Podezřelé záznamy ve firewallu part II

Zpráva

b_henry · #1 Příspěvek od **b_henry** » 27 srp 2011 17:36

http://ssdsandbox.net/ip?ip=67.202.66.171 Toto není snaha o spam,ale upozornění na možnou hrozbu z této IP, která se mě snaží "kontaktovat" několikrát denně a asi nemá dvakrát čisté úmysly. Pokud si myslíte že to není důležité,klidně to zase smažte...

j3šť3r · #2 Příspěvek od **j3šť3r** » 27 srp 2011 19:57

Tak si myslim, ze by nebylo od veci dat log alespon do prevetivek, jestli se nejaky smejd nesnazi pro to otevirat vratka (podle me je to vetsi sance nez primy utok na vas pocitac).

#3 Příspěvek od **vyosek** » 28 srp 2011 06:13

Zdravim a pekny den preji

Chapu Vasi "narazku" vetsou "Neni snaha o spam" - chyba na me strane - vysvetleno v PMce

Log z RSIT dejte sem at vime k cemu to patri, ja pak hodim cele tema do preventivek

Urcite si nemyslim ze to bude jen tak a kdyz uz tak nebude mit provider ciste svedomi, jak jste psal v prvnim tematu

b_henry · #4 Příspěvek od **b_henry** » 28 srp 2011 09:37

Dobrý den,jsem rád že se vše vysvětlilo!

Spíš si myslím že provozovatel té sítě je "trochu divnej"... Zde jsou logy:

Logfile of random's system information tool 1.09 (written by random/random)
Run by Milan at 2011-08-28 10:26:52
Microsoft Windows 7 Ultimate Service Pack 1
System drive C: has 126 GB (82%) free of 153 GB
Total RAM: 2045 MB (60% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:27:01, on 28.8.2011
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files\trend micro\Milan.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-3050074238-2697592148-57845244-1001\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'UpdatusUser')
O4 - HKUS\S-1-5-21-3050074238-2697592148-57845244-1001\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'UpdatusUser')
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {6BA530D8-94B2-49E0-AC55-70899582FE1F} (CV781Object Object) - http://sadek.jaronet.cz/AV718.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C0D6C327-4B13-4034-AEA5-84D53124B890}: NameServer = 77.48.254.254,77.48.100.254
O20 - AppInit_DLLs: C:\Windows\SysWOW64\guard32.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: @%windir%\system32\inetsrv\iisres.dll,-30007 (IISADMIN) - Unknown owner - C:\Windows\system32\inetsrv\inetinfo.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files (x86)\WinPcap\rpcapd.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: TeamViewer 6 (TeamViewer6) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: @%windir%\system32\inetsrv\iisres.dll,-20001 (WMSVC) - Unknown owner - C:\Windows\system32\inetsrv\wmsvc.exe (file missing)

--
End of file - 7884 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
winlogon.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
"C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe"
C:\Windows\system32\svchost.exe -k RPCSS
"C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe"
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
"C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe"
C:\Windows\system32\nvvsvc.exe -session -first
"C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"taskhost.exe"
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
C:\Windows\system32\svchost.exe -k apphost
C:\Windows\system32\inetsrv\inetinfo.exe
"C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe"
C:\Windows\system32\svchost.exe -k iissvcs
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Windows\system32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-ed364971-e538-4424-a5b9-e4ea81d7721b -SystemEventPortName:HostProcess-e7753498-48c5-4da8-b117-d6572b90432b -IoCancelEventPortName:HostProcess-2334460a-53ac-44c5-9e66-df9488f76572 -NonStateChangingEventPortName:HostProcess-8e487df8-588f-4535-a77d-d4224987e760 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:dabe2454-411f-4c23-826b-60c68d1d86cb
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:/Program Files/NVIDIA Corporation/Display/nvtray.exe" -user_has_logged_in 1
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
"C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
"C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe"
"C:\Windows\system32\wuauclt.exe"
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
"C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel=720.64b8a80.1411948695 "C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll" Mozilla.Firefox.6.0 -greomni "C:\Program Files (x86)\Mozilla Firefox\omni.jar" 720 "\\.\pipe\gecko-crash-server-pipe.720" plugin
"C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel=720.68b9a70.606523543 "C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll" Mozilla.Firefox.6.0 -greomni "C:\Program Files (x86)\Mozilla Firefox\omni.jar" 720 "\\.\pipe\gecko-crash-server-pipe.720" plugin
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe9_ Global\UsGthrCtrlFltPipeMssGthrPipe9 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 532 536 544 65536 540
"C:\Users\Milan\Desktop\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe

=========Mozilla firefox=========

ProfilePath - C:\Users\Milan\AppData\Roaming\Mozilla\Firefox\Profiles\tgws3wuf.default

prefs.js - "browser.search.useDBForOrder" - true

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Google.com/GoogleEarthPlugin]
"Description"=Google Earth in your browser
"Path"=C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/wpi,version=1.4]
"Description"=
"Path"=C:\Program Files\Microsoft\Web Platform Installer\\npwpidetector.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@nvidia.com/3DVision]
"Description"=NVIDIA stereo images plugin for Mozilla browsers
"Path"=C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@nvidia.com/3DVisionStreaming]
"Description"=NVIDIA 3D Vision Streaming plugin for Mozilla browsers
"Path"=C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/wpi,version=1.4]
"Description"=
"Path"=C:\Program Files\Microsoft\Web Platform Installer\\npwpidetector.dll

C:\Program Files (x86)\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA}

C:\Program Files (x86)\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files (x86)\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

C:\Users\Milan\AppData\Roaming\Mozilla\Firefox\Profiles\tgws3wuf.default\extensions\
fastdial@telega.phpnet.us

C:\Users\Milan\AppData\Roaming\Mozilla\Firefox\Profiles\tgws3wuf.default\searchplugins\
vyhledvn-vide-ve-slub-youtube.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{318A227B-5E9F-45bd-8999-7F8F10CA4CF5}]
avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2011-07-04 978496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-08-16 49440]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-06-06 63912]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2011-07-04 820864]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2011-08-16 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2011-07-04 978496]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2011-07-04 820864]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2011-07-07 12558440]
"COMODO Internet Security"=C:\Program Files\COMODO\COMODO Internet Security\cfp.exe [2011-06-30 9048392]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-21 1475584]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"NUSB3MON"=C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [2011-04-14 113288]
"JMB36X IDE Setup"=C:\Windows\RaidTool\xInsIDE.exe [2010-09-07 43608]
"avast"=C:\Program Files\AVAST Software\Avast\avastUI.exe [2011-07-04 3493720]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-06-06 937920]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2011-06-09 254696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=" C:\Windows\system32\guard64.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2011-08-28 10:26:52 ----D---- C:\rsit
2011-08-28 10:26:52 ----D---- C:\Program Files\trend micro
2011-08-24 23:29:14 ----A---- C:\Windows\SYSWOW64\tzres.dll
2011-08-24 23:29:14 ----A---- C:\Windows\system32\tzres.dll
2011-08-24 16:07:47 ----A---- C:\Windows\system32\RTNUninst64.dll
2011-08-24 16:07:47 ----A---- C:\Windows\system32\RtNicProp64.dll
2011-08-24 16:07:47 ----A---- C:\Windows\system32\drivers\Rt64win7.sys
2011-08-23 23:05:45 ----D---- C:\Program Files (x86)\TeamViewer
2011-08-23 22:04:24 ----D---- C:\Users\Milan\AppData\Roaming\TeamViewer
2011-08-23 09:24:02 ----D---- C:\Program Files (x86)\Trillian
2011-08-21 11:48:01 ----D---- C:\Users\Milan\AppData\Roaming\QIP
2011-08-21 11:47:10 ----D---- C:\Program Files (x86)\QIP Infium
2011-08-20 10:16:14 ----D---- C:\Program Files\PHP Manager 1.2 for IIS 7
2011-08-20 10:16:09 ----D---- C:\Program Files (x86)\PHP
2011-08-20 10:14:05 ----D---- C:\Program Files (x86)\Microsoft
2011-08-20 10:14:04 ----D---- C:\Program Files\Microsoft
2011-08-20 09:39:21 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI
2011-08-20 09:38:44 ----D---- C:\Windows\SYSWOW64\BestPractices
2011-08-20 09:38:43 ----D---- C:\Windows\system32\BestPractices
2011-08-20 09:19:00 ----D---- C:\inetpub
2011-08-19 11:04:45 ----D---- C:\Users\Milan\AppData\Roaming\Wireshark
2011-08-19 11:03:09 ----D---- C:\Program Files (x86)\WinPcap
2011-08-19 11:01:59 ----D---- C:\Program Files\Wireshark
2011-08-19 08:28:53 ----D---- C:\Program Files (x86)\CBS Software
2011-08-18 22:32:37 ----D---- C:\Users\Milan\AppData\Roaming\Trillian
2011-08-18 12:43:15 ----D---- C:\Windows\system32\appmgmt
2011-08-16 21:51:41 ----D---- C:\ProgramData\Sun
2011-08-16 21:51:33 ----A---- C:\Windows\SYSWOW64\javaws.exe
2011-08-16 21:51:33 ----A---- C:\Windows\SYSWOW64\javaw.exe
2011-08-16 21:51:33 ----A---- C:\Windows\SYSWOW64\java.exe
2011-08-16 21:51:33 ----A---- C:\Windows\SYSWOW64\deployJava1.dll
2011-08-16 21:51:20 ----D---- C:\Program Files (x86)\Java
2011-08-16 21:50:00 ----A---- C:\Windows\system32\javaws.exe
2011-08-16 21:50:00 ----A---- C:\Windows\system32\javaw.exe
2011-08-16 21:50:00 ----A---- C:\Windows\system32\java.exe
2011-08-16 21:50:00 ----A---- C:\Windows\system32\deployJava1.dll
2011-08-16 21:48:55 ----D---- C:\Program Files\Java
2011-08-15 22:29:20 ----D---- C:\Program Files (x86)\Adobe
2011-08-15 22:28:34 ----D---- C:\ProgramData\Adobe
2011-08-15 18:08:20 ----D---- C:\Program Files (x86)\Google
2011-08-13 17:50:28 ----D---- C:\Windows\Options
2011-08-13 15:00:08 ----RA---- C:\Windows\system32\athurx.sys
2011-08-13 15:00:08 ----A---- C:\Windows\system32\drivers\athurx.sys
2011-08-13 14:59:15 ----D---- C:\ProgramData\TP-LINK
2011-08-10 22:25:27 ----D---- C:\Users\Milan\AppData\Roaming\WinRAR
2011-08-10 22:25:14 ----D---- C:\Program Files\WinRAR
2011-08-10 15:56:28 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2011-08-10 15:56:28 ----A---- C:\Windows\system32\mshtmled.dll
2011-08-10 15:56:27 ----A---- C:\Windows\SYSWOW64\ieui.dll
2011-08-10 15:56:27 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2011-08-10 15:56:27 ----A---- C:\Windows\system32\ieui.dll
2011-08-10 15:56:27 ----A---- C:\Windows\system32\iertutil.dll
2011-08-10 15:56:26 ----A---- C:\Windows\SYSWOW64\url.dll
2011-08-10 15:56:26 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2011-08-10 15:56:26 ----A---- C:\Windows\SYSWOW64\jscript.dll
2011-08-10 15:56:26 ----A---- C:\Windows\system32\url.dll
2011-08-10 15:56:26 ----A---- C:\Windows\system32\jscript9.dll
2011-08-10 15:56:25 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2011-08-10 15:56:25 ----A---- C:\Windows\system32\urlmon.dll
2011-08-10 15:56:25 ----A---- C:\Windows\system32\jscript.dll
2011-08-10 15:56:24 ----A---- C:\Windows\SYSWOW64\wininet.dll
2011-08-10 15:56:24 ----A---- C:\Windows\system32\wininet.dll
2011-08-10 15:56:24 ----A---- C:\Windows\system32\jsproxy.dll
2011-08-10 15:56:23 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2011-08-10 15:56:21 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2011-08-10 15:56:20 ----A---- C:\Windows\system32\mshtml.dll
2011-08-10 15:56:19 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2011-08-10 15:56:19 ----A---- C:\Windows\system32\ieframe.dll
2011-08-10 15:55:42 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2011-08-10 15:55:42 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2011-08-10 15:55:42 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2011-08-10 15:55:41 ----A---- C:\Windows\system32\kernel32.dll
2011-08-10 15:55:41 ----A---- C:\Windows\system32\conhost.exe
2011-08-10 15:55:40 ----A---- C:\Windows\SYSWOW64\setup16.exe
2011-08-10 15:55:40 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2011-08-10 15:55:40 ----A---- C:\Windows\system32\wow64win.dll
2011-08-10 15:55:40 ----A---- C:\Windows\system32\wow64cpu.dll
2011-08-10 15:55:40 ----A---- C:\Windows\system32\wow64.dll
2011-08-10 15:55:40 ----A---- C:\Windows\system32\winsrv.dll
2011-08-10 15:55:40 ----A---- C:\Windows\system32\ntvdm64.dll
2011-08-10 15:55:40 ----A---- C:\Windows\system32\KernelBase.dll
2011-08-10 15:55:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2011-08-10 15:55:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2011-08-10 15:55:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2011-08-10 15:55:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-08-10 15:55:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2011-08-10 15:55:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2011-08-10 15:55:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2011-08-10 15:55:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2011-08-10 15:55:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2011-08-10 15:55:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2011-08-10 15:55:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2011-08-10 15:55:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2011-08-10 15:55:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2011-08-10 15:55:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2011-08-10 15:55:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2011-08-10 15:55:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2011-08-10 15:55:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2011-08-10 15:55:39 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2011-08-10 15:55:39 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2011-08-10 15:55:39 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2011-08-10 15:55:39 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2011-08-10 15:55:39 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2011-08-10 15:55:39 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2011-08-10 15:55:39 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2011-08-10 15:55:39 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-08-10 15:55:39 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2011-08-10 15:55:39 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2011-08-10 15:55:39 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2011-08-10 15:55:39 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2011-08-10 15:55:39 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2011-08-10 15:55:39 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2011-08-10 15:55:39 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2011-08-10 15:55:39 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2011-08-10 15:55:39 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2011-08-10 15:55:39 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2011-08-10 15:55:39 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2011-08-10 15:55:39 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2011-08-10 15:55:39 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2011-08-10 15:55:39 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2011-08-10 15:55:39 ----A---- C:\Windows\SYSWOW64\wow32.dll
2011-08-10 15:55:39 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2011-08-10 15:55:39 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2011-08-10 15:55:38 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2011-08-10 15:55:38 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2011-08-10 15:55:38 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2011-08-10 15:55:38 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2011-08-10 15:55:38 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2011-08-10 15:55:38 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2011-08-10 15:55:38 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2011-08-10 15:55:38 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2011-08-10 15:55:38 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2011-08-10 15:55:38 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2011-08-10 15:55:38 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2011-08-10 15:55:38 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2011-08-10 15:55:38 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2011-08-10 15:55:38 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2011-08-10 15:55:38 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2011-08-10 15:55:38 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2011-08-10 15:55:38 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2011-08-10 15:55:38 ----A---- C:\Windows\SYSWOW64\xmllite.dll
2011-08-10 15:55:38 ----A---- C:\Windows\SYSWOW64\user.exe
2011-08-10 15:55:38 ----A---- C:\Windows\SYSWOW64\instnm.exe
2011-08-10 15:55:38 ----A---- C:\Windows\system32\xmllite.dll
2011-08-10 15:55:37 ----A---- C:\Windows\SYSWOW64\odbctrac.dll
2011-08-10 15:55:37 ----A---- C:\Windows\SYSWOW64\odbcjt32.dll
2011-08-10 15:55:37 ----A---- C:\Windows\SYSWOW64\odbccu32.dll
2011-08-10 15:55:37 ----A---- C:\Windows\SYSWOW64\odbccr32.dll
2011-08-10 15:55:37 ----A---- C:\Windows\SYSWOW64\odbccp32.dll
2011-08-10 15:55:37 ----A---- C:\Windows\system32\odbctrac.dll
2011-08-10 15:55:37 ----A---- C:\Windows\system32\odbccu32.dll
2011-08-10 15:55:37 ----A---- C:\Windows\system32\odbccr32.dll
2011-08-10 15:55:37 ----A---- C:\Windows\system32\odbccp32.dll
2011-08-10 15:55:37 ----A---- C:\Windows\system32\drivers\tcpip.sys
2011-08-10 15:55:36 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2011-08-10 15:55:36 ----A---- C:\Windows\system32\ntoskrnl.exe
2011-08-10 15:55:35 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2011-08-10 11:30:59 ----D---- C:\Program Files (x86)\YouTube Downloader
2011-08-09 11:58:28 ----A---- C:\Windows\SYSWOW64\esent.dll
2011-08-09 11:58:28 ----A---- C:\Windows\system32\fsutil.exe
2011-08-09 11:58:28 ----A---- C:\Windows\system32\esent.dll
2011-08-09 11:58:28 ----A---- C:\Windows\system32\drivers\amdxata.sys
2011-08-09 11:58:27 ----A---- C:\Windows\SYSWOW64\fsutil.exe
2011-08-09 11:58:27 ----A---- C:\Windows\system32\drivers\USBSTOR.SYS
2011-08-09 11:58:27 ----A---- C:\Windows\system32\drivers\storport.sys
2011-08-09 11:58:27 ----A---- C:\Windows\system32\drivers\nvstor.sys
2011-08-09 11:58:27 ----A---- C:\Windows\system32\drivers\nvraid.sys
2011-08-09 11:58:27 ----A---- C:\Windows\system32\drivers\ntfs.sys
2011-08-09 11:58:27 ----A---- C:\Windows\system32\drivers\iaStorV.sys
2011-08-09 11:58:27 ----A---- C:\Windows\system32\drivers\amdsata.sys
2011-08-09 11:58:23 ----A---- C:\Windows\system32\drivers\usbuhci.sys
2011-08-09 11:58:23 ----A---- C:\Windows\system32\drivers\usbport.sys
2011-08-09 11:58:23 ----A---- C:\Windows\system32\drivers\usbohci.sys
2011-08-09 11:58:23 ----A---- C:\Windows\system32\drivers\usbhub.sys
2011-08-09 11:58:23 ----A---- C:\Windows\system32\drivers\usbehci.sys
2011-08-09 11:58:23 ----A---- C:\Windows\system32\drivers\usbd.sys
2011-08-09 11:58:23 ----A---- C:\Windows\system32\drivers\usbccgp.sys
2011-08-08 23:03:04 ----D---- C:\Users\Milan\AppData\Roaming\Thunderbird
2011-08-08 23:02:56 ----D---- C:\Program Files (x86)\Mozilla Thunderbird
2011-08-08 21:35:25 ----D---- C:\Users\Milan\AppData\Roaming\Mozilla
2011-08-08 21:35:17 ----D---- C:\Program Files (x86)\Mozilla Firefox
2011-08-08 21:30:38 ----D---- C:\Users\Milan\AppData\Roaming\Macromedia
2011-08-08 21:30:38 ----D---- C:\Users\Milan\AppData\Roaming\Adobe
2011-08-08 21:30:34 ----D---- C:\Windows\SYSWOW64\Macromed
2011-08-08 21:26:33 ----D---- C:\Program Files\CCleaner
2011-08-08 21:25:43 ----D---- C:\Program Files\Defraggler
2011-08-08 21:10:26 ----A---- C:\Windows\SYSWOW64\explorer.exe
2011-08-08 21:10:26 ----A---- C:\Windows\explorer.exe
2011-08-08 21:10:25 ----A---- C:\Windows\SYSWOW64\drvinst.exe
2011-08-08 21:10:25 ----A---- C:\Windows\SYSWOW64\devrtl.dll
2011-08-08 21:10:25 ----A---- C:\Windows\SYSWOW64\devobj.dll
2011-08-08 21:10:25 ----A---- C:\Windows\SYSWOW64\d3d10_1.dll
2011-08-08 21:10:25 ----A---- C:\Windows\SYSWOW64\cfgmgr32.dll
2011-08-08 21:10:25 ----A---- C:\Windows\system32\umpnpmgr.dll
2011-08-08 21:10:25 ----A---- C:\Windows\system32\d3d10_1.dll
2011-08-08 21:10:23 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2011-08-08 21:10:23 ----A---- C:\Windows\system32\kerberos.dll
2011-08-08 21:10:15 ----A---- C:\Windows\system32\drivers\bowser.sys
2011-08-08 21:10:04 ----A---- C:\Windows\system32\EncDec.dll
2011-08-08 21:10:04 ----A---- C:\Windows\system32\CPFilters.dll
2011-08-08 21:10:03 ----A---- C:\Windows\SYSWOW64\sbe.dll
2011-08-08 21:10:03 ----A---- C:\Windows\SYSWOW64\EncDec.dll
2011-08-08 21:10:03 ----A---- C:\Windows\SYSWOW64\CPFilters.dll
2011-08-08 21:10:03 ----A---- C:\Windows\system32\sbe.dll
2011-08-08 21:10:01 ----A---- C:\Windows\SYSWOW64\XpsPrint.dll
2011-08-08 21:10:01 ----A---- C:\Windows\system32\XpsPrint.dll
2011-08-08 21:09:57 ----A---- C:\Windows\system32\drivers\afd.sys
2011-08-08 21:09:56 ----A---- C:\Windows\SYSWOW64\tquery.dll
2011-08-08 21:09:56 ----A---- C:\Windows\SYSWOW64\SearchProtocolHost.exe
2011-08-08 21:09:56 ----A---- C:\Windows\SYSWOW64\SearchIndexer.exe
2011-08-08 21:09:56 ----A---- C:\Windows\SYSWOW64\SearchFilterHost.exe
2011-08-08 21:09:56 ----A---- C:\Windows\SYSWOW64\mssvp.dll
2011-08-08 21:09:56 ----A---- C:\Windows\SYSWOW64\mssrch.dll
2011-08-08 21:09:56 ----A---- C:\Windows\SYSWOW64\mssphtb.dll
2011-08-08 21:09:56 ----A---- C:\Windows\SYSWOW64\mssph.dll
2011-08-08 21:09:56 ----A---- C:\Windows\SYSWOW64\msscntrs.dll
2011-08-08 21:09:56 ----A---- C:\Windows\system32\tquery.dll
2011-08-08 21:09:56 ----A---- C:\Windows\system32\SearchProtocolHost.exe
2011-08-08 21:09:56 ----A---- C:\Windows\system32\SearchIndexer.exe
2011-08-08 21:09:56 ----A---- C:\Windows\system32\SearchFilterHost.exe
2011-08-08 21:09:56 ----A---- C:\Windows\system32\mssvp.dll
2011-08-08 21:09:56 ----A---- C:\Windows\system32\mssrch.dll
2011-08-08 21:09:56 ----A---- C:\Windows\system32\mssphtb.dll
2011-08-08 21:09:56 ----A---- C:\Windows\system32\mssph.dll
2011-08-08 21:09:56 ----A---- C:\Windows\system32\msscntrs.dll
2011-08-08 21:09:55 ----A---- C:\Windows\SYSWOW64\mfc42u.dll
2011-08-08 21:09:55 ----A---- C:\Windows\SYSWOW64\mfc42.dll
2011-08-08 21:09:55 ----A---- C:\Windows\system32\mfc42u.dll
2011-08-08 21:09:55 ----A---- C:\Windows\system32\mfc42.dll
2011-08-08 21:09:54 ----A---- C:\Windows\SYSWOW64\DWrite.dll
2011-08-08 21:09:54 ----A---- C:\Windows\SYSWOW64\d2d1.dll
2011-08-08 21:09:54 ----A---- C:\Windows\system32\FntCache.dll
2011-08-08 21:09:54 ----A---- C:\Windows\system32\DWrite.dll
2011-08-08 21:09:54 ----A---- C:\Windows\system32\d2d1.dll
2011-08-08 21:09:53 ----A---- C:\Windows\SYSWOW64\XpsGdiConverter.dll
2011-08-08 21:09:53 ----A---- C:\Windows\SYSWOW64\fontsub.dll
2011-08-08 21:09:53 ----A---- C:\Windows\SYSWOW64\atmlib.dll
2011-08-08 21:09:53 ----A---- C:\Windows\SYSWOW64\atmfd.dll
2011-08-08 21:09:53 ----A---- C:\Windows\system32\XpsGdiConverter.dll
2011-08-08 21:09:53 ----A---- C:\Windows\system32\fontsub.dll
2011-08-08 21:09:53 ----A---- C:\Windows\system32\atmlib.dll
2011-08-08 21:09:53 ----A---- C:\Windows\system32\atmfd.dll
2011-08-08 21:09:51 ----A---- C:\Windows\SYSWOW64\poqexec.exe
2011-08-08 21:09:51 ----A---- C:\Windows\system32\poqexec.exe
2011-08-08 21:09:51 ----A---- C:\Windows\system32\drivers\Diskdump.sys
2011-08-08 21:09:50 ----A---- C:\Windows\SYSWOW64\dnscacheugc.exe
2011-08-08 21:09:50 ----A---- C:\Windows\SYSWOW64\dnsapi.dll
2011-08-08 21:09:50 ----A---- C:\Windows\system32\dnsrslvr.dll
2011-08-08 21:09:50 ----A---- C:\Windows\system32\dnscacheugc.exe
2011-08-08 21:09:50 ----A---- C:\Windows\system32\dnsapi.dll
2011-08-08 21:09:43 ----A---- C:\Windows\SYSWOW64\oleaut32.dll
2011-08-08 21:09:43 ----A---- C:\Windows\system32\oleaut32.dll
2011-08-08 21:09:42 ----A---- C:\Windows\system32\winresume.exe
2011-08-08 21:09:42 ----A---- C:\Windows\system32\winload.exe
2011-08-08 21:09:42 ----A---- C:\Windows\system32\kdusb.dll
2011-08-08 21:09:42 ----A---- C:\Windows\system32\kdcom.dll
2011-08-08 21:09:42 ----A---- C:\Windows\system32\kd1394.dll
2011-08-08 21:09:41 ----A---- C:\Windows\SYSWOW64\prevhost.exe
2011-08-08 21:09:41 ----A---- C:\Windows\SYSWOW64\inetcomm.dll
2011-08-08 21:09:41 ----A---- C:\Windows\system32\prevhost.exe
2011-08-08 21:09:41 ----A---- C:\Windows\system32\inetcomm.dll
2011-08-08 21:09:41 ----A---- C:\Windows\system32\FXSCOVER.exe
2011-08-08 21:08:34 ----A---- C:\Windows\system32\win32k.sys
2011-08-08 21:08:22 ----A---- C:\Windows\system32\drivers\srvnet.sys
2011-08-08 21:08:22 ----A---- C:\Windows\system32\drivers\srv2.sys
2011-08-08 21:08:22 ----A---- C:\Windows\system32\drivers\srv.sys
2011-08-08 20:17:39 ----D---- C:\Program Files\COMODO
2011-08-08 20:16:48 ----D---- C:\ProgramData\Comodo
2011-08-08 20:16:23 ----D---- C:\ProgramData\Comodo Downloader
2011-08-08 20:08:58 ----A---- C:\Windows\system32\drivers\aswSP.sys
2011-08-08 20:08:58 ----A---- C:\Windows\system32\drivers\aswFsBlk.sys
2011-08-08 20:08:57 ----A---- C:\Windows\system32\drivers\aswTdi.sys
2011-08-08 20:08:57 ----A---- C:\Windows\system32\drivers\aswSnx.sys
2011-08-08 20:08:57 ----A---- C:\Windows\system32\drivers\aswRdr.sys
2011-08-08 20:08:56 ----A---- C:\Windows\system32\drivers\aswMonFlt.sys
2011-08-08 20:08:56 ----A---- C:\Windows\system32\aswBoot.exe
2011-08-08 20:08:42 ----A---- C:\Windows\SYSWOW64\aswBoot.exe
2011-08-08 20:08:42 ----A---- C:\Windows\avastSS.scr
2011-08-08 20:08:38 ----D---- C:\ProgramData\AVAST Software
2011-08-08 20:08:38 ----D---- C:\Program Files\AVAST Software
2011-08-08 18:06:37 ----D---- C:\Windows\SYSWOW64\RTCOM
2011-08-08 18:06:37 ----D---- C:\Program Files\Realtek
2011-08-08 18:06:16 ----A---- C:\Windows\system32\WavesGUILib.dll
2011-08-08 18:06:15 ----A---- C:\Windows\system32\SRSWOW64.dll
2011-08-08 18:06:15 ----A---- C:\Windows\system32\SRSTSX64.dll
2011-08-08 18:06:15 ----A---- C:\Windows\system32\SRSTSH64.dll
2011-08-08 18:06:15 ----A---- C:\Windows\system32\SRSHP64.dll
2011-08-08 18:06:14 ----A---- C:\Windows\SYSWOW64\SFCOM.dll
2011-08-08 18:06:14 ----A---- C:\Windows\system32\SFSS_APO.dll
2011-08-08 18:06:14 ----A---- C:\Windows\system32\SFNHK64.dll
2011-08-08 18:06:14 ----A---- C:\Windows\system32\SFCOM64.dll
2011-08-08 18:06:14 ----A---- C:\Windows\system32\SFAPO64.dll
2011-08-08 18:06:12 ----A---- C:\Windows\system32\RtPgEx64.dll
2011-08-08 18:06:12 ----A---- C:\Windows\system32\RtlCPAPI64.dll
2011-08-08 18:06:12 ----A---- C:\Windows\system32\RtkCfg64.dll
2011-08-08 18:06:12 ----A---- C:\Windows\system32\drivers\RTKVHD64.sys
2011-08-08 18:06:11 ----A---- C:\Windows\system32\RtkAPO64.dll
2011-08-08 18:06:11 ----A---- C:\Windows\system32\RtkApi64.dll
2011-08-08 18:06:11 ----A---- C:\Windows\system32\RTEEP64A.dll
2011-08-08 18:06:11 ----A---- C:\Windows\system32\RTEEL64A.dll
2011-08-08 18:06:11 ----A---- C:\Windows\system32\RTEEG64A.dll
2011-08-08 18:06:11 ----A---- C:\Windows\system32\RTEED64A.dll
2011-08-08 18:06:11 ----A---- C:\Windows\system32\RTCOM64.dll
2011-08-08 18:06:11 ----A---- C:\Windows\system32\RP3DHT64.dll
2011-08-08 18:06:11 ----A---- C:\Windows\system32\RP3DAA64.dll
2011-08-08 18:06:11 ----A---- C:\Windows\system32\RCoRes64.dat
2011-08-08 18:06:11 ----A---- C:\Windows\system32\RCoInst64.dll
2011-08-08 18:06:10 ----A---- C:\Windows\system32\R4EEP64A.dll
2011-08-08 18:06:10 ----A---- C:\Windows\system32\R4EEL64A.dll
2011-08-08 18:06:10 ----A---- C:\Windows\system32\R4EEG64A.dll
2011-08-08 18:06:10 ----A---- C:\Windows\system32\R4EED64A.dll
2011-08-08 18:06:10 ----A---- C:\Windows\system32\R4EEA64A.dll
2011-08-08 18:06:10 ----A---- C:\Windows\system32\MaxxVolumeSDAPO.dll
2011-08-08 18:06:10 ----A---- C:\Windows\system32\MaxxAudioRealtek.dll
2011-08-08 18:06:10 ----A---- C:\Windows\system32\MaxxAudioEQ.dll
2011-08-08 18:06:09 ----A---- C:\Windows\system32\MaxxAudioAPO30.dll
2011-08-08 18:06:09 ----A---- C:\Windows\system32\MaxxAudioAPO20.dll
2011-08-08 18:06:09 ----A---- C:\Windows\system32\KAAPORT64.dll
2011-08-08 18:06:08 ----A---- C:\Windows\system32\FMAPO64.dll
2011-08-08 18:06:08 ----A---- C:\Windows\system32\DTSVoiceClarityDLL64.dll
2011-08-08 18:06:08 ----A---- C:\Windows\system32\DTSSymmetryDLL64.dll
2011-08-08 18:06:07 ----D---- C:\Program Files (x86)\Realtek
2011-08-08 18:06:07 ----A---- C:\Windows\system32\DTSS2SpeakerDLL64.dll
2011-08-08 18:06:07 ----A---- C:\Windows\system32\DTSS2HeadphoneDLL64.dll
2011-08-08 18:06:07 ----A---- C:\Windows\system32\DTSNeoPCDLL64.dll
2011-08-08 18:06:07 ----A---- C:\Windows\system32\DTSLimiterDLL64.dll
2011-08-08 18:06:07 ----A---- C:\Windows\system32\DTSLFXAPO64.dll
2011-08-08 18:06:07 ----A---- C:\Windows\system32\DTSGFXAPONS64.dll
2011-08-08 18:06:07 ----A---- C:\Windows\system32\DTSGFXAPO64.dll
2011-08-08 18:06:07 ----A---- C:\Windows\system32\DTSGainCompensatorDLL64.dll
2011-08-08 18:06:07 ----A---- C:\Windows\system32\DTSBoostDLL64.dll
2011-08-08 18:06:07 ----A---- C:\Windows\system32\DTSBassEnhancementDLL64.dll
2011-08-08 18:06:07 ----A---- C:\Windows\system32\AERTAR64.dll
2011-08-08 18:06:07 ----A---- C:\Windows\system32\AERTAC64.dll
2011-08-08 18:06:03 ----HD---- C:\Program Files (x86)\Temp
2011-08-08 18:06:03 ----A---- C:\Windows\RtlExUpd.dll
2011-08-08 17:55:30 ----D---- C:\ProgramData\NVIDIA
2011-08-08 17:55:29 ----D---- C:\Program Files (x86)\NVIDIA Corporation
2011-08-08 17:54:46 ----A---- C:\Windows\system32\nvvsvc.exe
2011-08-08 17:54:46 ----A---- C:\Windows\system32\nvsvcr.dll
2011-08-08 17:54:46 ----A---- C:\Windows\system32\nvsvc64.dll
2011-08-08 17:54:46 ----A---- C:\Windows\system32\nvshext.dll
2011-08-08 17:54:46 ----A---- C:\Windows\system32\nvmctray.dll
2011-08-08 17:54:46 ----A---- C:\Windows\system32\nvcpl.dll
2011-08-08 17:54:46 ----A---- C:\Windows\system32\easyupdatusapiu64.dll
2011-08-08 17:54:40 ----D---- C:\ProgramData\NVIDIA Corporation
2011-08-08 17:54:12 ----A---- C:\Windows\system32\nvhdap64.dll
2011-08-08 17:54:12 ----A---- C:\Windows\system32\nvhdagenco642040.dll
2011-08-08 17:54:12 ----A---- C:\Windows\system32\drivers\nvhda64v.sys
2011-08-08 17:54:11 ----A---- C:\Windows\SYSWOW64\OpenCL.dll
2011-08-08 17:54:11 ----A---- C:\Windows\SYSWOW64\nvwgf2um.dll
2011-08-08 17:54:11 ----A---- C:\Windows\SYSWOW64\nvoglv32.dll
2011-08-08 17:54:11 ----A---- C:\Windows\SYSWOW64\nvd3dum.dll
2011-08-08 17:54:11 ----A---- C:\Windows\SYSWOW64\nvcuvid.dll
2011-08-08 17:54:11 ----A---- C:\Windows\SYSWOW64\nvcuvenc.dll
2011-08-08 17:54:11 ----A---- C:\Windows\SYSWOW64\nvcuda.dll
2011-08-08 17:54:11 ----A---- C:\Windows\SYSWOW64\nvcompiler.dll
2011-08-08 17:54:11 ----A---- C:\Windows\SYSWOW64\nvapi.dll
2011-08-08 17:54:11 ----A---- C:\Windows\system32\OpenCL.dll
2011-08-08 17:54:11 ----A---- C:\Windows\system32\nvwgf2umx.dll
2011-08-08 17:54:11 ----A---- C:\Windows\system32\nvoglv64.dll
2011-08-08 17:54:11 ----A---- C:\Windows\system32\nvgenco642090.dll
2011-08-08 17:54:11 ----A---- C:\Windows\system32\nvdispco6420150.dll
2011-08-08 17:54:11 ----A---- C:\Windows\system32\nvd3dumx.dll
2011-08-08 17:54:11 ----A---- C:\Windows\system32\nvcuvid.dll
2011-08-08 17:54:11 ----A---- C:\Windows\system32\nvcuvenc.dll
2011-08-08 17:54:11 ----A---- C:\Windows\system32\nvcuda.dll
2011-08-08 17:54:11 ----A---- C:\Windows\system32\nvcompiler.dll
2011-08-08 17:54:11 ----A---- C:\Windows\system32\nvapi64.dll
2011-08-08 17:54:11 ----A---- C:\Windows\system32\drivers\nvlddmkm.sys
2011-08-08 17:53:56 ----D---- C:\Program Files\NVIDIA Corporation
2011-08-08 17:53:34 ----D---- C:\NVIDIA
2011-08-08 17:52:28 ----D---- C:\Windows\Panther
2011-08-08 17:48:23 ----N---- C:\Windows\SYSWOW64\xRaidSetup.exe
2011-08-08 17:48:23 ----N---- C:\Windows\SYSWOW64\xRaidAPI.dll
2011-08-08 17:48:17 ----D---- C:\Windows\RaidTool
2011-08-08 17:47:25 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2011-08-08 17:47:16 ----D---- C:\Windows\system32\2C0A
2011-08-08 17:47:16 ----D---- C:\Windows\system32\0C0A
2011-08-08 17:47:16 ----D---- C:\Windows\system32\0C04
2011-08-08 17:47:16 ----D---- C:\Windows\system32\0816
2011-08-08 17:47:16 ----D---- C:\Windows\system32\0804
2011-08-08 17:47:16 ----D---- C:\Windows\system32\0424
2011-08-08 17:47:16 ----D---- C:\Windows\system32\041F
2011-08-08 17:47:16 ----D---- C:\Windows\system32\041E
2011-08-08 17:47:16 ----D---- C:\Windows\system32\041D
2011-08-08 17:47:16 ----D---- C:\Windows\system32\041B
2011-08-08 17:47:16 ----D---- C:\Windows\system32\0419
2011-08-08 17:47:16 ----D---- C:\Windows\system32\0416
2011-08-08 17:47:16 ----D---- C:\Windows\system32\0415
2011-08-08 17:47:16 ----D---- C:\Windows\system32\0414
2011-08-08 17:47:16 ----D---- C:\Windows\system32\0413
2011-08-08 17:47:16 ----D---- C:\Windows\system32\0412
2011-08-08 17:47:16 ----D---- C:\Windows\system32\0411
2011-08-08 17:47:16 ----D---- C:\Windows\system32\0410
2011-08-08 17:47:16 ----D---- C:\Windows\system32\040E
2011-08-08 17:47:16 ----D---- C:\Windows\system32\040D
2011-08-08 17:47:16 ----D---- C:\Windows\system32\040C
2011-08-08 17:47:16 ----D---- C:\Windows\system32\040B
2011-08-08 17:47:16 ----D---- C:\Windows\system32\040A
2011-08-08 17:47:16 ----D---- C:\Windows\system32\0408
2011-08-08 17:47:16 ----D---- C:\Windows\system32\0407
2011-08-08 17:47:16 ----D---- C:\Windows\system32\0406
2011-08-08 17:47:16 ----D---- C:\Windows\system32\0405
2011-08-08 17:47:16 ----D---- C:\Windows\system32\0404
2011-08-08 17:47:16 ----D---- C:\Windows\system32\0401
2011-08-08 17:47:13 ----D---- C:\Program Files (x86)\Renesas Electronics
2011-08-08 17:39:14 ----D---- C:\Program Files (x86)\AMD APP
2011-08-08 17:39:09 ----DC---- C:\Windows\system32\DRVSTORE
2011-08-08 17:39:09 ----A---- C:\Windows\system32\drivers\usbfilter.sys
2011-08-08 17:38:59 ----D---- C:\Program Files (x86)\ATI Technologies
2011-08-08 17:38:57 ----SHD---- C:\Windows\Installer
2011-08-08 17:38:57 ----D---- C:\Program Files\ATI
2011-08-08 17:33:23 ----D---- C:\Program Files\ATI Technologies
2011-08-08 17:31:22 ----A---- C:\Windows\system32\drivers\AtiPcie64.sys
2011-08-08 17:31:22 ----A---- C:\Windows\system32\drivers\amd_xata.sys
2011-08-08 17:31:22 ----A---- C:\Windows\system32\drivers\amd_sata.sys
2011-08-08 17:23:09 ----A---- C:\Windows\SYSWOW64\wextract.exe
2011-08-08 17:23:09 ----A---- C:\Windows\SYSWOW64\webcheck.dll
2011-08-08 17:23:09 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2011-08-08 17:23:09 ----A---- C:\Windows\SYSWOW64\SetIEInstalledDate.exe
2011-08-08 17:23:09 ----A---- C:\Windows\SYSWOW64\RegisterIEPKEYs.exe
2011-08-08 17:23:09 ----A---- C:\Windows\SYSWOW64\pngfilt.dll
2011-08-08 17:23:09 ----A---- C:\Windows\SYSWOW64\occache.dll
2011-08-08 17:23:09 ----A---- C:\Windows\SYSWOW64\msrating.dll
2011-08-08 17:23:09 ----A---- C:\Windows\SYSWOW64\msls31.dll
2011-08-08 17:23:09 ----A---- C:\Windows\SYSWOW64\mshtmler.dll
2011-08-08 17:23:09 ----A---- C:\Windows\SYSWOW64\mshta.exe
2011-08-08 17:23:09 ----A---- C:\Windows\SYSWOW64\msfeedssync.exe
2011-08-08 17:23:09 ----A---- C:\Windows\SYSWOW64\msfeedsbs.dll
2011-08-08 17:23:09 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2011-08-08 17:23:09 ----A---- C:\Windows\SYSWOW64\licmgr10.dll
2011-08-08 17:23:09 ----A---- C:\Windows\SYSWOW64\inseng.dll
2011-08-08 17:23:09 ----A---- C:\Windows\SYSWOW64\imgutil.dll
2011-08-08 17:23:09 ----A---- C:\Windows\SYSWOW64\iexpress.exe
2011-08-08 17:23:09 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2011-08-08 17:23:09 ----A---- C:\Windows\SYSWOW64\iesysprep.dll
2011-08-08 17:23:09 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2011-08-08 17:23:09 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2011-08-08 17:23:09 ----A---- C:\Windows\SYSWOW64\iepeers.dll
2011-08-08 17:23:09 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2011-08-08 17:23:09 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2011-08-08 17:23:09 ----A---- C:\Windows\SYSWOW64\ieapfltr.dat
2011-08-08 17:23:09 ----A---- C:\Windows\SYSWOW64\ieakui.dll
2011-08-08 17:23:09 ----A---- C:\Windows\SYSWOW64\ieaksie.dll
2011-08-08 17:23:09 ----A---- C:\Windows\SYSWOW64\ieakeng.dll
2011-08-08 17:23:09 ----A---- C:\Windows\SYSWOW64\IEAdvpack.dll
2011-08-08 17:23:09 ----A---- C:\Windows\SYSWOW64\ie4uinit.exe
2011-08-08 17:23:09 ----A---- C:\Windows\SYSWOW64\icardie.dll
2011-08-08 17:23:09 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2011-08-08 17:23:09 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2011-08-08 17:23:09 ----A---- C:\Windows\SYSWOW64\admparse.dll
2011-08-08 17:23:09 ----A---- C:\Windows\system32\wextract.exe
2011-08-08 17:23:09 ----A---- C:\Windows\system32\webcheck.dll
2011-08-08 17:23:09 ----A---- C:\Windows\system32\vbscript.dll
2011-08-08 17:23:09 ----A---- C:\Windows\system32\SetIEInstalledDate.exe
2011-08-08 17:23:09 ----A---- C:\Windows\system32\RegisterIEPKEYs.exe
2011-08-08 17:23:09 ----A---- C:\Windows\system32\pngfilt.dll
2011-08-08 17:23:09 ----A---- C:\Windows\system32\occache.dll
2011-08-08 17:23:09 ----A---- C:\Windows\system32\msrating.dll
2011-08-08 17:23:09 ----A---- C:\Windows\system32\msls31.dll
2011-08-08 17:23:09 ----A---- C:\Windows\system32\mshtmler.dll
2011-08-08 17:23:09 ----A---- C:\Windows\system32\mshta.exe
2011-08-08 17:23:09 ----A---- C:\Windows\system32\msfeedssync.exe
2011-08-08 17:23:09 ----A---- C:\Windows\system32\msfeedsbs.dll
2011-08-08 17:23:09 ----A---- C:\Windows\system32\msfeeds.dll
2011-08-08 17:23:09 ----A---- C:\Windows\system32\licmgr10.dll
2011-08-08 17:23:09 ----A---- C:\Windows\system32\inseng.dll
2011-08-08 17:23:09 ----A---- C:\Windows\system32\imgutil.dll
2011-08-08 17:23:09 ----A---- C:\Windows\system32\iexpress.exe
2011-08-08 17:23:09 ----A---- C:\Windows\system32\ieUnatt.exe
2011-08-08 17:23:09 ----A---- C:\Windows\system32\iesysprep.dll
2011-08-08 17:23:09 ----A---- C:\Windows\system32\iesetup.dll
2011-08-08 17:23:09 ----A---- C:\Windows\system32\iernonce.dll
2011-08-08 17:23:09 ----A---- C:\Windows\system32\iepeers.dll
2011-08-08 17:23:09 ----A---- C:\Windows\system32\iedkcs32.dll
2011-08-08 17:23:09 ----A---- C:\Windows\system32\ieapfltr.dll
2011-08-08 17:23:09 ----A---- C:\Windows\system32\ieapfltr.dat
2011-08-08 17:23:09 ----A---- C:\Windows\system32\ieakui.dll
2011-08-08 17:23:09 ----A---- C:\Windows\system32\ieaksie.dll
2011-08-08 17:23:09 ----A---- C:\Windows\system32\ieakeng.dll
2011-08-08 17:23:09 ----A---- C:\Windows\system32\IEAdvpack.dll
2011-08-08 17:23:09 ----A---- C:\Windows\system32\ie4uinit.exe
2011-08-08 17:23:09 ----A---- C:\Windows\system32\icardie.dll
2011-08-08 17:23:09 ----A---- C:\Windows\system32\dxtrans.dll
2011-08-08 17:23:09 ----A---- C:\Windows\system32\dxtmsft.dll
2011-08-08 17:23:09 ----A---- C:\Windows\system32\admparse.dll
2011-08-08 16:59:49 ----D---- C:\Users\Milan\AppData\Roaming\Identities
2011-08-08 16:59:23 ----SD---- C:\Users\Milan\AppData\Roaming\Microsoft
2011-08-08 16:59:23 ----D---- C:\Users\Milan\AppData\Roaming\Media Center Programs
2011-08-08 16:59:15 ----SHD---- C:\Recovery
2011-08-08 16:59:14 ----SHD---- C:\ProgramData\Šablony
2011-08-08 16:59:14 ----SHD---- C:\ProgramData\Plocha
2011-08-08 16:59:14 ----SHD---- C:\ProgramData\Oblíbené položky
2011-08-08 16:59:14 ----SHD---- C:\ProgramData\Nabídka Start
2011-08-08 16:59:14 ----SHD---- C:\ProgramData\Dokumenty
2011-08-08 16:59:14 ----SHD---- C:\ProgramData\Data aplikací
2011-08-08 16:56:07 ----D---- C:\Windows\SoftwareDistribution
2011-08-08 16:53:58 ----D---- C:\Windows\Prefetch
2011-08-08 16:53:13 ----ASH---- C:\pagefile.sys
2011-08-08 16:53:12 ----SHD---- C:\System Volume Information
2011-08-08 16:53:12 ----ASH---- C:\hiberfil.sys

======List of files/folders modified in the last 1 month======

2011-08-28 10:26:52 ----RD---- C:\Program Files
2011-08-28 09:47:58 ----D---- C:\Windows\Temp
2011-08-28 09:46:22 ----D---- C:\Windows\system32\config
2011-08-28 09:37:28 ----D---- C:\Windows\System32
2011-08-28 09:37:28 ----D---- C:\Windows\inf
2011-08-28 09:37:28 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-08-28 09:35:08 ----D---- C:\Windows\system32\inetsrv
2011-08-24 23:30:00 ----D---- C:\Windows\winsxs
2011-08-24 23:29:50 ----D---- C:\Windows\SYSWOW64\cs-CZ
2011-08-24 23:29:50 ----D---- C:\Windows\SysWOW64
2011-08-24 23:29:50 ----D---- C:\Windows\system32\cs-CZ
2011-08-24 23:28:39 ----D---- C:\Windows\system32\catroot
2011-08-24 23:28:38 ----D---- C:\Windows\system32\catroot2
2011-08-24 16:24:38 ----D---- C:\Windows
2011-08-24 16:14:52 ----D---- C:\Windows\system32\drivers
2011-08-24 16:14:50 ----D---- C:\Windows\system32\DriverStore
2011-08-23 23:56:41 ----D---- C:\Windows\rescache
2011-08-23 23:55:35 ----D---- C:\Windows\Logs
2011-08-23 23:05:45 ----RD---- C:\Program Files (x86)
2011-08-20 13:15:20 ----D---- C:\Windows\system32\LogFiles
2011-08-20 11:06:18 ----RSD---- C:\Windows\assembly
2011-08-20 11:06:17 ----D---- C:\Windows\SYSWOW64\inetsrv
2011-08-20 10:53:10 ----D---- C:\Windows\Downloaded Program Files
2011-08-20 10:07:46 ----SD---- C:\ProgramData\Microsoft
2011-08-20 10:01:56 ----D---- C:\Windows\Microsoft.NET
2011-08-20 09:42:54 ----RD---- C:\Users
2011-08-20 09:38:43 ----D---- C:\Windows\system32\wbem
2011-08-20 09:19:01 ----D---- C:\Windows\SYSWOW64\migration
2011-08-20 09:19:01 ----D---- C:\Windows\system32\migration
2011-08-19 11:02:14 ----D---- C:\Program Files\Common Files\Microsoft Shared
2011-08-16 21:51:41 ----HD---- C:\ProgramData
2011-08-16 21:51:41 ----D---- C:\Program Files (x86)\Common Files
2011-08-13 15:11:12 ----D---- C:\Windows\system32\drivers\etc
2011-08-10 16:10:15 ----D---- C:\Windows\AppPatch
2011-08-10 16:10:15 ----D---- C:\Program Files\Internet Explorer
2011-08-10 16:10:15 ----D---- C:\Program Files (x86)\Internet Explorer
2011-08-10 11:27:06 ----D---- C:\Windows\system32\wdi
2011-08-08 21:14:49 ----RSD---- C:\Windows\Fonts
2011-08-08 21:14:48 ----D---- C:\Windows\system32\Boot
2011-08-08 17:54:45 ----D---- C:\Windows\Help
2011-08-08 17:47:16 ----D---- C:\Windows\system32\0409
2011-08-08 17:24:33 ----D---- C:\Windows\servicing
2011-08-08 17:23:22 ----D---- C:\Windows\SYSWOW64\en-US
2011-08-08 17:23:21 ----D---- C:\Windows\system32\en-US
2011-08-08 17:23:21 ----D---- C:\Windows\PolicyDefinitions
2011-08-08 17:22:24 ----D---- C:\Windows\system32\restore
2011-08-08 17:14:48 ----D---- C:\Windows\system32\CodeIntegrity
2011-08-08 16:59:45 ----SHD---- C:\$Recycle.Bin
2011-08-08 16:59:14 ----D---- C:\Program Files\Windows NT
2011-08-08 16:59:13 ----D---- C:\Windows\debug
2011-08-08 16:56:50 ----D---- C:\Windows\system32\sysprep
2011-08-08 16:55:31 ----D---- C:\Windows\system32\drivers\UMDF
2011-08-08 16:53:53 ----D---- C:\Windows\CSC

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 amd_sata;amd_sata; C:\Windows\system32\DRIVERS\amd_sata.sys [2011-04-15 79488]
R0 amd_xata;amd_xata; C:\Windows\system32\DRIVERS\amd_xata.sys [2011-04-15 40064]
R0 AtiPcie;AMD PCI Express (3GIO) Filter; C:\Windows\system32\DRIVERS\AtiPcie64.sys [2010-06-17 16440]
R0 JRAID;JRAID; C:\Windows\system32\DRIVERS\jraid.sys [2011-05-19 120920]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2011-07-04 31064]
R1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2011-07-04 600920]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2011-07-04 288088]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2011-07-04 45400]
R1 cmdGuard;COMODO Internet Security Sandbox Driver; C:\Windows\System32\DRIVERS\cmdguard.sys [2011-06-30 252344]
R1 cmdHlp;COMODO Internet Security Helper Driver; C:\Windows\System32\DRIVERS\cmdhlp.sys [2011-06-30 41712]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-21 514560]
R1 inspect;COMODO Internet Security Firewall Driver; C:\Windows\system32\DRIVERS\inspect.sys [2011-06-30 92688]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2011-07-04 22360]
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2011-07-04 64856]
R2 NPF;NetGroup Packet Filter Driver; C:\Windows\system32\drivers\npf.sys [2010-06-25 35344]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2011-07-07 2914408]
R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver; C:\Windows\system32\DRIVERS\nusb3hub.sys [2011-06-10 91648]
R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver; C:\Windows\system32\DRIVERS\nusb3xhc.sys [2011-06-10 208896]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda64v.sys [2011-05-25 174184]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2011-03-21 452200]
R3 usbfilter;AMD USB Filter Driver; C:\Windows\system32\DRIVERS\usbfilter.sys [2010-11-29 44672]
S3 athur;Wireless Network Adapter Service; C:\Windows\system32\DRIVERS\athurx.sys [2010-01-05 1847296]
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-21 165888]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2010-11-21 20992]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-21 6656]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-21 34688]
S3 Synth3dVsc;Synth3dVsc; C:\Windows\System32\drivers\synth3dvsc.sys [2010-11-21 88960]
S3 terminpt;Microsoft Remote Desktop Input Driver; C:\Windows\system32\drivers\terminpt.sys [2010-11-21 34816]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 tsusbhub;@%SystemRoot%\system32\drivers\tsusbhub.sys,-1; C:\Windows\system32\drivers\tsusbhub.sys [2010-11-21 117248]
S3 VGPU;VGPU; C:\Windows\System32\drivers\rdvgkmd.sys []
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-21 199552]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-21 21760]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
R2 AppHostSvc;@%windir%\system32\inetsrv\iisres.dll,-30011; C:\Windows\system32\svchost.exe [2009-07-14 27136]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2011-07-04 42184]
R2 cmdAgent;COMODO Internet Security Helper Service; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [2011-06-30 2528096]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 IISADMIN;@%windir%\system32\inetsrv\iisres.dll,-30007; C:\Windows\system32\inetsrv\inetinfo.exe [2010-11-21 15872]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2011-05-25 1016936]
R2 nvUpdatusService;NVIDIA Update Service Daemon; C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-05-25 2214504]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-05-20 378472]
R2 TeamViewer6;TeamViewer 6; C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-08-17 2358656]
R2 W3SVC;@%windir%\system32\inetsrv\iisres.dll,-30003; C:\Windows\system32\svchost.exe [2009-07-14 27136]
R3 WAS;@%windir%\system32\inetsrv\iisres.dll,-30001; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); C:\Program Files (x86)\WinPcap\rpcapd.exe [2010-06-25 117264]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WMSVC;@%windir%\system32\inetsrv\iisres.dll,-20001; C:\Windows\system32\inetsrv\wmsvc.exe [2009-07-14 10752]

-----------------EOF-----------------

info.txt logfile of random's system information tool 1.09 2011-08-28 10:27:02

======Uninstall list======

-->MsiExec /X{B9DB4C76-01A4-46D5-8910-F7AA6376DBAF}
Adobe Flash Player 10 ActiveX-->C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10u_ActiveX.exe -maintain activex
Adobe Flash Player 10 Plugin-->C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10v_Plugin.exe -maintain plugin
Adobe Reader X (10.1.0) - Czech-->MsiExec.exe /I{AC76BA86-7AD7-1029-7B44-AA1000000001}
Aktualizace NVIDIA 1.3.5-->"C:\Windows\SysWOW64\RunDll32.EXE" "C:\Program Files\NVIDIA Corporation\Installer2\installer.0\NVI2.DLL",UninstallPackage Display.Update
AMD APP SDK Runtime-->MsiExec.exe /I{503F672D-6C84-448A-8F8F-4BC35AC83441}
ATI Catalyst Install Manager-->msiexec /q/x{55B18D14-06CF-3C24-4E72-F0765008C333} REBOOT=ReallySuppress
avast! Free Antivirus-->C:\Program Files\AVAST Software\Avast\aswRunDll.exe "C:\Program Files\AVAST Software\Avast\Setup\setiface.dll" RunSetup
CCleaner-->"C:\Program Files\CCleaner\uninst.exe"
COMODO Internet Security-->MsiExec.exe /I{FD8E178D-8B4E-42DA-B434-EFF270329B1C}
Defraggler-->"C:\Program Files\Defraggler\uninst.exe"
Google Earth-->MsiExec.exe /X{B3FED300-806C-11E0-A0D0-B8AC6F97B88E}
IIS URL Rewrite Module 2-->MsiExec.exe /X{EB675D0A-2C95-405B-BEE8-B42A65D23E11}
Java(TM) 6 Update 27 (64-bit)-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F86416027FF}
Java(TM) 6 Update 27-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216027FF}
Java(TM) SE Development Kit 6 Update 27 (64-bit)-->MsiExec.exe /I{64A3A4F4-B792-11D6-A78A-00B0D0160270}
JMicron JMB36X Driver-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}\setup.exe" -l0x9 -removeonly
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17-->MsiExec.exe /X{8220EEFE-38CD-377E-8595-13398D740ACE}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148-->MsiExec.exe /X{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}
Microsoft Web Platform Installer 3.0-->MsiExec.exe /X{CC4878C0-4A6A-49CD-AAA7-DD3FCB06CC84}
Mozilla Firefox 6.0 (x86 cs)-->C:\Program Files (x86)\Mozilla Firefox\uninstall\helper.exe
Mozilla Thunderbird (6.0)-->C:\Program Files (x86)\Mozilla Thunderbird\uninstall\helper.exe
NVIDIA 3D Vision Controller Driver-->"C:\Program Files (x86)\InstallShield Installation Information\{714B9C6C-70FC-4750-98E2-61520B906C45}\setup.exe" -runfromtemp -l0x0009 -removeonly
NVIDIA Ovladač 3D Vision 275.33-->"C:\Windows\SysWOW64\RunDll32.EXE" "C:\Program Files\NVIDIA Corporation\Installer2\installer.0\NVI2.DLL",UninstallPackage Display.3DVision
NVIDIA Ovladač HD audia 1.2.23.3-->"C:\Windows\SysWOW64\RunDll32.EXE" "C:\Program Files\NVIDIA Corporation\Installer2\installer.0\NVI2.DLL",UninstallPackage HDAudio.Driver
NVIDIA Ovladač řídící jednotky 3D Vision 275.33-->"C:\Windows\SysWOW64\RunDll32.EXE" "C:\Program Files\NVIDIA Corporation\Installer2\installer.0\NVI2.DLL",UninstallPackage Display.NVIRUSB
NVIDIA Ovladače grafiky 275.33-->"C:\Windows\SysWOW64\RunDll32.EXE" "C:\Program Files\NVIDIA Corporation\Installer2\installer.0\NVI2.DLL",UninstallPackage Display.Driver
NVIDIA PhysX-->MsiExec.exe /X{B9DB4C76-01A4-46D5-8910-F7AA6376DBAF}
NVIDIA Stereoscopic 3D Driver-->"C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvStInst.exe" /uninstall /ask
NVIDIA Systémový software PhysX 9.10.0514-->"C:\Windows\SysWOW64\RunDll32.EXE" "C:\Program Files\NVIDIA Corporation\Installer2\installer.0\NVI2.DLL",UninstallPackage Display.PhysX
PHP Manager 1.2 for IIS 7-->MsiExec.exe /I{E851486F-1FE2-44F0-85ED-F969088A68EE}
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -removeonly
Renesas Electronics USB 3.0 Host Controller Driver-->"C:\Program Files (x86)\InstallShield Installation Information\{5442DAB8-7177-49E1-8B22-09A049EA5996}\setup.exe" -runfromtemp -l0x0405 -removeonly
Renesas Electronics USB 3.0 Host Controller Driver-->MsiExec.exe /X{5442DAB8-7177-49E1-8B22-09A049EA5996}
SpeedConnect Connection Tester-->"C:\Program Files (x86)\CBS Software\SpeedConnect Connection Tester\unins000.exe"
TeamViewer 6-->C:\Program Files (x86)\TeamViewer\Version6\uninstall.exe
TP-LINK Wireless Client Utility-->"C:\Program Files (x86)\InstallShield Installation Information\{7A2A107B-9695-423F-9462-8F17C178BD35}\setup.exe" -runfromtemp -l0x0009 -removeonly
Trillian-->C:\Program Files (x86)\Trillian\Trillian.exe /uninstall
WinPcap 4.1.2-->C:\Program Files (x86)\WinPcap\uninstall.exe
WinRAR 4.01 (64-bit)-->C:\Program Files\WinRAR\uninstall.exe
Wireshark 1.6.1-->"C:\Program Files\Wireshark\uninstall.exe"

======System event log======

Computer Name: 37L4247F27-25
Event Code: 7036
Message: Stav služby Distributed Link Tracking Client byl změněn na: stopped
Record Number: 5
Source Name: Service Control Manager
Time Written: 20101121035831.108772-000
Event Type: Informace
User:

Computer Name: 37L4247F27-25
Event Code: 7036
Message: Stav služby Desktop Window Manager Session Manager byl změněn na: stopped
Record Number: 4
Source Name: Service Control Manager
Time Written: 20101121035831.108772-000
Event Type: Informace
User:

Computer Name: 37L4247F27-25
Event Code: 7036
Message: Stav služby Power byl změněn na: stopped
Record Number: 3
Source Name: Service Control Manager
Time Written: 20101121035831.108772-000
Event Type: Informace
User:

Computer Name: 37L4247F27-25
Event Code: 7036
Message: Stav služby Windows Event Log byl změněn na: stopped
Record Number: 2
Source Name: Service Control Manager
Time Written: 20101121035831.093172-000
Event Type: Informace
User:

Computer Name: 37L4247F27-25
Event Code: 7036
Message: Stav služby Diagnostic Policy Service byl změněn na: stopped
Record Number: 1
Source Name: Service Control Manager
Time Written: 20101121035831.093172-000
Event Type: Informace
User:

=====Application event log=====

Computer Name: 37L4247F27-25
Event Code: 5617
Message: Windows Management Instrumentation Service subsystems initialized successfully
Record Number: 5
Source Name: Microsoft-Windows-WMI
Time Written: 20110808145405.000000-000
Event Type: Informace
User:

Computer Name: 37L4247F27-25
Event Code: 5615
Message: Windows Management Instrumentation Service started sucessfully
Record Number: 4
Source Name: Microsoft-Windows-WMI
Time Written: 20110808145400.000000-000
Event Type: Informace
User:

Computer Name: 37L4247F27-25
Event Code: 1531
Message: Služba Profil uživatele byla úspěšně spuštěna.

Record Number: 3
Source Name: Microsoft-Windows-User Profiles Service
Time Written: 20110808145353.634908-000
Event Type: Informace
User: NT AUTHORITY\SYSTEM

Computer Name: 37L4247F27-25
Event Code: 4625
Message: Subsystém EventSystem zabraňuje vytváření duplicitních záznamů v protokolu událostí po dobu 86400 sekund. Tuto dobu lze změnit pomocí hodnoty REG_DWORD s názvem SuppressDuplicateDuration v následujícím klíči registru: HKLM\Software\Microsoft\EventSystem\EventLog.
Record Number: 2
Source Name: Microsoft-Windows-EventSystem
Time Written: 20110808145354.000000-000
Event Type: Informace
User:

Computer Name: 37L4247F27-25
Event Code: 1532
Message: Služba Profil uživatele byla zastavena.

Record Number: 1
Source Name: Microsoft-Windows-User Profiles Service
Time Written: 20101121035831.124372-000
Event Type: Informace
User: NT AUTHORITY\SYSTEM

=====Security event log=====

Computer Name: 37L4247F27-25
Event Code: 4735
Message: Byla změněna zabezpečená místní skupina.

Předmět:
ID zabezpečení: S-1-5-18
Název účtu: 37L4247F27-25$
Doména účtu: WORKGROUP
ID přihlášení: 0x3e7

Skupina:
ID zabezpečení: S-1-5-32-551
Název skupiny: Backup Operators
Doména skupiny: Builtin

Změněné atributy:
Název účtu SAM: -
Historie identifikátoru zabezpečení: -

Další informace:
Oprávnění: -
Record Number: 5
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20110808145332.699671-000
Event Type: Úspěšný audit
User:

Computer Name: 37L4247F27-25
Event Code: 4731
Message: Byla vytvořena zabezpečená místní skupina.

Předmět:
ID zabezpečení: S-1-5-18
Název účtu: 37L4247F27-25$
Doména účtu: WORKGROUP
ID přihlášení: 0x3e7

Nová skupina:
ID zabezpečení: S-1-5-32-551
Název skupiny: Backup Operators
Doména skupiny: Builtin

Atributy:
Název účtu SAM: Backup Operators
Historie identifikátoru zabezpečení: -

Další informace:
Oprávnění: -
Record Number: 4
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20110808145332.684071-000
Event Type: Úspěšný audit
User:

Computer Name: 37L4247F27-25
Event Code: 4902
Message: Tabulka zásad auditu pro jednotlivé uživatele byla vytvořena.

Počet prvků: 0
ID zásady: 0x33cc0
Record Number: 3
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20110808145332.247271-000
Event Type: Úspěšný audit
User:

Computer Name: 37L4247F27-25
Event Code: 4624
Message: Účet byl úspěšně přihlášen.

Předmět:
ID zabezpečení: S-1-0-0
Název účtu: -
Doména účtu: -
ID přihlášení: 0x0

Typ přihlášení: 0

Nové přihlášení:
ID zabezpečení: S-1-5-18
Název účtu: SYSTEM
Doména účtu: NT AUTHORITY
ID přihlášení: 0x3e7
GUID přihlášení: {00000000-0000-0000-0000-000000000000}

Informace o procesu:
ID procesu: 0x4
Název procesu:

Informace o síti:
Název pracovní stanice: -
Adresa zdrojové sítě -
Zdrojový port: -

Podrobné informace o ověření:
Proces přihlášení: -
Balíček ověření: -
Přenosové služby: -
Název balíčku (pouze NTLM): -
Délka klíče: 0

Tato událost je generována po vytvoření relace přihlášení. Je generována v počítači, ke kterému byl získán přístup.

Pole s předmětem označují účet v místním systému, který požadoval přihlášení. Jedná se nejčastěji o službu, například službu serveru nebo místní proces, například Winlogon.exe nebo Services.exe.

Pole Typ přihlášení označuje, k jakému typu přihlášení došlo. Nejběžnější typy jsou 2 (interaktivní) a 3 (síť).

Pole Nové přihlášení označují účet, pro který bylo nové přihlášení vytvořeno, tj. účet, který byl přihlášen.

Pole Síť označují původ požadavku na vzdálené přihlášení. Název pracovní stanice není vždy k dispozici a v některých případech může být toto pole prázdné.

Pole s informacemi o ověření poskytují podrobné informace o tomto konkrétním požadavku na přihlášení.
- GUID přihlášení je jednoznačný identifikátor, který je možné použít ke spojení této události s událostí KDC.
- Přenosové služby označují, které pomocné služby se podílely na tomto požadavku na přihlášení.
- Název balíčku označuje, který dílčí protokol z protokolů NTLM byl použit.
- Délka klíče označuje délku generovaného klíče relace. Tato hodnota bude 0, pokud nebyl požadován žádný klíč relace.
Record Number: 2
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20110808145328.971265-000
Event Type: Úspěšný audit
User:

Computer Name: 37L4247F27-25
Event Code: 4608
Message: Spouští se systém Windows.

Tato událost je zaznamenána při spuštění procesu LSASS.EXE a inicializaci kontrolního podsystému.
Record Number: 1
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20110808145328.784065-000
Event Type: Úspěšný audit
User:

======Environment variables======

"AMDAPPSDKROOT"=C:\Program Files (x86)\AMD APP\
"ComSpec"=%SystemRoot%\system32\cmd.exe
"devmgr_show_nonpresent_devices"=1
"FP_NO_HOST_CHECK"=NO
"NUMBER_OF_PROCESSORS"=2
"OS"=Windows_NT
"Path"=C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Program Files (x86)\AMD APP\bin\x86_64;C:\Program Files (x86)\AMD APP\bin\x86;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=AMD64
"PROCESSOR_IDENTIFIER"=AMD64 Family 16 Model 4 Stepping 3, AuthenticAMD
"PROCESSOR_LEVEL"=16
"PROCESSOR_REVISION"=0403
"PSModulePath"=%SystemRoot%\system32\WindowsPowerShell\v1.0\Modules\
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"windows_tracing_flags"=3
"windows_tracing_logfile"=C:\BVTBin\Tests\installpackage\csilogfile.log

-----------------EOF-----------------

#5 Příspěvek od **vyosek** » 28 srp 2011 16:52

Tady nic videt neni, tak mrknem dukladnejc...

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK

Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
Pokud mate Win XP spustte pod uctem Spravce\Administratora
Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

b_henry · #6 Příspěvek od **b_henry** » 28 srp 2011 18:37

Tak zde je ComboFix...

ComboFix 11-08-28.01 - Milan 28.08.2011 19:15:57.1.2 - x64
Microsoft Windows 7 Ultimate 6.1.7601.1.1250.420.1029.18.2045.1133 [GMT 2:00]
Spuštěný z: c:\users\Milan\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
FW: COMODO Firewall *Enabled* {4D6F75E0-14AF-2E9E-AACD-24CDCF08AA2A}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: COMODO Defense+ *Disabled/Updated* {CE351521-78FA-2048-BB22-B68A4A5CA7EC}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\security\Database\tmp.edb
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-07-28 do 2011-08-28 )))))))))))))))))))))))))))))))
.
.
2011-08-28 17:19 . 2011-08-28 17:19 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-08-28 08:26 . 2011-08-28 08:27 -------- d-----w- C:\rsit
2011-08-28 08:26 . 2011-08-28 08:27 -------- d-----w- c:\program files\trend micro
2011-08-24 21:29 . 2011-07-09 05:26 2048 ----a-w- c:\windows\system32\tzres.dll
2011-08-24 21:29 . 2011-07-09 04:29 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2011-08-24 14:07 . 2011-03-21 19:22 74272 ----a-w- c:\windows\system32\RtNicProp64.dll
2011-08-24 14:07 . 2011-03-21 19:22 452200 ----a-w- c:\windows\system32\drivers\Rt64win7.sys
2011-08-24 14:07 . 2011-03-21 19:22 107552 ----a-w- c:\windows\system32\RTNUninst64.dll
2011-08-23 21:05 . 2011-08-23 21:05 -------- d-----w- c:\program files (x86)\TeamViewer
2011-08-23 07:24 . 2011-08-23 07:24 -------- d-----w- c:\program files (x86)\Trillian
2011-08-21 09:47 . 2011-08-21 09:47 -------- d-----w- c:\program files (x86)\QIP Infium
2011-08-20 08:16 . 2011-08-20 08:16 -------- d-----w- c:\program files\PHP Manager 1.2 for IIS 7
2011-08-20 08:16 . 2011-08-20 08:16 -------- d-----w- c:\program files (x86)\PHP
2011-08-20 08:14 . 2011-08-20 08:14 -------- d-----w- c:\program files (x86)\Microsoft
2011-08-20 08:14 . 2011-08-20 08:14 -------- d-----w- c:\program files\Microsoft
2011-08-20 07:42 . 2011-08-20 07:42 -------- d-----w- c:\users\DefaultAppPool
2011-08-20 07:38 . 2011-08-20 07:38 -------- d-----w- c:\windows\SysWow64\BestPractices
2011-08-20 07:38 . 2011-08-20 07:38 -------- d-----w- c:\windows\system32\BestPractices
2011-08-20 07:19 . 2011-08-20 07:38 -------- d-----w- C:\inetpub
2011-08-19 09:03 . 2011-08-19 09:03 -------- d-----w- c:\program files (x86)\WinPcap
2011-08-19 09:01 . 2011-08-19 09:03 -------- d-----w- c:\program files\Wireshark
2011-08-19 06:28 . 2011-08-19 06:28 -------- d-----w- c:\program files (x86)\CBS Software
2011-08-18 10:43 . 2011-08-18 10:43 -------- d-----w- c:\windows\system32\appmgmt
2011-08-16 19:51 . 2011-08-16 19:51 -------- d-----w- c:\program files (x86)\Common Files\Java
2011-08-16 19:51 . 2011-08-16 19:51 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll
2011-08-16 19:51 . 2011-08-16 19:51 -------- d-----w- c:\program files (x86)\Java
2011-08-16 19:50 . 2011-08-16 19:49 525544 ----a-w- c:\windows\system32\deployJava1.dll
2011-08-16 19:48 . 2011-08-16 19:49 -------- d-----w- c:\program files\Java
2011-08-15 20:29 . 2011-08-15 20:29 -------- d-----w- c:\program files (x86)\Common Files\Adobe
2011-08-15 16:08 . 2011-08-15 16:08 -------- d-----w- c:\program files (x86)\Google
2011-08-13 15:50 . 2011-08-13 15:50 -------- d-----w- c:\windows\Options
2011-08-13 13:00 . 2010-01-05 17:23 1847296 ----a-w- c:\windows\system32\drivers\athurx.sys
2011-08-13 13:00 . 2010-01-05 17:23 1847296 ----a-r- c:\windows\system32\athurx.sys
2011-08-13 12:59 . 2011-08-13 13:07 -------- d-----w- c:\programdata\TP-LINK
2011-08-10 13:55 . 2011-07-09 02:46 288768 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-08-10 09:30 . 2011-08-10 09:30 -------- d-----w- c:\program files (x86)\YouTube Downloader
2011-08-08 21:02 . 2011-08-18 10:20 -------- d-----w- c:\program files (x86)\Mozilla Thunderbird
2011-08-08 19:30 . 2011-08-16 06:32 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-08-08 19:30 . 2011-08-08 19:30 -------- d-----w- c:\windows\SysWow64\Macromed
2011-08-08 19:26 . 2011-08-08 19:26 -------- d-----w- c:\program files\CCleaner
2011-08-08 19:25 . 2011-08-08 19:25 -------- d-----w- c:\program files\Defraggler
2011-08-08 19:09 . 2011-04-25 02:34 499200 ----a-w- c:\windows\system32\drivers\afd.sys
2011-08-08 19:08 . 2011-06-11 03:07 3137536 ----a-w- c:\windows\system32\win32k.sys
2011-08-08 19:08 . 2011-04-29 03:06 467456 ----a-w- c:\windows\system32\drivers\srv.sys
2011-08-08 19:08 . 2011-04-29 03:05 410112 ----a-w- c:\windows\system32\drivers\srv2.sys
2011-08-08 19:08 . 2011-04-29 03:05 168448 ----a-w- c:\windows\system32\drivers\srvnet.sys
2011-08-08 18:17 . 2011-08-08 18:17 -------- d-----w- c:\program files\COMODO
2011-08-08 18:16 . 2011-08-08 18:20 -------- d-----w- c:\programdata\Comodo
2011-08-08 18:16 . 2011-08-08 18:16 -------- d-----w- c:\programdata\Comodo Downloader
2011-08-08 18:08 . 2011-07-04 11:36 288088 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-08-08 18:08 . 2011-07-04 11:32 22360 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-08-08 18:08 . 2011-07-04 11:36 600920 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-08-08 18:08 . 2011-07-04 11:35 45400 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-08-08 18:08 . 2011-07-04 11:32 31064 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-08-08 18:08 . 2011-07-04 11:43 253888 ----a-w- c:\windows\system32\aswBoot.exe
2011-08-08 18:08 . 2011-07-04 11:32 64856 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-08-08 18:08 . 2011-07-04 11:43 40112 ----a-w- c:\windows\avastSS.scr
2011-08-08 18:08 . 2011-07-04 11:43 199304 ----a-w- c:\windows\SysWow64\aswBoot.exe
2011-08-08 18:08 . 2011-08-08 18:08 -------- d-----w- c:\programdata\AVAST Software
2011-08-08 18:08 . 2011-08-08 18:08 -------- d-----w- c:\program files\AVAST Software
2011-08-08 15:55 . 2011-08-28 17:20 -------- d-----w- c:\programdata\NVIDIA
2011-08-08 15:55 . 2011-08-28 10:54 -------- d-----w- c:\users\UpdatusUser
2011-08-08 15:55 . 2011-08-08 15:55 -------- d-----w- c:\program files (x86)\NVIDIA Corporation
2011-08-08 15:53 . 2011-08-28 10:50 -------- d-----w- c:\program files\NVIDIA Corporation
2011-08-08 15:53 . 2011-08-08 15:53 -------- d-----w- C:\NVIDIA
2011-08-08 15:52 . 2011-08-08 14:59 -------- d-----w- c:\windows\Panther
2011-08-08 15:48 . 2009-07-14 01:15 315904 ----a-w- c:\windows\SysWow64\Difx9655.rra
2011-08-08 15:48 . 2010-09-07 15:40 1976920 ------w- c:\windows\SysWow64\xRaidSetup.exe
2011-08-08 15:48 . 2010-09-07 15:40 162392 ------w- c:\windows\SysWow64\xRaidAPI.dll
2011-08-08 15:48 . 2011-08-08 15:48 -------- d-----w- c:\windows\RaidTool
2011-08-08 15:39 . 2011-08-08 15:39 -------- d-----w- c:\program files (x86)\AMD APP
2011-08-08 15:39 . 2011-08-08 15:39 -------- dc----w- c:\windows\system32\DRVSTORE
2011-08-08 15:39 . 2010-11-29 02:50 44672 ----a-w- c:\windows\system32\drivers\usbfilter.sys
2011-08-08 15:38 . 2011-08-08 15:38 -------- d-----w- c:\program files (x86)\ATI Technologies
2011-08-08 15:38 . 2011-08-20 09:06 -------- d-sh--w- c:\windows\Installer
2011-08-08 15:38 . 2011-08-08 15:38 -------- d-----w- c:\program files\ATI
2011-08-08 15:33 . 2011-08-08 15:33 -------- d-----w- c:\program files\ATI Technologies
2011-08-08 15:31 . 2011-04-15 12:37 79488 ----a-w- c:\windows\system32\drivers\amd_sata.sys
2011-08-08 15:31 . 2011-04-15 12:37 40064 ----a-w- c:\windows\system32\drivers\amd_xata.sys
2011-08-08 15:31 . 2010-06-17 03:15 16440 ----a-w- c:\windows\system32\drivers\AtiPcie64.sys
2011-08-08 14:59 . 2011-08-16 20:00 -------- d-----w- c:\users\Milan
2011-08-03 01:31 . 2011-08-03 01:31 311912 ----a-w- c:\windows\SysWow64\nvStreaming.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-16 04:26 . 2011-08-10 13:55 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2011-06-30 07:38 . 2011-06-30 07:38 92688 ----a-w- c:\windows\system32\drivers\inspect.sys
2011-06-30 07:38 . 2011-06-30 07:38 41712 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2011-06-30 07:38 . 2011-06-30 07:38 252344 ----a-w- c:\windows\system32\drivers\cmdGuard.sys
2011-06-30 07:38 . 2011-06-30 07:38 16016 ----a-w- c:\windows\system32\drivers\cmderd.sys
2011-06-30 07:37 . 2011-06-30 07:37 363560 ----a-w- c:\windows\system32\guard64.dll
2011-06-30 07:37 . 2011-06-30 07:37 285256 ----a-w- c:\windows\SysWow64\guard32.dll
2011-06-10 15:00 . 2011-06-10 15:00 208896 ----a-w- c:\windows\system32\drivers\nusb3xhc.sys
2011-06-10 15:00 . 2011-06-10 15:00 91648 ----a-w- c:\windows\system32\drivers\nusb3hub.sys
2011-06-03 09:52 . 2011-06-03 09:52 81920 ----a-w- c:\windows\system32\nusb3co2.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2011-04-14 113288]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2010-09-07 43608]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-07-04 3493720]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\SysWOW64\guard32.dll
.
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-08-03 2255464]
R3 athur;Wireless Network Adapter Service;c:\windows\system32\DRIVERS\athurx.sys [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
R3 WMSVC;Služba webové správy;c:\windows\system32\inetsrv\wmsvc.exe [x]
S0 amd_sata;amd_sata;c:\windows\system32\DRIVERS\amd_sata.sys [x]
S0 amd_xata;amd_xata;c:\windows\system32\DRIVERS\amd_xata.sys [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [x]
S1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [x]
S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-08-03 379496]
S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-08-17 2358656]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [x]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
iissvcs REG_MULTI_SZ w3svc was
apphost REG_MULTI_SZ apphostsvc
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-07-04 11:43 134384 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-07-07 12558440]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2011-06-30 9048392]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x1
"AppInit_DLLs"=c:\windows\System32\guard64.dll
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: Interfaces\{C0D6C327-4B13-4034-AEA5-84D53124B890}: NameServer = 77.48.254.254,77.48.100.254
DPF: {6BA530D8-94B2-49E0-AC55-70899582FE1F} - hxxp://sadek.jaronet.cz/AV718.cab
FF - ProfilePath - c:\users\Milan\AppData\Roaming\Mozilla\Firefox\Profiles\tgws3wuf.default\
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10u_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10u_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10u.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10u.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10u.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10u.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
.
**************************************************************************
.
Celkový čas: 2011-08-28 19:22:43 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-08-28 17:22
.
Před spuštěním: Volných bajtů: 130 766 774 272
Po spuštění: Volných bajtů: 130 352 517 120
.
- - End Of File - - 61D1A90726B43500B5ACFBDA6256C9F6

#7 Příspěvek od **vyosek** » 28 srp 2011 20:54

Stahnete OTM (viz muj podpis)

Pokud pouzivate Win Vista ci W7, kliknete na OTM pravym a dejte Run As Administrator ci Spustit jako spravce
Do leveho okna Paste Instructions for Items to be Moved (pod zlutou caru) vlozte obsah, ktery mate nize

Kód: Vybrat vše

:reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"="-
"SunJavaUpdateSched"=-

:files
ipconfig /flushdns /c
%windir%\system32\*.tmp.dll /s
%windir%\system32\SET*.tmp /s
%windir%\*.tmp

:commands
[RESETHOSTS]
[EMPTYTEMP]
[EMPTYFLASH]

Kliknete na cervene tlacitko MoveIt!
Budete vyzvani na restart, dejte Yes, log pote najdete C:\_OTM\MovedFiles, obsah sem vlozte

b_henry · #8 Příspěvek od **b_henry** » 28 srp 2011 21:24

Zde to je:

All processes killed
========== REGISTRY ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\\"Adobe ARM"|"- /E : value set successfully!
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched deleted successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Konfigurace protokolu IP syst‚mu Windows
MezipamŘś pýekl d nˇ DNS byla ŁspŘçnŘ vypr zdnŘna.
C:\Users\Milan\Desktop\cmd.bat deleted successfully.
C:\Users\Milan\Desktop\cmd.txt deleted successfully.
File/Folder C:\Windows\system32\*.tmp.dll not found.
File/Folder C:\Windows\system32\SET*.tmp not found.
File/Folder C:\Windows\*.tmp not found.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: DefaultAppPool
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Milan
->Temp folder emptied: 3090 bytes
->Temporary Internet Files folder emptied: 1695181 bytes
->Java cache emptied: 43389 bytes
->FireFox cache emptied: 46435067 bytes
->Flash cache emptied: 470 bytes

User: Public
->Temp folder emptied: 0 bytes

User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50574 bytes
RecycleBin emptied: 37425758 bytes

Total Files Cleaned = 82,00 mb

OTM by OldTimer - Version 3.1.18.0 log created on 08282011_221549

Files moved on Reboot...
C:\Users\Milan\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
File move failed. C:\Windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...

#9 Příspěvek od **vyosek** » 28 srp 2011 21:32

Odinstalujte Combofix

Prejmenujte ComboFix na Uninstall
Spustte jej
Tohle smaze Combofix a jeho slozky

T-Cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe

Stahnete a spustte
Pro potvrzeni volby mackejte A, Enter
Po pouziti utilitu smazte
Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

OTC http://oldtimer.geekstogo.com/OTC.exe

Stahnete a spustte
Kliknete na CleanUp a potvrdte YES
Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

Stahnete a spustte
Kliknete na Start a potvrdte OK
Program uklidi a restartuje pc
Po pouziti utilitu smazte

Stahnete Ccleaner (viz muj podpis)
Panel čistič

Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

dejte Hledej problémy
nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za tyden

Napiste co PC

b_henry · #10 Příspěvek od **b_henry** » 28 srp 2011 23:47

Tak provedeno (mimochodem CCleaner používám poctivě obden

) a stav je asi takový,že ty dvě adresy se zatím neobjevily (což bohužel nic neznamená - někdy byl klid i den a pak znovu 20x za sebou). No ukáže se, s veřejnou IP jsou podobné případy na denním pořádku a celkem normální (do jisté míry) a s kvalitním firewallem se snad není čeho bát. Každopádně díky za váš čas!

#11 Příspěvek od **vyosek** » 29 srp 2011 07:45

Neni zac, rado se stalo, kdyby byl problem, tak napiste

Tema presunuji do preventivek

b_henry · #12 Příspěvek od **b_henry** » 29 srp 2011 12:40

Takže záhada rozluštěna! Dělá to jeden web (plno bannerů,shoutboxů atd.) co mám uložen jako náhled ve Fast Dialu ve Firefoxu. Po otevření (i při refreshování FD) se připojuje na adresu 67.202.66.205:80, která vrací 403 Forbidden a následně se generuje to co se tu řešilo. Takže block pro 67.202.66.0-255 ven a hotovo...

#13 Příspěvek od **vyosek** » 29 srp 2011 17:29

Super, dekuji za informaci

VIRY.CZ

Podezřelé záznamy ve firewallu part II

Podezřelé záznamy ve firewallu part II

Re: Podezřelé záznamy ve firewallu part II

Re: Podezřelé záznamy ve firewallu part II

Re: Podezřelé záznamy ve firewallu part II

Re: Podezřelé záznamy ve firewallu part II

Re: Podezřelé záznamy ve firewallu part II

Re: Podezřelé záznamy ve firewallu part II

Re: Podezřelé záznamy ve firewallu part II

Re: Podezřelé záznamy ve firewallu part II

Re: Podezřelé záznamy ve firewallu part II

Re: Podezřelé záznamy ve firewallu part II

Re: Podezřelé záznamy ve firewallu part II

Re: Podezřelé záznamy ve firewallu part II