubor nenalezen)
 |_ [?][SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
 |_ [R][SoundMAX]                    C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
 |_ [R][PTHOSTTR]                    C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start
 |_ [?][SynTPEnh]                    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
 |_ [?][QlbCtrl]                     C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
 |_ [?][CognizanceTS] C:\PROGRA~1\HEWLET~1\IAM\Bin\ASTSVCC.dll ,RegisterModule
 |_ [?][Reminder]                    C:\WINDOWS\Creator\Remind_XP.exe
 |_ [?][Cpqset]                      C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
 |_ [?][WatchDog]                    C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
 |_ [?][AccelerometerSysTrayApplet] C:\WINDOWS\system32\AccelerometerSt.exe
 |_ [?][MFFSum_Pro_LL2] C:\Program Files\Xerox Companion Suite\MFFSUM.exe
 |_ [?][MFPrintServer_Pro_LL2] C:\Program Files\Xerox Companion Suite\MFPrintServer.exe
 |_ [?][ZyXEL USB Share Center] C:\Program Files\ZyXEL\NetUSB Share Center\Share Center.exe -mini
 |_ [?][Bonus.SSR.FR10] C:\Program Files\ABBYY FineReader 10\Bonus.ScreenshotReader.exe /autorun
 |_ [R][egui]                        C:\Program Files\ESET\ESET Smart Security\egui.exe /hide /waitservice

HKLM IC
 |_ [X][>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP (Soubor nenalezen)
 |_ [X][ccc-core-static] msiexec /fums {09258F12-48E7-B18E-C414-1F48C215685F} /qb (Soubor nenalezen)
 |_ [?][{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] C:\WINDOWS\INF\msnetmtg.inf ,NetMtg.Install.PerUser.NT
 |_ [?][{5945c046-1e7d-11d1-bc44-00c04fd912be}] C:\WINDOWS\INF\msmsgs.inf ,BLC.QuietInstall.PerUser
 |_ [?][{6BF52A52-394A-11d3-B153-00C04F79FAA6}] C:\WINDOWS\INF\wmp11.inf ,PerUserStub
 |_ [?][{89820200-ECBD-11cf-8B85-00AA005B4340}] regsvr32.exe /s /n /i:U shell32.dll

HKLM Winlogon Notify
 |_ [?][AtiExtEvent] C:\WINDOWS\system32\Ati2evxx.dll
 |_ [?][OneCard]                     C:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll

HKLM AppInit_DLLs
 |_ [?][AppInit_DLLs] C:\WINDOWS\system32\APSHook.dll

Po spuštění
 |_ C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
 |_ C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
 |_ [?][CCC.lnk]                     C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
 |_ [?][OpenOffice.org 3.3.lnk] C:\Program Files\OpenOffice.org 3\program\quickstart.exe


Služby (Zobraz běžící: True, Zobraz zastavené: False, Zobraz i bezpečné služby: False)
================================================================
[X] ABBYY FineReader 10 CE Licensing Service
 |_ Cesta: C:\Program Files\Common Files\ABBYY\FineReader\10.00\Licensing\CE\NetworkLicenseServer.exe -service
 |   |_ Výrobce:  
 |   |_ Popis: 
 |   |_ MD5: 
 |   
 |_ Jméno:  ABBYY.Licensing.FineReader.Corporate.10.0
 |_ StartName: LocalSystem
 |_ Typ spouštění:  Auto Start
 |_ Status: Spuštěno
 |_ Typ:  Win32 Own Process
 |_ Dependency: RPCSS

[?] Logon Session Broker
 |_ Cesta: C:\WINDOWS\System32\svchost.exe
 |   |_ Výrobce:  Microsoft Corporation
 |   |_ Popis: Generic Host Process for Win32 Services
 |   |_ MD5: DFBA2915B0BF58ABB288CD4C9318CB3F
 |   
 |_ ServiceDLL: C:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll
 |   |_ Výrobce:  Cognizance Corporation
 |   |_ Popis: Winlogon notification handler
 |   |_ MD5: 2EEDA27C19259C2340324EF7180D086B
 |   
 |_ Jméno:  ASBroker
 |_ StartName: LocalSystem
 |_ Typ spouštění:  Auto Start
 |_ Status: Spuštěno
 |_ Typ:  Win32 Share Process
 |_ Dependency: 

[?] Local Communication Channel
 |_ Cesta: C:\WINDOWS\System32\svchost.exe
 |   |_ Výrobce:  Microsoft Corporation
 |   |_ Popis: Generic Host Process for Win32 Services
 |   |_ MD5: DFBA2915B0BF58ABB288CD4C9318CB3F
 |   
 |_ ServiceDLL: C:\Program Files\Hewlett-Packard\IAM\Bin\ASChnl.dll
 |   |_ Výrobce:  Cognizance Corporation
 |   |_ Popis: Secure Communication Channel
 |   |_ MD5: BB3C0521ECCA4BB17AC55EB640DF0FA5
 |   
 |_ Jméno:  ASChannel
 |_ StartName: LocalSystem
 |_ Typ spouštění:  Auto Start
 |_ Status: Spuštěno
 |_ Typ:  Win32 Share Process
 |_ Dependency: 

[?] Ati HotKey Poller
 |_ Cesta: C:\WINDOWS\system32\Ati2evxx.exe
 |   |_ Výrobce:  ATI Technologies Inc.
 |   |_ Popis: ATI External Event Utility EXE Module
 |   |_ MD5: 29B2874B3956B62C0DBEA32D75A8E776
 |   
 |_ Jméno:  Ati HotKey Poller
 |_ StartName: LocalSystem
 |_ Typ spouštění:  Auto Start
 |_ Status: Spuštěno
 |_ Typ:  
 |_ Dependency: 

[?] Bluetooth Service
 |_ Cesta: C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
 |   |_ Výrobce:  Broadcom Corporation.
 |   |_ Popis: Bluetooth Support Server
 |   |_ MD5: 0ECE2B1910527AE85691151D56621891
 |   
 |_ Jméno:  btwdins
 |_ StartName: LocalSystem
 |_ Typ spouštění:  Auto Start
 |_ Status: Spuštěno
 |_ Typ:  Win32 Own Process
 |_ Dependency: 

[?] Eset Service
 |_ Cesta: C:\Program Files\ESET\ESET Smart Security\ekrn.exe
 |   |_ Výrobce:  ESET
 |   |_ Popis: Eset Service
 |   |_ MD5: 219D9FA882EABA00EAA5DFC9492BC92D
 |   
 |_ Jméno:  ekrn
 |_ StartName: LocalSystem
 |_ Typ spouštění:  Auto Start
 |_ Status: Spuštěno
 |_ Typ:  
 |_ Dependency: 

[?] Session Launcher Service
 |_ Cesta: C:\WINDOWS\system32\FUSServices.exe
 |   |_ Výrobce:  
 |   |_ Popis: 
 |   |_ MD5: 8A4B9FB26071E4A6EE8637F67E1BC61B
 |   
 |_ Jméno:  FUSServices
 |_ StartName: LocalSystem
 |_ Typ spouštění:  Auto Start
 |_ Status: Spuštěno
 |_ Typ:  Win32 Own Process
 |_ Dependency: 

[?] Drive Encryption Service
 |_ Cesta: c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe
 |   |_ Výrobce:  SafeBoot International
 |   |_ Popis: Drive Encryption for HP ProtectTools Service
 |   |_ MD5: 650D882BDA3ACBD069CB7C29B633ADFF
 |   
 |_ Jméno:  HpFkCryptService
 |_ StartName: LocalSystem
 |_ Typ spouštění:  Auto Start
 |_ Status: Spuštěno
 |_ Typ:  Win32 Own Process
 |_ Dependency: 

[?] hpqwmiex
 |_ Cesta: C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
 |   |_ Výrobce:  Hewlett-Packard Development Company, L.P.
 |   |_ Popis: hpqwmiex Module
 |   |_ MD5: 04C1DCBB226C6AE647B794833CE3CEB6
 |   
 |_ Jméno:  hpqwmiex
 |_ StartName: LocalSystem
 |_ Typ spouštění:  Auto Start
 |_ Status: Spuštěno
 |_ Typ:  Win32 Own Process
 |_ Dependency: RPCSS

[X] Java Quick Starter
 |_ Cesta: C:\Program Files\Java\jre6\bin\jqs.exe -service -config C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf
 |   |_ Výrobce:  
 |   |_ Popis: 
 |   |_ MD5: 
 |   
 |_ Jméno:  JavaQuickStarterService
 |_ StartName: LocalSystem
 |_ Typ spouštění:  Auto Start
 |_ Status: Spuštěno
 |_ Typ:  Win32 Own Process
 |_ Dependency: 

[?] Pml Driver HPZ12
 |_ Cesta: C:\WINDOWS\System32\svchost.exe
 |   |_ Výrobce:  Microsoft Corporation
 |   |_ Popis: Generic Host Process for Win32 Services
 |   |_ MD5: DFBA2915B0BF58ABB288CD4C9318CB3F
 |   
 |_ ServiceDLL: C:\WINDOWS\system32\HPZipm12.dll
 |   |_ Výrobce:  Hewlett-Packard
 |   |_ Popis: PmlDrv Module
 |   |_ MD5: 3CECDA26586CA4DB9BE51241A6DB7C3C
 |   
 |_ Jméno:  Pml Driver HPZ12
 |_ StartName: NT AUTHORITY\LocalService
 |_ Typ spouštění:  Auto Start
 |_ Status: Spuštěno
 |_ Typ:  Win32 Own Process
 |_ Dependency: 


Ovladače (Zobraz běžící: True, Zobraz zastavené: False, Zobraz i bezpečné služby: False)
================================================================
[?] Accelerometer
 |_ Cesta: C:\WINDOWS\system32\DRIVERS\Accelerometer.sys
 |   |_ Výrobce:  Hewlett-Packard Corporation
 |   |_ Popis: HP Accelerometer
 |   |_ MD5: 558A0039F0EF634397E1F61055504478
 |   
 |_ Jméno:  Accelerometer
 |_ StartName: 
 |_ Typ spouštění:  Ruční spuštění
 |_ Status: Spuštěno
 |_ Typ:  Kernel Driver
 |_ Dependency: 

[?] ADI UAA Function Driver for High Definition Audio Service
 |_ Cesta: C:\WINDOWS\system32\drivers\ADIHdAud.sys
 |   |_ Výrobce:  Analog Devices, Inc.
 |   |_ Popis: High Definition Audio Function Driver
 |   |_ MD5: BE4BEB3FDE3EDFAD4EF2760722717B0F
 |   
 |_ Jméno:  ADIHdAudAddService
 |_ StartName: 
 |_ Typ spouštění:  Ruční spuštění
 |_ Status: Spuštěno
 |_ Typ:  Kernel Driver
 |_ Dependency: 

[?] Agere Systems Soft Modem
 |_ Cesta: C:\WINDOWS\system32\DRIVERS\AGRSM.sys
 |   |_ Výrobce:  Agere Systems
 |   |_ Popis: SoftModem Device Driver
 |   |_ MD5: 90456051C422E09BC36E6340DD891F0C
 |   
 |_ Jméno:  AgereSoftModem
 |_ StartName: 
 |_ Typ spouštění:  Ruční spuštění
 |_ Status: Spuštěno
 |_ Typ:  Kernel Driver
 |_ Dependency: 

[?] ati2mtag
 |_ Cesta: C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
 |   |_ Výrobce:  ATI Technologies Inc.
 |   |_ Popis: ATI Radeon WindowsNT Miniport Driver
 |   |_ MD5: A1789368B4A31D2111AF7AEDA0C8D3FC
 |   
 |_ Jméno:  ati2mtag
 |_ StartName: 
 |_ Typ spouštění:  Ruční spuštění
 |_ Status: Spuštěno
 |_ Typ:  Kernel Driver
 |_ Dependency: 

[?] Broadcom NetLink (TM) Gigabit Ethernet
 |_ Cesta: C:\WINDOWS\system32\DRIVERS\b57xp32.sys
 |   |_ Výrobce:  Broadcom Corporation
 |   |_ Popis: Broadcom NetXtreme Gigabit Ethernet NDIS5.1 Driver.
 |   |_ MD5: 74A65415DFAAD20F06E7550FA9B6E012
 |   
 |_ Jméno:  b57w2k
 |_ StartName: 
 |_ Typ spouštění:  Ruční spuštění
 |_ Status: Spuštěno
 |_ Typ:  Kernel Driver
 |_ Dependency: 

[?] Bluetooth Bus Enumerator
 |_ Cesta: C:\WINDOWS\system32\DRIVERS\btkrnl.sys
 |   |_ Výrobce:  Broadcom Corporation.
 |   |_ Popis: Bluetooth Bus Enumerator
 |   |_ MD5: BA57F31EAB93DC597D772F6F5B9ED54F
 |   
 |_ Jméno:  BTKRNL
 |_ StartName: 
 |_ Typ spouštění:  Ruční spuštění
 |_ Status: Spuštěno
 |_ Typ:  Kernel Driver
 |_ Dependency: 

[?] eabfiltr
 |_ Cesta: C:\WINDOWS\system32\DRIVERS\eabfiltr.sys
 |   |_ Výrobce:  Hewlett-Packard Development Company, L.P.
 |   |_ Popis: QLB PS/2 Keyboard filter driver
 |   |_ MD5: E88B0CFCECF745211BBA87F44F85D0DD
 |   
 |_ Jméno:  eabfiltr
 |_ StartName: 
 |_ Typ spouštění:  System Start
 |_ Status: Spuštěno
 |_ Typ:  Kernel Driver
 |_ Dependency: 

[?] HBtnKey
 |_ Cesta: C:\WINDOWS\system32\DRIVERS\cpqbttn.sys
 |   |_ Výrobce:  Hewlett-Packard Development Company, L.P.
 |   |_ Popis: HP Tablet PC Key Button HID Driver
 |   |_ MD5: DE15777902A5D9121857D155873A1D1B
 |   
 |_ Jméno:  HBtnKey
 |_ StartName: 
 |_ Typ spouštění:  Ruční spuštění
 |_ Status: Spuštěno
 |_ Typ:  Kernel Driver
 |_ Dependency: 

[?] HP Disk Filter Driver
 |_ Cesta: C:\WINDOWS\system32\DRIVERS\hpdskflt.sys
 |   |_ Výrobce:  Hewlett-Packard Corporation
 |   |_ Popis: HP Disk Filter
 |   |_ MD5: 5953C0952E4DD2B25B9ADEF05AB0285C
 |   
 |_ Jméno:  hpdskflt
 |_ StartName: 
 |_ Typ spouštění:  Boot Start
 |_ Status: Spuštěno
 |_ Typ:  Kernel Driver
 |_ Dependency: 

[?] IFXTPM
 |_ Cesta: C:\WINDOWS\system32\DRIVERS\IFXTPM.SYS
 |   |_ Výrobce:  Infineon Technologies AG
 |   |_ Popis: Infineon Trusted Platform Module
 |   |_ MD5: F67554DA27D5B55EFCB6C7CB4818FBFD
 |   
 |_ Jméno:  IFXTPM
 |_ StartName: 
 |_ Typ spouštění:  Ruční spuštění
 |_ Status: Spuštěno
 |_ Typ:  Kernel Driver
 |_ Dependency: 

[?] PxHelp20
 |_ Cesta: C:\WINDOWS\System32\Drivers\PxHelp20.sys
 |   |_ Výrobce:  Sonic Solutions
 |   |_ Popis: Px Engine Device Driver for Windows 2000/XP
 |   |_ MD5: FEFFCFDC528764A04C8ED63D5FA6E711
 |   
 |_ Jméno:  PxHelp20
 |_ StartName: 
 |_ Typ spouštění:  Boot Start
 |_ Status: Spuštěno
 |_ Typ:  Kernel Driver
 |_ Dependency: 

[?] RsvLock
 |_ Cesta: C:\WINDOWS\system32\drivers\RsvLock.sys
 |   |_ Výrobce:  SafeBoot International
 |   |_ Popis: SafeBoot Reserved Files Lock Driver
 |   |_ MD5: 874ED329B959E7CA77168FD0F1B837E2
 |   
 |_ Jméno:  RsvLock
 |_ StartName: 
 |_ Typ spouštění:  System Start
 |_ Status: Spuštěno
 |_ Typ:  Kernel Driver
 |_ Dependency: 

[?] SafeBoot
 |_ Cesta: C:\WINDOWS\system32\drivers\SafeBoot.sys
 |   |_ Výrobce:  
 |   |_ Popis: 
 |   |_ MD5: 
 |   
 |_ Jméno:  SafeBoot
 |_ StartName: 
 |_ Typ spouštění:  Boot Start
 |_ Status: Spuštěno
 |_ Typ:  Kernel Driver
 |_ Dependency: 

[?] SbAlg
 |_ Cesta: C:\WINDOWS\system32\drivers\SbAlg.sys
 |   |_ Výrobce:  SafeBoot N.V.
 |   |_ Popis: SafeBoot FIPS AES Algorithm (256 bit)
 |   |_ MD5: F6367FB350F8E5D3F6DD8040E4C0E33B
 |   
 |_ Jméno:  SbAlg
 |_ StartName: 
 |_ Typ spouštění:  Boot Start
 |_ Status: Spuštěno
 |_ Typ:  Kernel Driver
 |_ Dependency: 

[?] Synaptics TouchPad Driver
 |_ Cesta: C:\WINDOWS\system32\DRIVERS\SynTP.sys
 |   |_ Výrobce:  Synaptics, Inc.
 |   |_ Popis: Synaptics Touchpad Driver
 |   |_ MD5: 5876072999220EF2FBA1DDEC86D2B97E
 |   
 |_ Jméno:  SynTP
 |_ StartName: 
 |_ Typ spouštění:  Ruční spuštění
 |_ Status: Spuštěno
 |_ Typ:  Kernel Driver
 |_ Dependency: 

[?] ViaIde
 |_ Cesta: C:\WINDOWS\system32\DRIVERS\viaide.sys
 |   |_ Výrobce:  Microsoft Corporation
 |   |_ Popis: Generic PCI IDE Bus Driver
 |   |_ MD5: 59CB1338AD3654417BEA49636457F65D
 |   
 |_ Jméno:  ViaIde
 |_ StartName: 
 |_ Typ spouštění:  Boot Start
 |_ Status: Spuštěno
 |_ Typ:  Kernel Driver
 |_ Dependency: 

[?] UDS Master Bus of Kernel USB Software Bus by TCP
 |_ Cesta: C:\WINDOWS\System32\Drivers\ZyxelUDSMBus.sys
 |   |_ Výrobce:  Windows (R) Codename Longhorn DDK provider
 |   |_ Popis: KCodes Master Bus of USB Software Bus By TCP
 |   |_ MD5: 8DF8791EF72BB16B3E3CB29A53F24B7D
 |   
 |_ Jméno:  ZyxelUDSMBus
 |_ StartName: 
 |_ Typ spouštění:  Ruční spuštění
 |_ Status: Spuštěno
 |_ Typ:  Kernel Driver
 |_ Dependency: 


lNetStat
================================================================
Typ:  PID       Proces              Local <-> Remote                             Status
-----------------------------------------------------------------------------------------
TCP (4000)    Skype.exe           0.0.0.0:80                                   LISTENING
TCP (1748)    svchost.exe         0.0.0.0:135                                  LISTENING
TCP (212)     PMB.exe             0.0.0.0:443                                  LISTENING
TCP (4)       Systém              0.0.0.0:445                                  LISTENING
TCP (212)     PMB.exe             0.0.0.0:563                                  LISTENING
TCP (1972)    mqsvc.exe           0.0.0.0:1027                                 LISTENING
TCP (1972)    mqsvc.exe           0.0.0.0:1801                                 LISTENING
TCP (1972)    mqsvc.exe           0.0.0.0:2103                                 LISTENING
TCP (1972)    mqsvc.exe           0.0.0.0:2105                                 LISTENING
TCP (1972)    mqsvc.exe           0.0.0.0:2107                                 LISTENING
TCP (4000)    Skype.exe           0.0.0.0:54206                                LISTENING
TCP (212)     PMB.exe             0.0.0.0:57059                                LISTENING
TCP (2660)    alg.exe             127.0.0.1:1028                               LISTENING
TCP (3928)    MOM.exe             127.0.0.1:1058                               LISTENING
TCP (1756)    CCC.exe             127.0.0.1:1059                               LISTENING
TCP (212)     PMB.exe             127.0.0.1:1070 <-> 127.0.0.1:1071            ESTABLISHED
TCP (212)     PMB.exe             127.0.0.1:1071 <-> 127.0.0.1:1070            ESTABLISHED
TCP (212)     PMB.exe             127.0.0.1:1072 <-> 127.0.0.1:1073            ESTABLISHED
TCP (212)     PMB.exe             127.0.0.1:1073 <-> 127.0.0.1:1072            ESTABLISHED
TCP (212)     PMB.exe             127.0.0.1:1074 <-> 127.0.0.1:1075            ESTABLISHED
TCP (212)     PMB.exe             127.0.0.1:1075 <-> 127.0.0.1:1074            ESTABLISHED
TCP (212)     PMB.exe             127.0.0.1:1077 <-> 127.0.0.1:1078            ESTABLISHED
TCP (212)     PMB.exe             127.0.0.1:1078 <-> 127.0.0.1:1077            ESTABLISHED
TCP (212)     PMB.exe             127.0.0.1:1079 <-> 127.0.0.1:1080            ESTABLISHED
TCP (212)     PMB.exe             127.0.0.1:1080 <-> 127.0.0.1:1079            ESTABLISHED
TCP (4000)    Skype.exe           127.0.0.1:1083 <-> 127.0.0.1:30606           ESTABLISHED
TCP (4000)    Skype.exe           127.0.0.1:1103 <-> 127.0.0.1:30606           ESTABLISHED
TCP (212)     PMB.exe             127.0.0.1:1134 <-> 127.0.0.1:1135            ESTABLISHED
TCP (212)     PMB.exe             127.0.0.1:1135 <-> 127.0.0.1:1134            ESTABLISHED
TCP (3940)    CCC.exe             127.0.0.1:1263                               LISTENING
TCP (2404)    jusched.exe         127.0.0.1:1659                               CLOSE_WAIT
TCP (0)       127.0.0.1:2401                               TIME_WAIT
TCP (196)     UPM.exe             127.0.0.1:2816                               CLOSE_WAIT
TCP (1004)    Ad-AwareAdmin.exe   127.0.0.1:2841 <-> 127.0.0.1:30606           ESTABLISHED
TCP (0)       127.0.0.1:2864                               TIME_WAIT
TCP (212)     PMB.exe             127.0.0.1:2871 <-> 127.0.0.1:30606           ESTABLISHED
TCP (0)       127.0.0.1:2877                               TIME_WAIT
TCP (0)       127.0.0.1:2881                               TIME_WAIT
TCP (196)     UPM.exe             127.0.0.1:2907                               CLOSE_WAIT
TCP (196)     UPM.exe             127.0.0.1:2909 <-> 127.0.0.1:30606           ESTABLISHED
TCP (196)     UPM.exe             127.0.0.1:2911 <-> 127.0.0.1:30606           ESTABLISHED
TCP (196)     UPM.exe             127.0.0.1:2913 <-> 127.0.0.1:30606           ESTABLISHED
TCP (196)     UPM.exe             127.0.0.1:2915 <-> 127.0.0.1:30606           ESTABLISHED
TCP (212)     PMB.exe             127.0.0.1:2917 <-> 127.0.0.1:30606           ESTABLISHED
TCP (212)     PMB.exe             127.0.0.1:2919 <-> 127.0.0.1:30606           ESTABLISHED
TCP (624)     jqs.exe             127.0.0.1:5152                               LISTENING
TCP (452)     ekrn.exe            127.0.0.1:30606                              LISTENING
TCP (452)     ekrn.exe            127.0.0.1:30606 <-> 127.0.0.1:1083           ESTABLISHED
TCP (452)     ekrn.exe            127.0.0.1:30606 <-> 127.0.0.1:1103           ESTABLISHED
TCP (0)       127.0.0.1:30606                              TIME_WAIT
TCP (452)     ekrn.exe            127.0.0.1:30606                              FIN_WAIT2
TCP (0)       127.0.0.1:30606                              TIME_WAIT
TCP (0)       127.0.0.1:30606                              TIME_WAIT
TCP (452)     ekrn.exe            127.0.0.1:30606 <-> 127.0.0.1:2841           ESTABLISHED
TCP (0)       127.0.0.1:30606                              TIME_WAIT
TCP (0)       127.0.0.1:30606                              TIME_WAIT
TCP (0)       127.0.0.1:30606                              TIME_WAIT
TCP (0)       127.0.0.1:30606                              TIME_WAIT
TCP (452)     ekrn.exe            127.0.0.1:30606 <-> 127.0.0.1:2871           ESTABLISHED
TCP (0)       127.0.0.1:30606                              TIME_WAIT
TCP (0)       127.0.0.1:30606                              TIME_WAIT
TCP (0)       127.0.0.1:30606                              TIME_WAIT
TCP (0)       127.0.0.1:30606                              TIME_WAIT
TCP (452)     ekrn.exe            127.0.0.1:30606                              FIN_WAIT2
TCP (452)     ekrn.exe            127.0.0.1:30606 <-> 127.0.0.1:2909           ESTABLISHED
TCP (452)     ekrn.exe            127.0.0.1:30606 <-> 127.0.0.1:2911           ESTABLISHED
TCP (452)     ekrn.exe            127.0.0.1:30606 <-> 127.0.0.1:2913           ESTABLISHED
TCP (452)     ekrn.exe            127.0.0.1:30606 <-> 127.0.0.1:2915           ESTABLISHED
TCP (452)     ekrn.exe            127.0.0.1:30606 <-> 127.0.0.1:2917           ESTABLISHED
TCP (452)     ekrn.exe            127.0.0.1:30606 <-> 127.0.0.1:2919           ESTABLISHED
TCP (1544)    svchost.exe         127.0.0.1:49100                              LISTENING
TCP (212)     PMB.exe             127.0.0.1:60524                              LISTENING
TCP (4)       Systém              192.168.1.34:139                             LISTENING
TCP (452)     ekrn.exe            192.168.1.34:1084 <-> 94.158.217.214:25882   ESTABLISHED
TCP (452)     ekrn.exe            192.168.1.34:1104 <-> 212.161.8.6:12350      ESTABLISHED
TCP (452)     ekrn.exe            192.168.1.34:2509                            LAST_ACK
TCP (452)     ekrn.exe            192.168.1.34:2842 <-> 68.232.34.73:80        ESTABLISHED
TCP (0)       192.168.1.34:2884                            TIME_WAIT
TCP (452)     ekrn.exe            192.168.1.34:2888 <-> 46.116.201.233:56729   ESTABLISHED
TCP (0)       192.168.1.34:2890                            TIME_WAIT
TCP (0)       192.168.1.34:2893                            TIME_WAIT
TCP (452)     ekrn.exe            192.168.1.34:2910 <-> 199.7.48.190:80        ESTABLISHED
TCP (452)     ekrn.exe            192.168.1.34:2912 <-> 199.7.51.190:80        ESTABLISHED
TCP (452)     ekrn.exe            192.168.1.34:2914 <-> 199.7.52.190:80        ESTABLISHED
TCP (452)     ekrn.exe            192.168.1.34:2916 <-> 199.7.51.190:80        ESTABLISHED
TCP (452)     ekrn.exe            192.168.1.34:2918                            SYN_SENT
UDP (4000)    Skype.exe           0.0.0.0:443                                  SYN_SENT
UDP (4)       Systém              0.0.0.0:445                                  
UDP (1368)    lsass.exe           0.0.0.0:500                                  
UDP (1972)    mqsvc.exe           0.0.0.0:1026                                 
UDP (212)     PMB.exe             0.0.0.0:2467                                 
UDP (212)     PMB.exe             0.0.0.0:2832                                 
UDP (212)     PMB.exe             0.0.0.0:2838                                 
UDP (212)     PMB.exe             0.0.0.0:2843                                 
UDP (212)     PMB.exe             0.0.0.0:2846                                 
UDP (212)     PMB.exe             0.0.0.0:2847                                 
UDP (212)     PMB.exe             0.0.0.0:2848                                 
UDP (212)     PMB.exe             0.0.0.0:2849                                 
UDP (212)     PMB.exe             0.0.0.0:2850                                 
UDP (212)     PMB.exe             0.0.0.0:2851                                 
UDP (212)     PMB.exe             0.0.0.0:2852                                 
UDP (212)     PMB.exe             0.0.0.0:2853                                 
UDP (212)     PMB.exe             0.0.0.0:2854                                 
UDP (212)     PMB.exe             0.0.0.0:2855                                 
UDP (212)     PMB.exe             0.0.0.0:2856                                 
UDP (212)     PMB.exe             0.0.0.0:2857                                 
UDP (212)     PMB.exe             0.0.0.0:2858                                 
UDP (212)     PMB.exe             0.0.0.0:2859                                 
UDP (212)     PMB.exe             0.0.0.0:2860                                 
UDP (212)     PMB.exe             0.0.0.0:2861                                 
UDP (212)     PMB.exe             0.0.0.0:2862                                 
UDP (212)     PMB.exe             0.0.0.0:2863                                 
UDP (212)     PMB.exe             0.0.0.0:2865                                 
UDP (212)     PMB.exe             0.0.0.0:2866                                 
UDP (212)     PMB.exe             0.0.0.0:2872                                 
UDP (212)     PMB.exe             0.0.0.0:2873                                 
UDP (212)     PMB.exe             0.0.0.0:2875                                 
UDP (212)     PMB.exe             0.0.0.0:2878                                 
UDP (212)     PMB.exe             0.0.0.0:2879                                 
UDP (212)     PMB.exe             0.0.0.0:2899                                 
UDP (212)     PMB.exe             0.0.0.0:2900                                 
UDP (212)     PMB.exe             0.0.0.0:2901                                 
UDP (212)     PMB.exe             0.0.0.0:2902                                 
UDP (212)     PMB.exe             0.0.0.0:2903                                 
UDP (212)     PMB.exe             0.0.0.0:2904                                 
UDP (212)     PMB.exe             0.0.0.0:2921                                 
UDP (1972)    mqsvc.exe           0.0.0.0:3527                                 
UDP (1368)    lsass.exe           0.0.0.0:4500                                 
UDP (4000)    Skype.exe           0.0.0.0:54206                                
UDP (212)     PMB.exe             0.0.0.0:57059                                
UDP (1948)    svchost.exe         127.0.0.1:123                                
UDP (4000)    Skype.exe           127.0.0.1:1061                               
UDP (4000)    Skype.exe           127.0.0.1:1094                               
UDP (368)     svchost.exe         127.0.0.1:1900                               
UDP (1948)    svchost.exe         192.168.1.34:123                             
UDP (4)       Systém              192.168.1.34:137                             
UDP (4)       Systém              192.168.1.34:138                             
UDP (368)     svchost.exe         192.168.1.34:1900                            
UDP (3436)    Share Center.exe    192.168.1.34:7417                            
UDP (3436)    Share Center.exe    192.168.1.49:7417                            

2. část v dalším příspěvku, nepovolené množství znaků
Nahoru
aenneus
Návštěvník
Návštěvník
Příspěvky: 5
Registrován: 27 Srp 2011 18:17

Re: upm log, mbr rootkit detected

#2 Příspěvek od aenneus »

2. část logu:


Moduly (Zobraz i bezpečné DLL: False, Jen bez výrobce: True, Zobraz registrované: False)
================================================================
[?] aswlnpkg.dll
|_ Cesta: C:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll
|_ MD5: 2EEDA27C19259C2340324EF7180D086B
|_ Výrobce: Cognizance Corporation
|_ Procesy
|_ winlogon.exe (1312)
|_ lsass.exe (1368)

[?] itmsg.dll
|_ Cesta: C:\Program Files\Hewlett-Packard\IAM\Bin\ItMsg.dll
|_ MD5: 9947DCA29209749EE0BB05FA24BC65BF
|_ Výrobce: Cognizance Corporation
|_ Procesy
|_ winlogon.exe (1312)
|_ lsass.exe (1368)
|_ svchost.exe (1544)
|_ asghost.exe (4032)
|_ pthosttr.exe (2328)

[?] trayicon.dll
|_ Cesta: C:\Program Files\Hewlett-Packard\IAM\Bin\TrayIcon.dll
|_ MD5: 4449282933FDA82E878A5C7CD46F78DE
|_ Výrobce: Bioscrypt Inc.
|_ Procesy
|_ winlogon.exe (1312)
|_ asghost.exe (4032)

[?] itdac.dll
|_ Cesta: C:\Program Files\Hewlett-Packard\IAM\Bin\ItDAC.dll
|_ MD5: 3D6BC61A133F7E0BCE8A402AB6C0BB89
|_ Výrobce: Cognizance Corporation
|_ Procesy
|_ winlogon.exe (1312)
|_ svchost.exe (1544)
|_ asghost.exe (4032)

[?] itreports.dll
|_ Cesta: C:\Program Files\Hewlett-Packard\IAM\Bin\ItReports.dll
|_ MD5: 499D5D393ED5E857E15C698681F88EB1
|_ Výrobce: Cognizance Corporation
|_ Procesy
|_ winlogon.exe (1312)
|_ svchost.exe (1544)
|_ asghost.exe (4032)
|_ pthosttr.exe (2328)

[?] aschnl.dll
|_ Cesta: C:\Program Files\Hewlett-Packard\IAM\Bin\ASChnl.dll
|_ MD5: BB3C0521ECCA4BB17AC55EB640DF0FA5
|_ Výrobce: Cognizance Corporation
|_ Procesy
|_ winlogon.exe (1312)
|_ svchost.exe (1544)
|_ asghost.exe (4032)
|_ pthosttr.exe (2328)

[?] bioauth.dll
|_ Cesta: C:\Program Files\Hewlett-Packard\IAM\Bin\BioAuth.dll
|_ MD5: E43C541A78FD73AD7161465739F524D1
|_ Výrobce: Cognizance Corporation
|_ Procesy
|_ winlogon.exe (1312)
|_ asghost.exe (4032)

[?] asbioat.dll
|_ Cesta: C:\Program Files\Hewlett-Packard\IAM\Bin\ASBioAT.dll
|_ MD5: FEDDA1F46E9E902B7870CD7C10AFE1BB
|_ Výrobce: Cognizance Corporation
|_ Procesy
|_ winlogon.exe (1312)
|_ asghost.exe (4032)

[?] stengine.dll
|_ Cesta: C:\Program Files\Hewlett-Packard\IAM\Bin\STEngine.dll
|_ MD5: 92A56EEC8CD2BFB4333C0CE500F666CE
|_ Výrobce: Cognizance Corporation
|_ Procesy
|_ winlogon.exe (1312)
|_ asghost.exe (4032)

[?] ittal.dll
|_ Cesta: C:\Program Files\Hewlett-Packard\IAM\Bin\ittal.dll
|_ MD5: 1EE5E81C26E4F15165D81179F8C5712C
|_ Výrobce: Cognizance Corporation
|_ Procesy
|_ winlogon.exe (1312)
|_ asghost.exe (4032)

[?] itvcclient.dll
|_ Cesta: C:\Program Files\Hewlett-Packard\IAM\Bin\ItVCClient.dll
|_ MD5: C4F43529C811B94BA18F6AF1A2A037F4
|_ Výrobce: Cognizance Corporation
|_ Procesy
|_ winlogon.exe (1312)
|_ asghost.exe (4032)
|_ pthosttr.exe (2328)

[?] authwiz.dll
|_ Cesta: C:\Program Files\Hewlett-Packard\IAM\Bin\AuthWiz.dll
|_ MD5: EFC847B31BC32138CB790CB2CC85173F
|_ Výrobce: Bioscrypt Inc.
|_ Procesy
|_ winlogon.exe (1312)
|_ svchost.exe (1544)
|_ asghost.exe (4032)
|_ pthosttr.exe (2328)

[?] apshook.dll
|_ Cesta: C:\WINDOWS\system32\APSHook.dll
|_ MD5: 26D017054EA002B6FE4E2AAA9CAE04B8
|_ Výrobce: Bioscrypt Inc.
|_ Procesy
|_ winlogon.exe (1312)
|_ services.exe (1356)
|_ lsass.exe (1368)
|_ svchost.exe (1544)
|_ ati2evxx.exe (1580)
|_ svchost.exe (1600)
|_ HpFkCrypt.exe (1688)
|_ svchost.exe (1748)
|_ svchost.exe (1948)
|_ btwdins.exe (1976)
|_ svchost.exe (312)
|_ svchost.exe (368)
|_ ati2evxx.exe (788)
|_ spoolsv.exe (952)
|_ Ad-AwareAdmin.exe (1004)
|_ svchost.exe (232)
|_ msdtc.exe (272)
|_ NetworkLicenseServer.exe (420)
|_ ekrn.exe (452)
|_ FUSServices.exe (468)
|_ iviRegMgr.exe (492)
|_ jqs.exe (624)
|_ LSSrvc.exe (656)
|_ pdfsvc.exe (1112)
|_ svchost.exe (1180)
|_ svchost.exe (1800)
|_ mqsvc.exe (1972)
|_ hpqWmiEx.exe (1224)
|_ mqtgsvc.exe (2140)
|_ unsecapp.exe (2268)
|_ wmiprvse.exe (2632)
|_ alg.exe (2660)
|_ scardsvr.exe (2920)
|_ explorer.exe (4044)
|_ pdfsty.exe (2316)
|_ pthosttr.exe (2328)
|_ SynTPEnh.exe (2336)
|_ HPWAMain.exe (2344)
|_ jusched.exe (2404)
|_ QLBCTRL.exe (2436)
|_ hpwuSchd2.exe (3040)
|_ accelerometerST.exe (3304)
|_ MFFSUM.exe (3360)
|_ MFPrintServer.exe (3400)
|_ Share Center.exe (3436)
|_ MFServices.exe (3748)
|_ egui.exe (3780)
|_ ctfmon.exe (3804)
|_ LightScribeControlPanel.exe (3912)
|_ MOM.exe (3928)
|_ Skype.exe (4000)
|_ HpqToaster.exe (152)
|_ PMB.exe (212)
|_ BTTray.exe (2656)
|_ soffice.exe (3168)
|_ soffice.bin (156)
|_ CCC.exe (1756)
|_ AAWTray.exe (3696)
|_ wuauclt.exe (3208)
|_ LF2GRPOW.EXE (2700)
|_ wmiapsrv.exe (2936)
|_ CCC.exe (3940)
|_ UPM.exe (196)

[?] msvcr70.dll
|_ Cesta: C:\WINDOWS\system32\msvcr70.dll
|_ MD5: 5A542C4E0F036431D0B7B607FC08758F
|_ Výrobce: Microsoft Corporation
|_ Procesy
|_ winlogon.exe (1312)
|_ lsass.exe (1368)
|_ svchost.exe (1544)
|_ asghost.exe (4032)
|_ pthosttr.exe (2328)

[?] bioauthsrv.dll
|_ Cesta: C:\Program Files\Hewlett-Packard\IAM\Bin\BioAuthSrv.dll
|_ MD5: 687238E9301D6014709F37A0CCC8027B
|_ Výrobce: Cognizance Corporation
|_ Procesy
|_ svchost.exe (1544)

[?] itvcserver.dll
|_ Cesta: C:\Program Files\Hewlett-Packard\IAM\Bin\ItVCServer.dll
|_ MD5: F0B91ABC28A32C16A7F281BAA1A9EF15
|_ Výrobce: Cognizance Corporation
|_ Procesy
|_ svchost.exe (1544)

[?] itvcard.dll
|_ Cesta: C:\Program Files\Hewlett-Packard\IAM\Bin\ItVCard.dll
|_ MD5: 53DC82B1A5BFE755CB44860EF24E6D16
|_ Výrobce: Cognizance Corporation
|_ Procesy
|_ svchost.exe (1544)
|_ asghost.exe (4032)

[?] itauth.dll
|_ Cesta: C:\Program Files\Hewlett-Packard\IAM\Bin\ItAuth.dll
|_ MD5: C380558BF897A1DC4B0E096BF93DEAC0
|_ Výrobce: Cognizance Corporation
|_ Procesy
|_ svchost.exe (1544)

[?] cspll2p.dll
|_ Cesta: C:\WINDOWS\system32\CSPLL2P.dll
|_ MD5: 98DDF1257A2B4C708861E57DDCC886C4
|_ Výrobce: OEM
|_ Procesy
|_ spoolsv.exe (952)

[?] widcommsdk.dll
|_ Cesta: C:\WINDOWS\system32\WidcommSdk.dll
|_ MD5: 86EB320066C74A7F44FC03F8C61A2F2F
|_ Výrobce: Broadcom Corporation.
|_ Procesy
|_ spoolsv.exe (952)

[?] wbtapi.dll
|_ Cesta: C:\WINDOWS\system32\wbtapi.dll
|_ MD5: FEDBD447C75CF934150F85A6DE08DACC
|_ Výrobce: Broadcom Corporation.
|_ Procesy
|_ spoolsv.exe (952)
|_ BTTray.exe (2656)

[?] aspnet_isapi.dll
|_ Cesta: C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_isapi.dll
|_ MD5: 1BF5ADCDC841B69AB00187ABD53253A1
|_ Výrobce: Microsoft Corporation
|_ Procesy
|_ jqs.exe (624)
|_ Skype.exe (4000)

[?] lssproxy.dll
|_ Cesta: C:\Program Files\Common Files\LightScribe\LSSProxy.dll
|_ MD5: 2CD31EE61D5D5329107FFDE66B8A00A5
|_ Výrobce: Hewlett-Packard Company
|_ Procesy
|_ LSSrvc.exe (656)

[?] lslog.dll
|_ Cesta: C:\Program Files\Common Files\LightScribe\LSLog.dll
|_ MD5: E50EF1A6E2A82160E470EE042AFCFB38
|_ Výrobce: Hewlett-Packard Company
|_ Procesy
|_ LSSrvc.exe (656)

[?] itsso.dll
|_ Cesta: C:\Program Files\Hewlett-Packard\IAM\Bin\ItSSO.dll
|_ MD5: 663CCCA76CB493E4E9605EDBC82BFCA9
|_ Výrobce: Cognizance Corporation
|_ Procesy
|_ asghost.exe (4032)

[?] rasadmin.dll
|_ Cesta: C:\Program Files\Hewlett-Packard\IAM\Bin\RasAdmin.dll
|_ MD5: 68586D694F957BB9C96B3EB840D8335C
|_ Výrobce: Cognizance Corporation
|_ Procesy
|_ asghost.exe (4032)

[?] pkiadmin.dll
|_ Cesta: C:\Program Files\Hewlett-Packard\IAM\Bin\PkiAdmin.dll
|_ MD5: 1B6C774A43709852C2DAC77664B23792
|_ Výrobce: Cognizance Corporation
|_ Procesy
|_ asghost.exe (4032)

[?] itaps.dll
|_ Cesta: C:\Program Files\Hewlett-Packard\IAM\Bin\ItAPS.dll
|_ MD5: 733A886451F373E32E2B7BF67DE218E8
|_ Výrobce: Cognizance Corporation
|_ Procesy
|_ asghost.exe (4032)

[?] ssomngr.dll
|_ Cesta: C:\Program Files\Hewlett-Packard\IAM\Bin\SSOMngr.dll
|_ MD5: 2ADD6048453D5CCE7C20830AD40C8EDA
|_ Výrobce: Cognizance Corporation
|_ Procesy
|_ asghost.exe (4032)

[?] netadmin.dll
|_ Cesta: C:\Program Files\Hewlett-Packard\IAM\Bin\NetAdmin.dll
|_ MD5: A905DF4631F440D7251FFE5122430A54
|_ Výrobce: Cognizance Corporation
|_ Procesy
|_ asghost.exe (4032)

[?] btncopy.dll
|_ Cesta: C:\WINDOWS\system32\BTNCopy.dll
|_ MD5: E42C215DF4C92624E498FBC9E1F89403
|_ Výrobce: Broadcom Corporation.
|_ Procesy
|_ explorer.exe (4044)

[?] btmmhook.dll
|_ Cesta: C:\WINDOWS\system32\BtMmHook.dll
|_ MD5: 645BDE5DDAAE79F887B9E91EEBFD164F
|_ Výrobce: Broadcom Corporation.
|_ Procesy
|_ explorer.exe (4044)
|_ MFPrintServer.exe (3400)
|_ Share Center.exe (3436)
|_ MFServices.exe (3748)
|_ egui.exe (3780)
|_ Skype.exe (4000)
|_ BTTray.exe (2656)
|_ wuauclt.exe (3208)
|_ UPM.exe (196)

[?] btkeyind.dll
|_ Cesta: C:\Program Files\WIDCOMM\Bluetooth Software\BTKeyInd.dll
|_ MD5: C38A99702435CFE437858506B0247A62
|_ Výrobce:
|_ Procesy
|_ explorer.exe (4044)
|_ egui.exe (3780)
|_ BTTray.exe (2656)
|_ UPM.exe (196)

[?] shlxthdl.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
|_ MD5: B0057A8BEB1F7CC88662BEC2B262966E
|_ Výrobce: OpenOffice.org
|_ Procesy
|_ explorer.exe (4044)

[?] hpwmibiossettings.dll
|_ Cesta: C:\Program Files\Hewlett-Packard\HP BIOS Configuration for ProtectTools\HPWMIBIOSSettings.dll
|_ MD5: 60317BFC4760A7936A898930E175AAAD
|_ Výrobce: Hewlett-Packard
|_ Procesy
|_ pthosttr.exe (2328)

[?] sbhpfve.dll
|_ Cesta: C:\Program Files\Hewlett-Packard\Drive Encryption\SbHpFve.dll
|_ MD5: 60E5D96ED908635AA4EC3026A770A923
|_ Výrobce: SafeBoot International
|_ Procesy
|_ pthosttr.exe (2328)

[?] sbhpfverecovery.dll
|_ Cesta: C:\Program Files\Hewlett-Packard\Drive Encryption\SbHpFveRecovery.dll
|_ MD5: 05BBCFED69EF86F6EDC536582794AAF2
|_ Výrobce: SafeBoot International
|_ Procesy
|_ pthosttr.exe (2328)

[?] hpplugin.dll
|_ Cesta: C:\Program Files\Hewlett-Packard\IAM\Bin\HPPlugIn.dll
|_ MD5: EE55D481ADCABE66A6DD6FC5F7B50432
|_ Výrobce: Cognizance Corporation
|_ Procesy
|_ pthosttr.exe (2328)

[?] settings.dll
|_ Cesta: C:\Program Files\Hewlett-Packard\IAM\Bin\Settings.dll
|_ MD5: CD5AC860380A7E6A65221D5EAC37681E
|_ Výrobce: Cognizance Corporation
|_ Procesy
|_ pthosttr.exe (2328)

[?] qlbservice.dll
|_ Cesta: C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBSERVICE.dll
|_ MD5: DD575C48B02261C39DE5BCCE4EC7105A
|_ Výrobce: Hewlett-Packard Development Company, L.P.
|_ Procesy
|_ QLBCTRL.exe (2436)

[?] hpevents.dll
|_ Cesta: C:\WINDOWS\system32\HPEvents.dll
|_ MD5: 03F77C98F0F32DCF2A247DEA1480FCFF
|_ Výrobce: Hewlett-Packard
|_ Procesy
|_ Scheduler.exe (3016)

[?] naspp.dll
|_ Cesta: C:\WINDOWS\SMINST\naspp.dll
|_ MD5: 4413A132A5F480FFFFA531B7DE8240BB
|_ Výrobce:
|_ Procesy
|_ Scheduler.exe (3016)

[?] advanced.dll
|_ Cesta: C:\Program Files\Xerox Companion Suite\Advanced.dll
|_ MD5: A248E879DCE12AE186D973189A53CAF9
|_ Výrobce:
|_ Procesy
|_ MFFSUM.exe (3360)

[?] sustring.dll
|_ Cesta: C:\Program Files\Xerox Companion Suite\SuString.dll
|_ MD5: 84C7D57488A95EF9A4C1A05470647194
|_ Výrobce:
|_ Procesy
|_ MFFSUM.exe (3360)

[?] utility32.dll
|_ Cesta: C:\Program Files\Xerox Companion Suite\Utility32.dll
|_ MD5: 7EDA79872C51F1FA9E54E4E06F5108CF
|_ Výrobce: Copyright (C) 2002
|_ Procesy
|_ MFFSUM.exe (3360)

[?] advancedu.dll
|_ Cesta: C:\Program Files\Xerox Companion Suite\AdvancedU.dll
|_ MD5: A14BE8E381CA3C8117AB93AABDEA9D0C
|_ Výrobce:
|_ Procesy
|_ MFPrintServer.exe (3400)
|_ MFServices.exe (3748)

[?] sustringu.dll
|_ Cesta: C:\Program Files\Xerox Companion Suite\SuStringU.dll
|_ MD5: 85F57EC1691FAB3777E1CB3ABBEFEC0C
|_ Výrobce:
|_ Procesy
|_ MFPrintServer.exe (3400)
|_ MFServices.exe (3748)

[?] utility32u.dll
|_ Cesta: C:\Program Files\Xerox Companion Suite\Utility32U.dll
|_ MD5: 5F9995E5E2E6307237F2EC1E7E69CDE5
|_ Výrobce: Copyright (C) 2002
|_ Procesy
|_ MFPrintServer.exe (3400)
|_ MFServices.exe (3748)

[?] controlsu.dll
|_ Cesta: C:\Program Files\Xerox Companion Suite\ControlsU.dll
|_ MD5: E93A72ECBB53F9EFF888588A2694E57A
|_ Výrobce: Copyright (C) 2002
|_ Procesy
|_ MFPrintServer.exe (3400)
|_ MFServices.exe (3748)

[?] graphicsu.dll
|_ Cesta: C:\Program Files\Xerox Companion Suite\GraphicsU.dll
|_ MD5: BCDF9F3B7C47A4DEFE1D36296D620491
|_ Výrobce: Copyright (C) 2002
|_ Procesy
|_ MFPrintServer.exe (3400)
|_ MFServices.exe (3748)

[?] protocolu.dll
|_ Cesta: C:\Program Files\Xerox Companion Suite\ProtocolU.dll
|_ MD5: B0E628356DABDB360033F1AC669EA36E
|_ Výrobce: Copyright (C) 2003
|_ Procesy
|_ MFPrintServer.exe (3400)
|_ MFServices.exe (3748)

[?] routeru.dll
|_ Cesta: C:\Program Files\Xerox Companion Suite\RouterU.dll
|_ MD5: 3E757C30C8479D5B673E90DE33803171
|_ Výrobce: Copyright (C) 2003
|_ Procesy
|_ MFPrintServer.exe (3400)
|_ MFServices.exe (3748)

[?] pdg32u.dll
|_ Cesta: C:\Program Files\Xerox Companion Suite\Pdg32U.dll
|_ MD5: AEEE81B41B94202D576B6DB2E5DE221E
|_ Výrobce: Copyright (C) 1997
|_ Procesy
|_ MFPrintServer.exe (3400)

[?] componentsu.dll
|_ Cesta: C:\Program Files\Xerox Companion Suite\ComponentsU.dll
|_ MD5: 64C19BD5C273CD9DD2E604291C89D742
|_ Výrobce: Copyright (C) 2003
|_ Procesy
|_ MFPrintServer.exe (3400)
|_ MFServices.exe (3748)

[?] faxu.dll
|_ Cesta: C:\Program Files\Xerox Companion Suite\FAXU.dll
|_ MD5: C12CBA5F1BFA1FC502358E5240A41523
|_ Výrobce: Copyright (C) 2003
|_ Procesy
|_ MFPrintServer.exe (3400)

[?] tiffu.dll
|_ Cesta: C:\Program Files\Xerox Companion Suite\TiffU.dll
|_ MD5: EB126742A38B86C474F4E0DB3430A635
|_ Výrobce:
|_ Procesy
|_ MFPrintServer.exe (3400)
|_ MFServices.exe (3748)

[?] imgman32.dll
|_ Cesta: C:\Program Files\Xerox Companion Suite\imgman32.dll
|_ MD5: 86C5AAC31EA7909121327701045F74BD
|_ Výrobce: Data Techniques, Inc.
|_ Procesy
|_ MFPrintServer.exe (3400)
|_ MFServices.exe (3748)

[?] addressbooku.dll
|_ Cesta: C:\Program Files\Xerox Companion Suite\AddressBookU.dll
|_ MD5: AB2A5983B4D752EDEDC85AB3C60EBE8B
|_ Výrobce: Copyright (C) 2003
|_ Procesy
|_ MFPrintServer.exe (3400)
|_ MFServices.exe (3748)

[?] digitalizeru.dll
|_ Cesta: C:\Program Files\Xerox Companion Suite\DigitalizerU.dll
|_ MD5: 5A7286E6E12C7329C411000B233D092D
|_ Výrobce: Copyright (C) 2003
|_ Procesy
|_ MFPrintServer.exe (3400)
|_ MFServices.exe (3748)

[?] printfaxu.dll
|_ Cesta: C:\Program Files\Xerox Companion Suite\PrintFaxU.dll
|_ MD5: 9B1940B011B8C820097F8C1944BAB0BF
|_ Výrobce: Copyright (C) 2003
|_ Procesy
|_ MFPrintServer.exe (3400)

[?] mfservicetr29u.dll
|_ Cesta: C:\Program Files\Xerox Companion Suite\MFServiceTR29U.dll
|_ MD5: 3F4F08B50708DDEAA639733EC4017067
|_ Výrobce: Copyright (C) 2004
|_ Procesy
|_ MFPrintServer.exe (3400)
|_ MFServices.exe (3748)

[?] im31bmp.dil
|_ Cesta: C:\Program Files\Xerox Companion Suite\IM31bmp.dil
|_ MD5: 14A627150EBAE8C36BDC24C7F9A0C1A7
|_ Výrobce: Data Techniques, Inc.
|_ Procesy
|_ MFPrintServer.exe (3400)
|_ MFServices.exe (3748)

[?] im31img.dil
|_ Cesta: C:\Program Files\Xerox Companion Suite\IM31img.dil
|_ MD5: 9F22E3CE1639917EB07DCC730CD0D410
|_ Výrobce: Data Techniques, Inc.
|_ Procesy
|_ MFPrintServer.exe (3400)
|_ MFServices.exe (3748)

[?] im31jpg.dil
|_ Cesta: C:\Program Files\Xerox Companion Suite\IM31jpg.dil
|_ MD5: C2BFD1660BC1D6CF836F584422535FAF
|_ Výrobce: Data Techniques, Inc.
|_ Procesy
|_ MFPrintServer.exe (3400)
|_ MFServices.exe (3748)

[?] im31tif.dil
|_ Cesta: C:\Program Files\Xerox Companion Suite\IM31tif.dil
|_ MD5: 6333BD389E925340ACF16A6D325C6AFD
|_ Výrobce: Data Techniques, Inc.
|_ Procesy
|_ MFPrintServer.exe (3400)
|_ MFServices.exe (3748)

[?] smsu.dll
|_ Cesta: C:\Program Files\Xerox Companion Suite\SMSU.dll
|_ MD5: FF85C75BF60816CC73B4351088BD878B
|_ Výrobce: Copyright (C) 2003
|_ Procesy
|_ MFPrintServer.exe (3400)

[?] pluginu.dll
|_ Cesta: C:\Program Files\Xerox Companion Suite\PlugInU.dll
|_ MD5: 7F039DB24DC8A485082F57BEB3BA9570
|_ Výrobce: Copyright (C) 2003
|_ Procesy
|_ MFPrintServer.exe (3400)
|_ MFServices.exe (3748)

[?] mfserviceapiu.dll
|_ Cesta: C:\Program Files\Xerox Companion Suite\MFServiceAPIU.dll
|_ MD5: 1850777DC0D713558B685E65D80FCC81
|_ Výrobce: Copyright (C) 2003
|_ Procesy
|_ MFServices.exe (3748)

[?] deviceu.dll
|_ Cesta: C:\Program Files\Xerox Companion Suite\DeviceU.dll
|_ MD5: 7E1BE7275E5BA0BE552FC4A693535B4A
|_ Výrobce: Copyright (C) 2003
|_ Procesy
|_ MFServices.exe (3748)

[?] xmldiusbu.dll
|_ Cesta: C:\Program Files\Xerox Companion Suite\HAL\XMLDIUSBU.dll
|_ MD5: 3EA9A9CE2D06736AF5CA25303BA9E953
|_ Výrobce: Copyright (C) 2003
|_ Procesy
|_ MFServices.exe (3748)

[?] mfservicetsu.dll
|_ Cesta: C:\Program Files\Xerox Companion Suite\MFServiceTSU.dll
|_ MD5: DD8024BC5D3854B8905D4D24910D8A9F
|_ Výrobce:
|_ Procesy
|_ MFServices.exe (3748)

[?] mfservicemonu.dll
|_ Cesta: C:\Program Files\Xerox Companion Suite\MFServiceMONU.dll
|_ MD5: 6F0F9CD6DD65B5DB35D42AF9A3AEDC0C
|_ Výrobce:
|_ Procesy
|_ MFServices.exe (3748)

[?] mfservicehttpu.dll
|_ Cesta: C:\Program Files\Xerox Companion Suite\MFServiceHTTPU.dll
|_ MD5: B53B78C6A8F26B8FE6BF9A30D06C6FDF
|_ Výrobce:
|_ Procesy
|_ MFServices.exe (3748)

[?] mfservicefolderu.dll
|_ Cesta: C:\Program Files\Xerox Companion Suite\MFServiceFOLDERu.dll
|_ MD5: 1BB30076A724A16B30ECD318E2AB67C7
|_ Výrobce:
|_ Procesy
|_ MFServices.exe (3748)

[?] qtgui4.dll
|_ Cesta: C:\Program Files\Common Files\LightScribe\QtGui4.dll
|_ MD5: 6B47602F46FB03EE21CA818E72B00D11
|_ Výrobce:
|_ Procesy
|_ LightScribeControlPanel.exe (3912)

[?] qtcore4.dll
|_ Cesta: C:\Program Files\Common Files\LightScribe\QtCore4.dll
|_ MD5: 428DEDDDA454A3799BC8EB5B626F54F2
|_ Výrobce:
|_ Procesy
|_ LightScribeControlPanel.exe (3912)

[?] mom.implementation.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\MOM.Implementation\2.0.2589.35160__90ba9c70f846762e\MOM.Implementation.DLL
|_ MD5: B5496FF5182DA3A543FB3B1A199078A0
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ MOM.exe (3928)
|_ MOM.exe (3928)
|_ CCC.exe (1756)
|_ CCC.exe (1756)
|_ CCC.exe (3940)
|_ CCC.exe (3940)

[?] log.foundation.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation\2.0.2560.25959__90ba9c70f846762e\LOG.Foundation.DLL
|_ MD5: 394B4021BB8E43F511296724B8CAD06D
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ MOM.exe (3928)
|_ MOM.exe (3928)
|_ CCC.exe (1756)
|_ CCC.exe (1756)
|_ CCC.exe (3940)
|_ CCC.exe (3940)

[?] mom.foundation.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\MOM.Foundation\2.0.2560.25974__90ba9c70f846762e\MOM.Foundation.DLL
|_ MD5: 4EB48170E9F53CD33230EF4EBFF4268B
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ MOM.exe (3928)
|_ MOM.exe (3928)
|_ CCC.exe (1756)
|_ CCC.exe (1756)
|_ CCC.exe (3940)
|_ CCC.exe (3940)

[?] aem.server.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\AEM.Server\2.0.2589.34836__90ba9c70f846762e\AEM.Server.DLL
|_ MD5: BF8DBDCAB8286ADE147A2FCAA00BE645
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ MOM.exe (3928)
|_ MOM.exe (3928)
|_ CCC.exe (1756)
|_ CCC.exe (1756)
|_ CCC.exe (3940)
|_ CCC.exe (3940)

[?] newaem.foundation.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.2560.25964__90ba9c70f846762e\NEWAEM.Foundation.DLL
|_ MD5: 5A174C92A20B8A7904CE78967CD55C59
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ MOM.exe (3928)
|_ MOM.exe (3928)
|_ CCC.exe (1756)
|_ CCC.exe (1756)
|_ CCC.exe (3940)
|_ CCC.exe (3940)

[?] log.foundation.implementation.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.2589.35158__90ba9c70f846762e\LOG.Foundation.Implementation.dll
|_ MD5: 67016CCF8AD7ED7A000DE08F63FB8D41
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ MOM.exe (3928)
|_ CCC.exe (1756)
|_ CCC.exe (3940)

[?] log.foundation.implementation.private.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.2560.25982__90ba9c70f846762e\LOG.Foundation.Implementation.Private.dll
|_ MD5: B06D849120DBAD9120D4F5C31B223576
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ MOM.exe (3928)
|_ CCC.exe (1756)
|_ CCC.exe (3940)

[?] log.foundation.private.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.2560.25964__90ba9c70f846762e\LOG.Foundation.Private.dll
|_ MD5: 486E71760BF62AB86E96E4DE7443A01E
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ MOM.exe (3928)
|_ CCC.exe (1756)
|_ CCC.exe (3940)

[?] system.runtime.remoting.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
|_ MD5: 2849F13593D2712CCB97FFBDD3C1232E
|_ Výrobce: Microsoft Corporation
|_ Procesy
|_ MOM.exe (3928)
|_ CCC.exe (1756)
|_ CCC.exe (3940)

[?] btwhidcs.dll
|_ Cesta: C:\WINDOWS\system32\btwhidcs.dll
|_ MD5: 59D6E6DD0BEC13A4BA228F6DC8E08F9E
|_ Výrobce: Broadcom Corporation.
|_ Procesy
|_ BTTray.exe (2656)

[?] btballoon.dll
|_ Cesta: C:\Program Files\WIDCOMM\Bluetooth Software\BtBalloon.dll
|_ MD5: 065BA70B51B86E45E8E9D8E68F0FA2AC
|_ Výrobce: Broadcom Corporation.
|_ Procesy
|_ BTTray.exe (2656)

[?] btrez.dll
|_ Cesta: C:\WINDOWS\system32\btrez.dll
|_ MD5: DD01873A5DDBCA850D0483796F71806D
|_ Výrobce: Broadcom Corporation.
|_ Procesy
|_ BTTray.exe (2656)

[?] btwicons.dll
|_ Cesta: C:\WINDOWS\system32\btwicons.dll
|_ MD5: 90003A8DC1250E3CAB908F83C6D77472
|_ Výrobce: Copyright (C) 2006
|_ Procesy
|_ BTTray.exe (2656)

[?] sofficeapp.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\program\sofficeapp.dll
|_ MD5: 60BFBB6BECFBD3A0635F94F81F03E193
|_ Výrobce: OpenOffice.org
|_ Procesy
|_ soffice.bin (156)

[?] cppuhelper3msc.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\URE\bin\cppuhelper3MSC.dll
|_ MD5: 2D2548CDDAB69DA1CFECB9FA9FBF9ECE
|_ Výrobce: OpenOffice.org
|_ Procesy
|_ soffice.bin (156)

[?] salhelper3msc.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\URE\bin\salhelper3MSC.dll
|_ MD5: 4C9643168C0B1C284C39F86014DF6DAB
|_ Výrobce: OpenOffice.org
|_ Procesy
|_ soffice.bin (156)

[?] comphelp4msc.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\program\comphelp4MSC.dll
|_ MD5: 3FBA6850336CD96C83590920BB328FB7
|_ Výrobce: OpenOffice.org
|_ Procesy
|_ soffice.bin (156)

[?] cppu3.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\URE\bin\cppu3.dll
|_ MD5: 14F70DDA7497E0049498865AA5264FD0
|_ Výrobce: OpenOffice.org
|_ Procesy
|_ soffice.bin (156)

[?] stlport_vc7145.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\URE\bin\stlport_vc7145.dll
|_ MD5: C73F8260084E9B162AFDDAB06D90A309
|_ Výrobce: STLport Consulting, Inc.
|_ Procesy
|_ soffice.bin (156)

[?] ucbhelper4msc.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\program\ucbhelper4MSC.dll
|_ MD5: AF15E399B82AE08E9F9BBB813E34EB7E
|_ Výrobce: OpenOffice.org
|_ Procesy
|_ soffice.bin (156)

[?] vos3msc.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\program\vos3MSC.dll
|_ MD5: 02AECE292AE1C043C6F290C8C728DC84
|_ Výrobce: OpenOffice.org
|_ Procesy
|_ soffice.bin (156)

[?] deploymentmiscmi.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\program\deploymentmiscmi.dll
|_ MD5: E209AAF734FE4D036F4C6C3F421CCC2D
|_ Výrobce: OpenOffice.org
|_ Procesy
|_ soffice.bin (156)

[?] libdb47.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\program\libdb47.dll
|_ MD5: F7146F397D58D7116BC615154A932322
|_ Výrobce: Oracle
|_ Procesy
|_ soffice.bin (156)

[?] tlmi.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\program\tlmi.dll
|_ MD5: 15635AE980F8E712EDDACD257D8B666D
|_ Výrobce: OpenOffice.org
|_ Procesy
|_ soffice.bin (156)

[?] basegfxmi.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\program\basegfxmi.dll
|_ MD5: E5E6A429CB51E823562D272820926B36
|_ Výrobce: OpenOffice.org
|_ Procesy
|_ soffice.bin (156)

[?] i18nisolang1msc.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\program\i18nisolang1MSC.dll
|_ MD5: 8261423BFE4EE28F02ACEBEE4F2C7A0B
|_ Výrobce: OpenOffice.org
|_ Procesy
|_ soffice.bin (156)

[?] utlmi.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\program\utlmi.dll
|_ MD5: 938C1E9B649382C2DB4C369BBDC67A10
|_ Výrobce: OpenOffice.org
|_ Procesy
|_ soffice.bin (156)

[?] xcrmi.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\program\xcrmi.dll
|_ MD5: 7D4341D4CF5DDD685E83DE34A429A0D2
|_ Výrobce: OpenOffice.org
|_ Procesy
|_ soffice.bin (156)

[?] sfxmi.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\program\sfxmi.dll
|_ MD5: BA7F248E3ED074364A9AA6CBB6ACAA9C
|_ Výrobce: OpenOffice.org
|_ Procesy
|_ soffice.bin (156)

[?] fwemi.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\program\fwemi.dll
|_ MD5: 041B0136DD936C1926CCC123816AA7AC
|_ Výrobce: OpenOffice.org
|_ Procesy
|_ soffice.bin (156)

[?] fwimi.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\program\fwimi.dll
|_ MD5: BB792F1FE264C354E554BA9EE60F4BD8
|_ Výrobce: OpenOffice.org
|_ Procesy
|_ soffice.bin (156)

[?] svtmi.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\program\svtmi.dll
|_ MD5: 36CA2750DE73DB8878E021EC363AF01F
|_ Výrobce: OpenOffice.org
|_ Procesy
|_ soffice.bin (156)

[?] tkmi.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\program\tkmi.dll
|_ MD5: 7D1532694BFE41EF008D7EDC087F2100
|_ Výrobce: OpenOffice.org
|_ Procesy
|_ soffice.bin (156)

[?] vclmi.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\program\vclmi.dll
|_ MD5: 8F07E862536D1A558DA9A5050588554E
|_ Výrobce: OpenOffice.org
|_ Procesy
|_ soffice.bin (156)

[?] sotmi.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\program\sotmi.dll
|_ MD5: FC3DB7D1455051E44F0A7486FA7567B0
|_ Výrobce: OpenOffice.org
|_ Procesy
|_ soffice.bin (156)

[?] i18npapermi.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\program\i18npapermi.dll
|_ MD5: DDE5A280AC92E54302A7E08551281438
|_ Výrobce: OpenOffice.org
|_ Procesy
|_ soffice.bin (156)

[?] i18nutilmsc.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\program\i18nutilMSC.dll
|_ MD5: F55186CABD9F9B2D17FA8F42674F9980
|_ Výrobce: OpenOffice.org
|_ Procesy
|_ soffice.bin (156)

[?] icuuc40.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\program\icuuc40.dll
|_ MD5: 98A8B345FD95123D15C6C2CAD0040749
|_ Výrobce: IBM Corporation and others
|_ Procesy
|_ soffice.bin (156)

[?] svlmi.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\program\svlmi.dll
|_ MD5: 75F08527394CA580E9BA9AB2CC2D0210
|_ Výrobce: OpenOffice.org
|_ Procesy
|_ soffice.bin (156)

[?] jvmfwk3.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\URE\bin\jvmfwk3.dll
|_ MD5: 0857D99097344B707FE8A6D85FDA5624
|_ Výrobce: OpenOffice.org
|_ Procesy
|_ soffice.bin (156)

[?] libxml2.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\program\libxml2.dll
|_ MD5: 961947676B3E5731F1DE760F8ABDDEEF
|_ Výrobce:
|_ Procesy
|_ soffice.bin (156)

[?] sbmi.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\program\sbmi.dll
|_ MD5: D3C5C2FEBCD3D4E3C93FB2CEBBE90887
|_ Výrobce: OpenOffice.org
|_ Procesy
|_ soffice.bin (156)

[?] saxmi.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\program\saxmi.dll
|_ MD5: 7C27F5AD651035A99AA84CCF0F6E9B43
|_ Výrobce: OpenOffice.org
|_ Procesy
|_ soffice.bin (156)

[?] msci_uno.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\URE\bin\msci_uno.dll
|_ MD5: AA0D2733324173F092D98072B3FFC2B7
|_ Výrobce: OpenOffice.org
|_ Procesy
|_ soffice.bin (156)

[?] bootstrap.uno.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\URE\bin\bootstrap.uno.dll
|_ MD5: 4FD924F3DE4C7784B3337D702B69DC29
|_ Výrobce: OpenOffice.org
|_ Procesy
|_ soffice.bin (156)

[?] reg3.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\URE\bin\reg3.dll
|_ MD5: 79CBB12EFA24DA12B43B63A3AB1F9C69
|_ Výrobce: OpenOffice.org
|_ Procesy
|_ soffice.bin (156)

[?] store3.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\URE\bin\store3.dll
|_ MD5: 5C49F35FF856A22F33B241D0AD6F1EC1
|_ Výrobce: OpenOffice.org
|_ Procesy
|_ soffice.bin (156)

[?] configmgr.uno.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\program\configmgr.uno.dll
|_ MD5: F3577139853E87A5DB00F28AAEB80D24
|_ Výrobce: OpenOffice.org
|_ Procesy
|_ soffice.bin (156)

[?] localebe1.uno.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\program\localebe1.uno.dll
|_ MD5: 92751940EED061887B1D9CD2B1A66052
|_ Výrobce: OpenOffice.org
|_ Procesy
|_ soffice.bin (156)

[?] stocservices.uno.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\URE\bin\stocservices.uno.dll
|_ MD5: 923B46EB955C01FC7F065D43CD20BACA
|_ Výrobce: OpenOffice.org
|_ Procesy
|_ soffice.bin (156)

[?] ucb1.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\program\ucb1.dll
|_ MD5: F78114721B155BC153C488CBBD7F5563
|_ Výrobce: OpenOffice.org
|_ Procesy
|_ soffice.bin (156)

[?] ucpfile1.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\program\ucpfile1.dll
|_ MD5: DFF49F4FD1DB3F1A359C1C6252CFE49C
|_ Výrobce: OpenOffice.org
|_ Procesy
|_ soffice.bin (156)

[?] emsermi.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\program\emsermi.dll
|_ MD5: 38A86E1BBEAB1DE6593E34BCB27C61E4
|_ Výrobce: OpenOffice.org
|_ Procesy
|_ soffice.bin (156)

[?] fwkmi.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\program\fwkmi.dll
|_ MD5: E125CF4A8373A192D16E782295E4542A
|_ Výrobce: OpenOffice.org
|_ Procesy
|_ soffice.bin (156)

[?] i18npool.uno.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\program\i18npool.uno.dll
|_ MD5: FDA958CB2C81431C5E2354C6DA3B1685
|_ Výrobce: OpenOffice.org
|_ Procesy
|_ soffice.bin (156)

[?] icuin40.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\program\icuin40.dll
|_ MD5: CFAC3F20057B07CFEE1C0393626E8519
|_ Výrobce: IBM Corporation and others
|_ Procesy
|_ soffice.bin (156)

[?] oooimprovementmi.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\program\oooimprovementmi.dll
|_ MD5: 963A917B3A6DE79A62C7B6B5CD43BA72
|_ Výrobce: OpenOffice.org
|_ Procesy
|_ soffice.bin (156)

[?] oleautobridge.uno.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\program\oleautobridge.uno.dll
|_ MD5: 81EA03E4B0D6B637308CD03025FC9F56
|_ Výrobce: OpenOffice.org
|_ Procesy
|_ soffice.bin (156)

[?] sal3.dll
|_ Cesta: C:\Program Files\OpenOffice.org 3\URE\bin\sal3.dll
|_ MD5: FE9149736716904D03FD776C5C8A096B
|_ Výrobce: OpenOffice.org
|_ Procesy
|_ soffice.bin (156)

[?] ccc.implementation.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CCC.Implementation\2.0.2589.35160__90ba9c70f846762e\CCC.Implementation.DLL
|_ MD5: E09C1C44A944CD34F44AD7E119D8DAD0
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)
|_ CCC.exe (1756)
|_ CCC.exe (3940)
|_ CCC.exe (3940)

[?] cli.foundation.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Foundation\2.0.2560.25961__90ba9c70f846762e\CLI.Foundation.DLL
|_ MD5: A50F18D15C926B9AB49E85A39FFC4F6D
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)
|_ CCC.exe (1756)
|_ CCC.exe (3940)
|_ CCC.exe (3940)

[?] aticccom.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.DLL
|_ MD5: F57C8B935C8CB5F674CCBC51CB17EA4A
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)
|_ CCC.exe (1756)
|_ CCC.exe (3940)
|_ CCC.exe (3940)

[?] aem.foundation.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\AEM.Foundation\2.0.2560.25960__90ba9c70f846762e\AEM.Foundation.DLL
|_ MD5: 22B2ADE6E1127683FF8E821947BEE1AD
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)
|_ CCC.exe (1756)
|_ CCC.exe (3940)
|_ CCC.exe (3940)

[?] system.windows.forms.resources.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_cs_b77a5c561934e089\System.Windows.Forms.resources.dll
|_ MD5: 7A73AAE6DFE246EA429D6D3A83F0218A
|_ Výrobce: Microsoft Corporation
|_ Procesy
|_ CCC.exe (1756)

[?] aem.server.shared.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\AEM.Server.Shared\2.0.2560.25970__90ba9c70f846762e\AEM.Server.Shared.DLL
|_ MD5: C6AE483810EEC97924DBBA0D9138B72A
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)
|_ CCC.exe (1756)

[?] aem.plugin.source.kit.server.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.Source.Kit.Server\2.0.2589.35208__90ba9c70f846762e\AEM.Plugin.Source.Kit.Server.dll
|_ MD5: F4F607A8DC460B02EAC7004F865CB3AB
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)

[?] aem.plugin.dppe.shared.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.DPPE.Shared\2.0.2560.26010__90ba9c70f846762e\AEM.Plugin.DPPE.Shared.dll
|_ MD5: 6F9F45487AE44122D865DAEFDA3D7C7B
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)

[?] dem.graphics.i0601.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\DEM.Graphics.I0601\2.0.2537.29860__90ba9c70f846762e\DEM.Graphics.I0601.DLL
|_ MD5: A22AACFAC0C20841E2A2B961F013815C
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)
|_ CCC.exe (1756)

[?] dem.foundation.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\DEM.Foundation\2.0.2531.19989__90ba9c70f846762e\DEM.Foundation.DLL
|_ MD5: EC01B6D5F879B6A78E0C04DC5D9DB921
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)
|_ CCC.exe (1756)
|_ CCC.exe (3940)
|_ CCC.exe (3940)

[?] dem.graphics.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\DEM.Graphics\2.0.2560.25997__90ba9c70f846762e\DEM.Graphics.DLL
|_ MD5: DBD8B9A2B21602198FB643CE7840E2F4
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)
|_ CCC.exe (1756)

[?] atidemgx.dll
|_ Cesta: C:\Program Files\ATI Technologies\ATI.ACE\Core-Implementation\ATIDEMGX.dll
|_ MD5: 59D04FD8B5D02AD6D454348116A72366
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)
|_ CCC.exe (1756)

[?] system.management.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
|_ MD5: EBAADBBFB6C455E54EB6A0E47267D33C
|_ Výrobce: Microsoft Corporation
|_ Procesy
|_ CCC.exe (1756)
|_ CCC.exe (1756)

[?] dem.os.i0602.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\DEM.OS.I0602\2.0.2560.26001__90ba9c70f846762e\DEM.OS.I0602.DLL
|_ MD5: 56D90C832ED88EDBF64F1726902E1DC5
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)
|_ CCC.exe (1756)

[?] dem.os.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\DEM.OS\2.0.2560.26002__90ba9c70f846762e\DEM.OS.DLL
|_ MD5: D80E4F8BC01461E4A4CB0C51DC8068B5
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)
|_ CCC.exe (1756)

[?] atidemos.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\ATIDEMOS\2.0.2589.34838__90ba9c70f846762e\ATIDEMOS.DLL
|_ MD5: D97195BCE6732C82B9AA8E67C6D42828
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)
|_ CCC.exe (1756)

[?] apm.foundation.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\APM.Foundation\2.0.2560.26001__90ba9c70f846762e\APM.Foundation.DLL
|_ MD5: FF8670D7BDB474362C8D43EF554A7D6D
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)
|_ CCC.exe (1756)

[?] ace.graphics.displaysmanager.shared.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\ACE.Graphics.DisplaysManager.Shared\2.0.2531.19989__90ba9c70f846762e\ACE.Graphics.DisplaysManager.Shared.dll
|_ MD5: 01DD005081A60AB81EDAC7C8FCF5DD09
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)
|_ CCC.exe (3940)

[?] cli.aspect.customformats.graphics.shared.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.CustomFormats.Graphics.Shared\2.0.2560.25982__90ba9c70f846762e\CLI.Aspect.CustomFormats.Graphics.Shared.dll
|_ MD5: 3996FD9DC4F432FF64D0A3E452A87044
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)
|_ CCC.exe (3940)

[?] cli.aspect.devicecrt.graphics.dashboard.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Dashboard\2.0.2589.35014__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Dashboard.dll
|_ MD5: 4B6CAC06908B22EED4156AB0133A163B
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)

[?] cli.aspect.devicecrt.graphics.runtime.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Runtime\2.0.2589.35019__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Runtime.dll
|_ MD5: FF9BCB6ADFF94F8FD814129670499057
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)

[?] cli.aspect.devicecrt.graphics.shared.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Shared\2.0.2560.25998__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Shared.dll
|_ MD5: 991690DBDF4E6C3909D7080EDB3C691B
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)

[?] cli.aspect.devicecv.graphics.runtime.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Runtime\2.0.2589.35080__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Runtime.dll
|_ MD5: B11BD8944E633EE0032E29DFBA252ACC
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)

[?] cli.aspect.devicecv.graphics.shared.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Shared\2.0.2560.26000__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Shared.dll
|_ MD5: F082F96ECE1A17E61F354256F9B785E4
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)
|_ CCC.exe (3940)

[?] cli.aspect.devicedfp.graphics.runtime.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Runtime\2.0.2589.35012__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Runtime.dll
|_ MD5: 8D1D0A5F5F0D4484BBC9E146D74D4404
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)

[?] cli.aspect.devicedfp.graphics.shared.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Shared\2.0.2560.25998__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Shared.dll
|_ MD5: F0B56BC8D6C8059157B0AE2382824D74
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)

[?] cli.aspect.devicelcd.graphics.dashboard.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Dashboard\2.0.2589.35069__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Dashboard.dll
|_ MD5: 58868D17CE33C4EC27E80BEDFDAE4945
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)

[?] cli.aspect.devicelcd.graphics.runtime.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Runtime\2.0.2589.35066__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Runtime.dll
|_ MD5: BD8263DF245ECAE56A266589047159DA
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)

[?] cli.aspect.devicelcd.graphics.shared.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Shared\2.0.2560.25987__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Shared.dll
|_ MD5: 81B5321DE6BF5A211B0C3669E0F11C83
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)
|_ CCC.exe (3940)

[?] cli.aspect.devicelcd.graphics.wizard.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Wizard\2.0.2589.34923__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Wizard.dll
|_ MD5: 65754C40E4F070F2BE269F4563ADCE2A
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)
|_ CCC.exe (3940)

[?] cli.aspect.deviceproperty.graphics.runtime.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Runtime\2.0.2589.35011__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Runtime.dll
|_ MD5: 8C9AA92A737025CF56AC04723AB53604
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)

[?] cli.aspect.deviceproperty.graphics.shared.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Shared\2.0.2560.25986__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Shared.dll
|_ MD5: 1A76DCE2E0C390F8D88A70D5D91B30BC
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)
|_ CCC.exe (3940)

[?] cli.aspect.devicetv.graphics.runtime.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Runtime\2.0.2589.35129__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Runtime.dll
|_ MD5: A46044AD095277C769FE041F292235CF
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)

[?] cli.aspect.devicetv.graphics.shared.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Shared\2.0.2560.26001__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Shared.dll
|_ MD5: 2658A1BDE90E898E47604F502A4ABD69
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)
|_ CCC.exe (3940)

[?] cli.aspect.devicetv.graphics.wizard.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Wizard\2.0.2589.35144__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Wizard.dll
|_ MD5: 923A4EEED38F5F67D4ECB73ECD60A6B9
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)
|_ CCC.exe (3940)

[?] cli.aspect.displayscolour2.graphics.dashboard.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Dashboard\2.0.2589.34915__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Dashboard.dll
|_ MD5: 054AD22AD95529B034A7B9F498AFF5B3
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)

[?] cli.aspect.displayscolour2.graphics.runtime.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Runtime\2.0.2589.34921__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Runtime.dll
|_ MD5: 05430E537B5290B993FAE09F76019933
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)

[?] cli.aspect.displayscolour2.graphics.shared.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Shared\2.0.2560.25988__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Shared.dll
|_ MD5: 04D2307AA367A150F2FCBFB79935571B
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)

[?] cli.aspect.displaysmanager.graphics.dashboard.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Dashboard\2.0.2589.34863__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Dashboard.dll
|_ MD5: 46CC128C7B920FE954E6B84F2489B185
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)

[?] cli.aspect.displaysoptions.graphics.dashboard.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Dashboard\2.0.2589.35045__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Dashboard.dll
|_ MD5: 567E67C20B9D851AEF51DEE74BCF42EA
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)

[?] cli.aspect.displaysoptions.graphics.runtime.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Runtime\2.0.2589.35044__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Runtime.dll
|_ MD5: 1E6652F9F603B6A4F39E128D82C54673
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)

[?] cli.aspect.displaysoptions.graphics.shared.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Shared\2.0.2560.25999__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Shared.dll
|_ MD5: E655CACEBD9DE28A1876606D29CFE615
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)

[?] cli.aspect.hotkeyshandling.graphics.runtime.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Runtime\2.0.2589.34860__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Runtime.dll
|_ MD5: 476CDDF20AC5152EBA18570EB4334577
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)

[?] cli.aspect.hotkeyshandling.graphics.shared.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Shared\2.0.2560.25987__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Shared.dll
|_ MD5: C6B2E06AB5A727AF14FE6E40B7C8F08D
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)

[?] cli.aspect.infocentre.graphics.dashboard.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Dashboard\2.0.2589.34907__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Dashboard.dll
|_ MD5: 1AF853102D0D20E0271D07B5D4337F10
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)

[?] cli.aspect.infocentre.graphics.runtime.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Runtime\2.0.2589.34898__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Runtime.dll
|_ MD5: 1E340B2B5D66A235BBFD7A54B4F71379
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)

[?] cli.aspect.infocentre.graphics.shared.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Shared\2.0.2560.25988__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Shared.dll
|_ MD5: 7E4C5C446F84942245C0881E59911811
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)
|_ CCC.exe (3940)

[?] cli.aspect.infocentre.graphics.wizard.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Wizard\2.0.2589.34900__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Wizard.dll
|_ MD5: 1BFC4ABFDDF95C35356DB89EDBACF177
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)
|_ CCC.exe (3940)

[?] cli.aspect.mmvideo.graphics.runtime.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Runtime\2.0.2589.35020__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Runtime.dll
|_ MD5: DF0A0DD59AD95AB8F5E238EB9249E9D9
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)

[?] cli.aspect.mmvideo.graphics.shared.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Shared\2.0.2560.25999__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Shared.dll
|_ MD5: 0FD3AE600E7D4F93B44BE9871F9EFB23
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)
|_ CCC.exe (3940)

[?] cli.aspect.mmvideo.graphics.wizard.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Wizard\2.0.2589.35114__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Wizard.dll
|_ MD5: 5699628D699BDA90FE52661FFE83A88B
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)
|_ CCC.exe (3940)

[?] cli.aspect.powerplay3.graphics.dashboard.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.PowerPlay3.Graphics.Dashboard\2.0.2589.35075__90ba9c70f846762e\CLI.Aspect.PowerPlay3.Graphics.Dashboard.dll
|_ MD5: E47FFE16E1E759DC5BD28CB68E7ABA27
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)

[?] cli.aspect.powerplay3.graphics.runtime.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.PowerPlay3.Graphics.Runtime\2.0.2589.35080__90ba9c70f846762e\CLI.Aspect.PowerPlay3.Graphics.Runtime.dll
|_ MD5: 1CFC01139DF471BFED6842934A0EF07B
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)

[?] cli.aspect.powerplay3.graphics.shared.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.PowerPlay3.Graphics.Shared\2.0.2560.26000__90ba9c70f846762e\CLI.Aspect.PowerPlay3.Graphics.Shared.dll
|_ MD5: 63B6E859E2426F91C49BCFBA56F738E6
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)

[?] cli.aspect.radeon3d.graphics.dashboard.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Dashboard\2.0.2589.35093__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Dashboard.dll
|_ MD5: 4F41D4CF20AFE868BB2616C30CF49384
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)

[?] cli.aspect.radeon3d.graphics.runtime.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Runtime\2.0.2589.35090__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Runtime.dll
|_ MD5: F60ED9D91D7F1D2665EA1ED2371E8DBF
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)

[?] cli.aspect.radeon3d.graphics.shared.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Shared\2.0.2560.26000__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Shared.dll
|_ MD5: 61435D9042F6D8F1C90BEA2EE5B62928
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)
|_ CCC.exe (3940)

[?] cli.aspect.radeon3d.graphics.wizard.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Wizard\2.0.2589.35098__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Wizard.dll
|_ MD5: 4F4E108DE930A9588DEAC579FDD2D6DB
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)
|_ CCC.exe (3940)

[?] cli.aspect.transcode.graphics.wizard.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Wizard\2.0.2589.35177__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Wizard.dll
|_ MD5: 4C353A4919311584246769438D55088A
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)
|_ CCC.exe (3940)

[?] cli.aspect.vpurecover.graphics.dashboard.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.VPURecover.Graphics.Dashboard\2.0.2589.34892__90ba9c70f846762e\CLI.Aspect.VPURecover.Graphics.Dashboard.dll
|_ MD5: 92881DCA5E5A0004B1DB459D8A2698BB
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)

[?] cli.aspect.vpurecover.graphics.runtime.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.VPURecover.Graphics.Runtime\2.0.2589.34891__90ba9c70f846762e\CLI.Aspect.VPURecover.Graphics.Runtime.dll
|_ MD5: 584C963346E3559B5E324DD120CB1081
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)

[?] cli.aspect.vpurecover.graphics.shared.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.VPURecover.Graphics.Shared\2.0.2560.25988__90ba9c70f846762e\CLI.Aspect.VPURecover.Graphics.Shared.dll
|_ MD5: 1B0AEE8B6003BD5A17D7661293B1D76D
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)

[?] cli.aspect.welcome.graphics.dashboard.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.Welcome.Graphics.Dashboard\2.0.2589.35183__90ba9c70f846762e\CLI.Aspect.Welcome.Graphics.Dashboard.dll
|_ MD5: B935F80033839F9AA694EDFD226B3D76
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)

[?] cli.caste.graphics.dashboard.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard\2.0.2589.34854__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.dll
|_ MD5: 87E1080DC97C9BF5EF6AEF55A1C98670
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)

[?] cli.caste.graphics.dashboard.shared.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard.Shared\2.0.2560.25987__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.Shared.dll
|_ MD5: 45DBCDFD2E26A68371912DE2D8A05E58
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)

[?] cli.caste.graphics.runtime.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.2589.34839__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.dll
|_ MD5: F76597A6443362953B1B6D86FDA87CF2
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)

[?] cli.caste.graphics.runtime.shared.private.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime.Shared.Private\2.0.2560.26004__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.Shared.Private.dll
|_ MD5: 9F206B225B3E85321C423D4D8F147CF2
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)

[?] cli.caste.graphics.shared.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.2560.25971__90ba9c70f846762e\CLI.Caste.Graphics.Shared.dll
|_ MD5: F479CA4A5CEF495710CBA48750152285
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)
|_ CCC.exe (3940)

[?] cli.caste.graphics.wizard.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard\2.0.2589.34876__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.dll
|_ MD5: 6D48B42D9D2FB7E36082A2A456D6154E
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)
|_ CCC.exe (3940)

[?] cli.caste.graphics.wizard.shared.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard.Shared\2.0.2560.25988__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.Shared.dll
|_ MD5: A590CAA2DC96074724C3CE8973DFAD15
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)
|_ CCC.exe (3940)

[?] cli.component.client.shared.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.2560.25968__90ba9c70f846762e\CLI.Component.Client.Shared.dll
|_ MD5: 8E5C5F024AA95D01EDE8C2AB803F51CB
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)
|_ CCC.exe (3940)

[?] cli.component.client.shared.private.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.2560.25970__90ba9c70f846762e\CLI.Component.Client.Shared.Private.dll
|_ MD5: 982D2FFDF4170CB41C7034AD8AF58DCD
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)
|_ CCC.exe (3940)

[?] cli.component.dashboard.shared.private.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared.Private\2.0.2560.25981__90ba9c70f846762e\CLI.Component.Dashboard.Shared.Private.dll
|_ MD5: FBB630F1CE72F0A8D60532865DC1B043
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)

[?] cli.component.runtime.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.2589.34837__90ba9c70f846762e\CLI.Component.Runtime.dll
|_ MD5: 4B0B8B1A5843BC3640C847ECCAB8616F
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)
|_ CCC.exe (3940)

[?] cli.component.runtime.shared.private.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.2560.25980__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.dll
|_ MD5: 8488F9C54BA7429D12BCA76F2C0463FD
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)
|_ CCC.exe (3940)

[?] cli.component.wizard.shared.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.2560.25982__90ba9c70f846762e\CLI.Component.Wizard.Shared.dll
|_ MD5: B4EA05537B6081097549107914567EB7
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)
|_ CCC.exe (3940)

[?] cli.component.wizard.shared.private.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.2560.26010__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.dll
|_ MD5: 99543A4863CA293CF06B4A8B7A69D41F
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)
|_ CCC.exe (3940)

[?] cli.foundation.private.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.2560.25966__90ba9c70f846762e\CLI.Foundation.Private.dll
|_ MD5: FA2A57EC2F787D799A02284502DBA94D
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)
|_ CCC.exe (3940)

[?] cli.foundation.xmanifest.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.2560.26040__90ba9c70f846762e\CLI.Foundation.XManifest.dll
|_ MD5: AE98EEE5702B2118C4F70AB0E71C7BFC
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)
|_ CCC.exe (3940)

[?] cli.aspect.devicecv.graphics.dashboard.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Dashboard\2.0.2589.35085__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Dashboard.dll
|_ MD5: 8CB9E6ABB272BFD64D1C14F519341AAD
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)

[?] cli.aspect.devicecv.graphics.wizard.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Wizard\2.0.2589.35106__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Wizard.dll
|_ MD5: 3A2CF6E54AF8C3E9EA525A9BE627B3DA
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)
|_ CCC.exe (3940)

[?] cli.aspect.devicetv.graphics.dashboard.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Dashboard\2.0.2589.35137__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Dashboard.dll
|_ MD5: A96D1726CDF12CD9618137A375989F3D
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)

[?] cli.aspect.displaysmanager.graphics.wizard.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Wizard\2.0.2589.34886__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Wizard.dll
|_ MD5: 243B90196A341B02BB534B471C87E13D
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)
|_ CCC.exe (3940)

[?] cli.aspect.mmvideo.graphics.dashboard.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Dashboard\2.0.2589.35024__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Dashboard.dll
|_ MD5: 86826F3B9B723FE12B5F1F140B728FFC
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)

[?] cli.component.dashboard.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Dashboard\2.0.2589.34848__90ba9c70f846762e\CLI.Component.Dashboard.dll
|_ MD5: 1E03B10B56D4A4B45368E7E80AA8A0AF
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (1756)

[?] cli.aspect.transcode.graphics.shared.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Shared\2.0.2560.26012__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Shared.dll
|_ MD5: 80683075240B3BF4B07B6FDAA8DDD602
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (3940)

[?] cli.component.wizard.dll
|_ Cesta: C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.2589.34870__90ba9c70f846762e\CLI.Component.Wizard.dll
|_ MD5: BE77FB4882A5F4A52261A049042D18B5
|_ Výrobce: ATI Technologies Inc.
|_ Procesy
|_ CCC.exe (3940)


Výpis souborů
================================================================
\System32:
[?] ac3filter.acm AC3FIL~1.ACM 12 ncmpny, {D2EED6E4}
[?] accelerometercp.CPL ACCELE~1.CPL 14 no vrfy, {72E11267}
[?] accelerometerdll.DLL ACCELE~1.DLL 7 no vrfy, {760B1497}
[?] accelerometerST.exe ACCELE~1.EXE 14 no vrfy, {B8B84B7F}
[?] APSHook.dll 7 no vrfy, {EC21C62C}
[?] atrc.dll 7 no vrfy, {7BF0F1E8}
[?] AviSplitter.ax AVISPL~1.AX 7 no vrfy, {4F137A43}
[?] biologon.dll 12 ncmpny, {51FC1AF8}
[?] bt2k_ins.dll 7 no vrfy, {FC139B84}
[?] BtAudioHelper.dll BTAUDI~1.DLL 7 no vrfy, {ADEB867D}
[?] btbigbmp.dll 14 no vrfy, {A4F8C3B0}
[?] btbip.dll 7 no vrfy, {DB640692}
[?] BTChooser.dll BTCHOO~1.DLL 14 no vrfy, {C4CF8D27}
[?] btcpl.cpl 7 no vrfy, {55BC1FB3}
[?] btcss.dll 7 no vrfy, {BCF9E664}
[?] btdev.dll 7 no vrfy, {1264DC95}
[?] bthcrp.dll 7 no vrfy, {0EE45E6F}
[?] bthcrpui.dll 7 no vrfy, {9C734311}
[?] btins.dll 7 no vrfy, {77C4A1D4}
[?] BtMmHook.dll 7 no vrfy, {39173D6C}
[?] BTNCopy.dll 7 no vrfy, {5D1947B2}
[?] BTNeighborhood.dll BTNEIG~1.DLL 7 no vrfy, {12454174}
[?] btosif.dll 7 no vrfy, {430C5C03}
[?] btosif_notes.dll BTOSIF~1.DLL 7 no vrfy, {F2DDAA18}
[?] btosif_ol.dll BTOSIF~2.DLL 7 no vrfy, {FF6C8CA4}
[?] btosif_olx.dll BTOSIF~3.DLL 7 no vrfy, {0D99F69D}
[?] btprn2k.dll 12 ncmpny, {B7660AF3}
[?] btrez.dll 14 no vrfy, {0AA058F5}
[?] btrezxp.dll 14 no vrfy, {E1E1CFE8}
[?] btsec.dll 7 no vrfy, {5E18E867}
[?] btsendto.dll 7 no vrfy, {79C3C8E6}
[?] btsendto_ie.dll BTSEND~2.DLL 7 no vrfy, {1F0DC18E}
[?] btsendto_notes.dll BTSEND~3.DLL 7 no vrfy, {5B34F576}
[?] btsendto_office.dll BTSEND~1.DLL 7 no vrfy, {FE18B7B8}
[?] btsendto_wab.dll BTSEND~4.DLL 7 no vrfy, {07E01AD5}
[?] BttnCmns.dll 14 no vrfy, {27FFB65E}
[?] BttnCmns_64.dll BTTNCM~1.DLL 14 no vrfy, {21AAB11E}
[?] btwhidcs.dll 14 no vrfy, {1B15E9C3}
[?] BtWiaExt.dll 14 no vrfy, {96B5A4B7}
[?] btwicons.dll 14 no vrfy, {888C5246}
[?] BtWizard.dll 14 no vrfy, {3DC21867}
[?] btwpimif.dll 7 no vrfy, {039335EC}
[?] BTXPPanel.dll BTXPPA~1.DLL 7 no vrfy, {B64BAE6F}
[?] BtXpShell.dll BTXPSH~1.DLL 7 no vrfy, {E3E02768}
[?] CddbCleanRoxio.dll CDDBCL~1.DLL 7 no vrfy, {F82A7513}
[?] CDDBControlRoxio.dll CDDBCO~1.DLL 7 no vrfy, {AFBCE0BA}
[?] CddbFileTaggerRoxio.dll CDDBFI~1.DLL 7 no vrfy, {7179ECD0}
[?] CddbMusicIDRoxio.dll CDDBMU~1.DLL 7 no vrfy, {535C24BC}
[?] CddbPlaylist2Roxio.dll CDDBPL~1.DLL 7 no vrfy, {A78A9F3F}
[?] CDDBUIRoxio.dll CDDBUI~1.DLL 14 no vrfy, {E0BE8CA8}
[?] CddbWOManagerRoxio.dll CDDBWO~1.DLL 7 no vrfy, {4F61F37A}
[?] cdral.dll 7 no vrfy, {2FD1D135}
[?] cdrtc.dll 7 no vrfy, {DE5A1C60}
[?] cdxareader.ax CDXARE~1.AX 7 no vrfy, {225C159D}
[?] cook.dll 7 no vrfy, {E21EDF8E}
[?] CoreAAC.ax 7 no vrfy, {6535B591}
[?] CoreFLACDecoder.ax COREFL~1.AX 12 ncmpny, {CFCDC976}
[?] CoreVorbis.ax COREVO~1.AX 12 ncmpny, {CC25CE0D}
[?] CSPLL2P.dll 7 no vrfy, {71392754}
[?] drv1.dll 7 no vrfy, {7CE8B544}
[?] drv2.dll 7 no vrfy, {1CCB6ECC}
[?] drvc.dll 12 ncmpny, {E169BD28}
[?] ffdshow.ax 12 ncmpny, {E89C73EE}
[?] ff_mpeg2enc.dll FF_MPE~1.DLL 12 ncmpny, {B40F9AC8}
[?] ff_theora.dll FF_THE~1.DLL 12 ncmpny, {698EADAE}
[?] ff_vfw.dll 12 ncmpny, {A9D9105F}
[?] ff_wmv9.dll 12 ncmpny, {B992495A}
[?] ff_x264.dll 12 ncmpny, {435D7390}
[?] FUSServices.exe FUSSER~1.EXE 12 ncmpny, {DAE1D37B}
[?] GplMpgDec.ax GPLMPG~1.AX 7 no vrfy, {642BE6B9}
[?] HPEvents.dll 7 no vrfy, {3B7FC35F}
[?] hxltcolor.dll HXLTCO~1.DLL 7 no vrfy, {B3CD103E}
[?] IM31bmp.dil 7 no vrfy, {7714A38B}
[?] IM31img.dil 7 no vrfy, {FE886784}
[?] IM31jpg.dil 7 no vrfy, {54461CE4}
[?] IM31tif.dil 7 no vrfy, {27824410}
[?] IM31xbmp.del 7 no vrfy, {AD3F2F26}
[?] IM31xjpg.del 7 no vrfy, {970AB26A}
[?] IM31xtif.del 7 no vrfy, {65FA42DC}
[?] imgman32.dll 14 no vrfy, {A79F2C18}
[?] imhost32.dll 7 no vrfy, {BF339282}
[?] javacpl.cpl 14 no vrfy, {A32F0498}
[?] libavcodec.dll LIBAVC~1.DLL 12 ncmpny, {A3268AA4}
[?] libmplayer.dll LIBMPL~1.DLL 12 ncmpny, {B17ACDC7}
[?] MatroskaSplitter.ax MATROS~1.AX 7 no vrfy, {B732FC13}
[?] msvcr70.dll 12 ncmpny, {D927E0DC}
[?] oggsplitter.ax OGGSPL~1.AX 7 no vrfy, {FC0F5A3E}
[?] OptimFROG.dll OPTIMF~1.DLL 7 no vrfy, {7DF3FA08}
[!] pncrt.dll 63 no vrfy, cx (UPX1)?, {281CBD63}
[?] RealMediaSplitter.ax REALME~1.AX 7 no vrfy, {7AF073BF}
[?] RLAPEDec.ax 7 no vrfy, {4902B273}
[?] RLMPCDec.ax 7 no vrfy, {1C762F5B}
[?] RLOFRDec.ax 7 no vrfy, {7019EC88}
[?] RLTTADec.ax 7 no vrfy, {B79440CF}
[?] rv10.dll 7 no vrfy, {371C2FCF}
[?] rv20.dll 7 no vrfy, {E564B5F0}
[?] rv30.dll 7 no vrfy, {72C1EF1A}
[?] rv40.dll 7 no vrfy, {E1AF71E7}
[?] SbHpCm.dll 7 no vrfy, {DC24FFAD}
[?] sherlock2.exe SHERLO~1.EXE 12 ncmpny, {295D2B90}
[?] sipr.dll 7 no vrfy, {F2BAD494}
[?] VSFilter.dll 7 no vrfy, {F1E1A7E2}
[?] wbtapi.dll 7 no vrfy, {5871B4B8}
[?] WidcommSdk.dll WIDCOM~1.DLL 7 no vrfy, {BA857D48}

\Drivers:
[?] pxhelp20.sys 7 no vrfy, {0E45F441}
[?] rsvlock.sys 7 no vrfy, {9A60FA34}
[?] SbAlg.sys 7 no vrfy, {7AD67199}
[?] SbHiber.sys 7 no vrfy, {1673CB7C}
[?] ZyxelUDSMBus.sys ZYXELU~2.SYS 14 no vrfy, {51C1422F}
[?] ZyxelUDSTcpBus.sys ZYXELU~1.SYS 14 no vrfy, {AF542118}
[?] ZyxelUDSTcpBus.sys ZYXELU~1.SYS 14 no vrfy, {AF542118}

Access violations - HKCU
================================================================


================================================================
Ultimate Process Manager v4.1.3 - [ Lodus Software ][/code]
Nahoru
Avatar uživatele
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 Říj 2008 08:02

Re: upm log, mbr rootkit detected

#3 Příspěvek od motji »

Dobrý večer :)
Můžu poprosit o log ze rsitu, viz můj podpis?
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
aenneus
Návštěvník
Návštěvník
Příspěvky: 5
Registrován: 27 Srp 2011 18:17

Re: upm log, mbr rootkit detected

#4 Příspěvek od aenneus »

zde .-)


Logfile of random's system information tool 1.09 (written by random/random)
Run by Administrator at 2011-08-27 20:53:43
Systém Microsoft Windows XP Professional Service Pack 2
System drive C: has 177 GB (60%) free of 294 GB
Total RAM: 1919 MB (32% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:54:06, on 27.8.2011
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\ABBYY\FineReader\10.00\Licensing\CE\NetworkLicenseServer.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\WINDOWS\system32\FUSServices.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\PDF Complete\pdfsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\Program Files\Hewlett-Packard\IAM\bin\asghost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\PDF Complete\pdfsty.exe
C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\WINDOWS\SMINST\Scheduler.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\AccelerometerSt.exe
C:\Program Files\Xerox Companion Suite\MFFSUM.exe
C:\Program Files\Xerox Companion Suite\MFPrintServer.exe
C:\Program Files\ZyXEL\NetUSB Share Center\Share Center.exe
C:\Program Files\Xerox Companion Suite\MFServices.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Pando Networks\Media Booster\PMB.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\LF2GRPOW.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Dokumenty\Downloads\RSIT.exe
C:\Program Files\trend micro\Administrator.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hp.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.hp.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Credential Manager for HP ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\Hewlett-Packard\IAM\Bin\ItIEAddIn.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [PDF Complete] "C:\Program Files\PDF Complete\pdfsty.exe"
O4 - HKLM\..\Run: [PTHOSTTR] C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe C:\PROGRA~1\HEWLET~1\IAM\Bin\ASTSVCC.dll,RegisterModule
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\Sminst\Recguard.exe
O4 - HKLM\..\Run: [Reminder] C:\WINDOWS\Creator\Remind_XP.exe
O4 - HKLM\..\Run: [Scheduler] C:\WINDOWS\SMINST\Scheduler.exe
O4 - HKLM\..\Run: [HP Software Update] c:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
O4 - HKLM\..\Run: [AccelerometerSysTrayApplet] C:\WINDOWS\system32\AccelerometerSt.exe
O4 - HKLM\..\Run: [MFFSum_Pro_LL2] "C:\Program Files\Xerox Companion Suite\MFFSUM.exe"
O4 - HKLM\..\Run: [MFPrintServer_Pro_LL2] "C:\Program Files\Xerox Companion Suite\MFPrintServer.exe"
O4 - HKLM\..\Run: [ZyXEL USB Share Center] C:\Program Files\ZyXEL\NetUSB Share Center\Share Center.exe -mini
O4 - HKLM\..\Run: [Bonus.SSR.FR10] "C:\Program Files\ABBYY FineReader 10\Bonus.ScreenshotReader.exe" /autorun
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-18 Startup: CCC.lnk = ? (User 'SYSTEM')
O4 - .DEFAULT Startup: CCC.lnk = ? (User 'Default user')
O4 - .DEFAULT User Startup: CCC.lnk = ? (User 'Default user')
O4 - Startup: CCC.lnk = ?
O4 - Startup: OpenOffice.org 3.3.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: DVD Check.lnk = C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O20 - AppInit_DLLs: APSHook.dll
O20 - Winlogon Notify: OneCard - C:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: ABBYY FineReader 10 CE Licensing Service (ABBYY.Licensing.FineReader.Corporate.10.0) - ABBYY - C:\Program Files\Common Files\ABBYY\FineReader\10.00\Licensing\CE\NetworkLicenseServer.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Session Launcher Service (FUSServices) - Unknown owner - C:\WINDOWS\system32\FUSServices.exe
O23 - Service: Drive Encryption Service (HpFkCryptService) - SafeBoot International - c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft Limited - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: PC Angel (PCA) - SoftThinks - C:\WINDOWS\SMINST\PCAngel.exe
O23 - Service: PDF Document Manager (pdfcDispatcher) - PDF Complete Inc - C:\Program Files\PDF Complete\pdfsvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe

--
End of file - 11988 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2388447024-3804241515-2854086067-500Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2388447024-3804241515-2854086067-500UA.job

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\4nio02z7.default

"{20a82645-c095-46ed-80e3-08825760534b}"=c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
"jqs@sun.com"=C:\Program Files\Java\jre6\lib\deploy\jqs\ff


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WPF,version=3.5]
"Description"=Windows Presentation Foundation plug-in for Mozilla browsers
"Path"=c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@pandonetworks.com/PandoWebPlugin]
"Description"=This plugin detects and launches Pando Media Booster
"Path"=C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Browser Helper - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2011-05-16 1164680]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-06-15 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DF21F1DB-80C6-11D3-9483-B03D0EC10000}]
Credential Manager for HP ProtectTools - C:\Program Files\Hewlett-Packard\IAM\Bin\ItIEAddIn.dll [2006-11-21 71192]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2011-06-15 79648]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"MsmqIntCert"=regsvr32 /s mqrt.dll []
"SoundMAXPnP"=C:\Program Files\Analog Devices\Core\smax4pnp.exe [2007-01-05 872448]
"SoundMAX"=C:\Program Files\Analog Devices\SoundMAX\Smax4.exe [2006-07-13 729088]
"PDF Complete"=C:\Program Files\PDF Complete\pdfsty.exe [2007-05-08 331552]
"PTHOSTTR"=C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE [2007-01-09 145184]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2007-01-12 827392]
"hpWirelessAssistant"=C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [2007-03-01 472776]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2011-04-08 254696]
"QlbCtrl"=C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [2007-05-02 163840]
"CognizanceTS"=C:\PROGRA~1\HEWLET~1\IAM\Bin\ASTSVCC.dll [2003-12-22 17920]
"Recguard"=C:\WINDOWS\Sminst\Recguard.exe [2005-12-20 1187840]
"Reminder"=C:\WINDOWS\Creator\Remind_XP.exe [2006-03-09 806912]
"Scheduler"=C:\WINDOWS\SMINST\Scheduler.exe [2006-10-09 697976]
"HP Software Update"=c:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [2005-02-16 49152]
"Cpqset"=C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe [2007-05-03 57344]
"WatchDog"=C:\Program Files\InterVideo\DVD Check\DVDCheck.exe [2007-05-23 192512]
"AccelerometerSysTrayApplet"=C:\WINDOWS\system32\AccelerometerSt.exe [2007-01-24 124928]
"MFFSum_Pro_LL2"=C:\Program Files\Xerox Companion Suite\MFFSUM.exe [2009-04-22 24576]
"MFPrintServer_Pro_LL2"=C:\Program Files\Xerox Companion Suite\MFPrintServer.exe [2009-04-22 73728]
"ZyXEL USB Share Center"=C:\Program Files\ZyXEL\NetUSB Share Center\Share Center.exe [2010-07-22 5623808]
"Bonus.SSR.FR10"=C:\Program Files\ABBYY FineReader 10\Bonus.ScreenshotReader.exe [2011-07-14 941320]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2008-03-01 1443072]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2004-08-18 15360]
""= []
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2006-11-10 90112]
"LightScribe Control Panel"=C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2007-04-19 484904]
"Google Update"=C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe [2011-06-04 136176]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2011-06-15 15141768]
"Pando Media Booster"=C:\Program Files\Pando Networks\Media Booster\PMB.exe [2011-08-09 3077528]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
DVD Check.lnk - C:\Program Files\InterVideo\DVD Check\DVDCheck.exe

C:\Documents and Settings\Administrator\Nabídka Start\Programy\Po spuštění
CCC.lnk - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
OpenOffice.org 3.3.lnk - C:\Program Files\OpenOffice.org 3\program\quickstart.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="APSHook.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2007-02-02 110592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\OneCard]
C:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll [2007-02-07 74240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"notification packages"=SbHpNp
scecli
ASWLNPkg

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\WINDOWS\system32\mqsvc.exe"="C:\WINDOWS\system32\mqsvc.exe:*:Enabled:Message Queuing"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\WINDOWS\SMINST\Scheduler.exe"="C:\WINDOWS\SMINST\Scheduler.exe:*:Enabled:Scheduler "
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\World of Warcraft (enGB)\WoW-x.x.x.x-4.0.0.12911-EU-Downloader.exe"="C:\Program Files\World of Warcraft (enGB)\WoW-x.x.x.x-4.0.0.12911-EU-Downloader.exe:*:Enabled:Blizzard Downloader"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\ZyXEL\NetUSB Share Center\Share Center.exe"="C:\Program Files\ZyXEL\NetUSB Share Center\Share Center.exe:*:Enabled:NetUSB Share Center"
"C:\Program Files\ICQ7.5\ICQ.exe"="C:\Program Files\ICQ7.5\ICQ.exe:*:Enabled:ICQ7.5"
"C:\Program Files\Pando Networks\Media Booster\PMB.exe"="C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\WINDOWS\system32\mqsvc.exe"="C:\WINDOWS\system32\mqsvc.exe:*:Enabled:Message Queuing"
"C:\Program Files\ICQ7.5\ICQ.exe"="C:\Program Files\ICQ7.5\ICQ.exe:*:Enabled:ICQ7.5"
"C:\Program Files\Pando Networks\Media Booster\PMB.exe"="C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"vidc.ffds"=ffdshow.ax
"msacm.ac3filter"=ac3filter.acm

======List of files/folders created in the last 1 month======

2011-08-27 20:53:44 ----D---- C:\Program Files\trend micro
2011-08-27 20:53:43 ----D---- C:\rsit
2011-08-27 19:05:36 ----D---- C:\Program Files\Ultimate Process Manager
2011-08-15 02:22:43 ----A---- C:\WINDOWS\system32\lsdelete.exe
2011-08-09 23:35:23 ----D---- C:\Documents and Settings\Administrator\Data aplikací\LolClient
2011-08-09 22:55:26 ----A---- C:\WINDOWS\system32\XAudio2_2.dll
2011-08-09 22:55:26 ----A---- C:\WINDOWS\system32\XAPOFX1_1.dll
2011-08-09 22:55:24 ----A---- C:\WINDOWS\system32\d3dx10_39.dll
2011-08-09 22:55:24 ----A---- C:\WINDOWS\system32\D3DCompiler_39.dll
2011-08-09 22:55:20 ----A---- C:\WINDOWS\system32\D3DX9_39.dll
2011-08-09 22:55:16 ----D---- C:\WINDOWS\Logs
2011-08-09 22:31:28 ----D---- C:\Program Files\lol
2011-08-09 22:31:00 ----D---- C:\Documents and Settings\All Users\Data aplikací\PMB Files
2011-08-09 22:30:32 ----D---- C:\Program Files\Pando Networks
2011-08-09 14:29:31 ----A---- C:\WINDOWS\system32\rp_stats.dat
2011-08-09 14:29:31 ----A---- C:\WINDOWS\system32\rp_rules.dat
2011-07-31 19:25:12 ----D---- C:\Program Files\CCleaner
2011-07-31 19:17:58 ----A---- C:\WINDOWS\system32\drivers\SBREDrv.sys
2011-07-31 19:16:41 ----A---- C:\WINDOWS\system32\drivers\Lbd.sys
2011-07-31 19:15:40 ----D---- C:\Program Files\Lavasoft
2011-07-31 19:14:52 ----D---- C:\Documents and Settings\All Users\Data aplikací\Lavasoft

======List of files/folders modified in the last 1 month======

2011-08-27 20:53:45 ----D---- C:\WINDOWS\Temp
2011-08-27 20:53:44 ----RD---- C:\Program Files
2011-08-27 20:53:42 ----D---- C:\Documents and Settings\Administrator\Data aplikací\uTorrent
2011-08-27 20:53:41 ----D---- C:\WINDOWS\Prefetch
2011-08-27 20:51:12 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Skype
2011-08-27 20:18:13 ----SD---- C:\WINDOWS\Tasks
2011-08-27 19:07:01 ----D---- C:\WINDOWS
2011-08-27 18:48:52 ----D---- C:\WINDOWS\SMINST
2011-08-27 18:48:39 ----D---- C:\WINDOWS\system32\CatRoot2
2011-08-27 18:48:31 ----D---- C:\WINDOWS\system32
2011-08-23 10:36:53 ----N---- C:\WINDOWS\SchedLgU.Txt
2011-08-15 15:59:01 ----A---- C:\WINDOWS\win.ini
2011-08-15 01:38:16 ----D---- C:\WINDOWS\Debug
2011-08-11 18:05:46 ----A---- C:\WINDOWS\system32\MRT.exe
2011-08-11 16:30:35 ----D---- C:\WINDOWS\system32\DirectX
2011-08-11 16:30:34 ----HD---- C:\WINDOWS\inf
2011-08-11 16:26:23 ----HD---- C:\Program Files\InstallShield Installation Information
2011-08-09 16:12:49 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2011-08-03 22:27:00 ----D---- C:\Program Files\World of Warcraft (enGB)
2011-07-31 19:45:19 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Media Player Classic
2011-07-31 19:17:58 ----D---- C:\WINDOWS\system32\drivers
2011-07-31 19:17:04 ----SHD---- C:\WINDOWS\Installer
2011-07-31 19:16:41 ----DC---- C:\WINDOWS\system32\DRVSTORE
2011-07-31 19:16:16 ----D---- C:\WINDOWS\WinSxS

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 hpdskflt;HP Disk Filter Driver; C:\WINDOWS\system32\DRIVERS\hpdskflt.sys [2006-07-24 17920]
R0 Lbd;Lbd; C:\WINDOWS\system32\DRIVERS\Lbd.sys [2011-07-21 64512]
R0 ohci1394;Hostitelský řadič IEEE 1394 dle standardu OHCI; C:\WINDOWS\system32\DRIVERS\ohci1394.sys [2004-09-28 61056]
R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2006-07-24 36528]
R0 SafeBoot;SafeBoot; C:\WINDOWS\system32\drivers\SafeBoot.sys [2007-02-07 100495]
R0 SbAlg;SbAlg; C:\WINDOWS\system32\drivers\SbAlg.sys [2006-10-09 44720]
R0 SbFsLock;SbFsLock; C:\WINDOWS\system32\drivers\SbFsLock.sys [2007-03-29 13696]
R1 AmdK8;Ovladač procesoru AMD; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2006-07-01 43008]
R1 eabfiltr;eabfiltr; C:\WINDOWS\system32\DRIVERS\eabfiltr.sys [2006-11-30 8192]
R1 easdrv;easdrv; C:\WINDOWS\system32\DRIVERS\easdrv.sys [2008-03-01 29704]
R1 epfwtdi;epfwtdi; C:\WINDOWS\system32\DRIVERS\epfwtdi.sys [2008-03-01 54280]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-17 14848]
R1 RsvLock;RsvLock; C:\WINDOWS\system32\drivers\RsvLock.sys [2007-02-07 5808]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2004-08-03 8832]
R2 eamon;EAMON; C:\WINDOWS\system32\DRIVERS\eamon.sys [2008-03-01 39944]
R2 epfw;epfw; C:\WINDOWS\system32\DRIVERS\epfw.sys [2008-03-01 71176]
R3 Accelerometer;Accelerometer; C:\WINDOWS\system32\DRIVERS\Accelerometer.sys [2006-07-24 22016]
R3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\ADIHdAud.sys [2007-02-16 288768]
R3 AEAudio;AE Audio Service; C:\WINDOWS\system32\drivers\AEAudio.sys [2006-08-07 93952]
R3 AgereSoftModem;Agere Systems Soft Modem; C:\WINDOWS\system32\DRIVERS\AGRSM.sys [2007-05-07 1160320]
R3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2004-08-18 60800]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2007-02-02 1975296]
R3 ATSWPDRV;(****DEBUG****) AuthenTec TruePrint USB Driver (SwipeSensor); C:\WINDOWS\system32\DRIVERS\ATSwpDrv.sys [2007-04-10 140808]
R3 b57w2k;Broadcom NetLink (TM) Gigabit Ethernet; C:\WINDOWS\system32\DRIVERS\b57xp32.sys [2007-02-27 160256]
R3 BTKRNL;Bluetooth Bus Enumerator; C:\WINDOWS\system32\DRIVERS\btkrnl.sys [2007-02-14 868298]
R3 Epfwndis;Eset Personal Firewall; C:\WINDOWS\system32\DRIVERS\Epfwndis.sys [2008-03-01 30728]
R3 HBtnKey;HBtnKey; C:\WINDOWS\system32\DRIVERS\cpqbttn.sys [2006-06-28 9472]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 IFXTPM;IFXTPM; C:\WINDOWS\system32\DRIVERS\IFXTPM.SYS [2006-09-19 36608]
R3 Lavasoft Kernexplorer;Lavasoft helper driver; \??\C:\Program Files\Lavasoft\Ad-Aware\KernExplorer.sys []
R3 MQAC;Message Queuing access control; \??\C:\WINDOWS\system32\drivers\mqac.sys []
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2004-08-18 61824]
R3 RMCAST;Reliable Multicast Protocol driver; \??\C:\WINDOWS\system32\drivers\RMCast.sys []
R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2007-01-12 201856]
R3 ZyxelUDSMBus;UDS Master Bus of Kernel USB Software Bus by TCP; C:\WINDOWS\System32\Drivers\ZyxelUDSMBus.sys [2010-07-22 61184]
S3 BCM43XX;Ovladač síťového adaptéru Broadcom 802.11; C:\WINDOWS\system32\DRIVERS\bcmwl5.sys [2006-11-02 604928]
S3 BTWUSB;WIDCOMM USB Bluetooth Driver; C:\WINDOWS\System32\Drivers\btwusb.sys [2007-02-14 67960]
S3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
S3 Rasirda;WAN Miniport (IrDA); C:\WINDOWS\system32\DRIVERS\rasirda.sys [2001-08-17 19584]
S3 SMCIRDA;SMC IrCC Miniport Device Driver; C:\WINDOWS\system32\DRIVERS\smcirda.sys [2001-10-24 35913]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2006-04-19 20608]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S3 XMLDIUSB;XML USB Device Interface; C:\WINDOWS\System32\Drivers\XMLDIUSB.sys [2008-01-16 33152]
S3 ZyxelUDSTcpBus;ZyxelUDSTcpBus; C:\WINDOWS\System32\Drivers\ZyxelUDSTcpBus.sys [2010-07-22 90240]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ABBYY.Licensing.FineReader.Corporate.10.0;ABBYY FineReader 10 CE Licensing Service; C:\Program Files\Common Files\ABBYY\FineReader\10.00\Licensing\CE\NetworkLicenseServer.exe [2009-12-19 814344]
R2 ASBroker;Logon Session Broker; C:\WINDOWS\System32\svchost.exe [2004-08-18 14336]
R2 ASChannel;Local Communication Channel; C:\WINDOWS\System32\svchost.exe [2004-08-18 14336]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2007-02-02 446464]
R2 btwdins;Bluetooth Service; C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe [2007-02-06 266295]
R2 ekrn;Eset Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2007-12-21 468224]
R2 FUSServices;Session Launcher Service; C:\WINDOWS\system32\FUSServices.exe [2009-04-22 10752]
R2 HpFkCryptService;Drive Encryption Service; c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [2007-03-29 221184]
R2 hpqwmiex;hpqwmiex; C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe [2006-05-02 135168]
R2 IviRegMgr;IviRegMgr; C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe [2007-01-04 112152]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2011-06-15 153376]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe [2011-07-21 2151640]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2007-04-19 75304]
R2 MSMQ;Message Queuing; C:\WINDOWS\system32\mqsvc.exe [2009-06-22 4608]
R2 MSMQTriggers;Message Queuing Triggers; C:\WINDOWS\system32\mqtgsvc.exe [2009-06-22 117248]
R2 pdfcDispatcher;PDF Document Manager; C:\Program Files\PDF Complete\pdfsvc.exe [2007-05-08 540448]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\System32\svchost.exe [2004-08-18 14336]
S2 PCA;PC Angel; C:\WINDOWS\SMINST\PCAngel.exe [2006-01-12 294912]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 EhttpSrv;Eset HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2008-03-01 19200]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 RoxMediaDB9;RoxMediaDB9; c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe [2006-11-06 887544]
S3 stllssvr;stllssvr; c:\Program Files\Common Files\SureThing Shared\stllssvr.exe [2006-11-01 73728]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2004-08-18 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------
Nahoru
Avatar uživatele
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 Říj 2008 08:02

Re: upm log, mbr rootkit detected

#5 Příspěvek od motji »

Já tam nic podezdřelého nevidím.

:arrow: Stahněte MBAM z mého podpisu
-Nainstalujte,dejte úplný sken

NIC NEMAZAT :!:
-MBAM má občas falešné detekce,proto budeme mazat až po kontrole logu.
-Log zkopírujte sem.
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
aenneus
Návštěvník
Návštěvník
Příspěvky: 5
Registrován: 27 Srp 2011 18:17

Re: upm log, mbr rootkit detected

#6 Příspěvek od aenneus »

promiňte otálení, byl jsem dlouhodobě afk
log z mbam
předem dík :)


Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org

Verze databáze: 7588

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

3.9.2011 15:57:41
mbam-log-2011-09-03 (15-57-34).txt

Typ kontroly: Úplný test (C:\|)
Testované objekty: 279751
Uplynulý čas: 33 minut, 0 sekund

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 0
Infikované hodnoty v registru: 0
Infikované datové položky v registru: 1
Infikované složky: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky v registru:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\StartMenuLogoff (PUM.Hijack.StartMenu) -> Bad: (1) Good: (0) -> No action taken.

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
(Žádné škodlivé položky nebyly zjištěny)
Nahoru
Avatar uživatele
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 Říj 2008 08:02

Re: upm log, mbr rootkit detected

#7 Příspěvek od motji »

V mbamu smažte.


:arrow: Spusťte combofix podle tohoto návodu
http://www.bleepingcomputer.com/combofi ... t-combofix
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
aenneus
Návštěvník
Návštěvník
Příspěvky: 5
Registrován: 27 Srp 2011 18:17

Re: upm log, mbr rootkit detected

#8 Příspěvek od aenneus »

dík :)
na jednom místě musel být log krácen, je tam poznámka.
log z combo fixu:

ComboFix 11-09-03.01 - Administrator 04.09.2011 15:23:19.1.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.1919.1113 [GMT 2:00]
Spuštěný z: c:\documents and settings\Administrator\Dokumenty\Downloads\ComboFix.exe
AV: ESET Smart Security 3.0 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}
FW: ESET Personal firewall *Enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Administrator\WINDOWS
c:\program files\lol
TADY NÁSLEDUJÍ VŠECHNY SOUBORY VE SLOŽCE LOL, TJ. INSTALAČNÍ SLOŽKA HRY LEAGUE OF LEGENDS, VYMAZAL JSEM JE Z LOGU, PROTOŽE BYL PŘÍLIŠ DLOUHÝ.
c:\windows\system32\comct332.ocx
D:\Autorun.inf
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-08-04 do 2011-09-04 )))))))))))))))))))))))))))))))
.
.
2011-09-02 09:01 . 2011-09-02 09:01 21840 ----a-w- c:\windows\system32\SIntfNT.dll
2011-09-02 09:01 . 2011-09-02 09:01 17212 ----a-w- c:\windows\system32\SIntf32.dll
2011-09-02 09:01 . 2011-09-02 09:01 12067 ----a-w- c:\windows\system32\SIntf16.dll
2011-09-02 08:59 . 2011-09-02 09:01 -------- d-----w- c:\program files\Bhagavad-gita Interactive
2011-09-02 08:59 . 1997-08-26 10:06 315904 ----a-w- c:\windows\IsUninst.exe
2011-08-27 21:38 . 2011-08-27 21:38 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\Malwarebytes
2011-08-27 21:38 . 2010-11-29 15:42 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-08-27 21:38 . 2011-08-27 21:38 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-08-27 21:38 . 2010-11-29 15:42 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-27 18:53 . 2011-08-27 18:54 -------- d-----w- c:\program files\trend micro
2011-08-27 18:53 . 2011-08-27 18:54 -------- d-----w- C:\rsit
2011-08-27 17:05 . 2011-08-27 17:05 -------- d-----w- c:\program files\Ultimate Process Manager
2011-08-15 00:22 . 2011-07-31 17:17 16432 ----a-w- c:\windows\system32\lsdelete.exe
2011-08-12 11:49 . 2011-08-14 23:02 -------- d-----w- c:\documents and settings\Administrator\riotsGamesLogs
2011-08-09 21:35 . 2011-08-09 21:35 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\LolClient
2011-08-09 20:55 . 2008-07-31 08:41 68616 ----a-w- c:\windows\system32\XAPOFX1_1.dll
2011-08-09 20:55 . 2008-07-31 08:40 509448 ----a-w- c:\windows\system32\XAudio2_2.dll
2011-08-09 20:55 . 2008-07-12 06:18 467984 ----a-w- c:\windows\system32\d3dx10_39.dll
2011-08-09 20:55 . 2008-07-12 06:18 1493528 ----a-w- c:\windows\system32\D3DCompiler_39.dll
2011-08-09 20:55 . 2008-07-12 06:18 3851784 ----a-w- c:\windows\system32\D3DX9_39.dll
2011-08-09 20:55 . 2011-08-14 23:38 -------- d-----w- c:\windows\Logs
2011-08-09 20:31 . 2011-09-04 13:37 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Data aplikací\PMB Files
2011-08-09 20:30 . 2011-08-09 20:30 -------- d-----w- c:\documents and settings\All Users\Data aplikac
2011-08-09 20:30 . 2011-08-09 20:30 -------- d-----w- c:\program files\Pando Networks
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-04 11:49 . 2011-06-30 00:46 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-31 17:17 . 2011-07-31 17:17 101720 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2011-07-21 12:59 . 2011-07-31 17:16 64512 ----a-w- c:\windows\system32\drivers\Lbd.sys
2011-06-15 05:43 . 2011-06-15 05:44 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-06-15 05:43 . 2007-07-30 07:36 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-06-16 04:30 . 2011-06-30 00:42 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-04-19 484904]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-06-15 15141768]
"Pando Media Booster"="c:\program files\Pando Networks\Media Booster\PMB.exe" [2011-08-09 3077528]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsmqIntCert"="mqrt.dll" [2009-06-25 177152]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-01-05 872448]
"PDF Complete"="c:\program files\PDF Complete\pdfsty.exe" [2007-05-08 331552]
"PTHOSTTR"="c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE" [2007-01-09 145184]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-01-12 827392]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-05-02 163840]
"CognizanceTS"="c:\progra~1\HEWLET~1\IAM\Bin\ASTSVCC.dll" [2003-12-22 17920]
"Recguard"="c:\windows\Sminst\Recguard.exe" [2005-12-20 1187840]
"Reminder"="c:\windows\Creator\Remind_XP.exe" [2006-03-09 806912]
"Scheduler"="c:\windows\SMINST\Scheduler.exe" [2006-10-09 697976]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 49152]
"Cpqset"="c:\program files\Hewlett-Packard\Default Settings\cpqset.exe" [2007-05-03 57344]
"WatchDog"="c:\program files\InterVideo\DVD Check\DVDCheck.exe" [2007-05-23 192512]
"AccelerometerSysTrayApplet"="c:\windows\system32\AccelerometerSt.exe" [2007-01-24 124928]
"MFFSum_Pro_LL2"="c:\program files\Xerox Companion Suite\MFFSUM.exe" [2009-04-22 24576]
"MFPrintServer_Pro_LL2"="c:\program files\Xerox Companion Suite\MFPrintServer.exe" [2009-04-22 73728]
"ZyXEL USB Share Center"="c:\program files\ZyXEL\NetUSB Share Center\Share Center.exe" [2010-07-22 5623808]
"Bonus.SSR.FR10"="c:\program files\ABBYY FineReader 10\Bonus.ScreenshotReader.exe" [2011-07-14 941320]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2008-03-01 1443072]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-18 15360]
.
c:\windows\system32\config\systemprofile\Nabˇdka Start\Programy\Po spuçtŘnˇ\
CCC.lnk - c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [2006-9-29 49152]
.
c:\documents and settings\Administrator\Nabˇdka Start\Programy\Po spuçtŘnˇ\
CCC.lnk - c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [2006-9-29 49152]
OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\windows\system32\config\systemprofile\Nabˇdka Start\Programy\Po spuçtŘnˇ\
CCC.lnk - c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [2006-9-29 49152]
.
c:\documents and settings\Administrator\Nabˇdka Start\Programy\Po spuçtŘnˇ\
CCC.lnk - c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [2006-9-29 49152]
OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-2-6 561213]
DVD Check.lnk - c:\program files\InterVideo\DVD Check\DVDCheck.exe [2011-6-3 192512]
.
c:\windows\system32\config\systemprofile\Nabˇdka Start\Programy\Po spuçtŘnˇ\
CCC.lnk - c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [2006-9-29 49152]
.
c:\documents and settings\Default User\Nabˇdka Start\Programy\Po spuçtŘnˇ\
CCC.lnk - c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [2006-9-29 49152]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OneCard]
2007-02-07 01:30 74240 ----a-r- c:\program files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\APSHook.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mqsvc.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\WINDOWS\\SMINST\\Scheduler.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\ZyXEL\\NetUSB Share Center\\Share Center.exe"=
"c:\\Program Files\\ICQ7.5\\ICQ.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"7417:UDP"= 7417:UDP:NetUSB Share Center UDP Port
"58178:TCP"= 58178:TCP:Pando Media Booster
"58178:UDP"= 58178:UDP:Pando Media Booster
.
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [31.7.2011 19:16 64512]
R0 SafeBoot;SafeBoot;c:\windows\system32\drivers\SafeBoot.sys [7.2.2007 11:22 100495]
R0 SbAlg;SbAlg;c:\windows\system32\drivers\SbAlg.sys [9.10.2006 13:31 44720]
R0 SbFsLock;SbFsLock;c:\windows\system32\drivers\SbFsLock.sys [29.3.2007 16:54 13696]
R1 RsvLock;RsvLock;c:\windows\system32\drivers\rsvlock.sys [7.2.2007 11:23 5808]
R2 ABBYY.Licensing.FineReader.Corporate.10.0;ABBYY FineReader 10 CE Licensing Service;c:\program files\Common Files\ABBYY\FineReader\10.00\Licensing\CE\NetworkLicenseServer.exe [19.12.2009 1:06 814344]
R2 ASBroker;Logon Session Broker;c:\windows\System32\svchost.exe -k Cognizance [18.8.2004 10:00 14336]
R2 ASChannel;Local Communication Channel;c:\windows\System32\svchost.exe -k Cognizance [18.8.2004 10:00 14336]
R2 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [21.12.2007 8:21 468224]
R2 FUSServices;Session Launcher Service;c:\windows\system32\FUSServices.exe [22.4.2009 4:18 10752]
R2 HpFkCryptService;Drive Encryption Service;c:\program files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [29.3.2007 17:50 221184]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [21.7.2011 14:59 2152152]
R2 pdfcDispatcher;PDF Document Manager;c:\program files\PDF Complete\pdfsvc.exe [30.7.2007 9:12 540448]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [19.9.2006 18:58 36608]
R3 ZyxelUDSMBus;UDS Master Bus of Kernel USB Software Bus by TCP;c:\windows\system32\drivers\ZyxelUDSMBus.sys [22.7.2010 18:15 61184]
S3 XMLDIUSB;XML USB Device Interface;c:\windows\system32\drivers\XMLDIUSB.sys [9.6.2011 7:46 33152]
S3 ZyxelUDSTcpBus;ZyxelUDSTcpBus;c:\windows\system32\drivers\ZyxelUDSTcpBus.sys [22.7.2010 18:19 90240]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
Cognizance REG_MULTI_SZ ASBroker ASChannel
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-04-19 11:23 452136 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2011-09-04 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2011-07-21 07:40]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.hp.com
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files\ICQ7.5\ICQ.exe
FF - ProfilePath - c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\4nio02z7.default\
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
HKLM_ActiveSetup-ccc-core-static - msiexec
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-09-04 15:36
Windows 5.1.2600 Service Pack 2 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\Hewlett-Packard\Default Settings\cpqset.exe????????T??????????????|?M?|?????M?|&?@
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\pdfcDispatcher]
"ImagePath"="c:\program files\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(996)
c:\windows\system32\Ati2evxx.dll
c:\program files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll
c:\program files\Hewlett-Packard\IAM\bin\ItMsg.dll
c:\program files\Hewlett-Packard\IAM\Bin\TrayIcon.dll
c:\program files\Hewlett-Packard\IAM\bin\HPBrand.dll
c:\program files\Hewlett-Packard\IAM\Bin\ASChnl.dll
c:\program files\Hewlett-Packard\IAM\Bin\ItDAC.dll
c:\program files\Hewlett-Packard\IAM\Bin\ItReports.DLL
c:\program files\Hewlett-Packard\IAM\Bin\BioAuth.dll
c:\program files\Hewlett-Packard\IAM\Bin\ASBIoAT.dll
c:\program files\Hewlett-Packard\IAM\Bin\ittal.dll
c:\program files\Hewlett-Packard\IAM\Bin\STEngine.dll
c:\program files\Hewlett-Packard\IAM\Bin\ItVCClient.dll
c:\program files\Hewlett-Packard\IAM\Bin\AuthWiz.dll
.
- - - - - - - > 'explorer.exe'(2056)
c:\windows\system32\APSHook.dll
c:\windows\system32\btmmhook.dll
c:\windows\system32\msi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\msdtc.exe
c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\windows\system32\mqsvc.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\mqtgsvc.exe
c:\windows\System32\SCardSvr.exe
c:\program files\Hewlett-Packard\IAM\bin\asghost.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
c:\program files\Xerox Companion Suite\MFServices.exe
c:\program files\Hewlett-Packard\Shared\HpqToaster.exe
c:\program files\Lavasoft\Ad-Aware\AAWTray.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\windows\system32\LF2GRPOW.exe
c:\windows\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Celkový čas: 2011-09-04 15:40:10 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-09-04 13:40
.
Před spuštěním: Volných bajtů: 167 122 206 720
Po spuštění: Volných bajtů: 167 203 774 464
.
WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer
.
- - End Of File - - 5B869CFE3FC387D02900AA3E95A46477
Nahoru
Avatar uživatele
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 Říj 2008 08:02

Re: upm log, mbr rootkit detected

#9 Příspěvek od motji »

Můžete prosím složku c:\qoobox dát do raru a upnout zde jako přílohu? Podívám se, proč mazal některé soubory.
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
Odpovědět

Vrátit se na „Řešení problémů, logy“