Po dlouhé době BSOD 0xF4 a zalogování ANONYMOUS USER

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz

Vážení uživaterlé!
Ve dnech 4. - 6-9.2026 budou někteříí naši členové na každoročním srazu fóra. Žádáme vás, abyste měli strpení, nemusí se na na řešení vašeho problému dostat hned. Děkujeme za pochopení.
Odpovědět
Zpráva
Autor
dog.big
Návštěvník
Návštěvník
Příspěvky: 23
Registrován: 25 Ún 2009 17:37

Po dlouhé době BSOD 0xF4 a zalogování ANONYMOUS USER

#1 Příspěvek od dog.big »

Zdravím,
po dlouhé době se navrátil neslavný červ způsobující BSOD 0xF4 (přisuzuji instalaci nějaké z aplikací). Již řešeno zde: http://www.viry.cz/forum/viewtopic.php? ... 29&start=0 počemž problém ustal. Nyní po x měsících je problém zpět opět se stejnými symptomy (odepnutí už. rozhraní, podivná činnost HDD, BSOD, reboot...). Prosím o pomoc s níže uvedenými logy o loginu opět anonymního usera (id 4624).



Anonymous login v logu zabezpečení
Účet byl úspěšně přihlášen.

Předmět:
ID zabezpečení: NULL SID
Název účtu: -
Doména účtu: -
ID přihlášení: 0x0

Typ přihlášení: 3

Nové přihlášení:
ID zabezpečení: ANONYMOUS LOGON
Název účtu: ANONYMOUS LOGON
Doména účtu: NT AUTHORITY
ID přihlášení: 0x345ec
GUID přihlášení: {00000000-0000-0000-0000-000000000000}

Informace o procesu:
ID procesu: 0x0
Název procesu: -

Informace o síti:
Název pracovní stanice:
Adresa zdrojové sítě -
Zdrojový port: -

Podrobné informace o ověření:
Proces přihlášení: NtLmSsp
Balíček ověření: NTLM
Přenosové služby: -
Název balíčku (pouze NTLM): NTLM V1
Délka klíče: 0

Tato událost je generována po vytvoření relace přihlášení. Je generována v počítači, ke kterému byl získán přístup.

Pole s předmětem označují účet v místním systému, který požadoval přihlášení. Jedná se nejčastěji o službu, například službu serveru nebo místní proces, například Winlogon.exe nebo Services.exe.

Pole Typ přihlášení označuje, k jakému typu přihlášení došlo. Nejběžnější typy jsou 2 (interaktivní) a 3 (síť).

Pole Nové přihlášení označují účet, pro který bylo nové přihlášení vytvořeno, tj. účet, který byl přihlášen.

Pole Síť označují původ požadavku na vzdálené přihlášení. Název pracovní stanice není vždy k dispozici a v některých případech může být toto pole prázdné.
.
RSIT


Logfile of random's system information tool 1.09 (written by random/random)
Run by Michal Charvát at 2011-09-05 09:55:03
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 412 GB (59%) free of 698 GB
Total RAM: 4031 MB (54% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:55:08, on 5.9.2011
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Windows Live\Mesh\WLSync.exe
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files (x86)\Windows Live\Mesh\MOE.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
C:\Program Files (x86)\TeamViewer\Version5\TeamViewer.exe
C:\Users\Michal Charvát\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Michal Charvát\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Michal Charvát\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Michal Charvát\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Michal Charvát\AppData\Local\Google\Chrome\Application\chrome.exe
C:\WINDOWS\SysWOW64\rundll32.exe
C:\Users\Michal Charvát\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\trend micro\Michal Charvát.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: LinkAirBrowserHelper HistoryTriggerBHO - {21A88CB9-84D2-4020-A2D1-B25A21034884} - C:\Program Files (x86)\LG Electronics\LG PC Suite IV\LinkAir\LinkAirBrowserHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
O2 - BHO: Speckie - {8CE7F568-67FA-4432-BA39-F5AFD68E7B8B} - C:\Users\Michal Charvát\AppData\Roaming\Speckie\bin32\Speckie32.dll
O2 - BHO: Pomocná služba pro přihlášení ke službě Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~3\Office14\URLREDIR.DLL
O2 - BHO: WOT Helper - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files (x86)\WOT\WOT.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Microsoft Web Test Recorder 10.0 Helper - {DDA57003-0068-4ed2-9D32-4D1EC707D94D} - C:\Program Files (x86)\Microsoft Visual Studio 10.0\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.QualityTools.RecorderBarBHO100.dll
O3 - Toolbar: WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files (x86)\WOT\WOT.dll
O4 - HKLM\..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
O4 - HKLM\..\Run: [KeePass 2 PreLoad] "C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe" --preload
O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKCU\..\Run: [TrayStatus] "C:\Program Files (x86)\TrayStatus\TrayStatus.exe"
O4 - HKCU\..\Run: [WLSync] "C:\Program Files (x86)\Windows Live\Mesh\WLSync.exe" /background
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files (x86)\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Odeslat do zařízení Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: Odeslat do zařízení &Bluetooth... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files (x86)\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files (x86)\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: (no name) - {E6846530-6088-4AA3-932F-C6245CE59A4C} - C:\Users\Michal Charvát\AppData\Roaming\Speckie\bin32\Speckie32.dll
O9 - Extra 'Tools' menuitem: Nastavení Speckie - {E6846530-6088-4AA3-932F-C6245CE59A4C} - C:\Users\Michal Charvát\AppData\Roaming\Speckie\bin32\Speckie32.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {C1F8FC10-E5DB-4112-9DBF-6C3FF728D4E3} (DellSystemLite.Scanner) - http://support.euro.dell.com/systemprof ... emLite.CAB
O16 - DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} (SysInfo Class) - http://content.systemrequirementslab.co ... 4.24.0.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/pub/s ... wflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Protocol: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files (x86)\WOT\WOT.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Program Files\IDT\WDM\AESTSr64.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\WINDOWS\system32\atiesrxx.exe (file missing)
O23 - Service: Avira AntiVir MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Avira AntiVir WebGuard (AntiVirWebService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\WINDOWS\system32\fxssvc.exe (file missing)
O23 - Service: Úložná technologie Intel(R) Rapid (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\WINDOWS\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: NitroPDFDriverCreatorReadSpool (NitroDriverReadSpool) - Nitro PDF Software - C:\Program Files\Common Files\Nitro PDF\Professional\6.0\NitroPDFDriverServicex64.exe
O23 - Service: NLS Service (nlsX86cc) - Nalpeiron Ltd. - C:\WINDOWS\SysWOW64\NLSSRV32.EXE
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\WINDOWS\System32\snmptrap.exe (file missing)
O23 - Service: Sony Ericsson PCCompanion - Avanquest Software - C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\WINDOWS\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\WINDOWS\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\stlang64.dll,-10122 (STacSV) - IDT, Inc. - C:\Program Files\IDT\WDM\STacSV64.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: TeamViewer 5 (TeamViewer5) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Service.exe
O23 - Service: TurboBoost - Intel(R) Corporation - C:\Program Files\Intel\TurboBoost\TurboBoost.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\WINDOWS\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\WINDOWS\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\WINDOWS\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\WINDOWS\system32\wbengine.exe (file missing)
O23 - Service: DW WLAN Tray Service (wltrysvc) - Dell Inc. - C:\Program Files\Dell\DW WLAN Card\WLTRYSVC.EXE
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 12756 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\lsm.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\svchost.exe -k RPCSS
winlogon.exe
C:\WINDOWS\system32\atiesrxx.exe
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\WINDOWS\system32\svchost.exe -k netsvcs
"C:\Program Files\IDT\WDM\STacSV64.exe"
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k NetworkService
atieclxx
"C:\Program Files\Dell\DW WLAN Card\WLTRYSVC.EXE" "C:\Program Files\Dell\DW WLAN Card\bcmwltry.exe"
C:\WINDOWS\system32\WLANExt.exe 23749088
\??\C:\WINDOWS\system32\conhost.exe "1757852385-1411794225942092661-1344631713193491077713449513161004196556-1896380443
C:\Program Files\Dell\DW WLAN Card\bcmwltry.exe
C:\WINDOWS\System32\spoolsv.exe
"C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe"
C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files\IDT\WDM\AESTSr64.exe"
"C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe"
"C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe"
"C:\Program Files (x86)\Microsoft SQL Server\MSSQL$PCNETSERVICE\Binn\sqlservr.exe" -sPCNETSERVICE
"C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe" avshadowcontrol0_00000798
\??\C:\WINDOWS\system32\conhost.exe "-21273004461939286920-19259706531302169471-1626184822751439801870261245-631725232
"C:\Program Files\Common Files\Nitro PDF\Professional\6.0\NitroPDFDriverServicex64.exe"
C:\WINDOWS\SysWOW64\NLSSRV32.EXE
taskeng.exe {D1FDC22F-9039-4702-86A6-74F0CC1E3C56}
"C:\WINDOWS\system32\Dwm.exe"
"taskhost.exe"
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /c
"C:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Service.exe"
"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"
"C:\Program Files (x86)\Microsoft SQL Server\MSSQL$PCNETSERVICE\Binn\sqlagent.EXE" -i PCNETSERVICE
\??\C:\WINDOWS\system32\conhost.exe "1872426299-176724220139711622410144618591595825870-1963474368545698708-1081707211
WLIDSvcM.exe 2648
"C:\Program Files\IDT\WDM\sttray64.exe"
"C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
"C:\Program Files\Dell\DW WLAN Card\WLTRAY.EXE"
"C:\Program Files\Dell\QuickSet\quickset.exe"
"C:\Program Files (x86)\TrayStatus\TrayStatus.exe"
C:\WINDOWS\system32\wbem\wmiprvse.exe
"C:\Program Files (x86)\Windows Live\Mesh\WLSync.exe" /background
"C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe"
"C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe"
"C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM"
"C:\Program Files (x86)\Windows Live\Mesh\MOE.exe" "Global\MOE_STARTUP_COMPLETE_146d973f-e241-434d-93ae-2bf832cd1640_Michal Charvát" "Global\MOE_SHUTDOWN_146d973f-e241-434d-93ae-2bf832cd1640_Michal Charvát"
"C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe"
"C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE"
C:\WINDOWS\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\WINDOWS\system32\svchost.exe -k bthsvcs
C:\WINDOWS\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\WINDOWS\system32\SearchIndexer.exe /Embedding
"C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe" -Embedding
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
"C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe"
"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe" 0
"C:\Program Files\Synaptics\SynTP\SynTPHelper.exe"
"C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe" -Embedding
"C:\WINDOWS\system32\cmd.exe"
\??\C:\WINDOWS\system32\conhost.exe "-2136071314-686830756-9140137661172287174-4434716137570406971207384956223483695
sfc /scannow
C:\WINDOWS\servicing\TrustedInstaller.exe
"C:\Program Files (x86)\TeamViewer\Version5\TeamViewer.exe"
C:\WINDOWS\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
"C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe"
C:\WINDOWS\system32\sppsvc.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
"C:\Users\Michal Charvát\AppData\Local\Google\Chrome\Application\chrome.exe"
"C:\Users\Michal Charvát\AppData\Local\Google\Chrome\Application\chrome.exe" --type=extension --lang=cs --force-fieldtest=ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/DnsParallelism/parallel_default/GlobalSdch/global_enable_sdch/IdleSktToImpact/idle_timeout_10/Prefetch/ContentPrefetchPrerender2/ProxyConnectionImpact/proxy_connections_32/SSLFalseStart/FalseStart_enabled/SpdyImpact/npn_with_spdy/ --disable-client-side-phishing-detection --channel=2076.009582C0.1938147965 --ignored=" --type=renderer " /prefetch:3
"C:\Users\Michal Charvát\AppData\Local\Google\Chrome\Application\chrome.exe" --type=extension --lang=cs --force-fieldtest=ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/DnsParallelism/parallel_default/GlobalSdch/global_enable_sdch/IdleSktToImpact/idle_timeout_10/Prefetch/ContentPrefetchPrerender2/ProxyConnectionImpact/proxy_connections_32/SSLFalseStart/FalseStart_enabled/SpdyImpact/npn_with_spdy/ --disable-client-side-phishing-detection --channel=2076.00958160.1745732042 --ignored=" --type=renderer " /prefetch:3
"C:\Users\Michal Charvát\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtest=ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/DnsParallelism/parallel_default/GlobalSdch/global_enable_sdch/IdleSktToImpact/idle_timeout_10/Prefetch/ContentPrefetchPrerender2/ProxyConnectionImpact/proxy_connections_32/SSLFalseStart/FalseStart_enabled/SpdyImpact/npn_with_spdy/ --disable-client-side-phishing-detection --channel=2076.07DCE160.833331336 /prefetch:3
"C:\Users\Michal Charvát\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtest=ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/DnsParallelism/parallel_default/GlobalSdch/global_enable_sdch/IdleSktToImpact/idle_timeout_10/Prefetch/ContentPrefetchPrerender2/ProxyConnectionImpact/proxy_connections_32/SSLFalseStart/FalseStart_enabled/SpdyImpact/npn_with_spdy/ --disable-client-side-phishing-detection --channel=2076.059CD000.321113149 /prefetch:3
C:\WINDOWS\system32\rundll32.exe "C:\Users\MICHAL~1\AppData\Local\Google\Chrome\APPLIC~1\130782~1.215\gcswf32.dll",BrokerMain browser=chrome
"C:\Users\Michal Charvát\AppData\Local\Google\Chrome\Application\chrome.exe" --type=plugin --plugin-path="C:\Users\Michal Charvát\AppData\Local\Google\Chrome\Application\13.0.782.215\gcswf32.dll" --lang=cs --channel=2076.0757CC40.1304678822 --flash-broker=1216 /prefetch:4
"C:\WINDOWS\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\WINDOWS\system32\SearchFilterHost.exe" 0 532 536 544 65536 540
"C:\WINDOWS\system32\mmc.exe" "C:\WINDOWS\system32\compmgmt.msc" /s
"C:\Users\Michal Charvát\Stažené soubory\RSITx64 (2).exe"

======Scheduled tasks folder======

C:\WINDOWS\tasks\PCDoctorBackgroundMonitorTask.job
C:\WINDOWS\tasks\SystemToolsDailyTest.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8CE7F568-67FA-4432-BA39-F5AFD68E7B8B}]
Speckie - C:\Users\Michal Charvát\AppData\Roaming\Speckie\bin64\Speckie64.dll [2011-05-24 532224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28 529280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL [2010-12-21 689040]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-06-11 49440]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-06-06 63912]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{21A88CB9-84D2-4020-A2D1-B25A21034884}]
HistoryTriggerBHO Class - C:\Program Files (x86)\LG Electronics\LG PC Suite IV\LinkAir\LinkAirBrowserHelper.dll [2011-08-12 35688]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL [2011-02-12 4220304]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files (x86)\Java\jre6\bin\ssv.dll [2011-06-11 325408]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8CE7F568-67FA-4432-BA39-F5AFD68E7B8B}]
Speckie - C:\Users\Michal Charvát\AppData\Roaming\Speckie\bin32\Speckie32.dll [2011-05-24 470784]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocná služba pro přihlášení ke službě Windows Live ID - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28 441216]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype add-on for Internet Explorer - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-02-08 804136]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~3\Office14\URLREDIR.DLL [2010-12-21 561552]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C920E44A-7F78-4E64-BDD7-A57026E7FEB7}]
WOT Helper - C:\Program Files (x86)\WOT\WOT.dll [2010-12-20 1671840]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2011-06-11 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DDA57003-0068-4ed2-9D32-4D1EC707D94D}]
Microsoft Web Test Recorder 10.0 Helper - C:\Program Files (x86)\Microsoft Visual Studio 10.0\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.QualityTools.RecorderBarBHO100.dll [2010-03-19 61360]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{71576546-354D-41c9-AAE8-31F2EC22BF0D} - WOT - C:\Program Files (x86)\WOT\WOT.dll [2010-12-20 1671840]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SysTrayApp"=C:\Program Files\IDT\WDM\sttray64.exe [2010-06-18 487424]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2010-03-17 1890088]
"Broadcom Wireless Manager UI"=C:\Program Files\Dell\DW WLAN Card\WLTRAY.exe [2010-02-03 5712896]
"QuickSet"=C:\Program Files\Dell\QuickSet\QuickSet.exe [2010-01-06 3179288]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"TrayStatus"=C:\Program Files (x86)\TrayStatus\TrayStatus.exe [2011-05-18 283032]
"WLSync"=C:\Program Files (x86)\Windows Live\Mesh\WLSync.exe [2011-05-13 1449312]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\B2C_AGENT]
C:\ProgramData\LGMOBILEAX\B2C_Client\B2CNotiAgent.exe [2011-06-15 404568]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCSSync]
C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [2010-03-13 91520]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell Webcam Central]
C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe [2009-06-24 409744]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"=C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [2010-11-05 283160]
"KeePass 2 PreLoad"=C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [2011-04-10 1733120]
"avgnt"=C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [2011-03-04 281768]
"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2011-05-24 336384]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll [2011-06-03 249344]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL [2011-02-12 4220304]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableLockWorkstation"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"MSVideo8"=VfWWDM32.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"VIDC.FPS1"=frapsv64.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux"=wdmaud.drv
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"wave5"=wdmaud.drv
"midi5"=wdmaud.drv
"mixer5"=wdmaud.drv
"wave6"=wdmaud.drv
"midi6"=wdmaud.drv
"mixer6"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.txt - open - C:\WINDOWS\NOTEPAD.EXE %1

======List of files/folders created in the last 1 month======

2011-09-05 09:55:03 ----D---- C:\rsit
2011-09-05 09:33:37 ----D---- C:\hotfix
2011-09-03 22:26:18 ----D---- C:\Program Files\apache-maven-3.0.3
2011-09-02 14:02:21 ----D---- C:\Users\Michal Charvát\AppData\Roaming\syntevo
2011-09-02 14:00:00 ----D---- C:\Program Files (x86)\SmartGit 2
2011-09-02 13:38:12 ----D---- C:\Git
2011-09-02 13:14:28 ----D---- C:\Program Files (x86)\Git
2011-09-02 12:18:02 ----D---- C:\WINDOWS\SYSWOW64\.ssh
2011-08-26 12:54:33 ----D---- C:\ProgramData\Creative
2011-08-26 12:54:32 ----D---- C:\Users\Michal Charvát\AppData\Roaming\Creative
2011-08-25 18:31:42 ----D---- C:\Program Files (x86)\Lightworks
2011-08-25 18:21:15 ----D---- C:\Users\Michal Charvát\AppData\Roaming\dvdcss
2011-08-25 18:19:41 ----D---- C:\Program Files (x86)\VLMC
2011-08-25 13:46:40 ----D---- C:\Users\Michal Charvát\AppData\Roaming\Malwarebytes
2011-08-25 13:46:21 ----A---- C:\WINDOWS\SYSWOW64\drivers\mbamswissarmy.sys
2011-08-25 13:46:20 ----D---- C:\ProgramData\Malwarebytes
2011-08-25 13:46:17 ----D---- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2011-08-25 13:46:17 ----A---- C:\WINDOWS\system32\drivers\mbam.sys
2011-08-25 13:31:58 ----D---- C:\WINDOWS\temp
2011-08-25 13:27:06 ----SHD---- C:\$RECYCLE.BIN
2011-08-25 13:14:12 ----A---- C:\WINDOWS\ntbtlog.txt
2011-08-25 11:38:11 ----A---- C:\WINDOWS\system32\Partizan.exe
2011-08-25 11:37:52 ----RASHOT---- C:\WINDOWS\winstart.bat
2011-08-25 11:37:47 ----D---- C:\Program Files (x86)\UnHackMe
2011-08-25 11:26:12 ----D---- C:\Program Files\trend micro
2011-08-25 11:21:28 ----D---- C:\Program Files (x86)\Trend Micro
2011-08-24 22:21:05 ----D---- C:\Program Files (x86)\Google
2011-08-24 11:29:59 ----D---- C:\Users\Michal Charvát\AppData\Roaming\Blender Foundation
2011-08-24 11:26:51 ----A---- C:\WINDOWS\SYSWOW64\tzres.dll
2011-08-24 11:26:51 ----A---- C:\WINDOWS\system32\tzres.dll
2011-08-24 11:26:41 ----D---- C:\Program Files\Blender Foundation
2011-08-23 19:35:05 ----D---- C:\ProgramData\Pinnacle VideoSpin
2011-08-23 19:35:05 ----D---- C:\Program Files (x86)\Pinnacle
2011-08-23 19:33:59 ----D---- C:\ProgramData\Pinnacle
2011-08-23 19:22:16 ----D---- C:\Program Files (x86)\Pure Motion
2011-08-23 19:22:15 ----D---- C:\Program Files (x86)\Sonic Foundry
2011-08-23 19:22:12 ----D---- C:\Program Files (x86)\DebugMode
2011-08-23 19:06:27 ----D---- C:\Users\Michal Charvát\AppData\Roaming\avidemux
2011-08-23 19:05:57 ----D---- C:\Program Files (x86)\Avidemux 2.5
2011-08-23 17:20:38 ----D---- C:\Tmp
2011-08-23 17:19:33 ----D---- C:\ProgramData\WeGame
2011-08-23 17:18:39 ----A---- C:\WINDOWS\SYSWOW64\Ltkrn15u.dll
2011-08-23 17:18:39 ----A---- C:\WINDOWS\SYSWOW64\Ltfil15u.dll
2011-08-23 16:50:05 ----D---- C:\Program Files (x86)\CamStudio 2.6b
2011-08-23 16:50:05 ----A---- C:\WINDOWS\system32\CamCodec.dll
2011-08-22 10:43:32 ----A---- C:\WINDOWS\SYSWOW64\dbmsqlgc.dll
2011-08-22 10:43:32 ----A---- C:\WINDOWS\SYSWOW64\dbmsgnet.dll
2011-08-22 10:43:26 ----A---- C:\WINDOWS\IsUninst.exe
2011-08-22 10:42:13 ----A---- C:\WINDOWS\SYSWOW64\drivers\port_nt.sys
2011-08-22 10:39:16 ----D---- C:\Program Files (x86)\PC NET SERVICE
2011-08-22 10:39:16 ----D---- C:\Program Files (x86)\Business Objects
2011-08-15 11:25:30 ----A---- C:\bugreport.txt
2011-08-12 15:57:41 ----D---- C:\LGP350
2011-08-11 11:38:39 ----D---- C:\Users\Michal Charvát\AppData\Roaming\Mozilla
2011-08-11 09:20:33 ----A---- C:\WINDOWS\SYSWOW64\mshtmled.dll
2011-08-11 09:20:33 ----A---- C:\WINDOWS\system32\mshtmled.dll
2011-08-11 09:20:32 ----A---- C:\WINDOWS\SYSWOW64\ieui.dll
2011-08-11 09:20:32 ----A---- C:\WINDOWS\SYSWOW64\iertutil.dll
2011-08-11 09:20:32 ----A---- C:\WINDOWS\system32\ieui.dll
2011-08-11 09:20:32 ----A---- C:\WINDOWS\system32\iertutil.dll
2011-08-11 09:20:31 ----A---- C:\WINDOWS\SYSWOW64\urlmon.dll
2011-08-11 09:20:31 ----A---- C:\WINDOWS\SYSWOW64\url.dll
2011-08-11 09:20:31 ----A---- C:\WINDOWS\SYSWOW64\jscript9.dll
2011-08-11 09:20:31 ----A---- C:\WINDOWS\SYSWOW64\jscript.dll
2011-08-11 09:20:31 ----A---- C:\WINDOWS\system32\url.dll
2011-08-11 09:20:31 ----A---- C:\WINDOWS\system32\jscript9.dll
2011-08-11 09:20:31 ----A---- C:\WINDOWS\system32\jscript.dll
2011-08-11 09:20:30 ----A---- C:\WINDOWS\SYSWOW64\wininet.dll
2011-08-11 09:20:30 ----A---- C:\WINDOWS\system32\urlmon.dll
2011-08-11 09:20:30 ----A---- C:\WINDOWS\system32\jsproxy.dll
2011-08-11 09:20:29 ----A---- C:\WINDOWS\SYSWOW64\mshtml.dll
2011-08-11 09:20:29 ----A---- C:\WINDOWS\SYSWOW64\jsproxy.dll
2011-08-11 09:20:29 ----A---- C:\WINDOWS\system32\wininet.dll
2011-08-11 09:20:27 ----A---- C:\WINDOWS\system32\mshtml.dll
2011-08-11 09:20:26 ----A---- C:\WINDOWS\SYSWOW64\ieframe.dll
2011-08-11 09:20:25 ----A---- C:\WINDOWS\system32\ieframe.dll
2011-08-10 21:46:10 ----A---- C:\WINDOWS\SYSWOW64\mfc71u.dll
2011-08-10 21:46:09 ----D---- C:\Program Files (x86)\WinMerge
2011-08-10 21:45:39 ----A---- C:\WINDOWS\SYSWOW64\xmllite.dll
2011-08-10 21:45:39 ----A---- C:\WINDOWS\system32\xmllite.dll
2011-08-10 21:45:38 ----A---- C:\WINDOWS\SYSWOW64\odbctrac.dll
2011-08-10 21:45:38 ----A---- C:\WINDOWS\SYSWOW64\odbcjt32.dll
2011-08-10 21:45:38 ----A---- C:\WINDOWS\SYSWOW64\odbccu32.dll
2011-08-10 21:45:38 ----A---- C:\WINDOWS\SYSWOW64\odbccr32.dll
2011-08-10 21:45:38 ----A---- C:\WINDOWS\SYSWOW64\odbccp32.dll
2011-08-10 21:45:38 ----A---- C:\WINDOWS\system32\odbctrac.dll
2011-08-10 21:45:38 ----A---- C:\WINDOWS\system32\odbccu32.dll
2011-08-10 21:45:38 ----A---- C:\WINDOWS\system32\odbccr32.dll
2011-08-10 21:45:38 ----A---- C:\WINDOWS\system32\odbccp32.dll
2011-08-10 21:45:37 ----A---- C:\WINDOWS\system32\drivers\mrxsmb10.sys
2011-08-10 21:45:34 ----A---- C:\WINDOWS\system32\winsrv.dll
2011-08-10 21:45:34 ----A---- C:\WINDOWS\system32\kernel32.dll
2011-08-10 21:45:34 ----A---- C:\WINDOWS\system32\conhost.exe
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\system32\api-ms-win-security-base-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\system32\api-ms-win-core-xstate-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\system32\api-ms-win-core-util-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\system32\api-ms-win-core-threadpool-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\system32\api-ms-win-core-synch-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\system32\api-ms-win-core-string-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\system32\api-ms-win-core-profile-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\system32\api-ms-win-core-processthreads-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\system32\api-ms-win-core-misc-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\system32\api-ms-win-core-memory-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\system32\api-ms-win-core-localregistry-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\system32\api-ms-win-core-io-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\system32\api-ms-win-core-interlocked-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\system32\api-ms-win-core-heap-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\system32\api-ms-win-core-handle-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\system32\api-ms-win-core-file-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\system32\api-ms-win-core-fibers-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\system32\api-ms-win-core-delayload-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\system32\api-ms-win-core-debug-l1-1-0.dll
2011-08-10 21:45:33 ----AH---- C:\WINDOWS\system32\api-ms-win-core-datetime-l1-1-0.dll
2011-08-10 21:45:33 ----A---- C:\WINDOWS\SYSWOW64\wow32.dll
2011-08-10 21:45:33 ----A---- C:\WINDOWS\SYSWOW64\setup16.exe
2011-08-10 21:45:33 ----A---- C:\WINDOWS\SYSWOW64\ntvdm64.dll
2011-08-10 21:45:33 ----A---- C:\WINDOWS\SYSWOW64\KernelBase.dll
2011-08-10 21:45:33 ----A---- C:\WINDOWS\SYSWOW64\kernel32.dll
2011-08-10 21:45:33 ----A---- C:\WINDOWS\system32\wow64win.dll
2011-08-10 21:45:33 ----A---- C:\WINDOWS\system32\wow64cpu.dll
2011-08-10 21:45:33 ----A---- C:\WINDOWS\system32\wow64.dll
2011-08-10 21:45:33 ----A---- C:\WINDOWS\system32\ntvdm64.dll
2011-08-10 21:45:33 ----A---- C:\WINDOWS\system32\KernelBase.dll
2011-08-10 21:45:32 ----AH---- C:\WINDOWS\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2011-08-10 21:45:32 ----AH---- C:\WINDOWS\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2011-08-10 21:45:32 ----AH---- C:\WINDOWS\system32\api-ms-win-core-localization-l1-1-0.dll
2011-08-10 21:45:32 ----AH---- C:\WINDOWS\system32\api-ms-win-core-console-l1-1-0.dll
2011-08-10 21:45:32 ----A---- C:\WINDOWS\SYSWOW64\user.exe
2011-08-10 21:45:32 ----A---- C:\WINDOWS\SYSWOW64\instnm.exe
2011-08-10 21:45:31 ----A---- C:\WINDOWS\system32\drivers\tcpip.sys
2011-08-10 21:45:29 ----A---- C:\WINDOWS\SYSWOW64\ntoskrnl.exe
2011-08-10 21:45:29 ----A---- C:\WINDOWS\SYSWOW64\ntkrnlpa.exe
2011-08-10 21:45:29 ----A---- C:\WINDOWS\system32\ntoskrnl.exe
2011-08-09 11:37:04 ----D---- C:\WINDOWS\cs
2011-08-09 11:34:47 ----D---- C:\Program Files\Windows Live
2011-08-07 12:31:19 ----D---- C:\Users\Michal Charvát\AppData\Roaming\ts3overlay
2011-08-07 12:30:48 ----D---- C:\Users\Michal Charvát\AppData\Roaming\TS3Client
2011-08-06 16:37:47 ----D---- C:\Users\Michal Charvát\AppData\Roaming\Spadille

======List of files/folders modified in the last 1 month======

2011-09-05 09:51:40 ----D---- C:\WINDOWS\system32\config
2011-09-05 09:33:55 ----AD---- C:\WINDOWS
2011-09-05 09:30:27 ----D---- C:\WINDOWS\Prefetch
2011-09-05 09:28:47 ----D---- C:\Users\Michal Charvát\AppData\Roaming\KeePass
2011-09-05 09:28:47 ----D---- C:\Users\Michal Charvát\AppData\Roaming\FileZilla
2011-09-05 08:57:32 ----SD---- C:\Users\Michal Charvát\AppData\Roaming\Microsoft
2011-09-04 21:26:31 ----D---- C:\Users\Michal Charvát\AppData\Roaming\.minecraft
2011-09-04 16:26:51 ----D---- C:\Users\Michal Charvát\AppData\Roaming\Mumble
2011-09-03 22:26:54 ----RD---- C:\Program Files (x86)
2011-09-03 22:26:54 ----RD---- C:\Program Files
2011-09-02 18:05:34 ----SHD---- C:\WINDOWS\Installer
2011-09-02 15:15:40 ----D---- C:\Users\Michal Charvát\AppData\Roaming\False
2011-09-02 15:15:27 ----D---- C:\Program Files (x86)\Tachograf snadno a jednoduše
2011-09-02 12:18:02 ----D---- C:\WINDOWS\SysWOW64
2011-09-02 09:43:04 ----D---- C:\Users\Michal Charvát\AppData\Roaming\gtk-2.0
2011-09-01 20:00:58 ----D---- C:\WINDOWS\system32\wdi
2011-08-31 12:12:26 ----D---- C:\WINDOWS\inf
2011-08-31 12:12:26 ----AD---- C:\WINDOWS\System32
2011-08-31 12:12:26 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2011-08-30 15:25:16 ----D---- C:\Users\Michal Charvát\AppData\Roaming\Skype
2011-08-29 18:21:04 ----D---- C:\WINDOWS\rescache
2011-08-27 20:22:32 ----D---- C:\WINDOWS\system32\NDF
2011-08-27 14:03:11 ----D---- C:\WINDOWS\Tasks
2011-08-27 14:03:09 ----D---- C:\Program Files\Dell Support Center
2011-08-26 15:55:49 ----D---- C:\ProgramData
2011-08-25 18:31:58 ----D---- C:\WINDOWS\winsxs
2011-08-25 14:59:46 ----D---- C:\WINDOWS\ModemLogs
2011-08-25 14:58:52 ----D---- C:\WINDOWS\system32\catroot
2011-08-25 14:58:51 ----D---- C:\WINDOWS\system32\DriverStore
2011-08-25 14:58:47 ----D---- C:\WINDOWS\system32\drivers
2011-08-25 13:55:52 ----SHD---- C:\System Volume Information
2011-08-25 13:46:21 ----D---- C:\WINDOWS\SYSWOW64\drivers
2011-08-25 13:42:21 ----D---- C:\Games
2011-08-25 13:27:06 ----A---- C:\WINDOWS\system.ini
2011-08-25 13:26:56 ----D---- C:\WINDOWS\system32\drivers\etc
2011-08-25 13:22:02 ----D---- C:\WINDOWS\AppPatch
2011-08-25 13:22:01 ----D---- C:\Program Files\Common Files
2011-08-25 13:22:01 ----D---- C:\Program Files (x86)\Common Files
2011-08-25 13:15:59 ----D---- C:\WINDOWS\system32\catroot2
2011-08-25 12:32:36 ----D---- C:\WINDOWS\system32\Tasks
2011-08-24 22:29:41 ----D---- C:\WINDOWS\SYSWOW64\cs-CZ
2011-08-24 22:29:41 ----D---- C:\WINDOWS\system32\cs-CZ
2011-08-24 21:38:09 ----D---- C:\ProgramData\LGMOBILEAX
2011-08-24 21:38:08 ----A---- C:\WINDOWS\SYSWOW64\lgAxconfig.ini
2011-08-23 19:35:39 ----RSD---- C:\WINDOWS\Fonts
2011-08-23 19:22:16 ----D---- C:\Program Files (x86)\Adobe
2011-08-23 10:46:34 ----D---- C:\ProgramData\PCDr
2011-08-22 10:43:50 ----A---- C:\WINDOWS\SYSWOW64\PerfStringBackup.INI
2011-08-22 10:43:30 ----HD---- C:\Program Files (x86)\Uninstall Information
2011-08-22 10:43:16 ----D---- C:\Program Files (x86)\Microsoft SQL Server
2011-08-21 22:52:59 ----D---- C:\Program Files (x86)\ICQ7.5
2011-08-21 22:52:57 ----D---- C:\Users\Michal Charvát\AppData\Roaming\ICQ
2011-08-19 13:55:28 ----D---- C:\WINDOWS\system32\FxsTmp
2011-08-19 13:55:26 ----D---- C:\Users\Michal Charvát\AppData\Roaming\Nitro PDF
2011-08-19 13:18:58 ----D---- C:\Users\Michal Charvát\AppData\Roaming\PrimoPDF
2011-08-17 18:56:56 ----D---- C:\Users\Michal Charvát\AppData\Roaming\TeamViewer
2011-08-17 15:34:14 ----D---- C:\Users\Michal Charvát\AppData\Roaming\HLSW
2011-08-14 18:33:37 ----RSD---- C:\WINDOWS\assembly
2011-08-14 18:33:37 ----D---- C:\WINDOWS\Microsoft.NET
2011-08-13 15:02:41 ----D---- C:\WINDOWS\SYSWOW64\directx
2011-08-12 16:02:50 ----D---- C:\Program Files (x86)\LG Electronics
2011-08-12 15:26:19 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2011-08-11 14:50:31 ----D---- C:\WINDOWS\SYSWOW64\migration
2011-08-11 14:50:31 ----D---- C:\WINDOWS\system32\migration
2011-08-11 14:50:31 ----D---- C:\Program Files (x86)\Internet Explorer
2011-08-11 14:50:30 ----D---- C:\Program Files\Internet Explorer
2011-08-11 09:28:40 ----A---- C:\WINDOWS\system32\MRT.exe
2011-08-11 09:28:16 ----D---- C:\ProgramData\Microsoft Help
2011-08-09 11:37:07 ----D---- C:\Program Files (x86)\Windows Live
2011-08-09 11:34:38 ----D---- C:\Program Files\Common Files\Microsoft Shared
2011-08-09 09:58:42 ----D---- C:\Program Files (x86)\KeePass Password Safe 2

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iaStor;Intel AHCI Controller; C:\WINDOWS\system32\DRIVERS\iaStor.sys [2010-11-05 438808]
R0 rdyboost;ReadyBoost; C:\WINDOWS\System32\drivers\rdyboost.sys [2010-11-20 213888]
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2011-06-30 123784]
R1 HWiNFO32;HWiNFO32/64 Kernel Driver; \??\C:\Program Files\HWiNFO64\HWiNFO64A.SYS [2011-05-22 28032]
R1 vpcnfltr;Virtual PC Network Filter Driver; C:\WINDOWS\system32\DRIVERS\vpcnfltr.sys [2010-11-20 59392]
R1 vpcvmm;@%SystemRoot%\system32\drivers\vpcvmm.sys,-100; C:\WINDOWS\system32\drivers\vpcvmm.sys [2010-11-20 360832]
R1 vwififlt;Virtual WiFi Filter Driver; C:\WINDOWS\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2011-06-30 88288]
R2 TurboB;Turbo Boost UI Monitor driver; C:\WINDOWS\system32\DRIVERS\TurboB.sys [2009-11-02 13784]
R3 amdkmdag;amdkmdag; C:\WINDOWS\system32\DRIVERS\atikmdag.sys [2011-05-25 9359872]
R3 amdkmdap;amdkmdap; C:\WINDOWS\system32\DRIVERS\atikmpag.sys [2011-05-25 309760]
R3 BCM42RLY;BCM42RLY; C:\WINDOWS\system32\drivers\BCM42RLY.sys [2010-02-03 22520]
R3 BCM43XX;Ovladač pro bezdrátovou síťovou kartu DW WLAN; C:\WINDOWS\system32\DRIVERS\bcmwl664.sys [2010-02-03 3058168]
R3 BcmVWL;Broadcom Virtual Wireless; C:\WINDOWS\system32\DRIVERS\bcmvwl64.sys [2010-02-03 20984]
R3 BthEnum;Ovladač pro Bluetooth Request Block; C:\WINDOWS\system32\drivers\BthEnum.sys [2009-07-14 41984]
R3 BthPan;Zařízení Bluetooth (síť PAN); C:\WINDOWS\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
R3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\WINDOWS\System32\Drivers\BTHUSB.sys [2011-04-28 80384]
R3 btwaudio;Bluetooth Audio Device Service; C:\WINDOWS\system32\drivers\btwaudio.sys [2009-07-02 98344]
R3 btwavdt;Bluetooth AVDT Service; C:\WINDOWS\system32\DRIVERS\btwavdt.sys [2010-03-30 132648]
R3 btwl2cap;Bluetooth L2CAP Service; C:\WINDOWS\system32\DRIVERS\btwl2cap.sys [2010-03-30 35104]
R3 btwrchid;btwrchid; C:\WINDOWS\system32\DRIVERS\btwrchid.sys [2009-07-02 21160]
R3 CtClsFlt;Creative Camera Class Upper Filter Driver; C:\WINDOWS\system32\DRIVERS\CtClsFlt.sys [2009-06-15 172704]
R3 LgBttPort;LGE Bluetooth TransPort; C:\WINDOWS\system32\DRIVERS\lgbtpt64.sys [2009-09-29 16384]
R3 lgbusenum;LG Bluetooth Bus Enumerator; C:\WINDOWS\system32\DRIVERS\lgbtbs64.sys [2009-09-29 14848]
R3 LGVMODEM;LGE Virtual Modem; C:\WINDOWS\system32\DRIVERS\lgvmdm64.sys [2009-09-29 17408]
R3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\WINDOWS\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
R3 STHDA;@%SystemRoot%\system32\stlang64.dll,-10322; C:\WINDOWS\system32\DRIVERS\stwrt64.sys [2010-06-18 515584]
R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2010-03-17 301104]
R3 vpcbus;Služba hostitelské sběrnice programu Virtual PC; C:\WINDOWS\system32\DRIVERS\vpchbus.sys [2010-11-20 194944]
R3 vpcusb;Služba konektoru virtualizace rozhraní USB; C:\WINDOWS\system32\DRIVERS\vpcusb.sys [2010-11-20 95232]
S1 StarOpen;StarOpen; C:\WINDOWS\system32\drivers\StarOpen.sys []
S2 port_nt;port_nt; \??\c:\windows\system32\drivers\port_nt.sys []
S3 Andbus;LGE Android Platform Composite USB Device; C:\WINDOWS\system32\DRIVERS\lgandbus64.sys [2010-12-07 19456]
S3 AndDiag;LGE Android Platform USB Serial Port; C:\WINDOWS\system32\DRIVERS\lganddiag64.sys [2010-12-07 27648]
S3 AndGps;LGE Android Platform USB GPS NMEA Port; C:\WINDOWS\system32\DRIVERS\lgandgps64.sys [2010-12-07 27136]
S3 ANDModem;LGE Android Platform USB Modem; C:\WINDOWS\system32\DRIVERS\lgandmodem64.sys [2010-12-07 34304]
S3 androidusb;ADB Interface Driver; C:\WINDOWS\System32\Drivers\lgandadb.sys [2010-08-02 31744]
S3 BTHPORT;Ovladač portu Bluetooth; C:\WINDOWS\System32\Drivers\BTHport.sys [2011-04-28 552960]
S3 btusbflt;Bluetooth USB Filter; C:\WINDOWS\system32\drivers\btusbflt.sys [2010-03-30 53800]
S3 cpudrv64;cpudrv64; \??\C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys [2009-12-18 17864]
S3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2009-03-18 33856]
S3 HECIx64;Intel(R) Management Engine Interface; C:\WINDOWS\system32\DRIVERS\HECIx64.sys [2010-03-17 56344]
S3 igfx;igfx; C:\WINDOWS\system32\DRIVERS\igdkmd64.sys [2009-06-10 6108416]
S3 PCDSRVC{1E208CE0-FB7451FF-06020101}_0;PCDSRVC{1E208CE0-FB7451FF-06020101}_0 - PCDR Kernel Mode Service Helper Driver; \??\c:\program files\dell support center\pcdsrvc_x64.pkms [2011-05-12 25072]
S3 pciide;pciide; C:\WINDOWS\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader; C:\WINDOWS\System32\Drivers\RtsUStor.sys [2010-12-01 250984]
S3 RTL8167;Realtek 8167 NT Driver; C:\WINDOWS\system32\DRIVERS\Rt64win7.sys [2010-03-17 325152]
S3 s1018bus;Sony Ericsson Device 1018 driver (WDM); C:\WINDOWS\system32\DRIVERS\s1018bus.sys [2009-03-25 113704]
S3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\s1018mdfl.sys [2009-03-25 19496]
S3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\s1018mdm.sys [2009-03-25 153128]
S3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\s1018mgmt.sys [2009-03-25 133160]
S3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS); C:\WINDOWS\system32\DRIVERS\s1018nd5.sys [2009-03-25 34856]
S3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\s1018obex.sys [2009-03-25 128552]
S3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM); C:\WINDOWS\system32\DRIVERS\s1018unic.sys [2009-03-25 146472]
S3 TsUsbFlt;TsUsbFlt; C:\WINDOWS\system32\drivers\tsusbflt.sys [2010-11-20 59392]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2009-07-14 41984]
S3 VSPerfDrv100;Performance Tools Driver 10.0; \??\C:\Program Files (x86)\Microsoft Visual Studio 10.0\Team Tools\Performance Tools\x64\VSPerfDrv100.sys [2010-03-17 68440]
S3 WimFltr;WimFltr; C:\WINDOWS\system32\DRIVERS\wimfltr.sys [2006-11-01 151656]
S3 WinUsb;WinUsb; C:\WINDOWS\system32\DRIVERS\WinUsb.sys [2010-11-20 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
R2 AESTFilters;Andrea ST Filters Service; C:\Program Files\IDT\WDM\AESTSr64.exe [2009-03-03 89600]
R2 AMD External Events Utility;AMD External Events Utility; C:\WINDOWS\system32\atiesrxx.exe [2011-05-25 204288]
R2 AntiVirMailService;Avira AntiVir MailGuard; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [2011-06-30 340136]
R2 AntiVirService;Avira AntiVir Guard; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [2011-06-30 269480]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [2011-06-05 136360]
R2 AntiVirWebService;Avira AntiVir WebGuard; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [2011-06-30 428200]
R2 btwdins;Bluetooth Service; C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe [2009-12-29 873248]
R2 IAStorDataMgrSvc;Úložná technologie Intel(R) Rapid; C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-11-05 13336]
R2 MSSQL$PCNETSERVICE;MSSQL$PCNETSERVICE; C:\Program Files (x86)\Microsoft SQL Server\MSSQL$PCNETSERVICE\Binn\sqlservr.exe [2002-12-17 7520337]
R2 NitroDriverReadSpool;NitroPDFDriverCreatorReadSpool; C:\Program Files\Common Files\Nitro PDF\Professional\6.0\NitroPDFDriverServicex64.exe [2011-03-21 341312]
R2 nlsX86cc;NLS Service; C:\WINDOWS\SysWOW64\NLSSRV32.EXE [2011-03-21 68928]
R2 SQLAgent$PCNETSERVICE;SQLAgent$PCNETSERVICE; C:\Program Files (x86)\Microsoft SQL Server\MSSQL$PCNETSERVICE\Binn\sqlagent.EXE [2002-12-17 311872]
R2 STacSV;@%SystemRoot%\system32\stlang64.dll,-10122; C:\Program Files\IDT\WDM\STacSV64.exe [2010-06-18 258048]
R2 TeamViewer5;TeamViewer 5; C:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Service.exe [2011-03-17 2025336]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2011-03-28 2292096]
R2 wltrysvc;DW WLAN Tray Service; C:\Program Files\Dell\DW WLAN Card\WLTRYSVC.EXE [2010-02-03 48128]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2010-03-18 44376]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service; C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE [2010-12-27 31124344]
S3 MSSQLServerADHelper;MSSQLServerADHelper; C:\Program Files (x86)\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe [2002-12-17 66112]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S3 Sony Ericsson PCCompanion;Sony Ericsson PCCompanion; C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [2011-06-29 155344]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2011-08-02 411432]
S3 TurboBoost;TurboBoost; C:\Program Files\Intel\TurboBoost\TurboBoost.exe [2009-11-02 126352]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\WINDOWS\system32\Wat\WatAdminSvc.exe [2011-06-03 1255736]
S4 NetMsmqActivator;@C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 wlcrasvc;Windows Live Mesh remote connections service; C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]

-----------------EOF-----------------
Nahoru
dog.big
Návštěvník
Návštěvník
Příspěvky: 23
Registrován: 25 Ún 2009 17:37

Re: Po dlouhé době BSOD 0xF4 a zalogování ANONYMOUS USER

#2 Příspěvek od dog.big »

Bump.

Nalezl jsem podezřelé klíče (pomohl mi MWAV s nálezem)


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf]
@="@SYS:Software\\Swearware\\dump"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Swearware]
"ComboFix_wow"="11-08-24.06"
"LastDir"="C:\\Uninstall"
"Runs"="3"
"limitblankpassworduse"="1"
"CacheSum"="26B0B4D88741ACA4CE4AA8D49361E570"
"SnapShot"="C:\\qoobox\\SnapShot@2011-08-25_10.29.06"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Swearware]
"ComboFix_wow"="11-08-24.06"
"LastDir"="C:\\Uninstall"
"Runs"="3"
"limitblankpassworduse"="1"
"CacheSum"="26B0B4D88741ACA4CE4AA8D49361E570"
"SnapShot"="C:\\qoobox\\SnapShot@2011-08-25_10.29.06"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\SeCEdit\Reg Values\MACHINE/System/CurrentControlSet/Control/Lsa/LimitBlankPasswordUse]
"ValueType"=dword:00000004
"DisplayType"=dword:00000000
"DisplayName"="@wsecedit.dll,-59001"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SeCEdit\Reg Values\MACHINE/System/CurrentControlSet/Control/Lsa/LimitBlankPasswordUse]
"ValueType"=dword:00000004
"DisplayType"=dword:00000000
"DisplayName"="@wsecedit.dll,-59001"
Nahoru
Avatar uživatele
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 Říj 2008 08:02

Re: Po dlouhé době BSOD 0xF4 a zalogování ANONYMOUS USER

#3 Příspěvek od motji »

Hezký podvečer :)

:arrow: Spusťte combofix podle tohoto návodu
http://www.bleepingcomputer.com/combofi ... t-combofix
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
dog.big
Návštěvník
Návštěvník
Příspěvky: 23
Registrován: 25 Ún 2009 17:37

Re: Po dlouhé době BSOD 0xF4 a zalogování ANONYMOUS USER

#4 Příspěvek od dog.big »

Combofix spuštěn, níže je log.


ComboFix 11-09-06.01 - Michal Charvát 06.09.2011 11:49:36.4.8 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.4031.2571 [GMT 2:00]
Spuštěný z: F:\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\PCDr\5830\Downloads\07439fd5-7039-4014-b635-5bf088a1465b.dll
c:\programdata\PCDr\5830\Downloads\0d85b53c-d766-4bf0-8940-17b534910268.dll
c:\programdata\PCDr\5830\Downloads\5dc4b59a-1f5d-427b-9110-b820c717226b.dll
c:\programdata\PCDr\5830\Downloads\8a6735b1-c078-4648-9416-b6bb29ec3dc1.dll
c:\programdata\PCDr\5830\Downloads\a30a02da-a4ca-4f1c-af5c-d8dd738b134a.dll
c:\windows\dasetup.log
c:\windows\SysWow64\mfc100deu.dll
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-08-06 do 2011-09-06 )))))))))))))))))))))))))))))))
.
.
2011-09-06 09:56 . 2011-09-06 09:56 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-09-06 09:24 . 2011-09-06 09:24 -------- d-----w- c:\users\Michal Charvát\AppData\Roaming\Reallusion
2011-09-06 08:11 . 2011-09-06 08:12 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{FCC1708F-075D-4B29-BE96-8352E9F0AC0A}
2011-09-06 08:11 . 2011-09-06 08:11 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{C0528927-7787-4840-8CC8-63759A23E7EA}
2011-09-05 19:05 . 2011-09-05 19:05 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{AB78BB34-AA31-4B7B-B1D9-AB39FC603EC2}
2011-09-05 19:05 . 2011-09-05 19:05 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{D8B32F17-1CFB-4D4C-9535-1AB3E64C5EE5}
2011-09-05 12:18 . 2011-09-05 12:18 -------- d-----w- c:\program files (x86)\ESET
2011-09-05 10:54 . 2011-09-05 10:54 -------- d-----w- c:\program files (x86)\Common Files\Intel Corporation
2011-09-05 10:48 . 2011-05-20 07:53 557848 ----a-w- c:\windows\system32\drivers\iaStor.sys
2011-09-05 09:10 . 2011-09-05 09:10 -------- d---a-w- c:\windows\VDLL.DLL
2011-09-05 09:10 . 2011-09-05 09:10 -------- d---a-w- c:\windows\SysWow64\runouce.exe
2011-09-05 09:10 . 2011-09-05 09:10 -------- d---a-w- c:\windows\rundll16.exe
2011-09-05 09:10 . 2011-09-05 09:10 -------- d---a-w- c:\windows\RUNDL132.EXE
2011-09-05 09:10 . 2011-09-05 09:10 -------- d---a-w- c:\windows\logo1_.exe
2011-09-05 09:10 . 2011-09-05 09:10 -------- d---a-w- c:\windows\logo_1.exe
2011-09-05 09:05 . 2011-09-05 09:05 632064 ----a-w- c:\windows\SysWow64\msvcr80.dll
2011-09-05 09:05 . 2011-09-05 09:05 554240 ----a-w- c:\windows\SysWow64\msvcp80.dll
2011-09-05 09:05 . 2011-09-05 09:05 34048 ----a-w- c:\windows\SysWow64\eEmpty.exe
2011-09-05 09:05 . 2011-09-05 09:05 -------- d-----w- c:\program files (x86)\Common Files\MicroWorld
2011-09-05 09:04 . 2011-09-05 09:05 -------- d-----w- c:\programdata\MicroWorld
2011-09-05 07:55 . 2011-09-05 07:55 -------- d-----w- C:\rsit
2011-09-05 07:33 . 2011-09-05 07:33 -------- d-----w- C:\hotfix
2011-09-05 07:04 . 2011-09-05 07:04 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{BC68A4FF-3D57-4682-91E8-FC5560C11D64}
2011-09-05 07:04 . 2011-09-05 07:04 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{DC1E0919-DF16-442B-8C96-46326D1174EC}
2011-09-05 06:53 . 2011-09-05 06:54 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{FBB6EC81-F6AF-4693-8F88-C02DCEF1AE29}
2011-09-05 06:53 . 2011-09-05 06:53 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{30DBD712-F3C5-4489-86C6-2EBDE3843ED1}
2011-09-04 09:45 . 2011-09-04 09:46 -------- d--h--w- c:\users\Michal Charvát\.m2
2011-09-04 09:32 . 2011-09-04 09:32 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{B1803922-AF05-4CC6-8C6C-AE5157732A3C}
2011-09-04 09:31 . 2011-09-04 09:32 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{49744B4C-23FC-48DD-A1D6-147468FDCD76}
2011-09-03 20:26 . 2011-09-03 20:26 -------- d-----w- c:\program files\apache-maven-3.0.3
2011-09-03 09:36 . 2011-09-03 09:36 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{3A7F8953-2561-4B16-AB56-C353D2C25BE7}
2011-09-03 09:36 . 2011-09-03 09:36 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{55292712-3B87-485B-9FF6-131D5ABD5410}
2011-09-02 18:53 . 2011-09-02 18:54 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{4E023BD7-06EE-4A7C-B66B-7EEFB3E2BCF2}
2011-09-02 12:08 . 2011-09-02 12:11 -------- d--h--w- c:\users\Michal Charvát\.ssh
2011-09-02 12:02 . 2011-09-02 12:02 -------- d-----w- c:\users\Michal Charvát\AppData\Roaming\syntevo
2011-09-02 12:00 . 2011-09-02 12:00 -------- d-----w- c:\program files (x86)\SmartGit 2
2011-09-02 11:38 . 2011-09-02 11:59 -------- d-----w- C:\Git
2011-09-02 11:14 . 2011-09-02 12:03 -------- d-----w- c:\program files (x86)\Git
2011-09-02 10:18 . 2011-09-02 10:18 -------- d-----w- c:\windows\SysWow64\.ssh
2011-09-02 10:10 . 2011-09-02 10:10 -------- d-----w- c:\users\Michal Charvát\Nová složka
2011-09-02 06:53 . 2011-09-02 06:53 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{15933624-5BE0-42E3-BF79-F73024B172D9}
2011-09-02 06:53 . 2011-09-02 18:53 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{FD0D14C9-E984-4E7C-AE3F-46DC544E2735}
2011-09-01 09:24 . 2011-09-01 09:25 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{0ED2C64E-92F1-48AE-9FB0-A6A6319AACE6}
2011-09-01 09:24 . 2011-09-01 09:24 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{61E65C5E-9868-43D0-A073-9449D1E7377B}
2011-08-31 20:02 . 2011-08-31 20:02 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{261513E6-9D86-49D6-85E2-5ADECEA9D99D}
2011-08-31 08:01 . 2011-08-31 08:01 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{3D056DAC-B498-4C2F-B74C-8BE910FB0C9D}
2011-08-30 18:53 . 2011-08-30 18:53 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{A0C077CD-6124-4541-9AB9-1530D44215B3}
2011-08-30 18:52 . 2011-08-31 20:02 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{2E40B1AF-84C6-44BB-8372-9B49385CB2DE}
2011-08-30 06:52 . 2011-08-30 06:52 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{4258B015-AED1-4E0F-90B0-3DD7A20393C5}
2011-08-30 06:51 . 2011-08-30 06:52 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{733B54AA-39EA-4D91-ACA2-865628023E70}
2011-08-29 11:28 . 2011-08-29 11:28 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{E90CDEB0-B608-40A5-8FB6-5B99E401B6D9}
2011-08-28 10:04 . 2011-08-28 10:04 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{F753EFE5-8BB3-446F-BAA5-D32BE3D24B65}
2011-08-28 10:04 . 2011-08-28 10:04 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{BCC7BE23-EAB6-4524-B7A9-A6C2989731A0}
2011-08-27 10:03 . 2011-08-27 10:03 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{5AFE188F-60DB-4ADF-948F-B85AD3D119A8}
2011-08-27 10:02 . 2011-08-27 10:03 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{10A88CF4-DB90-461A-A64B-FFBEAC9A5A7C}
2011-08-26 18:49 . 2011-08-26 18:49 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{0154E571-AA19-4360-913C-97B2F180ECEE}
2011-08-26 18:49 . 2011-08-26 18:49 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{1DAE30C8-1FA9-455E-A02D-F11042A92F89}
2011-08-26 10:54 . 2011-09-06 09:24 -------- d-----w- c:\programdata\Creative
2011-08-26 10:54 . 2011-08-26 10:54 -------- d-----w- c:\users\Michal Charvát\AppData\Roaming\Creative
2011-08-26 06:48 . 2011-08-26 06:48 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{35791476-063F-421D-8128-E9EBC47511FA}
2011-08-26 06:48 . 2011-08-26 06:48 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{F31E55D7-E936-497C-A4FE-E1486811070D}
2011-08-25 16:31 . 2011-08-25 16:31 -------- d-----w- c:\program files (x86)\Lightworks
2011-08-25 16:21 . 2011-08-25 16:21 -------- d-----w- c:\users\Michal Charvát\AppData\Roaming\dvdcss
2011-08-25 16:19 . 2011-08-25 16:22 -------- d-----w- c:\program files (x86)\VLMC
2011-08-25 12:58 . 2007-05-23 19:26 100352 ----a-w- c:\windows\system32\Spool\prtprocs\x64\HPZPPLHN.DLL
2011-08-25 11:46 . 2011-08-25 11:46 -------- d-----w- c:\users\Michal Charvát\AppData\Roaming\Malwarebytes
2011-08-25 11:46 . 2011-07-06 17:52 41272 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-08-25 11:46 . 2011-08-25 11:46 -------- d-----w- c:\programdata\Malwarebytes
2011-08-25 11:46 . 2011-08-25 11:46 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-08-25 11:46 . 2011-07-06 17:52 25912 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-25 09:38 . 2011-08-25 09:38 39192 ----a-w- c:\windows\system32\Partizan.exe
2011-08-25 09:37 . 2011-08-25 09:37 2 --shatr- c:\windows\winstart.bat
2011-08-25 09:37 . 2011-08-25 09:56 -------- d-----w- c:\program files (x86)\UnHackMe
2011-08-25 09:26 . 2011-09-05 07:55 -------- d-----w- c:\program files\trend micro
2011-08-25 09:21 . 2011-08-25 09:21 388096 ----a-r- c:\users\Michal Charvát\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-08-25 09:21 . 2011-08-25 09:21 -------- d-----w- c:\program files (x86)\Trend Micro
2011-08-25 09:11 . 2011-08-25 09:11 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{4B783CE0-997A-4747-BE97-4034F03AB0D8}
2011-08-25 09:11 . 2011-08-25 09:11 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{091296BB-115C-4268-82F2-5329EE2691E8}
2011-08-24 20:21 . 2011-08-24 20:22 -------- d-----w- c:\program files (x86)\Google
2011-08-24 09:29 . 2011-08-24 09:29 -------- d-----w- c:\users\Michal Charvát\AppData\Roaming\Blender Foundation
2011-08-24 09:26 . 2011-07-09 05:26 2048 ----a-w- c:\windows\system32\tzres.dll
2011-08-24 09:26 . 2011-07-09 04:29 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2011-08-24 09:26 . 2011-08-25 16:00 -------- d-----w- c:\program files\Blender Foundation
2011-08-24 09:20 . 2011-08-24 09:21 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{61CA5642-4894-4C71-B820-EDFA4CEA70CB}
2011-08-24 09:20 . 2011-08-24 09:20 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{C5E2AD8C-701C-44B1-97C9-4BAFBD12FA16}
2011-08-23 17:35 . 2011-08-23 17:38 -------- d-----w- c:\programdata\Pinnacle VideoSpin
2011-08-23 17:35 . 2011-08-23 17:35 -------- d-----w- c:\program files (x86)\Pinnacle
2011-08-23 17:35 . 2011-08-23 17:35 -------- d-----w- c:\program files (x86)\Common Files\Yahoo!
2011-08-23 17:33 . 2011-08-23 17:33 -------- d-----w- c:\programdata\Pinnacle
2011-08-23 17:22 . 2011-08-23 17:22 -------- d-----w- c:\program files (x86)\Pure Motion
2011-08-23 17:22 . 2011-08-23 17:22 -------- d-----w- c:\program files (x86)\Sonic Foundry
2011-08-23 17:22 . 2011-08-23 17:26 -------- d-----w- c:\program files (x86)\DebugMode
2011-08-23 17:06 . 2011-08-23 17:07 -------- d-----w- c:\users\Michal Charvát\AppData\Roaming\avidemux
2011-08-23 17:05 . 2011-08-23 17:06 -------- d-----w- c:\program files (x86)\Avidemux 2.5
2011-08-23 15:20 . 2011-08-24 09:29 -------- d-----w- C:\Tmp
2011-08-23 15:19 . 2011-08-23 15:19 -------- d-----w- c:\programdata\WeGame
2011-08-23 15:18 . 2011-08-23 15:23 -------- d-----w- c:\users\Michal Charvát\AppData\Local\WeGame
2011-08-23 15:18 . 2009-04-07 16:43 488800 ----a-w- c:\windows\SysWow64\Ltkrn15u.dll
2011-08-23 15:18 . 2009-04-07 16:43 185688 ----a-w- c:\windows\SysWow64\Ltfil15u.dll
2011-08-23 14:50 . 2011-08-23 14:50 -------- d-----w- c:\program files (x86)\CamStudio 2.6b
2011-08-23 14:50 . 2010-10-23 22:56 49664 ----a-w- c:\windows\system32\CamCodec.dll
2011-08-23 08:13 . 2011-08-23 08:13 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{9293C731-EF8A-4A15-A130-00A5DFA7B45E}
2011-08-23 08:12 . 2011-08-23 08:13 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{30C59AE1-D4C8-4CCC-8CDE-EC14C18063BF}
2011-08-22 18:48 . 2011-08-22 18:48 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{481EBDBA-163E-4857-B876-08AC96682420}
2011-08-22 09:57 . 2011-08-22 09:57 -------- d-----w- c:\users\Michal Charvát\AppData\Local\Eclipse
2011-08-22 08:43 . 2002-12-17 14:23 33340 ----a-w- c:\windows\SysWow64\dbmsqlgc.dll
2011-08-22 08:43 . 2002-10-20 12:05 24576 ----a-w- c:\windows\SysWow64\dbmsgnet.dll
2011-08-22 08:43 . 1998-10-29 13:45 306688 ----a-w- c:\windows\IsUninst.exe
2011-08-22 08:42 . 2011-08-22 08:37 3912 ----a-w- c:\windows\SysWow64\drivers\port_nt.sys
2011-08-22 08:40 . 2011-08-22 08:40 -------- d-----w- c:\program files (x86)\Common Files\Borland Shared
2011-08-22 08:39 . 2011-08-22 08:39 -------- d-----w- c:\program files (x86)\PC NET SERVICE
2011-08-22 08:39 . 2011-08-22 08:39 -------- d-----w- c:\program files (x86)\Common Files\Business Objects
2011-08-22 08:39 . 2011-08-22 08:39 -------- d-----w- c:\program files (x86)\Business Objects
2011-08-22 06:47 . 2011-08-22 06:48 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{8DE3C1EF-39DB-4134-A01C-83731C410904}
2011-08-22 06:47 . 2011-08-22 18:48 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{99BF3FF0-419F-4603-8F20-015ED8A82F4D}
2011-08-21 11:17 . 2011-08-21 11:18 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{53E7131B-F2DF-449A-A88C-25665BD363DB}
2011-08-21 11:17 . 2011-08-21 11:17 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{79E5C683-2E43-462D-959C-2FB8D8CA47E9}
2011-08-20 10:16 . 2011-08-20 10:16 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{A39E7ED1-D3EE-4503-88EF-BBFA9FE5BAA0}
2011-08-20 10:16 . 2011-08-20 10:16 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{3A022B0D-5B59-406D-BB33-A6013E880A0E}
2011-08-19 19:57 . 2011-08-19 19:57 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{086F7E15-21F1-49D9-973C-CE3CE58574D5}
2011-08-19 07:56 . 2011-08-19 07:57 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{C65C0520-87B2-4731-AC26-459389450430}
2011-08-19 07:56 . 2011-08-19 19:57 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{7F32E973-9B19-4340-B490-687EEFFF65CE}
2011-08-18 19:56 . 2011-08-18 19:56 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{EBF8BDFD-D5ED-4D71-9401-E2B19D168F46}
2011-08-18 07:55 . 2011-08-18 07:55 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{E06CE65B-4B44-4557-9E03-5FE646E5A0A3}
2011-08-18 07:55 . 2011-08-18 19:56 -------- d-----w- c:\users\Michal Charvát\AppData\Local\{C93091C8-2C3B-4685-BB0D-80751C5B0613}
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-25 09:21 . 2011-08-25 09:21 388096 ----a-r- c:\users\Michal Charvát\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-08-25 09:21 . 2011-08-25 09:21 388096 ----a-r- c:\users\Michal Charvát\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-08-17 09:05 . 2011-06-04 15:19 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-07-31 07:35 . 2011-07-31 07:35 71680 ----a-w- c:\windows\system32\frapsv64.dll
2011-07-31 07:35 . 2011-07-31 07:35 65536 ----a-w- c:\windows\SysWow64\frapsvid.dll
2011-07-16 04:26 . 2011-08-10 19:45 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2011-07-13 18:55 . 2011-07-13 18:55 466456 ----a-w- c:\windows\system32\wrap_oal.dll
2011-07-13 18:55 . 2011-07-13 18:55 444952 ----a-w- c:\windows\SysWow64\wrap_oal.dll
2011-07-13 18:55 . 2011-07-13 18:55 122904 ----a-w- c:\windows\system32\OpenAL32.dll
2011-07-13 18:55 . 2011-07-13 18:55 109080 ----a-w- c:\windows\SysWow64\OpenAL32.dll
2011-07-07 21:36 . 2011-07-07 21:36 16907776 ----a-w- c:\windows\system32\amdocl64.dll
2011-07-07 21:36 . 2011-07-07 21:36 13904896 ----a-w- c:\windows\SysWow64\amdocl.dll
2011-06-30 16:18 . 2011-06-04 17:08 88288 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2011-06-30 16:18 . 2011-06-04 17:08 123784 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-06-16 01:34 . 2011-06-16 01:34 79872 ----a-w- c:\windows\SysWow64\SlotMaximizerAg.dll
2011-06-16 01:34 . 2011-06-16 01:34 2971648 ----a-w- c:\windows\system32\SlotMaximizerBe.dll
2011-06-16 01:34 . 2011-06-16 01:34 2117632 ----a-w- c:\windows\SysWow64\SlotMaximizerBe.dll
2011-06-16 01:34 . 2011-06-16 01:34 105984 ----a-w- c:\windows\system32\SlotMaximizerAg.dll
2011-06-15 20:36 . 2011-06-04 12:00 1757792 ----a-w- c:\programdata\Microsoft\VisualStudio\10.0\1033\ResourceCache.dll
2011-06-11 14:41 . 2010-10-19 06:54 525544 ----a-w- c:\windows\system32\deployJava1.dll
2011-06-11 14:39 . 2011-06-04 16:34 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll
2011-06-11 03:07 . 2011-07-13 10:55 3137536 ----a-w- c:\windows\system32\win32k.sys
2007-08-20 07:18 . 2007-08-20 07:18 520704 ----a-w- c:\program files (x86)\Nadaj_upr_pelne.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{8CE7F568-67FA-4432-BA39-F5AFD68E7B8B}]
2011-05-23 22:32 470784 ----a-w- c:\users\Michal Charvát\AppData\Roaming\Speckie\bin32\Speckie32.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TrayStatus"="c:\program files (x86)\TrayStatus\TrayStatus.exe" [2011-05-18 283032]
"WLSync"="c:\program files (x86)\Windows Live\Mesh\WLSync.exe" [2011-05-13 1449312]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-05-20 284440]
"KeePass 2 PreLoad"="c:\program files (x86)\KeePass Password Safe 2\KeePass.exe" [2011-04-10 1733120]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-03-04 281768]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-05-24 336384]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-12-29 1082656]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer6"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /k:C *
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
R3 Andbus;LGE Android Platform Composite USB Device;c:\windows\system32\DRIVERS\lgandbus64.sys [x]
R3 AndDiag;LGE Android Platform USB Serial Port;c:\windows\system32\DRIVERS\lganddiag64.sys [x]
R3 AndGps;LGE Android Platform USB GPS NMEA Port;c:\windows\system32\DRIVERS\lgandgps64.sys [x]
R3 ANDModem;LGE Android Platform USB Modem;c:\windows\system32\DRIVERS\lgandmodem64.sys [x]
R3 androidusb;ADB Interface Driver;c:\windows\system32\Drivers\lgandadb.sys [x]
R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [x]
R3 cpudrv64;cpudrv64;c:\program files (x86)\SystemRequirementsLab\cpudrv64.sys [2009-12-18 17864]
R3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2010-12-27 31124344]
R3 PCDSRVC{1E208CE0-FB7451FF-06020101}_0;PCDSRVC{1E208CE0-FB7451FF-06020101}_0 - PCDR Kernel Mode Service Helper Driver;c:\program files\dell support center\pcdsrvc_x64.pkms [2011-05-12 25072]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
R3 s1018bus;Sony Ericsson Device 1018 driver (WDM);c:\windows\system32\DRIVERS\s1018bus.sys [x]
R3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s1018mdfl.sys [x]
R3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s1018mdm.sys [x]
R3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s1018mgmt.sys [x]
R3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS);c:\windows\system32\DRIVERS\s1018nd5.sys [x]
R3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s1018obex.sys [x]
R3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM);c:\windows\system32\DRIVERS\s1018unic.sys [x]
R3 Sony Ericsson PCCompanion;Sony Ericsson PCCompanion;c:\program files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [2011-06-29 155344]
R3 TeamViewer5;TeamViewer 5;c:\program files (x86)\TeamViewer\Version5\TeamViewer_Service.exe [2011-03-17 2025336]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 VSPerfDrv100;Performance Tools Driver 10.0;c:\program files (x86)\Microsoft Visual Studio 10.0\Team Tools\Performance Tools\x64\VSPerfDrv100.sys [2010-03-17 68440]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S1 HWiNFO32;HWiNFO32/64 Kernel Driver;c:\program files\HWiNFO64\HWiNFO64A.SYS [2011-05-22 28032]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe [2009-03-03 89600]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 AntiVirMailService;Avira AntiVir MailGuard;c:\program files (x86)\Avira\AntiVir Desktop\avmailc.exe [2011-06-30 340136]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-06-05 136360]
S2 AntiVirWebService;Avira AntiVir WebGuard;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [2011-06-30 428200]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 IAStorDataMgrSvc;Úložná technologie Intel(R) Rapid;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-05-20 13592]
S2 MSSQL$PCNETSERVICE;MSSQL$PCNETSERVICE;c:\program files (x86)\Microsoft SQL Server\MSSQL$PCNETSERVICE\Binn\sqlservr.exe [2002-12-17 7520337]
S2 nlsX86cc;NLS Service;c:\windows\SysWOW64\NLSSRV32.EXE [2011-03-21 68928]
S2 SQLAgent$PCNETSERVICE;SQLAgent$PCNETSERVICE;c:\program files (x86)\Microsoft SQL Server\MSSQL$PCNETSERVICE\Binn\sqlagent.EXE [2002-12-17 311872]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [x]
S2 TurboBoost;Intel(R) Turbo Boost Technology Monitor;c:\program files\Intel\TurboBoost\TurboBoost.exe [2009-11-02 126352]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 BcmVWL;Broadcom Virtual Wireless;c:\windows\system32\DRIVERS\bcmvwl64.sys [x]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [x]
S3 LgBttPort;LGE Bluetooth TransPort;c:\windows\system32\DRIVERS\lgbtpt64.sys [x]
S3 lgbusenum;LG Bluetooth Bus Enumerator;c:\windows\system32\DRIVERS\lgbtbs64.sys [x]
S3 LGVMODEM;LGE Virtual Modem;c:\windows\system32\DRIVERS\lgvmdm64.sys [x]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{2D46B6DC-2207-486B-B523-A557E6D54B47}]
2010-11-20 02:17 302592 ----a-w- c:\windows\System32\cmd.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2011-08-28 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job
- c:\program files\Dell Support Center\uaclauncher.exe [2011-06-21 18:09]
.
2011-09-06 c:\windows\Tasks\SystemToolsDailyTest.job
- c:\program files\Dell Support Center\uaclauncher.exe [2011-06-21 18:09]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8CE7F568-67FA-4432-BA39-F5AFD68E7B8B}]
2011-05-23 22:33 532224 ----a-w- c:\users\Michal Charvát\AppData\Roaming\Speckie\bin64\Speckie64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2010-06-18 487424]
"Broadcom Wireless Manager UI"="c:\program files\Dell\DW WLAN Card\WLTRAY.exe" [2010-02-03 5712896]
"QuickSet"="c:\program files\Dell\QuickSet\QuickSet.exe" [2010-01-06 3179288]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Sothink SWF Catcher - c:\program files (x86)\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files (x86)\ICQ7.5\ICQ.exe
IE: {{E6846530-6088-4AA3-932F-C6245CE59A4C} - {8CE7F568-67FA-4432-BA39-F5AFD68E7B8B} - c:\users\Michal Charvát\AppData\Roaming\Speckie\bin32\Speckie32.dll
LSP: c:\program files (x86)\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 81.200.55.50 81.200.55.34
.
.
------- Asociace souborů -------
.
txtfile=c:\windows\NOTEPAD.EXE %1
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PCDSRVC{1E208CE0-FB7451FF-06020101}_0]
"ImagePath"="\??\c:\program files\dell support center\pcdsrvc_x64.pkms"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-3847059355-3794568477-1451639886-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\V*`]
"Order"=hex:08,00,00,00,02,00,00,00,74,01,00,00,01,00,00,00,03,00,00,00,6e,00,
00,00,02,00,00,00,60,00,32,00,16,01,00,00,c4,3e,57,83,20,00,53,54,41,47,49,\
.
Celkový čas: 2011-09-06 11:59:02
ComboFix-quarantined-files.txt 2011-09-06 09:59
.
Před spuštěním: Volných bajtů: 386 137 710 592
Po spuštění: Volných bajtů: 386 458 013 696
.
- - End Of File - - D0B2D7B5F4AD49E84E7A1A6ED36C4BA2
Nahoru
dog.big
Návštěvník
Návštěvník
Příspěvky: 23
Registrován: 25 Ún 2009 17:37

Re: Po dlouhé době BSOD 0xF4 a zalogování ANONYMOUS USER

#5 Příspěvek od dog.big »

bump
Nahoru
Avatar uživatele
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 Říj 2008 08:02

Re: Po dlouhé době BSOD 0xF4 a zalogování ANONYMOUS USER

#6 Příspěvek od motji »

Omlouvám se, včera jsem to nestihla :) .

Znáte
c:\windows\system32\Partizan.exe

c:\users\Michal Charvát\.ssh
c:\git
c:\windows\winstart.bat - soubor otevřete v notepadu a obsah vložte zde
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
dog.big
Návštěvník
Návštěvník
Příspěvky: 23
Registrován: 25 Ún 2009 17:37

Re: Po dlouhé době BSOD 0xF4 a zalogování ANONYMOUS USER

#7 Příspěvek od dog.big »

Zdravím,
děkuji za reakci.. co jsem zjistil je níže:

c:\windows\system32\Partizan.exe - zřejmě nainstalováno s nějakým antirootkitem, popis: Partizan - First Bootwatch Anti-Rootkit, Unhackme
c:\users\Michal Charvát\.ssh - legitimní, obsahuje můj ssh klíč pro GitHub
c:\git - legitimní, obsahuje klonované repositáře
c:\windows\winstart.bat - je prázdný
Nahoru
Avatar uživatele
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 Říj 2008 08:02

Re: Po dlouhé době BSOD 0xF4 a zalogování ANONYMOUS USER

#8 Příspěvek od motji »

Dobře, ted to s pc vypadá jak?
tohle znáte?

TCP: DhcpNameServer = 81.200.55.50 81.200.55.34
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
dog.big
Návštěvník
Návštěvník
Příspěvky: 23
Registrován: 25 Ún 2009 17:37

Re: Po dlouhé době BSOD 0xF4 a zalogování ANONYMOUS USER

#9 Příspěvek od dog.big »

Dobrý den,
BSOD žádné, ty DNS jsou legitimní od mého ISP.
Avšal dnes jserm objevil další anonymní zalogování:

Kód: Vybrat vše

Účet byl úspěšně přihlášen.

Předmět:
	ID zabezpečení:		NULL SID
	Název účtu:		-
	Doména účtu:		-
	ID přihlášení:		0x0

Typ přihlášení:			3

Nové přihlášení:
	ID zabezpečení:		ANONYMOUS LOGON
	Název účtu:		ANONYMOUS LOGON
	Doména účtu:		NT AUTHORITY
	ID přihlášení:		0x30061
	GUID přihlášení:		{00000000-0000-0000-0000-000000000000}

Informace o procesu:
	ID procesu:		0x0
	Název procesu:		-

Informace o síti:
	Název pracovní stanice:	
	Adresa zdrojové sítě	-
	Zdrojový port:		-

Podrobné informace o ověření:
	Proces přihlášení:		NtLmSsp 
	Balíček ověření:	NTLM
	Přenosové služby:	-
	Název balíčku (pouze NTLM):	NTLM V1
	Délka klíče:		0

Tato událost je generována po vytvoření relace přihlášení. Je generována v počítači, ke kterému byl získán přístup.

Pole s předmětem označují účet v místním systému, který požadoval přihlášení. Jedná se nejčastěji o službu, například službu serveru nebo místní proces, například Winlogon.exe nebo Services.exe.

Pole Typ přihlášení označuje, k jakému typu přihlášení došlo. Nejběžnější typy jsou 2 (interaktivní) a 3 (síť).

Pole Nové přihlášení označují účet, pro který bylo nové přihlášení vytvořeno, tj. účet, který byl přihlášen.

Pole Síť označují původ požadavku na vzdálené přihlášení. Název pracovní stanice není vždy k dispozici a v některých případech může být toto pole prázdné.

Pole s informacemi o ověření poskytují podrobné informace o tomto konkrétním požadavku na přihlášení.
	- GUID přihlášení je jednoznačný identifikátor, který je možné použít ke spojení této události s událostí KDC.
	- Přenosové služby označují, které pomocné služby se podílely na tomto požadavku na přihlášení.
	- Název balíčku označuje, který dílčí protokol z protokolů NTLM byl použit.
	- Délka klíče označuje délku generovaného klíče relace. Tato hodnota bude 0, pokud nebyl požadován žádný klíč relace.
Nahoru
Avatar uživatele
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 Říj 2008 08:02

Re: Po dlouhé době BSOD 0xF4 a zalogování ANONYMOUS USER

#10 Příspěvek od motji »

Vydržte, poradím se s kolegy.
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
Avatar uživatele
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 Říj 2008 08:02

Re: Po dlouhé době BSOD 0xF4 a zalogování ANONYMOUS USER

#11 Příspěvek od motji »

Ten anonymous user je ok http://support.microsoft.com/kb/288571/cs
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
Odpovědět

Vrátit se na „Řešení problémů, logy“