PUP:Win32:FunWeb a PUP:Win32:PUP-gen log z RSIT prilozen

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz

Vážení uživaterlé!
Ve dnech 4. - 6-9.2026 budou někteříí naši členové na každoročním srazu fóra. Žádáme vás, abyste měli strpení, nemusí se na na řešení vašeho problému dostat hned. Děkujeme za pochopení.
Odpovědět
Zpráva
Autor
cipisekcz
Návštěvník
Návštěvník
Příspěvky: 7
Registrován: 09 Lis 2011 14:13

PUP:Win32:FunWeb a PUP:Win32:PUP-gen log z RSIT prilozen

#1 Příspěvek od cipisekcz »

Dobry den,chtel bych poprosit o pomoc.Muj Avast 6 mi hlasi tyto problemy viz. predmet.Zkousel jsem je odstranit pres Avast v nouzovem rezimua,ale po restartu je stale mam v PC.Log z RSIT je tady.


Logfile of random's system information tool 1.09 (written by random/random)
Run by R at 2011-11-09 14:19:06
Microsoft Windows XP Professional Service Pack 3
System drive C: has 3 GB (13%) free of 21 GB
Total RAM: 1023 MB (27% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 14:19:34, on 9.11.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Program Files\Dell\QuickSet\QuickSet.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Spyware Terminator\st_rsser.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\DOCUME~1\R\LOCALS~1\TempImg\VerControl.exe
C:\DOCUME~1\R\LOCALS~1\TempCkt\chk.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
D:\Program Files\stickies\stickies.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
C:\totalcmd\TOTALCMD.EXE
C:\Documents and Settings\R\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\R\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\R\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\R\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\R\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\R\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\R\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
D:\E - ARCHIV\01. - DOWNLOAD - Internet\DOWNLOAD - Direct Connect\RSIT.exe
C:\Program Files\trend micro\R.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatche ... tbid=60747
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource= ... =CT2645238
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60747
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60747
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60747
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60747
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.forumswatcher.com/search.htm
R3 - URLSearchHook: &Crawler Toolbar Helper - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: &Crawler Toolbar Helper - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\PROGRA~1\MI1933~1\Office12\GRA8E1~1.DLL
O2 - BHO: ZoneAlarm Security Engine Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O2 - BHO: ZoneAlarm Security - {91da5e8a-3318-4f8c-b67e-5964de3ab546} - C:\Program Files\ZoneAlarm_Security\prxtbZone.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: ZoneAlarm Security Toolbar - {91da5e8a-3318-4f8c-b67e-5964de3ab546} - C:\Program Files\ZoneAlarm_Security\prxtbZone.dll
O3 - Toolbar: ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O3 - Toolbar: &Crawler Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\QuickSet.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [Dell Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ISW] "C:\Program Files\CheckPoint\ZAForceField\ForceField.exe" /icon="hidden"
O4 - HKLM\..\Run: [SpywareTerminatorShield] C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
O4 - HKLM\..\Run: [SpywareTerminatorUpdater] C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [VerControl] C:\DOCUME~1\R\LOCALS~1\TempImg\VerControl.exe
O4 - HKCU\..\Run: [chk] C:\DOCUME~1\R\LOCALS~1\TempCkt\chk.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Stickies.lnk = D:\Program Files\stickies\stickies.exe
O4 - Startup: OpenOffice.org 2.0.lnk = H:\System\Apps\236C571E-47D6-4a73-AD5A-97F1E555E375\Exec\openoffice\program\quickstart.exe
O4 - Startup: Výrezy obrazovky a spuštení aplikace OneNote 2007.lnk
O4 - Startup: KooBits 4.lnk = C:\Program Files\KooBits 4.0\KooBits 4.0.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: e&xportovat do aplikace microsoft excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000a-7350-4f3c-8081-5663ee0c6c49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000a-7350-4f3c-8081-5663ee0c6c49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780b25-18cc-41c8-b9be-3c9c571a8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [java_sun] Java (Sun)
O16 - DPF: {6414512b-b978-451d-a0d8-fcfdf33e833c} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 5725790109
O16 - DPF: {e2883e8f-472f-4fb0-9522-ac9bf37916a7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: groovelocalgws - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MI1933~1\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ZoneAlarm Toolbar IswSvc (IswSvc) - Check Point Software Technologies - C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Spyware Terminator 2012 Realtime Shield Service (ST2012_Svc) - Crawler.com - C:\Program Files\Spyware Terminator\st_rsser.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZONELABS\vsmon.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--
End of file - 12794 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-854245398-1801674531-725345543-1003Core1cc9078f756b2d2.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-12-18 59032]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}]
&Crawler Toolbar Helper - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll [2011-09-12 1237240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5CA3D70E-1895-11CF-8E15-001234567890}]
DriveLetterAccess - C:\WINDOWS\system32\dla\tfswshx.dll [2004-08-13 118842]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30c5-4d22-b7f9-0bbc1d38a37e}]
Groove GFS Browser Helper - C:\PROGRA~1\MI1933~1\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3}]
ZoneAlarm Security Engine Registrar - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll [2011-02-15 599544]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{91da5e8a-3318-4f8c-b67e-5964de3ab546}]
ZoneAlarm Security Toolbar - C:\Program Files\ZoneAlarm_Security\prxtbZone.dll [2011-05-09 176936]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-05-03 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-05-03 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{91da5e8a-3318-4f8c-b67e-5964de3ab546} - ZoneAlarm Security Toolbar - C:\Program Files\ZoneAlarm_Security\prxtbZone.dll [2011-05-09 176936]
{EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - ZoneAlarm Security Engine - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll [2011-02-15 599544]
{4B3803EA-5230-4DC3-A7FC-33638F3D3542} - &Crawler Toolbar - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll [2011-09-12 1237240]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]
"BluetoothAuthenticationAgent"=bthprops.cpl,,BluetoothAuthenticationAgent []
"IntelliPoint"=C:\Program Files\Microsoft IntelliPoint\point32.exe [2004-06-03 204800]
"Dell QuickSet"=C:\Program Files\Dell\QuickSet\QuickSet.exe [2004-11-10 598016]
"Apoint"=C:\Program Files\Apoint\Apoint.exe [2004-09-13 155648]
"Dell Wireless Manager UI"=C:\WINDOWS\system32\WLTRAY []
"IntelWireless"=C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe [2004-10-30 385024]
"ATIPTA"=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [2004-12-03 344064]
"dla"=C:\WINDOWS\system32\dla\tfswctrl.exe [2004-08-13 122939]
"UpdateManager"=C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe [2004-01-07 110592]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2007-03-14 257088]
"Broadcom Wireless Manager UI"=C:\WINDOWS\system32\WLTRAY.exe [2006-11-01 1392640]
"DVDLauncher"=C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe [2004-04-26 53248]
"DAEMON Tools"=C:\Program Files\DAEMON Tools\daemon.exe [2005-11-09 128920]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2007-10-19 286720]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]
"avast"=C:\Program Files\AVAST Software\Avast\avastUI.exe [2011-09-06 3722416]
"ZoneAlarm Client"=C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe [2011-03-18 1043968]
"ISW"=C:\Program Files\CheckPoint\ZAForceField\ForceField.exe [2011-02-15 738808]
"SpywareTerminatorShield"=C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe [2011-09-28 2775728]
"SpywareTerminatorUpdater"=C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe [2011-09-28 3609776]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"updateMgr"=C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [2006-03-30 313472]
"VerControl"=C:\DOCUME~1\R\LOCALS~1\TempImg\VerControl.exe [2010-10-04 339968]
"chk"=C:\DOCUME~1\R\LOCALS~1\TempCkt\chk.exe [2010-07-22 339968]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Bluetooth Manager.lnk - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

C:\Documents and Settings\R\Start Menu\Programs\Startup
Stickies.lnk - D:\Program Files\stickies\stickies.exe
OpenOffice.org 2.0.lnk - H:\System\Apps\236C571E-47D6-4a73-AD5A-97F1E555E375\Exec\openoffice\program\quickstart.exe
Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
KooBits 4.lnk - C:\Program Files\KooBits 4.0\KooBits 4.0.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2004-12-03 90112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll [2004-09-07 110592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 239496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MI1933~1\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vsmon]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDrives"=0
"NoDriveAutoRun"=67108863

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\WINDOWS\System32\dpnsvr.exe"="C:\WINDOWS\System32\dpnsvr.exe:*:Disabled:Microsoft DirectPlay8 Server"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe"="C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe:*:Enabled:ENABLE"
"C:\Program Files\Microsoft Office\Office12\groove.exe"="C:\Program Files\Microsoft Office\Office12\groove.exe:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\WINDOWS\System32\ZoneLabs\vsmon.exe"="C:\WINDOWS\System32\ZoneLabs\vsmon.exe:*:Enabled:vsmon"
"C:\Program Files\Spyware Terminator\SpywareTerminator.exe"="C:\Program Files\Spyware Terminator\SpywareTerminator.exe:*:Enabled:Spyware Terminator 2012"
"C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe"="C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe:*:Enabled:Spyware Terminator 2012"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.avrn"=C:\PROGRA~1\ACEMEG~1\SystemS\AVIDAV~1.DLL
"vidc.advj"=C:\PROGRA~1\ACEMEG~1\SystemS\AVIDAV~1.DLL
"vidc.mszh"=C:\PROGRA~1\ACEMEG~1\SystemS\avimszh.dll
"vidc.zlib"=C:\PROGRA~1\ACEMEG~1\SystemS\avizlib.dll
"vidc.cscd"=C:\PROGRA~1\ACEMEG~1\SystemS\camcodec.dll
"vidc.cvid"=C:\PROGRA~1\ACEMEG~1\SystemS\iccvid.dll
"msacm.trspch"=C:\PROGRA~1\ACEMEG~1\SystemS\tssoft32.acm
"vidc.em2v"=C:\PROGRA~1\ACEMEG~1\SystemS\etxcodec.dll
"vidc.mkvc"=C:\PROGRA~1\ACEMEG~1\SystemS\kmvidc32.dll
"vidc.hfyu"=C:\PROGRA~1\ACEMEG~1\SystemS\huffyuv.dll
"msacm.lameacm"=C:\PROGRA~1\ACEMEG~1\SystemS\lameacm.acm
"msacm.lhacm"=C:\PROGRA~1\ACEMEG~1\SystemS\lhacm.acm
"msacm.l3acm"=C:\PROGRA~1\ACEMEG~1\SystemS\l3codecp.acm
"vidc.sjpg"=C:\PROGRA~1\ACEMEG~1\SystemS\pmjpeg32.dll
"vidc.dmb2"=C:\PROGRA~1\ACEMEG~1\SystemS\pmjpeg32.dll
"vidc.gepj"=C:\PROGRA~1\ACEMEG~1\SystemS\pmjpeg32.dll
"vidc.qpeg"=C:\PROGRA~1\ACEMEG~1\SystemS\Qpeg32.dll
"vidc.q1.0"=C:\PROGRA~1\ACEMEG~1\SystemS\Qpeg32.dll
"msacm.sl_anet"=C:\PROGRA~1\ACEMEG~1\SystemS\sl_anet.acm
"vidc.tscc"=C:\PROGRA~1\ACEMEG~1\SystemS\tsccvid.dll
"vidc.vifp"=C:\PROGRA~1\ACEMEG~1\SystemS\vfcodec.dll
"vidc.wrpr"=C:\PROGRA~1\ACEMEG~1\SystemS\aviwrap.dll
"vidc.wnv1"=C:\PROGRA~1\ACEMEG~1\SystemS\wnvplay1.dll
"vidc.3ivx"=C:\PROGRA~1\ACEMEG~1\SystemS\3ivx\3IVXVF~1.DLL
"vidc.3iv0"=C:\PROGRA~1\ACEMEG~1\SystemS\3ivx\3IVXVF~1.DLL
"vidc.3iv1"=C:\PROGRA~1\ACEMEG~1\SystemS\3ivx\3IVXVF~1.DLL
"vidc.3iv2"=C:\PROGRA~1\ACEMEG~1\SystemS\3ivx\3IVXVF~1.DLL
"vidc.3ivd"=C:\PROGRA~1\ACEMEG~1\SystemS\3ivx\3IVXVF~1.DLL
"vidc.advs"=C:\PROGRA~1\ACEMEG~1\SystemS\Adaptec\Dvc.dll
"vidc.aflc"=C:\PROGRA~1\ACEMEG~1\SystemS\Autodesk\FLCCOD~1.DLL
"vidc.afli"=C:\PROGRA~1\ACEMEG~1\SystemS\Autodesk\FLCCOD~1.DLL
"vidc.aasc"=C:\PROGRA~1\ACEMEG~1\SystemS\Autodesk\Aasc32.dll
"vidc.aas4"=C:\PROGRA~1\ACEMEG~1\SystemS\Autodesk\Aasc32.dll
"vidc.asv1"=C:\PROGRA~1\ACEMEG~1\SystemS\ASUS\asusasv1.dll
"vidc.asv2"=C:\PROGRA~1\ACEMEG~1\SystemS\ASUS\asusasv2.dll
"vidc.asvx"=C:\PROGRA~1\ACEMEG~1\SystemS\ASUS\asusasv2.dll
"vidc.vcr1"=C:\PROGRA~1\ACEMEG~1\SystemS\ATI\ativcr1.dll
"vidc.vcr2"=C:\PROGRA~1\ACEMEG~1\SystemS\ATI\ativcr2.dll
"vidc.mwv1"=C:\PROGRA~1\ACEMEG~1\SystemS\Aware\icmw_32.dll
"vidc.bt20"=C:\PROGRA~1\ACEMEG~1\SystemS\BROOKT~1\btvvc32.drv
"vidc.y41p"=C:\PROGRA~1\ACEMEG~1\SystemS\BROOKT~1\btvvc32.drv
"msacm.pcdv"=C:\PROGRA~1\ACEMEG~1\SystemS\Canopus\pcdv.acm
"vidc.cdvc"=C:\PROGRA~1\ACEMEG~1\SystemS\Canopus\CSCCDVC.DLL
"vidc.ddvc"=C:\PROGRA~1\ACEMEG~1\SystemS\Canopus\CSCdvsd.DLL
"vidc.png1"=C:\PROGRA~1\ACEMEG~1\SystemS\Core\COREPN~1.DLL
"msacm.CoreFLAC_ACM"=C:\PROGRA~1\ACEMEG~1\SystemS\Core\COREFL~1.ACM
"vidc.davc"=C:\PROGRA~1\ACEMEG~1\SystemS\dicas\davcvfw.dll
"vidc.div3"=C:\PROGRA~1\ACEMEG~1\SystemS\DivX\DivXc32.dll
"vidc.div5"=C:\PROGRA~1\ACEMEG~1\SystemS\DivX\DivXc32.dll
"vidc.mpg3"=C:\PROGRA~1\ACEMEG~1\SystemS\DivX\DivXc32.dll
"vidc.div4"=C:\PROGRA~1\ACEMEG~1\SystemS\DivX\DivXc32f.dll
"vidc.div6"=C:\PROGRA~1\ACEMEG~1\SystemS\DivX\DivXc32f.dll
"vidc.ap41"=C:\PROGRA~1\ACEMEG~1\SystemS\DivX\DivXc32f.dll
"vidc.dvx4"=C:\PROGRA~1\ACEMEG~1\SystemS\DivX\divx4.dll
"msacm.divxa32"=C:\PROGRA~1\ACEMEG~1\SystemS\DivX\divxa32.acm
"vidc.frwd"=C:\PROGRA~1\ACEMEG~1\SystemS\Forward\frwd.dll
"vidc.frwt"=C:\PROGRA~1\ACEMEG~1\SystemS\Forward\frwd.dll
"vidc.frwa"=C:\PROGRA~1\ACEMEG~1\SystemS\Forward\frwt.dll
"vidc.frwu"=C:\PROGRA~1\ACEMEG~1\SystemS\Forward\frwu.dll
"vidc.glzw"=C:\PROGRA~1\ACEMEG~1\SystemS\Gabest\GLZW.dll
"vidc.gpeg"=C:\PROGRA~1\ACEMEG~1\SystemS\Gabest\GPEG.dll
"vidc.i263"=C:\PROGRA~1\ACEMEG~1\SystemS\Intel\i263_32.drv
"vidc.iv30"=C:\PROGRA~1\ACEMEG~1\SystemS\Intel\ir32_32.dll
"vidc.iv31"=C:\PROGRA~1\ACEMEG~1\SystemS\Intel\ir32_32.dll
"vidc.iv32"=C:\PROGRA~1\ACEMEG~1\SystemS\Intel\ir32_32.dll
"vidc.iv33"=C:\PROGRA~1\ACEMEG~1\SystemS\Intel\ir32_32.dll
"vidc.iv34"=C:\PROGRA~1\ACEMEG~1\SystemS\Intel\ir32_32.dll
"vidc.iv35"=C:\PROGRA~1\ACEMEG~1\SystemS\Intel\ir32_32.dll
"vidc.iv36"=C:\PROGRA~1\ACEMEG~1\SystemS\Intel\ir32_32.dll
"vidc.iv37"=C:\PROGRA~1\ACEMEG~1\SystemS\Intel\ir32_32.dll
"vidc.iv38"=C:\PROGRA~1\ACEMEG~1\SystemS\Intel\ir32_32.dll
"vidc.iv39"=C:\PROGRA~1\ACEMEG~1\SystemS\Intel\ir32_32.dll
"vidc.iv40"=C:\PROGRA~1\ACEMEG~1\SystemS\Intel\ir41_32.dll
"vidc.iv41"=C:\PROGRA~1\ACEMEG~1\SystemS\Intel\ir41_32.dll
"vidc.iv42"=C:\PROGRA~1\ACEMEG~1\SystemS\Intel\ir41_32.dll
"vidc.iv43"=C:\PROGRA~1\ACEMEG~1\SystemS\Intel\ir41_32.dll
"vidc.iv44"=C:\PROGRA~1\ACEMEG~1\SystemS\Intel\ir41_32.dll
"vidc.iv45"=C:\PROGRA~1\ACEMEG~1\SystemS\Intel\ir41_32.dll
"vidc.iv46"=C:\PROGRA~1\ACEMEG~1\SystemS\Intel\ir41_32.dll
"vidc.iv47"=C:\PROGRA~1\ACEMEG~1\SystemS\Intel\ir41_32.dll
"vidc.iv48"=C:\PROGRA~1\ACEMEG~1\SystemS\Intel\ir41_32.dll
"vidc.iv49"=C:\PROGRA~1\ACEMEG~1\SystemS\Intel\ir41_32.dll
"vidc.iv50"=C:\PROGRA~1\ACEMEG~1\SystemS\Intel\ir50_32.dll
"vidc.iyuv"=C:\PROGRA~1\ACEMEG~1\SystemS\Intel\iyuv_32.dll
"vidc.yvu9"=C:\PROGRA~1\ACEMEG~1\SystemS\Intel\Iyvu9_32.dll
"vidc.ir21"=C:\PROGRA~1\ACEMEG~1\SystemS\Intel\IR21_R.DLL
"vidc.rt21"=C:\PROGRA~1\ACEMEG~1\SystemS\Intel\IR21_R.DLL
"msacm.imc"=C:\PROGRA~1\ACEMEG~1\SystemS\Intel\IMC32.ACM
"vidc.lead"=C:\PROGRA~1\ACEMEG~1\SystemS\LEAD\LCODCCMP.DLL
"vidc.dvsd"=C:\PROGRA~1\ACEMEG~1\SystemS\MAINCO~1\MCDVD_32.DLL
"vidc.dvc"=C:\PROGRA~1\ACEMEG~1\SystemS\MAINCO~1\MCDVD_32.DLL

======List of files/folders created in the last 1 month======

2011-11-09 12:12:13 ----D---- C:\Program Files\Crawler
2011-11-09 12:12:02 ----A---- C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
2011-11-09 12:12:01 ----D---- C:\Documents and Settings\R\Application Data\Spyware Terminator
2011-11-09 12:12:01 ----D---- C:\Documents and Settings\All Users\Application Data\Spyware Terminator
2011-11-09 12:08:23 ----D---- C:\Program Files\Spyware Terminator
2011-11-09 12:02:59 ----D---- C:\Documents and Settings\R\Application Data\CheckPoint
2011-11-09 12:02:24 ----D---- C:\Program Files\Conduit
2011-11-09 12:02:20 ----D---- C:\Program Files\ZoneAlarm_Security
2011-11-09 12:01:44 ----D---- C:\Program Files\CheckPoint
2011-11-09 12:01:40 ----A---- C:\WINDOWS\system32\vsregexp.dll
2011-11-09 12:01:37 ----A---- C:\WINDOWS\system32\zlcommdb.dll
2011-11-09 12:01:37 ----A---- C:\WINDOWS\system32\zlcomm.dll
2011-11-09 12:01:32 ----A---- C:\WINDOWS\system32\vswmi.dll
2011-11-09 12:01:30 ----A---- C:\WINDOWS\system32\zpeng25.dll
2011-11-09 12:01:30 ----A---- C:\WINDOWS\system32\vsxml.dll
2011-11-09 12:01:29 ----A---- C:\WINDOWS\system32\vspubapi.dll
2011-11-09 12:01:29 ----A---- C:\WINDOWS\system32\vsmonapi.dll
2011-11-09 12:01:28 ----A---- C:\WINDOWS\system32\vsdatant.sys
2011-11-09 12:01:26 ----D---- C:\Program Files\Zone Labs
2011-11-09 12:00:56 ----A---- C:\WINDOWS\system32\vsutil.dll
2011-11-09 12:00:56 ----A---- C:\WINDOWS\system32\vsinit.dll
2011-11-09 12:00:56 ----A---- C:\WINDOWS\system32\vsdata.dll
2011-11-09 11:10:16 ----ASH---- C:\hiberfil.sys
2011-11-06 15:18:03 ----D---- C:\WINDOWS\ERDNT
2011-11-06 15:09:27 ----D---- C:\Program Files\trend micro
2011-11-06 15:09:26 ----D---- C:\rsit
2011-11-06 14:52:43 ----D---- C:\Program Files\CCleaner
2011-11-06 14:32:37 ----HD---- C:\WINDOWS\$NtUninstallKB2345886$
2011-11-06 14:32:30 ----HD---- C:\WINDOWS\$NtUninstallKB970430$
2011-11-06 14:31:59 ----HD---- C:\WINDOWS\$NtUninstallKB971737$
2011-11-06 12:02:09 ----HD---- C:\WINDOWS\$NtUninstallKB2570791$
2011-11-06 12:01:59 ----HD---- C:\WINDOWS\$NtUninstallKB2387149$
2011-11-06 12:01:47 ----HD---- C:\WINDOWS\$NtUninstallKB960859$
2011-11-06 12:01:39 ----HD---- C:\WINDOWS\$NtUninstallKB2479943$
2011-11-06 12:01:32 ----HD---- C:\WINDOWS\$NtUninstallKB2567680$
2011-11-06 12:01:20 ----HD---- C:\WINDOWS\$NtUninstallKB2564958$
2011-11-06 12:01:13 ----HD---- C:\WINDOWS\$NtUninstallKB2478971$
2011-11-06 12:01:06 ----HD---- C:\WINDOWS\$NtUninstallKB2536276-v2$
2011-11-06 12:00:59 ----HD---- C:\WINDOWS\$NtUninstallKB2296011$
2011-11-06 12:00:53 ----HD---- C:\WINDOWS\$NtUninstallKB2115168$
2011-11-06 12:00:44 ----HD---- C:\WINDOWS\$NtUninstallKB975558_WM8$
2011-11-06 12:00:36 ----HD---- C:\WINDOWS\$NtUninstallKB955759$
2011-11-06 12:00:23 ----HD---- C:\WINDOWS\$NtUninstallKB2378111_WM9$
2011-11-06 12:00:13 ----HD---- C:\WINDOWS\$NtUninstallKB974318$
2011-11-06 12:00:02 ----HD---- C:\WINDOWS\$NtUninstallKB969059$
2011-11-06 11:59:52 ----HD---- C:\WINDOWS\$NtUninstallKB2443105$
2011-11-06 11:59:45 ----HD---- C:\WINDOWS\$NtUninstallKB2229593$
2011-11-06 11:59:20 ----HD---- C:\WINDOWS\$NtUninstallKB2481109$
2011-11-06 11:59:08 ----HD---- C:\WINDOWS\$NtUninstallKB975713$
2011-11-06 11:59:02 ----HD---- C:\WINDOWS\$NtUninstallKB2485663$
2011-11-06 11:58:55 ----HD---- C:\WINDOWS\$NtUninstallKB2440591$
2011-11-06 11:58:47 ----HD---- C:\WINDOWS\$NtUninstallKB982132$
2011-11-06 11:58:40 ----HD---- C:\WINDOWS\$NtUninstallKB971657$
2011-11-06 11:58:32 ----HD---- C:\WINDOWS\$NtUninstallKB978338$
2011-11-06 11:58:21 ----HD---- C:\WINDOWS\$NtUninstallKB954155_WM9$
2011-11-06 11:58:15 ----HD---- C:\WINDOWS\$NtUninstallKB2507938$
2011-11-06 11:58:07 ----HD---- C:\WINDOWS\$NtUninstallKB972270$
2011-11-06 11:57:58 ----HD---- C:\WINDOWS\$NtUninstallKB2616676-v2$
2011-11-06 11:57:44 ----HD---- C:\WINDOWS\$NtUninstallKB2510581$
2011-11-06 11:57:36 ----HD---- C:\WINDOWS\$NtUninstallKB956744$
2011-11-06 11:57:29 ----HD---- C:\WINDOWS\$NtUninstallKB2476490$
2011-11-06 11:57:22 ----HD---- C:\WINDOWS\$NtUninstallKB974112$
2011-11-06 11:57:14 ----HD---- C:\WINDOWS\$NtUninstallKB2347290$
2011-11-06 11:57:05 ----HD---- C:\WINDOWS\$NtUninstallKB956844$
2011-11-06 11:56:52 ----HD---- C:\WINDOWS\$NtUninstallKB2483185$
2011-11-06 11:56:40 ----HD---- C:\WINDOWS\$NtUninstallKB2079403$
2011-11-06 11:52:30 ----HD---- C:\WINDOWS\$NtUninstallKB979687$
2011-11-06 11:52:20 ----HD---- C:\WINDOWS\$NtUninstallKB973869$
2011-11-06 11:52:09 ----HD---- C:\WINDOWS\$NtUninstallKB975025$
2011-11-06 11:51:57 ----HD---- C:\WINDOWS\$NtUninstallKB974571$
2011-11-06 11:51:47 ----HD---- C:\WINDOWS\$NtUninstallKB2567053$
2011-11-06 11:51:37 ----HD---- C:\WINDOWS\$NtUninstallKB2592799$
2011-11-06 11:51:25 ----HD---- C:\WINDOWS\$NtUninstallKB975560$
2011-11-06 11:51:09 ----HD---- C:\WINDOWS\$NtUninstallKB973507$
2011-11-06 11:50:58 ----HD---- C:\WINDOWS\$NtUninstallKB2570222$
2011-11-06 11:50:46 ----HD---- C:\WINDOWS\$NtUninstallKB2535512$
2011-11-06 11:50:36 ----HD---- C:\WINDOWS\$NtUninstallKB2412687$
2011-11-06 11:50:13 ----HD---- C:\WINDOWS\$NtUninstallKB973904$
2011-11-05 18:43:32 ----HD---- C:\WINDOWS\$NtUninstallKB977816$
2011-11-05 18:43:23 ----HD---- C:\WINDOWS\$NtUninstallKB973687$
2011-11-05 18:43:13 ----HD---- C:\WINDOWS\$NtUninstallKB978601$
2011-11-05 18:43:05 ----HD---- C:\WINDOWS\$NtUninstallKB2570947$
2011-11-05 18:42:58 ----HD---- C:\WINDOWS\$NtUninstallKB981322$
2011-11-05 18:42:47 ----HD---- C:\WINDOWS\$NtUninstallKB978695_WM9$
2011-11-05 18:39:50 ----HD---- C:\WINDOWS\$NtUninstallKB2507618$
2011-11-05 18:36:20 ----SD---- C:\Beruska.com25397B
2011-11-05 18:32:47 ----HD---- C:\WINDOWS\$NtUninstallKB973540_WM9$
2011-11-05 18:32:37 ----HD---- C:\WINDOWS\$NtUninstallKB2419632$
2011-11-05 18:32:29 ----HD---- C:\WINDOWS\$NtUninstallKB2508429$
2011-11-05 18:32:22 ----HD---- C:\WINDOWS\$NtUninstallKB974392$
2011-11-05 18:32:08 ----HD---- C:\WINDOWS\$NtUninstallKB971029$
2011-11-05 18:31:57 ----HD---- C:\WINDOWS\$NtUninstallKB2506212$
2011-11-05 18:31:49 ----HD---- C:\WINDOWS\$NtUninstallKB977914$
2011-11-05 18:31:39 ----HD---- C:\WINDOWS\$NtUninstallKB978542$
2011-11-05 18:31:31 ----HD---- C:\WINDOWS\$NtUninstallKB979309$
2011-11-05 18:31:24 ----HD---- C:\WINDOWS\$NtUninstallKB979482$
2011-11-05 18:31:18 ----HD---- C:\WINDOWS\$NtUninstallKB978706$
2011-11-05 18:31:08 ----HD---- C:\WINDOWS\$NtUninstallKB981997$
2011-11-05 18:30:58 ----HD---- C:\WINDOWS\$NtUninstallKB973815$
2011-11-05 18:30:40 ----HD---- C:\WINDOWS\$NtUninstallKB2586448$
2011-11-05 18:30:31 ----HD---- C:\WINDOWS\$NtUninstallKB975562$
2011-11-05 18:30:24 ----HD---- C:\WINDOWS\$NtUninstallKB2544893$
2011-11-05 18:30:16 ----HD---- C:\WINDOWS\$NtUninstallKB2509553$
2011-11-05 18:30:00 ----HD---- C:\WINDOWS\$NtUninstallKB982665$
2011-11-05 18:29:52 ----HD---- C:\WINDOWS\$NtUninstallKB2541763$
2011-11-05 18:29:45 ----HD---- C:\WINDOWS\$NtUninstallKB2544521$
2011-11-05 18:29:38 ----HD---- C:\WINDOWS\$NtUninstallKB2478960$
2011-11-05 18:29:22 ----HD---- C:\WINDOWS\$NtUninstallKB2393802$
2011-11-05 18:29:06 ----HD---- C:\WINDOWS\$NtUninstallKB2566454$
2011-11-05 18:28:57 ----HD---- C:\WINDOWS\$NtUninstallKB2562937$
2011-11-05 18:28:49 ----HD---- C:\WINDOWS\$NtUninstallKB975467$
2011-11-05 18:28:04 ----HD---- C:\WINDOWS\$NtUninstallKB968389$
2011-11-05 18:24:08 ----HD---- C:\WINDOWS\$NtUninstallKB2423089$
2011-11-05 18:23:23 ----HD---- C:\WINDOWS\$NtUninstallKB2360937$
2011-11-05 17:51:49 ----N---- C:\WINDOWS\system32\browserchoice.exe
2011-11-05 17:40:13 ----SHD---- C:\Recycled
2011-11-05 17:27:26 ----A---- C:\WINDOWS\system32\grpconv.exe
2011-11-05 17:17:07 ----A---- C:\Boot.bak
2011-11-05 17:17:04 ----RASHD---- C:\cmdcons
2011-11-05 14:34:22 ----D---- C:\Beruska.com
2011-11-05 14:27:29 ----A---- C:\WINDOWS\system32\drivers\aswSP.sys
2011-11-05 14:27:29 ----A---- C:\WINDOWS\system32\drivers\aswFsBlk.sys
2011-11-05 14:27:27 ----A---- C:\WINDOWS\system32\drivers\aswTdi.sys
2011-11-05 14:27:27 ----A---- C:\WINDOWS\system32\drivers\aswRdr.sys
2011-11-05 14:27:26 ----A---- C:\WINDOWS\system32\drivers\aswSnx.sys
2011-11-05 14:27:25 ----A---- C:\WINDOWS\system32\drivers\aswmon2.sys
2011-11-05 14:27:25 ----A---- C:\WINDOWS\system32\drivers\aswmon.sys
2011-11-05 14:27:25 ----A---- C:\WINDOWS\system32\drivers\aavmker4.sys
2011-11-05 14:27:01 ----A---- C:\WINDOWS\avastSS.scr
2011-11-05 14:27:00 ----A---- C:\WINDOWS\system32\aswBoot.exe
2011-11-05 14:26:43 ----D---- C:\Program Files\AVAST Software
2011-11-05 14:26:43 ----D---- C:\Documents and Settings\All Users\Application Data\AVAST Software
2011-11-05 07:08:10 ----D---- C:\Documents and Settings\R\Application Data\Malwarebytes
2011-11-05 07:07:56 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2011-11-05 07:07:51 ----A---- C:\WINDOWS\system32\drivers\mbam.sys
2011-11-05 07:07:50 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2011-11-01 17:26:54 ----A---- C:\Documents and Settings\R\Application Data\AutoGK.ini
2011-11-01 14:55:31 ----D---- C:\Program Files\Free DVD Ripper
2011-10-23 16:27:20 ----D---- C:\Documents and Settings\R\Application Data\MoneyManagerEx
2011-10-23 16:27:13 ----D---- C:\Program Files\MoneyManagerEX
2011-10-18 17:13:24 ----D---- C:\Program Files\Gmail Notifier
2011-10-18 16:26:28 ----D---- C:\Program Files\Google

======List of files/folders modified in the last 1 month======

2011-11-09 13:34:18 ----A---- C:\WINDOWS\wincmd.ini
2011-11-09 12:52:18 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-11-06 14:52:44 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2011-11-05 17:32:14 ----A---- C:\WINDOWS\system.ini
2011-11-05 17:17:08 ----RASH---- C:\boot.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 a347bus;a347bus; C:\WINDOWS\system32\DRIVERS\a347bus.sys [2004-04-30 160640]
R0 a347scsi;a347scsi; C:\WINDOWS\System32\Drivers\a347scsi.sys [2004-04-30 5248]
R0 drvmcdb;drvmcdb; C:\WINDOWS\system32\drivers\drvmcdb.sys [2004-08-04 87136]
R0 prohlp02;StarForce Protection Helper Driver v2; C:\WINDOWS\System32\drivers\prohlp02.sys [2004-08-09 114016]
R0 prosync1;StarForce Protection Synchronization Driver v1; C:\WINDOWS\System32\drivers\prosync1.sys [2004-07-19 7040]
R0 PxHelp20;PxHelp20; C:\WINDOWS\system32\DRIVERS\PxHelp20.sys [2006-09-27 36560]
R0 sfdrv01;StarForce Protection Environment Driver (version 1.x); C:\WINDOWS\System32\drivers\sfdrv01.sys [2005-03-03 48640]
R0 sfhlp01;StarForce Protection Helper Driver; C:\WINDOWS\System32\drivers\sfhlp01.sys [2003-12-01 4832]
R0 sfhlp02;StarForce Protection Helper Driver (version 2.x); C:\WINDOWS\System32\drivers\sfhlp02.sys [2005-02-23 6656]
R0 sfsync02;StarForce Protection Synchronization Driver (version 2.x); C:\WINDOWS\System32\drivers\sfsync02.sys [2004-12-03 20544]
R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2008-10-11 664064]
R0 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2011-09-06 30808]
R1 APPDRV;APPDRV; C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS [2004-08-18 16128]
R1 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2011-09-06 34392]
R1 aswSnx;aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [2011-09-06 442200]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2011-09-06 320856]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2011-09-06 52568]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14592]
R1 OMCI;OMCI; C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS [2001-08-22 13632]
R1 prodrv06;StarForce Protection Environment Driver v6; C:\WINDOWS\System32\drivers\prodrv06.sys [2004-08-09 53920]
R1 sp_rsdrv2;Spyware Terminator 2012 Realtime Shield Driver; \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys []
R1 sscdbhk5;sscdbhk5; C:\WINDOWS\system32\drivers\sscdbhk5.sys [2004-07-14 5627]
R1 ssrtln;ssrtln; C:\WINDOWS\system32\drivers\ssrtln.sys [2004-07-14 23545]
R1 Tosrfcom;Bluetooth RFCOMM from TOSHIBA; C:\WINDOWS\System32\Drivers\tosrfcom.sys [2004-10-04 62799]
R1 truecrypt;truecrypt; C:\WINDOWS\System32\drivers\truecrypt.sys [2011-07-16 231248]
R1 vsdatant;vsdatant; C:\WINDOWS\System32\vsdatant.sys [2010-05-13 532224]
R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-12 12032]
R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.2.0.3; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2007-04-29 17801]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2011-09-06 20568]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2011-09-06 110552]
R2 drvnddm;drvnddm; C:\WINDOWS\system32\drivers\drvnddm.sys [2004-08-13 40544]
R2 ISWKL;ZoneAlarm Toolbar ISWKL; \??\C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys []
R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2004-03-17 13059]
R2 s24trans;WLAN Transport; C:\WINDOWS\system32\DRIVERS\s24trans.sys [2004-08-31 11354]
R2 tfsnboio;tfsnboio; C:\WINDOWS\system32\dla\tfsnboio.sys [2004-08-13 25723]
R2 tfsncofs;tfsncofs; C:\WINDOWS\system32\dla\tfsncofs.sys [2004-08-13 34843]
R2 tfsndrct;tfsndrct; C:\WINDOWS\system32\dla\tfsndrct.sys [2004-08-13 4123]
R2 tfsndres;tfsndres; C:\WINDOWS\system32\dla\tfsndres.sys [2004-08-13 2239]
R2 tfsnifs;tfsnifs; C:\WINDOWS\system32\dla\tfsnifs.sys [2004-08-13 86202]
R2 tfsnopio;tfsnopio; C:\WINDOWS\system32\dla\tfsnopio.sys [2004-08-13 14715]
R2 tfsnpool;tfsnpool; C:\WINDOWS\system32\dla\tfsnpool.sys [2004-08-13 6363]
R2 tfsnudf;tfsnudf; C:\WINDOWS\system32\dla\tfsnudf.sys [2004-08-13 98714]
R2 tfsnudfa;tfsnudfa; C:\WINDOWS\system32\dla\tfsnudfa.sys [2004-08-13 100603]
R3 ApfiltrService;Alps Touch Pad Filter Driver for Windows 2000/XP; C:\WINDOWS\system32\DRIVERS\Apfiltr.sys [2004-11-16 108791]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2004-12-03 800768]
R3 b57w2k;Broadcom NetXtreme Gigabit Ethernet Adapter; C:\WINDOWS\system32\DRIVERS\b57xp32.sys [2006-01-27 150528]
R3 BCM43XX;Ovladač bezdrátové karty Dell WLAN; C:\WINDOWS\system32\DRIVERS\bcmwl5.sys [2006-10-12 604928]
R3 dtscsi;dtscsi; C:\WINDOWS\System32\Drivers\dtscsi.sys [2008-10-11 223128]
R3 GEARAspiWDM;GEARAspiWDM; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2006-09-19 15664]
R3 GTIPCI21;GTIPCI21; C:\WINDOWS\system32\DRIVERS\gtipci21.sys [2004-05-03 80384]
R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 HSF_DPV;HSF_DPV; C:\WINDOWS\system32\DRIVERS\HSF_DPV.SYS [2005-05-03 1033728]
R3 HSFHWICH;HSFHWICH; C:\WINDOWS\system32\DRIVERS\HSFHWICH.sys [2005-05-03 208384]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
R3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\WINDOWS\System32\Drivers\RootMdm.sys [2004-08-12 5888]
R3 STAC97;SigmaTel C-Major Audio; C:\WINDOWS\system32\drivers\STAC97.sys [2005-03-10 273168]
R3 tosporte;Bluetooth Port Driver from Toshiba; C:\WINDOWS\system32\DRIVERS\tosporte.sys [2005-01-08 51582]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys [2005-05-03 705408]
S1 eb09a39e;eb09a39e; C:\WINDOWS\System32\drivers\eb09a39e.sys []
S3 BthEnum;Bluetooth Enumerator Service; C:\WINDOWS\system32\DRIVERS\BthEnum.sys [2008-04-13 17024]
S3 BthPan;Bluetooth Device (Personal Area Network); C:\WINDOWS\system32\DRIVERS\bthpan.sys [2008-04-13 101120]
S3 BTHPORT;Bluetooth Port Driver; C:\WINDOWS\System32\Drivers\BTHport.sys [2008-06-13 272128]
S3 BTHUSB;Bluetooth Radio USB Driver; C:\WINDOWS\System32\Drivers\BTHUSB.sys [2008-04-13 18944]
S3 bvrp_pci;bvrp_pci; C:\WINDOWS\system32\drivers\bvrp_pci.sys []
S3 pcouffin;VSO Software pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [2008-01-01 47360]
S3 Point32;Microsoft IntelliPoint Filter Driver; C:\WINDOWS\system32\DRIVERS\point32.sys [2004-06-03 20352]
S3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\WINDOWS\system32\DRIVERS\rfcomm.sys [2008-04-13 59136]
S3 s217bus;Sony Ericsson Device 217 driver (WDM); C:\WINDOWS\system32\DRIVERS\s217bus.sys [2007-11-02 83496]
S3 s217mdfl;Sony Ericsson Device 217 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\s217mdfl.sys [2007-11-02 15016]
S3 s217mdm;Sony Ericsson Device 217 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\s217mdm.sys [2007-11-02 109992]
S3 s217mgmt;Sony Ericsson Device 217 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\s217mgmt.sys [2007-11-02 103976]
S3 s217nd5;Sony Ericsson Device 217 USB Ethernet Emulation SEMC217 (NDIS); C:\WINDOWS\system32\DRIVERS\s217nd5.sys [2007-11-02 24872]
S3 s217obex;Sony Ericsson Device 217 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\s217obex.sys [2007-11-02 100008]
S3 s217unic;Sony Ericsson Device 217 USB Ethernet Emulation SEMC217 (WDM); C:\WINDOWS\system32\DRIVERS\s217unic.sys [2007-11-02 105896]
S3 toshidpt;TOSHIBA Bluetooth HID port driver; C:\WINDOWS\system32\drivers\Toshidpt.sys [2002-10-16 2851]
S3 Tosrfbd;Bluetooth RFBUS from TOSHIBA; C:\WINDOWS\System32\Drivers\tosrfbd.sys [2004-12-24 97792]
S3 Tosrfbnp;Bluetooth RFBNEP from TOSHIBA; C:\WINDOWS\System32\Drivers\tosrfbnp.sys [2004-07-08 36531]
S3 Tosrfhid;Bluetooth RFHID from TOSHIBA; C:\WINDOWS\system32\DRIVERS\Tosrfhid.sys [2004-11-15 50048]
S3 tosrfnds;Bluetooth Personal Area Network from TOSHIBA; C:\WINDOWS\system32\DRIVERS\tosrfnds.sys [2005-01-06 18612]
S3 TosRfSnd;Bluetooth Audio Device (WDM) from TOSHIBA; C:\WINDOWS\system32\drivers\TosRfSnd.sys [2004-12-15 50048]
S3 Tosrfusb;Bluetooth USB Controller; C:\WINDOWS\System32\Drivers\tosrfusb.sys [2004-12-21 34816]
S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2004-12-03 405504]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2011-09-06 44768]
R2 BthServ;Bluetooth Support Service; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 EvtEng;EvtEng; C:\Program Files\Intel\Wireless\Bin\EvtEng.exe [2004-09-07 86016]
R2 IswSvc;ZoneAlarm Toolbar IswSvc; C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe [2011-02-15 488952]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-04-12 153376]
R2 NICCONFIGSVC;NICCONFIGSVC; C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe [2004-11-11 356352]
R2 RegSrvc;RegSrvc; C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe [2004-09-07 139264]
R2 S24EventMonitor;Spectrum24 Event Monitor; C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe [2004-09-07 360521]
R2 ST2012_Svc;Spyware Terminator 2012 Realtime Shield Service; C:\Program Files\Spyware Terminator\st_rsser.exe [2011-09-28 482992]
R2 vsmon;TrueVector Internet Monitor; C:\WINDOWS\system32\ZONELABS\vsmon.exe [2011-03-18 2435592]
R2 WLANKEEPER;WLANKEEPER; C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe [2004-09-07 225353]
R2 wltrysvc;Dell Wireless WLAN Tray Service; C:\WINDOWS\System32\WLTRYSVC.EXE [2006-11-01 20480]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2007-03-14 500800]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 microsoft office groove audit service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------
Nahoru
Avatar uživatele
chodnik74
Přítel fóra
Přítel fóra
Příspěvky: 4975
Registrován: 13 Zář 2010 21:30
Místo/Bydliště: Napajedla
Kontaktovat uživatele:
Kontaktovat uživatele chodnik74

Re: PUP:Win32:FunWeb a PUP:Win32:PUP-gen log z RSIT priloz

#2 Příspěvek od chodnik74 »

Dobrý den :welcome:
vypadá to, že havěť je opravdu aktivní...

Program nepoužívejte bez doporučení Rádce a pozorně se řiďte následujících pokynu,protože program netoleruje chyby a může dojít k úplnému poškození systému!!
  • :arrow: Stáhneme si Combofix Obrázek
  • Program uložíme nejlépe na Plochu
  • Vypneme všechny rezidentní štíty.Jak antiviru,tak antispywaru a firewallu
  • Vypneme všechny běžící aplikace (ICQ,prohlížeč,programy) a necháme pouze Combofix
  • Spustíme Combofix.exe s administrátorským oprávněním
    U Windows XP se přihlásíme pod účtem správce
    Ve Windows 7 a Vista klikněte pravým tlačítkem myši na Combofix.exe a dejte ,,Spustit jako správce,,)
  • Hned po startu programu na vás vyskočí licenční podmínky,tak potvrdíme tlačítkemANO
  • Pokud vám Combofix nabídne instalaci Konzoly pro zotavení,tak souhlaste a nechte nainstalovat(zde je potřeba aktivní připojení na internet)
  • Pokračujte dle pokynů programu a během skenování na nic neklikejte,na pc nepracujte(ICQ,jiné aplikace,internet..).Nechte počítač v klidu.
  • Celý sken tvá mezi 5-15 min,ale pokud je v PC hodně havěti,tak se čas může lišit.
  • Po skončení skenování(případném restartu počítače) se vám zobrazí log z Combofixu,který mi vložte sem(Kdyby se log nezobrazil,tak jej najdete zde: C:\ComboFix.txt
  • (Pokud si nevíte rady s kterýmkoliv z výše uvedených kroků,tak se ptejte nebo mrkněte na detailnější návod včetně obrázků http://www.bleepingcomputer.com/combofi ... t-combofix )
Napiš mi: chodnik74@gmail.com nebo Obrázek

>RSIT<>MBAM<>VirusTotal

Doporučuji:Obrázek | Obrázek

:!: Postup si raději vícekrát přečtěte a v případě jakýchkoliv nejasností či pochybností se ptejte. ;-) Pokud máte infikovaný počítač nebo se nechová jako obvykle, tak si zálohujte všechny data a pozorně postupujte dle pokynů rádce! :!:

:!: Nepoužívejte utilitu Combofix bez dohledu a doporučení rádce!

:idea: Jste s naší pomocí spokojeni :???: Neváhejte a podpořte forum ZDE.

Pravidla fora: č.1 a č.2
Nahoru
cipisekcz
Návštěvník
Návštěvník
Příspěvky: 7
Registrován: 09 Lis 2011 14:13

Re: PUP:Win32:FunWeb a PUP:Win32:PUP-gen log z RSIT priloz

#3 Příspěvek od cipisekcz »

Tak log jsem vyrobil.Jeste se chci zeptat.Nevim jestli to stim souvisi,ale zonealarm se me obcas zepta na toto
Auto Update Checker - chk.exe jestli povolit,nebo zakazat?




ComboFix 11-11-08.02 - R 09.11.2011 17:13:41.2.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.650 [GMT 1:00]
Running from: d:\e - archiv\01. - DOWNLOAD - Internet\DOWNLOAD - Direct Connect\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: AVG Anti-Virus *Disabled/Outdated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: ZoneAlarm Firewall *Disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
* Created a new restore point
.
.
((((((((((((((((((((((((( Files Created from 2011-10-09 to 2011-11-09 )))))))))))))))))))))))))))))))
.
.
2011-11-09 15:23 . 2009-08-06 18:23 215920 ----a-w- c:\windows\system32\muweb.dll
2011-11-09 15:23 . 2009-08-06 18:23 274288 ----a-w- c:\windows\system32\mucltui.dll
2011-11-09 15:23 . 2011-11-09 15:23 -------- d-----w- c:\windows\LastGood
2011-11-09 11:12 . 2011-11-09 11:12 -------- d-----w- c:\program files\Crawler
2011-11-09 11:12 . 2011-06-21 10:24 32768 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2011-11-09 11:12 . 2011-11-09 11:12 -------- d-----w- c:\documents and settings\R\Application Data\Spyware Terminator
2011-11-09 11:12 . 2011-11-09 11:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Spyware Terminator
2011-11-09 11:08 . 2011-11-09 11:08 -------- d-----w- c:\program files\Spyware Terminator
2011-11-09 11:02 . 2011-11-09 11:03 -------- d-----w- c:\documents and settings\R\Application Data\CheckPoint
2011-11-09 11:02 . 2011-11-09 11:02 -------- d-----w- c:\program files\Conduit
2011-11-09 11:02 . 2011-11-09 11:02 -------- d-----w- c:\documents and settings\R\Local Settings\Application Data\ZoneAlarm_Security
2011-11-09 11:02 . 2011-11-09 11:02 -------- d-----w- c:\documents and settings\R\Local Settings\Application Data\Conduit
2011-11-09 11:02 . 2011-11-09 11:02 -------- d-----w- c:\program files\ZoneAlarm_Security
2011-11-09 11:01 . 2011-11-09 11:01 -------- d-----w- c:\program files\CheckPoint
2011-11-09 11:01 . 2011-03-18 00:24 69120 ----a-w- c:\windows\system32\zlcomm.dll
2011-11-09 11:01 . 2011-03-18 00:24 104448 ----a-w- c:\windows\system32\zlcommdb.dll
2011-11-09 11:01 . 2011-03-18 00:24 1238528 ----a-w- c:\windows\system32\zpeng25.dll
2011-11-09 11:01 . 2011-11-09 11:01 -------- d-----w- c:\program files\Zone Labs
2011-11-06 14:09 . 2011-11-06 14:09 -------- d-----w- c:\program files\trend micro
2011-11-06 14:09 . 2011-11-06 14:09 -------- d-----w- C:\rsit
2011-11-06 13:52 . 2011-11-06 13:52 -------- d-----w- c:\program files\CCleaner
2011-11-05 16:56 . 2010-08-23 16:12 617472 ------w- c:\windows\system32\dllcache\comctl32.dll
2011-11-05 16:55 . 2010-09-18 06:53 953856 ------w- c:\windows\system32\dllcache\mfc40u.dll
2011-11-05 16:55 . 2010-06-14 14:31 744448 ------w- c:\windows\system32\dllcache\helpsvc.exe
2011-11-05 16:54 . 2009-11-21 15:51 471552 ------w- c:\windows\system32\dllcache\aclayers.dll
2011-11-05 16:54 . 2010-08-27 08:02 119808 ------w- c:\windows\system32\dllcache\t2embed.dll
2011-11-05 16:54 . 2009-10-15 16:28 81920 ------w- c:\windows\system32\dllcache\fontsub.dll
2011-11-05 16:51 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
2011-11-05 16:50 . 2010-11-02 15:17 40960 ------w- c:\windows\system32\dllcache\ndproxy.sys
2011-11-05 16:50 . 2009-06-21 21:44 153088 ------w- c:\windows\system32\dllcache\triedit.dll
2011-11-05 16:50 . 2011-06-24 14:10 139656 ------w- c:\windows\system32\dllcache\rdpwd.sys
2011-11-05 16:48 . 2011-04-21 13:37 105472 ------w- c:\windows\system32\dllcache\mup.sys
2011-11-05 16:42 . 2010-06-18 13:36 3558912 ------w- c:\windows\system32\dllcache\moviemk.exe
2011-11-05 16:40 . 2011-04-29 19:07 852480 ------w- c:\windows\system32\dllcache\vgx.dll
2011-11-05 16:40 . 2011-07-08 14:02 10496 ------w- c:\windows\system32\dllcache\ndistapi.sys
2011-11-05 16:37 . 2010-10-11 14:59 45568 ------w- c:\windows\system32\dllcache\wab.exe
2011-11-05 16:27 . 2008-04-14 01:12 39424 ----a-w- c:\windows\system32\grpconv.exe
2011-11-05 16:27 . 2008-04-14 01:12 39424 ----a-w- c:\windows\system32\dllcache\grpconv.exe
2011-11-05 13:34 . 2011-11-05 13:34 -------- d-----w- C:\Beruska.com
2011-11-05 13:27 . 2011-09-06 21:37 320856 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-11-05 13:27 . 2011-09-06 21:36 20568 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-11-05 13:27 . 2011-09-06 21:36 34392 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-11-05 13:27 . 2011-09-06 21:36 52568 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-11-05 13:27 . 2011-09-06 21:38 442200 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-11-05 13:27 . 2011-09-06 21:36 110552 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2011-11-05 13:27 . 2011-09-06 21:36 104536 ----a-w- c:\windows\system32\drivers\aswmon.sys
2011-11-05 13:27 . 2011-09-06 21:33 30808 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2011-11-05 13:27 . 2011-09-06 21:45 41184 ----a-w- c:\windows\avastSS.scr
2011-11-05 13:27 . 2011-09-06 21:45 199304 ----a-w- c:\windows\system32\aswBoot.exe
2011-11-05 13:26 . 2011-11-05 13:26 -------- d-----w- c:\program files\AVAST Software
2011-11-05 13:26 . 2011-11-05 13:26 -------- d-----w- c:\documents and settings\All Users\Application Data\AVAST Software
2011-11-05 10:16 . 2011-11-05 10:16 -------- d-----w- c:\documents and settings\Administrator
2011-11-05 06:08 . 2011-11-05 06:08 -------- d-----w- c:\documents and settings\R\Application Data\Malwarebytes
2011-11-05 06:07 . 2011-11-05 06:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-11-05 06:07 . 2011-08-31 16:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-11-05 06:07 . 2011-11-05 06:07 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-11-01 13:55 . 2011-11-01 13:55 -------- d-----w- c:\program files\Free DVD Ripper
2011-10-23 15:27 . 2011-10-23 15:27 -------- d-----w- c:\documents and settings\R\Application Data\MoneyManagerEx
2011-10-23 15:27 . 2011-10-23 15:27 -------- d-----w- c:\program files\MoneyManagerEX
2011-10-22 08:41 . 2011-10-22 08:41 -------- d-----w- c:\documents and settings\R\Local Settings\Application Data\GmailNotifierPro
2011-10-18 16:13 . 2011-10-18 16:13 -------- d-----w- c:\program files\Gmail Notifier
2011-10-18 15:26 . 2011-10-18 15:26 -------- d-----w- c:\program files\Google
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-12 05:42 . 2011-05-25 12:54 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-09-26 10:41 . 2006-10-20 20:29 611328 ----a-w- c:\windows\system32\uiautomationcore.dll
2011-09-26 10:41 . 2004-08-12 12:25 220160 ----a-w- c:\windows\system32\oleacc.dll
2011-09-26 10:41 . 2004-08-12 12:25 20480 ----a-w- c:\windows\system32\oleaccrc.dll
2011-09-09 09:12 . 2004-08-12 12:18 599040 ----a-w- c:\windows\system32\crypt32.dll
2011-09-06 13:20 . 2004-08-12 12:33 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-09-05 13:56 . 2010-02-03 17:21 81920 ----a-w- c:\windows\system32\ieencode.dll
2011-09-05 13:56 . 2004-08-12 12:33 667136 ----a-w- c:\windows\system32\wininet.dll
2011-09-05 13:56 . 2004-08-12 12:30 61952 ----a-w- c:\windows\system32\tdc.ocx
2011-09-05 12:35 . 2004-08-12 12:19 369664 ----a-w- c:\windows\system32\html.iec
2011-08-17 13:49 . 2004-08-12 12:17 138496 ----a-w- c:\windows\system32\drivers\afd.sys
2006-05-03 10:06 163328 --sha-r- c:\windows\system32\flvDX.dll
2007-02-21 11:47 31232 --sha-r- c:\windows\system32\msfDX.dll
2008-03-16 13:30 216064 --sha-r- c:\windows\system32\nbDX.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[7] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\atapi.sys
[7] 2004-08-12 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\ReinstallBackups\0006\DriverFiles\i386\atapi.sys
[-] 2004-08-03 21:59 . !HASH: COULD NOT OPEN FILE !!!!! . 95360 . . [------] . . c:\windows\system32\drivers\atapi.sys
[7] 2004-08-03 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\atapi.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{91da5e8a-3318-4f8c-b67e-5964de3ab546}]
2011-05-09 09:49 176936 ----a-w- c:\program files\ZoneAlarm_Security\prxtbZone.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{91da5e8a-3318-4f8c-b67e-5964de3ab546}"= "c:\program files\ZoneAlarm_Security\prxtbZone.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{91da5e8a-3318-4f8c-b67e-5964de3ab546}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{91DA5E8A-3318-4F8C-B67E-5964DE3AB546}"= "c:\program files\ZoneAlarm_Security\prxtbZone.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{91da5e8a-3318-4f8c-b67e-5964de3ab546}]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-09-06 21:45 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
"VerControl"="c:\docume~1\R\LOCALS~1\TempImg\VerControl.exe" [2010-10-04 339968]
"chk"="c:\docume~1\R\LOCALS~1\TempCkt\chk.exe" [2010-07-22 339968]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Dell Wireless Manager UI"="c:\windows\system32\WLTRAY" [X]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\point32.exe" [2004-06-03 204800]
"Dell QuickSet"="c:\program files\Dell\QuickSet\QuickSet.exe" [2004-11-10 598016]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2004-09-13 155648]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 385024]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-12-03 344064]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-08-13 122939]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-07 110592]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2007-03-14 257088]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2006-11-01 1392640]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-26 53248]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2005-11-08 128920]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-10-19 286720]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-09-06 3722416]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2011-03-18 1043968]
"ISW"="c:\program files\CheckPoint\ZAForceField\ForceField.exe" [2011-02-15 738808]
"SpywareTerminatorShield"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2011-09-28 2775728]
"SpywareTerminatorUpdater"="c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe" [2011-09-28 3609776]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2007-10-23 443968]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
.
c:\documents and settings\R\Start Menu\Programs\Startup\
Stickies.lnk - d:\program files\stickies\stickies.exe [2004-10-26 335872]
OpenOffice.org 2.0.lnk - h:\system\Apps\236C571E-47D6-4a73-AD5A-97F1E555E375\Exec\openoffice\program\quickstart.exe [N/A]
Výrezy obrazovky a spuštení aplikace OneNote 2007.lnk - [N/A]
KooBits 4.lnk - c:\program files\KooBits 4.0\KooBits 4.0.exe [N/A]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe [2004-12-21 45056]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-5-6 113664]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
2004-09-07 15:08 110592 ----a-w- c:\program files\Intel\Wireless\Bin\LgNotify.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\WINDOWS\\System32\\dpnsvr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Intel\\Wireless\\Bin\\ZcfgSvc.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\groove.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\WINDOWS\\System32\\ZoneLabs\\vsmon.exe"=
"c:\\Program Files\\Spyware Terminator\\SpywareTerminator.exe"=
"c:\\Program Files\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26155:TCP"= 26155:TCP:BitComet 26155 TCP
"26155:UDP"= 26155:UDP:BitComet 26155 UDP
.
R0 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [31.5.2007 17:02 160640]
R0 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [31.5.2007 17:02 5248]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [11.10.2008 10:42 664064]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [5.11.2011 14:27 442200]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [5.11.2011 14:27 320856]
R1 sp_rsdrv2;Spyware Terminator 2012 Realtime Shield Driver;c:\windows\system32\drivers\sp_rsdrv2.sys [9.11.2011 12:12 32768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [5.11.2011 14:27 20568]
R2 ISWKL;ZoneAlarm Toolbar ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [15.2.2011 16:25 26872]
R2 IswSvc;ZoneAlarm Toolbar IswSvc;c:\program files\CheckPoint\ZAForceField\ISWSVC.exe [15.2.2011 16:25 488952]
R2 ST2012_Svc;Spyware Terminator 2012 Realtime Shield Service;c:\program files\Spyware Terminator\st_rsser.exe [9.11.2011 12:11 482992]
R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [3.5.2004 16:26 80384]
S1 eb09a39e;eb09a39e;c:\windows\system32\drivers\eb09a39e.sys [11.6.2009 9:45 0]
S3 pcouffin;VSO Software pcouffin;c:\windows\system32\drivers\pcouffin.sys [1.1.2008 16:03 47360]
.
Contents of the 'Scheduled Tasks' folder
.
2011-10-21 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
2011-11-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-854245398-1801674531-725345543-1003Core1cc9078f756b2d2.job
- c:\documents and settings\R\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-09-11 11:38]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.crawler.com/homepage.aspx?tbid=60747
uSearchURL,(Default) = hxxp://www.forumswatcher.com/search.htm
IE: Crawler Search - tbr:iemenu
IE: e&xportovat do aplikace microsoft excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 213.46.172.36 213.46.172.37
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\Toolbar\ctbr.dll
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-11-09 17:22
Windows 5.1.2600 Service Pack 3 FAT NTAPI
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-854245398-1801674531-725345543-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(960)
c:\windows\system32\Ati2evxx.dll
c:\windows\System32\BCMLogon.dll
c:\program files\Intel\Wireless\Bin\LgNotify.dll
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
.
- - - - - - - > 'lsass.exe'(1020)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
.
- - - - - - - > 'explorer.exe'(4356)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll
.
Completion time: 2011-11-09 17:26:37
ComboFix-quarantined-files.txt 2011-11-09 16:26
.
Pre-Run: 2 345 811 968 bytes free
Post-Run: 2 331 803 648 bytes free
.
- - End Of File - - 051D05EDF8B89C9F9E53B19FB0731428
Nahoru
Avatar uživatele
chodnik74
Přítel fóra
Přítel fóra
Příspěvky: 4975
Registrován: 13 Zář 2010 21:30
Místo/Bydliště: Napajedla
Kontaktovat uživatele:
Kontaktovat uživatele chodnik74

Re: PUP:Win32:FunWeb a PUP:Win32:PUP-gen log z RSIT priloz

#4 Příspěvek od chodnik74 »

Vidím zbytky po AVG, čili odinstalujte touto utilitou :)

http://download.avg.com/filedir/util/av ... 2_1796.exe

:arrow: Odinstalujte Spyware Terminator,Conduit engine


:arrow: Otevřeme si Poznámkový blok Obrázek
  • (stiskneme klávesovou kombinaci WIN+R a napíšeme ,,notepad,, bez úvozovek a dáme enter)
  • Vložíme do něj následující script:

    Kód: Vybrat vše

    
KillAll::

Restore::
c:\windows\system32\drivers\atapi.sys

Folder::
c:\docume~1\R\LOCALS~1\TempCkt\
c:\docume~1\R\LOCALS~1\TempImg\

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"updateMgr"=-
"VerControl"=-
"chk"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Dell Wireless Manager UI"="c:\windows\system32\WLTRAY" [X]
"NeroFilterCheck"=-
"ATIPTA"=-
"UpdateManager"=-
"iTunesHelper"=-
"DVDLauncher"=-
"DAEMON Tools"=-
"QuickTime Task"=-
"GrooveMonitor"=-
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000000

Driver::
eb09a39e

DDS::
uStart Page = hxxp://www.crawler.com/homepage.aspx?tbid=60747
uSearchURL,(Default) = hxxp://www.forumswatcher.com/search.htm

File::
c:\windows\system32\drivers\eb09a39e.sys

RegLock::
[HKEY_USERS\S-1-5-21-854245398-1801674531-725345543-1003\Software\Microsoft\SystemCertificates\AddressBook*]

RegNull::
[HKEY_USERS\S-1-5-21-854245398-1801674531-725345543-1003\Software\Microsoft\SystemCertificates\AddressBook*]

Reboot::
  • Soubor uložíme na Plochu jako CFScript.txt
  • Poté tento soubor uchopíme levým tlačítkem myši a přetáhneme na ikonu Combofixu a upustíme

    Obrázek
  • Poté Combofix provede všechny operace a udělá nový log,který sem vložte
:!: Může se stát,že po aplikaci scriptu nenaběhne Windows běžným způsobem.V tomto případě restartujte počítač a při startu mačkejte F8 a zvolte možnost Poslední známá funkční konfigurace
Napiš mi: chodnik74@gmail.com nebo Obrázek

>RSIT<>MBAM<>VirusTotal

Doporučuji:Obrázek | Obrázek

:!: Postup si raději vícekrát přečtěte a v případě jakýchkoliv nejasností či pochybností se ptejte. ;-) Pokud máte infikovaný počítač nebo se nechová jako obvykle, tak si zálohujte všechny data a pozorně postupujte dle pokynů rádce! :!:

:!: Nepoužívejte utilitu Combofix bez dohledu a doporučení rádce!

:idea: Jste s naší pomocí spokojeni :???: Neváhejte a podpořte forum ZDE.

Pravidla fora: č.1 a č.2
Nahoru
cipisekcz
Návštěvník
Návštěvník
Příspěvky: 7
Registrován: 09 Lis 2011 14:13

Re: PUP:Win32:FunWeb a PUP:Win32:PUP-gen log z RSIT priloz

#5 Příspěvek od cipisekcz »

ComboFix 11-11-09.01 - R 09.11.2011 18:32:23.3.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.607 [GMT 1:00]
Running from: d:\e - archiv\01. - DOWNLOAD - Internet\DOWNLOAD - Direct Connect\ComboFix.exe
Command switches used :: c:\documents and settings\R\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: AVG Anti-Virus *Disabled/Outdated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: ZoneAlarm Firewall *Disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.
FILE ::
"c:\windows\system32\drivers\eb09a39e.sys"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\docume~1\R\LOCALS~1\TempCkt
c:\docume~1\R\LOCALS~1\TempCkt\chk.exe
c:\docume~1\R\LOCALS~1\TempImg
c:\docume~1\R\LOCALS~1\TempImg\facemoods.exe
c:\docume~1\R\LOCALS~1\TempImg\FVM.exe
c:\docume~1\R\LOCALS~1\TempImg\chk.exe
c:\docume~1\R\LOCALS~1\TempImg\Installer.exe
c:\docume~1\R\LOCALS~1\TempImg\ioClean.ini
c:\docume~1\R\LOCALS~1\TempImg\log.txt
c:\docume~1\R\LOCALS~1\TempImg\silent-ringtonejunkiez-installer.exe
c:\docume~1\R\LOCALS~1\TempImg\VerControl.exe
.
Infected copy of c:\windows\system32\drivers\atapi.sys was found and disinfected
Restored copy from - c:\windows\ServicePackFiles\i386\atapi.sys
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_eb09a39e
.
.
((((((((((((((((((((((((( Files Created from 2011-10-09 to 2011-11-09 )))))))))))))))))))))))))))))))
.
.
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-12 05:42 . 2011-05-25 12:54 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-09-26 10:41 . 2006-10-20 20:29 611328 ----a-w- c:\windows\system32\uiautomationcore.dll
2011-09-26 10:41 . 2004-08-12 12:25 220160 ----a-w- c:\windows\system32\oleacc.dll
2011-09-26 10:41 . 2004-08-12 12:25 20480 ----a-w- c:\windows\system32\oleaccrc.dll
2011-09-09 09:12 . 2004-08-12 12:18 599040 ----a-w- c:\windows\system32\crypt32.dll
2011-09-06 13:20 . 2004-08-12 12:33 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-09-05 13:56 . 2010-02-03 17:21 81920 ----a-w- c:\windows\system32\ieencode.dll
2011-09-05 13:56 . 2004-08-12 12:33 667136 ----a-w- c:\windows\system32\wininet.dll
2011-09-05 13:56 . 2004-08-12 12:30 61952 ----a-w- c:\windows\system32\tdc.ocx
2011-09-05 12:35 . 2004-08-12 12:19 369664 ----a-w- c:\windows\system32\html.iec
2011-08-17 13:49 . 2004-08-12 12:17 138496 ----a-w- c:\windows\system32\drivers\afd.sys
2006-05-03 10:06 163328 --sha-r- c:\windows\system32\flvDX.dll
2007-02-21 11:47 31232 --sha-r- c:\windows\system32\msfDX.dll
2008-03-16 13:30 216064 --sha-r- c:\windows\system32\nbDX.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2008-04-13 19:40 . !HASH: COULD NOT OPEN FILE !!!!! . 96512 . . [------] . . c:\windows\system32\drivers\atapi.sys
[7] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\atapi.sys
[7] 2004-08-12 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\ReinstallBackups\0006\DriverFiles\i386\atapi.sys
[7] 2004-08-03 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\atapi.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{91da5e8a-3318-4f8c-b67e-5964de3ab546}]
2011-05-09 09:49 176936 ----a-w- c:\program files\ZoneAlarm_Security\prxtbZone.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{91da5e8a-3318-4f8c-b67e-5964de3ab546}"= "c:\program files\ZoneAlarm_Security\prxtbZone.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{91da5e8a-3318-4f8c-b67e-5964de3ab546}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{91DA5E8A-3318-4F8C-B67E-5964DE3AB546}"= "c:\program files\ZoneAlarm_Security\prxtbZone.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{91da5e8a-3318-4f8c-b67e-5964de3ab546}]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-09-06 21:45 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Dell Wireless Manager UI"="c:\windows\system32\WLTRAY" [X]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\point32.exe" [2004-06-03 204800]
"Dell QuickSet"="c:\program files\Dell\QuickSet\QuickSet.exe" [2004-11-10 598016]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2004-09-13 155648]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 385024]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-08-13 122939]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2006-11-01 1392640]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-09-06 3722416]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2011-03-18 1043968]
"ISW"="c:\program files\CheckPoint\ZAForceField\ForceField.exe" [2011-02-15 738808]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2007-10-23 443968]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
.
c:\documents and settings\R\Start Menu\Programs\Startup\
Stickies.lnk - d:\program files\stickies\stickies.exe [2004-10-26 335872]
OpenOffice.org 2.0.lnk - h:\system\Apps\236C571E-47D6-4a73-AD5A-97F1E555E375\Exec\openoffice\program\quickstart.exe [N/A]
Výrezy obrazovky a spuštení aplikace OneNote 2007.lnk - [N/A]
KooBits 4.lnk - c:\program files\KooBits 4.0\KooBits 4.0.exe [N/A]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe [2004-12-21 45056]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-5-6 113664]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
2004-09-07 15:08 110592 ----a-w- c:\program files\Intel\Wireless\Bin\LgNotify.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\WINDOWS\\System32\\dpnsvr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Intel\\Wireless\\Bin\\ZcfgSvc.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\groove.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\WINDOWS\\System32\\ZoneLabs\\vsmon.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26155:TCP"= 26155:TCP:BitComet 26155 TCP
"26155:UDP"= 26155:UDP:BitComet 26155 UDP
.
R0 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [31.5.2007 17:02 160640]
R0 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [31.5.2007 17:02 5248]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [11.10.2008 10:42 664064]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [5.11.2011 14:27 442200]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [5.11.2011 14:27 320856]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [5.11.2011 14:27 20568]
R2 ISWKL;ZoneAlarm Toolbar ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [15.2.2011 16:25 26872]
R2 IswSvc;ZoneAlarm Toolbar IswSvc;c:\program files\CheckPoint\ZAForceField\ISWSVC.exe [15.2.2011 16:25 488952]
R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [3.5.2004 16:26 80384]
S3 pcouffin;VSO Software pcouffin;c:\windows\system32\drivers\pcouffin.sys [1.1.2008 16:03 47360]
.
Contents of the 'Scheduled Tasks' folder
.
2011-10-21 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
2011-11-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-854245398-1801674531-725345543-1003Core1cc9078f756b2d2.job
- c:\documents and settings\R\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-09-11 11:38]
.
.
------- Supplementary Scan -------
.
uSearchURL,(Default) = hxxp://www.forumswatcher.com/search.htm
IE: Crawler Search - tbr:iemenu
IE: e&xportovat do aplikace microsoft excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 213.46.172.36 213.46.172.37
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\Toolbar\ctbr.dll
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-11-09 18:45
Windows 5.1.2600 Service Pack 3 FAT NTAPI
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-854245398-1801674531-725345543-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(964)
c:\windows\system32\Ati2evxx.dll
c:\windows\System32\BCMLogon.dll
c:\program files\Intel\Wireless\Bin\LgNotify.dll
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
.
- - - - - - - > 'lsass.exe'(1024)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
.
- - - - - - - > 'explorer.exe'(1532)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Intel\Wireless\Bin\WLKeeper.exe
c:\program files\Intel\Wireless\Bin\ZcfgSvc.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\System32\WLTRYSVC.EXE
c:\windows\System32\bcmwltry.exe
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\windows\system32\rundll32.exe
c:\windows\System32\SCardSvr.exe
c:\program files\Apoint\Apntex.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2011-11-09 18:52:03 - machine was rebooted
ComboFix-quarantined-files.txt 2011-11-09 17:52
ComboFix2.txt 2011-11-09 16:26
.
Pre-Run: 1 966 292 992 bytes free
Post-Run: 1 791 787 008 bytes free
.
- - End Of File - - FFDD4A7671E429E3291346CA8108E7D7
Nahoru
Avatar uživatele
chodnik74
Přítel fóra
Přítel fóra
Příspěvky: 4975
Registrován: 13 Zář 2010 21:30
Místo/Bydliště: Napajedla
Kontaktovat uživatele:
Kontaktovat uživatele chodnik74

Re: PUP:Win32:FunWeb a PUP:Win32:PUP-gen log z RSIT priloz

#6 Příspěvek od chodnik74 »

:arrow: Malwarebytes' Anti-Malware Obrázek
  • Stáhneme,nainstalujeme a spustíme(pokud si nevíte rady jak,klikněte ZDE)
  • Vybereme Úplná kontrola a klikneme na tlačítko ProhledatObrázek
  • Program provede kontrolu počítače a na konci se vám objeví hláska,že bylo skenování dokončeno,tak potvrdíme tlačítkem OK
  • Objeví se vám log,který mi sem vložte
  • NIC NEMAZAT!!Program mívá občas falešné detekce,takže mazat budeme až po konzultaci :twisted:
To AVG jste odinstaloval přes utilitu?
Napiš mi: chodnik74@gmail.com nebo Obrázek

>RSIT<>MBAM<>VirusTotal

Doporučuji:Obrázek | Obrázek

:!: Postup si raději vícekrát přečtěte a v případě jakýchkoliv nejasností či pochybností se ptejte. ;-) Pokud máte infikovaný počítač nebo se nechová jako obvykle, tak si zálohujte všechny data a pozorně postupujte dle pokynů rádce! :!:

:!: Nepoužívejte utilitu Combofix bez dohledu a doporučení rádce!

:idea: Jste s naší pomocí spokojeni :???: Neváhejte a podpořte forum ZDE.

Pravidla fora: č.1 a č.2
Nahoru
cipisekcz
Návštěvník
Návštěvník
Příspěvky: 7
Registrován: 09 Lis 2011 14:13

Re: PUP:Win32:FunWeb a PUP:Win32:PUP-gen log z RSIT priloz

#7 Příspěvek od cipisekcz »

AVG utilitu jsem uzil 3x.Tady je ten log


Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Verze databáze: 8127

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

9.11.2011 20:28:38
mbam-log-2011-11-09 (20-28-08).txt

Typ: Úplná kontrola (C:\|D:\|)
Kontrolované objekty: 290781
Uplynulý èas: 51 minut, 5 sekund

Infikované procesy v pamìti: 0
Infikované moduly v pamìti: 0
Infikované klíèe v registru: 0
Infikované hodnoty v registru: 0
Infikované datové položky v registru: 0
Infikované složky: 0
Infikované soubory: 3

Infikované procesy v pamìti:
(Žádné škodlivé položky nebyly zjištìny)

Infikované moduly v pamìti:
(Žádné škodlivé položky nebyly zjištìny)

Infikované klíèe v registru:
(Žádné škodlivé položky nebyly zjištìny)

Infikované hodnoty v registru:
(Žádné škodlivé položky nebyly zjištìny)

Infikované datové položky v registru:
(Žádné škodlivé položky nebyly zjištìny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištìny)

Infikované soubory:
c:\system volume information\_restore{73e2af8d-ec8f-4834-9827-06bc03724d78}\RP1225\A0146108.exe (Adware.FunWeb) -> No action taken.
c:\system volume information\_restore{73e2af8d-ec8f-4834-9827-06bc03724d78}\RP1226\A0147739.exe (Adware.FunWeb) -> No action taken.
c:\Qoobox\quarantine\C\DOCUME~1\R\LOCALS~1\TempImg\installer.exe.vir (Adware.FunWeb) -> No action taken.
Nahoru
Avatar uživatele
chodnik74
Přítel fóra
Přítel fóra
Příspěvky: 4975
Registrován: 13 Zář 2010 21:30
Místo/Bydliště: Napajedla
Kontaktovat uživatele:
Kontaktovat uživatele chodnik74

Re: PUP:Win32:FunWeb a PUP:Win32:PUP-gen log z RSIT priloz

#8 Příspěvek od chodnik74 »

Nalezené položky dejte smazat :)

Vyčistěte pc dle tohoto návodu


:arrow: Stáhněte si TDSSKiller
  • Spuste program a klikněte na Start Scan
  • Pokud program najde infikekci,tak ji bude lecit (Cure), povolte léčení kliknutím na tlačítko Continue
  • Pokud program najde podezrely soubor (suspicious),bude ho chtít přeskočit (Skip), povolte přeskočení kliknutim na tlačítko Continue
  • Po dokončení skenování bude možná potřeba restartovat počítač,ten povolíte programu kliknutím na tlačítko Reboot now
  • Po restartování počítače na vás vyskočí log(pokud se tak nestane,tak ho najdete na disku,kde máte nainstalovaná systém s názvem TDSSKiller.xxxx_log.txt) a vložte mi sem jeho obsah
  • Pokud nebude program požadovat restartování počítače,klikněte na tlačítko Close a následně na Report , čímž se Vám vytvoří log a jeho obsah mu sem vložte
Napiš mi: chodnik74@gmail.com nebo Obrázek

>RSIT<>MBAM<>VirusTotal

Doporučuji:Obrázek | Obrázek

:!: Postup si raději vícekrát přečtěte a v případě jakýchkoliv nejasností či pochybností se ptejte. ;-) Pokud máte infikovaný počítač nebo se nechová jako obvykle, tak si zálohujte všechny data a pozorně postupujte dle pokynů rádce! :!:

:!: Nepoužívejte utilitu Combofix bez dohledu a doporučení rádce!

:idea: Jste s naší pomocí spokojeni :???: Neváhejte a podpořte forum ZDE.

Pravidla fora: č.1 a č.2
Nahoru
cipisekcz
Návštěvník
Návštěvník
Příspěvky: 7
Registrován: 09 Lis 2011 14:13

Re: PUP:Win32:FunWeb a PUP:Win32:PUP-gen log z RSIT priloz

#9 Příspěvek od cipisekcz »

20:59:55.0171 1948 TDSS rootkit removing tool 2.6.16.0 Nov 7 2011 16:26:51
20:59:55.0734 1948 ============================================================
20:59:55.0734 1948 Current date / time: 2011/11/09 20:59:55.0734
20:59:55.0734 1948 SystemInfo:
20:59:55.0734 1948
20:59:55.0734 1948 OS Version: 5.1.2600 ServicePack: 3.0
20:59:55.0734 1948 Product type: Workstation
20:59:55.0734 1948 ComputerName: V-F0D7D6B13BD24
20:59:55.0734 1948 UserName: R
20:59:55.0734 1948 Windows directory: C:\WINDOWS
20:59:55.0734 1948 System windows directory: C:\WINDOWS
20:59:55.0734 1948 Processor architecture: Intel x86
20:59:55.0734 1948 Number of processors: 1
20:59:55.0734 1948 Page size: 0x1000
20:59:55.0734 1948 Boot type: Normal boot
20:59:55.0734 1948 ============================================================
20:59:57.0203 1948 Initialize success
21:00:01.0875 3432 ============================================================
21:00:01.0875 3432 Scan started
21:00:01.0875 3432 Mode: Manual;
21:00:01.0875 3432 ============================================================
21:00:03.0109 3432 a347bus (1f61cacacb521215f39061789147968c) C:\WINDOWS\system32\DRIVERS\a347bus.sys
21:00:03.0125 3432 a347bus - ok
21:00:03.0265 3432 a347scsi (113e4b318bbaa7483ca4e582a4d63f49) C:\WINDOWS\system32\Drivers\a347scsi.sys
21:00:03.0265 3432 a347scsi - ok
21:00:03.0359 3432 Aavmker4 (95d1de2a6613494e853a9738d5d9acd4) C:\WINDOWS\system32\drivers\Aavmker4.sys
21:00:03.0359 3432 Aavmker4 - ok
21:00:03.0640 3432 Abiosdsk - ok
21:00:03.0890 3432 abp480n5 - ok
21:00:03.0953 3432 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
21:00:03.0968 3432 ACPI - ok
21:00:04.0046 3432 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
21:00:04.0046 3432 ACPIEC - ok
21:00:04.0359 3432 adpu160m - ok
21:00:04.0468 3432 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
21:00:04.0468 3432 aec - ok
21:00:04.0781 3432 AegisP (2c5c22990156a1063e19ad162191dc1d) C:\WINDOWS\system32\DRIVERS\AegisP.sys
21:00:04.0781 3432 AegisP - ok
21:00:05.0000 3432 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
21:00:05.0000 3432 AFD - ok
21:00:05.0250 3432 Aha154x - ok
21:00:05.0453 3432 aic78u2 - ok
21:00:05.0687 3432 aic78xx - ok
21:00:05.0937 3432 AliIde - ok
21:00:06.0218 3432 amsint - ok
21:00:06.0484 3432 ApfiltrService (aeb775a2bae0f392ba6adc0bb706233a) C:\WINDOWS\system32\DRIVERS\Apfiltr.sys
21:00:06.0484 3432 ApfiltrService - ok
21:00:06.0703 3432 APPDRV (ec94e05b76d033b74394e7b2175103cf) C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS
21:00:06.0703 3432 APPDRV - ok
21:00:06.0937 3432 asc - ok
21:00:07.0171 3432 asc3350p - ok
21:00:07.0453 3432 asc3550 - ok
21:00:07.0687 3432 aswFsBlk (c47623ffd181a1e7d63574dde2a0a711) C:\WINDOWS\system32\drivers\aswFsBlk.sys
21:00:07.0687 3432 aswFsBlk - ok
21:00:07.0828 3432 aswMon2 (fff2dbb17a3c89f87f78d5fa72ca47fd) C:\WINDOWS\system32\drivers\aswMon2.sys
21:00:07.0828 3432 aswMon2 - ok
21:00:08.0062 3432 aswRdr (36239e24470a3dd81fae37510953cc6c) C:\WINDOWS\system32\drivers\aswRdr.sys
21:00:08.0062 3432 aswRdr - ok
21:00:08.0281 3432 aswSnx (caa846e9c83836bdc3d2d700c678db65) C:\WINDOWS\system32\drivers\aswSnx.sys
21:00:08.0296 3432 aswSnx - ok
21:00:08.0609 3432 aswSP (748ae7f2d7da33adb063fe05704a9969) C:\WINDOWS\system32\drivers\aswSP.sys
21:00:08.0609 3432 aswSP - ok
21:00:08.0890 3432 aswTdi (ca9925ce1dbd07ffe1eb357752cf5577) C:\WINDOWS\system32\drivers\aswTdi.sys
21:00:08.0906 3432 aswTdi - ok
21:00:09.0062 3432 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
21:00:09.0062 3432 AsyncMac - ok
21:00:09.0234 3432 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
21:00:09.0234 3432 Suspicious file (NoAccess): C:\WINDOWS\system32\DRIVERS\atapi.sys. md5: 9f3a2f5aa6875c72bf062c712cfa2674
21:00:09.0250 3432 atapi ( LockedFile.Multi.Generic ) - warning
21:00:09.0250 3432 atapi - detected LockedFile.Multi.Generic (1)
21:00:09.0531 3432 Atdisk - ok
21:00:09.0859 3432 ati2mtag (5b75176663f88e90f14a87e57b8562a4) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
21:00:09.0875 3432 ati2mtag - ok
21:00:11.0156 3432 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
21:00:11.0156 3432 Atmarpc - ok
21:00:11.0343 3432 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
21:00:11.0343 3432 audstub - ok
21:00:11.0562 3432 b57w2k (1ca87e228e9aed459d6439b9ace5089c) C:\WINDOWS\system32\DRIVERS\b57xp32.sys
21:00:11.0562 3432 b57w2k - ok
21:00:11.0781 3432 BCM43XX (b89bcf0a25aeb3b47030ac83287f894a) C:\WINDOWS\system32\DRIVERS\bcmwl5.sys
21:00:11.0781 3432 BCM43XX - ok
21:00:11.0859 3432 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
21:00:11.0859 3432 Beep - ok
21:00:12.0125 3432 BthEnum (b279426e3c0c344893ed78a613a73bde) C:\WINDOWS\system32\DRIVERS\BthEnum.sys
21:00:12.0140 3432 BthEnum - ok
21:00:12.0312 3432 BthPan (80602b8746d3738f5886ce3d67ef06b6) C:\WINDOWS\system32\DRIVERS\bthpan.sys
21:00:12.0312 3432 BthPan - ok
21:00:12.0546 3432 BTHPORT (662bfd909447dd9cc15b1a1c366583b4) C:\WINDOWS\system32\Drivers\BTHport.sys
21:00:12.0546 3432 BTHPORT - ok
21:00:12.0765 3432 BTHUSB (61364cd71ef63b0f038b7e9df00f1efa) C:\WINDOWS\system32\Drivers\BTHUSB.sys
21:00:12.0781 3432 BTHUSB - ok
21:00:13.0015 3432 bvrp_pci - ok
21:00:13.0031 3432 catchme - ok
21:00:13.0093 3432 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
21:00:13.0093 3432 cbidf2k - ok
21:00:13.0328 3432 cd20xrnt - ok
21:00:13.0375 3432 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
21:00:13.0375 3432 Cdaudio - ok
21:00:13.0500 3432 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
21:00:13.0500 3432 Cdfs - ok
21:00:13.0593 3432 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
21:00:13.0593 3432 Cdrom - ok
21:00:13.0859 3432 Changer - ok
21:00:14.0015 3432 CmBatt (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
21:00:14.0015 3432 CmBatt - ok
21:00:14.0281 3432 CmdIde - ok
21:00:14.0390 3432 Compbatt (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
21:00:14.0390 3432 Compbatt - ok
21:00:14.0656 3432 Cpqarray - ok
21:00:14.0906 3432 dac2w2k - ok
21:00:15.0171 3432 dac960nt - ok
21:00:15.0281 3432 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
21:00:15.0281 3432 Disk - ok
21:00:15.0406 3432 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
21:00:15.0421 3432 dmboot - ok
21:00:15.0640 3432 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
21:00:15.0640 3432 dmio - ok
21:00:15.0703 3432 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
21:00:15.0703 3432 dmload - ok
21:00:15.0906 3432 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
21:00:15.0906 3432 DMusic - ok
21:00:16.0171 3432 dpti2o - ok
21:00:16.0265 3432 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
21:00:16.0265 3432 drmkaud - ok
21:00:16.0562 3432 drvmcdb (b15f9e526ba511a48b1b1b8537815740) C:\WINDOWS\system32\drivers\drvmcdb.sys
21:00:16.0562 3432 drvmcdb - ok
21:00:16.0875 3432 drvnddm (fa4670cae95ae2bb857c68e535661145) C:\WINDOWS\system32\drivers\drvnddm.sys
21:00:16.0875 3432 drvnddm - ok
21:00:17.0046 3432 dtscsi (6461e57bb51a848aae26f52427b7cf9e) C:\WINDOWS\System32\Drivers\dtscsi.sys
21:00:17.0046 3432 Suspicious file (NoAccess): C:\WINDOWS\System32\Drivers\dtscsi.sys. md5: 6461e57bb51a848aae26f52427b7cf9e
21:00:17.0062 3432 dtscsi ( LockedFile.Multi.Generic ) - warning
21:00:17.0062 3432 dtscsi - detected LockedFile.Multi.Generic (1)
21:00:17.0156 3432 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
21:00:17.0156 3432 Fastfat - ok
21:00:17.0250 3432 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
21:00:17.0250 3432 Fdc - ok
21:00:17.0375 3432 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
21:00:17.0375 3432 Fips - ok
21:00:17.0531 3432 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
21:00:17.0531 3432 Flpydisk - ok
21:00:17.0750 3432 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
21:00:17.0765 3432 FltMgr - ok
21:00:17.0796 3432 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
21:00:17.0796 3432 Fs_Rec - ok
21:00:17.0843 3432 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
21:00:17.0859 3432 Ftdisk - ok
21:00:18.0156 3432 GEARAspiWDM (4ac51459805264affd5f6fdfb9d9235f) C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys
21:00:18.0171 3432 GEARAspiWDM - ok
21:00:18.0375 3432 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
21:00:18.0390 3432 Gpc - ok
21:00:18.0656 3432 GTIPCI21 (7d074058804ad398f93ca0a08af83ff2) C:\WINDOWS\system32\DRIVERS\gtipci21.sys
21:00:18.0656 3432 GTIPCI21 - ok
21:00:18.0859 3432 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
21:00:18.0859 3432 hidusb - ok
21:00:19.0140 3432 hpn - ok
21:00:19.0234 3432 HSFHWICH (a84bbbdd125d370593004f6429f8445c) C:\WINDOWS\system32\DRIVERS\HSFHWICH.sys
21:00:19.0250 3432 HSFHWICH - ok
21:00:19.0406 3432 HSF_DPV (b678fa91cf4a1c19b462d8db04cd02ab) C:\WINDOWS\system32\DRIVERS\HSF_DPV.SYS
21:00:19.0421 3432 HSF_DPV - ok
21:00:19.0593 3432 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
21:00:19.0609 3432 HTTP - ok
21:00:19.0953 3432 i2omgmt - ok
21:00:20.0218 3432 i2omp - ok
21:00:20.0312 3432 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
21:00:20.0312 3432 i8042prt - ok
21:00:20.0562 3432 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
21:00:20.0562 3432 Imapi - ok
21:00:20.0843 3432 ini910u - ok
21:00:20.0953 3432 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys
21:00:20.0953 3432 IntelIde - ok
21:00:21.0078 3432 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
21:00:21.0078 3432 intelppm - ok
21:00:21.0218 3432 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
21:00:21.0218 3432 Ip6Fw - ok
21:00:21.0296 3432 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
21:00:21.0296 3432 IpFilterDriver - ok
21:00:21.0531 3432 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
21:00:21.0531 3432 IpInIp - ok
21:00:21.0671 3432 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
21:00:21.0687 3432 IpNat - ok
21:00:21.0843 3432 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
21:00:21.0843 3432 IPSec - ok
21:00:22.0031 3432 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
21:00:22.0031 3432 IRENUM - ok
21:00:22.0156 3432 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
21:00:22.0156 3432 isapnp - ok
21:00:22.0343 3432 ISWKL (eb8594268cf50baaecbe82d70c833533) C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys
21:00:22.0343 3432 ISWKL - ok
21:00:22.0515 3432 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
21:00:22.0515 3432 Kbdclass - ok
21:00:22.0703 3432 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
21:00:22.0718 3432 kbdhid - ok
21:00:22.0890 3432 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
21:00:22.0890 3432 kmixer - ok
21:00:23.0125 3432 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
21:00:23.0125 3432 KSecDD - ok
21:00:23.0406 3432 lbrtfdc - ok
21:00:23.0687 3432 MBAMSwissArmy - ok
21:00:23.0828 3432 mdmxsdk (3c318b9cd391371bed62126581ee9961) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys
21:00:23.0828 3432 mdmxsdk - ok
21:00:23.0921 3432 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
21:00:23.0921 3432 mnmdd - ok
21:00:24.0125 3432 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
21:00:24.0125 3432 Modem - ok
21:00:24.0203 3432 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
21:00:24.0203 3432 Mouclass - ok
21:00:24.0406 3432 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
21:00:24.0406 3432 mouhid - ok
21:00:24.0593 3432 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
21:00:24.0593 3432 MountMgr - ok
21:00:24.0859 3432 mraid35x - ok
21:00:25.0046 3432 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
21:00:25.0062 3432 MRxDAV - ok
21:00:25.0218 3432 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
21:00:25.0234 3432 MRxSmb - ok
21:00:25.0359 3432 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
21:00:25.0375 3432 Msfs - ok
21:00:25.0578 3432 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
21:00:25.0578 3432 MSKSSRV - ok
21:00:25.0781 3432 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
21:00:25.0781 3432 MSPCLOCK - ok
21:00:25.0859 3432 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
21:00:25.0859 3432 MSPQM - ok
21:00:26.0062 3432 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
21:00:26.0062 3432 mssmbios - ok
21:00:26.0250 3432 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
21:00:26.0250 3432 Mup - ok
21:00:26.0296 3432 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
21:00:26.0296 3432 NDIS - ok
21:00:26.0453 3432 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
21:00:26.0453 3432 NdisTapi - ok
21:00:26.0562 3432 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
21:00:26.0562 3432 Ndisuio - ok
21:00:26.0625 3432 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
21:00:26.0625 3432 NdisWan - ok
21:00:27.0125 3432 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
21:00:27.0125 3432 NDProxy - ok
21:00:27.0234 3432 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
21:00:27.0234 3432 NetBIOS - ok
21:00:27.0375 3432 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
21:00:27.0375 3432 NetBT - ok
21:00:27.0531 3432 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
21:00:27.0531 3432 Npfs - ok
21:00:27.0703 3432 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
21:00:27.0718 3432 Ntfs - ok
21:00:27.0796 3432 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
21:00:27.0796 3432 Null - ok
21:00:27.0843 3432 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
21:00:27.0843 3432 NwlnkFlt - ok
21:00:27.0875 3432 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
21:00:27.0875 3432 NwlnkFwd - ok
21:00:28.0046 3432 OMCI (cec7e2c6c1fa00c7ab2f5434f848ae51) C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS
21:00:28.0046 3432 OMCI - ok
21:00:28.0093 3432 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\drivers\Parport.sys
21:00:28.0093 3432 Parport - ok
21:00:28.0265 3432 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
21:00:28.0265 3432 PartMgr - ok
21:00:28.0312 3432 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
21:00:28.0312 3432 ParVdm - ok
21:00:28.0468 3432 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
21:00:28.0468 3432 PCI - ok
21:00:28.0718 3432 PCIDump - ok
21:00:28.0953 3432 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
21:00:28.0953 3432 PCIIde - ok
21:00:29.0093 3432 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\DRIVERS\pcmcia.sys
21:00:29.0093 3432 Pcmcia - ok
21:00:29.0296 3432 pcouffin (5b6c11de7e839c05248ced8825470fef) C:\WINDOWS\system32\Drivers\pcouffin.sys
21:00:29.0296 3432 pcouffin - ok
21:00:29.0578 3432 PDCOMP - ok
21:00:29.0812 3432 PDFRAME - ok
21:00:30.0046 3432 PDRELI - ok
21:00:30.0312 3432 PDRFRAME - ok
21:00:30.0578 3432 perc2 - ok
21:00:30.0843 3432 perc2hib - ok
21:00:31.0062 3432 Point32 (3b6973d60bde757c53bb76842d31318e) C:\WINDOWS\system32\DRIVERS\point32.sys
21:00:31.0078 3432 Point32 - ok
21:00:31.0265 3432 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
21:00:31.0265 3432 PptpMiniport - ok
21:00:31.0531 3432 prodrv06 (18d9789a4664bf417eea944d2776091a) C:\WINDOWS\System32\drivers\prodrv06.sys
21:00:31.0531 3432 prodrv06 - ok
21:00:31.0843 3432 prohlp02 (8cc9671a7ed2902e747ee0892e1c8575) C:\WINDOWS\system32\drivers\prohlp02.sys
21:00:31.0859 3432 prohlp02 - ok
21:00:32.0015 3432 prosync1 (960bce3ed38761b446aabac06c76badf) C:\WINDOWS\system32\drivers\prosync1.sys
21:00:32.0015 3432 prosync1 - ok
21:00:32.0109 3432 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
21:00:32.0109 3432 PSched - ok
21:00:32.0156 3432 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
21:00:32.0156 3432 Ptilink - ok
21:00:32.0296 3432 PxHelp20 (f7bb4e7a7c02ab4a2672937e124e306e) C:\WINDOWS\system32\DRIVERS\PxHelp20.sys
21:00:32.0312 3432 PxHelp20 - ok
21:00:32.0593 3432 ql1080 - ok
21:00:32.0875 3432 Ql10wnt - ok
21:00:33.0250 3432 ql12160 - ok
21:00:33.0515 3432 ql1240 - ok
21:00:33.0906 3432 ql1280 - ok
21:00:33.0953 3432 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
21:00:33.0953 3432 RasAcd - ok
21:00:34.0078 3432 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
21:00:34.0078 3432 Rasl2tp - ok
21:00:34.0171 3432 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
21:00:34.0171 3432 RasPppoe - ok
21:00:34.0203 3432 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
21:00:34.0203 3432 Raspti - ok
21:00:34.0375 3432 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
21:00:34.0375 3432 Rdbss - ok
21:00:34.0437 3432 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
21:00:34.0437 3432 RDPCDD - ok
21:00:34.0515 3432 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
21:00:34.0515 3432 rdpdr - ok
21:00:34.0625 3432 RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
21:00:34.0640 3432 RDPWD - ok
21:00:34.0765 3432 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
21:00:34.0765 3432 redbook - ok
21:00:35.0015 3432 RFCOMM (851c30df2807fcfa21e4c681a7d6440e) C:\WINDOWS\system32\DRIVERS\rfcomm.sys
21:00:35.0015 3432 RFCOMM - ok
21:00:35.0078 3432 ROOTMODEM (d8b0b4ade32574b2d9c5cc34dc0dbbe7) C:\WINDOWS\system32\Drivers\RootMdm.sys
21:00:35.0078 3432 ROOTMODEM - ok
21:00:35.0234 3432 s217bus (0266151de3f36429f6ac3c4b28085061) C:\WINDOWS\system32\DRIVERS\s217bus.sys
21:00:35.0234 3432 s217bus - ok
21:00:35.0531 3432 s217mdfl (a43c0af0e46be7ef0c7e8ccf0f058600) C:\WINDOWS\system32\DRIVERS\s217mdfl.sys
21:00:35.0531 3432 s217mdfl - ok
21:00:35.0750 3432 s217mdm (005f5ded1ed8f8a9d2399d765ead20f1) C:\WINDOWS\system32\DRIVERS\s217mdm.sys
21:00:35.0750 3432 s217mdm - ok
21:00:36.0015 3432 s217mgmt (de9562ad0c91e1857d11f65a91ee1a47) C:\WINDOWS\system32\DRIVERS\s217mgmt.sys
21:00:36.0015 3432 s217mgmt - ok
21:00:36.0359 3432 s217nd5 (11cc5d7f992799e7e75d018e9c018563) C:\WINDOWS\system32\DRIVERS\s217nd5.sys
21:00:36.0359 3432 s217nd5 - ok
21:00:36.0640 3432 s217obex (0f9f4045799afb66b85eef999d0609ec) C:\WINDOWS\system32\DRIVERS\s217obex.sys
21:00:36.0640 3432 s217obex - ok
21:00:36.0890 3432 s217unic (1c91e1023f07b6407d84b5a43537d984) C:\WINDOWS\system32\DRIVERS\s217unic.sys
21:00:36.0906 3432 s217unic - ok
21:00:37.0250 3432 s24trans (81aa6f0d6a2be1c550f814b036215888) C:\WINDOWS\system32\DRIVERS\s24trans.sys
21:00:37.0250 3432 s24trans - ok
21:00:37.0687 3432 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
21:00:37.0687 3432 Secdrv - ok
21:00:37.0828 3432 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
21:00:37.0828 3432 serenum - ok
21:00:37.0968 3432 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys
21:00:37.0968 3432 Serial - ok
21:00:38.0156 3432 sfdrv01 (00de597b81b381053cb5b21a7f20e365) C:\WINDOWS\system32\drivers\sfdrv01.sys
21:00:38.0156 3432 sfdrv01 - ok
21:00:38.0406 3432 sfhlp01 (462aee0ea0481ea8bd45cac876a4ccc4) C:\WINDOWS\system32\drivers\sfhlp01.sys
21:00:38.0406 3432 sfhlp01 - ok
21:00:38.0578 3432 sfhlp02 (64b9ab76f1b16eb059cb6cdd906c067a) C:\WINDOWS\system32\drivers\sfhlp02.sys
21:00:38.0593 3432 sfhlp02 - ok
21:00:38.0734 3432 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
21:00:38.0734 3432 Sfloppy - ok
21:00:38.0875 3432 sfsync02 (798d918d8f20380008277ce3ce5319d1) C:\WINDOWS\system32\drivers\sfsync02.sys
21:00:38.0875 3432 sfsync02 - ok
21:00:39.0156 3432 Simbad - ok
21:00:39.0390 3432 Sparrow - ok
21:00:39.0578 3432 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
21:00:39.0578 3432 splitter - ok
21:00:39.0812 3432 sptd (55fc93c16bd6f9ba4c971373ec8129f8) C:\WINDOWS\system32\Drivers\sptd.sys
21:00:39.0812 3432 Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: 55fc93c16bd6f9ba4c971373ec8129f8
21:00:39.0812 3432 sptd ( LockedFile.Multi.Generic ) - warning
21:00:39.0812 3432 sptd - detected LockedFile.Multi.Generic (1)
21:00:40.0031 3432 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
21:00:40.0031 3432 sr - ok
21:00:40.0234 3432 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
21:00:40.0250 3432 Srv - ok
21:00:40.0515 3432 sscdbhk5 (d7968049be0adbb6a57cee3960320911) C:\WINDOWS\system32\drivers\sscdbhk5.sys
21:00:40.0515 3432 sscdbhk5 - ok
21:00:40.0796 3432 ssrtln (c3ffd65abfb6441e7606cf74f1155273) C:\WINDOWS\system32\drivers\ssrtln.sys
21:00:40.0796 3432 ssrtln - ok
21:00:40.0937 3432 STAC97 (305cc42945a713347f978d78566113f3) C:\WINDOWS\system32\drivers\STAC97.sys
21:00:40.0937 3432 STAC97 - ok
21:00:41.0109 3432 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
21:00:41.0109 3432 swenum - ok
21:00:42.0078 3432 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
21:00:42.0078 3432 swmidi - ok
21:00:42.0421 3432 symc810 - ok
21:00:42.0687 3432 symc8xx - ok
21:00:43.0046 3432 sym_hi - ok
21:00:43.0328 3432 sym_u3 - ok
21:00:43.0468 3432 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
21:00:43.0468 3432 sysaudio - ok
21:00:43.0609 3432 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
21:00:43.0625 3432 Tcpip - ok
21:00:43.0812 3432 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
21:00:43.0828 3432 TDPIPE - ok
21:00:44.0000 3432 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
21:00:44.0015 3432 TDTCP - ok
21:00:44.0156 3432 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
21:00:44.0171 3432 TermDD - ok
21:00:45.0609 3432 tfsnboio (1d265cd2fb1673a0873bf8cec19ddc7f) C:\WINDOWS\system32\dla\tfsnboio.sys
21:00:45.0609 3432 tfsnboio - ok
21:00:47.0000 3432 tfsncofs (62e4901295e0467cac78e5b4b131ae5c) C:\WINDOWS\system32\dla\tfsncofs.sys
21:00:47.0000 3432 tfsncofs - ok
21:00:48.0218 3432 tfsndrct (a2f380f9252ab3464c859adf91eead9c) C:\WINDOWS\system32\dla\tfsndrct.sys
21:00:48.0218 3432 tfsndrct - ok
21:00:49.0515 3432 tfsndres (eee79bbefe9c6a2a3ce6c8753cfea950) C:\WINDOWS\system32\dla\tfsndres.sys
21:00:49.0515 3432 tfsndres - ok
21:00:51.0078 3432 tfsnifs (9d644eb11fec9487450c4cfcd63a5df4) C:\WINDOWS\system32\dla\tfsnifs.sys
21:00:51.0078 3432 tfsnifs - ok
21:00:52.0546 3432 tfsnopio (e656af05c67edb7c0e9230a5df71ed1b) C:\WINDOWS\system32\dla\tfsnopio.sys
21:00:52.0546 3432 tfsnopio - ok
21:00:54.0171 3432 tfsnpool (64fccb9cce703ca507dffc3cebf6b2cb) C:\WINDOWS\system32\dla\tfsnpool.sys
21:00:54.0171 3432 tfsnpool - ok
21:00:55.0531 3432 tfsnudf (48bc9d8ab4e4b9bff70fb18e55cec3d6) C:\WINDOWS\system32\dla\tfsnudf.sys
21:00:55.0531 3432 tfsnudf - ok
21:00:57.0546 3432 tfsnudfa (79f60822224256b49bfc855da8d651d5) C:\WINDOWS\system32\dla\tfsnudfa.sys
21:00:57.0562 3432 tfsnudfa - ok
21:00:57.0921 3432 toshidpt (62c57e7411b5f20980e70530ca69d5a7) C:\WINDOWS\system32\drivers\Toshidpt.sys
21:00:57.0921 3432 toshidpt - ok
21:00:58.0203 3432 TosIde - ok
21:00:58.0531 3432 tosporte (09505abeae3de953442417a48256684a) C:\WINDOWS\system32\DRIVERS\tosporte.sys
21:00:58.0546 3432 tosporte - ok
21:00:58.0890 3432 Tosrfbd (9b478a68d0f627ed3c4c4a48e86c5509) C:\WINDOWS\system32\Drivers\tosrfbd.sys
21:00:58.0890 3432 Tosrfbd - ok
21:00:59.0171 3432 Tosrfbnp (fe200eece7521061cdad658c6ee4f341) C:\WINDOWS\system32\Drivers\tosrfbnp.sys
21:00:59.0171 3432 Tosrfbnp - ok
21:00:59.0437 3432 Tosrfcom (d185be751021bcf1e5d58566d408314a) C:\WINDOWS\system32\Drivers\tosrfcom.sys
21:00:59.0453 3432 Tosrfcom - ok
21:00:59.0703 3432 Tosrfhid (341612b9758054e5965bcd6ae111b8f9) C:\WINDOWS\system32\DRIVERS\Tosrfhid.sys
21:00:59.0718 3432 Tosrfhid - ok
21:00:59.0953 3432 tosrfnds (c52fd27b9adf3a1f22cb90e6bcf9b0cb) C:\WINDOWS\system32\DRIVERS\tosrfnds.sys
21:00:59.0953 3432 tosrfnds - ok
21:01:00.0250 3432 TosRfSnd (350814a87f8ba3b0e28278feddf36f82) C:\WINDOWS\system32\drivers\TosRfSnd.sys
21:01:00.0281 3432 TosRfSnd - ok
21:01:00.0562 3432 Tosrfusb (ddb8a339e57d514768f45d33b11bdb50) C:\WINDOWS\system32\Drivers\tosrfusb.sys
21:01:00.0562 3432 Tosrfusb - ok
21:01:00.0843 3432 truecrypt (be45dad1c73a3216edc8c485916f6594) C:\WINDOWS\system32\drivers\truecrypt.sys
21:01:00.0843 3432 truecrypt - ok
21:01:01.0015 3432 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
21:01:01.0015 3432 Udfs - ok
21:01:01.0265 3432 ultra - ok
21:01:01.0468 3432 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
21:01:01.0468 3432 Update - ok
21:01:01.0671 3432 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
21:01:01.0671 3432 usbccgp - ok
21:01:01.0906 3432 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
21:01:01.0906 3432 usbehci - ok
21:01:02.0015 3432 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
21:01:02.0031 3432 usbhub - ok
21:01:02.0281 3432 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
21:01:02.0281 3432 usbprint - ok
21:01:02.0500 3432 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
21:01:02.0500 3432 usbscan - ok
21:01:02.0671 3432 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
21:01:02.0671 3432 USBSTOR - ok
21:01:02.0765 3432 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
21:01:02.0765 3432 usbuhci - ok
21:01:02.0859 3432 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
21:01:02.0859 3432 VgaSave - ok
21:01:03.0156 3432 ViaIde - ok
21:01:03.0281 3432 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
21:01:03.0281 3432 VolSnap - ok
21:01:04.0015 3432 vsdatant (050c38ebb22512122e54b47dc278bccd) C:\WINDOWS\system32\vsdatant.sys
21:01:04.0031 3432 vsdatant - ok
21:01:04.0234 3432 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
21:01:04.0234 3432 Wanarp - ok
21:01:04.0453 3432 WDICA - ok
21:01:04.0562 3432 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
21:01:04.0562 3432 wdmaud - ok
21:01:04.0734 3432 winachsf (0c5b9cf1bdf998750d9c5eeb5f8c55ac) C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys
21:01:04.0750 3432 winachsf - ok
21:01:04.0921 3432 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys
21:01:04.0921 3432 WpdUsb - ok
21:01:05.0015 3432 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
21:01:05.0015 3432 WS2IFSL - ok
21:01:05.0125 3432 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
21:01:05.0125 3432 WudfPf - ok
21:01:05.0281 3432 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
21:01:05.0281 3432 WudfRd - ok
21:01:05.0343 3432 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0
21:01:05.0531 3432 \Device\Harddisk0\DR0 - ok
21:01:05.0531 3432 Boot (0x1200) (90510cfdaea6619153ecbc980603ee58) \Device\Harddisk0\DR0\Partition0
21:01:05.0531 3432 \Device\Harddisk0\DR0\Partition0 - ok
21:01:05.0562 3432 Boot (0x1200) (5c7efc63bdb2ecab73941878c44f46a1) \Device\Harddisk0\DR0\Partition1
21:01:05.0562 3432 \Device\Harddisk0\DR0\Partition1 - ok
21:01:05.0562 3432 ============================================================
21:01:05.0562 3432 Scan finished
21:01:05.0562 3432 ============================================================
21:01:05.0578 3016 Detected object count: 3
21:01:05.0578 3016 Actual detected object count: 3
21:01:09.0140 3016 atapi ( LockedFile.Multi.Generic ) - skipped by user
21:01:09.0140 3016 atapi ( LockedFile.Multi.Generic ) - User select action: Skip
21:01:09.0140 3016 dtscsi ( LockedFile.Multi.Generic ) - skipped by user
21:01:09.0140 3016 dtscsi ( LockedFile.Multi.Generic ) - User select action: Skip
21:01:09.0140 3016 sptd ( LockedFile.Multi.Generic ) - skipped by user
21:01:09.0140 3016 sptd ( LockedFile.Multi.Generic ) - User select action: Skip
Nahoru
Avatar uživatele
chodnik74
Přítel fóra
Přítel fóra
Příspěvky: 4975
Registrován: 13 Zář 2010 21:30
Místo/Bydliště: Napajedla
Kontaktovat uživatele:
Kontaktovat uživatele chodnik74

Re: PUP:Win32:FunWeb a PUP:Win32:PUP-gen log z RSIT priloz

#10 Příspěvek od chodnik74 »

V pořádku..

Ještě dočistíme od používaných programů:

:arrow: Obrázek OTC
  • Spustíme,zmáčkneme CleanUp a potvrdíme YES :) Program uklidí a následně restartuje
:arrow: ObrázekT-Cleaner
  • Spustíme,zmáčkneme klávesu A a potvrdíme ENTER(některé antiviry mohou detekovat utilitu jako vir-jedá se o falešný poplach,proto IGNOROVAT nebo dočasně vypnout antivir )
  • po použití T-Cleaner smažte ;-)


:arrow: Obrázek TFC
  • Stáhneme a spustíme program
  • Klikneme na Start a potvrdíme OK
  • Program začne uklízet,poté restartuje pc
  • po použití program smažte
Malwarebytes můžete odinstalovat..

jak se chová PC?
Napiš mi: chodnik74@gmail.com nebo Obrázek

>RSIT<>MBAM<>VirusTotal

Doporučuji:Obrázek | Obrázek

:!: Postup si raději vícekrát přečtěte a v případě jakýchkoliv nejasností či pochybností se ptejte. ;-) Pokud máte infikovaný počítač nebo se nechová jako obvykle, tak si zálohujte všechny data a pozorně postupujte dle pokynů rádce! :!:

:!: Nepoužívejte utilitu Combofix bez dohledu a doporučení rádce!

:idea: Jste s naší pomocí spokojeni :???: Neváhejte a podpořte forum ZDE.

Pravidla fora: č.1 a č.2
Nahoru
cipisekcz
Návštěvník
Návštěvník
Příspěvky: 7
Registrován: 09 Lis 2011 14:13

Re: PUP:Win32:FunWeb a PUP:Win32:PUP-gen log z RSIT priloz

#11 Příspěvek od cipisekcz »

Dobry den,jsem opet zde.PC se zatim chova bez zavad.Plna kontrola - Avast 6,Malwarebytes vse OK.
Uz jsem odeslal financni odmenu na podporu fora.
Moc dekuji. :worship:
PS:co ten Spyware Terminator 2012 mam znova naistalovat??
Nahoru
Avatar uživatele
chodnik74
Přítel fóra
Přítel fóra
Příspěvky: 4975
Registrován: 13 Zář 2010 21:30
Místo/Bydliště: Napajedla
Kontaktovat uživatele:
Kontaktovat uživatele chodnik74

Re: PUP:Win32:FunWeb a PUP:Win32:PUP-gen log z RSIT priloz

#12 Příspěvek od chodnik74 »

:arrow: Malwarebytes můžete odinstalovat
:!: Spyware Terminator 2012 bych neinstaloval. Zkuste nahradit SUPERAntispyware, který používejte jako preventivní sken jednou za 14 dní :)

Pokud chcete, udělejte údržbu pc..

Údržba PC:

1)Čištění dočasných složek + neplatné registry
:arrow: ObrázekCcleaner
  • Stáhneme a nainstalujeme program
  • Spustíme program
  • ČISTIČ
    Windows zde necháme vše jak je (pokud používáme IE,tak odškrkneme jeho položky) a zaškrkneme položky Start Menu zástupci a Zástupci na ploše a odškrkneme volbu Zbytky souborů v paměti
    Aplikace - necháme jak je,ale pokud používáme nějaký prohlížeč (Google chrome,Firefox,Opera..) tak odškrkneme jeho položky
    >Stiskeneme tlačítko Analyzovat a poté Spustit Cleaner
  • Registry
    >Stiskneme tlačítko Hledej problémy,program začne hledat neplatné registry..podé zvolíme Opravit vybrané problémy..
    >Program se zeptá,zda chceme vytvořit zálohu registrů,zvolíme ano a uložíme si někde zálohu(kdyby byli po opravení registru s něčím problémy,tak zálohu obnovíme tak,že spustíme uloženou zálohu a potvrdíme ano),dále zvolíme Opravit všechny problémy a Zavřít
    >opakujte dokud nebude registr bez problémů
  • Program používáme 1x 14dní (záleží na používání pc,můžeme i jednou týdně)
2)Defragmentace disku
:arrow: ObrázekDefraggler
  • Stáhneme a nainstalujeme program
  • Spustíme program
  • Vybereme disk ( C:,D:..prostě který používáme)
  • Pokud je ve sloupci Fragmentace více než 5% dejte Defragmentovat
  • Proveďte se všemi používanými disky
  • Provádíme 1x za měsíc
3)Aktualizace programů
:arrow: ObrázekFileHippo.com Update Checker
  • Stáhneme a nainstalujeme program(Při instalaci odškrkneme volbu Run at Startup )
  • Spustíme program
  • Program vyhledá nainstalované programy v PC a zjistí dostupné aktualizace
  • Poté se vám otevře internetová stránka,kde budou nabídnuté aplikace k aktualizování
    >X Updates Detected..to jsou dostupné aktualizace..
    > klikneme na zelenou šipečku a stáhneme program,poté nainstalujeme jeho aktuální verzi
    > :!: X Beta Updates Detected..tyto aktualizace nestahujte,jedná se o betaverze,které jsou ve vývoji a jsou nestabilní :)
  • Provádíme 1x za 14 dní nebo jednou za měsíc



Za podporu fora děkuji za celý tým :all_coholic:
Napiš mi: chodnik74@gmail.com nebo Obrázek

>RSIT<>MBAM<>VirusTotal

Doporučuji:Obrázek | Obrázek

:!: Postup si raději vícekrát přečtěte a v případě jakýchkoliv nejasností či pochybností se ptejte. ;-) Pokud máte infikovaný počítač nebo se nechová jako obvykle, tak si zálohujte všechny data a pozorně postupujte dle pokynů rádce! :!:

:!: Nepoužívejte utilitu Combofix bez dohledu a doporučení rádce!

:idea: Jste s naší pomocí spokojeni :???: Neváhejte a podpořte forum ZDE.

Pravidla fora: č.1 a č.2
Nahoru
Odpovědět

Vrátit se na „Řešení problémů, logy“