avast nasel rootkit

[Lukvot]

Dobrý den,
při testu po restartu mi avast nasel rootkit. PC je mírně zpomalené. Prosím o kontrolu. Díky.

Logfile of random's system information tool 1.09 (written by random/random)
Run by Cajnik at 2011-11-29 09:47:25
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 8 GB (22%) free of 38 GB
Total RAM: 510 MB (37% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:47:53, on 29.11.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\Cajnik\Dokumenty\Stažené soubory\RSIT.exe
C:\Program Files\trend micro\Cajnik.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Bluetooth Manager.lnk = ?
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - c:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

--
End of file - 4888 bytes

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\Cajnik\Data aplikací\Mozilla\Firefox\Profiles\yc85q8jm.default

prefs.js - "browser.search.useDBForOrder" - true
prefs.js - "browser.startup.homepage" - "https://encrypted.google.com/"
prefs.js - "extensions.enabledItems" - "dealio@mybrowserbar.com:4.7, wtxpcom@mybrowserbar.com:4.7, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.24"
prefs.js - "keyword.URL" - "http://search.yahoo.com/search?fr=green ... =150911&p="

"wrc@avast.com"=C:\Program Files\AVAST Software\Avast\WebRep\FF


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\WINDOWS\System32\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

C:\Program Files\Mozilla Firefox\extensions\
dealio@mybrowserbar.com
wtxpcom@mybrowserbar.com
{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files\Mozilla Firefox\plugins\
nppdf32.dll

C:\Program Files\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml
yahoo.xml

C:\Documents and Settings\Cajnik\Data aplikací\Mozilla\Firefox\Profiles\yc85q8jm.default\searchplugins\
askcom.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-09-05 63912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2011-09-06 806456]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E99421FB-68DD-40F0-B4AC-B7027CAE2F1A}]
EpsonToolBandKicker Class - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll [2005-02-22 368640]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EE5D279F-081B-4404-994D-C6B60AAEBA6D} - EPSON Web-To-Page - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll [2005-02-22 368640]
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2011-09-06 806456]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\WINDOWS\System32\igfxtray.exe [2004-02-10 155648]
"HotKeysCmds"=C:\WINDOWS\System32\hkcmd.exe [2004-02-10 118784]
"avast"=C:\Program Files\AVAST Software\Avast\avastUI.exe [2011-09-06 3722416]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-06-06 937920]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BrowserChoice]
C:\WINDOWS\system32\browserchoice.exe [2010-02-12 293376]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe [2009-06-29 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Microsoft Office.lnk]
C:\PROGRA~1\MICROS~2\Office\OSA9.EXE [1999-02-17 65588]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Bluetooth Manager.lnk - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxsrvc.dll [2004-02-10 339968]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"vidc.iv41"=ir41_32.ax
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll

======List of files/folders created in the last 1 month======

2011-11-29 09:47:31 ----D---- C:\Program Files\trend micro
2011-11-29 09:47:25 ----D---- C:\rsit
2011-11-29 01:10:51 ----A---- C:\WINDOWS\system32\FNTCACHE.DAT
2011-11-28 23:06:05 ----D---- C:\Program Files\CCleaner
2011-11-28 22:46:20 ----A---- C:\WINDOWS\system32\drivers\aswFsBlk.sys
2011-11-28 22:46:19 ----A---- C:\WINDOWS\system32\drivers\aswSP.sys
2011-11-28 22:46:13 ----A---- C:\WINDOWS\system32\drivers\aswRdr.sys
2011-11-28 22:46:12 ----A---- C:\WINDOWS\system32\drivers\aswTdi.sys
2011-11-28 22:46:10 ----A---- C:\WINDOWS\system32\drivers\aswSnx.sys
2011-11-28 22:46:08 ----A---- C:\WINDOWS\system32\drivers\aswmon2.sys
2011-11-28 22:46:08 ----A---- C:\WINDOWS\system32\drivers\aswmon.sys
2011-11-28 22:46:07 ----A---- C:\WINDOWS\system32\drivers\aavmker4.sys
2011-11-28 22:44:53 ----A---- C:\WINDOWS\avastSS.scr
2011-11-28 22:44:50 ----A---- C:\WINDOWS\system32\aswBoot.exe
2011-11-28 22:43:43 ----D---- C:\Program Files\AVAST Software
2011-11-28 22:43:43 ----D---- C:\Documents and Settings\All Users\Data aplikací\AVAST Software
2011-11-28 21:51:12 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2011-11-28 21:50:58 ----HDC---- C:\WINDOWS\$NtUninstallKB2570791$
2011-11-28 21:50:46 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2011-11-28 21:50:30 ----HDC---- C:\WINDOWS\$NtUninstallKB959426$
2011-11-28 21:50:14 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2011-11-28 21:49:55 ----HDC---- C:\WINDOWS\$NtUninstallKB2387149$
2011-11-28 21:49:37 ----HDC---- C:\WINDOWS\$NtUninstallKB960859$
2011-11-28 21:49:18 ----HDC---- C:\WINDOWS\$NtUninstallKB2479943$
2011-11-28 21:49:02 ----HDC---- C:\WINDOWS\$NtUninstallKB2567680$
2011-11-28 21:48:44 ----HDC---- C:\WINDOWS\$NtUninstallKB2564958$
2011-11-28 21:48:32 ----HDC---- C:\WINDOWS\$NtUninstallKB2478971$
2011-11-28 21:48:17 ----HDC---- C:\WINDOWS\$NtUninstallKB2544893-v2$
2011-11-28 21:47:59 ----HDC---- C:\WINDOWS\$NtUninstallKB2536276-v2$
2011-11-28 21:47:42 ----HDC---- C:\WINDOWS\$NtUninstallKB2296011$
2011-11-28 21:47:27 ----HDC---- C:\WINDOWS\$NtUninstallKB2115168$
2011-11-28 21:47:14 ----HDC---- C:\WINDOWS\$NtUninstallKB975558_WM8$
2011-11-28 21:46:57 ----HDC---- C:\WINDOWS\$NtUninstallKB955759$
2011-11-28 21:46:38 ----HDC---- C:\WINDOWS\$NtUninstallKB2378111_WM9$
2011-11-28 21:46:20 ----HDC---- C:\WINDOWS\$NtUninstallKB974318$
2011-11-28 21:46:03 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$
2011-11-28 21:45:45 ----HDC---- C:\WINDOWS\$NtUninstallKB969059$
2011-11-28 21:45:28 ----HDC---- C:\WINDOWS\$NtUninstallKB2443105$
2011-11-28 21:45:13 ----HDC---- C:\WINDOWS\$NtUninstallKB2229593$
2011-11-28 21:42:03 ----HDC---- C:\WINDOWS\$NtUninstallKB2467659$
2011-11-28 21:40:40 ----D---- C:\WINDOWS\ie8updates
2011-11-28 21:38:33 ----D---- C:\WINDOWS\WBEM
2011-11-28 21:36:07 ----HDC---- C:\WINDOWS\ie8
2011-11-28 21:27:43 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2011-11-28 21:27:24 ----HDC---- C:\WINDOWS\$NtUninstallKB2481109$
2011-11-28 21:27:05 ----HDC---- C:\WINDOWS\$NtUninstallKB975713$
2011-11-28 21:26:52 ----HDC---- C:\WINDOWS\$NtUninstallKB2485663$
2011-11-28 21:26:38 ----HDC---- C:\WINDOWS\$NtUninstallKB2440591$
2011-11-28 21:26:25 ----HDC---- C:\WINDOWS\$NtUninstallKB982132$
2011-11-28 21:26:11 ----HDC---- C:\WINDOWS\$NtUninstallKB971657$
2011-11-28 21:25:57 ----HDC---- C:\WINDOWS\$NtUninstallKB978338$
2011-11-28 21:25:45 ----HDC---- C:\WINDOWS\$NtUninstallKB954155_WM9$
2011-11-28 21:25:33 ----HDC---- C:\WINDOWS\$NtUninstallKB2507938$
2011-11-28 21:25:10 ----HDC---- C:\WINDOWS\$NtUninstallKB972270$
2011-11-28 21:24:47 ----A---- C:\WINDOWS\system32\MRT.INI
2011-11-28 21:19:35 ----A---- C:\WINDOWS\system32\MRT.exe
2011-11-28 21:18:50 ----HDC---- C:\WINDOWS\$NtUninstallKB2510581$
2011-11-28 21:18:31 ----HDC---- C:\WINDOWS\$NtUninstallKB956744$
2011-11-28 21:18:16 ----HDC---- C:\WINDOWS\$NtUninstallKB2476490$
2011-11-28 21:18:00 ----HDC---- C:\WINDOWS\$NtUninstallKB974112$
2011-11-28 21:17:33 ----HDC---- C:\WINDOWS\$NtUninstallKB956572$
2011-11-28 21:17:02 ----HDC---- C:\WINDOWS\$NtUninstallKB2347290$
2011-11-28 21:16:47 ----HDC---- C:\WINDOWS\$NtUninstallKB956844$
2011-11-28 21:16:31 ----HDC---- C:\WINDOWS\$NtUninstallKB2641690$
2011-11-28 21:15:50 ----HDC---- C:\WINDOWS\$NtUninstallKB2483185$
2011-11-28 21:15:26 ----HDC---- C:\WINDOWS\$NtUninstallKB961501$
2011-11-28 21:15:09 ----HDC---- C:\WINDOWS\$NtUninstallKB2079403$
2011-11-28 21:14:53 ----HDC---- C:\WINDOWS\$NtUninstallKB979687$
2011-11-28 21:14:38 ----HDC---- C:\WINDOWS\$NtUninstallKB973869$
2011-11-28 21:14:25 ----HDC---- C:\WINDOWS\$NtUninstallKB975025$
2011-11-28 21:14:07 ----HDC---- C:\WINDOWS\$NtUninstallKB952004$
2011-11-28 21:13:50 ----HDC---- C:\WINDOWS\$NtUninstallKB974571$
2011-11-28 21:13:36 ----HDC---- C:\WINDOWS\$NtUninstallKB2567053$
2011-11-28 21:13:21 ----HDC---- C:\WINDOWS\$NtUninstallKB2592799$
2011-11-28 21:13:08 ----HDC---- C:\WINDOWS\$NtUninstallKB975560$
2011-11-28 21:12:44 ----HDC---- C:\WINDOWS\$NtUninstallKB973507$
2011-11-28 21:12:30 ----HDC---- C:\WINDOWS\$NtUninstallKB2570222$
2011-11-28 21:12:19 ----HDC---- C:\WINDOWS\$NtUninstallKB2535512$
2011-11-28 21:12:06 ----HDC---- C:\WINDOWS\$NtUninstallKB977816$
2011-11-28 21:11:48 ----HDC---- C:\WINDOWS\$NtUninstallKB973687$
2011-11-28 21:11:34 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2011-11-28 21:11:22 ----HDC---- C:\WINDOWS\$NtUninstallKB2412687$
2011-11-28 21:11:09 ----HDC---- C:\WINDOWS\$NtUninstallKB978601$
2011-11-28 21:10:57 ----HDC---- C:\WINDOWS\$NtUninstallKB2570947$
2011-11-28 21:10:46 ----HDC---- C:\WINDOWS\$NtUninstallKB2508272$
2011-11-28 21:10:35 ----HDC---- C:\WINDOWS\$NtUninstallKB980436$
2011-11-28 21:10:23 ----HDC---- C:\WINDOWS\$NtUninstallKB981322$
2011-11-28 21:10:10 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2011-11-28 21:09:55 ----HDC---- C:\WINDOWS\$NtUninstallKB978695_WM9$
2011-11-28 21:09:42 ----HDC---- C:\WINDOWS\$NtUninstallKB2507618$
2011-11-28 21:09:25 ----HDC---- C:\WINDOWS\$NtUninstallKB973904$
2011-11-28 21:09:05 ----HDC---- C:\WINDOWS\$NtUninstallKB973540_WM9$
2011-11-28 21:08:42 ----HDC---- C:\WINDOWS\$NtUninstallKB2419632$
2011-11-28 21:08:25 ----HDC---- C:\WINDOWS\$NtUninstallKB2508429$
2011-11-28 21:08:12 ----HDC---- C:\WINDOWS\$NtUninstallKB974392$
2011-11-28 21:07:31 ----HDC---- C:\WINDOWS\$NtUninstallKB971029$
2011-11-28 21:07:07 ----HDC---- C:\WINDOWS\$NtUninstallKB954459$
2011-11-28 21:06:51 ----HDC---- C:\WINDOWS\$NtUninstallKB2506212$
2011-11-28 21:06:33 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$
2011-11-28 21:06:20 ----HDC---- C:\WINDOWS\$NtUninstallKB977914$
2011-11-28 21:05:57 ----HDC---- C:\WINDOWS\$NtUninstallKB978542$
2011-11-28 21:05:43 ----HDC---- C:\WINDOWS\$NtUninstallKB979309$
2011-11-28 21:05:33 ----HDC---- C:\WINDOWS\$NtUninstallKB979482$
2011-11-28 21:05:21 ----HDC---- C:\WINDOWS\$NtUninstallKB978706$
2011-11-28 21:05:02 ----HDC---- C:\WINDOWS\$NtUninstallKB981997$
2011-11-28 21:04:45 ----HDC---- C:\WINDOWS\$NtUninstallKB960803$
2011-11-28 21:04:32 ----HDC---- C:\WINDOWS\$NtUninstallKB973815$
2011-11-28 21:03:56 ----HDC---- C:\WINDOWS\$NtUninstallKB2586448$
2011-11-28 21:03:30 ----HDC---- C:\WINDOWS\$NtUninstallKB975562$
2011-11-28 21:03:17 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2011-11-28 21:03:06 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$
2011-11-28 21:02:46 ----HDC---- C:\WINDOWS\$NtUninstallKB2509553$
2011-11-28 21:02:36 ----D---- C:\Program Files\MSXML 4.0
2011-11-28 21:02:14 ----HDC---- C:\WINDOWS\$NtUninstallKB982665$
2011-11-28 21:02:04 ----HDC---- C:\WINDOWS\$NtUninstallKB2541763$
2011-11-28 21:01:52 ----HDC---- C:\WINDOWS\$NtUninstallKB2544521$
2011-11-28 21:01:39 ----HDC---- C:\WINDOWS\$NtUninstallKB2478960$
2011-11-28 21:01:08 ----HDC---- C:\WINDOWS\$NtUninstallKB2393802$
2011-11-28 21:00:51 ----HDC---- C:\WINDOWS\$NtUninstallKB923561$
2011-11-28 21:00:40 ----HDC---- C:\WINDOWS\$NtUninstallKB2566454$
2011-11-28 21:00:29 ----HDC---- C:\WINDOWS\$NtUninstallKB2562937$
2011-11-28 21:00:18 ----HDC---- C:\WINDOWS\$NtUninstallKB975467$
2011-11-28 21:00:03 ----HDC---- C:\WINDOWS\$NtUninstallKB968389$
2011-11-28 20:59:50 ----HDC---- C:\WINDOWS\$NtUninstallKB2423089$
2011-11-28 20:59:30 ----HDC---- C:\WINDOWS\$NtUninstallKB2360937$
2011-11-28 20:44:56 ----N---- C:\WINDOWS\system32\drivers\bthport.sys
2011-11-28 20:34:47 ----D---- C:\WINDOWS\system32\cs-cz
2011-11-28 20:34:47 ----D---- C:\WINDOWS\system32\cs
2011-11-28 20:34:47 ----D---- C:\WINDOWS\Provisioning
2011-11-28 20:34:47 ----D---- C:\WINDOWS\PeerNet
2011-11-28 20:34:47 ----D---- C:\WINDOWS\Network Diagnostic
2011-11-28 20:34:47 ----D---- C:\WINDOWS\L2Schemas
2011-11-28 20:34:47 ----D---- C:\WINDOWS\ehome
2011-11-28 20:33:34 ----N---- C:\WINDOWS\system32\browserchoice.exe
2011-11-28 20:19:43 ----D---- C:\WINDOWS\system32\PreInstall
2011-11-28 20:19:41 ----A---- C:\WINDOWS\system32\spupdsvc.exe
2011-11-28 20:19:40 ----HDC---- C:\WINDOWS\$NtUninstallKB898461$
2011-11-28 20:19:40 ----HD---- C:\WINDOWS\$hf_mig$
2011-11-28 20:13:34 ----A---- C:\WINDOWS\system32\igfxres.dll
2011-11-28 20:09:28 ----D---- C:\WINDOWS\Prefetch
2011-11-28 19:57:44 ----A---- C:\WINDOWS\system32\bitsprx4.dll
2011-11-28 19:57:44 ----A---- C:\WINDOWS\system32\bitsprx3.dll
2011-11-28 19:57:44 ----A---- C:\WINDOWS\system32\bitsprx2.dll
2011-11-28 19:57:31 ----A---- C:\WINDOWS\system32\fltMc.exe
2011-11-28 19:57:31 ----A---- C:\WINDOWS\system32\fltlib.dll
2011-11-28 19:57:31 ----A---- C:\WINDOWS\system32\drivers\fltMgr.sys
2011-11-28 19:54:23 ----A---- C:\WINDOWS\system32\tsgqec.dll
2011-11-28 19:54:23 ----A---- C:\WINDOWS\system32\rhttpaa.dll
2011-11-28 19:54:23 ----A---- C:\WINDOWS\system32\aaclient.dll
2011-11-28 19:44:16 ----A---- C:\WINDOWS\system32\irclass.dll
2011-11-28 19:44:15 ----A---- C:\WINDOWS\system32\spxcoins.dll
2011-11-28 19:43:45 ----RA---- C:\WINDOWS\SET5E.tmp
2011-11-28 19:43:40 ----RA---- C:\WINDOWS\SET52.tmp
2011-11-28 19:43:37 ----RA---- C:\WINDOWS\SET51.tmp
2011-11-28 18:58:59 ----RD---- C:\Program Files\Skype

======List of files/folders modified in the last 1 month======

2011-11-29 09:47:31 ----RD---- C:\Program Files
2011-11-29 09:38:08 ----D---- C:\Instalace
2011-11-29 09:38:00 ----D---- C:\WINDOWS\Temp
2011-11-29 09:23:03 ----HD---- C:\WINDOWS\inf
2011-11-29 01:45:14 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-11-29 01:41:00 ----D---- C:\WINDOWS
2011-11-29 01:38:13 ----D---- C:\Documents and Settings\Cajnik\Data aplikací\Skype
2011-11-29 01:16:39 ----ASH---- C:\boot.ini
2011-11-29 01:10:51 ----D---- C:\WINDOWS\system32
2011-11-29 00:12:14 ----SD---- C:\WINDOWS\Tasks
2011-11-29 00:12:06 ----SHD---- C:\WINDOWS\Installer
2011-11-28 23:51:17 ----D---- C:\WINDOWS\pss
2011-11-28 23:46:21 ----D---- C:\WINDOWS\SoftwareDistribution
2011-11-28 23:46:21 ----D---- C:\WINDOWS\Debug
2011-11-28 23:46:20 ----D---- C:\WINDOWS\Minidump
2011-11-28 23:32:38 ----D---- C:\WINDOWS\system32\drivers
2011-11-28 23:26:16 ----D---- C:\Program Files\Google
2011-11-28 22:45:23 ----D---- C:\WINDOWS\WinSxS
2011-11-28 22:26:28 ----D---- C:\Program Files\Mozilla Firefox
2011-11-28 22:19:28 ----A---- C:\WINDOWS\win.ini
2011-11-28 22:19:28 ----A---- C:\WINDOWS\system.ini
2011-11-28 21:59:36 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2011-11-28 21:53:47 ----RSHDC---- C:\WINDOWS\system32\dllcache
2011-11-28 21:53:47 ----D---- C:\WINDOWS\AppPatch
2011-11-28 21:53:45 ----D---- C:\WINDOWS\Help
2011-11-28 21:53:45 ----D---- C:\Program Files\Internet Explorer
2011-11-28 21:53:43 ----D---- C:\WINDOWS\system32\wbem
2011-11-28 21:50:18 ----D---- C:\Program Files\Messenger
2011-11-28 21:47:21 ----D---- C:\WINDOWS\system32\CatRoot2
2011-11-28 21:38:03 ----D---- C:\WINDOWS\Media
2011-11-28 21:06:01 ----D---- C:\Program Files\Outlook Express
2011-11-28 21:05:07 ----D---- C:\Program Files\Movie Maker
2011-11-28 20:49:58 ----D---- C:\WINDOWS\SxsCaPendDel
2011-11-28 20:48:07 ----D---- C:\Program Files\Common Files
2011-11-28 20:40:51 ----D---- C:\WINDOWS\system32\Setup
2011-11-28 20:40:40 ----D---- C:\WINDOWS\system32\usmt
2011-11-28 20:40:22 ----D---- C:\WINDOWS\ime
2011-11-28 20:40:20 ----RSD---- C:\WINDOWS\Fonts
2011-11-28 20:39:41 ----D---- C:\WINDOWS\system32\npp
2011-11-28 20:39:30 ----D---- C:\WINDOWS\msagent
2011-11-28 20:36:54 ----D---- C:\WINDOWS\system32\1029
2011-11-28 20:36:47 ----D---- C:\WINDOWS\twain_32
2011-11-28 20:36:27 ----D---- C:\WINDOWS\system32\icsxml
2011-11-28 20:35:59 ----D---- C:\WINDOWS\system32\ias
2011-11-28 20:35:54 ----D---- C:\WINDOWS\system32\1033
2011-11-28 20:34:47 ----D---- C:\WINDOWS\Driver Cache
2011-11-28 20:15:46 ----SD---- C:\Documents and Settings\Cajnik\Data aplikací\Microsoft
2011-11-28 20:12:51 ----D---- C:\WINDOWS\Registration
2011-11-28 20:12:37 ----D---- C:\WINDOWS\system32\CatRoot
2011-11-28 20:09:41 ----SHD---- C:\System Volume Information
2011-11-28 20:09:41 ----D---- C:\WINDOWS\system32\Restore
2011-11-28 20:08:04 ----D---- C:\WINDOWS\system32\config
2011-11-28 20:00:58 ----D---- C:\Program Files\Windows Media Player
2011-11-28 20:00:44 ----SD---- C:\Documents and Settings\All Users\Data aplikací\Microsoft
2011-11-28 20:00:16 ----AC---- C:\WINDOWS\ODBCINST.INI
2011-11-28 19:59:39 ----ASHC---- C:\WINDOWS\fonts\desktop.ini
2011-11-28 19:58:44 ----RD---- C:\WINDOWS\Web
2011-11-28 19:58:26 ----RAHC---- C:\WINDOWS\system32\cdplayer.exe.manifest
2011-11-28 19:57:51 ----D---- C:\WINDOWS\srchasst
2011-11-28 19:57:38 ----D---- C:\WINDOWS\system32\oobe
2011-11-28 19:57:36 ----D---- C:\WINDOWS\security
2011-11-28 19:57:29 ----D---- C:\Program Files\NetMeeting
2011-11-28 19:57:27 ----D---- C:\Program Files\Common Files\System
2011-11-28 19:55:33 ----D---- C:\WINDOWS\system32\Com
2011-11-28 19:54:26 ----D---- C:\Program Files\Windows NT
2011-11-28 19:44:15 ----D---- C:\WINDOWS\system
2011-11-28 19:43:57 ----ASH---- C:\Documents and Settings\All Users\Data aplikací\desktop.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 IdeBusDr;IdeBusDr; C:\WINDOWS\System32\DRIVERS\IdeBusDr.sys [2002-10-14 13891]
R0 IdeChnDr;Intel(R) Ultra ATA Controller; C:\WINDOWS\System32\DRIVERS\IdeChnDr.sys [2002-10-14 101431]
R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2011-09-06 30808]
R1 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2011-09-06 34392]
R1 aswSnx;aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [2011-09-06 442200]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2011-09-06 320856]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2011-09-06 52568]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 Tosrfcom;Bluetooth RFCOMM; C:\WINDOWS\System32\Drivers\tosrfcom.sys [2005-08-01 64896]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2011-09-06 20568]
R2 aswMon2;aswMon2; C:\WINDOWS\system32\drivers\aswMon2.sys [2011-09-06 110552]
R3 aeaudio;aeaudio; C:\WINDOWS\system32\drivers\aeaudio.sys [2002-04-01 4816]
R3 E1000;Intel(R) PRO/1000 Adapter Driver; C:\WINDOWS\System32\DRIVERS\e1000325.sys [2002-10-17 103936]
R3 ialm;ialm; C:\WINDOWS\System32\DRIVERS\ialmnt5.sys [2004-02-10 681469]
R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2002-12-19 539008]
R3 tosporte;Bluetooth COM Port; C:\WINDOWS\System32\DRIVERS\tosporte.sys [2006-10-10 41600]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 NAL;Nal Service ; \??\C:\WINDOWS\System32\Drivers\iqvw32.sys []
S3 tosrfbd;Bluetooth RFBUS; C:\WINDOWS\System32\DRIVERS\tosrfbd.sys [2007-02-22 113920]
S3 tosrfbnp;Bluetooth RFBNEP; C:\WINDOWS\System32\Drivers\tosrfbnp.sys [2006-11-20 36480]
S3 Tosrfhid;Bluetooth RFHID; C:\WINDOWS\System32\DRIVERS\Tosrfhid.sys [2007-03-01 73728]
S3 tosrfnds;Bluetooth Personal Area Network; C:\WINDOWS\System32\DRIVERS\tosrfnds.sys [2005-01-06 18612]
S3 TosRfSnd;Bluetooth Audio; C:\WINDOWS\system32\drivers\tosrfsnd.sys [2007-01-22 53376]
S3 tosrfusb;Bluetooth USB Controller; C:\WINDOWS\System32\DRIVERS\tosrfusb.sys [2007-03-30 41856]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbprint;Třída USB Printer; C:\WINDOWS\System32\DRIVERS\usbprint.sys [2008-04-14 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\System32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2011-09-06 44768]
R2 TOSHIBA Bluetooth Service;TOSHIBA Bluetooth Service; C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe [2007-02-25 125048]
S3 NetSvc;Intel NCS NetService; c:\Program Files\Intel\NCS\Sync\NetSvc.exe [2002-09-27 139264]

-----------------EOF-----------------

[vyosek]

Zdravim a pekny den preji

Kde jej Avast nachazi

Stahnete si TDSSKiller http://support.kaspersky.com/downloads/ ... killer.exe

• Utilitu spustte a prikazte ji, at skenuje - klik na Start Scan
• Pokud utilita najde infikekci, bude ji chtit lecit (Cure), povolte leceni kliknutim na Continue
• Pokud utilita najde podezrely soubor (suspicious), bude jej chtit preskocit (Skip), povolte preskoceni kliknutim na Continue
• Po dokonceni skenu bude mozna nutny restart PC, povolte jej kliknutim na Reboot now
• Po restartu na Vas vyskoci log, pokud se tak nestane, najdete jej primo na disku, kde mate Windows (obvykle c:\) ve tvaru TDSSKiller.nejaka cisilka _log.txt - jeho obsah sem vlozte
• Pokud restart nebude vyzadovan, kliknete na Close a nasledne na Report - vytvori se log - jeho obsah sem vlozte

[Lukvot]

Bohužel jsem si nezapomatoval cestu k souboru s logem avastu takže nevím přesně, kde byl rootkit nalezen bylo to C:\WINDOWS\system32\..... a dál nevím. Log z Tdsskiller zde:

0:12:39.0234 0128 TDSS rootkit removing tool 2.6.21.0 Nov 24 2011 12:32:44
10:12:39.0515 0128 ============================================================
10:12:39.0515 0128 Current date / time: 2011/11/29 10:12:39.0515
10:12:39.0515 0128 SystemInfo:
10:12:39.0515 0128
10:12:39.0515 0128 OS Version: 5.1.2600 ServicePack: 3.0
10:12:39.0515 0128 Product type: Workstation
10:12:39.0515 0128 ComputerName: ALENA-A5CVAFFXM
10:12:39.0515 0128 UserName: Cajnik
10:12:39.0515 0128 Windows directory: C:\WINDOWS
10:12:39.0515 0128 System windows directory: C:\WINDOWS
10:12:39.0515 0128 Processor architecture: Intel x86
10:12:39.0515 0128 Number of processors: 1
10:12:39.0515 0128 Page size: 0x1000
10:12:39.0515 0128 Boot type: Normal boot
10:12:39.0515 0128 ============================================================
10:12:42.0093 0128 Initialize success
10:12:52.0031 3636 ============================================================
10:12:52.0031 3636 Scan started
10:12:52.0031 3636 Mode: Manual;
10:12:52.0031 3636 ============================================================
10:12:53.0750 3636 Aavmker4 (95d1de2a6613494e853a9738d5d9acd4) C:\WINDOWS\system32\drivers\Aavmker4.sys
10:12:53.0765 3636 Aavmker4 - ok
10:12:54.0734 3636 Abiosdsk - ok
10:12:55.0671 3636 abp480n5 - ok
10:12:56.0750 3636 ACPI (4fe34f1f3126b61fcc6b2043aa8112c9) C:\WINDOWS\system32\DRIVERS\ACPI.sys
10:12:56.0781 3636 ACPI - ok
10:12:57.0640 3636 ACPIEC (afdff022a01f0b11c776f0860c3b282f) C:\WINDOWS\system32\drivers\ACPIEC.sys
10:12:57.0656 3636 ACPIEC - ok
10:12:58.0468 3636 adpu160m - ok
10:12:59.0359 3636 aeaudio (11c04b17ed2abbb4833694bcd644ac90) C:\WINDOWS\system32\drivers\aeaudio.sys
10:12:59.0359 3636 aeaudio - ok
10:13:00.0296 3636 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
10:13:00.0296 3636 aec - ok
10:13:01.0171 3636 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
10:13:01.0187 3636 AFD - ok
10:13:01.0968 3636 Aha154x - ok
10:13:02.0843 3636 aic78u2 - ok
10:13:03.0703 3636 aic78xx - ok
10:13:04.0500 3636 AliIde - ok
10:13:05.0281 3636 amsint - ok
10:13:06.0046 3636 asc - ok
10:13:06.0812 3636 asc3350p - ok
10:13:07.0859 3636 asc3550 - ok
10:13:08.0687 3636 aswFsBlk (c47623ffd181a1e7d63574dde2a0a711) C:\WINDOWS\system32\drivers\aswFsBlk.sys
10:13:08.0703 3636 aswFsBlk - ok
10:13:09.0546 3636 aswMon2 (fff2dbb17a3c89f87f78d5fa72ca47fd) C:\WINDOWS\system32\drivers\aswMon2.sys
10:13:09.0562 3636 aswMon2 - ok
10:13:10.0359 3636 aswRdr (36239e24470a3dd81fae37510953cc6c) C:\WINDOWS\system32\drivers\aswRdr.sys
10:13:10.0359 3636 aswRdr - ok
10:13:11.0359 3636 aswSnx (caa846e9c83836bdc3d2d700c678db65) C:\WINDOWS\system32\drivers\aswSnx.sys
10:13:11.0375 3636 aswSnx - ok
10:13:12.0468 3636 aswSP (748ae7f2d7da33adb063fe05704a9969) C:\WINDOWS\system32\drivers\aswSP.sys
10:13:12.0484 3636 aswSP - ok
10:13:14.0062 3636 aswTdi (ca9925ce1dbd07ffe1eb357752cf5577) C:\WINDOWS\system32\drivers\aswTdi.sys
10:13:14.0062 3636 aswTdi - ok
10:13:15.0000 3636 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
10:13:15.0015 3636 AsyncMac - ok
10:13:15.0968 3636 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
10:13:15.0968 3636 atapi - ok
10:13:16.0734 3636 Atdisk - ok
10:13:17.0578 3636 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
10:13:17.0593 3636 Atmarpc - ok
10:13:18.0437 3636 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
10:13:18.0437 3636 audstub - ok
10:13:19.0250 3636 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
10:13:19.0250 3636 Beep - ok
10:13:20.0125 3636 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
10:13:20.0125 3636 cbidf2k - ok
10:13:20.0906 3636 cd20xrnt - ok
10:13:21.0750 3636 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
10:13:21.0750 3636 Cdaudio - ok
10:13:22.0625 3636 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
10:13:22.0625 3636 Cdfs - ok
10:13:23.0515 3636 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
10:13:23.0515 3636 Cdrom - ok
10:13:24.0281 3636 Changer - ok
10:13:25.0156 3636 CmdIde - ok
10:13:25.0921 3636 Cpqarray - ok
10:13:26.0703 3636 dac2w2k - ok
10:13:27.0468 3636 dac960nt - ok
10:13:28.0312 3636 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
10:13:28.0312 3636 Disk - ok
10:13:29.0531 3636 dmboot (db5fd2bf5b07dc54bfcb3664ff05bd7c) C:\WINDOWS\system32\drivers\dmboot.sys
10:13:29.0546 3636 dmboot - ok
10:13:31.0468 3636 dmio (fff1720af51171f32f1ead5cf71f2810) C:\WINDOWS\system32\DRIVERS\dmio.sys
10:13:31.0468 3636 dmio - ok
10:13:32.0468 3636 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
10:13:32.0468 3636 dmload - ok
10:13:34.0046 3636 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
10:13:34.0062 3636 DMusic - ok
10:13:35.0468 3636 dpti2o - ok
10:13:36.0390 3636 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
10:13:36.0421 3636 drmkaud - ok
10:13:37.0421 3636 E1000 (785db16f68a89d4500a93625cead7b0e) C:\WINDOWS\system32\DRIVERS\e1000325.sys
10:13:37.0437 3636 E1000 - ok
10:13:38.0390 3636 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
10:13:38.0406 3636 Fastfat - ok
10:13:39.0234 3636 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
10:13:39.0250 3636 Fdc - ok
10:13:40.0734 3636 Fips (ac366695a0796560aa37215ad5762aaf) C:\WINDOWS\system32\drivers\Fips.sys
10:13:40.0843 3636 Fips - ok
10:13:42.0234 3636 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
10:13:42.0234 3636 Flpydisk - ok
10:13:43.0750 3636 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
10:13:43.0750 3636 FltMgr - ok
10:13:45.0125 3636 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
10:13:45.0125 3636 Fs_Rec - ok
10:13:46.0078 3636 Ftdisk (4e664d8541db4a66b73a24257e322e1f) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
10:13:46.0093 3636 Ftdisk - ok
10:13:47.0109 3636 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
10:13:47.0109 3636 Gpc - ok
10:13:48.0281 3636 hpn - ok
10:13:49.0468 3636 HTTP (f6aacf5bce2893e0c1754afeb672e5c9) C:\WINDOWS\system32\Drivers\HTTP.sys
10:13:49.0515 3636 HTTP - ok
10:13:50.0484 3636 i2omgmt - ok
10:13:51.0375 3636 i2omp - ok
10:13:52.0265 3636 i8042prt (c528e27945367191e7bae364930b6932) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
10:13:52.0281 3636 i8042prt - ok
10:13:53.0359 3636 ialm (da58a8be6a445835f603720c4bc8837e) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
10:13:53.0359 3636 ialm - ok
10:13:54.0171 3636 IdeBusDr (791f0829de88dd0ca77192f0dfad03b6) C:\WINDOWS\system32\DRIVERS\IdeBusDr.sys
10:13:54.0171 3636 IdeBusDr - ok
10:13:56.0203 3636 IdeChnDr (7d2b8be9e89628663c1fb571f7c34062) C:\WINDOWS\system32\DRIVERS\IdeChnDr.sys
10:13:56.0203 3636 IdeChnDr - ok
10:13:57.0078 3636 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
10:13:57.0078 3636 Imapi - ok
10:13:57.0890 3636 ini910u - ok
10:13:58.0703 3636 IntelIde (57d928e548b38502abba7a77a6eb7312) C:\WINDOWS\system32\DRIVERS\intelide.sys
10:13:58.0703 3636 IntelIde - ok
10:13:59.0671 3636 intelppm (27b290d632af2cf3cf40bfddb7370985) C:\WINDOWS\system32\DRIVERS\intelppm.sys
10:13:59.0796 3636 intelppm - ok
10:14:00.0781 3636 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
10:14:00.0781 3636 Ip6Fw - ok
10:14:01.0578 3636 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
10:14:01.0593 3636 IpFilterDriver - ok
10:14:02.0578 3636 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
10:14:02.0578 3636 IpInIp - ok
10:14:03.0578 3636 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
10:14:03.0593 3636 IpNat - ok
10:14:04.0500 3636 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
10:14:04.0515 3636 IPSec - ok
10:14:05.0328 3636 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
10:14:05.0328 3636 IRENUM - ok
10:14:06.0171 3636 isapnp (cc9f8a2d60aed1a51a3ac34c59b987ae) C:\WINDOWS\system32\DRIVERS\isapnp.sys
10:14:06.0171 3636 isapnp - ok
10:14:07.0203 3636 Kbdclass (1b6162fe7f66b1a71a4b70f941c4aa9b) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
10:14:07.0218 3636 Kbdclass - ok
10:14:08.0406 3636 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
10:14:08.0515 3636 kmixer - ok
10:14:09.0390 3636 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
10:14:09.0390 3636 KSecDD - ok
10:14:10.0421 3636 lbrtfdc - ok
10:14:11.0390 3636 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
10:14:11.0406 3636 mnmdd - ok
10:14:12.0375 3636 Modem (44032b0c6d9954d3fd26438330b99ee7) C:\WINDOWS\system32\drivers\Modem.sys
10:14:12.0390 3636 Modem - ok
10:14:13.0609 3636 Mouclass (4cb582831dbde63ce43b45d771218374) C:\WINDOWS\system32\DRIVERS\mouclass.sys
10:14:13.0609 3636 Mouclass - ok
10:14:15.0437 3636 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
10:14:15.0437 3636 MountMgr - ok
10:14:16.0250 3636 mraid35x - ok
10:14:17.0375 3636 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
10:14:17.0375 3636 MRxDAV - ok
10:14:18.0484 3636 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
10:14:18.0515 3636 MRxSmb - ok
10:14:19.0484 3636 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
10:14:19.0500 3636 Msfs - ok
10:14:20.0343 3636 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
10:14:20.0343 3636 MSKSSRV - ok
10:14:21.0187 3636 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
10:14:21.0187 3636 MSPCLOCK - ok
10:14:22.0015 3636 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
10:14:22.0015 3636 MSPQM - ok
10:14:22.0859 3636 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
10:14:22.0859 3636 mssmbios - ok
10:14:25.0062 3636 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
10:14:25.0062 3636 Mup - ok
10:14:25.0921 3636 NAL (ab7cc5ddfa1557bab312e12abb6a5158) C:\WINDOWS\System32\Drivers\iqvw32.sys
10:14:25.0921 3636 NAL - ok
10:14:26.0875 3636 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
10:14:26.0875 3636 NDIS - ok
10:14:28.0015 3636 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
10:14:28.0031 3636 NdisTapi - ok
10:14:28.0953 3636 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
10:14:28.0953 3636 Ndisuio - ok
10:14:30.0031 3636 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
10:14:30.0046 3636 NdisWan - ok
10:14:30.0921 3636 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
10:14:30.0921 3636 NDProxy - ok
10:14:30.0921 3636 Suspicious service (NoAccess): nebyz
10:14:31.0859 3636 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
10:14:31.0859 3636 NetBIOS - ok
10:14:33.0062 3636 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
10:14:33.0062 3636 NetBT - ok
10:14:33.0937 3636 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
10:14:33.0937 3636 Npfs - ok
10:14:35.0546 3636 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
10:14:35.0578 3636 Ntfs - ok
10:14:37.0062 3636 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
10:14:37.0062 3636 Null - ok
10:14:37.0984 3636 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
10:14:38.0000 3636 NwlnkFlt - ok
10:14:38.0796 3636 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
10:14:38.0796 3636 NwlnkFwd - ok
10:14:39.0875 3636 Parport (46f8db73b4a53e543f8e371dc7c75bae) C:\WINDOWS\system32\DRIVERS\parport.sys
10:14:39.0890 3636 Parport - ok
10:14:40.0796 3636 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
10:14:40.0796 3636 PartMgr - ok
10:14:42.0218 3636 ParVdm (1fae19d0457176318bba4a8795656ebc) C:\WINDOWS\system32\drivers\ParVdm.sys
10:14:42.0265 3636 ParVdm - ok
10:14:43.0718 3636 PCI (6ce351d149cb4befc702951e471e1730) C:\WINDOWS\system32\DRIVERS\pci.sys
10:14:43.0765 3636 PCI - ok
10:14:44.0578 3636 PCIDump - ok
10:14:45.0437 3636 PCIIde (2da4ec85e0ea7a45c6b2a05820492d5a) C:\WINDOWS\system32\drivers\PCIIde.sys
10:14:45.0437 3636 PCIIde - ok
10:14:46.0453 3636 Pcmcia (4fc31e6c19a5ce5198b1abff94cae758) C:\WINDOWS\system32\drivers\Pcmcia.sys
10:14:46.0484 3636 Pcmcia - ok
10:14:47.0656 3636 PDCOMP - ok
10:14:49.0265 3636 PDFRAME - ok
10:14:50.0062 3636 PDRELI - ok
10:14:50.0968 3636 PDRFRAME - ok
10:14:51.0828 3636 perc2 - ok
10:14:52.0671 3636 perc2hib - ok
10:14:53.0593 3636 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
10:14:53.0593 3636 PptpMiniport - ok
10:14:54.0453 3636 Processor (7eb15dce4ec3a0220bd796a15c18186e) C:\WINDOWS\system32\DRIVERS\processr.sys
10:14:54.0453 3636 Processor - ok
10:14:55.0578 3636 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
10:14:55.0609 3636 PSched - ok
10:14:56.0453 3636 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
10:14:56.0515 3636 Ptilink - ok
10:14:57.0296 3636 ql1080 - ok
10:14:58.0156 3636 Ql10wnt - ok
10:14:58.0906 3636 ql12160 - ok
10:14:59.0812 3636 ql1240 - ok
10:15:00.0703 3636 ql1280 - ok
10:15:01.0500 3636 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
10:15:01.0515 3636 RasAcd - ok
10:15:02.0625 3636 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
10:15:02.0640 3636 Rasl2tp - ok
10:15:03.0671 3636 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
10:15:03.0687 3636 RasPppoe - ok
10:15:04.0781 3636 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
10:15:04.0781 3636 Raspti - ok
10:15:07.0296 3636 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
10:15:07.0343 3636 Rdbss - ok
10:15:09.0406 3636 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
10:15:09.0406 3636 RDPCDD - ok
10:15:10.0625 3636 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
10:15:10.0734 3636 rdpdr - ok
10:15:11.0765 3636 RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
10:15:11.0843 3636 RDPWD - ok
10:15:12.0703 3636 redbook (611bfd220305be3a85ae876ea47d4aa5) C:\WINDOWS\system32\DRIVERS\redbook.sys
10:15:12.0703 3636 redbook - ok
10:15:14.0062 3636 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
10:15:14.0078 3636 Secdrv - ok
10:15:14.0984 3636 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
10:15:14.0984 3636 serenum - ok
10:15:15.0875 3636 Serial (b842729337c9b921615c40d3c1a1af96) C:\WINDOWS\system32\DRIVERS\serial.sys
10:15:15.0875 3636 Serial - ok
10:15:16.0703 3636 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
10:15:16.0703 3636 Sfloppy - ok
10:15:17.0656 3636 Simbad - ok
10:15:18.0843 3636 smwdm (70b8dd8707dbf6142530c106365df67d) C:\WINDOWS\system32\drivers\smwdm.sys
10:15:18.0859 3636 smwdm - ok
10:15:19.0796 3636 Sparrow - ok
10:15:20.0703 3636 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
10:15:20.0718 3636 splitter - ok
10:15:21.0625 3636 sr (94610c8653635e4459316a0050d55ce7) C:\WINDOWS\system32\DRIVERS\sr.sys
10:15:21.0640 3636 sr - ok
10:15:22.0625 3636 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
10:15:22.0640 3636 Srv - ok
10:15:23.0703 3636 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
10:15:23.0734 3636 swenum - ok
10:15:24.0578 3636 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
10:15:24.0578 3636 swmidi - ok
10:15:25.0406 3636 symc810 - ok
10:15:26.0187 3636 symc8xx - ok
10:15:26.0953 3636 sym_hi - ok
10:15:27.0890 3636 sym_u3 - ok
10:15:29.0000 3636 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
10:15:29.0140 3636 sysaudio - ok
10:15:30.0218 3636 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
10:15:30.0265 3636 Tcpip - ok
10:15:31.0093 3636 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
10:15:31.0109 3636 TDPIPE - ok
10:15:32.0031 3636 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
10:15:32.0031 3636 TDTCP - ok
10:15:32.0921 3636 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
10:15:32.0921 3636 TermDD - ok
10:15:33.0765 3636 TosIde - ok
10:15:36.0000 3636 tosporte (8d624d3bd1f2d78bd1c01a2d4e954b4e) C:\WINDOWS\system32\DRIVERS\tosporte.sys
10:15:36.0015 3636 tosporte - ok
10:15:37.0125 3636 tosrfbd (266df087a8c24da34ff40cf3df86ccfb) C:\WINDOWS\system32\DRIVERS\tosrfbd.sys
10:15:37.0140 3636 tosrfbd - ok
10:15:38.0046 3636 tosrfbnp (90c8525bc578aaffe87c2d0ed4379e9e) C:\WINDOWS\system32\Drivers\tosrfbnp.sys
10:15:38.0046 3636 tosrfbnp - ok
10:15:39.0000 3636 Tosrfcom (5ba1ca3b3cddb1ddc67df473f05d1ec2) C:\WINDOWS\system32\Drivers\tosrfcom.sys
10:15:39.0187 3636 Tosrfcom - ok
10:15:40.0140 3636 Tosrfhid (7c807ba9660e2995cc0217a14a24094c) C:\WINDOWS\system32\DRIVERS\Tosrfhid.sys
10:15:40.0140 3636 Tosrfhid - ok
10:15:40.0984 3636 tosrfnds (c52fd27b9adf3a1f22cb90e6bcf9b0cb) C:\WINDOWS\system32\DRIVERS\tosrfnds.sys
10:15:41.0000 3636 tosrfnds - ok
10:15:42.0078 3636 TosRfSnd (a4ce9572bc4ac8d329455059b43c5bea) C:\WINDOWS\system32\drivers\tosrfsnd.sys
10:15:42.0109 3636 TosRfSnd - ok
10:15:42.0953 3636 tosrfusb (602818649c84eb774d6971da65f79cc8) C:\WINDOWS\system32\DRIVERS\tosrfusb.sys
10:15:42.0953 3636 tosrfusb - ok
10:15:43.0921 3636 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
10:15:43.0937 3636 Udfs - ok
10:15:44.0703 3636 ultra - ok
10:15:45.0703 3636 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
10:15:45.0718 3636 Update - ok
10:15:46.0578 3636 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
10:15:46.0578 3636 usbccgp - ok
10:15:48.0546 3636 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
10:15:48.0593 3636 usbehci - ok
10:15:49.0453 3636 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
10:15:49.0453 3636 usbhub - ok
10:15:50.0343 3636 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
10:15:50.0343 3636 usbprint - ok
10:15:51.0156 3636 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
10:15:51.0171 3636 usbscan - ok
10:15:52.0031 3636 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
10:15:52.0046 3636 USBSTOR - ok
10:15:52.0921 3636 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
10:15:52.0921 3636 usbuhci - ok
10:15:54.0218 3636 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
10:15:54.0218 3636 VgaSave - ok
10:15:55.0031 3636 ViaIde - ok
10:15:55.0843 3636 VolSnap (28a4b296b47782173c346e376cb374d1) C:\WINDOWS\system32\drivers\VolSnap.sys
10:15:55.0843 3636 VolSnap - ok
10:15:56.0671 3636 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
10:15:56.0687 3636 Wanarp - ok
10:15:57.0453 3636 WDICA - ok
10:15:58.0359 3636 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
10:15:58.0375 3636 wdmaud - ok
10:15:58.0546 3636 MBR (0x1B8) (413fc2a0c716421b3158746d63736515) \Device\Harddisk0\DR0
10:15:58.0843 3636 \Device\Harddisk0\DR0 - ok
10:15:58.0859 3636 Boot (0x1200) (4c53893fb8c58b019fa07b8a8aa43122) \Device\Harddisk0\DR0\Partition0
10:15:58.0859 3636 \Device\Harddisk0\DR0\Partition0 - ok
10:15:58.0859 3636 ============================================================
10:15:58.0859 3636 Scan finished
10:15:58.0859 3636 ============================================================
10:15:58.0906 3624 Detected object count: 0
10:15:58.0906 3624 Actual detected object count: 0

[vyosek]

Stahnete aswMBR http://public.avast.com/%7Egmerek/aswMBR.exe a ulozte jej na plochu.

• Utilitu spustte a prikazte ji, at skenuje - klik na Scan
• Kliknutim na Save log ulozte log aswMBR na plochu
• Obsah logu aswMBR mi sem vlozte

[Lukvot]

aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
Run date: 2011-11-29 10:47:26
-----------------------------
10:47:26.187 OS Version: Windows 5.1.2600 Service Pack 3
10:47:26.187 Number of processors: 1 586 0x209
10:47:26.187 ComputerName: ALENA-A5CVAFFXM UserName: Cajnik
10:47:29.812 Initialize success
10:47:31.265 AVAST engine defs: 11112802
10:47:59.234 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
10:47:59.234 Disk 0 Vendor: WDC_WD400EB-75CPF0 06.04G06 Size: 38166MB BusType: 3
10:47:59.265 Disk 0 MBR read successfully
10:47:59.265 Disk 0 MBR scan
10:47:59.265 Disk 0 Windows XP default MBR code
10:47:59.281 Disk 0 scanning sectors +78140160
10:47:59.453 Disk 0 scanning C:\WINDOWS\system32\drivers
10:48:31.781 Service scanning
10:48:34.859 Modules scanning
10:48:51.515 Disk 0 trace - called modules:
10:48:51.546 ntoskrnl.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll
10:48:51.546 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x82389ab8]
10:48:51.546 3 CLASSPNP.SYS[f8577fd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x823d0d98]
10:48:52.500 AVAST engine scan C:\WINDOWS
10:49:01.828 AVAST engine scan C:\WINDOWS\system32
10:55:12.156 AVAST engine scan C:\WINDOWS\system32\drivers
10:55:36.656 AVAST engine scan C:\Documents and Settings\Cajnik
11:04:55.468 AVAST engine scan C:\Documents and Settings\All Users
11:05:41.500 Scan finished successfully
11:08:01.328 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Cajnik\Plocha\MBR.dat"
11:08:01.343 The log file has been saved successfully to "C:\Documents and Settings\Cajnik\Plocha\aswMBR.txt"

[Márty84]

Omlouvam se za vstup

Kdyz spustite Avast, kliknete na Testovat pocitac, objevi se vam napis Zaznamy testu. Nenajdete tam vysledky toho testu a nazvem toho souboru?
Jestli ano, napiste ho sem.

Preji uspesne doreseni

[Lukvot]

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\85IJODIZ\yozdt[1].bmp

Závažnost: Vysoká
Stav: Hrozba: Win32:Rootkit-gen [Rtk]
Akce: Přesunut do Truhly
Výsledek: Akce proběhla úspěšně

[vyosek]

Dekuji kolegovi za vstup, tohle nam hodne pomuze

Stahnete OTM (viz muj podpis)

• Pokud pouzivate Win Vista ci W7, kliknete na OTM pravym a dejte Run As Administrator ci Spustit jako spravce
• Do leveho okna Paste Instructions for Items to be Moved (pod zlutou caru) vlozte obsah, ktery mate nize

• Kód: Vybrat vše

  :reg
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BrowserChoice]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
  
  :files
  C:\Documents and Settings\Cajnik\Data aplikací\Mozilla\Firefox\Profiles\yc85q8jm.default\searchplugins\askcom.xml
  C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\*.*
  %windir%\system32\*.tmp.dll /s
  %windir%\system32\SET*.tmp /s
  %windir%\*.tmp
  
  :commands
  [RESETHOSTS]
  [EMPTYTEMP]
  [EMPTYFLASH]

• Kliknete na cervene tlacitko MoveIt!
• Budete vyzvani na restart, dejte Yes, log pote najdete C:\_OTM\MovedFiles, obsah sem vlozte

[Lukvot]

All processes killed
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BrowserChoice\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task\ deleted successfully.
========== FILES ==========
C:\Documents and Settings\Cajnik\Data aplikací\Mozilla\Firefox\Profiles\yc85q8jm.default\searchplugins\askcom.xml moved successfully.
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\desktop.ini moved successfully.
File/Folder C:\WINDOWS\system32\*.tmp.dll not found.
File/Folder C:\WINDOWS\system32\SET*.tmp not found.
C:\WINDOWS\SET3.tmp moved successfully.
C:\WINDOWS\SET51.tmp moved successfully.
C:\WINDOWS\SET52.tmp moved successfully.
C:\WINDOWS\SET5E.tmp moved successfully.
C:\WINDOWS\SETA.tmp moved successfully.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 26941149 bytes
->Temporary Internet Files folder emptied: 66280780 bytes
->Flash cache emptied: 65038 bytes

User: All Users

User: Cajnik
->Temp folder emptied: 24838071 bytes
->Temporary Internet Files folder emptied: 15986070 bytes
->FireFox cache emptied: 48611396 bytes
->Flash cache emptied: 721 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 133487 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 402 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 2504 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 692612 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 104415 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 4049620 bytes
RecycleBin emptied: 86563674 bytes

Total Files Cleaned = 262,00 mb


[EMPTYFLASH]

User: Administrator
->Flash cache emptied: 0 bytes

User: All Users

User: Cajnik
->Flash cache emptied: 0 bytes

User: Default User

User: LocalService

User: NetworkService

Total Flash Files Cleaned = 0,00 mb


OTM by OldTimer - Version 3.1.19.0 log created on 11292011_140558

Files moved on Reboot...
File move failed. C:\WINDOWS\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...

[vyosek]

jak se chova nas pacient

[Lukvot]

Zdá se, že je stabilizován a reaguje o poznání svižněji. Děkuji mnohokrát!

[vyosek]

Tak jeste uklidime

T-Cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe

• Stahnete a spustte
• Pro potvrzeni volby mackejte A, Enter
• Po pouziti utilitu smazte
• Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

OTC http://oldtimer.geekstogo.com/OTC.exe

• Stahnete a spustte
• Kliknete na CleanUp a potvrdte YES
• Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

• Stahnete a spustte
• Kliknete na Start a potvrdte OK
• Program uklidi a restartuje pc
• Po pouziti utilitu smazte

Stahnete Ccleaner (viz muj podpis)
Panel čistič

• Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

• dejte Hledej problémy
• nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
• postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

• Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za tyden

Doporucuji provest defragmentaci disku

• Nejjednodussi (ale nejmene ucinny) zpusob je pomoci utility ve windowsech
  • Kliknete na Tento pocitac, dale na disk kliknete pravym tlacitkem, vyberte Vlastnosti
  • prepnete se do zalozky Nastroje
  • Nyni vidite pomucky Defragmentace - spustte ji kliknutim na Defragmentovat
  • Toto provedte se vsemi disky
• Dalsi moznosti (a mnou doporucenou) je pres programek Defraggler http://www.stahuj.centrum.cz/utility_a_ ... efraggler/
  • Program stahnete, nainstalujte (dejte fajfku pryc u yahoo toolbaru) a spustte
  • Kliknete na Analyzovat
  • Pokud je ve sloupci Fragmentováno vice jak 5%, doporucuji provest defragmentaci (klik na Defragmentovat)
  • Postup provedte se vsemi disky
• Posledni moznost je pres jednoduchy programek JKDefrag http://www.stahuj.centrum.cz/utility_a_ ... /jkdefrag/
  • Vyhodou programku je, ze se neinstaluje
  • Staci tedy jen stahnout dle verze vaseho OS a rozbalit
  • Nasledne spustit pomoci souboru JKDefrag pripadne JKDefrag64
  • Probehne analyza disku a nasledne i defragmentace

A pokud nejsou problemy ci dotazy, je to z nasi strany vse

jinak i za kolegu, nemate zac, rado se stalo