Vypínání/zapínání PC. Sekání při datovém přenosu?

Zpráva

WIAL · #1 Příspěvek od **WIAL** » 16 bře 2012 19:14

podezřelé chování PC: Sám se vypne či zapne. Mám podezření na MB či zdroj. Dále se seká při hraní online her, nebo když jsem posílal něco na ftp... při nějakém přenosu. Nechápu.
LOG.txt:

Logfile of random's system information tool 1.09 (written by random/random)
Run by kundibal at 2012-03-16 19:08:33
Microsoft Windows XP Professional Service Pack 3
System drive C: has 3 GB (12%) free of 25 GB
Total RAM: 3327 MB (70% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:08:38, on 16.3.2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17108)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Capsa.cz\DokanLibrary0.5.3\mounter.exe
C:\WINDOWS\system32\FsUsbExService.Exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
F:\INSTALl\System protection\PC CLEAN\HiJackThis_v2.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\VITSOFT\Vit Registry Fix\Vit Registry Fix.exe
C:\Documents and Settings\kundibal\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\kundibal\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\kundibal\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\kundibal\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\kundibal\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\kundibal\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
E:\DOCUMENTS\Downloads\RSIT.exe
C:\Program Files\trend micro\kundibal.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://eu.ask.com/?l=dis&o=14672
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl Class - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe (file missing)
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O15 - Trusted Zone: *.clonewarsadventures.com
O15 - Trusted Zone: *.freerealms.com
O15 - Trusted Zone: *.soe.com
O15 - Trusted Zone: *.sony.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 1135424515
O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} (JuniperSetupClientControl Class) - https://uras.eu.sabmiller.com/dana-cach ... Client.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{03A562CB-672B-4D8C-B254-66C00ADA9AE6}: NameServer = 192.168.10.1
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: DokanMounter - Unknown owner - C:\Program Files\Capsa.cz\DokanLibrary0.5.3\mounter.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: FsUsbExService - Teruten - C:\WINDOWS\system32\FsUsbExService.Exe
O23 - Service: LogMeIn Hamachi Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PostgreSQL Database Server 8.3 (pgsql-8.3) - Unknown owner - D:\DB POKER\bin\pg_ctl.exe (file missing)
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

--
End of file - 7932 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-823518204-1035525444-725345543-1003Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-823518204-1035525444-725345543-1003UA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL [2011-02-12 4220304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2011-04-18 818280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL [2010-12-21 561552]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-07-12 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2011-07-12 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2011-04-18 818280]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"HDAudDeck"=C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe [2010-05-24 33747360]
"Logitech Utility"=C:\WINDOWS\Logi_MwX.Exe [2003-03-04 19968]
"KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k []
"avast"=C:\Program Files\AVAST Software\Avast\avastUI.exe [2011-04-18 3460784]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2012-02-10 15494464]
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2012-02-10 108352]
"MSConfig"=C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE [2008-04-14 169984]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\daemon.exe [2008-07-24 490952]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5ServiceManager]
C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [2010-02-22 406992]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AutoStartNPSAgent]
C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe [2011-06-04 102400]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCSSync]
C:\Program Files\Microsoft Office\Office14\BCSSync.exe [2010-03-13 91520]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
C:\Documents and Settings\kundibal\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-04-03 136176]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe [2012-02-28 1987976]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [2012-01-13 460872]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NPSStartup]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SwitchBoard]
C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AVer HID Receiver.lnk]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AVerQuick.lnk]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^kundibal^Start Menu^Programs^Startup^Warkeys Update.lnk]
C:\PROGRA~1\Warkeys\AUTOWA~1\AUTOHO~1\AUTOHO~1.EXE [2009-09-25 245248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 239496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL [2011-02-12 4220304]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\QIP\qip.exe"="C:\Program Files\QIP\qip.exe:*:Enabled:Quiet Internet Pager"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\Samsung\Samsung New PC Studio\npsasvr.exe"="C:\Program Files\Samsung\Samsung New PC Studio\npsasvr.exe:*:Enabled:KTF MUSIC AoD Server"
"C:\Program Files\Samsung\Samsung New PC Studio\npsvsvr.exe"="C:\Program Files\Samsung\Samsung New PC Studio\npsvsvr.exe:*:Enabled:KTF MUSIC VoD Server"
"C:\Program Files\Microsoft Games\Zoo Tycoon 2\zt.exe"="C:\Program Files\Microsoft Games\Zoo Tycoon 2\zt.exe:*:Enabled:Zoo Tycoon 2 Executable"
"E:\BACKUP\GAMES\Colonization.exe"="E:\BACKUP\GAMES\Colonization.exe:*:Enabled:Sid Meier's Civilization IV Colonization"
"E:\Program Files\Steam\steamapps\common\poxnora\LaunchPad.exe"="E:\Program Files\Steam\steamapps\common\poxnora\LaunchPad.exe:*:Enabled:PoxNora"
"C:\Program Files\Microsoft Office\Office14\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office14\GROOVE.EXE:*:Enabled:Microsoft SharePoint Workspace"
"C:\Program Files\Microsoft Office\Office14\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office14\ONENOTE.EXE:*:Enabled:Microsoft OneNote"
"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"E:\Program Files\Steam\steamapps\steam210576\condition zero\hl.exe"="E:\Program Files\Steam\steamapps\steam210576\condition zero\hl.exe:*:Enabled:Counter-Strike: Condition Zero"
"C:\Program Files\BitTorrent\BitTorrent.exe"="C:\Program Files\BitTorrent\BitTorrent.exe:*:Enabled:BitTorrent"
"E:\Program Files\Steam\steamapps\common\dota 2 beta\dota.exe"="E:\Program Files\Steam\steamapps\common\dota 2 beta\dota.exe:*:Enabled:Dota 2"
"E:\Program Files\Steam\steamapps\steam210576\counter-strike\hl.exe"="E:\Program Files\Steam\steamapps\steam210576\counter-strike\hl.exe:*:Enabled:Counter-Strike"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"VIDC.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"VIDC.IYUV"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVU9"=tsbyuv.dll
"VIDC.YVYU"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"VIDC.FPS1"=frapsvid.dll
"MSVideo8"=VfWWDM32.dll
"vidc.VP60"=C:\WINDOWS\system32\vp6vfw.dll
"vidc.VP61"=C:\WINDOWS\system32\vp6vfw.dll
"VIDC.FMVC"=fmcodec.dll

======List of files/folders created in the last 1 month======

2012-03-16 19:08:33 ----D---- C:\rsit
2012-03-16 19:02:22 ----A---- C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2012-03-16 18:52:31 ----A---- C:\WINDOWS\isRS-000.tmp
2012-03-15 12:42:06 ----D---- C:\WINDOWS\Installer
2012-03-12 22:10:11 ----D---- C:\Documents and Settings\kundibal\Application Data\dvdcss
2012-03-12 19:24:01 ----A---- C:\WINDOWS\zip.exe
2012-03-12 19:24:01 ----A---- C:\WINDOWS\SWXCACLS.exe
2012-03-12 19:24:01 ----A---- C:\WINDOWS\SWSC.exe
2012-03-12 19:24:01 ----A---- C:\WINDOWS\SWREG.exe
2012-03-12 19:24:01 ----A---- C:\WINDOWS\sed.exe
2012-03-12 19:24:01 ----A---- C:\WINDOWS\PEV.exe
2012-03-12 19:24:01 ----A---- C:\WINDOWS\NIRCMD.exe
2012-03-12 19:24:01 ----A---- C:\WINDOWS\MBR.exe
2012-03-12 19:24:01 ----A---- C:\WINDOWS\grep.exe
2012-03-12 19:23:52 ----D---- C:\WINDOWS\ERDNT
2012-03-12 19:23:50 ----SD---- C:\ComboFix
2012-03-12 19:23:44 ----D---- C:\Qoobox
2012-03-07 19:20:41 ----D---- C:\Documents and Settings\kundibal\Application Data\ElevatedDiagnostics
2012-03-07 19:17:56 ----D---- C:\WINDOWS\system32\windowspowershell
2012-03-07 19:17:54 ----HDC---- C:\WINDOWS\$NtUninstallKB926139-v2$
2012-03-07 18:54:52 ----D---- C:\Documents and Settings\kundibal\Application Data\Adobe
2012-03-05 21:08:02 ----D---- C:\Program Files\Blender Foundation
2012-03-05 17:23:30 ----D---- C:\Program Files\Lavalys
2012-03-05 17:17:00 ----D---- C:\Documents and Settings\kundibal\Application Data\FreeStone Group
2012-03-05 17:16:56 ----D---- C:\Program Files\Video Card Stability Test
2012-03-03 11:40:11 ----D---- C:\Documents and Settings\All Users\Application Data\RELOADED
2012-02-27 21:15:53 ----A---- C:\user.js
2012-02-27 21:15:49 ----D---- C:\Documents and Settings\All Users\Application Data\TheBflix
2012-02-27 21:15:00 ----D---- C:\Documents and Settings\All Users\Application Data\InstallMate
2012-02-25 09:39:41 ----D---- C:\NVIDIA

======List of files/folders modified in the last 1 month======

2012-03-16 19:08:38 ----D---- C:\Program Files\trend micro
2012-03-16 19:08:36 ----D---- C:\WINDOWS\Prefetch
2012-03-16 19:06:01 ----D---- C:\WINDOWS\system32
2012-03-16 19:06:01 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2012-03-16 19:03:58 ----ASH---- C:\boot.ini
2012-03-16 19:03:58 ----A---- C:\WINDOWS\win.ini
2012-03-16 19:03:58 ----A---- C:\WINDOWS\system.ini
2012-03-16 19:02:40 ----D---- C:\WINDOWS\system32\drivers
2012-03-16 19:02:32 ----D---- C:\WINDOWS\temp
2012-03-16 19:02:08 ----D---- C:\WINDOWS
2012-03-16 19:01:30 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2012-03-16 19:00:41 ----A---- C:\WINDOWS\SchedLgU.Txt
2012-03-16 19:00:40 ----D---- C:\WINDOWS\system32\CatRoot2
2012-03-16 18:31:51 ----D---- C:\Documents and Settings\kundibal\Application Data\Capsa
2012-03-12 19:37:04 ----D---- C:\WINDOWS\Minidump
2012-03-12 19:31:12 ----D---- C:\WINDOWS\AppPatch
2012-03-12 19:31:09 ----D---- C:\Program Files\Common Files
2012-03-09 07:04:31 ----D---- C:\Documents and Settings\kundibal\Application Data\vlc
2012-03-08 09:32:41 ----D---- C:\Documents and Settings
2012-03-08 09:32:07 ----SHD---- C:\System Volume Information
2012-03-07 22:21:04 ----D---- C:\Documents and Settings\kundibal\Application Data\Winamp
2012-03-07 20:50:13 ----RSD---- C:\WINDOWS\assembly
2012-03-07 20:49:59 ----D---- C:\WINDOWS\Microsoft.NET
2012-03-07 19:25:35 ----D---- C:\Documents and Settings\kundibal\Application Data\BitTorrent
2012-03-07 19:20:45 ----RD---- C:\Program Files
2012-03-07 19:19:59 ----D---- C:\WINDOWS\system32\Restore
2012-03-07 19:18:18 ----HD---- C:\WINDOWS\inf
2012-03-07 19:17:58 ----D---- C:\WINDOWS\system32\config
2012-03-07 17:20:21 ----D---- C:\WINDOWS\Debug
2012-03-07 10:24:47 ----D---- C:\WINDOWS\system32\wbem
2012-03-05 19:25:34 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2012-03-05 18:58:24 ----D---- C:\Program Files\Geeks3D
2012-03-04 21:01:39 ----A---- C:\WINDOWS\NeroDigital.ini
2012-03-03 19:05:52 ----D---- C:\Program Files\PokerTracker 3
2012-03-03 19:05:40 ----D---- C:\Program Files\PokerStars
2012-02-29 12:59:04 ----D---- C:\Program Files\LogMeIn Hamachi
2012-02-28 20:21:11 ----SD---- C:\WINDOWS\Tasks
2012-02-28 20:08:01 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2012-02-28 19:30:48 ----D---- C:\Documents and Settings\All Users\Application Data\regid.1986-12.com.adobe
2012-02-26 12:27:34 ----D---- C:\Documents and Settings\kundibal\Application Data\NVIDIA
2012-02-25 09:44:33 ----D---- C:\Program Files\NVIDIA Corporation
2012-02-25 09:43:46 ----RSHDC---- C:\WINDOWS\system32\dllcache
2012-02-25 09:43:24 ----D---- C:\WINDOWS\system32\ReinstallBackups
2012-02-25 09:43:18 ----D---- C:\WINDOWS\Help
2012-02-25 09:43:18 ----D---- C:\Documents and Settings\All Users\Application Data\NVIDIA Corporation
2012-02-17 17:45:42 ----D---- C:\Program Files\Magic Workstation

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2009-07-09 45200]
R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2011-03-26 717296]
R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2011-04-18 30680]
R1 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2011-04-18 25432]
R1 aswSnx;aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [2011-04-18 441176]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2011-04-18 307288]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2011-04-18 49240]
R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2010-12-21 115008]
R1 epfwtdir;epfwtdir; C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2010-12-21 94872]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-14 8832]
R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-08-23 12032]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2011-04-18 19544]
R2 aswMon2;aswMon2; C:\WINDOWS\system32\drivers\aswMon2.sys [2011-04-18 102488]
R2 atksgt;atksgt; C:\WINDOWS\system32\DRIVERS\atksgt.sys [2011-10-21 279712]
R2 Dokan;Dokan; \??\C:\WINDOWS\system32\drivers\dokan.sys []
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2010-12-21 141264]
R2 lirsgt;lirsgt; C:\WINDOWS\system32\DRIVERS\lirsgt.sys [2011-10-21 25888]
R3 AR5211;TP-LINK Wireless Network Adapter Service; C:\WINDOWS\system32\DRIVERS\ar5211.sys [2005-12-21 470048]
R3 FsUsbExDisk;FsUsbExDisk; \??\C:\WINDOWS\system32\FsUsbExDisk.SYS []
R3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2009-03-18 26176]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusbf;USB Mouse Rate Adjuster Lower Filter by SweetLow; C:\WINDOWS\system32\DRIVERS\hidusbf.sys [2006-11-08 4544]
R3 L1e;Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller; C:\WINDOWS\system32\DRIVERS\l1e51x86.sys [2009-05-20 38400]
R3 LHidFlt2;Logitech HID/USB Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\LHidFlt2.Sys [2003-03-04 25214]
R3 LHidUsb;Logitech USB Receiver device driver; C:\WINDOWS\System32\Drivers\LHidUsb.Sys [2003-03-04 37804]
R3 LMouFlt2;Logitech Mouse Class Filter Driver; C:\WINDOWS\system32\DRIVERS\LMouFlt2.Sys [2003-03-04 73134]
R3 MBAMProtector;MBAMProtector; \??\C:\WINDOWS\system32\drivers\mbam.sys []
R3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\WINDOWS\system32\drivers\mbamswissarmy.sys []
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-15 5810]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2012-02-10 13415040]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service; C:\WINDOWS\system32\drivers\viahduaa.sys [2010-05-15 2136224]
S3 akqjbbbi;akqjbbbi; C:\WINDOWS\system32\drivers\akqjbbbi.sys []
S3 AVerAF15DMBTH;AVerMedia A850 USB; C:\WINDOWS\System32\Drivers\AVerAF15DMBTH.sys [2010-05-06 569728]
S3 catchme;catchme; \??\C:\DOCUME~1\kundibal\LOCALS~1\Temp\catchme.sys []
S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 dsNcAdpt;Juniper Network Connect Adapter; C:\WINDOWS\system32\DRIVERS\dsNcAdpt.sys []
S3 GGSAFERDriver;GGSAFER Driver; \??\E:\Garena\safedrv.sys []
S3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
S3 monfilt;monfilt; C:\WINDOWS\system32\drivers\monfilt.sys [2008-02-14 1389056]
S3 MPE;BDA MPE Filter; C:\WINDOWS\system32\DRIVERS\MPE.sys [2008-04-13 15232]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2008-04-13 20992]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 ss_bbus;SAMSUNG USB Mobile Device (WDM); C:\WINDOWS\system32\DRIVERS\ss_bbus.sys [2009-03-20 90112]
S3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter); C:\WINDOWS\system32\DRIVERS\ss_bmdfl.sys [2009-03-20 14976]
S3 ss_bmdm;SAMSUNG USB Mobile Modem; C:\WINDOWS\system32\DRIVERS\ss_bmdm.sys [2009-03-20 121856]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 RsFx0103;RsFx0103 Driver; C:\WINDOWS\system32\DRIVERS\RsFx0103.sys [2009-03-30 239336]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2011-04-18 42184]
R2 DokanMounter;DokanMounter; C:\Program Files\Capsa.cz\DokanLibrary0.5.3\mounter.exe [2010-08-29 22016]
R2 FsUsbExService;FsUsbExService; C:\WINDOWS\system32\FsUsbExService.Exe [2009-03-31 233472]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2011-07-12 153376]
R2 MBAMService;MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [2012-01-13 652360]
R2 NVSvc;NVIDIA Driver Helper Service; C:\WINDOWS\system32\nvsvc32.exe [2012-02-10 164160]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 pgsql-8.3;PostgreSQL Database Server 8.3; D:\DB POKER\bin\pg_ctl.exe runservice -w -N pgsql-8.3 -D D:\DB POKER\data\ []
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2010-03-18 35160]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2011-05-07 654848]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine; C:\Program Files\LogMeIn Hamachi\hamachi-2.exe [2012-02-28 1373576]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service; C:\Program Files\Microsoft Office\Office14\GROOVE.EXE [2010-12-27 31124344]
S3 MSSQL$SONY_MEDIAMGR;MSSQL$SONY_MEDIAMGR; C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe -sSONY_MEDIAMGR []
S3 MSSQL$SQLEXPRESS;SQL Server (SQLEXPRESS); C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [2009-03-30 43010392]
S3 MSSQLServerADHelper;MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe [2002-12-17 66112]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2008-04-07 430592]
S3 SQLAgent$SONY_MEDIAMGR;SQLAgent$SONY_MEDIAMGR; C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE -i SONY_MEDIAMGR []
S3 SQLWriter;SQL Server VSS Writer; C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe [2008-07-10 98840]
S3 SwitchBoard;SwitchBoard; C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:\Program Files\Bonjour\mDNSResponder.exe [2006-02-28 229376]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service; C:\Program Files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2009-07-23 47128]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS); C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2009-03-30 366936]
S4 SQLBrowser;SQL Server Browser; C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe [2009-03-30 254808]

-----------------EOF-----------------

INFO.TXT:

info.txt logfile of random's system information tool 1.09 2012-03-16 19:08:42

======Uninstall list======

-->MsiExec /X{B9DB4C76-01A4-46D5-8910-F7AA6376DBAF}
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe AIR-->C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe -arp:uninstall
Adobe AIR-->MsiExec.exe /I{A2BCA9F1-566C-4805-97D1-7FDC93386723}
Adobe Anchor Service CS3-->MsiExec.exe /I{90176341-0A8B-4CCC-A78D-F862228A6B95}
Adobe Asset Services CS3-->MsiExec.exe /I{6D12B99F-EAAA-49D8-8E2F-74FA7459CCB2}
Adobe Asset Services CS3-->MsiExec.exe /I{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}
Adobe Bridge CS3-->MsiExec.exe /I{9C9824D9-9000-4373-A6A5-D0E5D4831394}
Adobe Bridge Start Meeting-->MsiExec.exe /I{08B32819-6EEF-4057-AEDA-5AB681A36A23}
Adobe BridgeTalk Plugin CS3-->MsiExec.exe /I{B73CFB12-C814-4638-AFFD-7E3AAFAF0B4E}
Adobe Camera Raw 4.0-->MsiExec.exe /I{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}
Adobe CMaps-->MsiExec.exe /I{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}
Adobe Color - Photoshop Specific-->MsiExec.exe /I{A2D81E70-2A98-4A08-A628-94388B063C5E}
Adobe Color Common Settings-->MsiExec.exe /I{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}
Adobe Color EU Recommended Settings-->MsiExec.exe /I{BD087F50-46B2-43E4-BD73-5DB3DC20B47C}
Adobe Color JA Extra Settings-->MsiExec.exe /I{D92B72E2-C854-4738-8ED6-4C3661CC17AE}
Adobe Color NA Extra Settings-->MsiExec.exe /I{6179A7D2-A668-4F1D-BC9A-DCC6A10C7871}
Adobe Community Help-->msiexec /qb /x {0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}
Adobe Community Help-->MsiExec.exe /I{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}
Adobe Default Language CS3-->MsiExec.exe /I{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}
Adobe Device Central CS3-->MsiExec.exe /I{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}
Adobe Dreamweaver CS3-->MsiExec.exe /I{ED95B55C-4759-4242-85DE-EAD1DA7AB090}
Adobe ExtendScript Toolkit 2-->MsiExec.exe /I{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}
Adobe Extension Manager CS3-->MsiExec.exe /I{BE5F3842-8309-4754-92D5-83E02E6077A3}
Adobe Flash CS3-->MsiExec.exe /I{AE6BE2FE-5D3D-4FA0-98BC-57B7B78493F4}
Adobe Flash Player 10 Plugin-->MsiExec.exe /X{BC41C09D-FAA9-4346-9FE6-1E0017BC551A}
Adobe Flash Player 11 Plugin-->C:\WINDOWS\system32\Macromed\Flash\FlashUtil11e_Plugin.exe -maintain plugin
Adobe Flash Professional CS5-->C:\Program Files\Common Files\Adobe\OOBE\PDApp\core\PDApp.exe --appletID="DWA_UI" --appletVersion="1.0" --mode="Uninstall" --mediaSignature="{CFC9F871-7C40-40B6-BE4A-B98A5B309716}"
Adobe Fonts All-->MsiExec.exe /I{6ABE0BEE-D572-4FE8-B434-9E72A289431B}
Adobe Help Viewer CS3-->MsiExec.exe /I{04AF207D-9A77-465A-8B76-991F6AB66245}
Adobe Illustrator CS3-->C:\Program Files\Common Files\Adobe\Installers\b5ed30048e229c36945fd3d95860c0b\Setup.exe
Adobe Illustrator CS3-->MsiExec.exe /I{D6CD1A90-1421-4F19-AFD8-BE4E28A1D6D5}
Adobe InDesign CS3 Icon Handler-->MsiExec.exe /I{EA7B3CC4-366D-4CF6-8350-FD7A7034116E}
Adobe Linguistics CS3-->MsiExec.exe /I{54793AA1-5001-42F4-ABB6-C364617C6078}
Adobe Media Player-->MsiExec.exe /I{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}
Adobe MotionPicture Color Files-->MsiExec.exe /I{6B708481-748A-4EB4-97C1-CD386244FF77}
Adobe PDF Library Files-->MsiExec.exe /I{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}
Adobe Photoshop CS3-->C:\Program Files\Common Files\Adobe\Installers\4977c84bcdc298c444ccfbdcccb660d\Setup.exe
Adobe Photoshop CS3-->MsiExec.exe /I{5178C1BB-1EB1-4468-894B-7DE964DDCAA2}
Adobe Premiere Pro CS3 Functional Content-->MsiExec.exe /I{50F102CA-4BE2-41A9-9810-5BB05EB91B9A}
Adobe Premiere Pro CS3-->C:\Program Files\Common Files\Adobe\Installers\32fdd767b4383606e8168e834af5d90\Setup.exe
Adobe Premiere Pro CS3-->MsiExec.exe /I{58DCEEE5-532E-44F4-B1D7-A146EF9E9FDA}
Adobe Setup-->MsiExec.exe /I{0901FCE8-5415-4499-BBC8-1AA106DD66E2}
Adobe Setup-->MsiExec.exe /I{6EC3499F-025A-4EDB-A03D-AB3DC042051D}
Adobe Setup-->MsiExec.exe /I{739CE62B-2893-4D89-8BF8-9B4034633DB6}
Adobe Setup-->MsiExec.exe /I{BB81360F-041C-4CF7-B15E-71380D154244}
Adobe SING CS3-->MsiExec.exe /I{B671CBFD-4109-4D35-9252-3062D3CCB7B2}
Adobe Stock Photos CS3-->MsiExec.exe /I{29E5EA97-5F74-4A57-B8B2-D4F169117183}
Adobe Type Support-->MsiExec.exe /I{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}
Adobe Update Manager CS3-->MsiExec.exe /I{E69AE897-9E0B-485C-8552-7841F48D42D8}
Adobe Version Cue CS3 Client-->MsiExec.exe /I{D0DFF92A-492E-4C40-B862-A74A173C25C5}
Adobe WAS CS3-->MsiExec.exe /I{C5BD220A-EFE8-48A5-B70E-9503D535FACE}
Adobe WinSoft Linguistics Plugin-->MsiExec.exe /I{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}
Adobe XMP DVA Panels CS3-->MsiExec.exe /I{0224CACC-994D-45F8-B973-D65056EA9C2F}
Adobe XMP Panels CS3-->MsiExec.exe /I{802771A9-A856-4A41-ACF7-1450E523C923}
Adobe XMP Panels CS3-->MsiExec.exe /I{D5A31AB1-345D-47C7-A87B-036A669F6DF1}
AHV content for Acrobat and Flash-->MsiExec.exe /I{6BBAA81D-6A7E-43AD-8889-2F002DCAAFDD}
Atheros Communications Inc.(R) AR8121/AR8113/AR8114 Gigabit/Fast Ethernet Driver-->"C:\Program Files\InstallShield Installation Information\{3108C217-BE83-42E4-AE9E-A56A2A92E549}\Setup.exe" -runfromtemp -l0x0009 -removeonly
aTube Catcher-->C:\Program Files\DsNET Corp\aTube Catcher 2.0\uninstall.exe
avast! Free Antivirus-->C:\Program Files\AVAST Software\Avast\aswRunDll.exe "C:\Program Files\AVAST Software\Avast\Setup\setiface.dll" RunSetup
BitTorrent-->"C:\Program Files\BitTorrent\BitTorrent.exe" /UNINSTALL
Blender-->"C:\Program Files\Blender Foundation\Blender\uninstall.exe"
Bookworm Adventures Deluxe 1.00-->C:\Program Files\Games\Bookworm Adventures Deluxe\UNWISE.exe
BS.Player FREE-->"C:\Program Files\Webteh\BSplayer\uninstall.exe"
Capsa.cz 1.1.13-->"C:\Program Files\Capsa.cz\unins000.exe"
CCleaner-->"C:\Program Files\CCleaner\uninst.exe"
Counter-Strike: Condition Zero Deleted Scenes-->"E:\Program Files\Steam\steam.exe" steam://uninstall/100
Crystal Reports for Visual Studio-->MsiExec.exe /I{AC41D924-8C68-4BD5-A7A1-0AE4176C31A6}
DawnOfWar-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\IDriver.exe /M{362D5167-9716-44BE-89FD-BF9EB6EF814B}
Defraggler-->"C:\Program Files\Defraggler\uninst.exe"
Diablo II-->C:\WINDOWS\DIIUnin.exe C:\WINDOWS\DIIUnin.dat
Dota 2-->"E:\Program Files\Steam\steam.exe" steam://uninstall/570
Dotfuscator Software Services - Community Edition-->MsiExec.exe /X{41B31ABE-5A6E-498A-8F28-3BA3B8779A41}
Dungeon Keeper 2-->C:\WINDOWS\IsUninst.exe -fe:\backup\games\DK\Uninst.isu -c"e:\backup\games\DK\uninst.dll"
EVEREST Ultimate Edition v5.50-->"C:\Program Files\Lavalys\EVEREST Ultimate Edition\unins000.exe"
Fraps (remove only)-->"C:\Program Files\fraps\uninstall.exe"
Garena 2010-->E:\Garena\uninst.exe
GPU Caps Viewer 1.14.5-->"C:\Program Files\Geeks3D\GPU_Caps_Viewer_v1.14.5\unins000.exe"
Guitar Pro 5.2-->"C:\Program Files\Guitar Pro 5\unins000.exe"
HD Tune 2.55-->"C:\Program Files\HD Tune\unins000.exe"
HijackThis 2.0.0-->"F:\INSTALl\System protection\PC CLEAN\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
IrfanView (remove only)-->C:\Program Files\IrfanView\iv_uninstall.exe
Java(TM) 6 Update 26-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216026FF}
Last.fm 1.5.4.27091-->"C:\Program Files\Last.fm\unins000.exe"
Logitech MouseWare 9.76 -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5809E7CF-4DCF-11D4-9875-00105ACE7734}\setup.exe" -l0x9 -l0009 UNINSTALL
LogMeIn Hamachi-->C:\WINDOWS\system32\\msiexec.exe /i {E2494AD8-314D-44F8-B39C-4358A60DC184} REMOVE=ALL
LogMeIn Hamachi-->MsiExec.exe /I{491DFBAA-77EF-4B06-8676-2FC66EEE049A}
LogMeIn Hamachi-->MsiExec.exe /I{E2494AD8-314D-44F8-B39C-4358A60DC184}
Magic ISO Maker v5.5 (build 0281)-->C:\PROGRA~1\MagicISO\UNWISE.EXE C:\PROGRA~1\MagicISO\INSTALL.LOG
Magic Set Editor 2.0.0-->"C:\Program Files\Magic Set Editor 2\unins000.exe"
Magic Workstation 0.94f-->"C:\Program Files\Magic Workstation\unins000.exe"
Malwarebytes Anti-Malware version 1.60.1.1000-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 1.1 Security Update (KB2656353)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M2656353\M2656353Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft .NET Framework 4 Client Profile-->C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\Setup.exe /repair /x86 /parameterfolder Client
Microsoft .NET Framework 4 Client Profile-->MsiExec.exe /X{3C3901C5-3455-3E0A-A214-0B093A5070A6}
Microsoft .NET Framework 4 Extended-->C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\Setup.exe /repair /x86 /parameterfolder Extended
Microsoft .NET Framework 4 Extended-->MsiExec.exe /X{0A0CADCF-78DA-33C4-A350-CD51849B9702}
Microsoft .NET Framework 4 Multi-Targeting Pack-->MsiExec.exe /I{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}
Microsoft ASP.NET MVC 2 - Visual Studio 2010 Tools-->MsiExec.exe /X{40416836-56CC-4C0E-A6AF-5C34BADCE483}
Microsoft ASP.NET MVC 2-->MsiExec.exe /X{1803A630-3C38-4D2B-9B9A-0CB37243539C}
Microsoft Games for Windows - LIVE Redistributable-->MsiExec.exe /X{8FB1B528-E260-451E-9B55-E9152F94B80B}
Microsoft Help Viewer 1.0-->C:\Program Files\Microsoft Help Viewer\v1.0\Microsoft Help Viewer 1.0\install.exe
Microsoft Help Viewer 1.0-->MsiExec.exe /X{47C39E4A-28F2-33B1-B9B7-97F24E52D917}
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-0000-0000000FF1CE}" "{047B0968-E622-4FAA-9B4B-121FA109EDDE}" "1033" "0"
Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0015-0409-0000-0000000FF1CE}" "{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" "1033" "0"
Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0016-0409-0000-0000000FF1CE}" "{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" "1033" "0"
Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0018-0409-0000-0000000FF1CE}" "{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" "1033" "0"
Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0019-0409-0000-0000000FF1CE}" "{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" "1033" "0"
Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-001A-0409-0000-0000000FF1CE}" "{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" "1033" "0"
Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-001B-0409-0000-0000000FF1CE}" "{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" "1033" "0"
Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-001F-0409-0000-0000000FF1CE}" "{99ACCA38-6DD3-48A8-96AE-A283C9759279}" "1033" "0"
Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-001F-040C-0000-0000000FF1CE}" "{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" "1033" "0"
Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-001F-0C0A-0000-0000000FF1CE}" "{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}" "1033" "0"
Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-002C-0409-0000-0000000FF1CE}" "{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}" "1033" "0"
Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0044-0409-0000-0000000FF1CE}" "{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" "1033" "0"
Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-006E-0409-0000-0000000FF1CE}" "{4560037C-E356-444A-A015-D21F487D809E}" "1033" "0"
Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-00A1-0409-0000-0000000FF1CE}" "{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" "1033" "0"
Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-00BA-0409-0000-0000000FF1CE}" "{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" "1033" "0"
Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0115-0409-0000-0000000FF1CE}" "{4560037C-E356-444A-A015-D21F487D809E}" "1033" "0"
Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0117-0409-0000-0000000FF1CE}" "{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" "1033" "0"
Microsoft Office Access MUI (English) 2010-->MsiExec.exe /X{90140000-0015-0409-0000-0000000FF1CE}
Microsoft Office Access Setup Metadata MUI (English) 2010-->MsiExec.exe /X{90140000-0117-0409-0000-0000000FF1CE}
Microsoft Office Excel MUI (English) 2010-->MsiExec.exe /X{90140000-0016-0409-0000-0000000FF1CE}
Microsoft Office Groove MUI (English) 2010-->MsiExec.exe /X{90140000-00BA-0409-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (English) 2010-->MsiExec.exe /X{90140000-0044-0409-0000-0000000FF1CE}
Microsoft Office OneNote MUI (English) 2010-->MsiExec.exe /X{90140000-00A1-0409-0000-0000000FF1CE}
Microsoft Office Outlook MUI (English) 2010-->MsiExec.exe /X{90140000-001A-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (English) 2010-->MsiExec.exe /X{90140000-0018-0409-0000-0000000FF1CE}
Microsoft Office Professional Edition 2003-->MsiExec.exe /I{90110405-6000-11D3-8CFE-0150048383C9}
Microsoft Office Professional Plus 2010-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\setup.exe" /uninstall PROPLUS /dll OSETUP.DLL
Microsoft Office Professional Plus 2010-->MsiExec.exe /X{90140000-0011-0000-0000-0000000FF1CE}
Microsoft Office Proof (English) 2010-->MsiExec.exe /X{90140000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2010-->MsiExec.exe /X{90140000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2010-->MsiExec.exe /X{90140000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (English) 2010-->MsiExec.exe /X{90140000-002C-0409-0000-0000000FF1CE}
Microsoft Office Publisher MUI (English) 2010-->MsiExec.exe /X{90140000-0019-0409-0000-0000000FF1CE}
Microsoft Office Shared MUI (English) 2010-->MsiExec.exe /X{90140000-006E-0409-0000-0000000FF1CE}
Microsoft Office Shared Setup Metadata MUI (English) 2010-->MsiExec.exe /X{90140000-0115-0409-0000-0000000FF1CE}
Microsoft Office Word MUI (English) 2010-->MsiExec.exe /X{90140000-001B-0409-0000-0000000FF1CE}
Microsoft Silverlight 3 SDK-->MsiExec.exe /X{2012098D-EEE9-4769-8DD3-B038050854D4}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft SQL Server 2008 Browser-->MsiExec.exe /X{C688457E-03FD-4941-923B-A27F4D42A7DD}
Microsoft SQL Server 2008 Common Files-->MsiExec.exe /I{196E77C5-F524-4B50-BD1A-2C21EEE9B8F7}
Microsoft SQL Server 2008 Common Files-->MsiExec.exe /I{4A6F34E2-09E5-4616-B227-4A26A488A6F9}
Microsoft SQL Server 2008 Database Engine Services-->MsiExec.exe /I{58721EC3-8D4E-4B79-BC51-1054E2DDCD10}
Microsoft SQL Server 2008 Database Engine Services-->MsiExec.exe /I{B5153233-9AEE-4CD4-9D2C-4FAAC870DBE2}
Microsoft SQL Server 2008 Database Engine Shared-->MsiExec.exe /I{4815BD99-96A4-49FE-A885-DCF06E9E4E78}
Microsoft SQL Server 2008 Database Engine Shared-->MsiExec.exe /I{F3494AB6-6900-41C6-AF57-823626827ED8}
Microsoft SQL Server 2008 Native Client-->MsiExec.exe /I{4F44B5AE-82A6-4A8A-A3E3-E24D489728E3}
Microsoft SQL Server 2008 R2 Data-Tier Application Framework-->MsiExec.exe /I{0DDCEC37-369C-484B-B16D-B4413FD42FB9}
Microsoft SQL Server 2008 R2 Data-Tier Application Project-->MsiExec.exe /I{E5AE9031-79A5-4627-9641-BEFA82819B08}
Microsoft SQL Server 2008 R2 Management Objects-->MsiExec.exe /I{4E968D9C-21A7-4915-B698-F7AEB913541D}
Microsoft SQL Server 2008 R2 Transact-SQL Language Service-->MsiExec.exe /I{78C3657E-742C-40B1-9F53-E5A921D40F17}
Microsoft SQL Server 2008 RsFx Driver-->MsiExec.exe /I{33AE9E89-47C9-4A0D-9E9D-BDD6966A3804}
Microsoft SQL Server 2008 Setup Support Files -->MsiExec.exe /X{D441BD04-E548-4F8E-97A4-1B66135BAAA8}
Microsoft SQL Server 2008-->"C:\Program Files\Microsoft SQL Server\100\Setup Bootstrap\Release\x86\SetupARP.exe" /X86
Microsoft SQL Server 2008-->"C:\Program Files\Microsoft SQL Server\100\Setup Bootstrap\Release\x86\SetupARP.exe" /x86
Microsoft SQL Server Compact 3.5 SP2 ENU-->MsiExec.exe /I{3A9FC03D-C685-4831-94CF-4EDFD3749497}
Microsoft SQL Server Database Publishing Wizard 1.4-->MsiExec.exe /I{ACE28263-76A4-4BF5-B6F4-8BD719595969}
Microsoft SQL Server Desktop Engine (SONY_MEDIAMGR)-->MsiExec.exe /X{E09B48B5-E141-427A-AB0C-D3605127224A}
Microsoft SQL Server System CLR Types-->MsiExec.exe /I{2A2F3AE8-246A-4252-BB26-1BEB45627074}
Microsoft SQL Server VSS Writer-->MsiExec.exe /I{B857D868-F8B0-43EE-BC2B-D9E5ED21F237}
Microsoft Sync Framework Runtime v1.0 SP1 (x86)-->MsiExec.exe /I{C6DD625F-4B61-4561-8286-87CA0275CEA1}
Microsoft Sync Framework SDK v1.0 SP1-->MsiExec.exe /I{97CE8B73-AA5A-4987-A1BE-50DD1A187478}
Microsoft Sync Framework Services v1.0 SP1 (x86)-->MsiExec.exe /I{F990B526-8F7C-46E0-B1F1-6C893A8B478F}
Microsoft Sync Services for ADO.NET v2.0 SP1 (x86)-->MsiExec.exe /I{DC3D6AFB-78B4-489F-81D7-30B66E0C2417}
Microsoft Team Foundation Server 2010 Object Model - ENU-->MsiExec.exe /I{6ED37A91-7710-3183-BE50-AB043FF6689E}
Microsoft Team Foundation Server 2010 Object Model - ENU-->MsiExec.exe /X{6ED37A91-7710-3183-BE50-AB043FF6689E}
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{837b34e3-7c30-493c-8f6a-2b0f04e2912c}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148-->MsiExec.exe /X{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4974-->MsiExec.exe /X{B7E38540-E355-3503-AFD7-635B2F2F76E1}
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319-->MsiExec.exe /X{196BB40D-1578-3D01-B289-BEFC77A11A1E}
Microsoft Visual C++ 2010 x86 Runtime - 10.0.30319-->MsiExec.exe /X{6A86554B-8928-30E4-A53C-D7337689134D}
Microsoft Visual F# 2.0 Runtime-->MsiExec.exe /X{729A3000-BC8A-3B74-BA5D-5068FE12D70C}
Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools-->MsiExec.exe /X{14DD7530-CCD2-3798-B37D-3839ED6A441C}
Microsoft Visual Studio 2010 Office Developer Tools (x86)-->MsiExec.exe /X{035400A4-29BD-3723-BEED-E2718A68CDE0}
Microsoft Visual Studio 2010 Professional - ENU-->E:\Program Files\visual studio\Microsoft Visual Studio 2010 Professional - ENU\setup.exe
Microsoft Visual Studio 2010 SharePoint Developer Tools-->MsiExec.exe /X{2D9FEBEE-F1B7-344F-BFDF-760E18332D96}
Microsoft Visual Studio 2010 Tools for Office Runtime (x86)-->MsiExec.exe /X{3BB19A2B-B9C5-3872-8FDF-3047CC9F9841}
Microsoft Visual Studio Macro Tools-->msiexec.exe /uninstall {6CDEAD7E-F8D8-37F7-AB6F-1E22716E30F3}
Microsoft Visual Studio Macro Tools-->MsiExec.exe /X{6CDEAD7E-F8D8-37F7-AB6F-1E22716E30F3}
Microsoft WSE 3.0 Runtime-->MsiExec.exe /X{E3E71D07-CD27-46CB-8448-16D4FB29AA13}
Microsoft XNA Framework Redistributable 1.0 Refresh-->MsiExec.exe /I{311F799A-FCE9-4D9E-B5D2-CBB8859B40BB}
Microsoft XNA Framework Redistributable 4.0-->MsiExec.exe /I{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}
Microsoft XNA Game Studio 4.0 (ARP entry)-->MsiExec.exe /I{73BE04D9-BA0E-4BAF-9C9D-677278BDB3DC}
Microsoft XNA Game Studio 4.0 (Redists)-->MsiExec.exe /I{68BD57D3-D606-411E-A7E0-3EB6EA5660F6}
Microsoft XNA Game Studio 4.0 (Shared Components)-->MsiExec.exe /I{08C84CC6-E7FD-4B2D-BBF9-B02CC90EE031}
Microsoft XNA Game Studio 4.0 (Visual Studio)-->MsiExec.exe /I{8C496FBF-DB4A-468D-A3A1-15E127382218}
Microsoft XNA Game Studio 4.0 (XnaLiveProxy)-->MsiExec.exe /I{01C79EF3-DE84-4B56-B638-8BEA0D507506}
Microsoft XNA Game Studio 4.0 Documentation-->MsiExec.exe /I{3F4EB5FE-B5BE-4069-A5A8-6D9262E1B379}
Microsoft XNA Game Studio 4.0-->C:\Program Files\Microsoft XNA\XNA Game Studio\v4.0\Setup\Bootstrapper.exe en-US
Microsoft XNA Game Studio Platform Tools-->MsiExec.exe /I{0666E46E-A860-4353-BE6D-13AA72FABB57}
Microsoft_VC80_ATL_x86-->MsiExec.exe /I{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}
Microsoft_VC80_CRT_x86-->MsiExec.exe /I{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}
Microsoft_VC80_MFC_x86-->MsiExec.exe /I{D1A19B02-817E-4296-A45B-07853FD74D57}
Microsoft_VC80_MFCLOC_x86-->MsiExec.exe /I{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}
Microsoft_VC90_ATL_x86-->MsiExec.exe /I{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}
Microsoft_VC90_CRT_x86-->MsiExec.exe /I{08D2E121-7F6A-43EB-97FD-629B44903403}
Microsoft_VC90_MFC_x86-->MsiExec.exe /I{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}
MSVCRT Redists-->MsiExec.exe /I{7032B400-11EC-11E0-A9BF-0013D3D69929}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
MSXML 6.0 Parser (KB925673)-->MsiExec.exe /I{FE9126DB-5F84-495A-BB46-3C724F1C2D08}
MTG Card Images for Magic Workstation-->"C:\Program Files\Magic Workstation\unins002.exe"
MTG GamePack for Magic Workstation-->"C:\Program Files\Magic Workstation\unins001.exe"
Nero 6 Ultra Edition-->C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL
NVIDIA GAME System Software 2.8.1-->MsiExec.exe /I{4F0C7CCF-5666-474B-B02E-AC514A95EC93}
NVIDIA Graphics Driver 295.73-->"C:\WINDOWS\system32\RunDll32.EXE" "C:\Program Files\NVIDIA Corporation\Installer2\installer.1\NVI2.DLL",UninstallPackage Display.Driver
NVIDIA PhysX System Software 9.10.0514-->"C:\WINDOWS\system32\RunDll32.EXE" "C:\Program Files\NVIDIA Corporation\Installer2\installer.0\NVI2.DLL",UninstallPackage Display.PhysX
NVIDIA PhysX-->MsiExec.exe /X{B9DB4C76-01A4-46D5-8910-F7AA6376DBAF}
Paint.NET v3.5.10-->MsiExec.exe /X{529125EF-E3AC-4B74-97E6-F688A7C0F1BF}
PC Connectivity Solution-->MsiExec.exe /I{AC599724-5755-48C1-ABE7-ABB857652930}
PDF Settings CS5-->MsiExec.exe /I{A78FE97A-C0C8-49CE-89D0-EDD524A17392}
PDF Settings-->MsiExec.exe /I{293D5729-7C01-4FA4-A4DE-BB6A1587BBB9}
PoxNora-->"E:\Program Files\Steam\steam.exe" steam://uninstall/201210
PxMergeModule-->MsiExec.exe /I{024521CF-C07E-4F8E-8481-0D75695E03AF}
SAMSUNG Mobile Composite Device Software-->C:\WINDOWS\system32\Samsung_USB_Drivers\6_old\SSBCUninstall.exe
Samsung Mobile Modem Device Software-->C:\WINDOWS\system32\Samsung_USB_Drivers\7\SSECUninstall.exe
SAMSUNG Mobile Modem Driver Set-->C:\WINDOWS\system32\Samsung_USB_Drivers\3\SSCDUninstall.exe
Samsung Mobile phone USB driver Software-->C:\WINDOWS\system32\Samsung_USB_Drivers\5\SSSDUninstall.exe
SAMSUNG Mobile USB Modem 1.0 Software-->C:\WINDOWS\system32\Samsung_USB_Drivers\1\SS_Uninstall.exe
SAMSUNG Mobile USB Modem Software-->C:\WINDOWS\system32\Samsung_USB_Drivers\2\SSM_Uninstall.exe
Samsung New PC Studio-->"C:\Program Files\InstallShield Installation Information\{F193FC0E-9E18-40FC-A974-509A1BDD240A}\setup.exe" -runfromtemp -l0x0405 -removeonly
Samsung New PC Studio-->MsiExec.exe /X{F193FC0E-9E18-40FC-A974-509A1BDD240A}
SAMSUNG USB Mobile Device Software-->C:\WINDOWS\system32\Samsung_USB_Drivers\6\SS_BUninstall.exe
SamsungConnectivityCableDriver-->MsiExec.exe /X{7E84FAC8-C518-40F9-9807-7455301D6D25}
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {F6F5AC31-9833-3E77-AC8E-8E910CAB39AE} /qb+ REBOOTPROMPT=""
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)-->C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {728D9A6A-2206-31E8-9F65-C3EABEFCF53E} /parameterfolder Client
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)-->C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {2CE2EB39-45C8-32D4-8A99-5529C38F1B99} /parameterfolder Client
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)-->C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {7E97AB83-C1FE-38DE-B848-877E0A4BD81E} /parameterfolder Client
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)-->C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {DB31DEDD-BF95-31E7-A9B7-5480561CEFF3} /parameterfolder Client
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)-->C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {8DDEFC7E-0C61-3D11-AFC6-5414F2DAFD01} /parameterfolder Client
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)-->C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {4952F442-5C1A-38EB-8C23-B18EFE77E20C} /parameterfolder Client
Security Update for Microsoft .NET Framework 4 Extended (KB2416472)-->C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\setup.exe /uninstallpatch {7A2C18A1-D2A2-3177-82F1-5FE9CC08ECB0} /parameterfolder Extended
Security Update for Microsoft .NET Framework 4 Extended (KB2487367)-->C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\setup.exe /uninstallpatch {42A3562E-8B4E-39A4-B82D-CC12F82889E3} /parameterfolder Extended
Security Update for Microsoft .NET Framework 4 Extended (KB2656351)-->C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\setup.exe /uninstallpatch {4952F442-5C1A-38EB-8C23-B18EFE77E20C} /parameterfolder Extended
Security Update for Windows Internet Explorer 7 (KB2647516)-->"C:\WINDOWS\ie7updates\KB2647516-IE7\spuninst\spuninst.exe"
Security Update for Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Service Pack 1 for SQL Server 2008 (KB968369)-->"C:\Program Files\Microsoft SQL Server\100\Setup Bootstrap\Update Cache\KB968369\ServicePack\setup.exe" /Action=RemovePatch /AllInstances
Sid Meier's Civilization IV Colonization-->C:\Program Files\InstallShield Installation Information\{EF36A836-BF89-4A4F-B079-057B0C68C1E0}\setup.exe -runfromtemp -l0x0009 -removeonly
Sql Server Customer Experience Improvement Program-->MsiExec.exe /I{C965F01C-76EA-4BD7-973E-46236AE312D7}
StepMania (remove only)-->"C:\Program Files\StepMania\uninstall.exe"
Team Fortress 2-->"E:\Program Files\Steam\steam.exe" steam://uninstall/440
The Witcher Enhanced Edition-->"C:\Program Files\InstallShield Installation Information\{F138762F-5A1F-4CF0-A5E1-1588EF6088A4}\setup.exe" -runfromtemp -l0x0009 -removeonly
Theme Hospital-->C:\WINDOWS\uninst.exe -f"C:\Program Files\Bullfrog\Hospital\DeIsL2.isu"
Total Commander (Remove or Repair)-->F:\totalcmd\tcuninst.exe
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
Update for Microsoft .NET Framework 4 Client Profile (KB2473228)-->C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {FD988F49-E1C8-3C84-9683-0448B6BB8E20} /parameterfolder Client
VIA Platforma Ovladače zařízení-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{20D4A895-748C-4D88-871C-FDB1695B0169}
Video Card Stability Test-->C:\Program Files\Video Card Stability Test\uninstall.exe
VideoMach-->C:\Program Files\VideoMach\uninstall.exe
Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 ENU-->MsiExec.exe /X{112C23F2-C036-4D40-BED4-0CB47BF5555C}
Vit Registry Fix 10 (remove only)-->C:\Program Files\VITSOFT\Vit Registry Fix\Uninstall.exe
VLC media player 1.1.11-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Warkeys 1.19.3.0b-->C:\Program Files\Warkeys\uninst.exe
Web Deployment Tool-->MsiExec.exe /I{0F37D969-1260-419E-B308-EF7D29ABDE20}
Winamp-->"C:\Program Files\Winamp\UninstWA.exe"
Windows Internet Explorer 7-->"C:\WINDOWS\ie7\spuninst\spuninst.exe"
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows PowerShell(TM) 1.0-->"C:\WINDOWS\$NtUninstallKB926139-v2$\spuninst\spuninst.exe"
Windows Presentation Foundation-->MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840}
WinRAR-->C:\Program Files\WinRAR\uninstall.exe
Wizardry 8 CZ-->E:\BACKUP\GAMES\wizardry 8\Wizardry 8\uninstall.exe

======Security center information======

AV: avast! Antivirus

======System event log======

Computer Name: BITCH
Event Code: 7031
Message: The avast! Antivirus service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.

Record Number: 7356
Source Name: Service Control Manager
Time Written: 20120215070119.000000+060
Event Type: error
User:

Computer Name: BITCH
Event Code: 7000
Message: The PostgreSQL Database Server 8.3 service failed to start due to the following error:
The system cannot find the path specified.

Record Number: 7329
Source Name: Service Control Manager
Time Written: 20120215052430.000000+060
Event Type: error
User:

Computer Name: BITCH
Event Code: 7000
Message: The PostgreSQL Database Server 8.3 service failed to start due to the following error:
The system cannot find the path specified.

Record Number: 7293
Source Name: Service Control Manager
Time Written: 20120214105502.000000+060
Event Type: error
User:

Computer Name: BITCH
Event Code: 9
Message: The device, \Device\Ide\IdePort2, did not respond within the timeout period.

Record Number: 7289
Source Name: atapi
Time Written: 20120214071916.000000+060
Event Type: error
User:

Computer Name: BITCH
Event Code: 7000
Message: The PostgreSQL Database Server 8.3 service failed to start due to the following error:
The system cannot find the path specified.

Record Number: 7266
Source Name: Service Control Manager
Time Written: 20120214071227.000000+060
Event Type: error
User:

=====Application event log=====

Computer Name: BITCH
Event Code: 1001
Message:
Record Number: 2693
Source Name: MsiInstaller
Time Written: 20120223195227.000000+060
Event Type: warning
User: BITCH\kundibal

Computer Name: BITCH
Event Code: 1004
Message:
Record Number: 2692
Source Name: MsiInstaller
Time Written: 20120223195227.000000+060
Event Type: warning
User: BITCH\kundibal

Computer Name: BITCH
Event Code: 902
Message: The Software Protection service has started.
14.0.370.400

Record Number: 2499
Source Name: Office Software Protection Platform Service
Time Written: 20120221204807.000000+060
Event Type:
User:

Computer Name: BITCH
Event Code: 902
Message: The Software Protection service has started.
14.0.370.400

Record Number: 2456
Source Name: Office Software Protection Platform Service
Time Written: 20120220174642.000000+060
Event Type:
User:

Computer Name: BITCH
Event Code: 902
Message: The Software Protection service has started.
14.0.370.400

Record Number: 2265
Source Name: Office Software Protection Platform Service
Time Written: 20120218161749.000000+060
Event Type:
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\system32\wbem;C:\Program Files\PC Connectivity Solution;C:\Program Files\NVIDIA Corporation\PhysX\Common;C:\Program Files\Microsoft SQL Server\100\Tools\Binn;C:\Program Files\Microsoft SQL Server\100\DTS\Binn;C:\Program Files\Microsoft SQL Server\80\Tools\Binn;%dokanPath%;C:\WINDOWS\system32\WindowsPowerShell\v1.0
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 107 Stepping 2, AuthenticAMD
"PROCESSOR_REVISION"=6b02
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.PSC1
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"VS100COMNTOOLS"=E:\Program Files\visual studio\Common7\Tools\
"XNAGSShared"=C:\Program Files\Common Files\Microsoft Shared\XNA\
"XNAGSv4"=C:\Program Files\Microsoft XNA\XNA Game Studio\v4.0\
"dokanPath"=C:\Program Files\Capsa.cz\DokanLibrary0.5.3

-----------------EOF-----------------
Ještě v příloze minidump když mi padl PC pár dní zpátky. Bez přípony - nešlo jinak upnout.
Díky

WIAL · #2 Příspěvek od **WIAL** » 16 bře 2012 19:20

Tady je ten minidump

#3 Příspěvek od **motji** » 16 bře 2012 23:31

Dobrý večer

kdo Vám poradil použít combofix?
Počítač používáte v práci nebo doma?

WIAL · #4 Příspěvek od **WIAL** » 17 bře 2012 08:36

Známý, který jsem chodí. Vše jsem si předtím dobře zálohoval.

Počítač využívám doma. Semtam nějaká hra + programování. Jinak nebojte, VS je legální prof. verze licenci mám díky zaměstnání a Adobe je přítelkyně .

#5 Příspěvek od **motji** » 17 bře 2012 10:27

Prosím Ten dump s nepřejmenovanou koncovkou upněte na www.leteckaposta.cz, link vložte zde.

Nejde jen o to, že combofix Vám může zbořit systém. Ale zároveň smaže stopy po virech, takže já ted v logu ve rsitu nic nevidím. Log z combofixu máte? Měl by být na disku C.

Stáhněte TDSSKiller http://support.kaspersky.com/downloads/ ... killer.exe
- a uložte ho na plochu.
- 2x klikněte na ikonu programu a spusťte
- dejte volbu Spustit kontrolu - pak potvrdte start sken
- pokud program najde infikovaný soubor, ukáže se Vám předvolená akce Cure, v tom případě potvrdte tlačítko Continue
- pokud bude chtít program restartovat počítač, klikněte na tlačítko Reboot Now
- pokud si restart nevyžádá, klikněte na tlačítko Report. Měl vy na Vás vyskočit log, obsah logu zkopírujte do svého topicu.
- pokud se log nezobrazí, je uložený ve Vašem kořenovém adresáři.

WIAL · #6 Příspěvek od **WIAL** » 17 bře 2012 17:21

Takže tady je minidump http://leteckaposta.cz/330677005

Log z combofixu nemám, při "fáze 48" jsem měl bsod, stejná chybová hláška jako při bsod viz dump. Bohužel dump z této bsod nemám.

Jinak sosl jsem a spustil TDSS Killer, trochu se liší od Vašeho popisu.

V change parameters jsem zaskrtl i dalsi dve moznosti a toto viz Report po scanu:

17:13:13.0375 2924 TDSS rootkit removing tool 2.7.20.0 Mar 9 2012 17:10:43
17:13:13.0796 2924 ============================================================
17:13:13.0796 2924 Current date / time: 2012/03/17 17:13:13.0796
17:13:13.0796 2924 SystemInfo:
17:13:13.0796 2924
17:13:13.0796 2924 OS Version: 5.1.2600 ServicePack: 3.0
17:13:13.0796 2924 Product type: Workstation
17:13:13.0796 2924 ComputerName: BITCH
17:13:13.0796 2924 UserName: kundibal
17:13:13.0796 2924 Windows directory: C:\WINDOWS
17:13:13.0796 2924 System windows directory: C:\WINDOWS
17:13:13.0796 2924 Processor architecture: Intel x86
17:13:13.0796 2924 Number of processors: 2
17:13:13.0796 2924 Page size: 0x1000
17:13:13.0796 2924 Boot type: Normal boot
17:13:13.0796 2924 ============================================================
17:13:15.0156 2924 Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x97695, SectorsPerTrack: 0x3F, TracksPerCylinder: 0x10, Type 'K0', Flags 0x00000054
17:13:15.0171 2924 Drive \Device\Harddisk2\DR2 - Size: 0x12A1F16000 (74.53 Gb), SectorSize: 0x200, Cylinders: 0x2601, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
17:13:15.0171 2924 Drive \Device\Harddisk1\DR1 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
17:13:15.0187 2924 \Device\Harddisk0\DR0:
17:13:15.0187 2924 MBR used
17:13:15.0187 2924 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x2542E681
17:13:15.0187 2924 \Device\Harddisk2\DR2:
17:13:15.0187 2924 MBR used
17:13:15.0187 2924 \Device\Harddisk2\DR2\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x30D3C74
17:13:15.0203 2924 \Device\Harddisk2\DR2\Partition1: MBR, Type 0x7, StartLBA 0x30D3CF2, BlocksNum 0x643690E
17:13:15.0203 2924 \Device\Harddisk1\DR1:
17:13:15.0203 2924 MBR used
17:13:15.0203 2924 \Device\Harddisk1\DR1\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x2542D682
17:13:15.0296 2924 Initialize success
17:13:15.0296 2924 ============================================================
17:14:00.0125 2952 ============================================================
17:14:00.0125 2952 Scan started
17:14:00.0125 2952 Mode: Manual; SigCheck; TDLFS;
17:14:00.0125 2952 ============================================================
17:14:00.0546 2952 Aavmker4 (78a4db23bb4e8d4349e164d1d90af73f) C:\WINDOWS\system32\drivers\Aavmker4.sys
17:14:00.0656 2952 Aavmker4 - ok
17:14:00.0687 2952 Abiosdsk - ok
17:14:00.0718 2952 abp480n5 - ok
17:14:00.0765 2952 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
17:14:01.0390 2952 ACPI - ok
17:14:01.0500 2952 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
17:14:01.0593 2952 ACPIEC - ok
17:14:01.0625 2952 adpu160m - ok
17:14:01.0687 2952 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
17:14:01.0812 2952 aec - ok
17:14:01.0875 2952 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
17:14:01.0890 2952 AFD - ok
17:14:01.0906 2952 Aha154x - ok
17:14:01.0937 2952 aic78u2 - ok
17:14:01.0968 2952 aic78xx - ok
17:14:01.0984 2952 AliIde - ok
17:14:02.0015 2952 amsint - ok
17:14:02.0078 2952 AR5211 (3cb8e72b7c9887b42b90000e8cb1e7be) C:\WINDOWS\system32\DRIVERS\ar5211.sys
17:14:02.0093 2952 AR5211 ( UnsignedFile.Multi.Generic ) - warning
17:14:02.0093 2952 AR5211 - detected UnsignedFile.Multi.Generic (1)
17:14:02.0125 2952 asc - ok
17:14:02.0140 2952 asc3350p - ok
17:14:02.0171 2952 asc3550 - ok
17:14:02.0234 2952 aswFsBlk (9bdb29e81abceb883556df44649696c4) C:\WINDOWS\system32\drivers\aswFsBlk.sys
17:14:02.0250 2952 aswFsBlk - ok
17:14:02.0296 2952 aswMon2 (2ce6da466687cbb3b97e59f8831a27cb) C:\WINDOWS\system32\drivers\aswMon2.sys
17:14:02.0296 2952 aswMon2 - ok
17:14:02.0328 2952 aswRdr (a90cf680ca7a323913ca3a0810c8e02d) C:\WINDOWS\system32\drivers\aswRdr.sys
17:14:02.0328 2952 aswRdr - ok
17:14:02.0375 2952 aswSnx (f7969934cca2e566e95df17380a3cb11) C:\WINDOWS\system32\drivers\aswSnx.sys
17:14:02.0390 2952 aswSnx - ok
17:14:02.0437 2952 aswSP (478d6a0e0630c31bf4a7f5eb0a05b92c) C:\WINDOWS\system32\drivers\aswSP.sys
17:14:02.0453 2952 aswSP - ok
17:14:02.0484 2952 aswTdi (e52e45743e27fd6184c55618a10b81ab) C:\WINDOWS\system32\drivers\aswTdi.sys
17:14:02.0500 2952 aswTdi - ok
17:14:02.0546 2952 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
17:14:02.0687 2952 AsyncMac - ok
17:14:02.0718 2952 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
17:14:02.0859 2952 atapi - ok
17:14:02.0890 2952 Atdisk - ok
17:14:02.0937 2952 atksgt (f9c24d25d9ff29f894995a64812b4d85) C:\WINDOWS\system32\DRIVERS\atksgt.sys
17:14:02.0953 2952 atksgt - ok
17:14:02.0984 2952 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
17:14:03.0093 2952 Atmarpc - ok
17:14:03.0140 2952 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
17:14:03.0250 2952 audstub - ok
17:14:03.0312 2952 AVerAF15DMBTH (3e851cc6db0c07a8cc640fd03eb6fdae) C:\WINDOWS\system32\Drivers\AVerAF15DMBTH.sys
17:14:03.0375 2952 AVerAF15DMBTH ( UnsignedFile.Multi.Generic ) - warning
17:14:03.0375 2952 AVerAF15DMBTH - detected UnsignedFile.Multi.Generic (1)
17:14:03.0421 2952 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
17:14:03.0546 2952 Beep - ok
17:14:03.0578 2952 bjrvlvcn - ok
17:14:03.0671 2952 catchme - ok
17:14:03.0718 2952 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
17:14:03.0859 2952 cbidf2k - ok
17:14:03.0968 2952 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
17:14:04.0093 2952 CCDECODE - ok
17:14:04.0125 2952 cd20xrnt - ok
17:14:04.0156 2952 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
17:14:04.0265 2952 Cdaudio - ok
17:14:04.0328 2952 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
17:14:04.0437 2952 Cdfs - ok
17:14:04.0484 2952 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
17:14:04.0609 2952 Cdrom - ok
17:14:04.0640 2952 Changer - ok
17:14:04.0656 2952 CmdIde - ok
17:14:04.0687 2952 Cpqarray - ok
17:14:04.0703 2952 dac2w2k - ok
17:14:04.0734 2952 dac960nt - ok
17:14:04.0781 2952 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
17:14:04.0906 2952 Disk - ok
17:14:04.0953 2952 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
17:14:05.0109 2952 dmboot - ok
17:14:05.0156 2952 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
17:14:05.0281 2952 dmio - ok
17:14:05.0312 2952 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
17:14:05.0453 2952 dmload - ok
17:14:05.0500 2952 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
17:14:05.0625 2952 DMusic - ok
17:14:05.0671 2952 Dokan (bf94acf77e2c7458d91d0bef8718eece) C:\WINDOWS\system32\drivers\dokan.sys
17:14:05.0671 2952 Dokan ( UnsignedFile.Multi.Generic ) - warning
17:14:05.0671 2952 Dokan - detected UnsignedFile.Multi.Generic (1)
17:14:05.0703 2952 dpti2o - ok
17:14:05.0750 2952 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
17:14:05.0859 2952 drmkaud - ok
17:14:05.0875 2952 dsNcAdpt - ok
17:14:05.0921 2952 eamon (d42dd9021acd47683b33adf21bca49aa) C:\WINDOWS\system32\DRIVERS\eamon.sys
17:14:05.0937 2952 eamon - ok
17:14:05.0968 2952 ehdrv (fe7824239d132ad9ebd8645fe1199b30) C:\WINDOWS\system32\DRIVERS\ehdrv.sys
17:14:05.0984 2952 ehdrv - ok
17:14:06.0000 2952 epfwtdir (aa0667eb9a92414abb784c101a6c7fec) C:\WINDOWS\system32\DRIVERS\epfwtdir.sys
17:14:06.0015 2952 epfwtdir - ok
17:14:06.0046 2952 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
17:14:06.0171 2952 Fastfat - ok
17:14:06.0203 2952 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
17:14:06.0328 2952 Fdc - ok
17:14:06.0359 2952 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
17:14:06.0484 2952 Fips - ok
17:14:06.0515 2952 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
17:14:06.0656 2952 Flpydisk - ok
17:14:06.0734 2952 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
17:14:06.0843 2952 FltMgr - ok
17:14:06.0906 2952 FsUsbExDisk (790a4ca68f44be35967b3df61f3e4675) C:\WINDOWS\system32\FsUsbExDisk.SYS
17:14:06.0921 2952 FsUsbExDisk ( UnsignedFile.Multi.Generic ) - warning
17:14:06.0921 2952 FsUsbExDisk - detected UnsignedFile.Multi.Generic (1)
17:14:06.0953 2952 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
17:14:07.0078 2952 Fs_Rec - ok
17:14:07.0109 2952 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
17:14:07.0234 2952 Ftdisk - ok
17:14:07.0250 2952 GGSAFERDriver - ok
17:14:07.0296 2952 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
17:14:07.0421 2952 Gpc - ok
17:14:07.0468 2952 hamachi (833051c6c6c42117191935f734cfbd97) C:\WINDOWS\system32\DRIVERS\hamachi.sys
17:14:07.0484 2952 hamachi - ok
17:14:07.0531 2952 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
17:14:07.0640 2952 HDAudBus - ok
17:14:07.0703 2952 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
17:14:07.0828 2952 hidusb - ok
17:14:07.0890 2952 hidusbf (34f0823be25aed4992fd9fcf587f50d5) C:\WINDOWS\system32\DRIVERS\hidusbf.sys
17:14:07.0890 2952 hidusbf ( UnsignedFile.Multi.Generic ) - warning
17:14:07.0890 2952 hidusbf - detected UnsignedFile.Multi.Generic (1)
17:14:07.0921 2952 hpn - ok
17:14:07.0984 2952 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
17:14:08.0015 2952 HTTP - ok
17:14:08.0046 2952 i2omgmt - ok
17:14:08.0078 2952 i2omp - ok
17:14:08.0140 2952 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
17:14:08.0250 2952 i8042prt - ok
17:14:08.0296 2952 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
17:14:08.0406 2952 Imapi - ok
17:14:08.0437 2952 ini910u - ok
17:14:08.0453 2952 IntelIde - ok
17:14:08.0515 2952 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
17:14:08.0625 2952 Ip6Fw - ok
17:14:08.0671 2952 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
17:14:08.0796 2952 IpFilterDriver - ok
17:14:08.0828 2952 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
17:14:08.0953 2952 IpInIp - ok
17:14:09.0015 2952 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
17:14:09.0156 2952 IpNat - ok
17:14:09.0203 2952 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
17:14:09.0312 2952 IPSec - ok
17:14:09.0375 2952 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
17:14:09.0437 2952 IRENUM - ok
17:14:09.0484 2952 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
17:14:09.0593 2952 isapnp - ok
17:14:09.0625 2952 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
17:14:09.0750 2952 Kbdclass - ok
17:14:09.0812 2952 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
17:14:09.0937 2952 kmixer - ok
17:14:10.0000 2952 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
17:14:10.0000 2952 KSecDD - ok
17:14:10.0046 2952 L1e (101457d884e3dd4636baefb9b7e7d3f3) C:\WINDOWS\system32\DRIVERS\l1e51x86.sys
17:14:10.0078 2952 L1e - ok
17:14:10.0093 2952 lbrtfdc - ok
17:14:10.0156 2952 LHidFlt2 (63b00a26f62572e0d58e6c8d3b32bf59) C:\WINDOWS\system32\DRIVERS\LHidFlt2.Sys
17:14:10.0156 2952 LHidFlt2 - ok
17:14:10.0218 2952 LHidUsb (ac05a1b5c66d693b1598fd83617d1820) C:\WINDOWS\system32\Drivers\LHidUsb.Sys
17:14:10.0234 2952 LHidUsb - ok
17:14:10.0296 2952 lirsgt (8ccf9ed46d52af1375875f74a91ffacf) C:\WINDOWS\system32\DRIVERS\lirsgt.sys
17:14:10.0296 2952 lirsgt - ok
17:14:10.0343 2952 LMouFlt2 (03abef1a29addc98c32ed0f336b98e90) C:\WINDOWS\system32\DRIVERS\LMouFlt2.Sys
17:14:10.0359 2952 LMouFlt2 - ok
17:14:10.0390 2952 MBAMProtector (b7ca8cc3f978201856b6ab82f40953c3) C:\WINDOWS\system32\drivers\mbam.sys
17:14:10.0406 2952 MBAMProtector - ok
17:14:10.0468 2952 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
17:14:10.0578 2952 mnmdd - ok
17:14:10.0625 2952 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
17:14:10.0750 2952 Modem - ok
17:14:10.0843 2952 monfilt (9fa7207d1b1adead88ae8eed9cdbbaa5) C:\WINDOWS\system32\drivers\monfilt.sys
17:14:10.0937 2952 monfilt - ok
17:14:11.0000 2952 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
17:14:11.0109 2952 Mouclass - ok
17:14:11.0140 2952 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
17:14:11.0250 2952 mouhid - ok
17:14:11.0296 2952 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
17:14:11.0437 2952 MountMgr - ok
17:14:11.0484 2952 MPE (c0f8e0c2c3c0437cf37c6781896dc3ec) C:\WINDOWS\system32\DRIVERS\MPE.sys
17:14:11.0625 2952 MPE - ok
17:14:11.0640 2952 mraid35x - ok
17:14:11.0671 2952 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
17:14:11.0796 2952 MRxDAV - ok
17:14:11.0859 2952 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
17:14:11.0906 2952 MRxSmb - ok
17:14:11.0937 2952 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
17:14:12.0062 2952 Msfs - ok
17:14:12.0125 2952 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
17:14:12.0250 2952 MSKSSRV - ok
17:14:12.0343 2952 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
17:14:12.0468 2952 MSPCLOCK - ok
17:14:12.0500 2952 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
17:14:12.0640 2952 MSPQM - ok
17:14:12.0671 2952 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
17:14:12.0828 2952 mssmbios - ok
17:14:12.0875 2952 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
17:14:13.0015 2952 MSTEE - ok
17:14:13.0062 2952 MTsensor (d48659bb24c48345d926ecb45c1ebdf5) C:\WINDOWS\system32\DRIVERS\ASACPI.sys
17:14:13.0078 2952 MTsensor - ok
17:14:13.0109 2952 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
17:14:13.0125 2952 Mup - ok
17:14:13.0156 2952 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
17:14:13.0296 2952 NABTSFEC - ok
17:14:13.0343 2952 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
17:14:13.0484 2952 NDIS - ok
17:14:13.0531 2952 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
17:14:13.0640 2952 NdisIP - ok
17:14:13.0687 2952 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
17:14:13.0703 2952 NdisTapi - ok
17:14:13.0750 2952 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
17:14:13.0875 2952 Ndisuio - ok
17:14:13.0921 2952 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
17:14:14.0062 2952 NdisWan - ok
17:14:14.0109 2952 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
17:14:14.0125 2952 NDProxy - ok
17:14:14.0156 2952 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
17:14:14.0281 2952 NetBIOS - ok
17:14:14.0312 2952 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
17:14:14.0453 2952 NetBT - ok
17:14:14.0484 2952 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
17:14:14.0609 2952 Npfs - ok
17:14:14.0671 2952 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
17:14:14.0796 2952 Ntfs - ok
17:14:14.0843 2952 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
17:14:14.0968 2952 Null - ok
17:14:15.0359 2952 nv (0dc79b60cedc3a8854c27b3c6e4b3414) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
17:14:15.0796 2952 nv - ok
17:14:15.0875 2952 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
17:14:16.0015 2952 NwlnkFlt - ok
17:14:16.0046 2952 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
17:14:16.0171 2952 NwlnkFwd - ok
17:14:16.0234 2952 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\drivers\Parport.sys
17:14:16.0390 2952 Parport - ok
17:14:16.0421 2952 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
17:14:16.0546 2952 PartMgr - ok
17:14:16.0593 2952 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
17:14:16.0718 2952 ParVdm - ok
17:14:16.0765 2952 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
17:14:16.0906 2952 PCI - ok
17:14:16.0937 2952 PCIDump - ok
17:14:16.0984 2952 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
17:14:17.0109 2952 PCIIde - ok
17:14:17.0156 2952 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
17:14:17.0281 2952 Pcmcia - ok
17:14:17.0296 2952 PDCOMP - ok
17:14:17.0328 2952 PDFRAME - ok
17:14:17.0343 2952 PDRELI - ok
17:14:17.0375 2952 PDRFRAME - ok
17:14:17.0406 2952 perc2 - ok
17:14:17.0421 2952 perc2hib - ok
17:14:17.0468 2952 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
17:14:17.0578 2952 PptpMiniport - ok
17:14:17.0640 2952 Processor (a32bebaf723557681bfc6bd93e98bd26) C:\WINDOWS\system32\DRIVERS\processr.sys
17:14:17.0765 2952 Processor - ok
17:14:17.0781 2952 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
17:14:17.0890 2952 PSched - ok
17:14:17.0953 2952 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
17:14:18.0062 2952 Ptilink - ok
17:14:18.0093 2952 PxHelp20 (40fedd328f98245ad201cf5f9f311724) C:\WINDOWS\system32\Drivers\PxHelp20.sys
17:14:18.0109 2952 PxHelp20 - ok
17:14:18.0125 2952 ql1080 - ok
17:14:18.0156 2952 Ql10wnt - ok
17:14:18.0187 2952 ql12160 - ok
17:14:18.0203 2952 ql1240 - ok
17:14:18.0234 2952 ql1280 - ok
17:14:18.0281 2952 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
17:14:18.0390 2952 RasAcd - ok
17:14:18.0421 2952 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
17:14:18.0546 2952 Rasl2tp - ok
17:14:18.0562 2952 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
17:14:18.0703 2952 RasPppoe - ok
17:14:18.0718 2952 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
17:14:18.0859 2952 Raspti - ok
17:14:18.0890 2952 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
17:14:19.0015 2952 Rdbss - ok
17:14:19.0046 2952 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
17:14:19.0171 2952 RDPCDD - ok
17:14:19.0203 2952 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
17:14:19.0328 2952 rdpdr - ok
17:14:19.0390 2952 RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
17:14:19.0406 2952 RDPWD - ok
17:14:19.0437 2952 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
17:14:19.0578 2952 redbook - ok
17:14:19.0593 2952 rootrepeal - ok
17:14:19.0671 2952 RsFx0103 (fd692c6ffade58f7c4c3c3c9a0ec35bd) C:\WINDOWS\system32\DRIVERS\RsFx0103.sys
17:14:19.0671 2952 RsFx0103 - ok
17:14:19.0734 2952 rtl8139 (d507c1400284176573224903819ffda3) C:\WINDOWS\system32\DRIVERS\RTL8139.SYS
17:14:19.0859 2952 rtl8139 - ok
17:14:19.0921 2952 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
17:14:19.0968 2952 Secdrv - ok
17:14:20.0031 2952 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
17:14:20.0156 2952 serenum - ok
17:14:20.0187 2952 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys
17:14:20.0296 2952 Serial - ok
17:14:20.0328 2952 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
17:14:20.0453 2952 Sfloppy - ok
17:14:20.0468 2952 Simbad - ok
17:14:20.0531 2952 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
17:14:20.0656 2952 SLIP - ok
17:14:20.0687 2952 Sparrow - ok
17:14:20.0734 2952 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
17:14:20.0843 2952 splitter - ok
17:14:20.0906 2952 sptd (71e276f6d189413266ea22171806597b) C:\WINDOWS\system32\Drivers\sptd.sys
17:14:20.0906 2952 Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: 71e276f6d189413266ea22171806597b
17:14:20.0906 2952 sptd ( LockedFile.Multi.Generic ) - warning
17:14:20.0906 2952 sptd - detected LockedFile.Multi.Generic (1)
17:14:20.0968 2952 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
17:14:21.0015 2952 sr - ok
17:14:21.0062 2952 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
17:14:21.0078 2952 Srv - ok
17:14:21.0140 2952 ss_bbus (eaa66218cd39f5bb1b4853a78c67c787) C:\WINDOWS\system32\DRIVERS\ss_bbus.sys
17:14:21.0140 2952 ss_bbus - ok
17:14:21.0187 2952 ss_bmdfl (91765f99914ed8693d8bc76524f21581) C:\WINDOWS\system32\DRIVERS\ss_bmdfl.sys
17:14:21.0203 2952 ss_bmdfl - ok
17:14:21.0234 2952 ss_bmdm (840e7b738b03c10ee91d9b7d3d6eff15) C:\WINDOWS\system32\DRIVERS\ss_bmdm.sys
17:14:21.0250 2952 ss_bmdm - ok
17:14:21.0328 2952 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
17:14:21.0437 2952 streamip - ok
17:14:21.0484 2952 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
17:14:21.0593 2952 swenum - ok
17:14:21.0640 2952 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
17:14:21.0781 2952 swmidi - ok
17:14:21.0812 2952 symc810 - ok
17:14:21.0828 2952 symc8xx - ok
17:14:21.0859 2952 sym_hi - ok
17:14:21.0890 2952 sym_u3 - ok
17:14:21.0953 2952 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
17:14:22.0062 2952 sysaudio - ok
17:14:22.0140 2952 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
17:14:22.0187 2952 Tcpip - ok
17:14:22.0250 2952 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
17:14:22.0375 2952 TDPIPE - ok
17:14:22.0406 2952 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
17:14:22.0546 2952 TDTCP - ok
17:14:22.0593 2952 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
17:14:22.0718 2952 TermDD - ok
17:14:22.0750 2952 TosIde - ok
17:14:22.0812 2952 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
17:14:22.0953 2952 Udfs - ok
17:14:22.0968 2952 ultra - ok
17:14:23.0031 2952 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
17:14:23.0156 2952 Update - ok
17:14:23.0218 2952 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
17:14:23.0359 2952 usbccgp - ok
17:14:23.0406 2952 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
17:14:23.0531 2952 usbehci - ok
17:14:23.0562 2952 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
17:14:23.0687 2952 usbhub - ok
17:14:23.0718 2952 usbohci (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys
17:14:23.0828 2952 usbohci - ok
17:14:23.0875 2952 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
17:14:24.0015 2952 USBSTOR - ok
17:14:24.0046 2952 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
17:14:24.0171 2952 VgaSave - ok
17:14:24.0312 2952 VIAHdAudAddService (cbc1ce0a1fce0deed4f6f093be91d132) C:\WINDOWS\system32\drivers\viahduaa.sys
17:14:24.0375 2952 VIAHdAudAddService - ok
17:14:24.0421 2952 ViaIde - ok
17:14:24.0453 2952 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
17:14:24.0593 2952 VolSnap - ok
17:14:24.0640 2952 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
17:14:24.0765 2952 Wanarp - ok
17:14:24.0796 2952 WDICA - ok
17:14:24.0843 2952 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
17:14:24.0968 2952 wdmaud - ok
17:14:25.0031 2952 WmiAcpi (c42584fd66ce9e17403aebca199f7bdb) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
17:14:25.0140 2952 WmiAcpi - ok
17:14:25.0187 2952 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
17:14:25.0312 2952 WS2IFSL - ok
17:14:25.0375 2952 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
17:14:25.0484 2952 WSTCODEC - ok
17:14:25.0531 2952 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
17:14:25.0531 2952 WudfPf - ok
17:14:25.0578 2952 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
17:14:25.0578 2952 WudfRd - ok
17:14:25.0609 2952 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0
17:14:25.0656 2952 \Device\Harddisk0\DR0 - ok
17:14:25.0671 2952 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk2\DR2
17:14:25.0906 2952 \Device\Harddisk2\DR2 ( TDSS File System ) - warning
17:14:25.0906 2952 \Device\Harddisk2\DR2 - detected TDSS File System (1)
17:14:25.0906 2952 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk1\DR1
17:14:25.0968 2952 \Device\Harddisk1\DR1 - ok
17:14:25.0968 2952 Boot (0x1200) (57a5dc99b56e9005f2431a948e997904) \Device\Harddisk0\DR0\Partition0
17:14:25.0968 2952 \Device\Harddisk0\DR0\Partition0 - ok
17:14:25.0968 2952 Boot (0x1200) (8b1ec730cb92ce601529b2b77ef94f2e) \Device\Harddisk2\DR2\Partition0
17:14:25.0968 2952 \Device\Harddisk2\DR2\Partition0 - ok
17:14:25.0984 2952 Boot (0x1200) (be9dcdf9482ad37e6e4e0c93eece7738) \Device\Harddisk2\DR2\Partition1
17:14:25.0984 2952 \Device\Harddisk2\DR2\Partition1 - ok
17:14:25.0984 2952 Boot (0x1200) (67643b5bd28842b200c744127f5afd21) \Device\Harddisk1\DR1\Partition0
17:14:26.0000 2952 \Device\Harddisk1\DR1\Partition0 - ok
17:14:26.0000 2952 ============================================================
17:14:26.0000 2952 Scan finished
17:14:26.0000 2952 ============================================================
17:14:26.0109 3348 Detected object count: 7
17:14:26.0109 3348 Actual detected object count: 7
17:17:02.0328 3348 AR5211 ( UnsignedFile.Multi.Generic ) - skipped by user
17:17:02.0343 3348 AR5211 ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:17:02.0343 3348 AVerAF15DMBTH ( UnsignedFile.Multi.Generic ) - skipped by user
17:17:02.0343 3348 AVerAF15DMBTH ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:17:02.0343 3348 Dokan ( UnsignedFile.Multi.Generic ) - skipped by user
17:17:02.0343 3348 Dokan ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:17:02.0343 3348 FsUsbExDisk ( UnsignedFile.Multi.Generic ) - skipped by user
17:17:02.0343 3348 FsUsbExDisk ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:17:02.0343 3348 hidusbf ( UnsignedFile.Multi.Generic ) - skipped by user
17:17:02.0343 3348 hidusbf ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:17:02.0343 3348 sptd ( LockedFile.Multi.Generic ) - skipped by user
17:17:02.0343 3348 sptd ( LockedFile.Multi.Generic ) - User select action: Skip
17:17:02.0343 3348 \Device\Harddisk2\DR2 ( TDSS File System ) - skipped by user
17:17:02.0343 3348 \Device\Harddisk2\DR2 ( TDSS File System ) - User select action: Skip

PS:
Jediné co z reportu "suspicious" poznám je
SPTD - Daemon Tools driver na virtual mechaniku?
Dokan - driver na souborovy system pro capsa.cz
FsUsbExDisk - nevím
hidusbf - ovladac na vyssi rate USB
Aver - od Aver jsem mel TVtuner, uz nemam odstanit ?
AR5211 - nevim

#7 Příspěvek od **motji** » 17 bře 2012 18:50

Na dump ten nekouknu, nejsem u svého pc.
Máte tam pěknou potvoru, rootkita TDSS.

vyosek píše: Stahnete RogueKiller http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe
Ukoncete vsechny programy

Pokud pouzivate Win Vista ci W7, kliknete na RogueKiller pravym a dejte Run As Administrator ci Spustit jako spravce

Pockejte na dokonceni PreScanu

Zvolte moznost Prohledat (scan)

Po dokonceni skenu kliknete na Zpráva (Report)- otevre se log, ten sem vlozte

WIAL · #8 Příspěvek od **WIAL** » 17 bře 2012 22:04

RogueKiller V7.3.1 [03/10/2012] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.geekstogo.com/forum/files/fi ... guekiller/
Blog: http://tigzyrk.blogspot.com

Operating System: Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User: kundibal [Admin rights]
Mode: Scan -- Date: 03/17/2012 21:57:44

¤¤¤ Bad processes: 0 ¤¤¤

¤¤¤ Registry Entries: 5 ¤¤¤
[] HKLM\[...]\Windows : () -> ACCESS DENIED
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ] HKCU\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[] HKLM\[...]\Windows : () -> ACCESS DENIED

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver: [LOADED] ¤¤¤
IRP[IRP_MJ_CREATE] : Unknown -> HOOKED ([MAJOR] atapi.sys @ 0xB7DFCB40)
IRP[IRP_MJ_CLOSE] : Unknown -> HOOKED ([MAJOR] atapi.sys @ 0xB7DFCB40)
IRP[IRP_MJ_DEVICE_CONTROL] : Unknown -> HOOKED ([MAJOR] atapi.sys @ 0xB7DFCB40)
IRP[IRP_MJ_INTERNAL_DEVICE_CONTROL] : Unknown -> HOOKED ([MAJOR] atapi.sys @ 0xB7DFCB40)
IRP[IRP_MJ_SYSTEM_CONTROL] : Unknown -> HOOKED ([MAJOR] atapi.sys @ 0xB7DFCB40)
IRP[IRP_MJ_DEVICE_CHANGE] : Unknown -> HOOKED ([MAJOR] atapi.sys @ 0xB7DFCB40)

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
127.0.0.1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: ST3320620AS +++++
--- User ---
[MBR] 0d5042f8689668c196c7fe6e7c8de20d
[BSP] d19af4eddeca007fdce9913b4d3d5b5b : Windows XP MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 305244 Mo
User = LL1 ... OK!
User = LL2 ... OK!

+++++ PhysicalDrive1: WDC WD3200JS-63PDB1 +++++
--- User ---
[MBR] 4afb9005cffff188ea60da997fd1bdf9
[BSP] 271139afabcce979652f030bac56718c : Windows XP MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 305242 Mo
User = LL1 ... OK!
User = LL2 ... OK!

+++++ PhysicalDrive2: WDC WD800JB-00ETA0 +++++
--- User ---
[MBR] feae3003caf1d816bac254095d89c2b1
[BSP] 8e32c701c58ec603a3c76f06986da3a8 : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 24999 Mo
1 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 51199155 | Size: 51309 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[1].txt >>
RKreport[1].txt

#9 Příspěvek od **motji** » 17 bře 2012 22:09

Zazálohujte si důležitá data, pro jistotu

Spusťte combofix podle tohoto návodu
http://www.bleepingcomputer.com/combofi ... t-combofix

WIAL · #10 Příspěvek od **WIAL** » 18 bře 2012 08:15

Další věc co PC dělá - po bootu do windows nejde spustit Chrome, ani jiné věci. Např. internet explorer jde. Ale nespustím např. ten Chrome, nebo jsem chtěl síťové připojení spustit - nic. Jen se vidím proces v taskmanageru a nic. Po cca minutě začne HDD něco chroustat a potom jde vše normálně.

Combofix zase BSOD - http://leteckaposta.cz/844091509 dump.

Tak jsem ho spustil v safe modu:

ComboFix 12-03-17.01 - kundibal 18.03.2012 7:42.4.2 - x86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.3.1250.420.1033.18.3327.2879 [GMT 1:00]
Spuštěný z: e:\documents\Downloads\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\All Users\Application Data\TEMP\{F232C87C-6E92-4775-8210-DFE90B7777D9}\PostBuild.exe
c:\documents and settings\kundibal\WINDOWS
c:\windows\m
c:\windows\m\KB2544521-IE7\spuninst\spuninst.exe
c:\windows\m\KB2544521-IE7\spuninst\spuninst.inf
c:\windows\m\KB2544521-IE7\spuninst\spuninst.txt
c:\windows\m\KB2544521-IE7\spuninst\updspapi.dll
c:\windows\m\KB2544521-IE7\vgx.dll
c:\windows\m\KB2559049-IE7\advpack.dll
c:\windows\m\KB2559049-IE7\advpack.dll.000
c:\windows\m\KB2559049-IE7\corpol.dll
c:\windows\m\KB2559049-IE7\dxtmsft.dll
c:\windows\m\KB2559049-IE7\dxtrans.dll
c:\windows\m\KB2559049-IE7\extmgr.dll
c:\windows\m\KB2559049-IE7\html.iec
c:\windows\m\KB2559049-IE7\icardie.dll
c:\windows\m\KB2559049-IE7\icardie.dll.000
c:\windows\m\KB2559049-IE7\ie4uinit.exe
c:\windows\m\KB2559049-IE7\ieakeng.dll
c:\windows\m\KB2559049-IE7\ieaksie.dll
c:\windows\m\KB2559049-IE7\ieakui.dll
c:\windows\m\KB2559049-IE7\ieapfltr.dat
c:\windows\m\KB2559049-IE7\ieapfltr.dll
c:\windows\m\KB2559049-IE7\ieapfltr.dll.000
c:\windows\m\KB2559049-IE7\iedkcs32.dll
c:\windows\m\KB2559049-IE7\ieencode.dll
c:\windows\m\KB2559049-IE7\ieframe.dll
c:\windows\m\KB2559049-IE7\ieframe.dll.000
c:\windows\m\KB2559049-IE7\ieframe.dll.mui
c:\windows\m\KB2559049-IE7\ieframe.dll.mui.000
c:\windows\m\KB2559049-IE7\iepeers.dll
c:\windows\m\KB2559049-IE7\iernonce.dll
c:\windows\m\KB2559049-IE7\iertutil.dll
c:\windows\m\KB2559049-IE7\iertutil.dll.000
c:\windows\m\KB2559049-IE7\ieudinit.exe
c:\windows\m\KB2559049-IE7\iexplore.exe
c:\windows\m\KB2559049-IE7\inetcpl.cpl
c:\windows\m\KB2559049-IE7\jsproxy.dll
c:\windows\m\KB2559049-IE7\msfeeds.dll
c:\windows\m\KB2559049-IE7\msfeeds.dll.000
c:\windows\m\KB2559049-IE7\msfeedsbs.dll
c:\windows\m\KB2559049-IE7\msfeedsbs.dll.000
c:\windows\m\KB2559049-IE7\mshtml.dll
c:\windows\m\KB2559049-IE7\mshtml.dll.000
c:\windows\m\KB2559049-IE7\mshtmled.dll
c:\windows\m\KB2559049-IE7\msrating.dll
c:\windows\m\KB2559049-IE7\mstime.dll
c:\windows\m\KB2559049-IE7\occache.dll
c:\windows\m\KB2559049-IE7\pngfilt.dll
c:\windows\m\KB2559049-IE7\reg00002
c:\windows\m\KB2559049-IE7\reg00003
c:\windows\m\KB2559049-IE7\reg00004
c:\windows\m\KB2559049-IE7\reg00005
c:\windows\m\KB2559049-IE7\reg00006
c:\windows\m\KB2559049-IE7\reg00007
c:\windows\m\KB2559049-IE7\reg00008
c:\windows\m\KB2559049-IE7\reg00009
c:\windows\m\KB2559049-IE7\reg00010
c:\windows\m\KB2559049-IE7\reg00011
c:\windows\m\KB2559049-IE7\reg00012
c:\windows\m\KB2559049-IE7\reg00013
c:\windows\m\KB2559049-IE7\reg00014
c:\windows\m\KB2559049-IE7\reg00015
c:\windows\m\KB2559049-IE7\reg00016
c:\windows\m\KB2559049-IE7\reg00017
c:\windows\m\KB2559049-IE7\reg00018
c:\windows\m\KB2559049-IE7\reg00019
c:\windows\m\KB2559049-IE7\reg00020
c:\windows\m\KB2559049-IE7\reg00021
c:\windows\m\KB2559049-IE7\reg00022
c:\windows\m\KB2559049-IE7\spuninst\spuninst.exe
c:\windows\m\KB2559049-IE7\spuninst\spuninst.inf
c:\windows\m\KB2559049-IE7\spuninst\spuninst.txt
c:\windows\m\KB2559049-IE7\spuninst\updspapi.dll
c:\windows\m\KB2559049-IE7\url.dll
c:\windows\m\KB2559049-IE7\url.dll.000
c:\windows\m\KB2559049-IE7\urlmon.dll
c:\windows\m\KB2559049-IE7\urlmon.dll.000
c:\windows\m\KB2559049-IE7\webcheck.dll
c:\windows\m\KB2559049-IE7\webcheck.dll.000
c:\windows\m\KB2559049-IE7\wininet.dll
c:\windows\m\KB2559049-IE7\wininet.dll.000
c:\windows\m\KB2586448-IE7\advpack.dll
c:\windows\m\KB2586448-IE7\corpol.dll
c:\windows\m\KB2586448-IE7\dxtmsft.dll
c:\windows\m\KB2586448-IE7\dxtrans.dll
c:\windows\m\KB2586448-IE7\extmgr.dll
c:\windows\m\KB2586448-IE7\html.iec
c:\windows\m\KB2586448-IE7\icardie.dll
c:\windows\m\KB2586448-IE7\ie4uinit.exe
c:\windows\m\KB2586448-IE7\ieakeng.dll
c:\windows\m\KB2586448-IE7\ieaksie.dll
c:\windows\m\KB2586448-IE7\ieakui.dll
c:\windows\m\KB2586448-IE7\ieapfltr.dll
c:\windows\m\KB2586448-IE7\iedkcs32.dll
c:\windows\m\KB2586448-IE7\ieencode.dll
c:\windows\m\KB2586448-IE7\ieframe.dll
c:\windows\m\KB2586448-IE7\ieframe.dll.mui
c:\windows\m\KB2586448-IE7\iepeers.dll
c:\windows\m\KB2586448-IE7\iernonce.dll
c:\windows\m\KB2586448-IE7\iertutil.dll
c:\windows\m\KB2586448-IE7\ieudinit.exe
c:\windows\m\KB2586448-IE7\iexplore.exe
c:\windows\m\KB2586448-IE7\inetcpl.cpl
c:\windows\m\KB2586448-IE7\jsproxy.dll
c:\windows\m\KB2586448-IE7\msfeeds.dll
c:\windows\m\KB2586448-IE7\msfeedsbs.dll
c:\windows\m\KB2586448-IE7\mshtml.dll
c:\windows\m\KB2586448-IE7\mshtmled.dll
c:\windows\m\KB2586448-IE7\msrating.dll
c:\windows\m\KB2586448-IE7\mstime.dll
c:\windows\m\KB2586448-IE7\occache.dll
c:\windows\m\KB2586448-IE7\pngfilt.dll
c:\windows\m\KB2586448-IE7\reg00002
c:\windows\m\KB2586448-IE7\reg00003
c:\windows\m\KB2586448-IE7\reg00004
c:\windows\m\KB2586448-IE7\reg00005
c:\windows\m\KB2586448-IE7\reg00006
c:\windows\m\KB2586448-IE7\reg00007
c:\windows\m\KB2586448-IE7\reg00008
c:\windows\m\KB2586448-IE7\reg00009
c:\windows\m\KB2586448-IE7\reg00010
c:\windows\m\KB2586448-IE7\reg00011
c:\windows\m\KB2586448-IE7\reg00012
c:\windows\m\KB2586448-IE7\reg00013
c:\windows\m\KB2586448-IE7\reg00014
c:\windows\m\KB2586448-IE7\reg00015
c:\windows\m\KB2586448-IE7\reg00016
c:\windows\m\KB2586448-IE7\reg00017
c:\windows\m\KB2586448-IE7\reg00018
c:\windows\m\KB2586448-IE7\reg00019
c:\windows\m\KB2586448-IE7\reg00020
c:\windows\m\KB2586448-IE7\reg00021
c:\windows\m\KB2586448-IE7\reg00022
c:\windows\m\KB2586448-IE7\spuninst\spuninst.exe
c:\windows\m\KB2586448-IE7\spuninst\spuninst.inf
c:\windows\m\KB2586448-IE7\spuninst\spuninst.txt
c:\windows\m\KB2586448-IE7\spuninst\updspapi.dll
c:\windows\m\KB2586448-IE7\url.dll
c:\windows\m\KB2586448-IE7\urlmon.dll
c:\windows\m\KB2586448-IE7\webcheck.dll
c:\windows\m\KB2586448-IE7\wininet.dll
c:\windows\m\KB2618444-IE7\advpack.dll
c:\windows\m\KB2618444-IE7\corpol.dll
c:\windows\m\KB2618444-IE7\dxtmsft.dll
c:\windows\m\KB2618444-IE7\dxtrans.dll
c:\windows\m\KB2618444-IE7\extmgr.dll
c:\windows\m\KB2618444-IE7\icardie.dll
c:\windows\m\KB2618444-IE7\ie4uinit.exe
c:\windows\m\KB2618444-IE7\ieakeng.dll
c:\windows\m\KB2618444-IE7\ieaksie.dll
c:\windows\m\KB2618444-IE7\ieakui.dll
c:\windows\m\KB2618444-IE7\ieapfltr.dll
c:\windows\m\KB2618444-IE7\iedkcs32.dll
c:\windows\m\KB2618444-IE7\ieencode.dll
c:\windows\m\KB2618444-IE7\ieframe.dll
c:\windows\m\KB2618444-IE7\ieframe.dll.mui
c:\windows\m\KB2618444-IE7\iepeers.dll
c:\windows\m\KB2618444-IE7\iernonce.dll
c:\windows\m\KB2618444-IE7\iertutil.dll
c:\windows\m\KB2618444-IE7\ieudinit.exe
c:\windows\m\KB2618444-IE7\iexplore.exe
c:\windows\m\KB2618444-IE7\inetcpl.cpl
c:\windows\m\KB2618444-IE7\jsproxy.dll
c:\windows\m\KB2618444-IE7\msfeeds.dll
c:\windows\m\KB2618444-IE7\msfeedsbs.dll
c:\windows\m\KB2618444-IE7\mshtml.dll
c:\windows\m\KB2618444-IE7\mshtmled.dll
c:\windows\m\KB2618444-IE7\msrating.dll
c:\windows\m\KB2618444-IE7\mstime.dll
c:\windows\m\KB2618444-IE7\occache.dll
c:\windows\m\KB2618444-IE7\pngfilt.dll
c:\windows\m\KB2618444-IE7\reg00002
c:\windows\m\KB2618444-IE7\reg00003
c:\windows\m\KB2618444-IE7\reg00004
c:\windows\m\KB2618444-IE7\reg00005
c:\windows\m\KB2618444-IE7\reg00006
c:\windows\m\KB2618444-IE7\reg00007
c:\windows\m\KB2618444-IE7\reg00008
c:\windows\m\KB2618444-IE7\reg00009
c:\windows\m\KB2618444-IE7\reg00010
c:\windows\m\KB2618444-IE7\reg00011
c:\windows\m\KB2618444-IE7\reg00012
c:\windows\m\KB2618444-IE7\reg00013
c:\windows\m\KB2618444-IE7\reg00014
c:\windows\m\KB2618444-IE7\reg00015
c:\windows\m\KB2618444-IE7\reg00016
c:\windows\m\KB2618444-IE7\reg00017
c:\windows\m\KB2618444-IE7\reg00018
c:\windows\m\KB2618444-IE7\reg00019
c:\windows\m\KB2618444-IE7\reg00020
c:\windows\m\KB2618444-IE7\reg00021
c:\windows\m\KB2618444-IE7\reg00022
c:\windows\m\KB2618444-IE7\spuninst\spuninst.exe
c:\windows\m\KB2618444-IE7\spuninst\spuninst.inf
c:\windows\m\KB2618444-IE7\spuninst\spuninst.txt
c:\windows\m\KB2618444-IE7\spuninst\updspapi.dll
c:\windows\m\KB2618444-IE7\url.dll
c:\windows\m\KB2618444-IE7\urlmon.dll
c:\windows\m\KB2618444-IE7\webcheck.dll
c:\windows\m\KB2618444-IE7\wininet.dll
c:\windows\m\KB982381-IE7\advpack.dll
c:\windows\m\KB982381-IE7\corpol.dll
c:\windows\m\KB982381-IE7\dxtmsft.dll
c:\windows\m\KB982381-IE7\dxtrans.dll
c:\windows\m\KB982381-IE7\extmgr.dll
c:\windows\m\KB982381-IE7\html.iec
c:\windows\m\KB982381-IE7\icardie.dll
c:\windows\m\KB982381-IE7\ie4uinit.exe
c:\windows\m\KB982381-IE7\ieakeng.dll
c:\windows\m\KB982381-IE7\ieaksie.dll
c:\windows\m\KB982381-IE7\ieakui.dll
c:\windows\m\KB982381-IE7\ieapfltr.dat
c:\windows\m\KB982381-IE7\ieapfltr.dll
c:\windows\m\KB982381-IE7\iedkcs32.dll
c:\windows\m\KB982381-IE7\ieencode.dll
c:\windows\m\KB982381-IE7\ieframe.dll
c:\windows\m\KB982381-IE7\ieframe.dll.mui
c:\windows\m\KB982381-IE7\iepeers.dll
c:\windows\m\KB982381-IE7\iernonce.dll
c:\windows\m\KB982381-IE7\iertutil.dll
c:\windows\m\KB982381-IE7\ieudinit.exe
c:\windows\m\KB982381-IE7\iexplore.exe
c:\windows\m\KB982381-IE7\inetcpl.cpl
c:\windows\m\KB982381-IE7\jsproxy.dll
c:\windows\m\KB982381-IE7\msfeeds.dll
c:\windows\m\KB982381-IE7\msfeedsbs.dll
c:\windows\m\KB982381-IE7\mshtml.dll
c:\windows\m\KB982381-IE7\mshtmled.dll
c:\windows\m\KB982381-IE7\msrating.dll
c:\windows\m\KB982381-IE7\mstime.dll
c:\windows\m\KB982381-IE7\occache.dll
c:\windows\m\KB982381-IE7\pngfilt.dll
c:\windows\m\KB982381-IE7\reg00002
c:\windows\m\KB982381-IE7\reg00003
c:\windows\m\KB982381-IE7\reg00004
c:\windows\m\KB982381-IE7\reg00005
c:\windows\m\KB982381-IE7\reg00006
c:\windows\m\KB982381-IE7\reg00007
c:\windows\m\KB982381-IE7\reg00008
c:\windows\m\KB982381-IE7\reg00009
c:\windows\m\KB982381-IE7\reg00010
c:\windows\m\KB982381-IE7\reg00011
c:\windows\m\KB982381-IE7\reg00012
c:\windows\m\KB982381-IE7\reg00013
c:\windows\m\KB982381-IE7\reg00014
c:\windows\m\KB982381-IE7\reg00015
c:\windows\m\KB982381-IE7\reg00017
c:\windows\m\KB982381-IE7\spuninst\spuninst.exe
c:\windows\m\KB982381-IE7\spuninst\spuninst.inf
c:\windows\m\KB982381-IE7\spuninst\spuninst.txt
c:\windows\m\KB982381-IE7\spuninst\updspapi.dll
c:\windows\m\KB982381-IE7\url.dll
c:\windows\m\KB982381-IE7\urlmon.dll
c:\windows\m\KB982381-IE7\webcheck.dll
c:\windows\m\KB982381-IE7\wininet.dll
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
c:\windows\system32\_000116_.tmp.dll
c:\windows\system32\drivers\etc\hosts.ics
c:\windows\system32\SET1BA.tmp
c:\windows\system32\SET1BC.tmp
c:\windows\system32\SET1C8.tmp
.
-- Předchozí spuštění --
.
Nakažená kopie c:\windows\system32\drivers\ntfs.sys byla nalezena a vyléčena.
Obnovena kopie z - c:\system volume information\_restore{6C6A3ACC-3069-46F6-92F1-4B1C1B8282E8}\RP254\A0111988.sys
.
--------
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-02-18 do 2012-03-18 )))))))))))))))))))))))))))))))
.
.
2012-03-16 18:08 . 2012-03-16 18:08 -------- d-----w- C:\rsit
2012-03-15 11:42 . 2012-03-15 11:42 -------- d-----w- c:\windows\Installer
2012-03-12 21:10 . 2012-03-15 19:23 -------- d-----w- c:\documents and settings\kundibal\Application Data\dvdcss
2012-03-08 08:32 . 2012-03-08 08:32 -------- d-----w- c:\documents and settings\postgres
2012-03-07 18:20 . 2012-03-07 18:20 -------- d-----w- c:\documents and settings\kundibal\Application Data\ElevatedDiagnostics
2012-03-05 20:10 . 2012-03-05 20:10 -------- d-----w- c:\documents and settings\kundibal\.thumbnails
2012-03-05 20:08 . 2012-03-05 20:08 -------- d-----w- c:\program files\Blender Foundation
2012-03-05 16:23 . 2012-03-05 16:23 -------- d-----w- c:\program files\Lavalys
2012-03-05 16:17 . 2012-03-05 16:17 -------- d-----w- c:\documents and settings\kundibal\Application Data\FreeStone Group
2012-03-05 16:16 . 2012-03-05 16:16 -------- d-----w- c:\program files\Video Card Stability Test
2012-03-03 10:40 . 2012-03-03 10:40 -------- d-----w- c:\documents and settings\All Users\Application Data\RELOADED
2012-02-27 20:15 . 2012-02-27 20:15 1492 ----a-w- C:\user.js
2012-02-27 20:15 . 2012-03-07 18:21 -------- d-----w- c:\documents and settings\All Users\Application Data\TheBflix
2012-02-27 20:15 . 2012-02-27 20:15 -------- d-----w- c:\documents and settings\All Users\Application Data\InstallMate
2012-02-25 08:39 . 2012-02-25 08:39 -------- d-----w- C:\NVIDIA
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-07 07:11 . 2011-07-20 05:34 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-02-10 04:10 . 2011-03-26 10:23 65536 ----a-w- c:\windows\system32\OpenCL.dll
2012-02-10 04:10 . 2011-03-26 10:23 881984 ----a-w- c:\windows\system32\nvgenco32.dll
2012-02-10 04:10 . 2011-03-26 10:23 5918720 ----a-w- c:\windows\system32\nvcuda.dll
2012-02-10 04:10 . 2011-03-26 10:23 2522944 ----a-w- c:\windows\system32\nvcuvid.dll
2012-02-10 04:10 . 2011-03-26 10:23 2437440 ----a-w- c:\windows\system32\nvcuvenc.dll
2012-02-10 04:10 . 2011-03-26 10:23 18620416 ----a-w- c:\windows\system32\nvoglnt.dll
2012-02-10 04:10 . 2011-03-26 10:23 1000256 ----a-w- c:\windows\system32\nvdispco32.dll
2012-02-10 04:10 . 2011-03-26 10:23 4309760 ----a-w- c:\windows\system32\nv4_disp.dll
2012-02-10 04:10 . 2011-03-26 10:23 2292224 ----a-w- c:\windows\system32\nvapi.dll
2012-02-10 04:10 . 2011-03-26 10:23 17534976 ----a-w- c:\windows\system32\nvcompiler.dll
2012-02-10 04:10 . 2011-03-26 10:23 13415040 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
2012-02-10 03:04 . 2010-10-16 11:05 54272 ----a-w- c:\windows\system32\nvwddi.dll
2012-02-10 03:04 . 2010-10-16 11:05 164160 ----a-w- c:\windows\system32\nvsvc32.exe
2012-02-10 03:04 . 2010-10-16 11:05 143680 ----a-w- c:\windows\system32\nvcolor.exe
2012-02-10 03:04 . 2010-10-16 11:05 15494464 ----a-w- c:\windows\system32\nvcpl.dll
2012-02-10 03:04 . 2010-10-16 11:05 108352 ----a-w- c:\windows\system32\nvmctray.dll
2012-01-12 16:53 . 2008-04-13 23:00 1859968 ----a-w- c:\windows\system32\win32k.sys
2012-01-11 19:06 . 2012-02-16 07:50 3072 ------w- c:\windows\system32\iacenc.dll
2012-01-04 17:18 . 2011-08-04 16:13 1834688 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\VisualStudio\10.0\1033\ResourceCache.dll
2011-12-19 08:13 . 2008-04-14 03:42 1830912 ------w- c:\windows\system32\inetcpl.cpl
2011-12-19 08:13 . 2008-04-14 03:42 832512 ----a-w- c:\windows\system32\wininet.dll
2011-12-19 08:13 . 2008-04-14 03:41 78336 ----a-w- c:\windows\system32\ieencode.dll
2011-12-19 08:13 . 2008-04-14 03:41 17408 ----a-w- c:\windows\system32\corpol.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-04-18 17:25 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HDAudDeck"="c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe" [2010-05-24 33747360]
"Logitech Utility"="Logi_MwX.Exe" [2003-03-04 19968]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-04-18 3460784]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2012-02-10 15494464]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2012-02-10 108352]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AVer HID Receiver.lnk]
backup=c:\windows\pss\AVer HID Receiver.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AVerQuick.lnk]
backup=c:\windows\pss\AVerQuick.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^kundibal^Start Menu^Programs^Startup^Warkeys Update.lnk]
backup=c:\windows\pss\Warkeys Update.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5ServiceManager]
2010-02-22 03:57 406992 ----a-w- c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AutoStartNPSAgent]
2011-06-04 07:40 102400 ----a-w- c:\program files\Samsung\Samsung New PC Studio\NPSAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCSSync]
2010-03-13 13:54 91520 ----a-w- c:\program files\Microsoft Office\Office14\BCSSync.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2011-04-03 16:35 136176 ----atw- c:\documents and settings\kundibal\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
2012-02-28 16:38 1987976 ----a-w- c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
2012-01-13 13:53 460872 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 09:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SwitchBoard]
2010-02-19 12:37 517096 ----a-w- c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Samsung\\Samsung New PC Studio\\npsasvr.exe"=
"c:\\Program Files\\Samsung\\Samsung New PC Studio\\npsvsvr.exe"=
"e:\\Program Files\\Steam\\steamapps\\common\\poxnora\\LaunchPad.exe"=
"c:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE"=
"e:\\Program Files\\Steam\\steamapps\\steam210576\\condition zero\\hl.exe"=
"c:\\Program Files\\BitTorrent\\BitTorrent.exe"=
"e:\\Program Files\\Steam\\steamapps\\common\\dota 2 beta\\dota.exe"=
"e:\\Program Files\\Steam\\steamapps\\steam210576\\counter-strike\\hl.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3306:TCP"= 3306:TCP:mysql
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [26.3.2011 11:23 717296]
R3 hidusbf;USB Mouse Rate Adjuster Lower Filter by SweetLow;c:\windows\system32\drivers\hidusbf.sys [20.12.2011 19:47 4544]
S0 bjrvlvcn;bjrvlvcn;c:\windows\system32\drivers\pmvy.sys --> c:\windows\system32\drivers\pmvy.sys [?]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [10.5.2011 16:53 441176]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [10.5.2011 16:53 307288]
S1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [21.12.2010 14:04 115008]
S1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [21.12.2010 12:47 94872]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [10.5.2011 16:53 19544]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 12:16 130384]
S2 Dokan;Dokan;c:\windows\system32\drivers\dokan.sys [19.1.2012 17:09 84608]
S2 DokanMounter;DokanMounter;c:\program files\Capsa.cz\dokanLibrary0.5.3\mounter.exe [19.1.2012 17:09 22016]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [4.6.2011 8:27 233472]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [8.5.2011 10:36 652360]
S2 pgsql-8.3;PostgreSQL Database Server 8.3;"d:\db poker\bin\pg_ctl.exe" runservice -w -N "pgsql-8.3" -D "d:\db poker\data\" --> d:\db poker\bin\pg_ctl.exe [?]
S3 AVerAF15DMBTH;AVerMedia A850 USB;c:\windows\system32\drivers\AVerAF15DMBTH.sys [3.6.2011 19:54 569728]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [4.6.2011 8:27 36608]
S3 GGSAFERDriver;GGSAFER Driver;\??\e:\garena\safedrv.sys --> e:\garena\safedrv.sys [?]
S3 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [28.2.2012 17:38 1373576]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [8.5.2011 10:36 20464]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [27.12.2010 23:50 31124344]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [9.1.2010 21:37 4640000]
S3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\drivers\ss_bbus.sys [4.6.2011 8:28 90112]
S3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\drivers\ss_bmdfl.sys [4.6.2011 8:28 14976]
S3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\drivers\ss_bmdm.sys [4.6.2011 8:28 121856]
S3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [19.2.2010 13:37 517096]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [26.3.2011 11:24 2136224]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 12:16 753504]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\sqladhlp.exe [23.7.2009 4:08 47128]
S4 RsFx0103;RsFx0103 Driver;c:\windows\system32\drivers\RsFx0103.sys [30.3.2009 2:09 239336]
S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [30.3.2009 2:23 366936]
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - PARPORT
.
Obsah adresáře 'Naplánované úlohy'
.
2012-03-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-823518204-1035525444-725345543-1003Core.job
- c:\documents and settings\kundibal\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-04-03 16:35]
.
2012-03-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-823518204-1035525444-725345543-1003UA.job
- c:\documents and settings\kundibal\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-04-03 16:35]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://eu.ask.com/?l=dis&o=14672
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-03-18 08:00
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HDAudDeck = c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe 1????????????????????????????????????????????????
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-823518204-1035525444-725345543-1003\Software\SecuROM\License information*]
"datasecu"=hex:df,04,24,1a,58,25,42,a3,81,39,82,eb,7a,b7,cc,97,4d,0f,2a,04,f6,
e5,ca,c3,1d,77,58,57,25,c8,22,ec,13,4d,c2,59,dd,fd,e9,a2,24,b5,18,30,82,61,\
"rkeysecu"=hex:93,fb,26,f0,5f,97,92,2b,75,48,ee,0f,22,71,1c,c3
.
Celkový čas: 2012-03-18 08:04:37
ComboFix-quarantined-files.txt 2012-03-18 07:04
.
Před spuštěním: 1 591 140 352 bytes free
Po spuštění: 1 521 152 000 bytes free
.
- - End Of File - - C999DD0C08E5574C0BDD4CBD599CB6F0

spustil jsem TDSSkiller znovu a log stejný
08:15:00.0593 1912 TDSS rootkit removing tool 2.7.20.0 Mar 9 2012 17:10:43
08:15:00.0687 1912 ============================================================
08:15:00.0687 1912 Current date / time: 2012/03/18 08:15:00.0687
08:15:00.0687 1912 SystemInfo:
08:15:00.0687 1912
08:15:00.0687 1912 OS Version: 5.1.2600 ServicePack: 3.0
08:15:00.0687 1912 Product type: Workstation
08:15:00.0687 1912 ComputerName: BITCH
08:15:00.0687 1912 UserName: kundibal
08:15:00.0687 1912 Windows directory: C:\WINDOWS
08:15:00.0687 1912 System windows directory: C:\WINDOWS
08:15:00.0687 1912 Processor architecture: Intel x86
08:15:00.0687 1912 Number of processors: 2
08:15:00.0687 1912 Page size: 0x1000
08:15:00.0687 1912 Boot type: Normal boot
08:15:00.0687 1912 ============================================================
08:15:01.0843 1912 Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x97695, SectorsPerTrack: 0x3F, TracksPerCylinder: 0x10, Type 'K0', Flags 0x00000054
08:15:01.0859 1912 Drive \Device\Harddisk2\DR2 - Size: 0x12A1F16000 (74.53 Gb), SectorSize: 0x200, Cylinders: 0x2601, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
08:15:01.0859 1912 Drive \Device\Harddisk1\DR1 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
08:15:01.0859 1912 \Device\Harddisk0\DR0:
08:15:01.0875 1912 MBR used
08:15:01.0875 1912 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x2542E681
08:15:01.0875 1912 \Device\Harddisk2\DR2:
08:15:01.0875 1912 MBR used
08:15:01.0875 1912 \Device\Harddisk2\DR2\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x30D3C74
08:15:01.0890 1912 \Device\Harddisk2\DR2\Partition1: MBR, Type 0x7, StartLBA 0x30D3CF2, BlocksNum 0x643690E
08:15:01.0890 1912 \Device\Harddisk1\DR1:
08:15:01.0890 1912 MBR used
08:15:01.0890 1912 \Device\Harddisk1\DR1\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x2542D682
08:15:01.0984 1912 Initialize success
08:15:01.0984 1912 ============================================================
08:15:05.0906 2980 ============================================================
08:15:05.0906 2980 Scan started
08:15:05.0906 2980 Mode: Manual;
08:15:05.0906 2980 ============================================================
08:15:07.0031 2980 Aavmker4 (78a4db23bb4e8d4349e164d1d90af73f) C:\WINDOWS\system32\drivers\Aavmker4.sys
08:15:07.0031 2980 Aavmker4 - ok
08:15:07.0093 2980 Abiosdsk - ok
08:15:07.0125 2980 abp480n5 - ok
08:15:07.0171 2980 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
08:15:07.0171 2980 ACPI - ok
08:15:07.0218 2980 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
08:15:07.0218 2980 ACPIEC - ok
08:15:07.0250 2980 adpu160m - ok
08:15:07.0296 2980 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
08:15:07.0296 2980 aec - ok
08:15:07.0359 2980 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
08:15:07.0359 2980 AFD - ok
08:15:07.0390 2980 Aha154x - ok
08:15:07.0406 2980 aic78u2 - ok
08:15:07.0437 2980 aic78xx - ok
08:15:07.0453 2980 AliIde - ok
08:15:07.0468 2980 amsint - ok
08:15:07.0562 2980 AR5211 (3cb8e72b7c9887b42b90000e8cb1e7be) C:\WINDOWS\system32\DRIVERS\ar5211.sys
08:15:07.0562 2980 AR5211 - ok
08:15:07.0578 2980 asc - ok
08:15:07.0609 2980 asc3350p - ok
08:15:07.0640 2980 asc3550 - ok
08:15:07.0671 2980 aswFsBlk (9bdb29e81abceb883556df44649696c4) C:\WINDOWS\system32\drivers\aswFsBlk.sys
08:15:07.0671 2980 aswFsBlk - ok
08:15:07.0703 2980 aswMon2 (2ce6da466687cbb3b97e59f8831a27cb) C:\WINDOWS\system32\drivers\aswMon2.sys
08:15:07.0703 2980 aswMon2 - ok
08:15:07.0734 2980 aswRdr (a90cf680ca7a323913ca3a0810c8e02d) C:\WINDOWS\system32\drivers\aswRdr.sys
08:15:07.0734 2980 aswRdr - ok
08:15:07.0781 2980 aswSnx (f7969934cca2e566e95df17380a3cb11) C:\WINDOWS\system32\drivers\aswSnx.sys
08:15:07.0781 2980 aswSnx - ok
08:15:07.0828 2980 aswSP (478d6a0e0630c31bf4a7f5eb0a05b92c) C:\WINDOWS\system32\drivers\aswSP.sys
08:15:07.0828 2980 aswSP - ok
08:15:07.0859 2980 aswTdi (e52e45743e27fd6184c55618a10b81ab) C:\WINDOWS\system32\drivers\aswTdi.sys
08:15:07.0859 2980 aswTdi - ok
08:15:07.0921 2980 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
08:15:07.0921 2980 AsyncMac - ok
08:15:07.0953 2980 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
08:15:07.0953 2980 atapi - ok
08:15:07.0984 2980 Atdisk - ok
08:15:08.0031 2980 atksgt (f9c24d25d9ff29f894995a64812b4d85) C:\WINDOWS\system32\DRIVERS\atksgt.sys
08:15:08.0046 2980 atksgt - ok
08:15:08.0078 2980 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
08:15:08.0078 2980 Atmarpc - ok
08:15:08.0125 2980 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
08:15:08.0125 2980 audstub - ok
08:15:08.0203 2980 AVerAF15DMBTH (3e851cc6db0c07a8cc640fd03eb6fdae) C:\WINDOWS\system32\Drivers\AVerAF15DMBTH.sys
08:15:08.0203 2980 AVerAF15DMBTH - ok
08:15:08.0218 2980 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
08:15:08.0218 2980 Beep - ok
08:15:08.0250 2980 bjrvlvcn - ok
08:15:08.0328 2980 catchme - ok
08:15:08.0359 2980 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
08:15:08.0359 2980 cbidf2k - ok
08:15:08.0406 2980 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
08:15:08.0406 2980 CCDECODE - ok
08:15:08.0421 2980 cd20xrnt - ok
08:15:08.0453 2980 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
08:15:08.0453 2980 Cdaudio - ok
08:15:08.0484 2980 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
08:15:08.0484 2980 Cdfs - ok
08:15:08.0484 2980 Scan interrupted by user!
08:15:08.0484 2980 Scan interrupted by user!
08:15:08.0484 2980 Scan interrupted by user!
08:15:08.0484 2980 ============================================================
08:15:08.0484 2980 Scan finished
08:15:08.0484 2980 ============================================================
08:15:08.0484 2972 Detected object count: 0
08:15:08.0484 2972 Actual detected object count: 0
08:15:08.0921 2840 ============================================================
08:15:08.0921 2840 Scan started
08:15:08.0921 2840 Mode: Manual; SigCheck; TDLFS;
08:15:08.0921 2840 ============================================================
08:15:09.0156 2840 Aavmker4 (78a4db23bb4e8d4349e164d1d90af73f) C:\WINDOWS\system32\drivers\Aavmker4.sys
08:15:09.0250 2840 Aavmker4 - ok
08:15:09.0281 2840 Abiosdsk - ok
08:15:09.0312 2840 abp480n5 - ok
08:15:09.0359 2840 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
08:15:09.0468 2840 ACPI - ok
08:15:09.0515 2840 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
08:15:09.0625 2840 ACPIEC - ok
08:15:09.0640 2840 adpu160m - ok
08:15:09.0703 2840 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
08:15:09.0812 2840 aec - ok
08:15:09.0859 2840 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
08:15:09.0875 2840 AFD - ok
08:15:09.0906 2840 Aha154x - ok
08:15:09.0921 2840 aic78u2 - ok
08:15:09.0953 2840 aic78xx - ok
08:15:09.0984 2840 AliIde - ok
08:15:10.0000 2840 amsint - ok
08:15:10.0062 2840 AR5211 (3cb8e72b7c9887b42b90000e8cb1e7be) C:\WINDOWS\system32\DRIVERS\ar5211.sys
08:15:10.0078 2840 AR5211 ( UnsignedFile.Multi.Generic ) - warning
08:15:10.0078 2840 AR5211 - detected UnsignedFile.Multi.Generic (1)
08:15:10.0109 2840 asc - ok
08:15:10.0125 2840 asc3350p - ok
08:15:10.0156 2840 asc3550 - ok
08:15:10.0234 2840 aswFsBlk (9bdb29e81abceb883556df44649696c4) C:\WINDOWS\system32\drivers\aswFsBlk.sys
08:15:10.0250 2840 aswFsBlk - ok
08:15:10.0281 2840 aswMon2 (2ce6da466687cbb3b97e59f8831a27cb) C:\WINDOWS\system32\drivers\aswMon2.sys
08:15:10.0296 2840 aswMon2 - ok
08:15:10.0312 2840 aswRdr (a90cf680ca7a323913ca3a0810c8e02d) C:\WINDOWS\system32\drivers\aswRdr.sys
08:15:10.0328 2840 aswRdr - ok
08:15:10.0359 2840 aswSnx (f7969934cca2e566e95df17380a3cb11) C:\WINDOWS\system32\drivers\aswSnx.sys
08:15:10.0375 2840 aswSnx - ok
08:15:10.0421 2840 aswSP (478d6a0e0630c31bf4a7f5eb0a05b92c) C:\WINDOWS\system32\drivers\aswSP.sys
08:15:10.0437 2840 aswSP - ok
08:15:10.0468 2840 aswTdi (e52e45743e27fd6184c55618a10b81ab) C:\WINDOWS\system32\drivers\aswTdi.sys
08:15:10.0484 2840 aswTdi - ok
08:15:10.0515 2840 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
08:15:10.0640 2840 AsyncMac - ok
08:15:10.0671 2840 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
08:15:10.0796 2840 atapi - ok
08:15:10.0828 2840 Atdisk - ok
08:15:10.0890 2840 atksgt (f9c24d25d9ff29f894995a64812b4d85) C:\WINDOWS\system32\DRIVERS\atksgt.sys
08:15:10.0906 2840 atksgt - ok
08:15:10.0937 2840 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
08:15:11.0062 2840 Atmarpc - ok
08:15:11.0109 2840 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
08:15:11.0234 2840 audstub - ok
08:15:11.0312 2840 AVerAF15DMBTH (3e851cc6db0c07a8cc640fd03eb6fdae) C:\WINDOWS\system32\Drivers\AVerAF15DMBTH.sys
08:15:11.0343 2840 AVerAF15DMBTH ( UnsignedFile.Multi.Generic ) - warning
08:15:11.0343 2840 AVerAF15DMBTH - detected UnsignedFile.Multi.Generic (1)
08:15:11.0375 2840 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
08:15:11.0500 2840 Beep - ok
08:15:11.0531 2840 bjrvlvcn - ok
08:15:11.0609 2840 catchme - ok
08:15:11.0656 2840 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
08:15:11.0781 2840 cbidf2k - ok
08:15:11.0843 2840 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
08:15:11.0968 2840 CCDECODE - ok
08:15:12.0000 2840 cd20xrnt - ok
08:15:12.0031 2840 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
08:15:12.0140 2840 Cdaudio - ok
08:15:12.0203 2840 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
08:15:12.0328 2840 Cdfs - ok
08:15:12.0390 2840 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
08:15:12.0515 2840 Cdrom - ok
08:15:12.0531 2840 Changer - ok
08:15:12.0562 2840 CmdIde - ok
08:15:12.0593 2840 Cpqarray - ok
08:15:12.0609 2840 dac2w2k - ok
08:15:12.0625 2840 dac960nt - ok
08:15:12.0640 2840 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
08:15:12.0796 2840 Disk - ok
08:15:12.0843 2840 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
08:15:12.0968 2840 dmboot - ok
08:15:13.0015 2840 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
08:15:13.0140 2840 dmio - ok
08:15:13.0171 2840 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
08:15:13.0296 2840 dmload - ok
08:15:13.0359 2840 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
08:15:13.0484 2840 DMusic - ok
08:15:13.0515 2840 Dokan (bf94acf77e2c7458d91d0bef8718eece) C:\WINDOWS\system32\drivers\dokan.sys
08:15:13.0531 2840 Dokan ( UnsignedFile.Multi.Generic ) - warning
08:15:13.0531 2840 Dokan - detected UnsignedFile.Multi.Generic (1)
08:15:13.0562 2840 dpti2o - ok
08:15:13.0609 2840 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
08:15:13.0734 2840 drmkaud - ok
08:15:13.0765 2840 dsNcAdpt - ok
08:15:13.0796 2840 eamon (d42dd9021acd47683b33adf21bca49aa) C:\WINDOWS\system32\DRIVERS\eamon.sys
08:15:13.0812 2840 eamon - ok
08:15:13.0859 2840 ehdrv (fe7824239d132ad9ebd8645fe1199b30) C:\WINDOWS\system32\DRIVERS\ehdrv.sys
08:15:13.0859 2840 ehdrv - ok
08:15:13.0890 2840 epfwtdir (aa0667eb9a92414abb784c101a6c7fec) C:\WINDOWS\system32\DRIVERS\epfwtdir.sys
08:15:13.0906 2840 epfwtdir - ok
08:15:13.0953 2840 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
08:15:14.0093 2840 Fastfat - ok
08:15:14.0125 2840 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
08:15:14.0250 2840 Fdc - ok
08:15:14.0281 2840 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
08:15:14.0406 2840 Fips - ok
08:15:14.0437 2840 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
08:15:14.0562 2840 Flpydisk - ok
08:15:14.0609 2840 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
08:15:14.0718 2840 FltMgr - ok
08:15:14.0765 2840 FsUsbExDisk (790a4ca68f44be35967b3df61f3e4675) C:\WINDOWS\system32\FsUsbExDisk.SYS
08:15:14.0765 2840 FsUsbExDisk ( UnsignedFile.Multi.Generic ) - warning
08:15:14.0765 2840 FsUsbExDisk - detected UnsignedFile.Multi.Generic (1)
08:15:14.0843 2840 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
08:15:14.0968 2840 Fs_Rec - ok
08:15:15.0015 2840 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
08:15:15.0140 2840 Ftdisk - ok
08:15:15.0156 2840 GGSAFERDriver - ok
08:15:15.0187 2840 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
08:15:15.0312 2840 Gpc - ok
08:15:15.0359 2840 hamachi (833051c6c6c42117191935f734cfbd97) C:\WINDOWS\system32\DRIVERS\hamachi.sys
08:15:15.0375 2840 hamachi - ok
08:15:15.0421 2840 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
08:15:15.0546 2840 HDAudBus - ok
08:15:15.0593 2840 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
08:15:15.0718 2840 hidusb - ok
08:15:15.0750 2840 hidusbf (34f0823be25aed4992fd9fcf587f50d5) C:\WINDOWS\system32\DRIVERS\hidusbf.sys
08:15:15.0750 2840 hidusbf ( UnsignedFile.Multi.Generic ) - warning
08:15:15.0750 2840 hidusbf - detected UnsignedFile.Multi.Generic (1)
08:15:15.0781 2840 hpn - ok
08:15:15.0828 2840 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
08:15:15.0843 2840 HTTP - ok
08:15:15.0875 2840 i2omgmt - ok
08:15:15.0921 2840 i2omp - ok
08:15:15.0953 2840 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
08:15:16.0062 2840 i8042prt - ok
08:15:16.0093 2840 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
08:15:16.0234 2840 Imapi - ok
08:15:16.0250 2840 ini910u - ok
08:15:16.0265 2840 IntelIde - ok
08:15:16.0312 2840 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
08:15:16.0437 2840 Ip6Fw - ok
08:15:16.0484 2840 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
08:15:16.0593 2840 IpFilterDriver - ok
08:15:16.0625 2840 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
08:15:16.0734 2840 IpInIp - ok
08:15:16.0765 2840 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
08:15:16.0890 2840 IpNat - ok
08:15:16.0906 2840 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
08:15:17.0046 2840 IPSec - ok
08:15:17.0093 2840 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
08:15:17.0156 2840 IRENUM - ok
08:15:17.0218 2840 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
08:15:17.0328 2840 isapnp - ok
08:15:17.0390 2840 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
08:15:17.0500 2840 Kbdclass - ok
08:15:17.0562 2840 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
08:15:17.0687 2840 kmixer - ok
08:15:17.0734 2840 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
08:15:17.0750 2840 KSecDD - ok
08:15:17.0796 2840 L1e (101457d884e3dd4636baefb9b7e7d3f3) C:\WINDOWS\system32\DRIVERS\l1e51x86.sys
08:15:17.0812 2840 L1e - ok
08:15:17.0843 2840 lbrtfdc - ok
08:15:17.0906 2840 LHidFlt2 (63b00a26f62572e0d58e6c8d3b32bf59) C:\WINDOWS\system32\DRIVERS\LHidFlt2.Sys
08:15:17.0921 2840 LHidFlt2 - ok
08:15:17.0968 2840 LHidUsb (ac05a1b5c66d693b1598fd83617d1820) C:\WINDOWS\system32\Drivers\LHidUsb.Sys
08:15:17.0968 2840 LHidUsb - ok
08:15:18.0000 2840 lirsgt (8ccf9ed46d52af1375875f74a91ffacf) C:\WINDOWS\system32\DRIVERS\lirsgt.sys
08:15:18.0015 2840 lirsgt - ok
08:15:18.0078 2840 LMouFlt2 (03abef1a29addc98c32ed0f336b98e90) C:\WINDOWS\system32\DRIVERS\LMouFlt2.Sys
08:15:18.0109 2840 LMouFlt2 - ok
08:15:18.0156 2840 MBAMProtector (b7ca8cc3f978201856b6ab82f40953c3) C:\WINDOWS\system32\drivers\mbam.sys
08:15:18.0156 2840 MBAMProtector - ok
08:15:18.0218 2840 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
08:15:18.0343 2840 mnmdd - ok
08:15:18.0390 2840 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
08:15:18.0515 2840 Modem - ok
08:15:18.0593 2840 monfilt (9fa7207d1b1adead88ae8eed9cdbbaa5) C:\WINDOWS\system32\drivers\monfilt.sys
08:15:18.0671 2840 monfilt - ok
08:15:18.0718 2840 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
08:15:18.0828 2840 Mouclass - ok
08:15:18.0859 2840 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
08:15:18.0984 2840 mouhid - ok
08:15:19.0000 2840 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
08:15:19.0109 2840 MountMgr - ok
08:15:19.0187 2840 MPE (c0f8e0c2c3c0437cf37c6781896dc3ec) C:\WINDOWS\system32\DRIVERS\MPE.sys
08:15:19.0296 2840 MPE - ok
08:15:19.0328 2840 mraid35x - ok
08:15:19.0359 2840 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
08:15:19.0500 2840 MRxDAV - ok
08:15:19.0546 2840 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
08:15:19.0593 2840 MRxSmb - ok
08:15:19.0609 2840 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
08:15:19.0750 2840 Msfs - ok
08:15:19.0796 2840 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
08:15:19.0921 2840 MSKSSRV - ok
08:15:19.0968 2840 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
08:15:20.0078 2840 MSPCLOCK - ok
08:15:20.0109 2840 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
08:15:20.0234 2840 MSPQM - ok
08:15:20.0281 2840 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
08:15:20.0390 2840 mssmbios - ok
08:15:20.0453 2840 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
08:15:20.0578 2840 MSTEE - ok
08:15:20.0609 2840 MTsensor (d48659bb24c48345d926ecb45c1ebdf5) C:\WINDOWS\system32\DRIVERS\ASACPI.sys
08:15:20.0625 2840 MTsensor - ok
08:15:20.0656 2840 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
08:15:20.0671 2840 Mup - ok
08:15:20.0703 2840 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
08:15:20.0828 2840 NABTSFEC - ok
08:15:20.0875 2840 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
08:15:21.0000 2840 NDIS - ok
08:15:21.0031 2840 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
08:15:21.0140 2840 NdisIP - ok
08:15:21.0187 2840 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
08:15:21.0187 2840 NdisTapi - ok
08:15:21.0234 2840 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
08:15:21.0390 2840 Ndisuio - ok
08:15:21.0421 2840 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
08:15:21.0531 2840 NdisWan - ok
08:15:21.0578 2840 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
08:15:21.0578 2840 NDProxy - ok
08:15:21.0625 2840 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
08:15:21.0734 2840 NetBIOS - ok
08:15:21.0765 2840 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
08:15:21.0875 2840 NetBT - ok
08:15:21.0906 2840 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
08:15:22.0015 2840 Npfs - ok
08:15:22.0093 2840 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
08:15:22.0218 2840 Ntfs - ok
08:15:22.0265 2840 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
08:15:22.0390 2840 Null - ok
08:15:22.0765 2840 nv (0dc79b60cedc3a8854c27b3c6e4b3414) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
08:15:23.0093 2840 nv - ok
08:15:23.0171 2840 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
08:15:23.0281 2840 NwlnkFlt - ok
08:15:23.0312 2840 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
08:15:23.0437 2840 NwlnkFwd - ok
08:15:23.0515 2840 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\drivers\Parport.sys
08:15:23.0625 2840 Parport - ok
08:15:23.0656 2840 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
08:15:23.0781 2840 PartMgr - ok
08:15:23.0828 2840 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
08:15:23.0937 2840 ParVdm - ok
08:15:23.0984 2840 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
08:15:24.0093 2840 PCI - ok
08:15:24.0125 2840 PCIDump - ok
08:15:24.0156 2840 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
08:15:24.0281 2840 PCIIde - ok
08:15:24.0328 2840 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
08:15:24.0453 2840 Pcmcia - ok
08:15:24.0468 2840 PDCOMP - ok
08:15:24.0500 2840 PDFRAME - ok
08:15:24.0515 2840 PDRELI - ok
08:15:24.0546 2840 PDRFRAME - ok
08:15:24.0562 2840 perc2 - ok
08:15:24.0593 2840 perc2hib - ok
08:15:24.0640 2840 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
08:15:24.0750 2840 PptpMiniport - ok
08:15:24.0796 2840 Processor (a32bebaf723557681bfc6bd93e98bd26) C:\WINDOWS\system32\DRIVERS\processr.sys
08:15:24.0921 2840 Processor - ok
08:15:24.0953 2840 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
08:15:25.0062 2840 PSched - ok
08:15:25.0093 2840 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
08:15:25.0203 2840 Ptilink - ok
08:15:25.0250 2840 PxHelp20 (40fedd328f98245ad201cf5f9f311724) C:\WINDOWS\system32\Drivers\PxHelp20.sys
08:15:25.0265 2840 PxHelp20 - ok
08:15:25.0281 2840 ql1080 - ok
08:15:25.0312 2840 Ql10wnt - ok
08:15:25.0328 2840 ql12160 - ok
08:15:25.0359 2840 ql1240 - ok
08:15:25.0390 2840 ql1280 - ok
08:15:25.0390 2840 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
08:15:25.0531 2840 RasAcd - ok
08:15:25.0546 2840 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
08:15:25.0671 2840 Rasl2tp - ok
08:15:25.0703 2840 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
08:15:25.0812 2840 RasPppoe - ok
08:15:25.0828 2840 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
08:15:25.0953 2840 Raspti - ok
08:15:25.0984 2840 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
08:15:26.0093 2840 Rdbss - ok
08:15:26.0109 2840 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
08:15:26.0234 2840 RDPCDD - ok
08:15:26.0281 2840 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
08:15:26.0390 2840 rdpdr - ok
08:15:26.0437 2840 RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
08:15:26.0453 2840 RDPWD - ok
08:15:26.0468 2840 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
08:15:26.0625 2840 redbook - ok
08:15:26.0671 2840 RsFx0103 (fd692c6ffade58f7c4c3c3c9a0ec35bd) C:\WINDOWS\system32\DRIVERS\RsFx0103.sys
08:15:26.0687 2840 RsFx0103 - ok
08:15:26.0750 2840 rtl8139 (d507c1400284176573224903819ffda3) C:\WINDOWS\system32\DRIVERS\RTL8139.SYS
08:15:26.0859 2840 rtl8139 - ok
08:15:26.0906 2840 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
08:15:26.0953 2840 Secdrv - ok
08:15:27.0000 2840 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
08:15:27.0109 2840 serenum - ok
08:15:27.0125 2840 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys
08:15:27.0250 2840 Serial - ok
08:15:27.0296 2840 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
08:15:27.0406 2840 Sfloppy - ok
08:15:27.0437 2840 Simbad - ok
08:15:27.0484 2840 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
08:15:27.0593 2840 SLIP - ok
08:15:27.0609 2840 Sparrow - ok
08:15:27.0687 2840 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
08:15:27.0796 2840 splitter - ok
08:15:27.0859 2840 sptd (71e276f6d189413266ea22171806597b) C:\WINDOWS\system32\Drivers\sptd.sys
08:15:27.0859 2840 Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: 71e276f6d189413266ea22171806597b
08:15:27.0859 2840 sptd ( LockedFile.Multi.Generic ) - warning
08:15:27.0859 2840 sptd - detected LockedFile.Multi.Generic (1)
08:15:27.0906 2840 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
08:15:27.0953 2840 sr - ok
08:15:28.0000 2840 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
08:15:28.0031 2840 Srv - ok
08:15:28.0093 2840 ss_bbus (eaa66218cd39f5bb1b4853a78c67c787) C:\WINDOWS\system32\DRIVERS\ss_bbus.sys
08:15:28.0109 2840 ss_bbus - ok
08:15:28.0156 2840 ss_bmdfl (91765f99914ed8693d8bc76524f21581) C:\WINDOWS\system32\DRIVERS\ss_bmdfl.sys
08:15:28.0156 2840 ss_bmdfl - ok
08:15:28.0203 2840 ss_bmdm (840e7b738b03c10ee91d9b7d3d6eff15) C:\WINDOWS\system32\DRIVERS\ss_bmdm.sys
08:15:28.0218 2840 ss_bmdm - ok
08:15:28.0265 2840 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
08:15:28.0375 2840 streamip - ok
08:15:28.0437 2840 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
08:15:28.0546 2840 swenum - ok
08:15:28.0609 2840 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
08:15:28.0703 2840 swmidi - ok
08:15:28.0750 2840 symc810 - ok
08:15:28.0765 2840 symc8xx - ok
08:15:28.0796 2840 sym_hi - ok
08:15:28.0812 2840 sym_u3 - ok
08:15:28.0859 2840 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
08:15:28.0984 2840 sysaudio - ok
08:15:29.0046 2840 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
08:15:29.0062 2840 Tcpip - ok
08:15:29.0125 2840 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
08:15:29.0234 2840 TDPIPE - ok
08:15:29.0265 2840 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
08:15:29.0375 2840 TDTCP - ok
08:15:29.0437 2840 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
08:15:29.0531 2840 TermDD - ok
08:15:29.0562 2840 TosIde - ok
08:15:29.0625 2840 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
08:15:29.0718 2840 Udfs - ok
08:15:29.0734 2840 ultra - ok
08:15:29.0828 2840 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
08:15:29.0953 2840 Update - ok
08:15:30.0000 2840 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
08:15:30.0109 2840 usbccgp - ok
08:15:30.0171 2840 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
08:15:30.0281 2840 usbehci - ok
08:15:30.0312 2840 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
08:15:30.0421 2840 usbhub - ok
08:15:30.0453 2840 usbohci (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys
08:15:30.0546 2840 usbohci - ok
08:15:30.0593 2840 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
08:15:30.0718 2840 USBSTOR - ok
08:15:30.0765 2840 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
08:15:30.0859 2840 VgaSave - ok
08:15:30.0984 2840 VIAHdAudAddService (cbc1ce0a1fce0deed4f6f093be91d132) C:\WINDOWS\system32\drivers\viahduaa.sys
08:15:31.0046 2840 VIAHdAudAddService - ok
08:15:31.0078 2840 ViaIde - ok
08:15:31.0109 2840 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
08:15:31.0218 2840 VolSnap - ok
08:15:31.0265 2840 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
08:15:31.0375 2840 Wanarp - ok
08:15:31.0390 2840 WDICA - ok
08:15:31.0453 2840 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
08:15:31.0562 2840 wdmaud - ok
08:15:31.0609 2840 WmiAcpi (c42584fd66ce9e17403aebca199f7bdb) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
08:15:31.0718 2840 WmiAcpi - ok
08:15:31.0781 2840 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
08:15:31.0890 2840 WS2IFSL - ok
08:15:31.0906 2840 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
08:15:32.0046 2840 WSTCODEC - ok
08:15:32.0093 2840 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
08:15:32.0109 2840 WudfPf - ok
08:15:32.0140 2840 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
08:15:32.0156 2840 WudfRd - ok
08:15:32.0171 2840 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0
08:15:32.0218 2840 \Device\Harddisk0\DR0 - ok
08:15:32.0234 2840 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk2\DR2
08:15:32.0406 2840 \Device\Harddisk2\DR2 ( TDSS File System ) - warning
08:15:32.0406 2840 \Device\Harddisk2\DR2 - detected TDSS File System (1)
08:15:32.0406 2840 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk1\DR1
08:15:32.0437 2840 \Device\Harddisk1\DR1 - ok
08:15:32.0437 2840 Boot (0x1200) (57a5dc99b56e9005f2431a948e997904) \Device\Harddisk0\DR0\Partition0
08:15:32.0437 2840 \Device\Harddisk0\DR0\Partition0 - ok
08:15:32.0437 2840 Boot (0x1200) (8b1ec730cb92ce601529b2b77ef94f2e) \Device\Harddisk2\DR2\Partition0
08:15:32.0437 2840 \Device\Harddisk2\DR2\Partition0 - ok
08:15:32.0468 2840 Boot (0x1200) (be9dcdf9482ad37e6e4e0c93eece7738) \Device\Harddisk2\DR2\Partition1
08:15:32.0468 2840 \Device\Harddisk2\DR2\Partition1 - ok
08:15:32.0468 2840 Boot (0x1200) (67643b5bd28842b200c744127f5afd21) \Device\Harddisk1\DR1\Partition0
08:15:32.0468 2840 \Device\Harddisk1\DR1\Partition0 - ok
08:15:32.0468 2840 ============================================================
08:15:32.0468 2840 Scan finished
08:15:32.0468 2840 ============================================================
08:15:32.0578 3056 Detected object count: 7
08:15:32.0578 3056 Actual detected object count: 7
08:15:36.0640 3056 AR5211 ( UnsignedFile.Multi.Generic ) - skipped by user
08:15:36.0640 3056 AR5211 ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:15:36.0640 3056 AVerAF15DMBTH ( UnsignedFile.Multi.Generic ) - skipped by user
08:15:36.0640 3056 AVerAF15DMBTH ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:15:36.0640 3056 Dokan ( UnsignedFile.Multi.Generic ) - skipped by user
08:15:36.0640 3056 Dokan ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:15:36.0640 3056 FsUsbExDisk ( UnsignedFile.Multi.Generic ) - skipped by user
08:15:36.0640 3056 FsUsbExDisk ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:15:36.0656 3056 hidusbf ( UnsignedFile.Multi.Generic ) - skipped by user
08:15:36.0656 3056 hidusbf ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:15:36.0656 3056 sptd ( LockedFile.Multi.Generic ) - skipped by user
08:15:36.0656 3056 sptd ( LockedFile.Multi.Generic ) - User select action: Skip
08:15:36.0656 3056 \Device\Harddisk2\DR2 ( TDSS File System ) - skipped by user
08:15:36.0656 3056 \Device\Harddisk2\DR2 ( TDSS File System ) - User select action: Skip

WIAL · #11 Příspěvek od **WIAL** » 18 bře 2012 08:16

Další věc co PC dělá - po bootu do windows nejde spustit Chrome, ani jiné věci. Např. internet explorer jde. Ale nespustím např. ten Chrome, nebo jsem chtěl síťové připojení spustit - nic. Jen se vidím proces v taskmanageru a nic. Po cca minutě začne HDD něco chroustat a potom jde vše normálně.

Combofix zase BSOD - http://leteckaposta.cz/844091509 dump.

Tak jsem ho spustil v safe modu:

ComboFix 12-03-17.01 - kundibal 18.03.2012 7:42.4.2 - x86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.3.1250.420.1033.18.3327.2879 [GMT 1:00]
Spuštěný z: e:\documents\Downloads\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\All Users\Application Data\TEMP\{F232C87C-6E92-4775-8210-DFE90B7777D9}\PostBuild.exe
c:\documents and settings\kundibal\WINDOWS
c:\windows\m
c:\windows\m\KB2544521-IE7\spuninst\spuninst.exe
c:\windows\m\KB2544521-IE7\spuninst\spuninst.inf
c:\windows\m\KB2544521-IE7\spuninst\spuninst.txt
c:\windows\m\KB2544521-IE7\spuninst\updspapi.dll
c:\windows\m\KB2544521-IE7\vgx.dll
c:\windows\m\KB2559049-IE7\advpack.dll
c:\windows\m\KB2559049-IE7\advpack.dll.000
c:\windows\m\KB2559049-IE7\corpol.dll
c:\windows\m\KB2559049-IE7\dxtmsft.dll
c:\windows\m\KB2559049-IE7\dxtrans.dll
c:\windows\m\KB2559049-IE7\extmgr.dll
c:\windows\m\KB2559049-IE7\html.iec
c:\windows\m\KB2559049-IE7\icardie.dll
c:\windows\m\KB2559049-IE7\icardie.dll.000
c:\windows\m\KB2559049-IE7\ie4uinit.exe
c:\windows\m\KB2559049-IE7\ieakeng.dll
c:\windows\m\KB2559049-IE7\ieaksie.dll
c:\windows\m\KB2559049-IE7\ieakui.dll
c:\windows\m\KB2559049-IE7\ieapfltr.dat
c:\windows\m\KB2559049-IE7\ieapfltr.dll
c:\windows\m\KB2559049-IE7\ieapfltr.dll.000
c:\windows\m\KB2559049-IE7\iedkcs32.dll
c:\windows\m\KB2559049-IE7\ieencode.dll
c:\windows\m\KB2559049-IE7\ieframe.dll
c:\windows\m\KB2559049-IE7\ieframe.dll.000
c:\windows\m\KB2559049-IE7\ieframe.dll.mui
c:\windows\m\KB2559049-IE7\ieframe.dll.mui.000
c:\windows\m\KB2559049-IE7\iepeers.dll
c:\windows\m\KB2559049-IE7\iernonce.dll
c:\windows\m\KB2559049-IE7\iertutil.dll
c:\windows\m\KB2559049-IE7\iertutil.dll.000
c:\windows\m\KB2559049-IE7\ieudinit.exe
c:\windows\m\KB2559049-IE7\iexplore.exe
c:\windows\m\KB2559049-IE7\inetcpl.cpl
c:\windows\m\KB2559049-IE7\jsproxy.dll
c:\windows\m\KB2559049-IE7\msfeeds.dll
c:\windows\m\KB2559049-IE7\msfeeds.dll.000
c:\windows\m\KB2559049-IE7\msfeedsbs.dll
c:\windows\m\KB2559049-IE7\msfeedsbs.dll.000
c:\windows\m\KB2559049-IE7\mshtml.dll
c:\windows\m\KB2559049-IE7\mshtml.dll.000
c:\windows\m\KB2559049-IE7\mshtmled.dll
c:\windows\m\KB2559049-IE7\msrating.dll
c:\windows\m\KB2559049-IE7\mstime.dll
c:\windows\m\KB2559049-IE7\occache.dll
c:\windows\m\KB2559049-IE7\pngfilt.dll
c:\windows\m\KB2559049-IE7\reg00002
c:\windows\m\KB2559049-IE7\reg00003
c:\windows\m\KB2559049-IE7\reg00004
c:\windows\m\KB2559049-IE7\reg00005
c:\windows\m\KB2559049-IE7\reg00006
c:\windows\m\KB2559049-IE7\reg00007
c:\windows\m\KB2559049-IE7\reg00008
c:\windows\m\KB2559049-IE7\reg00009
c:\windows\m\KB2559049-IE7\reg00010
c:\windows\m\KB2559049-IE7\reg00011
c:\windows\m\KB2559049-IE7\reg00012
c:\windows\m\KB2559049-IE7\reg00013
c:\windows\m\KB2559049-IE7\reg00014
c:\windows\m\KB2559049-IE7\reg00015
c:\windows\m\KB2559049-IE7\reg00016
c:\windows\m\KB2559049-IE7\reg00017
c:\windows\m\KB2559049-IE7\reg00018
c:\windows\m\KB2559049-IE7\reg00019
c:\windows\m\KB2559049-IE7\reg00020
c:\windows\m\KB2559049-IE7\reg00021
c:\windows\m\KB2559049-IE7\reg00022
c:\windows\m\KB2559049-IE7\spuninst\spuninst.exe
c:\windows\m\KB2559049-IE7\spuninst\spuninst.inf
c:\windows\m\KB2559049-IE7\spuninst\spuninst.txt
c:\windows\m\KB2559049-IE7\spuninst\updspapi.dll
c:\windows\m\KB2559049-IE7\url.dll
c:\windows\m\KB2559049-IE7\url.dll.000
c:\windows\m\KB2559049-IE7\urlmon.dll
c:\windows\m\KB2559049-IE7\urlmon.dll.000
c:\windows\m\KB2559049-IE7\webcheck.dll
c:\windows\m\KB2559049-IE7\webcheck.dll.000
c:\windows\m\KB2559049-IE7\wininet.dll
c:\windows\m\KB2559049-IE7\wininet.dll.000
c:\windows\m\KB2586448-IE7\advpack.dll
c:\windows\m\KB2586448-IE7\corpol.dll
c:\windows\m\KB2586448-IE7\dxtmsft.dll
c:\windows\m\KB2586448-IE7\dxtrans.dll
c:\windows\m\KB2586448-IE7\extmgr.dll
c:\windows\m\KB2586448-IE7\html.iec
c:\windows\m\KB2586448-IE7\icardie.dll
c:\windows\m\KB2586448-IE7\ie4uinit.exe
c:\windows\m\KB2586448-IE7\ieakeng.dll
c:\windows\m\KB2586448-IE7\ieaksie.dll
c:\windows\m\KB2586448-IE7\ieakui.dll
c:\windows\m\KB2586448-IE7\ieapfltr.dll
c:\windows\m\KB2586448-IE7\iedkcs32.dll
c:\windows\m\KB2586448-IE7\ieencode.dll
c:\windows\m\KB2586448-IE7\ieframe.dll
c:\windows\m\KB2586448-IE7\ieframe.dll.mui
c:\windows\m\KB2586448-IE7\iepeers.dll
c:\windows\m\KB2586448-IE7\iernonce.dll
c:\windows\m\KB2586448-IE7\iertutil.dll
c:\windows\m\KB2586448-IE7\ieudinit.exe
c:\windows\m\KB2586448-IE7\iexplore.exe
c:\windows\m\KB2586448-IE7\inetcpl.cpl
c:\windows\m\KB2586448-IE7\jsproxy.dll
c:\windows\m\KB2586448-IE7\msfeeds.dll
c:\windows\m\KB2586448-IE7\msfeedsbs.dll
c:\windows\m\KB2586448-IE7\mshtml.dll
c:\windows\m\KB2586448-IE7\mshtmled.dll
c:\windows\m\KB2586448-IE7\msrating.dll
c:\windows\m\KB2586448-IE7\mstime.dll
c:\windows\m\KB2586448-IE7\occache.dll
c:\windows\m\KB2586448-IE7\pngfilt.dll
c:\windows\m\KB2586448-IE7\reg00002
c:\windows\m\KB2586448-IE7\reg00003
c:\windows\m\KB2586448-IE7\reg00004
c:\windows\m\KB2586448-IE7\reg00005
c:\windows\m\KB2586448-IE7\reg00006
c:\windows\m\KB2586448-IE7\reg00007
c:\windows\m\KB2586448-IE7\reg00008
c:\windows\m\KB2586448-IE7\reg00009
c:\windows\m\KB2586448-IE7\reg00010
c:\windows\m\KB2586448-IE7\reg00011
c:\windows\m\KB2586448-IE7\reg00012
c:\windows\m\KB2586448-IE7\reg00013
c:\windows\m\KB2586448-IE7\reg00014
c:\windows\m\KB2586448-IE7\reg00015
c:\windows\m\KB2586448-IE7\reg00016
c:\windows\m\KB2586448-IE7\reg00017
c:\windows\m\KB2586448-IE7\reg00018
c:\windows\m\KB2586448-IE7\reg00019
c:\windows\m\KB2586448-IE7\reg00020
c:\windows\m\KB2586448-IE7\reg00021
c:\windows\m\KB2586448-IE7\reg00022
c:\windows\m\KB2586448-IE7\spuninst\spuninst.exe
c:\windows\m\KB2586448-IE7\spuninst\spuninst.inf
c:\windows\m\KB2586448-IE7\spuninst\spuninst.txt
c:\windows\m\KB2586448-IE7\spuninst\updspapi.dll
c:\windows\m\KB2586448-IE7\url.dll
c:\windows\m\KB2586448-IE7\urlmon.dll
c:\windows\m\KB2586448-IE7\webcheck.dll
c:\windows\m\KB2586448-IE7\wininet.dll
c:\windows\m\KB2618444-IE7\advpack.dll
c:\windows\m\KB2618444-IE7\corpol.dll
c:\windows\m\KB2618444-IE7\dxtmsft.dll
c:\windows\m\KB2618444-IE7\dxtrans.dll
c:\windows\m\KB2618444-IE7\extmgr.dll
c:\windows\m\KB2618444-IE7\icardie.dll
c:\windows\m\KB2618444-IE7\ie4uinit.exe
c:\windows\m\KB2618444-IE7\ieakeng.dll
c:\windows\m\KB2618444-IE7\ieaksie.dll
c:\windows\m\KB2618444-IE7\ieakui.dll
c:\windows\m\KB2618444-IE7\ieapfltr.dll
c:\windows\m\KB2618444-IE7\iedkcs32.dll
c:\windows\m\KB2618444-IE7\ieencode.dll
c:\windows\m\KB2618444-IE7\ieframe.dll
c:\windows\m\KB2618444-IE7\ieframe.dll.mui
c:\windows\m\KB2618444-IE7\iepeers.dll
c:\windows\m\KB2618444-IE7\iernonce.dll
c:\windows\m\KB2618444-IE7\iertutil.dll
c:\windows\m\KB2618444-IE7\ieudinit.exe
c:\windows\m\KB2618444-IE7\iexplore.exe
c:\windows\m\KB2618444-IE7\inetcpl.cpl
c:\windows\m\KB2618444-IE7\jsproxy.dll
c:\windows\m\KB2618444-IE7\msfeeds.dll
c:\windows\m\KB2618444-IE7\msfeedsbs.dll
c:\windows\m\KB2618444-IE7\mshtml.dll
c:\windows\m\KB2618444-IE7\mshtmled.dll
c:\windows\m\KB2618444-IE7\msrating.dll
c:\windows\m\KB2618444-IE7\mstime.dll
c:\windows\m\KB2618444-IE7\occache.dll
c:\windows\m\KB2618444-IE7\pngfilt.dll
c:\windows\m\KB2618444-IE7\reg00002
c:\windows\m\KB2618444-IE7\reg00003
c:\windows\m\KB2618444-IE7\reg00004
c:\windows\m\KB2618444-IE7\reg00005
c:\windows\m\KB2618444-IE7\reg00006
c:\windows\m\KB2618444-IE7\reg00007
c:\windows\m\KB2618444-IE7\reg00008
c:\windows\m\KB2618444-IE7\reg00009
c:\windows\m\KB2618444-IE7\reg00010
c:\windows\m\KB2618444-IE7\reg00011
c:\windows\m\KB2618444-IE7\reg00012
c:\windows\m\KB2618444-IE7\reg00013
c:\windows\m\KB2618444-IE7\reg00014
c:\windows\m\KB2618444-IE7\reg00015
c:\windows\m\KB2618444-IE7\reg00016
c:\windows\m\KB2618444-IE7\reg00017
c:\windows\m\KB2618444-IE7\reg00018
c:\windows\m\KB2618444-IE7\reg00019
c:\windows\m\KB2618444-IE7\reg00020
c:\windows\m\KB2618444-IE7\reg00021
c:\windows\m\KB2618444-IE7\reg00022
c:\windows\m\KB2618444-IE7\spuninst\spuninst.exe
c:\windows\m\KB2618444-IE7\spuninst\spuninst.inf
c:\windows\m\KB2618444-IE7\spuninst\spuninst.txt
c:\windows\m\KB2618444-IE7\spuninst\updspapi.dll
c:\windows\m\KB2618444-IE7\url.dll
c:\windows\m\KB2618444-IE7\urlmon.dll
c:\windows\m\KB2618444-IE7\webcheck.dll
c:\windows\m\KB2618444-IE7\wininet.dll
c:\windows\m\KB982381-IE7\advpack.dll
c:\windows\m\KB982381-IE7\corpol.dll
c:\windows\m\KB982381-IE7\dxtmsft.dll
c:\windows\m\KB982381-IE7\dxtrans.dll
c:\windows\m\KB982381-IE7\extmgr.dll
c:\windows\m\KB982381-IE7\html.iec
c:\windows\m\KB982381-IE7\icardie.dll
c:\windows\m\KB982381-IE7\ie4uinit.exe
c:\windows\m\KB982381-IE7\ieakeng.dll
c:\windows\m\KB982381-IE7\ieaksie.dll
c:\windows\m\KB982381-IE7\ieakui.dll
c:\windows\m\KB982381-IE7\ieapfltr.dat
c:\windows\m\KB982381-IE7\ieapfltr.dll
c:\windows\m\KB982381-IE7\iedkcs32.dll
c:\windows\m\KB982381-IE7\ieencode.dll
c:\windows\m\KB982381-IE7\ieframe.dll
c:\windows\m\KB982381-IE7\ieframe.dll.mui
c:\windows\m\KB982381-IE7\iepeers.dll
c:\windows\m\KB982381-IE7\iernonce.dll
c:\windows\m\KB982381-IE7\iertutil.dll
c:\windows\m\KB982381-IE7\ieudinit.exe
c:\windows\m\KB982381-IE7\iexplore.exe
c:\windows\m\KB982381-IE7\inetcpl.cpl
c:\windows\m\KB982381-IE7\jsproxy.dll
c:\windows\m\KB982381-IE7\msfeeds.dll
c:\windows\m\KB982381-IE7\msfeedsbs.dll
c:\windows\m\KB982381-IE7\mshtml.dll
c:\windows\m\KB982381-IE7\mshtmled.dll
c:\windows\m\KB982381-IE7\msrating.dll
c:\windows\m\KB982381-IE7\mstime.dll
c:\windows\m\KB982381-IE7\occache.dll
c:\windows\m\KB982381-IE7\pngfilt.dll
c:\windows\m\KB982381-IE7\reg00002
c:\windows\m\KB982381-IE7\reg00003
c:\windows\m\KB982381-IE7\reg00004
c:\windows\m\KB982381-IE7\reg00005
c:\windows\m\KB982381-IE7\reg00006
c:\windows\m\KB982381-IE7\reg00007
c:\windows\m\KB982381-IE7\reg00008
c:\windows\m\KB982381-IE7\reg00009
c:\windows\m\KB982381-IE7\reg00010
c:\windows\m\KB982381-IE7\reg00011
c:\windows\m\KB982381-IE7\reg00012
c:\windows\m\KB982381-IE7\reg00013
c:\windows\m\KB982381-IE7\reg00014
c:\windows\m\KB982381-IE7\reg00015
c:\windows\m\KB982381-IE7\reg00017
c:\windows\m\KB982381-IE7\spuninst\spuninst.exe
c:\windows\m\KB982381-IE7\spuninst\spuninst.inf
c:\windows\m\KB982381-IE7\spuninst\spuninst.txt
c:\windows\m\KB982381-IE7\spuninst\updspapi.dll
c:\windows\m\KB982381-IE7\url.dll
c:\windows\m\KB982381-IE7\urlmon.dll
c:\windows\m\KB982381-IE7\webcheck.dll
c:\windows\m\KB982381-IE7\wininet.dll
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
c:\windows\system32\_000116_.tmp.dll
c:\windows\system32\drivers\etc\hosts.ics
c:\windows\system32\SET1BA.tmp
c:\windows\system32\SET1BC.tmp
c:\windows\system32\SET1C8.tmp
.
-- Předchozí spuštění --
.
Nakažená kopie c:\windows\system32\drivers\ntfs.sys byla nalezena a vyléčena.
Obnovena kopie z - c:\system volume information\_restore{6C6A3ACC-3069-46F6-92F1-4B1C1B8282E8}\RP254\A0111988.sys
.
--------
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-02-18 do 2012-03-18 )))))))))))))))))))))))))))))))
.
.
2012-03-16 18:08 . 2012-03-16 18:08 -------- d-----w- C:\rsit
2012-03-15 11:42 . 2012-03-15 11:42 -------- d-----w- c:\windows\Installer
2012-03-12 21:10 . 2012-03-15 19:23 -------- d-----w- c:\documents and settings\kundibal\Application Data\dvdcss
2012-03-08 08:32 . 2012-03-08 08:32 -------- d-----w- c:\documents and settings\postgres
2012-03-07 18:20 . 2012-03-07 18:20 -------- d-----w- c:\documents and settings\kundibal\Application Data\ElevatedDiagnostics
2012-03-05 20:10 . 2012-03-05 20:10 -------- d-----w- c:\documents and settings\kundibal\.thumbnails
2012-03-05 20:08 . 2012-03-05 20:08 -------- d-----w- c:\program files\Blender Foundation
2012-03-05 16:23 . 2012-03-05 16:23 -------- d-----w- c:\program files\Lavalys
2012-03-05 16:17 . 2012-03-05 16:17 -------- d-----w- c:\documents and settings\kundibal\Application Data\FreeStone Group
2012-03-05 16:16 . 2012-03-05 16:16 -------- d-----w- c:\program files\Video Card Stability Test
2012-03-03 10:40 . 2012-03-03 10:40 -------- d-----w- c:\documents and settings\All Users\Application Data\RELOADED
2012-02-27 20:15 . 2012-02-27 20:15 1492 ----a-w- C:\user.js
2012-02-27 20:15 . 2012-03-07 18:21 -------- d-----w- c:\documents and settings\All Users\Application Data\TheBflix
2012-02-27 20:15 . 2012-02-27 20:15 -------- d-----w- c:\documents and settings\All Users\Application Data\InstallMate
2012-02-25 08:39 . 2012-02-25 08:39 -------- d-----w- C:\NVIDIA
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-07 07:11 . 2011-07-20 05:34 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-02-10 04:10 . 2011-03-26 10:23 65536 ----a-w- c:\windows\system32\OpenCL.dll
2012-02-10 04:10 . 2011-03-26 10:23 881984 ----a-w- c:\windows\system32\nvgenco32.dll
2012-02-10 04:10 . 2011-03-26 10:23 5918720 ----a-w- c:\windows\system32\nvcuda.dll
2012-02-10 04:10 . 2011-03-26 10:23 2522944 ----a-w- c:\windows\system32\nvcuvid.dll
2012-02-10 04:10 . 2011-03-26 10:23 2437440 ----a-w- c:\windows\system32\nvcuvenc.dll
2012-02-10 04:10 . 2011-03-26 10:23 18620416 ----a-w- c:\windows\system32\nvoglnt.dll
2012-02-10 04:10 . 2011-03-26 10:23 1000256 ----a-w- c:\windows\system32\nvdispco32.dll
2012-02-10 04:10 . 2011-03-26 10:23 4309760 ----a-w- c:\windows\system32\nv4_disp.dll
2012-02-10 04:10 . 2011-03-26 10:23 2292224 ----a-w- c:\windows\system32\nvapi.dll
2012-02-10 04:10 . 2011-03-26 10:23 17534976 ----a-w- c:\windows\system32\nvcompiler.dll
2012-02-10 04:10 . 2011-03-26 10:23 13415040 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
2012-02-10 03:04 . 2010-10-16 11:05 54272 ----a-w- c:\windows\system32\nvwddi.dll
2012-02-10 03:04 . 2010-10-16 11:05 164160 ----a-w- c:\windows\system32\nvsvc32.exe
2012-02-10 03:04 . 2010-10-16 11:05 143680 ----a-w- c:\windows\system32\nvcolor.exe
2012-02-10 03:04 . 2010-10-16 11:05 15494464 ----a-w- c:\windows\system32\nvcpl.dll
2012-02-10 03:04 . 2010-10-16 11:05 108352 ----a-w- c:\windows\system32\nvmctray.dll
2012-01-12 16:53 . 2008-04-13 23:00 1859968 ----a-w- c:\windows\system32\win32k.sys
2012-01-11 19:06 . 2012-02-16 07:50 3072 ------w- c:\windows\system32\iacenc.dll
2012-01-04 17:18 . 2011-08-04 16:13 1834688 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\VisualStudio\10.0\1033\ResourceCache.dll
2011-12-19 08:13 . 2008-04-14 03:42 1830912 ------w- c:\windows\system32\inetcpl.cpl
2011-12-19 08:13 . 2008-04-14 03:42 832512 ----a-w- c:\windows\system32\wininet.dll
2011-12-19 08:13 . 2008-04-14 03:41 78336 ----a-w- c:\windows\system32\ieencode.dll
2011-12-19 08:13 . 2008-04-14 03:41 17408 ----a-w- c:\windows\system32\corpol.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-04-18 17:25 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HDAudDeck"="c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe" [2010-05-24 33747360]
"Logitech Utility"="Logi_MwX.Exe" [2003-03-04 19968]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-04-18 3460784]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2012-02-10 15494464]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2012-02-10 108352]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AVer HID Receiver.lnk]
backup=c:\windows\pss\AVer HID Receiver.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AVerQuick.lnk]
backup=c:\windows\pss\AVerQuick.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^kundibal^Start Menu^Programs^Startup^Warkeys Update.lnk]
backup=c:\windows\pss\Warkeys Update.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5ServiceManager]
2010-02-22 03:57 406992 ----a-w- c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AutoStartNPSAgent]
2011-06-04 07:40 102400 ----a-w- c:\program files\Samsung\Samsung New PC Studio\NPSAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCSSync]
2010-03-13 13:54 91520 ----a-w- c:\program files\Microsoft Office\Office14\BCSSync.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2011-04-03 16:35 136176 ----atw- c:\documents and settings\kundibal\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
2012-02-28 16:38 1987976 ----a-w- c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
2012-01-13 13:53 460872 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 09:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SwitchBoard]
2010-02-19 12:37 517096 ----a-w- c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Samsung\\Samsung New PC Studio\\npsasvr.exe"=
"c:\\Program Files\\Samsung\\Samsung New PC Studio\\npsvsvr.exe"=
"e:\\Program Files\\Steam\\steamapps\\common\\poxnora\\LaunchPad.exe"=
"c:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE"=
"e:\\Program Files\\Steam\\steamapps\\steam210576\\condition zero\\hl.exe"=
"c:\\Program Files\\BitTorrent\\BitTorrent.exe"=
"e:\\Program Files\\Steam\\steamapps\\common\\dota 2 beta\\dota.exe"=
"e:\\Program Files\\Steam\\steamapps\\steam210576\\counter-strike\\hl.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3306:TCP"= 3306:TCP:mysql
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [26.3.2011 11:23 717296]
R3 hidusbf;USB Mouse Rate Adjuster Lower Filter by SweetLow;c:\windows\system32\drivers\hidusbf.sys [20.12.2011 19:47 4544]
S0 bjrvlvcn;bjrvlvcn;c:\windows\system32\drivers\pmvy.sys --> c:\windows\system32\drivers\pmvy.sys [?]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [10.5.2011 16:53 441176]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [10.5.2011 16:53 307288]
S1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [21.12.2010 14:04 115008]
S1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [21.12.2010 12:47 94872]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [10.5.2011 16:53 19544]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 12:16 130384]
S2 Dokan;Dokan;c:\windows\system32\drivers\dokan.sys [19.1.2012 17:09 84608]
S2 DokanMounter;DokanMounter;c:\program files\Capsa.cz\dokanLibrary0.5.3\mounter.exe [19.1.2012 17:09 22016]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [4.6.2011 8:27 233472]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [8.5.2011 10:36 652360]
S2 pgsql-8.3;PostgreSQL Database Server 8.3;"d:\db poker\bin\pg_ctl.exe" runservice -w -N "pgsql-8.3" -D "d:\db poker\data\" --> d:\db poker\bin\pg_ctl.exe [?]
S3 AVerAF15DMBTH;AVerMedia A850 USB;c:\windows\system32\drivers\AVerAF15DMBTH.sys [3.6.2011 19:54 569728]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [4.6.2011 8:27 36608]
S3 GGSAFERDriver;GGSAFER Driver;\??\e:\garena\safedrv.sys --> e:\garena\safedrv.sys [?]
S3 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [28.2.2012 17:38 1373576]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [8.5.2011 10:36 20464]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [27.12.2010 23:50 31124344]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [9.1.2010 21:37 4640000]
S3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\drivers\ss_bbus.sys [4.6.2011 8:28 90112]
S3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\drivers\ss_bmdfl.sys [4.6.2011 8:28 14976]
S3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\drivers\ss_bmdm.sys [4.6.2011 8:28 121856]
S3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [19.2.2010 13:37 517096]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [26.3.2011 11:24 2136224]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 12:16 753504]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\sqladhlp.exe [23.7.2009 4:08 47128]
S4 RsFx0103;RsFx0103 Driver;c:\windows\system32\drivers\RsFx0103.sys [30.3.2009 2:09 239336]
S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [30.3.2009 2:23 366936]
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - PARPORT
.
Obsah adresáře 'Naplánované úlohy'
.
2012-03-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-823518204-1035525444-725345543-1003Core.job
- c:\documents and settings\kundibal\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-04-03 16:35]
.
2012-03-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-823518204-1035525444-725345543-1003UA.job
- c:\documents and settings\kundibal\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-04-03 16:35]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://eu.ask.com/?l=dis&o=14672
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-03-18 08:00
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HDAudDeck = c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe 1????????????????????????????????????????????????
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-823518204-1035525444-725345543-1003\Software\SecuROM\License information*]
"datasecu"=hex:df,04,24,1a,58,25,42,a3,81,39,82,eb,7a,b7,cc,97,4d,0f,2a,04,f6,
e5,ca,c3,1d,77,58,57,25,c8,22,ec,13,4d,c2,59,dd,fd,e9,a2,24,b5,18,30,82,61,\
"rkeysecu"=hex:93,fb,26,f0,5f,97,92,2b,75,48,ee,0f,22,71,1c,c3
.
Celkový čas: 2012-03-18 08:04:37
ComboFix-quarantined-files.txt 2012-03-18 07:04
.
Před spuštěním: 1 591 140 352 bytes free
Po spuštění: 1 521 152 000 bytes free
.
- - End Of File - - C999DD0C08E5574C0BDD4CBD599CB6F0

spustil jsem TDSSkiller znovu a log stejný
08:15:00.0593 1912 TDSS rootkit removing tool 2.7.20.0 Mar 9 2012 17:10:43
08:15:00.0687 1912 ============================================================
08:15:00.0687 1912 Current date / time: 2012/03/18 08:15:00.0687
08:15:00.0687 1912 SystemInfo:
08:15:00.0687 1912
08:15:00.0687 1912 OS Version: 5.1.2600 ServicePack: 3.0
08:15:00.0687 1912 Product type: Workstation
08:15:00.0687 1912 ComputerName: BITCH
08:15:00.0687 1912 UserName: kundibal
08:15:00.0687 1912 Windows directory: C:\WINDOWS
08:15:00.0687 1912 System windows directory: C:\WINDOWS
08:15:00.0687 1912 Processor architecture: Intel x86
08:15:00.0687 1912 Number of processors: 2
08:15:00.0687 1912 Page size: 0x1000
08:15:00.0687 1912 Boot type: Normal boot
08:15:00.0687 1912 ============================================================
08:15:01.0843 1912 Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x97695, SectorsPerTrack: 0x3F, TracksPerCylinder: 0x10, Type 'K0', Flags 0x00000054
08:15:01.0859 1912 Drive \Device\Harddisk2\DR2 - Size: 0x12A1F16000 (74.53 Gb), SectorSize: 0x200, Cylinders: 0x2601, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
08:15:01.0859 1912 Drive \Device\Harddisk1\DR1 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
08:15:01.0859 1912 \Device\Harddisk0\DR0:
08:15:01.0875 1912 MBR used
08:15:01.0875 1912 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x2542E681
08:15:01.0875 1912 \Device\Harddisk2\DR2:
08:15:01.0875 1912 MBR used
08:15:01.0875 1912 \Device\Harddisk2\DR2\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x30D3C74
08:15:01.0890 1912 \Device\Harddisk2\DR2\Partition1: MBR, Type 0x7, StartLBA 0x30D3CF2, BlocksNum 0x643690E
08:15:01.0890 1912 \Device\Harddisk1\DR1:
08:15:01.0890 1912 MBR used
08:15:01.0890 1912 \Device\Harddisk1\DR1\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x2542D682
08:15:01.0984 1912 Initialize success
08:15:01.0984 1912 ============================================================
08:15:05.0906 2980 ============================================================
08:15:05.0906 2980 Scan started
08:15:05.0906 2980 Mode: Manual;
08:15:05.0906 2980 ============================================================
08:15:07.0031 2980 Aavmker4 (78a4db23bb4e8d4349e164d1d90af73f) C:\WINDOWS\system32\drivers\Aavmker4.sys
08:15:07.0031 2980 Aavmker4 - ok
08:15:07.0093 2980 Abiosdsk - ok
08:15:07.0125 2980 abp480n5 - ok
08:15:07.0171 2980 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
08:15:07.0171 2980 ACPI - ok
08:15:07.0218 2980 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
08:15:07.0218 2980 ACPIEC - ok
08:15:07.0250 2980 adpu160m - ok
08:15:07.0296 2980 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
08:15:07.0296 2980 aec - ok
08:15:07.0359 2980 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
08:15:07.0359 2980 AFD - ok
08:15:07.0390 2980 Aha154x - ok
08:15:07.0406 2980 aic78u2 - ok
08:15:07.0437 2980 aic78xx - ok
08:15:07.0453 2980 AliIde - ok
08:15:07.0468 2980 amsint - ok
08:15:07.0562 2980 AR5211 (3cb8e72b7c9887b42b90000e8cb1e7be) C:\WINDOWS\system32\DRIVERS\ar5211.sys
08:15:07.0562 2980 AR5211 - ok
08:15:07.0578 2980 asc - ok
08:15:07.0609 2980 asc3350p - ok
08:15:07.0640 2980 asc3550 - ok
08:15:07.0671 2980 aswFsBlk (9bdb29e81abceb883556df44649696c4) C:\WINDOWS\system32\drivers\aswFsBlk.sys
08:15:07.0671 2980 aswFsBlk - ok
08:15:07.0703 2980 aswMon2 (2ce6da466687cbb3b97e59f8831a27cb) C:\WINDOWS\system32\drivers\aswMon2.sys
08:15:07.0703 2980 aswMon2 - ok
08:15:07.0734 2980 aswRdr (a90cf680ca7a323913ca3a0810c8e02d) C:\WINDOWS\system32\drivers\aswRdr.sys
08:15:07.0734 2980 aswRdr - ok
08:15:07.0781 2980 aswSnx (f7969934cca2e566e95df17380a3cb11) C:\WINDOWS\system32\drivers\aswSnx.sys
08:15:07.0781 2980 aswSnx - ok
08:15:07.0828 2980 aswSP (478d6a0e0630c31bf4a7f5eb0a05b92c) C:\WINDOWS\system32\drivers\aswSP.sys
08:15:07.0828 2980 aswSP - ok
08:15:07.0859 2980 aswTdi (e52e45743e27fd6184c55618a10b81ab) C:\WINDOWS\system32\drivers\aswTdi.sys
08:15:07.0859 2980 aswTdi - ok
08:15:07.0921 2980 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
08:15:07.0921 2980 AsyncMac - ok
08:15:07.0953 2980 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
08:15:07.0953 2980 atapi - ok
08:15:07.0984 2980 Atdisk - ok
08:15:08.0031 2980 atksgt (f9c24d25d9ff29f894995a64812b4d85) C:\WINDOWS\system32\DRIVERS\atksgt.sys
08:15:08.0046 2980 atksgt - ok
08:15:08.0078 2980 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
08:15:08.0078 2980 Atmarpc - ok
08:15:08.0125 2980 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
08:15:08.0125 2980 audstub - ok
08:15:08.0203 2980 AVerAF15DMBTH (3e851cc6db0c07a8cc640fd03eb6fdae) C:\WINDOWS\system32\Drivers\AVerAF15DMBTH.sys
08:15:08.0203 2980 AVerAF15DMBTH - ok
08:15:08.0218 2980 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
08:15:08.0218 2980 Beep - ok
08:15:08.0250 2980 bjrvlvcn - ok
08:15:08.0328 2980 catchme - ok
08:15:08.0359 2980 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
08:15:08.0359 2980 cbidf2k - ok
08:15:08.0406 2980 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
08:15:08.0406 2980 CCDECODE - ok
08:15:08.0421 2980 cd20xrnt - ok
08:15:08.0453 2980 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
08:15:08.0453 2980 Cdaudio - ok
08:15:08.0484 2980 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
08:15:08.0484 2980 Cdfs - ok
08:15:08.0484 2980 Scan interrupted by user!
08:15:08.0484 2980 Scan interrupted by user!
08:15:08.0484 2980 Scan interrupted by user!
08:15:08.0484 2980 ============================================================
08:15:08.0484 2980 Scan finished
08:15:08.0484 2980 ============================================================
08:15:08.0484 2972 Detected object count: 0
08:15:08.0484 2972 Actual detected object count: 0
08:15:08.0921 2840 ============================================================
08:15:08.0921 2840 Scan started
08:15:08.0921 2840 Mode: Manual; SigCheck; TDLFS;
08:15:08.0921 2840 ============================================================
08:15:09.0156 2840 Aavmker4 (78a4db23bb4e8d4349e164d1d90af73f) C:\WINDOWS\system32\drivers\Aavmker4.sys
08:15:09.0250 2840 Aavmker4 - ok
08:15:09.0281 2840 Abiosdsk - ok
08:15:09.0312 2840 abp480n5 - ok
08:15:09.0359 2840 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
08:15:09.0468 2840 ACPI - ok
08:15:09.0515 2840 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
08:15:09.0625 2840 ACPIEC - ok
08:15:09.0640 2840 adpu160m - ok
08:15:09.0703 2840 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
08:15:09.0812 2840 aec - ok
08:15:09.0859 2840 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
08:15:09.0875 2840 AFD - ok
08:15:09.0906 2840 Aha154x - ok
08:15:09.0921 2840 aic78u2 - ok
08:15:09.0953 2840 aic78xx - ok
08:15:09.0984 2840 AliIde - ok
08:15:10.0000 2840 amsint - ok
08:15:10.0062 2840 AR5211 (3cb8e72b7c9887b42b90000e8cb1e7be) C:\WINDOWS\system32\DRIVERS\ar5211.sys
08:15:10.0078 2840 AR5211 ( UnsignedFile.Multi.Generic ) - warning
08:15:10.0078 2840 AR5211 - detected UnsignedFile.Multi.Generic (1)
08:15:10.0109 2840 asc - ok
08:15:10.0125 2840 asc3350p - ok
08:15:10.0156 2840 asc3550 - ok
08:15:10.0234 2840 aswFsBlk (9bdb29e81abceb883556df44649696c4) C:\WINDOWS\system32\drivers\aswFsBlk.sys
08:15:10.0250 2840 aswFsBlk - ok
08:15:10.0281 2840 aswMon2 (2ce6da466687cbb3b97e59f8831a27cb) C:\WINDOWS\system32\drivers\aswMon2.sys
08:15:10.0296 2840 aswMon2 - ok
08:15:10.0312 2840 aswRdr (a90cf680ca7a323913ca3a0810c8e02d) C:\WINDOWS\system32\drivers\aswRdr.sys
08:15:10.0328 2840 aswRdr - ok
08:15:10.0359 2840 aswSnx (f7969934cca2e566e95df17380a3cb11) C:\WINDOWS\system32\drivers\aswSnx.sys
08:15:10.0375 2840 aswSnx - ok
08:15:10.0421 2840 aswSP (478d6a0e0630c31bf4a7f5eb0a05b92c) C:\WINDOWS\system32\drivers\aswSP.sys
08:15:10.0437 2840 aswSP - ok
08:15:10.0468 2840 aswTdi (e52e45743e27fd6184c55618a10b81ab) C:\WINDOWS\system32\drivers\aswTdi.sys
08:15:10.0484 2840 aswTdi - ok
08:15:10.0515 2840 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
08:15:10.0640 2840 AsyncMac - ok
08:15:10.0671 2840 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
08:15:10.0796 2840 atapi - ok
08:15:10.0828 2840 Atdisk - ok
08:15:10.0890 2840 atksgt (f9c24d25d9ff29f894995a64812b4d85) C:\WINDOWS\system32\DRIVERS\atksgt.sys
08:15:10.0906 2840 atksgt - ok
08:15:10.0937 2840 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
08:15:11.0062 2840 Atmarpc - ok
08:15:11.0109 2840 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
08:15:11.0234 2840 audstub - ok
08:15:11.0312 2840 AVerAF15DMBTH (3e851cc6db0c07a8cc640fd03eb6fdae) C:\WINDOWS\system32\Drivers\AVerAF15DMBTH.sys
08:15:11.0343 2840 AVerAF15DMBTH ( UnsignedFile.Multi.Generic ) - warning
08:15:11.0343 2840 AVerAF15DMBTH - detected UnsignedFile.Multi.Generic (1)
08:15:11.0375 2840 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
08:15:11.0500 2840 Beep - ok
08:15:11.0531 2840 bjrvlvcn - ok
08:15:11.0609 2840 catchme - ok
08:15:11.0656 2840 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
08:15:11.0781 2840 cbidf2k - ok
08:15:11.0843 2840 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
08:15:11.0968 2840 CCDECODE - ok
08:15:12.0000 2840 cd20xrnt - ok
08:15:12.0031 2840 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
08:15:12.0140 2840 Cdaudio - ok
08:15:12.0203 2840 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
08:15:12.0328 2840 Cdfs - ok
08:15:12.0390 2840 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
08:15:12.0515 2840 Cdrom - ok
08:15:12.0531 2840 Changer - ok
08:15:12.0562 2840 CmdIde - ok
08:15:12.0593 2840 Cpqarray - ok
08:15:12.0609 2840 dac2w2k - ok
08:15:12.0625 2840 dac960nt - ok
08:15:12.0640 2840 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
08:15:12.0796 2840 Disk - ok
08:15:12.0843 2840 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
08:15:12.0968 2840 dmboot - ok
08:15:13.0015 2840 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
08:15:13.0140 2840 dmio - ok
08:15:13.0171 2840 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
08:15:13.0296 2840 dmload - ok
08:15:13.0359 2840 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
08:15:13.0484 2840 DMusic - ok
08:15:13.0515 2840 Dokan (bf94acf77e2c7458d91d0bef8718eece) C:\WINDOWS\system32\drivers\dokan.sys
08:15:13.0531 2840 Dokan ( UnsignedFile.Multi.Generic ) - warning
08:15:13.0531 2840 Dokan - detected UnsignedFile.Multi.Generic (1)
08:15:13.0562 2840 dpti2o - ok
08:15:13.0609 2840 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
08:15:13.0734 2840 drmkaud - ok
08:15:13.0765 2840 dsNcAdpt - ok
08:15:13.0796 2840 eamon (d42dd9021acd47683b33adf21bca49aa) C:\WINDOWS\system32\DRIVERS\eamon.sys
08:15:13.0812 2840 eamon - ok
08:15:13.0859 2840 ehdrv (fe7824239d132ad9ebd8645fe1199b30) C:\WINDOWS\system32\DRIVERS\ehdrv.sys
08:15:13.0859 2840 ehdrv - ok
08:15:13.0890 2840 epfwtdir (aa0667eb9a92414abb784c101a6c7fec) C:\WINDOWS\system32\DRIVERS\epfwtdir.sys
08:15:13.0906 2840 epfwtdir - ok
08:15:13.0953 2840 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
08:15:14.0093 2840 Fastfat - ok
08:15:14.0125 2840 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
08:15:14.0250 2840 Fdc - ok
08:15:14.0281 2840 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
08:15:14.0406 2840 Fips - ok
08:15:14.0437 2840 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
08:15:14.0562 2840 Flpydisk - ok
08:15:14.0609 2840 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
08:15:14.0718 2840 FltMgr - ok
08:15:14.0765 2840 FsUsbExDisk (790a4ca68f44be35967b3df61f3e4675) C:\WINDOWS\system32\FsUsbExDisk.SYS
08:15:14.0765 2840 FsUsbExDisk ( UnsignedFile.Multi.Generic ) - warning
08:15:14.0765 2840 FsUsbExDisk - detected UnsignedFile.Multi.Generic (1)
08:15:14.0843 2840 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
08:15:14.0968 2840 Fs_Rec - ok
08:15:15.0015 2840 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
08:15:15.0140 2840 Ftdisk - ok
08:15:15.0156 2840 GGSAFERDriver - ok
08:15:15.0187 2840 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
08:15:15.0312 2840 Gpc - ok
08:15:15.0359 2840 hamachi (833051c6c6c42117191935f734cfbd97) C:\WINDOWS\system32\DRIVERS\hamachi.sys
08:15:15.0375 2840 hamachi - ok
08:15:15.0421 2840 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
08:15:15.0546 2840 HDAudBus - ok
08:15:15.0593 2840 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
08:15:15.0718 2840 hidusb - ok
08:15:15.0750 2840 hidusbf (34f0823be25aed4992fd9fcf587f50d5) C:\WINDOWS\system32\DRIVERS\hidusbf.sys
08:15:15.0750 2840 hidusbf ( UnsignedFile.Multi.Generic ) - warning
08:15:15.0750 2840 hidusbf - detected UnsignedFile.Multi.Generic (1)
08:15:15.0781 2840 hpn - ok
08:15:15.0828 2840 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
08:15:15.0843 2840 HTTP - ok
08:15:15.0875 2840 i2omgmt - ok
08:15:15.0921 2840 i2omp - ok
08:15:15.0953 2840 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
08:15:16.0062 2840 i8042prt - ok
08:15:16.0093 2840 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
08:15:16.0234 2840 Imapi - ok
08:15:16.0250 2840 ini910u - ok
08:15:16.0265 2840 IntelIde - ok
08:15:16.0312 2840 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
08:15:16.0437 2840 Ip6Fw - ok
08:15:16.0484 2840 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
08:15:16.0593 2840 IpFilterDriver - ok
08:15:16.0625 2840 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
08:15:16.0734 2840 IpInIp - ok
08:15:16.0765 2840 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
08:15:16.0890 2840 IpNat - ok
08:15:16.0906 2840 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
08:15:17.0046 2840 IPSec - ok
08:15:17.0093 2840 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
08:15:17.0156 2840 IRENUM - ok
08:15:17.0218 2840 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
08:15:17.0328 2840 isapnp - ok
08:15:17.0390 2840 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
08:15:17.0500 2840 Kbdclass - ok
08:15:17.0562 2840 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
08:15:17.0687 2840 kmixer - ok
08:15:17.0734 2840 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
08:15:17.0750 2840 KSecDD - ok
08:15:17.0796 2840 L1e (101457d884e3dd4636baefb9b7e7d3f3) C:\WINDOWS\system32\DRIVERS\l1e51x86.sys
08:15:17.0812 2840 L1e - ok
08:15:17.0843 2840 lbrtfdc - ok
08:15:17.0906 2840 LHidFlt2 (63b00a26f62572e0d58e6c8d3b32bf59) C:\WINDOWS\system32\DRIVERS\LHidFlt2.Sys
08:15:17.0921 2840 LHidFlt2 - ok
08:15:17.0968 2840 LHidUsb (ac05a1b5c66d693b1598fd83617d1820) C:\WINDOWS\system32\Drivers\LHidUsb.Sys
08:15:17.0968 2840 LHidUsb - ok
08:15:18.0000 2840 lirsgt (8ccf9ed46d52af1375875f74a91ffacf) C:\WINDOWS\system32\DRIVERS\lirsgt.sys
08:15:18.0015 2840 lirsgt - ok
08:15:18.0078 2840 LMouFlt2 (03abef1a29addc98c32ed0f336b98e90) C:\WINDOWS\system32\DRIVERS\LMouFlt2.Sys
08:15:18.0109 2840 LMouFlt2 - ok
08:15:18.0156 2840 MBAMProtector (b7ca8cc3f978201856b6ab82f40953c3) C:\WINDOWS\system32\drivers\mbam.sys
08:15:18.0156 2840 MBAMProtector - ok
08:15:18.0218 2840 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
08:15:18.0343 2840 mnmdd - ok
08:15:18.0390 2840 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
08:15:18.0515 2840 Modem - ok
08:15:18.0593 2840 monfilt (9fa7207d1b1adead88ae8eed9cdbbaa5) C:\WINDOWS\system32\drivers\monfilt.sys
08:15:18.0671 2840 monfilt - ok
08:15:18.0718 2840 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
08:15:18.0828 2840 Mouclass - ok
08:15:18.0859 2840 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
08:15:18.0984 2840 mouhid - ok
08:15:19.0000 2840 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
08:15:19.0109 2840 MountMgr - ok
08:15:19.0187 2840 MPE (c0f8e0c2c3c0437cf37c6781896dc3ec) C:\WINDOWS\system32\DRIVERS\MPE.sys
08:15:19.0296 2840 MPE - ok
08:15:19.0328 2840 mraid35x - ok
08:15:19.0359 2840 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
08:15:19.0500 2840 MRxDAV - ok
08:15:19.0546 2840 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
08:15:19.0593 2840 MRxSmb - ok
08:15:19.0609 2840 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
08:15:19.0750 2840 Msfs - ok
08:15:19.0796 2840 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
08:15:19.0921 2840 MSKSSRV - ok
08:15:19.0968 2840 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
08:15:20.0078 2840 MSPCLOCK - ok
08:15:20.0109 2840 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
08:15:20.0234 2840 MSPQM - ok
08:15:20.0281 2840 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
08:15:20.0390 2840 mssmbios - ok
08:15:20.0453 2840 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
08:15:20.0578 2840 MSTEE - ok
08:15:20.0609 2840 MTsensor (d48659bb24c48345d926ecb45c1ebdf5) C:\WINDOWS\system32\DRIVERS\ASACPI.sys
08:15:20.0625 2840 MTsensor - ok
08:15:20.0656 2840 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
08:15:20.0671 2840 Mup - ok
08:15:20.0703 2840 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
08:15:20.0828 2840 NABTSFEC - ok
08:15:20.0875 2840 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
08:15:21.0000 2840 NDIS - ok
08:15:21.0031 2840 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
08:15:21.0140 2840 NdisIP - ok
08:15:21.0187 2840 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
08:15:21.0187 2840 NdisTapi - ok
08:15:21.0234 2840 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
08:15:21.0390 2840 Ndisuio - ok
08:15:21.0421 2840 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
08:15:21.0531 2840 NdisWan - ok
08:15:21.0578 2840 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
08:15:21.0578 2840 NDProxy - ok
08:15:21.0625 2840 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
08:15:21.0734 2840 NetBIOS - ok
08:15:21.0765 2840 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
08:15:21.0875 2840 NetBT - ok
08:15:21.0906 2840 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
08:15:22.0015 2840 Npfs - ok
08:15:22.0093 2840 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
08:15:22.0218 2840 Ntfs - ok
08:15:22.0265 2840 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
08:15:22.0390 2840 Null - ok
08:15:22.0765 2840 nv (0dc79b60cedc3a8854c27b3c6e4b3414) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
08:15:23.0093 2840 nv - ok
08:15:23.0171 2840 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
08:15:23.0281 2840 NwlnkFlt - ok
08:15:23.0312 2840 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
08:15:23.0437 2840 NwlnkFwd - ok
08:15:23.0515 2840 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\drivers\Parport.sys
08:15:23.0625 2840 Parport - ok
08:15:23.0656 2840 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
08:15:23.0781 2840 PartMgr - ok
08:15:23.0828 2840 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
08:15:23.0937 2840 ParVdm - ok
08:15:23.0984 2840 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
08:15:24.0093 2840 PCI - ok
08:15:24.0125 2840 PCIDump - ok
08:15:24.0156 2840 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
08:15:24.0281 2840 PCIIde - ok
08:15:24.0328 2840 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
08:15:24.0453 2840 Pcmcia - ok
08:15:24.0468 2840 PDCOMP - ok
08:15:24.0500 2840 PDFRAME - ok
08:15:24.0515 2840 PDRELI - ok
08:15:24.0546 2840 PDRFRAME - ok
08:15:24.0562 2840 perc2 - ok
08:15:24.0593 2840 perc2hib - ok
08:15:24.0640 2840 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
08:15:24.0750 2840 PptpMiniport - ok
08:15:24.0796 2840 Processor (a32bebaf723557681bfc6bd93e98bd26) C:\WINDOWS\system32\DRIVERS\processr.sys
08:15:24.0921 2840 Processor - ok
08:15:24.0953 2840 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
08:15:25.0062 2840 PSched - ok
08:15:25.0093 2840 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
08:15:25.0203 2840 Ptilink - ok
08:15:25.0250 2840 PxHelp20 (40fedd328f98245ad201cf5f9f311724) C:\WINDOWS\system32\Drivers\PxHelp20.sys
08:15:25.0265 2840 PxHelp20 - ok
08:15:25.0281 2840 ql1080 - ok
08:15:25.0312 2840 Ql10wnt - ok
08:15:25.0328 2840 ql12160 - ok
08:15:25.0359 2840 ql1240 - ok
08:15:25.0390 2840 ql1280 - ok
08:15:25.0390 2840 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
08:15:25.0531 2840 RasAcd - ok
08:15:25.0546 2840 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
08:15:25.0671 2840 Rasl2tp - ok
08:15:25.0703 2840 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
08:15:25.0812 2840 RasPppoe - ok
08:15:25.0828 2840 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
08:15:25.0953 2840 Raspti - ok
08:15:25.0984 2840 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
08:15:26.0093 2840 Rdbss - ok
08:15:26.0109 2840 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
08:15:26.0234 2840 RDPCDD - ok
08:15:26.0281 2840 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
08:15:26.0390 2840 rdpdr - ok
08:15:26.0437 2840 RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
08:15:26.0453 2840 RDPWD - ok
08:15:26.0468 2840 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
08:15:26.0625 2840 redbook - ok
08:15:26.0671 2840 RsFx0103 (fd692c6ffade58f7c4c3c3c9a0ec35bd) C:\WINDOWS\system32\DRIVERS\RsFx0103.sys
08:15:26.0687 2840 RsFx0103 - ok
08:15:26.0750 2840 rtl8139 (d507c1400284176573224903819ffda3) C:\WINDOWS\system32\DRIVERS\RTL8139.SYS
08:15:26.0859 2840 rtl8139 - ok
08:15:26.0906 2840 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
08:15:26.0953 2840 Secdrv - ok
08:15:27.0000 2840 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
08:15:27.0109 2840 serenum - ok
08:15:27.0125 2840 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys
08:15:27.0250 2840 Serial - ok
08:15:27.0296 2840 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
08:15:27.0406 2840 Sfloppy - ok
08:15:27.0437 2840 Simbad - ok
08:15:27.0484 2840 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
08:15:27.0593 2840 SLIP - ok
08:15:27.0609 2840 Sparrow - ok
08:15:27.0687 2840 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
08:15:27.0796 2840 splitter - ok
08:15:27.0859 2840 sptd (71e276f6d189413266ea22171806597b) C:\WINDOWS\system32\Drivers\sptd.sys
08:15:27.0859 2840 Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: 71e276f6d189413266ea22171806597b
08:15:27.0859 2840 sptd ( LockedFile.Multi.Generic ) - warning
08:15:27.0859 2840 sptd - detected LockedFile.Multi.Generic (1)
08:15:27.0906 2840 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
08:15:27.0953 2840 sr - ok
08:15:28.0000 2840 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
08:15:28.0031 2840 Srv - ok
08:15:28.0093 2840 ss_bbus (eaa66218cd39f5bb1b4853a78c67c787) C:\WINDOWS\system32\DRIVERS\ss_bbus.sys
08:15:28.0109 2840 ss_bbus - ok
08:15:28.0156 2840 ss_bmdfl (91765f99914ed8693d8bc76524f21581) C:\WINDOWS\system32\DRIVERS\ss_bmdfl.sys
08:15:28.0156 2840 ss_bmdfl - ok
08:15:28.0203 2840 ss_bmdm (840e7b738b03c10ee91d9b7d3d6eff15) C:\WINDOWS\system32\DRIVERS\ss_bmdm.sys
08:15:28.0218 2840 ss_bmdm - ok
08:15:28.0265 2840 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
08:15:28.0375 2840 streamip - ok
08:15:28.0437 2840 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
08:15:28.0546 2840 swenum - ok
08:15:28.0609 2840 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
08:15:28.0703 2840 swmidi - ok
08:15:28.0750 2840 symc810 - ok
08:15:28.0765 2840 symc8xx - ok
08:15:28.0796 2840 sym_hi - ok
08:15:28.0812 2840 sym_u3 - ok
08:15:28.0859 2840 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
08:15:28.0984 2840 sysaudio - ok
08:15:29.0046 2840 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
08:15:29.0062 2840 Tcpip - ok
08:15:29.0125 2840 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
08:15:29.0234 2840 TDPIPE - ok
08:15:29.0265 2840 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
08:15:29.0375 2840 TDTCP - ok
08:15:29.0437 2840 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
08:15:29.0531 2840 TermDD - ok
08:15:29.0562 2840 TosIde - ok
08:15:29.0625 2840 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
08:15:29.0718 2840 Udfs - ok
08:15:29.0734 2840 ultra - ok
08:15:29.0828 2840 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
08:15:29.0953 2840 Update - ok
08:15:30.0000 2840 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
08:15:30.0109 2840 usbccgp - ok
08:15:30.0171 2840 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
08:15:30.0281 2840 usbehci - ok
08:15:30.0312 2840 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
08:15:30.0421 2840 usbhub - ok
08:15:30.0453 2840 usbohci (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys
08:15:30.0546 2840 usbohci - ok
08:15:30.0593 2840 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
08:15:30.0718 2840 USBSTOR - ok
08:15:30.0765 2840 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
08:15:30.0859 2840 VgaSave - ok
08:15:30.0984 2840 VIAHdAudAddService (cbc1ce0a1fce0deed4f6f093be91d132) C:\WINDOWS\system32\drivers\viahduaa.sys
08:15:31.0046 2840 VIAHdAudAddService - ok
08:15:31.0078 2840 ViaIde - ok
08:15:31.0109 2840 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
08:15:31.0218 2840 VolSnap - ok
08:15:31.0265 2840 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
08:15:31.0375 2840 Wanarp - ok
08:15:31.0390 2840 WDICA - ok
08:15:31.0453 2840 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
08:15:31.0562 2840 wdmaud - ok
08:15:31.0609 2840 WmiAcpi (c42584fd66ce9e17403aebca199f7bdb) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
08:15:31.0718 2840 WmiAcpi - ok
08:15:31.0781 2840 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
08:15:31.0890 2840 WS2IFSL - ok
08:15:31.0906 2840 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
08:15:32.0046 2840 WSTCODEC - ok
08:15:32.0093 2840 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
08:15:32.0109 2840 WudfPf - ok
08:15:32.0140 2840 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
08:15:32.0156 2840 WudfRd - ok
08:15:32.0171 2840 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0
08:15:32.0218 2840 \Device\Harddisk0\DR0 - ok
08:15:32.0234 2840 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk2\DR2
08:15:32.0406 2840 \Device\Harddisk2\DR2 ( TDSS File System ) - warning
08:15:32.0406 2840 \Device\Harddisk2\DR2 - detected TDSS File System (1)
08:15:32.0406 2840 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk1\DR1
08:15:32.0437 2840 \Device\Harddisk1\DR1 - ok
08:15:32.0437 2840 Boot (0x1200) (57a5dc99b56e9005f2431a948e997904) \Device\Harddisk0\DR0\Partition0
08:15:32.0437 2840 \Device\Harddisk0\DR0\Partition0 - ok
08:15:32.0437 2840 Boot (0x1200) (8b1ec730cb92ce601529b2b77ef94f2e) \Device\Harddisk2\DR2\Partition0
08:15:32.0437 2840 \Device\Harddisk2\DR2\Partition0 - ok
08:15:32.0468 2840 Boot (0x1200) (be9dcdf9482ad37e6e4e0c93eece7738) \Device\Harddisk2\DR2\Partition1
08:15:32.0468 2840 \Device\Harddisk2\DR2\Partition1 - ok
08:15:32.0468 2840 Boot (0x1200) (67643b5bd28842b200c744127f5afd21) \Device\Harddisk1\DR1\Partition0
08:15:32.0468 2840 \Device\Harddisk1\DR1\Partition0 - ok
08:15:32.0468 2840 ============================================================
08:15:32.0468 2840 Scan finished
08:15:32.0468 2840 ============================================================
08:15:32.0578 3056 Detected object count: 7
08:15:32.0578 3056 Actual detected object count: 7
08:15:36.0640 3056 AR5211 ( UnsignedFile.Multi.Generic ) - skipped by user
08:15:36.0640 3056 AR5211 ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:15:36.0640 3056 AVerAF15DMBTH ( UnsignedFile.Multi.Generic ) - skipped by user
08:15:36.0640 3056 AVerAF15DMBTH ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:15:36.0640 3056 Dokan ( UnsignedFile.Multi.Generic ) - skipped by user
08:15:36.0640 3056 Dokan ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:15:36.0640 3056 FsUsbExDisk ( UnsignedFile.Multi.Generic ) - skipped by user
08:15:36.0640 3056 FsUsbExDisk ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:15:36.0656 3056 hidusbf ( UnsignedFile.Multi.Generic ) - skipped by user
08:15:36.0656 3056 hidusbf ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:15:36.0656 3056 sptd ( LockedFile.Multi.Generic ) - skipped by user
08:15:36.0656 3056 sptd ( LockedFile.Multi.Generic ) - User select action: Skip
08:15:36.0656 3056 \Device\Harddisk2\DR2 ( TDSS File System ) - skipped by user
08:15:36.0656 3056 \Device\Harddisk2\DR2 ( TDSS File System ) - User select action: Skip

#12 Příspěvek od **motji** » 19 bře 2012 06:21

Spusťte znovu RogueKiller.
Omlouvám se za pozdní reakce, dnes odpoledne nebo večer už tu budu.
Bsod způsobuje asi driver od combofixu

WIAL · #13 Příspěvek od **WIAL** » 19 bře 2012 17:12

Spustil jsem hned po combofixu, viz předchozí příspěvek, ale spustím znovu

Mám dát skip u TDSS nebo Delete(nevím presne ted co je uvedeno za volbu).
Díky

#14 Příspěvek od **motji** » 19 bře 2012 18:27

Ne, já myslela tento program

vyosek píše: Stahnete RogueKiller http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe
Ukoncete vsechny programy

Pokud pouzivate Win Vista ci W7, kliknete na RogueKiller pravym a dejte Run As Administrator ci Spustit jako spravce

Pockejte na dokonceni PreScanu

Zvolte moznost Prohledat (scan)

Po dokonceni skenu kliknete na Zpráva (Report)- otevre se log, ten sem vlozte

[/quote]

WIAL · #15 Příspěvek od **WIAL** » 19 bře 2012 20:30

RogueKiller V7.3.1 [03/10/2012] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.geekstogo.com/forum/files/fi ... guekiller/
Blog: http://tigzyrk.blogspot.com

Operating System: Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User: kundibal [Admin rights]
Mode: Scan -- Date: 03/19/2012 20:29:20

¤¤¤ Bad processes: 0 ¤¤¤

¤¤¤ Registry Entries: 3 ¤¤¤
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ] HKCU\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver: [LOADED] ¤¤¤
IRP[IRP_MJ_CREATE] : Unknown -> HOOKED ([MAJOR] atapi.sys @ 0xB7DFCB40)
IRP[IRP_MJ_CLOSE] : Unknown -> HOOKED ([MAJOR] atapi.sys @ 0xB7DFCB40)
IRP[IRP_MJ_DEVICE_CONTROL] : Unknown -> HOOKED ([MAJOR] atapi.sys @ 0xB7DFCB40)
IRP[IRP_MJ_INTERNAL_DEVICE_CONTROL] : Unknown -> HOOKED ([MAJOR] atapi.sys @ 0xB7DFCB40)
IRP[IRP_MJ_SYSTEM_CONTROL] : Unknown -> HOOKED ([MAJOR] atapi.sys @ 0xB7DFCB40)
IRP[IRP_MJ_DEVICE_CHANGE] : Unknown -> HOOKED ([MAJOR] atapi.sys @ 0xB7DFCB40)

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
127.0.0.1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: ST3320620AS +++++
--- User ---
[MBR] 0d5042f8689668c196c7fe6e7c8de20d
[BSP] d19af4eddeca007fdce9913b4d3d5b5b : Windows XP MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 305244 Mo
User = LL1 ... OK!
User = LL2 ... OK!

+++++ PhysicalDrive1: WDC WD3200JS-63PDB1 +++++
--- User ---
[MBR] 4afb9005cffff188ea60da997fd1bdf9
[BSP] 271139afabcce979652f030bac56718c : Windows XP MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 305242 Mo
User = LL1 ... OK!
User = LL2 ... OK!

+++++ PhysicalDrive2: WDC WD800JB-00ETA0 +++++
--- User ---
[MBR] feae3003caf1d816bac254095d89c2b1
[BSP] 8e32c701c58ec603a3c76f06986da3a8 : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 24999 Mo
1 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 51199155 | Size: 51309 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[2].txt >>
RKreport[1].txt ; RKreport[2].txt

VIRY.CZ

Vypínání/zapínání PC. Sekání při datovém přenosu?

Vypínání/zapínání PC. Sekání při datovém přenosu?

Re: Vypínání/zapínání PC. Sekání při datovém přenosu?

Re: Vypínání/zapínání PC. Sekání při datovém přenosu?

Re: Vypínání/zapínání PC. Sekání při datovém přenosu?

Re: Vypínání/zapínání PC. Sekání při datovém přenosu?

Re: Vypínání/zapínání PC. Sekání při datovém přenosu?

Re: Vypínání/zapínání PC. Sekání při datovém přenosu?

Re: Vypínání/zapínání PC. Sekání při datovém přenosu?

Re: Vypínání/zapínání PC. Sekání při datovém přenosu?

Re: Vypínání/zapínání PC. Sekání při datovém přenosu?

Re: Vypínání/zapínání PC. Sekání při datovém přenosu?

Re: Vypínání/zapínání PC. Sekání při datovém přenosu?

Re: Vypínání/zapínání PC. Sekání při datovém přenosu?

Re: Vypínání/zapínání PC. Sekání při datovém přenosu?

Re: Vypínání/zapínání PC. Sekání při datovém přenosu?