Dobrý den, mám stejný problém, jako kolega filmar_8. Chtěl bych se zeptat, jestli ho můžu řešit stejně, jak je popsáno výše, nebo mám použít jiný postup.
Děkuji
log z RSIT:
Logfile of random's system information tool 1.09 (written by random/random)
Run by Jan at 2012-04-02 11:43:33
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 12 GB (21%) free of 57 GB
Total RAM: 8099 MB (65% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:43:39, on 2.4.2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal
Running processes:
C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe
C:\Program Files (x86)\pdfconverter.com\FreePDF Creator\itFPCPrnDisp.exe
C:\Program Files (x86)\Windows Sidebar\sidebar.exe
C:\Program Files (x86)\WinSplit Revolution\WinSplit.exe
C:\Program Files (x86)\QIP 2010\qip.exe
C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe
C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe
C:\Program Files (x86)\SnugTV\SnugTV Station\QuickStart.exe
C:\Program Files (x86)\ROCCAT\Kova[+] Mouse\Kova[+]Monitor.exe
C:\Program Files (x86)\WinSplit Revolution\WinSplitDrvr32.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_2_202_228_ActiveX.exe
C:\Program Files\trend micro\Jan.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: SearchHook Class - {BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\AddressBarSearch.dll
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
O2 - BHO: IESpeakDoc - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [BCU] "C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe"
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [RoccatKova+] "C:\Program Files (x86)\ROCCAT\Kova[+] Mouse\Kova[+]Monitor.EXE"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware (cleanup)] rundll32.exe "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScript
O4 - HKCU\..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Winsplit] C:\Program Files (x86)\WinSplit Revolution\WinSplit.exe
O4 - HKCU\..\Run: [Infium] "C:\Program Files (x86)\QIP 2010\qip.exe" /autorun
O4 - HKCU\..\Run: [PCSpeedUp] C:\Program Files (x86)\Zrychleni Pocitace\PCSpeedUp.lnk
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: AVer HID Receiver.lnk = C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe
O4 - Global Startup: AVerQuick.lnk = C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe
O4 - Global Startup: SnugTV Quick Start.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~1\MICROS~1\Office14\ONBttnIE.dll/105
O8 - Extra context menu item: Převést cíl vazby do Adobe PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Převést do Adobe PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Připojit cíl vazby k existujícímu PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Připojit k existujícímu PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: (no name) - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
O9 - Extra 'Tools' menuitem: Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AtherosSvc - Atheros Commnucations - C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
O23 - Service: Autodesk Content Service - Unknown owner - C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
O23 - Service: AVerRemote - AVerMedia - C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe
O23 - Service: AVerScheduleService - Unknown owner - C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe
O23 - Service: AVerUpdateServer - AVerMedia TECHNOLOGIES, Inc. - C:\Program Files (x86)\AVerMedia\AVerUpdate\AVerUpdateServer.exe
O23 - Service: Browser Configuration Utility Service (BCUService) - DeviceVM, Inc. - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\Windows\SysWow64\IntelCpHeciSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service 64 - Flexera Software, Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: Intel® PROSet Monitoring Service - Unknown owner - C:\Windows\system32\IProsetMonitor.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Internet Pass-Through Service (PassThru Service) - Unknown owner - C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: SnugTV Service - AVerMedia Technologies, Inc. - C:\Program Files (x86)\SnugTV\SnugTV Station\AMAServer.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
--
End of file - 11794 bytes
======Listing Processes======
\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
winlogon.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"taskhost.exe"
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files (x86)\Bluetooth Suite\adminservice.exe"
"C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe"
"C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe"
"C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe"
"C:\Program Files (x86)\AVerMedia\AVerUpdate\AVerUpdateServer.exe"
"C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe"
"C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe"
"C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe"
C:\Windows\system32\IProsetMonitor.exe
"C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe"
"C:\Program Files (x86)\SnugTV\SnugTV Station\AMAServer.exe"
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe"
"C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe"
"C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
"C:\Program Files (x86)\pdfconverter.com\FreePDF Creator\itFPCPrnDisp.exe"
"C:\Windows\System32\igfxtray.exe"
"C:\Windows\System32\hkcmd.exe"
"C:\Windows\System32\igfxpers.exe"
"C:\Program Files (x86)\Windows Sidebar\sidebar.exe" /autoRun
"C:\Program Files (x86)\WinSplit Revolution\WinSplit.exe"
"C:\Program Files (x86)\QIP 2010\qip.exe" /autorun
"C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe"
"C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe"
"C:\Program Files (x86)\SnugTV\SnugTV Station\QuickStart.exe"
"C:\Program Files (x86)\ROCCAT\Kova[+] Mouse\Kova[+]Monitor.exe"
"C:\Program Files (x86)\WinSplit Revolution\WinSplitDrvr32.exe" 66144
"C:\Program Files (x86)\WinSplit Revolution\WinSplitDrvr64.exe" 66144
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
C:\Windows\sysWOW64\wbem\wmiprvse.exe -Embedding
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding
C:\Windows\system32\svchost.exe -k bthsvcs
"C:\Windows\system32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-190d2bfe-0c92-4c88-9f48-7de32334dd00 -SystemEventPortName:HostProcess-0fc5aca7-f0aa-4080-9fe7-9a5503a96b18 -IoCancelEventPortName:HostProcess-b1e67775-c5fb-470f-900d-4cdcf156ff39 -NonStateChangingEventPortName:HostProcess-e18e0031-3632-4321-a3e2-cbae217f7ec6 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:f85b2845-8751-403d-9af3-93ba0cf92d80
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
"C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel=4892.181fcc60.932218031 "C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_228.dll" E7CF176E110C211B -greomni "C:\Program Files (x86)\Mozilla Firefox\omni.ja" 4892 "\\.\pipe\gecko-crash-server-pipe.4892" plugin
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\system32\svchost.exe -k SDRSVC
"C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe"
"C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /startalways
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
"C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:5296 CREDAT:203009
C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_2_202_228_ActiveX.exe -Embedding
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1699888946-4257952244-2652322587-10007_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1699888946-4257952244-2652322587-10007 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
"C:\Windows\system32\SearchFilterHost.exe" 0 516 520 528 65536 524
C:\Windows\system32\igfxsrvc.exe -Embedding
"D:\Download_mozzila\RSITx64.exe"
======Scheduled tasks folder======
C:\Windows\tasks\Adobe Flash Player Updater.job
C:\Windows\tasks\AutoKMS.job
=========Mozilla firefox=========
ProfilePath - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\jxi8mt5e.default
prefs.js - "browser.startup.homepage" - "www.seznam.cz"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.2.202.228 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_228.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.2.202.228 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_228.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL
C:\Program Files (x86)\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}
C:\Program Files (x86)\Mozilla Firefox\components\
binary.manifest
browsercomps.dll
C:\Program Files (x86)\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml
C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\jxi8mt5e.default\extensions\
centrumpomocnik@centrum.cz
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL [2011-06-12 6721936]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL [2010-12-21 689040]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-01-03 63912]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL [2011-06-12 4221328]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8D10F6C4-0E01-4BD4-8601-11AC1FDF8126}]
CIESpeechBHO Class - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll [2011-03-13 60576]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL [2010-12-21 561552]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2011-10-18 42272]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2010-11-19 11613288]
"AtherosBtStack"=C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [2011-03-13 617120]
"AthBtTray"=C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [2011-03-13 379552]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2011-09-08 4030008]
"TNOD UP"=C:\Program Files (x86)\TNod User & Password Finder\TNODUP.exe [2011-05-07 1882112]
"BCSSync"=C:\Program Files\Microsoft Office\Office14\BCSSync.exe [2010-03-13 112512]
"Free PDF Print Dispatcher"=C:\Program Files (x86)\pdfconverter.com\FreePDF Creator\itFPCPrnDisp.exe [2010-01-15 25600]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2012-02-14 170264]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2012-02-14 398616]
"Persistence"=C:\Windows\system32\igfxpers.exe [2012-02-14 440600]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files (x86)\Windows Sidebar\sidebar.exe [2010-11-21 1174016]
"Winsplit"=C:\Program Files (x86)\WinSplit Revolution\WinSplit.exe [2011-04-12 3951616]
"Infium"=C:\Program Files (x86)\QIP 2010\qip.exe [2011-08-22 6821248]
"PCSpeedUp"=C:\Program Files (x86)\Zrychleni Pocitace\PCSpeedUp.lnk [2011-10-31 2421]
[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"BCU"=C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe [2009-10-26 375000]
"JMB36X IDE Setup"=C:\Windows\RaidTool\xInsIDE.exe [2010-01-19 43632]
"RoccatKova+"=C:\Program Files (x86)\ROCCAT\Kova[+] Mouse\Kova[+]Monitor.EXE [2011-03-17 539688]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2011-06-09 254696]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-01-03 843712]
"Malwarebytes' Anti-Malware"=C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe [2012-01-13 460872]
[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\RunOnce]
"Malwarebytes Anti-Malware"=C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe [2012-01-13 460872]
"Malwarebytes Anti-Malware (cleanup)"=C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll [2012-01-13 1081416]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
AVer HID Receiver.lnk - C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe
AVerQuick.lnk - C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe
SnugTV Quick Start.lnk - C:\Windows\Installer\{33CFCB69-2FA5-43E8-B8A8-FAA155F870B5}\NewShortcut1_46FEF19C05F1475DAA14D9007DC15270_2.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2012-02-14 430080]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL [2011-06-12 6721936]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL [2011-06-12 4221328]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave2"=wdmaud.drv
"mixer2"=wdmaud.drv
"midi2"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
======File associations======
.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*
.scr - open - C:\Windows\system32\notepad.exe "%1"
.scr - install -
.scr - config -
======List of files/folders created in the last 1 month======
2012-04-02 11:43:33 ----D---- C:\rsit
2012-04-02 11:43:33 ----D---- C:\Program Files\trend micro
2012-04-02 11:32:58 ----A---- C:\TDSSKiller.2.7.23.0_02.04.2012_11.32.58_log.txt
2012-04-02 10:52:23 ----D---- C:\Users\Jan\AppData\Roaming\Malwarebytes
2012-04-02 10:52:20 ----D---- C:\ProgramData\Malwarebytes
2012-04-02 10:52:19 ----D---- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-04-02 10:52:19 ----A---- C:\Windows\system32\drivers\mbam.sys
2012-04-02 10:45:06 ----A---- C:\Windows\SYSWOW64\FlashPlayerInstaller.exe
2012-04-02 10:40:02 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2012-03-30 12:12:32 ----D---- C:\Program Files\CCleaner
2012-03-18 15:13:58 ----D---- C:\ProgramData\Windows
2012-03-14 19:49:00 ----A---- C:\Windows\system32\ntoskrnl.exe
2012-03-14 19:48:59 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2012-03-14 19:48:58 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2012-03-14 08:34:40 ----A---- C:\Windows\system32\win32k.sys
2012-03-14 08:34:40 ----A---- C:\Windows\system32\DWrite.dll
2012-03-14 08:34:39 ----A---- C:\Windows\SYSWOW64\DWrite.dll
2012-03-14 08:32:06 ----A---- C:\Windows\SYSWOW64\rdpcore.dll
2012-03-14 08:32:06 ----A---- C:\Windows\system32\rdpcore.dll
2012-03-14 08:32:05 ----A---- C:\Windows\system32\rdrmemptylst.exe
2012-03-14 08:32:05 ----A---- C:\Windows\system32\rdpwsx.dll
2012-03-14 08:32:05 ----A---- C:\Windows\system32\rdpcorekmts.dll
2012-03-14 08:32:05 ----A---- C:\Windows\system32\drivers\tdtcp.sys
2012-03-14 08:32:05 ----A---- C:\Windows\system32\drivers\rdpwd.sys
======List of files/folders modified in the last 1 month======
2012-04-02 11:43:39 ----D---- C:\Windows\Prefetch
2012-04-02 11:43:38 ----D---- C:\Windows\Temp
2012-04-02 11:43:33 ----RD---- C:\Program Files
2012-04-02 11:32:58 ----D---- C:\Windows\system32\drivers
2012-04-02 10:55:07 ----SHD---- C:\System Volume Information
2012-04-02 10:52:20 ----HD---- C:\ProgramData
2012-04-02 10:52:19 ----RD---- C:\Program Files (x86)
2012-04-02 10:45:06 ----D---- C:\Windows\SysWOW64
2012-04-02 10:43:55 ----D---- C:\Windows\System32
2012-04-02 10:43:55 ----A---- C:\Windows\system32\PerfStringBackup.INI
2012-04-02 10:43:54 ----D---- C:\Windows\inf
2012-04-02 10:40:41 ----SHD---- C:\Windows\Installer
2012-04-02 10:40:40 ----D---- C:\Program Files (x86)\HTC
2012-04-02 10:40:30 ----D---- C:\Windows\Tasks
2012-04-02 10:40:02 ----D---- C:\Windows\system32\Tasks
2012-04-02 10:39:45 ----D---- C:\Windows\system32\config
2012-04-02 10:12:41 ----D---- C:\Users\Jan\AppData\Roaming\Skype
2012-04-02 06:37:54 ----D---- C:\Windows\system32\catroot2
2012-03-31 08:55:52 ----D---- C:\Windows
2012-03-30 12:16:09 ----D---- C:\Users\Jan\AppData\Roaming\Media Player Classic
2012-03-30 12:14:14 ----D---- C:\Windows\Panther
2012-03-30 12:14:14 ----D---- C:\Windows\Logs
2012-03-30 12:14:14 ----D---- C:\Windows\debug
2012-03-26 09:03:05 ----D---- C:\ProgramData\Skype
2012-03-19 07:49:48 ----D---- C:\Program Files (x86)\Mozilla Firefox
2012-03-18 15:14:08 ----D---- C:\Windows\system32\sysprep
2012-03-14 19:58:30 ----D---- C:\Windows\system32\catroot
2012-03-14 19:58:29 ----D---- C:\Windows\system32\DriverStore
2012-03-14 19:53:04 ----D---- C:\Windows\winsxs
2012-03-14 19:48:23 ----A---- C:\Windows\system32\MRT.exe
2012-03-14 19:48:19 ----D---- C:\ProgramData\Microsoft Help
2012-03-14 09:49:05 ----D---- C:\Users\Jan\AppData\Roaming\vlc
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 JRAID;JRAID; C:\Windows\system32\DRIVERS\jraid.sys [2010-08-10 120920]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-21 514560]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2011-08-04 146432]
R2 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2011-08-09 202576]
R2 epfwwfpr;epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys [2011-08-04 137144]
R3 asmthub3;ASMedia USB3 Hub Service; C:\Windows\system32\DRIVERS\asmthub3.sys [2010-12-08 122856]
R3 asmtxhci;ASMEDIA XHCI Service; C:\Windows\system32\DRIVERS\asmtxhci.sys [2010-12-08 369640]
R3 AthBTPort;Atheros Virtual Bluetooth Class; C:\Windows\system32\DRIVERS\btath_flt.sys [2011-03-13 36000]
R3 AVerAF35;AVerMedia A867 USB DVB-T; C:\Windows\System32\Drivers\AVerAF35.sys [2010-09-21 804224]
R3 BTATH_A2DP;Bluetooth A2DP Audio Driver; C:\Windows\system32\drivers\btath_a2dp.sys [2011-03-13 298656]
R3 BTATH_BUS;Atheros Bluetooth Bus; C:\Windows\system32\DRIVERS\btath_bus.sys [2011-03-13 28832]
R3 BTATH_HCRP;Bluetooth HCRP Server driver; C:\Windows\system32\DRIVERS\btath_hcrp.sys [2011-03-13 201376]
R3 BTATH_LWFLT;Bluetooth LWFLT Device; C:\Windows\system32\DRIVERS\btath_lwflt.sys [2011-03-13 55456]
R3 BTATH_RCP;Bluetooth AVRCP Device; C:\Windows\system32\DRIVERS\btath_rcp.sys [2011-03-13 154272]
R3 BtFilter;BtFilter; C:\Windows\system32\DRIVERS\btfilter.sys [2011-03-13 280224]
R3 BthEnum;Ovladač pro Bluetooth Request Block; C:\Windows\system32\drivers\BthEnum.sys [2009-07-14 41984]
R3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
R3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2011-04-28 80384]
R3 e1cexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver C; C:\Windows\system32\DRIVERS\e1c62x64.sys [2010-09-21 313520]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2012-02-14 14692224]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2010-11-23 2565736]
R3 IntcDAud;Intel(R) Display Audio; C:\Windows\system32\DRIVERS\IntcDAud.sys [2011-08-23 317440]
R3 KovaPlusFltr;ROCCAT Kova[+] Mouse; C:\Windows\system32\drivers\KovaPlusFltr.sys [2010-01-25 15104]
R3 MBAMProtector;MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [2011-12-10 23152]
R3 MEIx64;Intel(R) Management Engine Interface; C:\Windows\system32\DRIVERS\HECIx64.sys [2010-10-19 56344]
R3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
S3 aswMBR;aswMBR; \??\C:\Users\Jan\AppData\Local\Temp\aswMBR.sys []
S3 ATHDFU;Atheros Valkyrie USB BootROM; C:\Windows\System32\Drivers\AthDfu.sys [2011-03-13 51872]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2011-04-28 552960]
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
S3 HTCAND64;HTC Device Driver; C:\Windows\System32\Drivers\ANDROIDUSB.sys [2009-11-02 33736]
S3 htcnprot;HTC NDIS Protocol Driver; C:\Windows\system32\DRIVERS\htcnprot.sys [2010-06-25 36928]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-21 165888]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-21 6656]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-21 34688]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 usb_rndisx;Adaptér USB RNDIS; C:\Windows\system32\DRIVERS\usb8023x.sys [2009-07-14 19968]
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-21 199552]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-21 21760]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
R2 AtherosSvc;AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [2011-03-13 74912]
R2 Autodesk Content Service;Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [2011-02-02 18656]
R2 AVerRemote;AVerRemote; C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe [2010-04-27 348160]
R2 AVerScheduleService;AVerScheduleService; C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe [2011-04-01 403456]
R2 AVerUpdateServer;AVerUpdateServer; C:\Program Files (x86)\AVerMedia\AVerUpdate\AVerUpdateServer.exe [2011-01-06 168448]
R2 BCUService;Browser Configuration Utility Service; C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe [2009-10-26 223464]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2011-09-08 974944]
R2 Intel® PROSet Monitoring Service;Intel® PROSet Monitoring Service; C:\Windows\system32\IProsetMonitor.exe [2010-08-12 133800]
R2 MBAMService;MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-01-13 652360]
R2 PassThru Service;Internet Pass-Through Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [2011-08-12 87040]
R2 SnugTV Service;SnugTV Service; C:\Program Files (x86)\SnugTV\SnugTV Station\AMAServer.exe [2011-04-06 571904]
R3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
R3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 253600]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2010-03-18 44376]
S3 cphs;Intel(R) Content Protection HECI Service; C:\Windows\SysWow64\IntelCpHeciSvc.exe [2012-02-14 276248]
S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2011-11-09 1431888]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service; C:\Program Files\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 51740536]
S3 ose64;Office 64 Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2011-09-18 1255736]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
-----------------EOF-----------------
Win32/TrojanDownloader.Mebload.AR
Moderátor: Moderátoři
Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Vážení uživaterlé!
Ve dnech 4. - 6-9.2026 budou někteříí naši členové na každoročním srazu fóra. Žádáme vás, abyste měli strpení, nemusí se na na řešení vašeho problému dostat hned. Děkujeme za pochopení.
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Vážení uživaterlé!
Ve dnech 4. - 6-9.2026 budou někteříí naši členové na každoročním srazu fóra. Žádáme vás, abyste měli strpení, nemusí se na na řešení vašeho problému dostat hned. Děkujeme za pochopení.
Re: Win32/TrojanDownloader.Mebload.AR
Zdravim 
tema jsem oddelil od puvodniho, at se nam to neplete
Co udelame s tim nelegalni ESETem - pravidla fora hovori jasne 
Koukam ze uz jste neco zkousel s TDSSKillerem - vy s nim umite
tema jsem oddelil od puvodniho, at se nam to neplete Co udelame s tim nelegalni ESETem - pravidla fora hovori jasne Koukam ze uz jste neco zkousel s TDSSKillerem - vy s nim umite "Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen
od 1. února 2011.
Člen
od 1. února 2011.Re: Win32/TrojanDownloader.Mebload.AR
Také zdravím, eset jsem odinstaloval a pohlédnu se po něčem legálním (mám to v plánu už delší dobu, asi jsem potřeboval nějaký impuls), mohl byste mi nějaký doporučit?
TDSSKiller jsem zkoušel podle předchozího tématu, ale došel jsem k tomu, že si tím sám neporadím a raději jsem se registroval a vložil log.
Pomohl byste mi s mím problémem? Děkuji
TDSSKiller jsem zkoušel podle předchozího tématu, ale došel jsem k tomu, že si tím sám neporadím a raději jsem se registroval a vložil log.
Pomohl byste mi s mím problémem? Děkuji
Re: Win32/TrojanDownloader.Mebload.AR
Nainstalujte free zabezpeceni - doporucuji Avast, Aviru ci MSE Pak dejte novy log z RSIT Taktez sem dejte tenhle log C:\TDSSKiller.2.7.23.0_02.04.2012_11.32.58_log.txt"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen od 1. února 2011.
Člen
od 1. února 2011.Re: Win32/TrojanDownloader.Mebload.AR
RSIT:
Logfile of random's system information tool 1.09 (written by random/random)
Run by Jan at 2012-04-02 18:27:45
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 12 GB (21%) free of 57 GB
Total RAM: 8099 MB (79% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:27:48, on 2.4.2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal
Running processes:
C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe
C:\Program Files (x86)\pdfconverter.com\FreePDF Creator\itFPCPrnDisp.exe
C:\Program Files (x86)\WinSplit Revolution\WinSplit.exe
C:\Program Files (x86)\WinSplit Revolution\WinSplitDrvr32.exe
C:\Program Files (x86)\QIP 2010\qip.exe
C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe
C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe
C:\Program Files (x86)\ROCCAT\Kova[+] Mouse\Kova[+]Monitor.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\SnugTV\SnugTV Station\QuickStart.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe
C:\Program Files\trend micro\Jan.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: SearchHook Class - {BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\AddressBarSearch.dll
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
O2 - BHO: IESpeakDoc - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [BCU] "C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe"
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [RoccatKova+] "C:\Program Files (x86)\ROCCAT\Kova[+] Mouse\Kova[+]Monitor.EXE"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Winsplit] C:\Program Files (x86)\WinSplit Revolution\WinSplit.exe
O4 - HKCU\..\Run: [Infium] "C:\Program Files (x86)\QIP 2010\qip.exe" /autorun
O4 - HKCU\..\Run: [PCSpeedUp] C:\Program Files (x86)\Zrychleni Pocitace\PCSpeedUp.lnk
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: AVer HID Receiver.lnk = C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe
O4 - Global Startup: AVerQuick.lnk = C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe
O4 - Global Startup: SnugTV Quick Start.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~1\MICROS~1\Office14\ONBttnIE.dll/105
O8 - Extra context menu item: Převést cíl vazby do Adobe PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Převést do Adobe PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Připojit cíl vazby k existujícímu PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Připojit k existujícímu PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: (no name) - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
O9 - Extra 'Tools' menuitem: Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AtherosSvc - Atheros Commnucations - C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
O23 - Service: Autodesk Content Service - Unknown owner - C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: AVerRemote - AVerMedia - C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe
O23 - Service: AVerScheduleService - Unknown owner - C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe
O23 - Service: AVerUpdateServer - AVerMedia TECHNOLOGIES, Inc. - C:\Program Files (x86)\AVerMedia\AVerUpdate\AVerUpdateServer.exe
O23 - Service: Browser Configuration Utility Service (BCUService) - DeviceVM, Inc. - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\Windows\SysWow64\IntelCpHeciSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service 64 - Flexera Software, Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Intel® PROSet Monitoring Service - Unknown owner - C:\Windows\system32\IProsetMonitor.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Internet Pass-Through Service (PassThru Service) - Unknown owner - C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: SnugTV Service - AVerMedia Technologies, Inc. - C:\Program Files (x86)\SnugTV\SnugTV Station\AMAServer.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
--
End of file - 11852 bytes
======Listing Processes======
\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
winlogon.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
"C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
taskeng.exe {0BF6DF6A-7AAC-45DA-9140-FA033160550A}
"taskhost.exe"
C:\Windows\AutoKMS\AutoKMS.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files (x86)\Bluetooth Suite\adminservice.exe"
"C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe"
"C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe"
"C:\Program Files (x86)\AVerMedia\AVerUpdate\AVerUpdateServer.exe"
"C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe"
C:\Windows\system32\IProsetMonitor.exe
"C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe"
"C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe"
"C:\Program Files (x86)\SnugTV\SnugTV Station\AMAServer.exe"
"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\sppsvc.exe
C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding
"C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe"
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe"
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe"
\??\C:\Windows\system32\conhost.exe "1185721617443142264-694805969-958270077-405626568-1905829898-1020041201-1832772751
"C:\Program Files (x86)\pdfconverter.com\FreePDF Creator\itFPCPrnDisp.exe"
"C:\Windows\System32\igfxtray.exe"
"C:\Windows\System32\hkcmd.exe"
"C:\Windows\System32\igfxpers.exe"
"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files (x86)\WinSplit Revolution\WinSplit.exe"
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Program Files (x86)\WinSplit Revolution\WinSplitDrvr32.exe" 66162
"C:\Program Files (x86)\QIP 2010\qip.exe" /autorun
"C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe"
"C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe"
"C:\Program Files (x86)\ROCCAT\Kova[+] Mouse\Kova[+]Monitor.exe"
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
"C:\Program Files (x86)\SnugTV\SnugTV Station\QuickStart.exe"
"C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
"C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
"C:\Program Files (x86)\WinSplit Revolution\WinSplitDrvr64.exe" 66162
C:\Windows\system32\wbem\WmiApSrv.exe
"C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1699888946-4257952244-2652322587-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1699888946-4257952244-2652322587-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Windows\system32\SearchFilterHost.exe" 0 528 532 540 65536 536
"C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe"
"D:\Download_mozzila\RSITx64.exe"
"C:\Windows\system32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-86f144c1-852b-489b-a95e-bf7c93dfbe83 -SystemEventPortName:HostProcess-d913d058-3a0d-4d89-b93b-2517e16a9c41 -IoCancelEventPortName:HostProcess-697a1088-68b3-4b01-bec6-5dc9c6bfe931 -NonStateChangingEventPortName:HostProcess-e2d39ddc-c5c1-43a8-a7ee-2ca8012fe009 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:13fb993e-2805-4e98-a41e-301dba0682e2
C:\Windows\system32\igfxsrvc.exe -Embedding
======Scheduled tasks folder======
C:\Windows\tasks\Adobe Flash Player Updater.job
C:\Windows\tasks\AutoKMS.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
=========Mozilla firefox=========
ProfilePath - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\jxi8mt5e.default
prefs.js - "browser.startup.homepage" - "www.seznam.cz"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.2.202.228 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_228.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.2.202.228 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_228.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL
C:\Program Files (x86)\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}
C:\Program Files (x86)\Mozilla Firefox\components\
binary.manifest
browsercomps.dll
C:\Program Files (x86)\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml
C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\jxi8mt5e.default\extensions\
centrumpomocnik@centrum.cz
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{318A227B-5E9F-45bd-8999-7F8F10CA4CF5}]
avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2012-03-07 1211776]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL [2011-06-12 6721936]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL [2010-12-21 689040]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-01-03 63912]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL [2011-06-12 4221328]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8D10F6C4-0E01-4BD4-8601-11AC1FDF8126}]
CIESpeechBHO Class - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll [2011-03-13 60576]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2012-03-07 1003704]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL [2010-12-21 561552]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2011-10-18 42272]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2012-03-07 1211776]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2012-03-07 1003704]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2010-11-19 11613288]
"AtherosBtStack"=C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [2011-03-13 617120]
"AthBtTray"=C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [2011-03-13 379552]
"TNOD UP"=C:\Program Files (x86)\TNod User & Password Finder\TNODUP.exe [2011-05-07 1882112]
"BCSSync"=C:\Program Files\Microsoft Office\Office14\BCSSync.exe [2010-03-13 112512]
"Free PDF Print Dispatcher"=C:\Program Files (x86)\pdfconverter.com\FreePDF Creator\itFPCPrnDisp.exe [2010-01-15 25600]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2012-02-14 170264]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2012-02-14 398616]
"Persistence"=C:\Windows\system32\igfxpers.exe [2012-02-14 440600]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-21 1475584]
"Winsplit"=C:\Program Files (x86)\WinSplit Revolution\WinSplit.exe [2011-04-12 3951616]
"Infium"=C:\Program Files (x86)\QIP 2010\qip.exe [2011-08-22 6821248]
"PCSpeedUp"=C:\Program Files (x86)\Zrychleni Pocitace\PCSpeedUp.lnk [2011-10-31 2421]
[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"BCU"=C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe [2009-10-26 375000]
"JMB36X IDE Setup"=C:\Windows\RaidTool\xInsIDE.exe [2010-01-19 43632]
"RoccatKova+"=C:\Program Files (x86)\ROCCAT\Kova[+] Mouse\Kova[+]Monitor.EXE [2011-03-17 539688]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2011-06-09 254696]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-01-03 843712]
"Malwarebytes' Anti-Malware"=C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe [2012-01-13 460872]
"avast"=C:\Program Files\AVAST Software\Avast\avastUI.exe [2012-03-07 4241512]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
AVer HID Receiver.lnk - C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe
AVerQuick.lnk - C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe
SnugTV Quick Start.lnk - C:\Windows\Installer\{33CFCB69-2FA5-43E8-B8A8-FAA155F870B5}\NewShortcut1_46FEF19C05F1475DAA14D9007DC15270_2.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2012-02-14 430080]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL [2011-06-12 6721936]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL [2011-06-12 4221328]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave2"=wdmaud.drv
"mixer2"=wdmaud.drv
"midi2"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
======File associations======
.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*
.scr - open - C:\Windows\system32\notepad.exe "%1"
.scr - install -
.scr - config -
======List of files/folders created in the last 1 month======
2012-04-02 18:16:40 ----D---- C:\Program Files (x86)\Google
2012-04-02 18:16:40 ----A---- C:\Windows\system32\drivers\aswTdi.sys
2012-04-02 18:16:40 ----A---- C:\Windows\system32\drivers\aswSP.sys
2012-04-02 18:16:40 ----A---- C:\Windows\system32\drivers\aswSnx.sys
2012-04-02 18:16:40 ----A---- C:\Windows\system32\drivers\aswRdr2.sys
2012-04-02 18:16:40 ----A---- C:\Windows\system32\drivers\aswMonFlt.sys
2012-04-02 18:16:40 ----A---- C:\Windows\system32\drivers\aswFsBlk.sys
2012-04-02 18:16:40 ----A---- C:\Windows\system32\aswBoot.exe
2012-04-02 18:16:30 ----A---- C:\Windows\SYSWOW64\aswBoot.exe
2012-04-02 18:16:30 ----A---- C:\Windows\avastSS.scr
2012-04-02 18:16:24 ----D---- C:\ProgramData\AVAST Software
2012-04-02 18:16:24 ----D---- C:\Program Files\AVAST Software
2012-04-02 11:43:33 ----D---- C:\rsit
2012-04-02 11:43:33 ----D---- C:\Program Files\trend micro
2012-04-02 11:32:58 ----A---- C:\TDSSKiller.2.7.23.0_02.04.2012_11.32.58_log.txt
2012-04-02 10:52:23 ----D---- C:\Users\Jan\AppData\Roaming\Malwarebytes
2012-04-02 10:52:20 ----D---- C:\ProgramData\Malwarebytes
2012-04-02 10:52:19 ----D---- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-04-02 10:52:19 ----A---- C:\Windows\system32\drivers\mbam.sys
2012-04-02 10:45:06 ----A---- C:\Windows\SYSWOW64\FlashPlayerInstaller.exe
2012-04-02 10:40:02 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2012-03-30 12:12:32 ----D---- C:\Program Files\CCleaner
2012-03-18 15:13:58 ----D---- C:\ProgramData\Windows
2012-03-14 19:49:00 ----A---- C:\Windows\system32\ntoskrnl.exe
2012-03-14 19:48:59 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2012-03-14 19:48:58 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2012-03-14 08:34:40 ----A---- C:\Windows\system32\win32k.sys
2012-03-14 08:34:40 ----A---- C:\Windows\system32\DWrite.dll
2012-03-14 08:34:39 ----A---- C:\Windows\SYSWOW64\DWrite.dll
2012-03-14 08:32:06 ----A---- C:\Windows\SYSWOW64\rdpcore.dll
2012-03-14 08:32:06 ----A---- C:\Windows\system32\rdpcore.dll
2012-03-14 08:32:05 ----A---- C:\Windows\system32\rdrmemptylst.exe
2012-03-14 08:32:05 ----A---- C:\Windows\system32\rdpwsx.dll
2012-03-14 08:32:05 ----A---- C:\Windows\system32\rdpcorekmts.dll
2012-03-14 08:32:05 ----A---- C:\Windows\system32\drivers\tdtcp.sys
2012-03-14 08:32:05 ----A---- C:\Windows\system32\drivers\rdpwd.sys
======List of files/folders modified in the last 1 month======
2012-04-02 18:27:36 ----D---- C:\Windows\Temp
2012-04-02 18:27:34 ----D---- C:\Windows\Prefetch
2012-04-02 18:26:45 ----D---- C:\Windows
2012-04-02 18:21:12 ----RD---- C:\Program Files (x86)
2012-04-02 18:21:11 ----SHD---- C:\Windows\Installer
2012-04-02 18:19:51 ----D---- C:\Windows\system32\Tasks
2012-04-02 18:18:04 ----D---- C:\Users\Jan\AppData\Roaming\Skype
2012-04-02 18:16:42 ----D---- C:\Windows\Tasks
2012-04-02 18:16:40 ----D---- C:\Windows\SysWOW64
2012-04-02 18:16:40 ----D---- C:\Windows\system32\drivers
2012-04-02 18:16:40 ----D---- C:\Windows\System32
2012-04-02 18:16:24 ----SHD---- C:\System Volume Information
2012-04-02 18:16:24 ----RD---- C:\Program Files
2012-04-02 18:16:24 ----HD---- C:\ProgramData
2012-04-02 17:51:22 ----D---- C:\Windows\system32\DriverStore
2012-04-02 17:51:22 ----D---- C:\Windows\system32\catroot
2012-04-02 17:51:22 ----D---- C:\Windows\inf
2012-04-02 15:00:24 ----A---- C:\Windows\system32\PerfStringBackup.INI
2012-04-02 12:42:41 ----D---- C:\Windows\system32\config
2012-04-02 10:40:40 ----D---- C:\Program Files (x86)\HTC
2012-04-02 06:37:54 ----D---- C:\Windows\system32\catroot2
2012-03-30 12:16:09 ----D---- C:\Users\Jan\AppData\Roaming\Media Player Classic
2012-03-30 12:14:14 ----D---- C:\Windows\Panther
2012-03-30 12:14:14 ----D---- C:\Windows\Logs
2012-03-30 12:14:14 ----D---- C:\Windows\debug
2012-03-26 09:03:05 ----D---- C:\ProgramData\Skype
2012-03-19 07:49:48 ----D---- C:\Program Files (x86)\Mozilla Firefox
2012-03-18 15:14:08 ----D---- C:\Windows\system32\sysprep
2012-03-14 19:53:04 ----D---- C:\Windows\winsxs
2012-03-14 19:48:23 ----A---- C:\Windows\system32\MRT.exe
2012-03-14 19:48:19 ----D---- C:\ProgramData\Microsoft Help
2012-03-14 09:49:05 ----D---- C:\Users\Jan\AppData\Roaming\vlc
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 JRAID;JRAID; C:\Windows\system32\DRIVERS\jraid.sys [2010-08-10 120920]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R1 aswRdr;aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [2012-03-07 53080]
R1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2012-03-07 819032]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2012-03-07 337240]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2012-03-07 59224]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-21 514560]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2012-03-07 24408]
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2012-03-07 69976]
R3 asmthub3;ASMedia USB3 Hub Service; C:\Windows\system32\DRIVERS\asmthub3.sys [2010-12-08 122856]
R3 asmtxhci;ASMEDIA XHCI Service; C:\Windows\system32\DRIVERS\asmtxhci.sys [2010-12-08 369640]
R3 AthBTPort;Atheros Virtual Bluetooth Class; C:\Windows\system32\DRIVERS\btath_flt.sys [2011-03-13 36000]
R3 AVerAF35;AVerMedia A867 USB DVB-T; C:\Windows\System32\Drivers\AVerAF35.sys [2010-09-21 804224]
R3 BTATH_A2DP;Bluetooth A2DP Audio Driver; C:\Windows\system32\drivers\btath_a2dp.sys [2011-03-13 298656]
R3 BTATH_BUS;Atheros Bluetooth Bus; C:\Windows\system32\DRIVERS\btath_bus.sys [2011-03-13 28832]
R3 BTATH_HCRP;Bluetooth HCRP Server driver; C:\Windows\system32\DRIVERS\btath_hcrp.sys [2011-03-13 201376]
R3 BTATH_LWFLT;Bluetooth LWFLT Device; C:\Windows\system32\DRIVERS\btath_lwflt.sys [2011-03-13 55456]
R3 BTATH_RCP;Bluetooth AVRCP Device; C:\Windows\system32\DRIVERS\btath_rcp.sys [2011-03-13 154272]
R3 BtFilter;BtFilter; C:\Windows\system32\DRIVERS\btfilter.sys [2011-03-13 280224]
R3 BthEnum;Ovladač pro Bluetooth Request Block; C:\Windows\system32\drivers\BthEnum.sys [2009-07-14 41984]
R3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
R3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2011-04-28 80384]
R3 e1cexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver C; C:\Windows\system32\DRIVERS\e1c62x64.sys [2010-09-21 313520]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2012-02-14 14692224]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2010-11-23 2565736]
R3 IntcDAud;Intel(R) Display Audio; C:\Windows\system32\DRIVERS\IntcDAud.sys [2011-08-23 317440]
R3 KovaPlusFltr;ROCCAT Kova[+] Mouse; C:\Windows\system32\drivers\KovaPlusFltr.sys [2010-01-25 15104]
R3 MBAMProtector;MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [2011-12-10 23152]
R3 MEIx64;Intel(R) Management Engine Interface; C:\Windows\system32\DRIVERS\HECIx64.sys [2010-10-19 56344]
R3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
S3 ATHDFU;Atheros Valkyrie USB BootROM; C:\Windows\System32\Drivers\AthDfu.sys [2011-03-13 51872]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2011-04-28 552960]
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
S3 HTCAND64;HTC Device Driver; C:\Windows\System32\Drivers\ANDROIDUSB.sys [2009-11-02 33736]
S3 htcnprot;HTC NDIS Protocol Driver; C:\Windows\system32\DRIVERS\htcnprot.sys [2010-06-25 36928]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-21 165888]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-21 6656]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-21 34688]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 usb_rndisx;Adaptér USB RNDIS; C:\Windows\system32\DRIVERS\usb8023x.sys [2009-07-14 19968]
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-21 199552]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-21 21760]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
R2 AtherosSvc;AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [2011-03-13 74912]
R2 Autodesk Content Service;Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [2011-02-02 18656]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2012-03-07 44768]
R2 AVerRemote;AVerRemote; C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe [2010-04-27 348160]
R2 AVerScheduleService;AVerScheduleService; C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe [2011-04-01 403456]
R2 AVerUpdateServer;AVerUpdateServer; C:\Program Files (x86)\AVerMedia\AVerUpdate\AVerUpdateServer.exe [2011-01-06 168448]
R2 BCUService;Browser Configuration Utility Service; C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe [2009-10-26 223464]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 Intel® PROSet Monitoring Service;Intel® PROSet Monitoring Service; C:\Windows\system32\IProsetMonitor.exe [2010-08-12 133800]
R2 MBAMService;MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-01-13 652360]
R2 PassThru Service;Internet Pass-Through Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [2011-08-12 87040]
R2 SnugTV Service;SnugTV Service; C:\Program Files (x86)\SnugTV\SnugTV Station\AMAServer.exe [2011-04-06 571904]
R3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-04-02 136176]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 253600]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2010-03-18 44376]
S3 cphs;Intel(R) Content Protection HECI Service; C:\Windows\SysWow64\IntelCpHeciSvc.exe [2012-02-14 276248]
S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2011-11-09 1431888]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-04-02 136176]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service; C:\Program Files\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 51740536]
S3 ose64;Office 64 Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2011-09-18 1255736]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
-----------------EOF-----------------
Logfile of random's system information tool 1.09 (written by random/random)
Run by Jan at 2012-04-02 18:27:45
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 12 GB (21%) free of 57 GB
Total RAM: 8099 MB (79% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:27:48, on 2.4.2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal
Running processes:
C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe
C:\Program Files (x86)\pdfconverter.com\FreePDF Creator\itFPCPrnDisp.exe
C:\Program Files (x86)\WinSplit Revolution\WinSplit.exe
C:\Program Files (x86)\WinSplit Revolution\WinSplitDrvr32.exe
C:\Program Files (x86)\QIP 2010\qip.exe
C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe
C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe
C:\Program Files (x86)\ROCCAT\Kova[+] Mouse\Kova[+]Monitor.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\SnugTV\SnugTV Station\QuickStart.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe
C:\Program Files\trend micro\Jan.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: SearchHook Class - {BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\AddressBarSearch.dll
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
O2 - BHO: IESpeakDoc - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [BCU] "C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe"
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [RoccatKova+] "C:\Program Files (x86)\ROCCAT\Kova[+] Mouse\Kova[+]Monitor.EXE"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Winsplit] C:\Program Files (x86)\WinSplit Revolution\WinSplit.exe
O4 - HKCU\..\Run: [Infium] "C:\Program Files (x86)\QIP 2010\qip.exe" /autorun
O4 - HKCU\..\Run: [PCSpeedUp] C:\Program Files (x86)\Zrychleni Pocitace\PCSpeedUp.lnk
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: AVer HID Receiver.lnk = C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe
O4 - Global Startup: AVerQuick.lnk = C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe
O4 - Global Startup: SnugTV Quick Start.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~1\MICROS~1\Office14\ONBttnIE.dll/105
O8 - Extra context menu item: Převést cíl vazby do Adobe PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Převést do Adobe PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Připojit cíl vazby k existujícímu PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Připojit k existujícímu PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: (no name) - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
O9 - Extra 'Tools' menuitem: Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AtherosSvc - Atheros Commnucations - C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
O23 - Service: Autodesk Content Service - Unknown owner - C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: AVerRemote - AVerMedia - C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe
O23 - Service: AVerScheduleService - Unknown owner - C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe
O23 - Service: AVerUpdateServer - AVerMedia TECHNOLOGIES, Inc. - C:\Program Files (x86)\AVerMedia\AVerUpdate\AVerUpdateServer.exe
O23 - Service: Browser Configuration Utility Service (BCUService) - DeviceVM, Inc. - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\Windows\SysWow64\IntelCpHeciSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service 64 - Flexera Software, Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Intel® PROSet Monitoring Service - Unknown owner - C:\Windows\system32\IProsetMonitor.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Internet Pass-Through Service (PassThru Service) - Unknown owner - C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: SnugTV Service - AVerMedia Technologies, Inc. - C:\Program Files (x86)\SnugTV\SnugTV Station\AMAServer.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
--
End of file - 11852 bytes
======Listing Processes======
\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
winlogon.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
"C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
taskeng.exe {0BF6DF6A-7AAC-45DA-9140-FA033160550A}
"taskhost.exe"
C:\Windows\AutoKMS\AutoKMS.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files (x86)\Bluetooth Suite\adminservice.exe"
"C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe"
"C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe"
"C:\Program Files (x86)\AVerMedia\AVerUpdate\AVerUpdateServer.exe"
"C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe"
C:\Windows\system32\IProsetMonitor.exe
"C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe"
"C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe"
"C:\Program Files (x86)\SnugTV\SnugTV Station\AMAServer.exe"
"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\sppsvc.exe
C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding
"C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe"
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe"
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe"
\??\C:\Windows\system32\conhost.exe "1185721617443142264-694805969-958270077-405626568-1905829898-1020041201-1832772751
"C:\Program Files (x86)\pdfconverter.com\FreePDF Creator\itFPCPrnDisp.exe"
"C:\Windows\System32\igfxtray.exe"
"C:\Windows\System32\hkcmd.exe"
"C:\Windows\System32\igfxpers.exe"
"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files (x86)\WinSplit Revolution\WinSplit.exe"
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Program Files (x86)\WinSplit Revolution\WinSplitDrvr32.exe" 66162
"C:\Program Files (x86)\QIP 2010\qip.exe" /autorun
"C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe"
"C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe"
"C:\Program Files (x86)\ROCCAT\Kova[+] Mouse\Kova[+]Monitor.exe"
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
"C:\Program Files (x86)\SnugTV\SnugTV Station\QuickStart.exe"
"C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
"C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
"C:\Program Files (x86)\WinSplit Revolution\WinSplitDrvr64.exe" 66162
C:\Windows\system32\wbem\WmiApSrv.exe
"C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1699888946-4257952244-2652322587-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1699888946-4257952244-2652322587-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Windows\system32\SearchFilterHost.exe" 0 528 532 540 65536 536
"C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe"
"D:\Download_mozzila\RSITx64.exe"
"C:\Windows\system32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-86f144c1-852b-489b-a95e-bf7c93dfbe83 -SystemEventPortName:HostProcess-d913d058-3a0d-4d89-b93b-2517e16a9c41 -IoCancelEventPortName:HostProcess-697a1088-68b3-4b01-bec6-5dc9c6bfe931 -NonStateChangingEventPortName:HostProcess-e2d39ddc-c5c1-43a8-a7ee-2ca8012fe009 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:13fb993e-2805-4e98-a41e-301dba0682e2
C:\Windows\system32\igfxsrvc.exe -Embedding
======Scheduled tasks folder======
C:\Windows\tasks\Adobe Flash Player Updater.job
C:\Windows\tasks\AutoKMS.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
=========Mozilla firefox=========
ProfilePath - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\jxi8mt5e.default
prefs.js - "browser.startup.homepage" - "www.seznam.cz"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.2.202.228 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_228.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.2.202.228 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_228.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL
C:\Program Files (x86)\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}
C:\Program Files (x86)\Mozilla Firefox\components\
binary.manifest
browsercomps.dll
C:\Program Files (x86)\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml
C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\jxi8mt5e.default\extensions\
centrumpomocnik@centrum.cz
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{318A227B-5E9F-45bd-8999-7F8F10CA4CF5}]
avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2012-03-07 1211776]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL [2011-06-12 6721936]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL [2010-12-21 689040]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-01-03 63912]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL [2011-06-12 4221328]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8D10F6C4-0E01-4BD4-8601-11AC1FDF8126}]
CIESpeechBHO Class - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll [2011-03-13 60576]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2012-03-07 1003704]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL [2010-12-21 561552]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2011-10-18 42272]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2012-03-07 1211776]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2012-03-07 1003704]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2010-11-19 11613288]
"AtherosBtStack"=C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [2011-03-13 617120]
"AthBtTray"=C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [2011-03-13 379552]
"TNOD UP"=C:\Program Files (x86)\TNod User & Password Finder\TNODUP.exe [2011-05-07 1882112]
"BCSSync"=C:\Program Files\Microsoft Office\Office14\BCSSync.exe [2010-03-13 112512]
"Free PDF Print Dispatcher"=C:\Program Files (x86)\pdfconverter.com\FreePDF Creator\itFPCPrnDisp.exe [2010-01-15 25600]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2012-02-14 170264]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2012-02-14 398616]
"Persistence"=C:\Windows\system32\igfxpers.exe [2012-02-14 440600]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-21 1475584]
"Winsplit"=C:\Program Files (x86)\WinSplit Revolution\WinSplit.exe [2011-04-12 3951616]
"Infium"=C:\Program Files (x86)\QIP 2010\qip.exe [2011-08-22 6821248]
"PCSpeedUp"=C:\Program Files (x86)\Zrychleni Pocitace\PCSpeedUp.lnk [2011-10-31 2421]
[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"BCU"=C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe [2009-10-26 375000]
"JMB36X IDE Setup"=C:\Windows\RaidTool\xInsIDE.exe [2010-01-19 43632]
"RoccatKova+"=C:\Program Files (x86)\ROCCAT\Kova[+] Mouse\Kova[+]Monitor.EXE [2011-03-17 539688]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2011-06-09 254696]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-01-03 843712]
"Malwarebytes' Anti-Malware"=C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe [2012-01-13 460872]
"avast"=C:\Program Files\AVAST Software\Avast\avastUI.exe [2012-03-07 4241512]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
AVer HID Receiver.lnk - C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe
AVerQuick.lnk - C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe
SnugTV Quick Start.lnk - C:\Windows\Installer\{33CFCB69-2FA5-43E8-B8A8-FAA155F870B5}\NewShortcut1_46FEF19C05F1475DAA14D9007DC15270_2.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2012-02-14 430080]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL [2011-06-12 6721936]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL [2011-06-12 4221328]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave2"=wdmaud.drv
"mixer2"=wdmaud.drv
"midi2"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
======File associations======
.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*
.scr - open - C:\Windows\system32\notepad.exe "%1"
.scr - install -
.scr - config -
======List of files/folders created in the last 1 month======
2012-04-02 18:16:40 ----D---- C:\Program Files (x86)\Google
2012-04-02 18:16:40 ----A---- C:\Windows\system32\drivers\aswTdi.sys
2012-04-02 18:16:40 ----A---- C:\Windows\system32\drivers\aswSP.sys
2012-04-02 18:16:40 ----A---- C:\Windows\system32\drivers\aswSnx.sys
2012-04-02 18:16:40 ----A---- C:\Windows\system32\drivers\aswRdr2.sys
2012-04-02 18:16:40 ----A---- C:\Windows\system32\drivers\aswMonFlt.sys
2012-04-02 18:16:40 ----A---- C:\Windows\system32\drivers\aswFsBlk.sys
2012-04-02 18:16:40 ----A---- C:\Windows\system32\aswBoot.exe
2012-04-02 18:16:30 ----A---- C:\Windows\SYSWOW64\aswBoot.exe
2012-04-02 18:16:30 ----A---- C:\Windows\avastSS.scr
2012-04-02 18:16:24 ----D---- C:\ProgramData\AVAST Software
2012-04-02 18:16:24 ----D---- C:\Program Files\AVAST Software
2012-04-02 11:43:33 ----D---- C:\rsit
2012-04-02 11:43:33 ----D---- C:\Program Files\trend micro
2012-04-02 11:32:58 ----A---- C:\TDSSKiller.2.7.23.0_02.04.2012_11.32.58_log.txt
2012-04-02 10:52:23 ----D---- C:\Users\Jan\AppData\Roaming\Malwarebytes
2012-04-02 10:52:20 ----D---- C:\ProgramData\Malwarebytes
2012-04-02 10:52:19 ----D---- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-04-02 10:52:19 ----A---- C:\Windows\system32\drivers\mbam.sys
2012-04-02 10:45:06 ----A---- C:\Windows\SYSWOW64\FlashPlayerInstaller.exe
2012-04-02 10:40:02 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2012-03-30 12:12:32 ----D---- C:\Program Files\CCleaner
2012-03-18 15:13:58 ----D---- C:\ProgramData\Windows
2012-03-14 19:49:00 ----A---- C:\Windows\system32\ntoskrnl.exe
2012-03-14 19:48:59 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2012-03-14 19:48:58 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2012-03-14 08:34:40 ----A---- C:\Windows\system32\win32k.sys
2012-03-14 08:34:40 ----A---- C:\Windows\system32\DWrite.dll
2012-03-14 08:34:39 ----A---- C:\Windows\SYSWOW64\DWrite.dll
2012-03-14 08:32:06 ----A---- C:\Windows\SYSWOW64\rdpcore.dll
2012-03-14 08:32:06 ----A---- C:\Windows\system32\rdpcore.dll
2012-03-14 08:32:05 ----A---- C:\Windows\system32\rdrmemptylst.exe
2012-03-14 08:32:05 ----A---- C:\Windows\system32\rdpwsx.dll
2012-03-14 08:32:05 ----A---- C:\Windows\system32\rdpcorekmts.dll
2012-03-14 08:32:05 ----A---- C:\Windows\system32\drivers\tdtcp.sys
2012-03-14 08:32:05 ----A---- C:\Windows\system32\drivers\rdpwd.sys
======List of files/folders modified in the last 1 month======
2012-04-02 18:27:36 ----D---- C:\Windows\Temp
2012-04-02 18:27:34 ----D---- C:\Windows\Prefetch
2012-04-02 18:26:45 ----D---- C:\Windows
2012-04-02 18:21:12 ----RD---- C:\Program Files (x86)
2012-04-02 18:21:11 ----SHD---- C:\Windows\Installer
2012-04-02 18:19:51 ----D---- C:\Windows\system32\Tasks
2012-04-02 18:18:04 ----D---- C:\Users\Jan\AppData\Roaming\Skype
2012-04-02 18:16:42 ----D---- C:\Windows\Tasks
2012-04-02 18:16:40 ----D---- C:\Windows\SysWOW64
2012-04-02 18:16:40 ----D---- C:\Windows\system32\drivers
2012-04-02 18:16:40 ----D---- C:\Windows\System32
2012-04-02 18:16:24 ----SHD---- C:\System Volume Information
2012-04-02 18:16:24 ----RD---- C:\Program Files
2012-04-02 18:16:24 ----HD---- C:\ProgramData
2012-04-02 17:51:22 ----D---- C:\Windows\system32\DriverStore
2012-04-02 17:51:22 ----D---- C:\Windows\system32\catroot
2012-04-02 17:51:22 ----D---- C:\Windows\inf
2012-04-02 15:00:24 ----A---- C:\Windows\system32\PerfStringBackup.INI
2012-04-02 12:42:41 ----D---- C:\Windows\system32\config
2012-04-02 10:40:40 ----D---- C:\Program Files (x86)\HTC
2012-04-02 06:37:54 ----D---- C:\Windows\system32\catroot2
2012-03-30 12:16:09 ----D---- C:\Users\Jan\AppData\Roaming\Media Player Classic
2012-03-30 12:14:14 ----D---- C:\Windows\Panther
2012-03-30 12:14:14 ----D---- C:\Windows\Logs
2012-03-30 12:14:14 ----D---- C:\Windows\debug
2012-03-26 09:03:05 ----D---- C:\ProgramData\Skype
2012-03-19 07:49:48 ----D---- C:\Program Files (x86)\Mozilla Firefox
2012-03-18 15:14:08 ----D---- C:\Windows\system32\sysprep
2012-03-14 19:53:04 ----D---- C:\Windows\winsxs
2012-03-14 19:48:23 ----A---- C:\Windows\system32\MRT.exe
2012-03-14 19:48:19 ----D---- C:\ProgramData\Microsoft Help
2012-03-14 09:49:05 ----D---- C:\Users\Jan\AppData\Roaming\vlc
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 JRAID;JRAID; C:\Windows\system32\DRIVERS\jraid.sys [2010-08-10 120920]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R1 aswRdr;aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [2012-03-07 53080]
R1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2012-03-07 819032]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2012-03-07 337240]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2012-03-07 59224]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-21 514560]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2012-03-07 24408]
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2012-03-07 69976]
R3 asmthub3;ASMedia USB3 Hub Service; C:\Windows\system32\DRIVERS\asmthub3.sys [2010-12-08 122856]
R3 asmtxhci;ASMEDIA XHCI Service; C:\Windows\system32\DRIVERS\asmtxhci.sys [2010-12-08 369640]
R3 AthBTPort;Atheros Virtual Bluetooth Class; C:\Windows\system32\DRIVERS\btath_flt.sys [2011-03-13 36000]
R3 AVerAF35;AVerMedia A867 USB DVB-T; C:\Windows\System32\Drivers\AVerAF35.sys [2010-09-21 804224]
R3 BTATH_A2DP;Bluetooth A2DP Audio Driver; C:\Windows\system32\drivers\btath_a2dp.sys [2011-03-13 298656]
R3 BTATH_BUS;Atheros Bluetooth Bus; C:\Windows\system32\DRIVERS\btath_bus.sys [2011-03-13 28832]
R3 BTATH_HCRP;Bluetooth HCRP Server driver; C:\Windows\system32\DRIVERS\btath_hcrp.sys [2011-03-13 201376]
R3 BTATH_LWFLT;Bluetooth LWFLT Device; C:\Windows\system32\DRIVERS\btath_lwflt.sys [2011-03-13 55456]
R3 BTATH_RCP;Bluetooth AVRCP Device; C:\Windows\system32\DRIVERS\btath_rcp.sys [2011-03-13 154272]
R3 BtFilter;BtFilter; C:\Windows\system32\DRIVERS\btfilter.sys [2011-03-13 280224]
R3 BthEnum;Ovladač pro Bluetooth Request Block; C:\Windows\system32\drivers\BthEnum.sys [2009-07-14 41984]
R3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
R3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2011-04-28 80384]
R3 e1cexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver C; C:\Windows\system32\DRIVERS\e1c62x64.sys [2010-09-21 313520]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2012-02-14 14692224]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2010-11-23 2565736]
R3 IntcDAud;Intel(R) Display Audio; C:\Windows\system32\DRIVERS\IntcDAud.sys [2011-08-23 317440]
R3 KovaPlusFltr;ROCCAT Kova[+] Mouse; C:\Windows\system32\drivers\KovaPlusFltr.sys [2010-01-25 15104]
R3 MBAMProtector;MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [2011-12-10 23152]
R3 MEIx64;Intel(R) Management Engine Interface; C:\Windows\system32\DRIVERS\HECIx64.sys [2010-10-19 56344]
R3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
S3 ATHDFU;Atheros Valkyrie USB BootROM; C:\Windows\System32\Drivers\AthDfu.sys [2011-03-13 51872]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2011-04-28 552960]
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
S3 HTCAND64;HTC Device Driver; C:\Windows\System32\Drivers\ANDROIDUSB.sys [2009-11-02 33736]
S3 htcnprot;HTC NDIS Protocol Driver; C:\Windows\system32\DRIVERS\htcnprot.sys [2010-06-25 36928]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-21 165888]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-21 6656]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-21 34688]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 usb_rndisx;Adaptér USB RNDIS; C:\Windows\system32\DRIVERS\usb8023x.sys [2009-07-14 19968]
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-21 199552]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-21 21760]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
R2 AtherosSvc;AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [2011-03-13 74912]
R2 Autodesk Content Service;Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [2011-02-02 18656]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2012-03-07 44768]
R2 AVerRemote;AVerRemote; C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe [2010-04-27 348160]
R2 AVerScheduleService;AVerScheduleService; C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe [2011-04-01 403456]
R2 AVerUpdateServer;AVerUpdateServer; C:\Program Files (x86)\AVerMedia\AVerUpdate\AVerUpdateServer.exe [2011-01-06 168448]
R2 BCUService;Browser Configuration Utility Service; C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe [2009-10-26 223464]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 Intel® PROSet Monitoring Service;Intel® PROSet Monitoring Service; C:\Windows\system32\IProsetMonitor.exe [2010-08-12 133800]
R2 MBAMService;MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-01-13 652360]
R2 PassThru Service;Internet Pass-Through Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [2011-08-12 87040]
R2 SnugTV Service;SnugTV Service; C:\Program Files (x86)\SnugTV\SnugTV Station\AMAServer.exe [2011-04-06 571904]
R3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-04-02 136176]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 253600]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2010-03-18 44376]
S3 cphs;Intel(R) Content Protection HECI Service; C:\Windows\SysWow64\IntelCpHeciSvc.exe [2012-02-14 276248]
S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2011-11-09 1431888]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-04-02 136176]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service; C:\Program Files\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 51740536]
S3 ose64;Office 64 Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2011-09-18 1255736]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
-----------------EOF-----------------
Re: Win32/TrojanDownloader.Mebload.AR
TDSSKiller:
11:32:58.0655 2892 TDSS rootkit removing tool 2.7.23.0 Mar 26 2012 13:40:18
11:32:58.0754 2892 ============================================================
11:32:58.0754 2892 Current date / time: 2012/04/02 11:32:58.0753
11:32:58.0754 2892 SystemInfo:
11:32:58.0754 2892
11:32:58.0754 2892 OS Version: 6.1.7601 ServicePack: 1.0
11:32:58.0754 2892 Product type: Workstation
11:32:58.0754 2892 ComputerName: JAN-PC
11:32:58.0754 2892 UserName: Jan
11:32:58.0754 2892 Windows directory: C:\Windows
11:32:58.0754 2892 System windows directory: C:\Windows
11:32:58.0754 2892 Running under WOW64
11:32:58.0754 2892 Processor architecture: Intel x64
11:32:58.0754 2892 Number of processors: 4
11:32:58.0754 2892 Page size: 0x1000
11:32:58.0754 2892 Boot type: Normal boot
11:32:58.0754 2892 ============================================================
11:32:58.0963 2892 Drive \Device\Harddisk1\DR1 - Size: 0xDF99E6000 (55.90 Gb), SectorSize: 0x200, Cylinders: 0x1C81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
11:32:58.0972 2892 Drive \Device\Harddisk0\DR0 - Size: 0xAEA8CDE000 (698.64 Gb), SectorSize: 0x200, Cylinders: 0x16441, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
11:32:59.0029 2892 \Device\Harddisk1\DR1:
11:32:59.0029 2892 MBR used
11:32:59.0029 2892 \Device\Harddisk1\DR1\Partition0: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x6F99800
11:32:59.0029 2892 \Device\Harddisk0\DR0:
11:32:59.0029 2892 MBR used
11:32:59.0029 2892 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x57545000
11:32:59.0046 2892 Initialize success
11:32:59.0046 2892 ============================================================
11:33:11.0086 4176 ============================================================
11:33:11.0087 4176 Scan started
11:33:11.0087 4176 Mode: Manual;
11:33:11.0087 4176 ============================================================
11:33:11.0328 4176 1394ohci (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
11:33:11.0333 4176 1394ohci - ok
11:33:11.0350 4176 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
11:33:11.0356 4176 ACPI - ok
11:33:11.0367 4176 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
11:33:11.0369 4176 AcpiPmi - ok
11:33:11.0377 4176 AdobeARMservice (62b7936f9036dd6ed36e6a7efa805dc0) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
11:33:11.0379 4176 AdobeARMservice - ok
11:33:11.0392 4176 AdobeFlashPlayerUpdateSvc (0d4c486a24a711a45fd83acdf4d18506) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
11:33:11.0396 4176 AdobeFlashPlayerUpdateSvc - ok
11:33:11.0413 4176 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\drivers\adp94xx.sys
11:33:11.0418 4176 adp94xx - ok
11:33:11.0431 4176 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\drivers\adpahci.sys
11:33:11.0435 4176 adpahci - ok
11:33:11.0447 4176 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\drivers\adpu320.sys
11:33:11.0449 4176 adpu320 - ok
11:33:11.0460 4176 AeLookupSvc (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll
11:33:11.0461 4176 AeLookupSvc - ok
11:33:11.0475 4176 AFD (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys
11:33:11.0480 4176 AFD - ok
11:33:11.0490 4176 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
11:33:11.0491 4176 agp440 - ok
11:33:11.0501 4176 ALG (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe
11:33:11.0502 4176 ALG - ok
11:33:11.0512 4176 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
11:33:11.0513 4176 aliide - ok
11:33:11.0523 4176 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
11:33:11.0523 4176 amdide - ok
11:33:11.0534 4176 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\drivers\amdk8.sys
11:33:11.0535 4176 AmdK8 - ok
11:33:11.0545 4176 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\drivers\amdppm.sys
11:33:11.0546 4176 AmdPPM - ok
11:33:11.0557 4176 amdsata (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
11:33:11.0558 4176 amdsata - ok
11:33:11.0570 4176 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\drivers\amdsbs.sys
11:33:11.0572 4176 amdsbs - ok
11:33:11.0582 4176 amdxata (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
11:33:11.0583 4176 amdxata - ok
11:33:11.0594 4176 AppID (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
11:33:11.0595 4176 AppID - ok
11:33:11.0604 4176 AppIDSvc (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll
11:33:11.0605 4176 AppIDSvc - ok
11:33:11.0615 4176 Appinfo (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll
11:33:11.0616 4176 Appinfo - ok
11:33:11.0629 4176 AppMgmt (4aba3e75a76195a3e38ed2766c962899) C:\Windows\System32\appmgmts.dll
11:33:11.0631 4176 AppMgmt - ok
11:33:11.0641 4176 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\drivers\arc.sys
11:33:11.0643 4176 arc - ok
11:33:11.0653 4176 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\drivers\arcsas.sys
11:33:11.0655 4176 arcsas - ok
11:33:11.0665 4176 asmthub3 (e1e75921e9eb025009696d4837f531fb) C:\Windows\system32\DRIVERS\asmthub3.sys
11:33:11.0667 4176 asmthub3 - ok
11:33:11.0682 4176 asmtxhci (b0cf9ab16006b61634d4f955345ca5d2) C:\Windows\system32\DRIVERS\asmtxhci.sys
11:33:11.0685 4176 asmtxhci - ok
11:33:11.0692 4176 aspnet_state (9217d874131ae6ff8f642f124f00a555) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
11:33:11.0693 4176 aspnet_state - ok
11:33:11.0704 4176 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
11:33:11.0705 4176 AsyncMac - ok
11:33:11.0715 4176 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
11:33:11.0716 4176 atapi - ok
11:33:11.0726 4176 AthBTPort (cbe61b4494165f458bd87e37181ee934) C:\Windows\system32\DRIVERS\btath_flt.sys
11:33:11.0727 4176 AthBTPort - ok
11:33:11.0738 4176 ATHDFU (4119870b90e1b5e7797d6433d21f9216) C:\Windows\system32\Drivers\AthDfu.sys
11:33:11.0738 4176 ATHDFU - ok
11:33:11.0741 4176 AtherosSvc (21753130331188c4b474e1d3b396e629) C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
11:33:11.0743 4176 AtherosSvc - ok
11:33:11.0762 4176 AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
11:33:11.0772 4176 AudioEndpointBuilder - ok
11:33:11.0784 4176 AudioSrv (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
11:33:11.0787 4176 AudioSrv - ok
11:33:11.0790 4176 Autodesk Content Service (1992c2a1867d95aa3a0802539358d162) C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
11:33:11.0791 4176 Autodesk Content Service - ok
11:33:11.0815 4176 AVerAF35 (b7dece0f526f6e896b851e8f271d2842) C:\Windows\system32\Drivers\AVerAF35.sys
11:33:11.0826 4176 AVerAF35 - ok
11:33:11.0834 4176 AVerRemote (b085322dc9984b31190bd80d2542329f) C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe
11:33:11.0841 4176 AVerRemote - ok
11:33:11.0849 4176 AVerScheduleService (3094f37d17c9f91632689ffe9381fc4b) C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe
11:33:11.0855 4176 AVerScheduleService - ok
11:33:11.0859 4176 AVerUpdateServer (ac116b5ebd1cd55eb4fa6399dc3abc3d) C:\Program Files (x86)\AVerMedia\AVerUpdate\AVerUpdateServer.exe
11:33:11.0861 4176 AVerUpdateServer - ok
11:33:11.0871 4176 AxInstSV (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll
11:33:11.0872 4176 AxInstSV - ok
11:33:11.0887 4176 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\drivers\bxvbda.sys
11:33:11.0891 4176 b06bdrv - ok
11:33:11.0903 4176 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
11:33:11.0906 4176 b57nd60a - ok
11:33:11.0912 4176 BCUService (7ed4e1d2e124ad4e6a287cf49dbc9bba) C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe
11:33:11.0915 4176 BCUService - ok
11:33:11.0925 4176 BDESVC (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll
11:33:11.0927 4176 BDESVC - ok
11:33:11.0937 4176 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
11:33:11.0938 4176 Beep - ok
11:33:11.0957 4176 BFE (82974d6a2fd19445cc5171fc378668a4) C:\Windows\System32\bfe.dll
11:33:11.0966 4176 BFE - ok
11:33:11.0987 4176 BITS (1ea7969e3271cbc59e1730697dc74682) C:\Windows\System32\qmgr.dll
11:33:11.0998 4176 BITS - ok
11:33:12.0008 4176 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
11:33:12.0009 4176 blbdrive - ok
11:33:12.0020 4176 bowser (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
11:33:12.0021 4176 bowser - ok
11:33:12.0031 4176 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\drivers\BrFiltLo.sys
11:33:12.0032 4176 BrFiltLo - ok
11:33:12.0041 4176 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\drivers\BrFiltUp.sys
11:33:12.0042 4176 BrFiltUp - ok
11:33:12.0053 4176 Browser (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll
11:33:12.0056 4176 Browser - ok
11:33:12.0067 4176 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
11:33:12.0070 4176 Brserid - ok
11:33:12.0080 4176 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
11:33:12.0081 4176 BrSerWdm - ok
11:33:12.0091 4176 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
11:33:12.0092 4176 BrUsbMdm - ok
11:33:12.0102 4176 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
11:33:12.0103 4176 BrUsbSer - ok
11:33:12.0117 4176 BTATH_A2DP (fe70889a85c57a9268101b2db0474509) C:\Windows\system32\drivers\btath_a2dp.sys
11:33:12.0121 4176 BTATH_A2DP - ok
11:33:12.0133 4176 BTATH_BUS (a83a91d07d1fe6bbe7a9db46ca00434b) C:\Windows\system32\DRIVERS\btath_bus.sys
11:33:12.0134 4176 BTATH_BUS - ok
11:33:12.0147 4176 BTATH_HCRP (c864ff85ee16d61c2bdd5ef76824625f) C:\Windows\system32\DRIVERS\btath_hcrp.sys
11:33:12.0151 4176 BTATH_HCRP - ok
11:33:12.0162 4176 BTATH_LWFLT (0dea505efb5d771826d177ef8b8a208f) C:\Windows\system32\DRIVERS\btath_lwflt.sys
11:33:12.0163 4176 BTATH_LWFLT - ok
11:33:12.0175 4176 BTATH_RCP (724c8088c96efe7a3e63fec21d4681c0) C:\Windows\system32\DRIVERS\btath_rcp.sys
11:33:12.0176 4176 BTATH_RCP - ok
11:33:12.0192 4176 BtFilter (aa0f5afcf077c5246589b32eceeae566) C:\Windows\system32\DRIVERS\btfilter.sys
11:33:12.0195 4176 BtFilter - ok
11:33:12.0206 4176 BthEnum (cf98190a94f62e405c8cb255018b2315) C:\Windows\system32\drivers\BthEnum.sys
11:33:12.0207 4176 BthEnum - ok
11:33:12.0218 4176 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\drivers\bthmodem.sys
11:33:12.0219 4176 BTHMODEM - ok
11:33:12.0230 4176 BthPan (02dd601b708dd0667e1331fa8518e9ff) C:\Windows\system32\DRIVERS\bthpan.sys
11:33:12.0231 4176 BthPan - ok
11:33:12.0245 4176 BTHPORT (64c198198501f7560ee41d8d1efa7952) C:\Windows\System32\Drivers\BTHport.sys
11:33:12.0250 4176 BTHPORT - ok
11:33:12.0260 4176 bthserv (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll
11:33:12.0262 4176 bthserv - ok
11:33:12.0272 4176 BTHUSB (f188b7394d81010767b6df3178519a37) C:\Windows\System32\Drivers\BTHUSB.sys
11:33:12.0273 4176 BTHUSB - ok
11:33:12.0284 4176 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
11:33:12.0285 4176 cdfs - ok
11:33:12.0296 4176 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\DRIVERS\cdrom.sys
11:33:12.0298 4176 cdrom - ok
11:33:12.0309 4176 CertPropSvc (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
11:33:12.0310 4176 CertPropSvc - ok
11:33:12.0321 4176 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
11:33:12.0322 4176 circlass - ok
11:33:12.0336 4176 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
11:33:12.0341 4176 CLFS - ok
11:33:12.0347 4176 clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
11:33:12.0348 4176 clr_optimization_v2.0.50727_32 - ok
11:33:12.0352 4176 clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
11:33:12.0354 4176 clr_optimization_v2.0.50727_64 - ok
11:33:12.0359 4176 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
11:33:12.0360 4176 clr_optimization_v4.0.30319_32 - ok
11:33:12.0365 4176 clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
11:33:12.0368 4176 clr_optimization_v4.0.30319_64 - ok
11:33:12.0378 4176 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\drivers\CmBatt.sys
11:33:12.0379 4176 CmBatt - ok
11:33:12.0389 4176 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
11:33:12.0389 4176 cmdide - ok
11:33:12.0407 4176 CNG (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys
11:33:12.0414 4176 CNG - ok
11:33:12.0424 4176 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\drivers\compbatt.sys
11:33:12.0425 4176 Compbatt - ok
11:33:12.0436 4176 CompositeBus (03edb043586cceba243d689bdda370a8) C:\Windows\system32\DRIVERS\CompositeBus.sys
11:33:12.0437 4176 CompositeBus - ok
11:33:12.0445 4176 COMSysApp - ok
11:33:12.0457 4176 cphs (df3e8c2c443d3618260dff5705ce2df5) C:\Windows\SysWow64\IntelCpHeciSvc.exe
11:33:12.0460 4176 cphs - ok
11:33:12.0469 4176 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\drivers\crcdisk.sys
11:33:12.0470 4176 crcdisk - ok
11:33:12.0483 4176 CryptSvc (15597883fbe9b056f276ada3ad87d9af) C:\Windows\system32\cryptsvc.dll
11:33:12.0486 4176 CryptSvc - ok
11:33:12.0500 4176 CSC (54da3dfd29ed9f1619b6f53f3ce55e49) C:\Windows\system32\drivers\csc.sys
11:33:12.0505 4176 CSC - ok
11:33:12.0522 4176 CscService (3ab183ab4d2c79dcf459cd2c1266b043) C:\Windows\System32\cscsvc.dll
11:33:12.0530 4176 CscService - ok
11:33:12.0544 4176 DcomLaunch (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
11:33:12.0550 4176 DcomLaunch - ok
11:33:12.0562 4176 defragsvc (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll
11:33:12.0566 4176 defragsvc - ok
11:33:12.0577 4176 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
11:33:12.0578 4176 DfsC - ok
11:33:12.0591 4176 Dhcp (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll
11:33:12.0596 4176 Dhcp - ok
11:33:12.0606 4176 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
11:33:12.0607 4176 discache - ok
11:33:12.0618 4176 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\drivers\disk.sys
11:33:12.0620 4176 Disk - ok
11:33:12.0631 4176 dmvsc (5db085a8a6600be6401f2b24eecb5415) C:\Windows\system32\drivers\dmvsc.sys
11:33:12.0633 4176 dmvsc - ok
11:33:12.0644 4176 Dnscache (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll
11:33:12.0646 4176 Dnscache - ok
11:33:12.0657 4176 dot3svc (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll
11:33:12.0660 4176 dot3svc - ok
11:33:12.0671 4176 DPS (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll
11:33:12.0674 4176 DPS - ok
11:33:12.0684 4176 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
11:33:12.0684 4176 drmkaud - ok
11:33:12.0703 4176 DXGKrnl (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
11:33:12.0712 4176 DXGKrnl - ok
11:33:12.0726 4176 e1cexpress (6bafd9819d9fec2edbaebc8493c711a4) C:\Windows\system32\DRIVERS\e1c62x64.sys
11:33:12.0731 4176 e1cexpress - ok
11:33:12.0742 4176 eamonm (13533557d01b88c83110d5cf749f14d7) C:\Windows\system32\DRIVERS\eamonm.sys
11:33:12.0744 4176 eamonm - ok
11:33:12.0754 4176 EapHost (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll
11:33:12.0756 4176 EapHost - ok
11:33:12.0792 4176 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\drivers\evbda.sys
11:33:12.0815 4176 ebdrv - ok
11:33:12.0825 4176 EFS (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe
11:33:12.0826 4176 EFS - ok
11:33:12.0839 4176 ehdrv (e097728129e7b79bf1089d7aef42332b) C:\Windows\system32\DRIVERS\ehdrv.sys
11:33:12.0842 4176 ehdrv - ok
11:33:12.0852 4176 ehRecvr (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe
11:33:12.0860 4176 ehRecvr - ok
11:33:12.0863 4176 ehSched (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe
11:33:12.0865 4176 ehSched - ok
11:33:12.0882 4176 ekrn (3b944199f8edd76be94460c0361409ab) C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
11:33:12.0894 4176 ekrn - ok
11:33:12.0909 4176 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\drivers\elxstor.sys
11:33:12.0913 4176 elxstor - ok
11:33:12.0924 4176 epfwwfpr (2380976cf8a4a56611f35633acd2a74f) C:\Windows\system32\DRIVERS\epfwwfpr.sys
11:33:12.0926 4176 epfwwfpr - ok
11:33:12.0936 4176 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
11:33:12.0937 4176 ErrDev - ok
11:33:12.0952 4176 EventSystem (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll
11:33:12.0958 4176 EventSystem - ok
11:33:12.0970 4176 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
11:33:12.0972 4176 exfat - ok
11:33:12.0983 4176 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
11:33:12.0986 4176 fastfat - ok
11:33:13.0001 4176 Fax (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe
11:33:13.0007 4176 Fax - ok
11:33:13.0017 4176 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\drivers\fdc.sys
11:33:13.0018 4176 fdc - ok
11:33:13.0027 4176 fdPHost (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll
11:33:13.0028 4176 fdPHost - ok
11:33:13.0037 4176 FDResPub (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll
11:33:13.0039 4176 FDResPub - ok
11:33:13.0049 4176 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
11:33:13.0050 4176 FileInfo - ok
11:33:13.0060 4176 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
11:33:13.0061 4176 Filetrace - ok
11:33:13.0076 4176 FLEXnet Licensing Service 64 (5cee6cd43ae5844c49300ea0b1e557ee) C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
11:33:13.0087 4176 FLEXnet Licensing Service 64 - ok
11:33:13.0097 4176 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\drivers\flpydisk.sys
11:33:13.0098 4176 flpydisk - ok
11:33:13.0113 4176 FltMgr (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
11:33:13.0117 4176 FltMgr - ok
11:33:13.0143 4176 FontCache (5c4cb4086fb83115b153e47add961a0c) C:\Windows\system32\FntCache.dll
11:33:13.0157 4176 FontCache - ok
11:33:13.0161 4176 FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
11:33:13.0162 4176 FontCache3.0.0.0 - ok
11:33:13.0172 4176 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
11:33:13.0174 4176 FsDepends - ok
11:33:13.0184 4176 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys
11:33:13.0185 4176 Fs_Rec - ok
11:33:13.0197 4176 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
11:33:13.0200 4176 fvevol - ok
11:33:13.0211 4176 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\drivers\gagp30kx.sys
11:33:13.0212 4176 gagp30kx - ok
11:33:13.0232 4176 gpsvc (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll
11:33:13.0242 4176 gpsvc - ok
11:33:13.0252 4176 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
11:33:13.0253 4176 hcw85cir - ok
11:33:13.0268 4176 HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
11:33:13.0273 4176 HdAudAddService - ok
11:33:13.0283 4176 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\DRIVERS\HDAudBus.sys
11:33:13.0284 4176 HDAudBus - ok
11:33:13.0294 4176 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\drivers\HidBatt.sys
11:33:13.0295 4176 HidBatt - ok
11:33:13.0305 4176 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\drivers\hidbth.sys
11:33:13.0307 4176 HidBth - ok
11:33:13.0317 4176 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
11:33:13.0319 4176 HidIr - ok
11:33:13.0328 4176 hidserv (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll
11:33:13.0329 4176 hidserv - ok
11:33:13.0340 4176 HidUsb (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys
11:33:13.0341 4176 HidUsb - ok
11:33:13.0351 4176 hkmsvc (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll
11:33:13.0353 4176 hkmsvc - ok
11:33:13.0364 4176 HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll
11:33:13.0366 4176 HomeGroupListener - ok
11:33:13.0378 4176 HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll
11:33:13.0382 4176 HomeGroupProvider - ok
11:33:13.0392 4176 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
11:33:13.0394 4176 HpSAMD - ok
11:33:13.0404 4176 HTCAND64 (f47cec45fb85791d4ab237563ad0fa8f) C:\Windows\system32\Drivers\ANDROIDUSB.sys
11:33:13.0404 4176 HTCAND64 - ok
11:33:13.0416 4176 htcnprot (b8b1b284362e1d8135112573395d5da5) C:\Windows\system32\DRIVERS\htcnprot.sys
11:33:13.0416 4176 htcnprot - ok
11:33:13.0433 4176 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
11:33:13.0439 4176 HTTP - ok
11:33:13.0450 4176 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
11:33:13.0451 4176 hwpolicy - ok
11:33:13.0462 4176 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
11:33:13.0464 4176 i8042prt - ok
11:33:13.0477 4176 iaStorV (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
11:33:13.0481 4176 iaStorV - ok
11:33:13.0491 4176 idsvc (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
11:33:13.0498 4176 idsvc - ok
11:33:13.0636 4176 igfx (276ee9cdab16c50e1df0e4cefa882f5f) C:\Windows\system32\DRIVERS\igdkmd64.sys
11:33:13.0695 4176 igfx - ok
11:33:13.0707 4176 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\drivers\iirsp.sys
11:33:13.0708 4176 iirsp - ok
11:33:13.0724 4176 IKEEXT (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll
11:33:13.0731 4176 IKEEXT - ok
11:33:13.0765 4176 IntcAzAudAddService (589b94a9b73a0e819ff873743a480834) C:\Windows\system32\drivers\RTKVHD64.sys
11:33:13.0784 4176 IntcAzAudAddService - ok
11:33:13.0797 4176 IntcDAud (ae594cc17c33ac146739494615e14851) C:\Windows\system32\DRIVERS\IntcDAud.sys
11:33:13.0801 4176 IntcDAud - ok
11:33:13.0811 4176 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
11:33:13.0812 4176 intelide - ok
11:33:13.0824 4176 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
11:33:13.0826 4176 intelppm - ok
11:33:13.0837 4176 Intel® PROSet Monitoring Service (068ec06f3b6dd7b81b365d8fd2ce27e6) C:\Windows\system32\IProsetMonitor.exe
11:33:13.0839 4176 Intel® PROSet Monitoring Service - ok
11:33:13.0849 4176 IPBusEnum (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll
11:33:13.0850 4176 IPBusEnum - ok
11:33:13.0861 4176 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
11:33:13.0862 4176 IpFilterDriver - ok
11:33:13.0879 4176 iphlpsvc (a34a587fffd45fa649fba6d03784d257) C:\Windows\System32\iphlpsvc.dll
11:33:13.0887 4176 iphlpsvc - ok
11:33:13.0897 4176 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
11:33:13.0898 4176 IPMIDRV - ok
11:33:13.0909 4176 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
11:33:13.0910 4176 IPNAT - ok
11:33:13.0920 4176 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
11:33:13.0922 4176 IRENUM - ok
11:33:13.0932 4176 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
11:33:13.0933 4176 isapnp - ok
11:33:13.0944 4176 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
11:33:13.0947 4176 iScsiPrt - ok
11:33:13.0959 4176 JRAID (a577f5db30f70eca9708c07c2eacbd9d) C:\Windows\system32\DRIVERS\jraid.sys
11:33:13.0960 4176 JRAID - ok
11:33:13.0971 4176 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys
11:33:13.0972 4176 kbdclass - ok
11:33:13.0983 4176 kbdhid (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\DRIVERS\kbdhid.sys
11:33:13.0984 4176 kbdhid - ok
11:33:13.0994 4176 KeyIso (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
11:33:13.0995 4176 KeyIso - ok
11:33:14.0005 4176 KovaPlusFltr (b355cdd82f914d681dadef1049d8174a) C:\Windows\system32\drivers\KovaPlusFltr.sys
11:33:14.0006 4176 KovaPlusFltr - ok
11:33:14.0017 4176 KSecDD (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys
11:33:14.0019 4176 KSecDD - ok
11:33:14.0030 4176 KSecPkg (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys
11:33:14.0032 4176 KSecPkg - ok
11:33:14.0042 4176 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
11:33:14.0043 4176 ksthunk - ok
11:33:14.0055 4176 KtmRm (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll
11:33:14.0059 4176 KtmRm - ok
11:33:14.0070 4176 LanmanServer (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\system32\srvsvc.dll
11:33:14.0073 4176 LanmanServer - ok
11:33:14.0083 4176 LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll
11:33:14.0085 4176 LanmanWorkstation - ok
11:33:14.0097 4176 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
11:33:14.0098 4176 lltdio - ok
11:33:14.0109 4176 lltdsvc (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll
11:33:14.0113 4176 lltdsvc - ok
11:33:14.0122 4176 lmhosts (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll
11:33:14.0124 4176 lmhosts - ok
11:33:14.0135 4176 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\drivers\lsi_fc.sys
11:33:14.0137 4176 LSI_FC - ok
11:33:14.0148 4176 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\drivers\lsi_sas.sys
11:33:14.0149 4176 LSI_SAS - ok
11:33:14.0160 4176 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\drivers\lsi_sas2.sys
11:33:14.0161 4176 LSI_SAS2 - ok
11:33:14.0172 4176 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\drivers\lsi_scsi.sys
11:33:14.0173 4176 LSI_SCSI - ok
11:33:14.0184 4176 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
11:33:14.0186 4176 luafv - ok
11:33:14.0197 4176 MBAMProtector (79da94b35371b9e7104460c7693dcb2c) C:\Windows\system32\drivers\mbam.sys
11:33:14.0198 4176 MBAMProtector - ok
11:33:14.0206 4176 MBAMService (056b19651bd7b7ce5f89a3ac46dbdc08) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
11:33:14.0212 4176 MBAMService - ok
11:33:14.0223 4176 Mcx2Svc (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll
11:33:14.0225 4176 Mcx2Svc - ok
11:33:14.0236 4176 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\drivers\megasas.sys
11:33:14.0237 4176 megasas - ok
11:33:14.0249 4176 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\drivers\MegaSR.sys
11:33:14.0252 4176 MegaSR - ok
11:33:14.0262 4176 MEIx64 (a6518dcc42f7a6e999bb3bea8fd87567) C:\Windows\system32\DRIVERS\HECIx64.sys
11:33:14.0263 4176 MEIx64 - ok
11:33:14.0267 4176 Microsoft SharePoint Workspace Audit Service - ok
11:33:14.0278 4176 MMCSS (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
11:33:14.0280 4176 MMCSS - ok
11:33:14.0290 4176 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
11:33:14.0291 4176 Modem - ok
11:33:14.0302 4176 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
11:33:14.0303 4176 monitor - ok
11:33:14.0313 4176 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
11:33:14.0314 4176 mouclass - ok
11:33:14.0324 4176 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
11:33:14.0325 4176 mouhid - ok
11:33:14.0335 4176 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
11:33:14.0337 4176 mountmgr - ok
11:33:14.0349 4176 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
11:33:14.0351 4176 mpio - ok
11:33:14.0362 4176 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
11:33:14.0363 4176 mpsdrv - ok
11:33:14.0384 4176 MpsSvc (54ffc9c8898113ace189d4aa7199d2c1) C:\Windows\system32\mpssvc.dll
11:33:14.0396 4176 MpsSvc - ok
11:33:14.0407 4176 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
11:33:14.0408 4176 MRxDAV - ok
11:33:14.0420 4176 mrxsmb (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
11:33:14.0423 4176 mrxsmb - ok
11:33:14.0438 4176 mrxsmb10 (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
11:33:14.0442 4176 mrxsmb10 - ok
11:33:14.0453 4176 mrxsmb20 (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
11:33:14.0455 4176 mrxsmb20 - ok
11:33:14.0465 4176 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
11:33:14.0466 4176 msahci - ok
11:33:14.0477 4176 msdsm (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
11:33:14.0479 4176 msdsm - ok
11:33:14.0489 4176 MSDTC (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe
11:33:14.0491 4176 MSDTC - ok
11:33:14.0502 4176 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
11:33:14.0503 4176 Msfs - ok
11:33:14.0513 4176 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
11:33:14.0514 4176 mshidkmdf - ok
11:33:14.0523 4176 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
11:33:14.0524 4176 msisadrv - ok
11:33:14.0534 4176 MSiSCSI (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll
11:33:14.0537 4176 MSiSCSI - ok
11:33:14.0545 4176 msiserver - ok
11:33:14.0558 4176 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
11:33:14.0559 4176 MSKSSRV - ok
11:33:14.0569 4176 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
11:33:14.0570 4176 MSPCLOCK - ok
11:33:14.0580 4176 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
11:33:14.0580 4176 MSPQM - ok
11:33:14.0593 4176 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
11:33:14.0595 4176 MsRPC - ok
11:33:14.0607 4176 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\DRIVERS\mssmbios.sys
11:33:14.0608 4176 mssmbios - ok
11:33:14.0617 4176 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
11:33:14.0618 4176 MSTEE - ok
11:33:14.0627 4176 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\drivers\MTConfig.sys
11:33:14.0628 4176 MTConfig - ok
11:33:14.0638 4176 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
11:33:14.0639 4176 Mup - ok
11:33:14.0652 4176 napagent (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll
11:33:14.0657 4176 napagent - ok
11:33:14.0669 4176 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
11:33:14.0672 4176 NativeWifiP - ok
11:33:14.0692 4176 NDIS (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
11:33:14.0700 4176 NDIS - ok
11:33:14.0710 4176 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
11:33:14.0711 4176 NdisCap - ok
11:33:14.0721 4176 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
11:33:14.0722 4176 NdisTapi - ok
11:33:14.0733 4176 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
11:33:14.0734 4176 Ndisuio - ok
11:33:14.0746 4176 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
11:33:14.0749 4176 NdisWan - ok
11:33:14.0760 4176 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
11:33:14.0761 4176 NDProxy - ok
11:33:14.0771 4176 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
11:33:14.0773 4176 NetBIOS - ok
11:33:14.0786 4176 NetBT (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
11:33:14.0790 4176 NetBT - ok
11:33:14.0800 4176 Netlogon (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
11:33:14.0801 4176 Netlogon - ok
11:33:14.0813 4176 Netman (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll
11:33:14.0817 4176 Netman - ok
11:33:14.0823 4176 NetMsmqActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
11:33:14.0824 4176 NetMsmqActivator - ok
11:33:14.0827 4176 NetPipeActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
11:33:14.0827 4176 NetPipeActivator - ok
11:33:14.0841 4176 netprofm (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll
11:33:14.0845 4176 netprofm - ok
11:33:14.0851 4176 NetTcpActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
11:33:14.0851 4176 NetTcpActivator - ok
11:33:14.0854 4176 NetTcpPortSharing (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
11:33:14.0855 4176 NetTcpPortSharing - ok
11:33:14.0866 4176 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\drivers\nfrd960.sys
11:33:14.0867 4176 nfrd960 - ok
11:33:14.0879 4176 NlaSvc (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll
11:33:14.0882 4176 NlaSvc - ok
11:33:14.0893 4176 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
11:33:14.0894 4176 Npfs - ok
11:33:14.0903 4176 nsi (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll
11:33:14.0905 4176 nsi - ok
11:33:14.0915 4176 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
11:33:14.0915 4176 nsiproxy - ok
11:33:14.0953 4176 Ntfs (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
11:33:14.0974 4176 Ntfs - ok
11:33:14.0984 4176 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
11:33:14.0984 4176 Null - ok
11:33:14.0995 4176 nvraid (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
11:33:14.0997 4176 nvraid - ok
11:33:15.0008 4176 nvstor (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
11:33:15.0010 4176 nvstor - ok
11:33:15.0021 4176 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
11:33:15.0022 4176 nv_agp - ok
11:33:15.0032 4176 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
11:33:15.0034 4176 ohci1394 - ok
11:33:15.0038 4176 ose64 (4965b005492cba7719e82b71e3245495) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
11:33:15.0040 4176 ose64 - ok
11:33:15.0091 4176 osppsvc (61bffb5f57ad12f83ab64b7181829b34) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
11:33:15.0129 4176 osppsvc - ok
11:33:15.0143 4176 p2pimsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
11:33:15.0147 4176 p2pimsvc - ok
11:33:15.0160 4176 p2psvc (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll
11:33:15.0164 4176 p2psvc - ok
11:33:15.0175 4176 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\drivers\parport.sys
11:33:15.0176 4176 Parport - ok
11:33:15.0186 4176 partmgr (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys
11:33:15.0188 4176 partmgr - ok
11:33:15.0192 4176 PassThru Service (68139940b5ac84affb7eb1b713be66e7) C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
11:33:15.0193 4176 PassThru Service - ok
11:33:15.0203 4176 PcaSvc (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll
11:33:15.0206 4176 PcaSvc - ok
11:33:15.0218 4176 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
11:33:15.0221 4176 pci - ok
11:33:15.0231 4176 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
11:33:15.0232 4176 pciide - ok
11:33:15.0244 4176 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\drivers\pcmcia.sys
11:33:15.0245 4176 pcmcia - ok
11:33:15.0256 4176 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
11:33:15.0258 4176 pcw - ok
11:33:15.0273 4176 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
11:33:15.0278 4176 PEAUTH - ok
11:33:15.0309 4176 PeerDistSvc (b9b0a4299dd2d76a4243f75fd54dc680) C:\Windows\system32\peerdistsvc.dll
11:33:15.0325 4176 PeerDistSvc - ok
11:33:15.0335 4176 PerfHost (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe
11:33:15.0337 4176 PerfHost - ok
11:33:15.0360 4176 pla (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll
11:33:15.0371 4176 pla - ok
11:33:15.0385 4176 PlugPlay (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll
11:33:15.0389 4176 PlugPlay - ok
11:33:15.0399 4176 PNRPAutoReg (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll
11:33:15.0400 4176 PNRPAutoReg - ok
11:33:15.0412 4176 PNRPsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
11:33:15.0414 4176 PNRPsvc - ok
11:33:15.0428 4176 PolicyAgent (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll
11:33:15.0433 4176 PolicyAgent - ok
11:33:15.0444 4176 Power (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll
11:33:15.0447 4176 Power - ok
11:33:15.0459 4176 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
11:33:15.0461 4176 PptpMiniport - ok
11:33:15.0472 4176 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\drivers\processr.sys
11:33:15.0473 4176 Processor - ok
11:33:15.0484 4176 ProfSvc (5c78838b4d166d1a27db3a8a820c799a) C:\Windows\system32\profsvc.dll
11:33:15.0488 4176 ProfSvc - ok
11:33:15.0497 4176 ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
11:33:15.0498 4176 ProtectedStorage - ok
11:33:15.0510 4176 Psched (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
11:33:15.0511 4176 Psched - ok
11:33:15.0535 4176 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\drivers\ql2300.sys
11:33:15.0547 4176 ql2300 - ok
11:33:15.0558 4176 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\drivers\ql40xx.sys
11:33:15.0560 4176 ql40xx - ok
11:33:15.0571 4176 QWAVE (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll
11:33:15.0574 4176 QWAVE - ok
11:33:15.0584 4176 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
11:33:15.0585 4176 QWAVEdrv - ok
11:33:15.0595 4176 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
11:33:15.0596 4176 RasAcd - ok
11:33:15.0607 4176 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
11:33:15.0608 4176 RasAgileVpn - ok
11:33:15.0618 4176 RasAuto (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll
11:33:15.0620 4176 RasAuto - ok
11:33:15.0631 4176 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
11:33:15.0633 4176 Rasl2tp - ok
11:33:15.0644 4176 RasMan (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll
11:33:15.0648 4176 RasMan - ok
11:33:15.0659 4176 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
11:33:15.0660 4176 RasPppoe - ok
11:33:15.0671 4176 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
11:33:15.0672 4176 RasSstp - ok
11:33:15.0684 4176 rdbss (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
11:33:15.0687 4176 rdbss - ok
11:33:15.0697 4176 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
11:33:15.0698 4176 rdpbus - ok
11:33:15.0708 4176 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
11:33:15.0709 4176 RDPCDD - ok
11:33:15.0722 4176 RDPDR (1b6163c503398b23ff8b939c67747683) C:\Windows\system32\drivers\rdpdr.sys
11:33:15.0724 4176 RDPDR - ok
11:33:15.0735 4176 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
11:33:15.0735 4176 RDPENCDD - ok
11:33:15.0746 4176 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
11:33:15.0747 4176 RDPREFMP - ok
11:33:15.0758 4176 RDPWD (6d76e6433574b058adcb0c50df834492) C:\Windows\system32\drivers\RDPWD.sys
11:33:15.0760 4176 RDPWD - ok
11:33:15.0775 4176 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
11:33:15.0787 4176 rdyboost - ok
11:33:15.0798 4176 RemoteAccess (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll
11:33:15.0801 4176 RemoteAccess - ok
11:33:15.0813 4176 RemoteRegistry (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll
11:33:15.0817 4176 RemoteRegistry - ok
11:33:15.0832 4176 RFCOMM (3dd798846e2c28102b922c56e71b7932) C:\Windows\system32\DRIVERS\rfcomm.sys
11:33:15.0835 4176 RFCOMM - ok
11:33:15.0845 4176 RpcEptMapper (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll
11:33:15.0848 4176 RpcEptMapper - ok
11:33:15.0858 4176 RpcLocator (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe
11:33:15.0860 4176 RpcLocator - ok
11:33:15.0874 4176 RpcSs (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
11:33:15.0878 4176 RpcSs - ok
11:33:15.0889 4176 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
11:33:15.0891 4176 rspndr - ok
11:33:15.0901 4176 s3cap (e60c0a09f997826c7627b244195ab581) C:\Windows\system32\drivers\vms3cap.sys
11:33:15.0902 4176 s3cap - ok
11:33:15.0912 4176 SamSs (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
11:33:15.0913 4176 SamSs - ok
11:33:15.0924 4176 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
11:33:15.0926 4176 sbp2port - ok
11:33:15.0937 4176 SCardSvr (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll
11:33:15.0940 4176 SCardSvr - ok
11:33:15.0950 4176 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
11:33:15.0952 4176 scfilter - ok
11:33:15.0973 4176 Schedule (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll
11:33:15.0986 4176 Schedule - ok
11:33:15.0996 4176 SCPolicySvc (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
11:33:15.0997 4176 SCPolicySvc - ok
11:33:16.0008 4176 SDRSVC (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll
11:33:16.0010 4176 SDRSVC - ok
11:33:16.0021 4176 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
11:33:16.0021 4176 secdrv - ok
11:33:16.0031 4176 seclogon (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll
11:33:16.0032 4176 seclogon - ok
11:33:16.0042 4176 SENS (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll
11:33:16.0045 4176 SENS - ok
11:33:16.0054 4176 SensrSvc (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll
11:33:16.0056 4176 SensrSvc - ok
11:33:16.0066 4176 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\drivers\serenum.sys
11:33:16.0067 4176 Serenum - ok
11:33:16.0078 4176 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\drivers\serial.sys
11:33:16.0079 4176 Serial - ok
11:33:16.0089 4176 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\drivers\sermouse.sys
11:33:16.0090 4176 sermouse - ok
11:33:16.0103 4176 SessionEnv (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll
11:33:16.0105 4176 SessionEnv - ok
11:33:16.0115 4176 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
11:33:16.0116 4176 sffdisk - ok
11:33:16.0126 4176 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
11:33:16.0127 4176 sffp_mmc - ok
11:33:16.0136 4176 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
11:33:16.0137 4176 sffp_sd - ok
11:33:16.0147 4176 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\drivers\sfloppy.sys
11:33:16.0148 4176 sfloppy - ok
11:33:16.0160 4176 SharedAccess (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll
11:33:16.0163 4176 SharedAccess - ok
11:33:16.0176 4176 ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll
11:33:16.0179 4176 ShellHWDetection - ok
11:33:16.0190 4176 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\drivers\SiSRaid2.sys
11:33:16.0191 4176 SiSRaid2 - ok
11:33:16.0202 4176 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\drivers\sisraid4.sys
11:33:16.0203 4176 SiSRaid4 - ok
11:33:16.0214 4176 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
11:33:16.0216 4176 Smb - ok
11:33:16.0227 4176 SNMPTRAP (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe
11:33:16.0229 4176 SNMPTRAP - ok
11:33:16.0237 4176 SnugTV Service (834200790f0c41fafd0748a800bbd1f5) C:\Program Files (x86)\SnugTV\SnugTV Station\AMAServer.exe
11:33:16.0242 4176 SnugTV Service - ok
11:33:16.0252 4176 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
11:33:16.0253 4176 spldr - ok
11:33:16.0271 4176 Spooler (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe
11:33:16.0280 4176 Spooler - ok
11:33:16.0341 4176 sppsvc (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe
11:33:16.0386 4176 sppsvc - ok
11:33:16.0396 4176 sppuinotify (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll
11:33:16.0398 4176 sppuinotify - ok
11:33:16.0415 4176 srv (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
11:33:16.0421 4176 srv - ok
11:33:16.0434 4176 srv2 (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
11:33:16.0438 4176 srv2 - ok
11:33:16.0449 4176 srvnet (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
11:33:16.0451 4176 srvnet - ok
11:33:16.0463 4176 SSDPSRV (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll
11:33:16.0467 4176 SSDPSRV - ok
11:33:16.0476 4176 SstpSvc (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll
11:33:16.0478 4176 SstpSvc - ok
11:33:16.0489 4176 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\drivers\stexstor.sys
11:33:16.0490 4176 stexstor - ok
11:33:16.0504 4176 stisvc (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll
11:33:16.0509 4176 stisvc - ok
11:33:16.0520 4176 storflt (7785dc213270d2fc066538daf94087e7) C:\Windows\system32\drivers\vmstorfl.sys
11:33:16.0522 4176 storflt - ok
11:33:16.0532 4176 StorSvc (c40841817ef57d491f22eb103da587cc) C:\Windows\system32\storsvc.dll
11:33:16.0533 4176 StorSvc - ok
11:33:16.0543 4176 storvsc (d34e4943d5ac096c8edeebfd80d76e23) C:\Windows\system32\drivers\storvsc.sys
11:33:16.0544 4176 storvsc - ok
11:33:16.0554 4176 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\DRIVERS\swenum.sys
11:33:16.0555 4176 swenum - ok
11:33:16.0568 4176 swprv (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll
11:33:16.0573 4176 swprv - ok
11:33:16.0605 4176 SysMain (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll
11:33:16.0625 4176 SysMain - ok
11:33:16.0635 4176 TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll
11:33:16.0637 4176 TabletInputService - ok
11:33:16.0649 4176 TapiSrv (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll
11:33:16.0653 4176 TapiSrv - ok
11:33:16.0662 4176 TBS (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll
11:33:16.0664 4176 TBS - ok
11:33:16.0690 4176 Tcpip (fc62769e7bff2896035aeed399108162) C:\Windows\system32\drivers\tcpip.sys
11:33:16.0705 4176 Tcpip - ok
11:33:16.0730 4176 TCPIP6 (fc62769e7bff2896035aeed399108162) C:\Windows\system32\DRIVERS\tcpip.sys
11:33:16.0739 4176 TCPIP6 - ok
11:33:16.0751 4176 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
11:33:16.0752 4176 tcpipreg - ok
11:33:16.0762 4176 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
11:33:16.0763 4176 TDPIPE - ok
11:33:16.0773 4176 TDTCP (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys
11:33:16.0774 4176 TDTCP - ok
11:33:16.0785 4176 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
11:33:16.0787 4176 tdx - ok
11:33:16.0798 4176 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\DRIVERS\termdd.sys
11:33:16.0799 4176 TermDD - ok
11:33:16.0814 4176 TermService (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll
11:33:16.0820 4176 TermService - ok
11:33:16.0829 4176 Themes (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll
11:33:16.0831 4176 Themes - ok
11:33:16.0841 4176 THREADORDER (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
11:33:16.0842 4176 THREADORDER - ok
11:33:16.0852 4176 TrkWks (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll
11:33:16.0855 4176 TrkWks - ok
11:33:16.0860 4176 TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe
11:33:16.0862 4176 TrustedInstaller - ok
11:33:16.0873 4176 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
11:33:16.0875 4176 tssecsrv - ok
11:33:16.0885 4176 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
11:33:16.0887 4176 TsUsbFlt - ok
11:33:16.0897 4176 TsUsbGD (9cc2ccae8a84820eaecb886d477cbcb8) C:\Windows\system32\drivers\TsUsbGD.sys
11:33:16.0899 4176 TsUsbGD - ok
11:33:16.0910 4176 tunnel (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
11:33:16.0912 4176 tunnel - ok
11:33:16.0923 4176 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\drivers\uagp35.sys
11:33:16.0925 4176 uagp35 - ok
11:33:16.0938 4176 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
11:33:16.0942 4176 udfs - ok
11:33:16.0953 4176 UI0Detect (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe
11:33:16.0955 4176 UI0Detect - ok
11:33:16.0966 4176 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
11:33:16.0968 4176 uliagpkx - ok
11:33:16.0978 4176 umbus (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\DRIVERS\umbus.sys
11:33:16.0979 4176 umbus - ok
11:33:16.0990 4176 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\drivers\umpass.sys
11:33:16.0991 4176 UmPass - ok
11:33:17.0001 4176 UmRdpService (a293dcd756d04d8492a750d03b9a297c) C:\Windows\System32\umrdp.dll
11:33:17.0004 4176 UmRdpService - ok
11:33:17.0018 4176 upnphost (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll
11:33:17.0024 4176 upnphost - ok
11:33:17.0035 4176 usbccgp (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys
11:33:17.0036 4176 usbccgp - ok
11:33:17.0048 4176 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
11:33:17.0050 4176 usbcir - ok
11:33:17.0061 4176 usbehci (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\drivers\usbehci.sys
11:33:17.0062 4176 usbehci - ok
11:33:17.0075 4176 usbhub (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
11:33:17.0078 4176 usbhub - ok
11:33:17.0088 4176 usbohci (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\drivers\usbohci.sys
11:33:17.0089 4176 usbohci - ok
11:33:17.0100 4176 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\drivers\usbprint.sys
11:33:17.0101 4176 usbprint - ok
11:33:17.0112 4176 USBSTOR (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
11:33:17.0113 4176 USBSTOR - ok
11:33:17.0123 4176 usbuhci (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys
11:33:17.0125 4176 usbuhci - ok
11:33:17.0135 4176 usb_rndisx (70d05ee263568a742d14e1876df80532) C:\Windows\system32\DRIVERS\usb8023x.sys
11:33:17.0136 4176 usb_rndisx - ok
11:33:17.0145 4176 UxSms (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll
11:33:17.0147 4176 UxSms - ok
11:33:17.0157 4176 VaultSvc (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
11:33:17.0158 4176 VaultSvc - ok
11:33:17.0168 4176 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
11:33:17.0169 4176 vdrvroot - ok
11:33:17.0182 4176 vds (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe
11:33:17.0187 4176 vds - ok
11:33:17.0198 4176 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
11:33:17.0200 4176 vga - ok
11:33:17.0210 4176 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
11:33:17.0211 4176 VgaSave - ok
11:33:17.0222 4176 vhdmp (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
11:33:17.0224 4176 vhdmp - ok
11:33:17.0234 4176 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
11:33:17.0235 4176 viaide - ok
11:33:17.0247 4176 vmbus (86ea3e79ae350fea5331a1303054005f) C:\Windows\system32\drivers\vmbus.sys
11:33:17.0249 4176 vmbus - ok
11:33:17.0259 4176 VMBusHID (7de90b48f210d29649380545db45a187) C:\Windows\system32\drivers\VMBusHID.sys
11:33:17.0261 4176 VMBusHID - ok
11:33:17.0271 4176 volmgr (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
11:33:17.0273 4176 volmgr - ok
11:33:17.0287 4176 volmgrx (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
11:33:17.0291 4176 volmgrx - ok
11:33:17.0303 4176 volsnap (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
11:33:17.0306 4176 volsnap - ok
11:33:17.0318 4176 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\drivers\vsmraid.sys
11:33:17.0320 4176 vsmraid - ok
11:33:17.0351 4176 VSS (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe
11:33:17.0369 4176 VSS - ok
11:33:17.0379 4176 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys
11:33:17.0380 4176 vwifibus - ok
11:33:17.0393 4176 W32Time (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll
11:33:17.0397 4176 W32Time - ok
11:33:17.0408 4176 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\drivers\wacompen.sys
11:33:17.0409 4176 WacomPen - ok
11:33:17.0420 4176 WANARP (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
11:33:17.0421 4176 WANARP - ok
11:33:17.0424 4176 Wanarpv6 (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
11:33:17.0424 4176 Wanarpv6 - ok
11:33:17.0448 4176 WatAdminSvc (3cec96de223e49eaae3651fcf8faea6c) C:\Windows\system32\Wat\WatAdminSvc.exe
11:33:17.0467 4176 WatAdminSvc - ok
11:33:17.0490 4176 wbengine (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe
11:33:17.0502 4176 wbengine - ok
11:33:17.0513 4176 WbioSrvc (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll
11:33:17.0516 4176 WbioSrvc - ok
11:33:17.0528 4176 wcncsvc (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll
11:33:17.0532 4176 wcncsvc - ok
11:33:17.0541 4176 WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll
11:33:17.0544 4176 WcsPlugInService - ok
11:33:17.0554 4176 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\drivers\wd.sys
11:33:17.0555 4176 Wd - ok
11:33:17.0570 4176 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
11:33:17.0575 4176 Wdf01000 - ok
11:33:17.0586 4176 WdiServiceHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
11:33:17.0589 4176 WdiServiceHost - ok
11:33:17.0592 4176 WdiSystemHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
11:33:17.0593 4176 WdiSystemHost - ok
11:33:17.0605 4176 WebClient (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll
11:33:17.0608 4176 WebClient - ok
11:33:17.0619 4176 Wecsvc (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll
11:33:17.0622 4176 Wecsvc - ok
11:33:17.0632 4176 wercplsupport (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll
11:33:17.0634 4176 wercplsupport - ok
11:33:17.0644 4176 WerSvc (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll
11:33:17.0646 4176 WerSvc - ok
11:33:17.0657 4176 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
11:33:17.0658 4176 WfpLwf - ok
11:33:17.0668 4176 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
11:33:17.0669 4176 WIMMount - ok
11:33:17.0671 4176 WinDefend - ok
11:33:17.0675 4176 WinHttpAutoProxySvc - ok
11:33:17.0688 4176 Winmgmt (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll
11:33:17.0690 4176 Winmgmt - ok
11:33:17.0716 4176 WinRM (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll
11:33:17.0731 4176 WinRM - ok
11:33:17.0750 4176 Wlansvc (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll
11:33:17.0758 4176 Wlansvc - ok
11:33:17.0769 4176 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\DRIVERS\wmiacpi.sys
11:33:17.0770 4176 WmiAcpi - ok
11:33:17.0784 4176 wmiApSrv (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe
11:33:17.0787 4176 wmiApSrv - ok
11:33:17.0790 4176 WMPNetworkSvc - ok
11:33:17.0800 4176 WPCSvc (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll
11:33:17.0802 4176 WPCSvc - ok
11:33:17.0812 4176 WPDBusEnum (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll
11:33:17.0814 4176 WPDBusEnum - ok
11:33:17.0824 4176 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
11:33:17.0825 4176 ws2ifsl - ok
11:33:17.0835 4176 wscsvc (e8b1fe6669397d1772d8196df0e57a9e) C:\Windows\System32\wscsvc.dll
11:33:17.0837 4176 wscsvc - ok
11:33:17.0846 4176 WSearch - ok
11:33:17.0888 4176 wuauserv (9df12edbc698b0bc353b3ef84861e430) C:\Windows\system32\wuaueng.dll
11:33:17.0914 4176 wuauserv - ok
11:33:17.0925 4176 WudfPf (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
11:33:17.0926 4176 WudfPf - ok
11:33:17.0938 4176 WUDFRd (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
11:33:17.0940 4176 WUDFRd - ok
11:33:17.0951 4176 wudfsvc (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll
11:33:17.0955 4176 wudfsvc - ok
11:33:17.0966 4176 WwanSvc (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll
11:33:17.0969 4176 WwanSvc - ok
11:33:17.0976 4176 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk1\DR1
11:33:17.0979 4176 \Device\Harddisk1\DR1 - ok
11:33:17.0981 4176 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
11:33:17.0982 4176 \Device\Harddisk0\DR0 - ok
11:33:17.0984 4176 Boot (0x1200) (9343de7a8339f4021d2b90fe1d650bdc) \Device\Harddisk1\DR1\Partition0
11:33:17.0985 4176 \Device\Harddisk1\DR1\Partition0 - ok
11:33:17.0986 4176 Boot (0x1200) (6c7dd7eea124b85bf588c21804e49673) \Device\Harddisk0\DR0\Partition0
11:33:17.0987 4176 \Device\Harddisk0\DR0\Partition0 - ok
11:33:17.0987 4176 ============================================================
11:33:17.0987 4176 Scan finished
11:33:17.0987 4176 ============================================================
11:33:17.0993 4472 Detected object count: 0
11:33:17.0993 4472 Actual detected object count: 0
11:34:20.0815 5404 Deinitialize success
11:32:58.0655 2892 TDSS rootkit removing tool 2.7.23.0 Mar 26 2012 13:40:18
11:32:58.0754 2892 ============================================================
11:32:58.0754 2892 Current date / time: 2012/04/02 11:32:58.0753
11:32:58.0754 2892 SystemInfo:
11:32:58.0754 2892
11:32:58.0754 2892 OS Version: 6.1.7601 ServicePack: 1.0
11:32:58.0754 2892 Product type: Workstation
11:32:58.0754 2892 ComputerName: JAN-PC
11:32:58.0754 2892 UserName: Jan
11:32:58.0754 2892 Windows directory: C:\Windows
11:32:58.0754 2892 System windows directory: C:\Windows
11:32:58.0754 2892 Running under WOW64
11:32:58.0754 2892 Processor architecture: Intel x64
11:32:58.0754 2892 Number of processors: 4
11:32:58.0754 2892 Page size: 0x1000
11:32:58.0754 2892 Boot type: Normal boot
11:32:58.0754 2892 ============================================================
11:32:58.0963 2892 Drive \Device\Harddisk1\DR1 - Size: 0xDF99E6000 (55.90 Gb), SectorSize: 0x200, Cylinders: 0x1C81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
11:32:58.0972 2892 Drive \Device\Harddisk0\DR0 - Size: 0xAEA8CDE000 (698.64 Gb), SectorSize: 0x200, Cylinders: 0x16441, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
11:32:59.0029 2892 \Device\Harddisk1\DR1:
11:32:59.0029 2892 MBR used
11:32:59.0029 2892 \Device\Harddisk1\DR1\Partition0: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x6F99800
11:32:59.0029 2892 \Device\Harddisk0\DR0:
11:32:59.0029 2892 MBR used
11:32:59.0029 2892 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x57545000
11:32:59.0046 2892 Initialize success
11:32:59.0046 2892 ============================================================
11:33:11.0086 4176 ============================================================
11:33:11.0087 4176 Scan started
11:33:11.0087 4176 Mode: Manual;
11:33:11.0087 4176 ============================================================
11:33:11.0328 4176 1394ohci (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
11:33:11.0333 4176 1394ohci - ok
11:33:11.0350 4176 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
11:33:11.0356 4176 ACPI - ok
11:33:11.0367 4176 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
11:33:11.0369 4176 AcpiPmi - ok
11:33:11.0377 4176 AdobeARMservice (62b7936f9036dd6ed36e6a7efa805dc0) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
11:33:11.0379 4176 AdobeARMservice - ok
11:33:11.0392 4176 AdobeFlashPlayerUpdateSvc (0d4c486a24a711a45fd83acdf4d18506) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
11:33:11.0396 4176 AdobeFlashPlayerUpdateSvc - ok
11:33:11.0413 4176 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\drivers\adp94xx.sys
11:33:11.0418 4176 adp94xx - ok
11:33:11.0431 4176 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\drivers\adpahci.sys
11:33:11.0435 4176 adpahci - ok
11:33:11.0447 4176 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\drivers\adpu320.sys
11:33:11.0449 4176 adpu320 - ok
11:33:11.0460 4176 AeLookupSvc (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll
11:33:11.0461 4176 AeLookupSvc - ok
11:33:11.0475 4176 AFD (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys
11:33:11.0480 4176 AFD - ok
11:33:11.0490 4176 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
11:33:11.0491 4176 agp440 - ok
11:33:11.0501 4176 ALG (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe
11:33:11.0502 4176 ALG - ok
11:33:11.0512 4176 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
11:33:11.0513 4176 aliide - ok
11:33:11.0523 4176 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
11:33:11.0523 4176 amdide - ok
11:33:11.0534 4176 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\drivers\amdk8.sys
11:33:11.0535 4176 AmdK8 - ok
11:33:11.0545 4176 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\drivers\amdppm.sys
11:33:11.0546 4176 AmdPPM - ok
11:33:11.0557 4176 amdsata (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
11:33:11.0558 4176 amdsata - ok
11:33:11.0570 4176 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\drivers\amdsbs.sys
11:33:11.0572 4176 amdsbs - ok
11:33:11.0582 4176 amdxata (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
11:33:11.0583 4176 amdxata - ok
11:33:11.0594 4176 AppID (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
11:33:11.0595 4176 AppID - ok
11:33:11.0604 4176 AppIDSvc (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll
11:33:11.0605 4176 AppIDSvc - ok
11:33:11.0615 4176 Appinfo (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll
11:33:11.0616 4176 Appinfo - ok
11:33:11.0629 4176 AppMgmt (4aba3e75a76195a3e38ed2766c962899) C:\Windows\System32\appmgmts.dll
11:33:11.0631 4176 AppMgmt - ok
11:33:11.0641 4176 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\drivers\arc.sys
11:33:11.0643 4176 arc - ok
11:33:11.0653 4176 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\drivers\arcsas.sys
11:33:11.0655 4176 arcsas - ok
11:33:11.0665 4176 asmthub3 (e1e75921e9eb025009696d4837f531fb) C:\Windows\system32\DRIVERS\asmthub3.sys
11:33:11.0667 4176 asmthub3 - ok
11:33:11.0682 4176 asmtxhci (b0cf9ab16006b61634d4f955345ca5d2) C:\Windows\system32\DRIVERS\asmtxhci.sys
11:33:11.0685 4176 asmtxhci - ok
11:33:11.0692 4176 aspnet_state (9217d874131ae6ff8f642f124f00a555) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
11:33:11.0693 4176 aspnet_state - ok
11:33:11.0704 4176 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
11:33:11.0705 4176 AsyncMac - ok
11:33:11.0715 4176 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
11:33:11.0716 4176 atapi - ok
11:33:11.0726 4176 AthBTPort (cbe61b4494165f458bd87e37181ee934) C:\Windows\system32\DRIVERS\btath_flt.sys
11:33:11.0727 4176 AthBTPort - ok
11:33:11.0738 4176 ATHDFU (4119870b90e1b5e7797d6433d21f9216) C:\Windows\system32\Drivers\AthDfu.sys
11:33:11.0738 4176 ATHDFU - ok
11:33:11.0741 4176 AtherosSvc (21753130331188c4b474e1d3b396e629) C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
11:33:11.0743 4176 AtherosSvc - ok
11:33:11.0762 4176 AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
11:33:11.0772 4176 AudioEndpointBuilder - ok
11:33:11.0784 4176 AudioSrv (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
11:33:11.0787 4176 AudioSrv - ok
11:33:11.0790 4176 Autodesk Content Service (1992c2a1867d95aa3a0802539358d162) C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
11:33:11.0791 4176 Autodesk Content Service - ok
11:33:11.0815 4176 AVerAF35 (b7dece0f526f6e896b851e8f271d2842) C:\Windows\system32\Drivers\AVerAF35.sys
11:33:11.0826 4176 AVerAF35 - ok
11:33:11.0834 4176 AVerRemote (b085322dc9984b31190bd80d2542329f) C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe
11:33:11.0841 4176 AVerRemote - ok
11:33:11.0849 4176 AVerScheduleService (3094f37d17c9f91632689ffe9381fc4b) C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe
11:33:11.0855 4176 AVerScheduleService - ok
11:33:11.0859 4176 AVerUpdateServer (ac116b5ebd1cd55eb4fa6399dc3abc3d) C:\Program Files (x86)\AVerMedia\AVerUpdate\AVerUpdateServer.exe
11:33:11.0861 4176 AVerUpdateServer - ok
11:33:11.0871 4176 AxInstSV (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll
11:33:11.0872 4176 AxInstSV - ok
11:33:11.0887 4176 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\drivers\bxvbda.sys
11:33:11.0891 4176 b06bdrv - ok
11:33:11.0903 4176 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
11:33:11.0906 4176 b57nd60a - ok
11:33:11.0912 4176 BCUService (7ed4e1d2e124ad4e6a287cf49dbc9bba) C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe
11:33:11.0915 4176 BCUService - ok
11:33:11.0925 4176 BDESVC (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll
11:33:11.0927 4176 BDESVC - ok
11:33:11.0937 4176 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
11:33:11.0938 4176 Beep - ok
11:33:11.0957 4176 BFE (82974d6a2fd19445cc5171fc378668a4) C:\Windows\System32\bfe.dll
11:33:11.0966 4176 BFE - ok
11:33:11.0987 4176 BITS (1ea7969e3271cbc59e1730697dc74682) C:\Windows\System32\qmgr.dll
11:33:11.0998 4176 BITS - ok
11:33:12.0008 4176 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
11:33:12.0009 4176 blbdrive - ok
11:33:12.0020 4176 bowser (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
11:33:12.0021 4176 bowser - ok
11:33:12.0031 4176 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\drivers\BrFiltLo.sys
11:33:12.0032 4176 BrFiltLo - ok
11:33:12.0041 4176 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\drivers\BrFiltUp.sys
11:33:12.0042 4176 BrFiltUp - ok
11:33:12.0053 4176 Browser (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll
11:33:12.0056 4176 Browser - ok
11:33:12.0067 4176 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
11:33:12.0070 4176 Brserid - ok
11:33:12.0080 4176 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
11:33:12.0081 4176 BrSerWdm - ok
11:33:12.0091 4176 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
11:33:12.0092 4176 BrUsbMdm - ok
11:33:12.0102 4176 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
11:33:12.0103 4176 BrUsbSer - ok
11:33:12.0117 4176 BTATH_A2DP (fe70889a85c57a9268101b2db0474509) C:\Windows\system32\drivers\btath_a2dp.sys
11:33:12.0121 4176 BTATH_A2DP - ok
11:33:12.0133 4176 BTATH_BUS (a83a91d07d1fe6bbe7a9db46ca00434b) C:\Windows\system32\DRIVERS\btath_bus.sys
11:33:12.0134 4176 BTATH_BUS - ok
11:33:12.0147 4176 BTATH_HCRP (c864ff85ee16d61c2bdd5ef76824625f) C:\Windows\system32\DRIVERS\btath_hcrp.sys
11:33:12.0151 4176 BTATH_HCRP - ok
11:33:12.0162 4176 BTATH_LWFLT (0dea505efb5d771826d177ef8b8a208f) C:\Windows\system32\DRIVERS\btath_lwflt.sys
11:33:12.0163 4176 BTATH_LWFLT - ok
11:33:12.0175 4176 BTATH_RCP (724c8088c96efe7a3e63fec21d4681c0) C:\Windows\system32\DRIVERS\btath_rcp.sys
11:33:12.0176 4176 BTATH_RCP - ok
11:33:12.0192 4176 BtFilter (aa0f5afcf077c5246589b32eceeae566) C:\Windows\system32\DRIVERS\btfilter.sys
11:33:12.0195 4176 BtFilter - ok
11:33:12.0206 4176 BthEnum (cf98190a94f62e405c8cb255018b2315) C:\Windows\system32\drivers\BthEnum.sys
11:33:12.0207 4176 BthEnum - ok
11:33:12.0218 4176 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\drivers\bthmodem.sys
11:33:12.0219 4176 BTHMODEM - ok
11:33:12.0230 4176 BthPan (02dd601b708dd0667e1331fa8518e9ff) C:\Windows\system32\DRIVERS\bthpan.sys
11:33:12.0231 4176 BthPan - ok
11:33:12.0245 4176 BTHPORT (64c198198501f7560ee41d8d1efa7952) C:\Windows\System32\Drivers\BTHport.sys
11:33:12.0250 4176 BTHPORT - ok
11:33:12.0260 4176 bthserv (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll
11:33:12.0262 4176 bthserv - ok
11:33:12.0272 4176 BTHUSB (f188b7394d81010767b6df3178519a37) C:\Windows\System32\Drivers\BTHUSB.sys
11:33:12.0273 4176 BTHUSB - ok
11:33:12.0284 4176 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
11:33:12.0285 4176 cdfs - ok
11:33:12.0296 4176 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\DRIVERS\cdrom.sys
11:33:12.0298 4176 cdrom - ok
11:33:12.0309 4176 CertPropSvc (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
11:33:12.0310 4176 CertPropSvc - ok
11:33:12.0321 4176 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
11:33:12.0322 4176 circlass - ok
11:33:12.0336 4176 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
11:33:12.0341 4176 CLFS - ok
11:33:12.0347 4176 clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
11:33:12.0348 4176 clr_optimization_v2.0.50727_32 - ok
11:33:12.0352 4176 clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
11:33:12.0354 4176 clr_optimization_v2.0.50727_64 - ok
11:33:12.0359 4176 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
11:33:12.0360 4176 clr_optimization_v4.0.30319_32 - ok
11:33:12.0365 4176 clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
11:33:12.0368 4176 clr_optimization_v4.0.30319_64 - ok
11:33:12.0378 4176 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\drivers\CmBatt.sys
11:33:12.0379 4176 CmBatt - ok
11:33:12.0389 4176 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
11:33:12.0389 4176 cmdide - ok
11:33:12.0407 4176 CNG (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys
11:33:12.0414 4176 CNG - ok
11:33:12.0424 4176 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\drivers\compbatt.sys
11:33:12.0425 4176 Compbatt - ok
11:33:12.0436 4176 CompositeBus (03edb043586cceba243d689bdda370a8) C:\Windows\system32\DRIVERS\CompositeBus.sys
11:33:12.0437 4176 CompositeBus - ok
11:33:12.0445 4176 COMSysApp - ok
11:33:12.0457 4176 cphs (df3e8c2c443d3618260dff5705ce2df5) C:\Windows\SysWow64\IntelCpHeciSvc.exe
11:33:12.0460 4176 cphs - ok
11:33:12.0469 4176 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\drivers\crcdisk.sys
11:33:12.0470 4176 crcdisk - ok
11:33:12.0483 4176 CryptSvc (15597883fbe9b056f276ada3ad87d9af) C:\Windows\system32\cryptsvc.dll
11:33:12.0486 4176 CryptSvc - ok
11:33:12.0500 4176 CSC (54da3dfd29ed9f1619b6f53f3ce55e49) C:\Windows\system32\drivers\csc.sys
11:33:12.0505 4176 CSC - ok
11:33:12.0522 4176 CscService (3ab183ab4d2c79dcf459cd2c1266b043) C:\Windows\System32\cscsvc.dll
11:33:12.0530 4176 CscService - ok
11:33:12.0544 4176 DcomLaunch (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
11:33:12.0550 4176 DcomLaunch - ok
11:33:12.0562 4176 defragsvc (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll
11:33:12.0566 4176 defragsvc - ok
11:33:12.0577 4176 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
11:33:12.0578 4176 DfsC - ok
11:33:12.0591 4176 Dhcp (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll
11:33:12.0596 4176 Dhcp - ok
11:33:12.0606 4176 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
11:33:12.0607 4176 discache - ok
11:33:12.0618 4176 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\drivers\disk.sys
11:33:12.0620 4176 Disk - ok
11:33:12.0631 4176 dmvsc (5db085a8a6600be6401f2b24eecb5415) C:\Windows\system32\drivers\dmvsc.sys
11:33:12.0633 4176 dmvsc - ok
11:33:12.0644 4176 Dnscache (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll
11:33:12.0646 4176 Dnscache - ok
11:33:12.0657 4176 dot3svc (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll
11:33:12.0660 4176 dot3svc - ok
11:33:12.0671 4176 DPS (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll
11:33:12.0674 4176 DPS - ok
11:33:12.0684 4176 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
11:33:12.0684 4176 drmkaud - ok
11:33:12.0703 4176 DXGKrnl (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
11:33:12.0712 4176 DXGKrnl - ok
11:33:12.0726 4176 e1cexpress (6bafd9819d9fec2edbaebc8493c711a4) C:\Windows\system32\DRIVERS\e1c62x64.sys
11:33:12.0731 4176 e1cexpress - ok
11:33:12.0742 4176 eamonm (13533557d01b88c83110d5cf749f14d7) C:\Windows\system32\DRIVERS\eamonm.sys
11:33:12.0744 4176 eamonm - ok
11:33:12.0754 4176 EapHost (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll
11:33:12.0756 4176 EapHost - ok
11:33:12.0792 4176 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\drivers\evbda.sys
11:33:12.0815 4176 ebdrv - ok
11:33:12.0825 4176 EFS (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe
11:33:12.0826 4176 EFS - ok
11:33:12.0839 4176 ehdrv (e097728129e7b79bf1089d7aef42332b) C:\Windows\system32\DRIVERS\ehdrv.sys
11:33:12.0842 4176 ehdrv - ok
11:33:12.0852 4176 ehRecvr (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe
11:33:12.0860 4176 ehRecvr - ok
11:33:12.0863 4176 ehSched (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe
11:33:12.0865 4176 ehSched - ok
11:33:12.0882 4176 ekrn (3b944199f8edd76be94460c0361409ab) C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
11:33:12.0894 4176 ekrn - ok
11:33:12.0909 4176 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\drivers\elxstor.sys
11:33:12.0913 4176 elxstor - ok
11:33:12.0924 4176 epfwwfpr (2380976cf8a4a56611f35633acd2a74f) C:\Windows\system32\DRIVERS\epfwwfpr.sys
11:33:12.0926 4176 epfwwfpr - ok
11:33:12.0936 4176 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
11:33:12.0937 4176 ErrDev - ok
11:33:12.0952 4176 EventSystem (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll
11:33:12.0958 4176 EventSystem - ok
11:33:12.0970 4176 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
11:33:12.0972 4176 exfat - ok
11:33:12.0983 4176 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
11:33:12.0986 4176 fastfat - ok
11:33:13.0001 4176 Fax (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe
11:33:13.0007 4176 Fax - ok
11:33:13.0017 4176 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\drivers\fdc.sys
11:33:13.0018 4176 fdc - ok
11:33:13.0027 4176 fdPHost (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll
11:33:13.0028 4176 fdPHost - ok
11:33:13.0037 4176 FDResPub (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll
11:33:13.0039 4176 FDResPub - ok
11:33:13.0049 4176 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
11:33:13.0050 4176 FileInfo - ok
11:33:13.0060 4176 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
11:33:13.0061 4176 Filetrace - ok
11:33:13.0076 4176 FLEXnet Licensing Service 64 (5cee6cd43ae5844c49300ea0b1e557ee) C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
11:33:13.0087 4176 FLEXnet Licensing Service 64 - ok
11:33:13.0097 4176 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\drivers\flpydisk.sys
11:33:13.0098 4176 flpydisk - ok
11:33:13.0113 4176 FltMgr (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
11:33:13.0117 4176 FltMgr - ok
11:33:13.0143 4176 FontCache (5c4cb4086fb83115b153e47add961a0c) C:\Windows\system32\FntCache.dll
11:33:13.0157 4176 FontCache - ok
11:33:13.0161 4176 FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
11:33:13.0162 4176 FontCache3.0.0.0 - ok
11:33:13.0172 4176 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
11:33:13.0174 4176 FsDepends - ok
11:33:13.0184 4176 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys
11:33:13.0185 4176 Fs_Rec - ok
11:33:13.0197 4176 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
11:33:13.0200 4176 fvevol - ok
11:33:13.0211 4176 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\drivers\gagp30kx.sys
11:33:13.0212 4176 gagp30kx - ok
11:33:13.0232 4176 gpsvc (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll
11:33:13.0242 4176 gpsvc - ok
11:33:13.0252 4176 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
11:33:13.0253 4176 hcw85cir - ok
11:33:13.0268 4176 HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
11:33:13.0273 4176 HdAudAddService - ok
11:33:13.0283 4176 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\DRIVERS\HDAudBus.sys
11:33:13.0284 4176 HDAudBus - ok
11:33:13.0294 4176 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\drivers\HidBatt.sys
11:33:13.0295 4176 HidBatt - ok
11:33:13.0305 4176 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\drivers\hidbth.sys
11:33:13.0307 4176 HidBth - ok
11:33:13.0317 4176 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
11:33:13.0319 4176 HidIr - ok
11:33:13.0328 4176 hidserv (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll
11:33:13.0329 4176 hidserv - ok
11:33:13.0340 4176 HidUsb (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys
11:33:13.0341 4176 HidUsb - ok
11:33:13.0351 4176 hkmsvc (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll
11:33:13.0353 4176 hkmsvc - ok
11:33:13.0364 4176 HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll
11:33:13.0366 4176 HomeGroupListener - ok
11:33:13.0378 4176 HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll
11:33:13.0382 4176 HomeGroupProvider - ok
11:33:13.0392 4176 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
11:33:13.0394 4176 HpSAMD - ok
11:33:13.0404 4176 HTCAND64 (f47cec45fb85791d4ab237563ad0fa8f) C:\Windows\system32\Drivers\ANDROIDUSB.sys
11:33:13.0404 4176 HTCAND64 - ok
11:33:13.0416 4176 htcnprot (b8b1b284362e1d8135112573395d5da5) C:\Windows\system32\DRIVERS\htcnprot.sys
11:33:13.0416 4176 htcnprot - ok
11:33:13.0433 4176 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
11:33:13.0439 4176 HTTP - ok
11:33:13.0450 4176 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
11:33:13.0451 4176 hwpolicy - ok
11:33:13.0462 4176 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
11:33:13.0464 4176 i8042prt - ok
11:33:13.0477 4176 iaStorV (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
11:33:13.0481 4176 iaStorV - ok
11:33:13.0491 4176 idsvc (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
11:33:13.0498 4176 idsvc - ok
11:33:13.0636 4176 igfx (276ee9cdab16c50e1df0e4cefa882f5f) C:\Windows\system32\DRIVERS\igdkmd64.sys
11:33:13.0695 4176 igfx - ok
11:33:13.0707 4176 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\drivers\iirsp.sys
11:33:13.0708 4176 iirsp - ok
11:33:13.0724 4176 IKEEXT (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll
11:33:13.0731 4176 IKEEXT - ok
11:33:13.0765 4176 IntcAzAudAddService (589b94a9b73a0e819ff873743a480834) C:\Windows\system32\drivers\RTKVHD64.sys
11:33:13.0784 4176 IntcAzAudAddService - ok
11:33:13.0797 4176 IntcDAud (ae594cc17c33ac146739494615e14851) C:\Windows\system32\DRIVERS\IntcDAud.sys
11:33:13.0801 4176 IntcDAud - ok
11:33:13.0811 4176 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
11:33:13.0812 4176 intelide - ok
11:33:13.0824 4176 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
11:33:13.0826 4176 intelppm - ok
11:33:13.0837 4176 Intel® PROSet Monitoring Service (068ec06f3b6dd7b81b365d8fd2ce27e6) C:\Windows\system32\IProsetMonitor.exe
11:33:13.0839 4176 Intel® PROSet Monitoring Service - ok
11:33:13.0849 4176 IPBusEnum (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll
11:33:13.0850 4176 IPBusEnum - ok
11:33:13.0861 4176 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
11:33:13.0862 4176 IpFilterDriver - ok
11:33:13.0879 4176 iphlpsvc (a34a587fffd45fa649fba6d03784d257) C:\Windows\System32\iphlpsvc.dll
11:33:13.0887 4176 iphlpsvc - ok
11:33:13.0897 4176 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
11:33:13.0898 4176 IPMIDRV - ok
11:33:13.0909 4176 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
11:33:13.0910 4176 IPNAT - ok
11:33:13.0920 4176 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
11:33:13.0922 4176 IRENUM - ok
11:33:13.0932 4176 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
11:33:13.0933 4176 isapnp - ok
11:33:13.0944 4176 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
11:33:13.0947 4176 iScsiPrt - ok
11:33:13.0959 4176 JRAID (a577f5db30f70eca9708c07c2eacbd9d) C:\Windows\system32\DRIVERS\jraid.sys
11:33:13.0960 4176 JRAID - ok
11:33:13.0971 4176 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys
11:33:13.0972 4176 kbdclass - ok
11:33:13.0983 4176 kbdhid (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\DRIVERS\kbdhid.sys
11:33:13.0984 4176 kbdhid - ok
11:33:13.0994 4176 KeyIso (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
11:33:13.0995 4176 KeyIso - ok
11:33:14.0005 4176 KovaPlusFltr (b355cdd82f914d681dadef1049d8174a) C:\Windows\system32\drivers\KovaPlusFltr.sys
11:33:14.0006 4176 KovaPlusFltr - ok
11:33:14.0017 4176 KSecDD (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys
11:33:14.0019 4176 KSecDD - ok
11:33:14.0030 4176 KSecPkg (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys
11:33:14.0032 4176 KSecPkg - ok
11:33:14.0042 4176 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
11:33:14.0043 4176 ksthunk - ok
11:33:14.0055 4176 KtmRm (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll
11:33:14.0059 4176 KtmRm - ok
11:33:14.0070 4176 LanmanServer (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\system32\srvsvc.dll
11:33:14.0073 4176 LanmanServer - ok
11:33:14.0083 4176 LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll
11:33:14.0085 4176 LanmanWorkstation - ok
11:33:14.0097 4176 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
11:33:14.0098 4176 lltdio - ok
11:33:14.0109 4176 lltdsvc (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll
11:33:14.0113 4176 lltdsvc - ok
11:33:14.0122 4176 lmhosts (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll
11:33:14.0124 4176 lmhosts - ok
11:33:14.0135 4176 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\drivers\lsi_fc.sys
11:33:14.0137 4176 LSI_FC - ok
11:33:14.0148 4176 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\drivers\lsi_sas.sys
11:33:14.0149 4176 LSI_SAS - ok
11:33:14.0160 4176 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\drivers\lsi_sas2.sys
11:33:14.0161 4176 LSI_SAS2 - ok
11:33:14.0172 4176 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\drivers\lsi_scsi.sys
11:33:14.0173 4176 LSI_SCSI - ok
11:33:14.0184 4176 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
11:33:14.0186 4176 luafv - ok
11:33:14.0197 4176 MBAMProtector (79da94b35371b9e7104460c7693dcb2c) C:\Windows\system32\drivers\mbam.sys
11:33:14.0198 4176 MBAMProtector - ok
11:33:14.0206 4176 MBAMService (056b19651bd7b7ce5f89a3ac46dbdc08) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
11:33:14.0212 4176 MBAMService - ok
11:33:14.0223 4176 Mcx2Svc (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll
11:33:14.0225 4176 Mcx2Svc - ok
11:33:14.0236 4176 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\drivers\megasas.sys
11:33:14.0237 4176 megasas - ok
11:33:14.0249 4176 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\drivers\MegaSR.sys
11:33:14.0252 4176 MegaSR - ok
11:33:14.0262 4176 MEIx64 (a6518dcc42f7a6e999bb3bea8fd87567) C:\Windows\system32\DRIVERS\HECIx64.sys
11:33:14.0263 4176 MEIx64 - ok
11:33:14.0267 4176 Microsoft SharePoint Workspace Audit Service - ok
11:33:14.0278 4176 MMCSS (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
11:33:14.0280 4176 MMCSS - ok
11:33:14.0290 4176 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
11:33:14.0291 4176 Modem - ok
11:33:14.0302 4176 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
11:33:14.0303 4176 monitor - ok
11:33:14.0313 4176 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
11:33:14.0314 4176 mouclass - ok
11:33:14.0324 4176 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
11:33:14.0325 4176 mouhid - ok
11:33:14.0335 4176 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
11:33:14.0337 4176 mountmgr - ok
11:33:14.0349 4176 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
11:33:14.0351 4176 mpio - ok
11:33:14.0362 4176 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
11:33:14.0363 4176 mpsdrv - ok
11:33:14.0384 4176 MpsSvc (54ffc9c8898113ace189d4aa7199d2c1) C:\Windows\system32\mpssvc.dll
11:33:14.0396 4176 MpsSvc - ok
11:33:14.0407 4176 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
11:33:14.0408 4176 MRxDAV - ok
11:33:14.0420 4176 mrxsmb (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
11:33:14.0423 4176 mrxsmb - ok
11:33:14.0438 4176 mrxsmb10 (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
11:33:14.0442 4176 mrxsmb10 - ok
11:33:14.0453 4176 mrxsmb20 (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
11:33:14.0455 4176 mrxsmb20 - ok
11:33:14.0465 4176 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
11:33:14.0466 4176 msahci - ok
11:33:14.0477 4176 msdsm (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
11:33:14.0479 4176 msdsm - ok
11:33:14.0489 4176 MSDTC (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe
11:33:14.0491 4176 MSDTC - ok
11:33:14.0502 4176 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
11:33:14.0503 4176 Msfs - ok
11:33:14.0513 4176 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
11:33:14.0514 4176 mshidkmdf - ok
11:33:14.0523 4176 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
11:33:14.0524 4176 msisadrv - ok
11:33:14.0534 4176 MSiSCSI (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll
11:33:14.0537 4176 MSiSCSI - ok
11:33:14.0545 4176 msiserver - ok
11:33:14.0558 4176 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
11:33:14.0559 4176 MSKSSRV - ok
11:33:14.0569 4176 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
11:33:14.0570 4176 MSPCLOCK - ok
11:33:14.0580 4176 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
11:33:14.0580 4176 MSPQM - ok
11:33:14.0593 4176 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
11:33:14.0595 4176 MsRPC - ok
11:33:14.0607 4176 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\DRIVERS\mssmbios.sys
11:33:14.0608 4176 mssmbios - ok
11:33:14.0617 4176 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
11:33:14.0618 4176 MSTEE - ok
11:33:14.0627 4176 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\drivers\MTConfig.sys
11:33:14.0628 4176 MTConfig - ok
11:33:14.0638 4176 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
11:33:14.0639 4176 Mup - ok
11:33:14.0652 4176 napagent (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll
11:33:14.0657 4176 napagent - ok
11:33:14.0669 4176 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
11:33:14.0672 4176 NativeWifiP - ok
11:33:14.0692 4176 NDIS (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
11:33:14.0700 4176 NDIS - ok
11:33:14.0710 4176 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
11:33:14.0711 4176 NdisCap - ok
11:33:14.0721 4176 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
11:33:14.0722 4176 NdisTapi - ok
11:33:14.0733 4176 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
11:33:14.0734 4176 Ndisuio - ok
11:33:14.0746 4176 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
11:33:14.0749 4176 NdisWan - ok
11:33:14.0760 4176 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
11:33:14.0761 4176 NDProxy - ok
11:33:14.0771 4176 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
11:33:14.0773 4176 NetBIOS - ok
11:33:14.0786 4176 NetBT (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
11:33:14.0790 4176 NetBT - ok
11:33:14.0800 4176 Netlogon (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
11:33:14.0801 4176 Netlogon - ok
11:33:14.0813 4176 Netman (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll
11:33:14.0817 4176 Netman - ok
11:33:14.0823 4176 NetMsmqActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
11:33:14.0824 4176 NetMsmqActivator - ok
11:33:14.0827 4176 NetPipeActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
11:33:14.0827 4176 NetPipeActivator - ok
11:33:14.0841 4176 netprofm (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll
11:33:14.0845 4176 netprofm - ok
11:33:14.0851 4176 NetTcpActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
11:33:14.0851 4176 NetTcpActivator - ok
11:33:14.0854 4176 NetTcpPortSharing (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
11:33:14.0855 4176 NetTcpPortSharing - ok
11:33:14.0866 4176 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\drivers\nfrd960.sys
11:33:14.0867 4176 nfrd960 - ok
11:33:14.0879 4176 NlaSvc (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll
11:33:14.0882 4176 NlaSvc - ok
11:33:14.0893 4176 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
11:33:14.0894 4176 Npfs - ok
11:33:14.0903 4176 nsi (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll
11:33:14.0905 4176 nsi - ok
11:33:14.0915 4176 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
11:33:14.0915 4176 nsiproxy - ok
11:33:14.0953 4176 Ntfs (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
11:33:14.0974 4176 Ntfs - ok
11:33:14.0984 4176 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
11:33:14.0984 4176 Null - ok
11:33:14.0995 4176 nvraid (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
11:33:14.0997 4176 nvraid - ok
11:33:15.0008 4176 nvstor (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
11:33:15.0010 4176 nvstor - ok
11:33:15.0021 4176 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
11:33:15.0022 4176 nv_agp - ok
11:33:15.0032 4176 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
11:33:15.0034 4176 ohci1394 - ok
11:33:15.0038 4176 ose64 (4965b005492cba7719e82b71e3245495) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
11:33:15.0040 4176 ose64 - ok
11:33:15.0091 4176 osppsvc (61bffb5f57ad12f83ab64b7181829b34) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
11:33:15.0129 4176 osppsvc - ok
11:33:15.0143 4176 p2pimsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
11:33:15.0147 4176 p2pimsvc - ok
11:33:15.0160 4176 p2psvc (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll
11:33:15.0164 4176 p2psvc - ok
11:33:15.0175 4176 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\drivers\parport.sys
11:33:15.0176 4176 Parport - ok
11:33:15.0186 4176 partmgr (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys
11:33:15.0188 4176 partmgr - ok
11:33:15.0192 4176 PassThru Service (68139940b5ac84affb7eb1b713be66e7) C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
11:33:15.0193 4176 PassThru Service - ok
11:33:15.0203 4176 PcaSvc (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll
11:33:15.0206 4176 PcaSvc - ok
11:33:15.0218 4176 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
11:33:15.0221 4176 pci - ok
11:33:15.0231 4176 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
11:33:15.0232 4176 pciide - ok
11:33:15.0244 4176 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\drivers\pcmcia.sys
11:33:15.0245 4176 pcmcia - ok
11:33:15.0256 4176 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
11:33:15.0258 4176 pcw - ok
11:33:15.0273 4176 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
11:33:15.0278 4176 PEAUTH - ok
11:33:15.0309 4176 PeerDistSvc (b9b0a4299dd2d76a4243f75fd54dc680) C:\Windows\system32\peerdistsvc.dll
11:33:15.0325 4176 PeerDistSvc - ok
11:33:15.0335 4176 PerfHost (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe
11:33:15.0337 4176 PerfHost - ok
11:33:15.0360 4176 pla (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll
11:33:15.0371 4176 pla - ok
11:33:15.0385 4176 PlugPlay (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll
11:33:15.0389 4176 PlugPlay - ok
11:33:15.0399 4176 PNRPAutoReg (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll
11:33:15.0400 4176 PNRPAutoReg - ok
11:33:15.0412 4176 PNRPsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
11:33:15.0414 4176 PNRPsvc - ok
11:33:15.0428 4176 PolicyAgent (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll
11:33:15.0433 4176 PolicyAgent - ok
11:33:15.0444 4176 Power (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll
11:33:15.0447 4176 Power - ok
11:33:15.0459 4176 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
11:33:15.0461 4176 PptpMiniport - ok
11:33:15.0472 4176 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\drivers\processr.sys
11:33:15.0473 4176 Processor - ok
11:33:15.0484 4176 ProfSvc (5c78838b4d166d1a27db3a8a820c799a) C:\Windows\system32\profsvc.dll
11:33:15.0488 4176 ProfSvc - ok
11:33:15.0497 4176 ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
11:33:15.0498 4176 ProtectedStorage - ok
11:33:15.0510 4176 Psched (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
11:33:15.0511 4176 Psched - ok
11:33:15.0535 4176 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\drivers\ql2300.sys
11:33:15.0547 4176 ql2300 - ok
11:33:15.0558 4176 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\drivers\ql40xx.sys
11:33:15.0560 4176 ql40xx - ok
11:33:15.0571 4176 QWAVE (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll
11:33:15.0574 4176 QWAVE - ok
11:33:15.0584 4176 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
11:33:15.0585 4176 QWAVEdrv - ok
11:33:15.0595 4176 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
11:33:15.0596 4176 RasAcd - ok
11:33:15.0607 4176 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
11:33:15.0608 4176 RasAgileVpn - ok
11:33:15.0618 4176 RasAuto (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll
11:33:15.0620 4176 RasAuto - ok
11:33:15.0631 4176 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
11:33:15.0633 4176 Rasl2tp - ok
11:33:15.0644 4176 RasMan (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll
11:33:15.0648 4176 RasMan - ok
11:33:15.0659 4176 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
11:33:15.0660 4176 RasPppoe - ok
11:33:15.0671 4176 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
11:33:15.0672 4176 RasSstp - ok
11:33:15.0684 4176 rdbss (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
11:33:15.0687 4176 rdbss - ok
11:33:15.0697 4176 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
11:33:15.0698 4176 rdpbus - ok
11:33:15.0708 4176 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
11:33:15.0709 4176 RDPCDD - ok
11:33:15.0722 4176 RDPDR (1b6163c503398b23ff8b939c67747683) C:\Windows\system32\drivers\rdpdr.sys
11:33:15.0724 4176 RDPDR - ok
11:33:15.0735 4176 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
11:33:15.0735 4176 RDPENCDD - ok
11:33:15.0746 4176 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
11:33:15.0747 4176 RDPREFMP - ok
11:33:15.0758 4176 RDPWD (6d76e6433574b058adcb0c50df834492) C:\Windows\system32\drivers\RDPWD.sys
11:33:15.0760 4176 RDPWD - ok
11:33:15.0775 4176 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
11:33:15.0787 4176 rdyboost - ok
11:33:15.0798 4176 RemoteAccess (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll
11:33:15.0801 4176 RemoteAccess - ok
11:33:15.0813 4176 RemoteRegistry (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll
11:33:15.0817 4176 RemoteRegistry - ok
11:33:15.0832 4176 RFCOMM (3dd798846e2c28102b922c56e71b7932) C:\Windows\system32\DRIVERS\rfcomm.sys
11:33:15.0835 4176 RFCOMM - ok
11:33:15.0845 4176 RpcEptMapper (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll
11:33:15.0848 4176 RpcEptMapper - ok
11:33:15.0858 4176 RpcLocator (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe
11:33:15.0860 4176 RpcLocator - ok
11:33:15.0874 4176 RpcSs (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
11:33:15.0878 4176 RpcSs - ok
11:33:15.0889 4176 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
11:33:15.0891 4176 rspndr - ok
11:33:15.0901 4176 s3cap (e60c0a09f997826c7627b244195ab581) C:\Windows\system32\drivers\vms3cap.sys
11:33:15.0902 4176 s3cap - ok
11:33:15.0912 4176 SamSs (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
11:33:15.0913 4176 SamSs - ok
11:33:15.0924 4176 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
11:33:15.0926 4176 sbp2port - ok
11:33:15.0937 4176 SCardSvr (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll
11:33:15.0940 4176 SCardSvr - ok
11:33:15.0950 4176 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
11:33:15.0952 4176 scfilter - ok
11:33:15.0973 4176 Schedule (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll
11:33:15.0986 4176 Schedule - ok
11:33:15.0996 4176 SCPolicySvc (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
11:33:15.0997 4176 SCPolicySvc - ok
11:33:16.0008 4176 SDRSVC (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll
11:33:16.0010 4176 SDRSVC - ok
11:33:16.0021 4176 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
11:33:16.0021 4176 secdrv - ok
11:33:16.0031 4176 seclogon (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll
11:33:16.0032 4176 seclogon - ok
11:33:16.0042 4176 SENS (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll
11:33:16.0045 4176 SENS - ok
11:33:16.0054 4176 SensrSvc (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll
11:33:16.0056 4176 SensrSvc - ok
11:33:16.0066 4176 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\drivers\serenum.sys
11:33:16.0067 4176 Serenum - ok
11:33:16.0078 4176 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\drivers\serial.sys
11:33:16.0079 4176 Serial - ok
11:33:16.0089 4176 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\drivers\sermouse.sys
11:33:16.0090 4176 sermouse - ok
11:33:16.0103 4176 SessionEnv (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll
11:33:16.0105 4176 SessionEnv - ok
11:33:16.0115 4176 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
11:33:16.0116 4176 sffdisk - ok
11:33:16.0126 4176 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
11:33:16.0127 4176 sffp_mmc - ok
11:33:16.0136 4176 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
11:33:16.0137 4176 sffp_sd - ok
11:33:16.0147 4176 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\drivers\sfloppy.sys
11:33:16.0148 4176 sfloppy - ok
11:33:16.0160 4176 SharedAccess (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll
11:33:16.0163 4176 SharedAccess - ok
11:33:16.0176 4176 ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll
11:33:16.0179 4176 ShellHWDetection - ok
11:33:16.0190 4176 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\drivers\SiSRaid2.sys
11:33:16.0191 4176 SiSRaid2 - ok
11:33:16.0202 4176 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\drivers\sisraid4.sys
11:33:16.0203 4176 SiSRaid4 - ok
11:33:16.0214 4176 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
11:33:16.0216 4176 Smb - ok
11:33:16.0227 4176 SNMPTRAP (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe
11:33:16.0229 4176 SNMPTRAP - ok
11:33:16.0237 4176 SnugTV Service (834200790f0c41fafd0748a800bbd1f5) C:\Program Files (x86)\SnugTV\SnugTV Station\AMAServer.exe
11:33:16.0242 4176 SnugTV Service - ok
11:33:16.0252 4176 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
11:33:16.0253 4176 spldr - ok
11:33:16.0271 4176 Spooler (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe
11:33:16.0280 4176 Spooler - ok
11:33:16.0341 4176 sppsvc (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe
11:33:16.0386 4176 sppsvc - ok
11:33:16.0396 4176 sppuinotify (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll
11:33:16.0398 4176 sppuinotify - ok
11:33:16.0415 4176 srv (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
11:33:16.0421 4176 srv - ok
11:33:16.0434 4176 srv2 (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
11:33:16.0438 4176 srv2 - ok
11:33:16.0449 4176 srvnet (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
11:33:16.0451 4176 srvnet - ok
11:33:16.0463 4176 SSDPSRV (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll
11:33:16.0467 4176 SSDPSRV - ok
11:33:16.0476 4176 SstpSvc (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll
11:33:16.0478 4176 SstpSvc - ok
11:33:16.0489 4176 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\drivers\stexstor.sys
11:33:16.0490 4176 stexstor - ok
11:33:16.0504 4176 stisvc (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll
11:33:16.0509 4176 stisvc - ok
11:33:16.0520 4176 storflt (7785dc213270d2fc066538daf94087e7) C:\Windows\system32\drivers\vmstorfl.sys
11:33:16.0522 4176 storflt - ok
11:33:16.0532 4176 StorSvc (c40841817ef57d491f22eb103da587cc) C:\Windows\system32\storsvc.dll
11:33:16.0533 4176 StorSvc - ok
11:33:16.0543 4176 storvsc (d34e4943d5ac096c8edeebfd80d76e23) C:\Windows\system32\drivers\storvsc.sys
11:33:16.0544 4176 storvsc - ok
11:33:16.0554 4176 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\DRIVERS\swenum.sys
11:33:16.0555 4176 swenum - ok
11:33:16.0568 4176 swprv (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll
11:33:16.0573 4176 swprv - ok
11:33:16.0605 4176 SysMain (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll
11:33:16.0625 4176 SysMain - ok
11:33:16.0635 4176 TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll
11:33:16.0637 4176 TabletInputService - ok
11:33:16.0649 4176 TapiSrv (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll
11:33:16.0653 4176 TapiSrv - ok
11:33:16.0662 4176 TBS (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll
11:33:16.0664 4176 TBS - ok
11:33:16.0690 4176 Tcpip (fc62769e7bff2896035aeed399108162) C:\Windows\system32\drivers\tcpip.sys
11:33:16.0705 4176 Tcpip - ok
11:33:16.0730 4176 TCPIP6 (fc62769e7bff2896035aeed399108162) C:\Windows\system32\DRIVERS\tcpip.sys
11:33:16.0739 4176 TCPIP6 - ok
11:33:16.0751 4176 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
11:33:16.0752 4176 tcpipreg - ok
11:33:16.0762 4176 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
11:33:16.0763 4176 TDPIPE - ok
11:33:16.0773 4176 TDTCP (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys
11:33:16.0774 4176 TDTCP - ok
11:33:16.0785 4176 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
11:33:16.0787 4176 tdx - ok
11:33:16.0798 4176 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\DRIVERS\termdd.sys
11:33:16.0799 4176 TermDD - ok
11:33:16.0814 4176 TermService (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll
11:33:16.0820 4176 TermService - ok
11:33:16.0829 4176 Themes (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll
11:33:16.0831 4176 Themes - ok
11:33:16.0841 4176 THREADORDER (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
11:33:16.0842 4176 THREADORDER - ok
11:33:16.0852 4176 TrkWks (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll
11:33:16.0855 4176 TrkWks - ok
11:33:16.0860 4176 TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe
11:33:16.0862 4176 TrustedInstaller - ok
11:33:16.0873 4176 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
11:33:16.0875 4176 tssecsrv - ok
11:33:16.0885 4176 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
11:33:16.0887 4176 TsUsbFlt - ok
11:33:16.0897 4176 TsUsbGD (9cc2ccae8a84820eaecb886d477cbcb8) C:\Windows\system32\drivers\TsUsbGD.sys
11:33:16.0899 4176 TsUsbGD - ok
11:33:16.0910 4176 tunnel (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
11:33:16.0912 4176 tunnel - ok
11:33:16.0923 4176 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\drivers\uagp35.sys
11:33:16.0925 4176 uagp35 - ok
11:33:16.0938 4176 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
11:33:16.0942 4176 udfs - ok
11:33:16.0953 4176 UI0Detect (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe
11:33:16.0955 4176 UI0Detect - ok
11:33:16.0966 4176 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
11:33:16.0968 4176 uliagpkx - ok
11:33:16.0978 4176 umbus (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\DRIVERS\umbus.sys
11:33:16.0979 4176 umbus - ok
11:33:16.0990 4176 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\drivers\umpass.sys
11:33:16.0991 4176 UmPass - ok
11:33:17.0001 4176 UmRdpService (a293dcd756d04d8492a750d03b9a297c) C:\Windows\System32\umrdp.dll
11:33:17.0004 4176 UmRdpService - ok
11:33:17.0018 4176 upnphost (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll
11:33:17.0024 4176 upnphost - ok
11:33:17.0035 4176 usbccgp (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys
11:33:17.0036 4176 usbccgp - ok
11:33:17.0048 4176 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
11:33:17.0050 4176 usbcir - ok
11:33:17.0061 4176 usbehci (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\drivers\usbehci.sys
11:33:17.0062 4176 usbehci - ok
11:33:17.0075 4176 usbhub (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
11:33:17.0078 4176 usbhub - ok
11:33:17.0088 4176 usbohci (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\drivers\usbohci.sys
11:33:17.0089 4176 usbohci - ok
11:33:17.0100 4176 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\drivers\usbprint.sys
11:33:17.0101 4176 usbprint - ok
11:33:17.0112 4176 USBSTOR (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
11:33:17.0113 4176 USBSTOR - ok
11:33:17.0123 4176 usbuhci (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys
11:33:17.0125 4176 usbuhci - ok
11:33:17.0135 4176 usb_rndisx (70d05ee263568a742d14e1876df80532) C:\Windows\system32\DRIVERS\usb8023x.sys
11:33:17.0136 4176 usb_rndisx - ok
11:33:17.0145 4176 UxSms (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll
11:33:17.0147 4176 UxSms - ok
11:33:17.0157 4176 VaultSvc (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
11:33:17.0158 4176 VaultSvc - ok
11:33:17.0168 4176 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
11:33:17.0169 4176 vdrvroot - ok
11:33:17.0182 4176 vds (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe
11:33:17.0187 4176 vds - ok
11:33:17.0198 4176 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
11:33:17.0200 4176 vga - ok
11:33:17.0210 4176 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
11:33:17.0211 4176 VgaSave - ok
11:33:17.0222 4176 vhdmp (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
11:33:17.0224 4176 vhdmp - ok
11:33:17.0234 4176 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
11:33:17.0235 4176 viaide - ok
11:33:17.0247 4176 vmbus (86ea3e79ae350fea5331a1303054005f) C:\Windows\system32\drivers\vmbus.sys
11:33:17.0249 4176 vmbus - ok
11:33:17.0259 4176 VMBusHID (7de90b48f210d29649380545db45a187) C:\Windows\system32\drivers\VMBusHID.sys
11:33:17.0261 4176 VMBusHID - ok
11:33:17.0271 4176 volmgr (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
11:33:17.0273 4176 volmgr - ok
11:33:17.0287 4176 volmgrx (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
11:33:17.0291 4176 volmgrx - ok
11:33:17.0303 4176 volsnap (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
11:33:17.0306 4176 volsnap - ok
11:33:17.0318 4176 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\drivers\vsmraid.sys
11:33:17.0320 4176 vsmraid - ok
11:33:17.0351 4176 VSS (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe
11:33:17.0369 4176 VSS - ok
11:33:17.0379 4176 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys
11:33:17.0380 4176 vwifibus - ok
11:33:17.0393 4176 W32Time (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll
11:33:17.0397 4176 W32Time - ok
11:33:17.0408 4176 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\drivers\wacompen.sys
11:33:17.0409 4176 WacomPen - ok
11:33:17.0420 4176 WANARP (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
11:33:17.0421 4176 WANARP - ok
11:33:17.0424 4176 Wanarpv6 (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
11:33:17.0424 4176 Wanarpv6 - ok
11:33:17.0448 4176 WatAdminSvc (3cec96de223e49eaae3651fcf8faea6c) C:\Windows\system32\Wat\WatAdminSvc.exe
11:33:17.0467 4176 WatAdminSvc - ok
11:33:17.0490 4176 wbengine (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe
11:33:17.0502 4176 wbengine - ok
11:33:17.0513 4176 WbioSrvc (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll
11:33:17.0516 4176 WbioSrvc - ok
11:33:17.0528 4176 wcncsvc (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll
11:33:17.0532 4176 wcncsvc - ok
11:33:17.0541 4176 WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll
11:33:17.0544 4176 WcsPlugInService - ok
11:33:17.0554 4176 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\drivers\wd.sys
11:33:17.0555 4176 Wd - ok
11:33:17.0570 4176 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
11:33:17.0575 4176 Wdf01000 - ok
11:33:17.0586 4176 WdiServiceHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
11:33:17.0589 4176 WdiServiceHost - ok
11:33:17.0592 4176 WdiSystemHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
11:33:17.0593 4176 WdiSystemHost - ok
11:33:17.0605 4176 WebClient (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll
11:33:17.0608 4176 WebClient - ok
11:33:17.0619 4176 Wecsvc (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll
11:33:17.0622 4176 Wecsvc - ok
11:33:17.0632 4176 wercplsupport (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll
11:33:17.0634 4176 wercplsupport - ok
11:33:17.0644 4176 WerSvc (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll
11:33:17.0646 4176 WerSvc - ok
11:33:17.0657 4176 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
11:33:17.0658 4176 WfpLwf - ok
11:33:17.0668 4176 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
11:33:17.0669 4176 WIMMount - ok
11:33:17.0671 4176 WinDefend - ok
11:33:17.0675 4176 WinHttpAutoProxySvc - ok
11:33:17.0688 4176 Winmgmt (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll
11:33:17.0690 4176 Winmgmt - ok
11:33:17.0716 4176 WinRM (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll
11:33:17.0731 4176 WinRM - ok
11:33:17.0750 4176 Wlansvc (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll
11:33:17.0758 4176 Wlansvc - ok
11:33:17.0769 4176 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\DRIVERS\wmiacpi.sys
11:33:17.0770 4176 WmiAcpi - ok
11:33:17.0784 4176 wmiApSrv (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe
11:33:17.0787 4176 wmiApSrv - ok
11:33:17.0790 4176 WMPNetworkSvc - ok
11:33:17.0800 4176 WPCSvc (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll
11:33:17.0802 4176 WPCSvc - ok
11:33:17.0812 4176 WPDBusEnum (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll
11:33:17.0814 4176 WPDBusEnum - ok
11:33:17.0824 4176 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
11:33:17.0825 4176 ws2ifsl - ok
11:33:17.0835 4176 wscsvc (e8b1fe6669397d1772d8196df0e57a9e) C:\Windows\System32\wscsvc.dll
11:33:17.0837 4176 wscsvc - ok
11:33:17.0846 4176 WSearch - ok
11:33:17.0888 4176 wuauserv (9df12edbc698b0bc353b3ef84861e430) C:\Windows\system32\wuaueng.dll
11:33:17.0914 4176 wuauserv - ok
11:33:17.0925 4176 WudfPf (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
11:33:17.0926 4176 WudfPf - ok
11:33:17.0938 4176 WUDFRd (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
11:33:17.0940 4176 WUDFRd - ok
11:33:17.0951 4176 wudfsvc (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll
11:33:17.0955 4176 wudfsvc - ok
11:33:17.0966 4176 WwanSvc (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll
11:33:17.0969 4176 WwanSvc - ok
11:33:17.0976 4176 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk1\DR1
11:33:17.0979 4176 \Device\Harddisk1\DR1 - ok
11:33:17.0981 4176 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
11:33:17.0982 4176 \Device\Harddisk0\DR0 - ok
11:33:17.0984 4176 Boot (0x1200) (9343de7a8339f4021d2b90fe1d650bdc) \Device\Harddisk1\DR1\Partition0
11:33:17.0985 4176 \Device\Harddisk1\DR1\Partition0 - ok
11:33:17.0986 4176 Boot (0x1200) (6c7dd7eea124b85bf588c21804e49673) \Device\Harddisk0\DR0\Partition0
11:33:17.0987 4176 \Device\Harddisk0\DR0\Partition0 - ok
11:33:17.0987 4176 ============================================================
11:33:17.0987 4176 Scan finished
11:33:17.0987 4176 ============================================================
11:33:17.0993 4472 Detected object count: 0
11:33:17.0993 4472 Actual detected object count: 0
11:34:20.0815 5404 Deinitialize success
Re: Win32/TrojanDownloader.Mebload.AR
Stahnete RogueKiller http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe
- Ukoncete vsechny programy
- Pokud pouzivate Win Vista ci W7, kliknete na RogueKiller pravym a dejte Run As Administrator ci Spustit jako spravce
- Pockejte na dokonceni PreScanu
- Zvolte moznost Prohledat (scan)
- Po dokonceni skenu kliknete na Zpráva (Report)- otevre se log, ten sem vlozte
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen od 1. února 2011.
Člen
od 1. února 2011.Re: Win32/TrojanDownloader.Mebload.AR
RogueKiller V7.3.2 [03/20/2012] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Podpora: http://www.geekstogo.com/forum/files/fi ... guekiller/
Operační systém: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Spuštěno v: Normální režim
Uživatel: Jan [Práva správce]
Mód: Kontrola -- Datum: 04/02/2012 18:51:21
¤¤¤ Škodlivé procesy: 0 ¤¤¤
¤¤¤ Záznamy Registrů: 5 ¤¤¤
[HJ] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> FOUND
[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HIDDEN KEY] HKLM\[...]\services : Intelﾮ PROSet Monitoring Service () -> FOUND
[HIDDEN KEY] HKLM\[...]\services : Intelﾮ PROSet Monitoring Service () -> FOUND
¤¤¤ Zvláštní soubory / Složky: ¤¤¤
¤¤¤ Ovladač: [NENAHRÁNO] ¤¤¤
¤¤¤ Nákaza : ¤¤¤
¤¤¤ Soubor HOSTS: ¤¤¤
¤¤¤ Kontrola MBR: ¤¤¤
+++++ PhysicalDrive0: WDC WD7502AAEX-00Z3A0 ATA Device +++++
--- User ---
[MBR] 803962acc04a91af0103d7fd4cac2060
[BSP] e8450b128ee835bad669ca778b08e81c : Windows 7 MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 715402 Mo
User = LL1 ... OK!
User = LL2 ... OK!
+++++ PhysicalDrive1: OCZ-AGILITY3 ATA Device +++++
--- User ---
[MBR] f67d96cfa2b97420160b03957f5b76ac
[BSP] f71d91843f4c4a53a49e809b597f0c9d : Windows 7 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 57139 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Dokončeno : << RKreport[1].txt >>
RKreport[1].txt
mail: tigzyRK<at>gmail<dot>com
Podpora: http://www.geekstogo.com/forum/files/fi ... guekiller/
Operační systém: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Spuštěno v: Normální režim
Uživatel: Jan [Práva správce]
Mód: Kontrola -- Datum: 04/02/2012 18:51:21
¤¤¤ Škodlivé procesy: 0 ¤¤¤
¤¤¤ Záznamy Registrů: 5 ¤¤¤
[HJ] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> FOUND
[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HIDDEN KEY] HKLM\[...]\services : Intelﾮ PROSet Monitoring Service () -> FOUND
[HIDDEN KEY] HKLM\[...]\services : Intelﾮ PROSet Monitoring Service () -> FOUND
¤¤¤ Zvláštní soubory / Složky: ¤¤¤
¤¤¤ Ovladač: [NENAHRÁNO] ¤¤¤
¤¤¤ Nákaza : ¤¤¤
¤¤¤ Soubor HOSTS: ¤¤¤
¤¤¤ Kontrola MBR: ¤¤¤
+++++ PhysicalDrive0: WDC WD7502AAEX-00Z3A0 ATA Device +++++
--- User ---
[MBR] 803962acc04a91af0103d7fd4cac2060
[BSP] e8450b128ee835bad669ca778b08e81c : Windows 7 MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 715402 Mo
User = LL1 ... OK!
User = LL2 ... OK!
+++++ PhysicalDrive1: OCZ-AGILITY3 ATA Device +++++
--- User ---
[MBR] f67d96cfa2b97420160b03957f5b76ac
[BSP] f71d91843f4c4a53a49e809b597f0c9d : Windows 7 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 57139 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Dokončeno : << RKreport[1].txt >>
RKreport[1].txt
Re: Win32/TrojanDownloader.Mebload.AR
Spustte znovu RogueKiller
- Pokud pouzivate Win Vista ci W7, kliknete na RogueKiller pravym a dejte Run As Administrator ci Spustit jako spravce
- Zvolte moznost Prohledat a pote Smazat a nasledne Zprava - otevre se log, ten sem vlozte
- Pak kliknete na Oprava Host a Zprava - otevre se log, ten sem vlozte
- Pak kliknete na Oprava Proxy a Zprava - otevre se log, ten sem vlozte
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen od 1. února 2011.
Člen
od 1. února 2011.Re: Win32/TrojanDownloader.Mebload.AR
RogueKiller V7.3.2 [03/20/2012] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Podpora: http://www.geekstogo.com/forum/files/fi ... guekiller/
Operační systém: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Spuštěno v: Normální režim
Uživatel: Jan [Práva správce]
Mód: Odebrat -- Datum: 04/02/2012 19:01:10
¤¤¤ Škodlivé procesy: 0 ¤¤¤
¤¤¤ Záznamy Registrů: 5 ¤¤¤
[HJ] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> REPLACED (1)
[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)
[HIDDEN KEY] HKLM\[...]\services : Intelﾮ PROSet Monitoring Service () -> DELETED
[HIDDEN KEY] HKLM\[...]\services : Intelﾮ PROSet Monitoring Service () -> DELETED
¤¤¤ Zvláštní soubory / Složky: ¤¤¤
¤¤¤ Ovladač: [NENAHRÁNO] ¤¤¤
¤¤¤ Nákaza : ¤¤¤
¤¤¤ Soubor HOSTS: ¤¤¤
¤¤¤ Kontrola MBR: ¤¤¤
+++++ PhysicalDrive0: WDC WD7502AAEX-00Z3A0 ATA Device +++++
--- User ---
[MBR] 803962acc04a91af0103d7fd4cac2060
[BSP] e8450b128ee835bad669ca778b08e81c : Windows 7 MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 715402 Mo
User = LL1 ... OK!
User = LL2 ... OK!
+++++ PhysicalDrive1: OCZ-AGILITY3 ATA Device +++++
--- User ---
[MBR] f67d96cfa2b97420160b03957f5b76ac
[BSP] f71d91843f4c4a53a49e809b597f0c9d : Windows 7 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 57139 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Dokončeno : << RKreport[3].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt
oprava host
RogueKiller V7.3.2 [03/20/2012] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Podpora: http://www.geekstogo.com/forum/files/fi ... guekiller/
Operační systém: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Spuštěno v: Normální režim
Uživatel: Jan [Práva správce]
Mód: Oprava HOSTS -- Datum: 04/02/2012 19:01:37
¤¤¤ Škodlivé procesy: 0 ¤¤¤
¤¤¤ Ovladač: [NENAHRÁNO] ¤¤¤
¤¤¤ Soubor HOSTS: ¤¤¤
¤¤¤ Resetovaný HOSTS: ¤¤¤
127.0.0.1 localhost
Dokončeno : << RKreport[4].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt ; RKreport[4].txt
oprava proxy
RogueKiller V7.3.2 [03/20/2012] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Podpora: http://www.geekstogo.com/forum/files/fi ... guekiller/
Operační systém: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Spuštěno v: Normální režim
Uživatel: Jan [Práva správce]
Mód: Oprava Proxy -- Datum: 04/02/2012 19:01:51
¤¤¤ Škodlivé procesy: 0 ¤¤¤
¤¤¤ Ovladač: [NENAHRÁNO] ¤¤¤
¤¤¤ Záznamy Registrů: 0 ¤¤¤
Dokončeno : << RKreport[5].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt ; RKreport[4].txt ; RKreport[5].txt
mail: tigzyRK<at>gmail<dot>com
Podpora: http://www.geekstogo.com/forum/files/fi ... guekiller/
Operační systém: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Spuštěno v: Normální režim
Uživatel: Jan [Práva správce]
Mód: Odebrat -- Datum: 04/02/2012 19:01:10
¤¤¤ Škodlivé procesy: 0 ¤¤¤
¤¤¤ Záznamy Registrů: 5 ¤¤¤
[HJ] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> REPLACED (1)
[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)
[HIDDEN KEY] HKLM\[...]\services : Intelﾮ PROSet Monitoring Service () -> DELETED
[HIDDEN KEY] HKLM\[...]\services : Intelﾮ PROSet Monitoring Service () -> DELETED
¤¤¤ Zvláštní soubory / Složky: ¤¤¤
¤¤¤ Ovladač: [NENAHRÁNO] ¤¤¤
¤¤¤ Nákaza : ¤¤¤
¤¤¤ Soubor HOSTS: ¤¤¤
¤¤¤ Kontrola MBR: ¤¤¤
+++++ PhysicalDrive0: WDC WD7502AAEX-00Z3A0 ATA Device +++++
--- User ---
[MBR] 803962acc04a91af0103d7fd4cac2060
[BSP] e8450b128ee835bad669ca778b08e81c : Windows 7 MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 715402 Mo
User = LL1 ... OK!
User = LL2 ... OK!
+++++ PhysicalDrive1: OCZ-AGILITY3 ATA Device +++++
--- User ---
[MBR] f67d96cfa2b97420160b03957f5b76ac
[BSP] f71d91843f4c4a53a49e809b597f0c9d : Windows 7 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 57139 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Dokončeno : << RKreport[3].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt
oprava host
RogueKiller V7.3.2 [03/20/2012] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Podpora: http://www.geekstogo.com/forum/files/fi ... guekiller/
Operační systém: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Spuštěno v: Normální režim
Uživatel: Jan [Práva správce]
Mód: Oprava HOSTS -- Datum: 04/02/2012 19:01:37
¤¤¤ Škodlivé procesy: 0 ¤¤¤
¤¤¤ Ovladač: [NENAHRÁNO] ¤¤¤
¤¤¤ Soubor HOSTS: ¤¤¤
¤¤¤ Resetovaný HOSTS: ¤¤¤
127.0.0.1 localhost
Dokončeno : << RKreport[4].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt ; RKreport[4].txt
oprava proxy
RogueKiller V7.3.2 [03/20/2012] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Podpora: http://www.geekstogo.com/forum/files/fi ... guekiller/
Operační systém: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Spuštěno v: Normální režim
Uživatel: Jan [Práva správce]
Mód: Oprava Proxy -- Datum: 04/02/2012 19:01:51
¤¤¤ Škodlivé procesy: 0 ¤¤¤
¤¤¤ Ovladač: [NENAHRÁNO] ¤¤¤
¤¤¤ Záznamy Registrů: 0 ¤¤¤
Dokončeno : << RKreport[5].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt ; RKreport[4].txt ; RKreport[5].txt
Re: Win32/TrojanDownloader.Mebload.AR
PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK
Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe
- Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
- Pokud mate Win XP spustte pod uctem Spravce\Administratora
- Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
- Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
- Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
- Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
- Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
- Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
- Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen od 1. února 2011.
Člen
od 1. února 2011.Re: Win32/TrojanDownloader.Mebload.AR
ComboFix 12-04-01.03 - Jan 02.04.2012 19:37:35.1.4 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.8099.6180 [GMT 2:00]
Spuštěný z: c:\users\Jan\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\TNod User & Password Finder\TNODUP.exe
c:\programdata\Windows
c:\programdata\Windows\ccdxmmde.dat
c:\programdata\windows\drss.dat
c:\programdata\Windows\xessmsxe.dat
c:\windows\PFRO.log
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
c:\windows\SysWow64\pthreadVC.dll
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-03-02 do 2012-04-02 )))))))))))))))))))))))))))))))
.
.
2012-04-02 17:40 . 2012-04-02 17:40 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-04-02 17:37 . 2012-04-02 17:37 69000 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{9961AA39-0328-4C85-88FC-F8DB09DF8CAB}\offreg.dll
2012-04-02 09:43 . 2012-04-02 16:27 -------- d-----w- c:\program files\trend micro
2012-04-02 09:43 . 2012-04-02 09:43 -------- d-----w- C:\rsit
2012-04-02 08:52 . 2012-04-02 08:52 -------- d-----w- c:\users\Jan\AppData\Roaming\Malwarebytes
2012-04-02 08:52 . 2012-04-02 08:52 -------- d-----w- c:\programdata\Malwarebytes
2012-04-02 08:52 . 2012-04-02 08:52 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-04-02 08:52 . 2011-12-10 13:24 23152 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-04-02 08:45 . 2012-04-02 08:45 8767136 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
2012-04-02 08:40 . 2012-04-02 08:45 418464 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-03-31 07:17 . 2012-03-14 03:27 8669240 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{9961AA39-0328-4C85-88FC-F8DB09DF8CAB}\mpengine.dll
2012-03-30 10:12 . 2012-03-30 10:12 -------- d-----w- c:\program files\CCleaner
2012-03-19 05:49 . 2012-03-19 05:49 592824 ----a-w- c:\program files (x86)\Mozilla Firefox\gkmedias.dll
2012-03-19 05:49 . 2012-03-19 05:49 44472 ----a-w- c:\program files (x86)\Mozilla Firefox\mozglue.dll
2012-03-14 17:49 . 2011-11-19 15:20 5559152 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-03-14 17:48 . 2011-11-19 14:50 3968368 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2012-03-14 17:48 . 2011-11-19 14:50 3913584 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2012-03-14 06:34 . 2012-02-10 06:36 1544192 ----a-w- c:\windows\system32\DWrite.dll
2012-03-14 06:34 . 2012-02-03 04:34 3145728 ----a-w- c:\windows\system32\win32k.sys
2012-03-14 06:34 . 2012-02-10 05:38 1077248 ----a-w- c:\windows\SysWow64\DWrite.dll
2012-03-14 06:32 . 2012-02-17 06:38 1031680 ----a-w- c:\windows\system32\rdpcore.dll
2012-03-14 06:32 . 2012-02-17 05:34 826880 ----a-w- c:\windows\SysWow64\rdpcore.dll
2012-03-14 06:32 . 2012-02-17 04:58 210944 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-03-14 06:32 . 2012-02-17 04:57 23552 ----a-w- c:\windows\system32\drivers\tdtcp.sys
2012-03-14 06:32 . 2012-01-25 06:38 77312 ----a-w- c:\windows\system32\rdpwsx.dll
2012-03-14 06:32 . 2012-01-25 06:38 149504 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-03-14 06:32 . 2012-01-25 06:33 9216 ----a-w- c:\windows\system32\rdrmemptylst.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-04-02 08:45 . 2011-09-13 19:58 70304 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-02-25 13:09 . 2011-10-31 16:27 484176 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2012-02-23 08:18 . 2010-11-21 03:27 279656 ------w- c:\windows\system32\MpSigStub.exe
2012-02-14 17:55 . 2012-02-14 17:55 276248 ----a-w- c:\windows\SysWow64\IntelCpHeciSvc.exe
2012-02-14 17:55 . 2012-02-14 17:55 5886232 ----a-w- c:\windows\system32\GfxUI.exe
2012-02-14 17:55 . 2012-02-14 17:55 511768 ----a-w- c:\windows\system32\igfxsrvc.exe
2012-02-14 17:55 . 2012-02-14 17:55 440600 ----a-w- c:\windows\system32\igfxpers.exe
2012-02-14 17:55 . 2012-02-14 17:55 398616 ----a-w- c:\windows\system32\hkcmd.exe
2012-02-14 17:55 . 2012-02-14 17:55 250136 ----a-w- c:\windows\system32\igfxext.exe
2012-02-14 17:55 . 2012-02-14 17:55 184600 ----a-w- c:\windows\system32\difx64.exe
2012-02-14 17:55 . 2012-02-14 17:55 170264 ----a-w- c:\windows\system32\igfxtray.exe
2012-02-14 17:53 . 2012-02-14 17:53 90112 ----a-w- c:\windows\system32\igfxCoIn_v2653.dll
2012-02-14 17:47 . 2012-02-14 17:47 8086528 ----a-w- c:\windows\system32\igdumd64.dll
2012-02-14 17:47 . 2012-02-14 17:47 14692224 ----a-w- c:\windows\system32\drivers\igdkmd64.sys
2012-02-14 17:47 . 2012-02-14 17:47 963912 ----a-w- c:\windows\system32\igkrng600.bin
2012-02-14 17:47 . 2012-02-14 17:47 79360 ----a-w- c:\windows\system32\igdde64.dll
2012-02-14 17:47 . 2012-02-14 17:47 261208 ----a-w- c:\windows\system32\igfcg600m.bin
2012-02-14 17:44 . 2012-02-14 17:44 6120960 ----a-w- c:\windows\SysWow64\igdumd32.dll
2012-02-14 17:44 . 2012-02-14 17:44 58880 ----a-w- c:\windows\SysWow64\igdde32.dll
2012-02-14 17:42 . 2011-09-13 19:37 9605632 ----a-w- c:\windows\system32\igd10umd64.dll
2012-02-14 17:35 . 2011-09-13 19:37 7794688 ----a-w- c:\windows\SysWow64\igd10umd32.dll
2012-02-14 17:07 . 2012-02-14 17:07 18125312 ----a-w- c:\windows\system32\ig4icd64.dll
2012-02-14 16:59 . 2012-02-14 16:59 13209600 ----a-w- c:\windows\SysWow64\ig4icd32.dll
2012-02-14 16:57 . 2012-02-14 16:57 439808 ----a-w- c:\windows\system32\igfxresn.lrc
2012-02-14 16:57 . 2012-02-14 16:57 439296 ----a-w- c:\windows\system32\igfxrrom.lrc
2012-02-14 16:57 . 2012-02-14 16:57 438784 ----a-w- c:\windows\system32\igfxrhrv.lrc
2012-02-14 16:57 . 2012-02-14 16:57 438272 ----a-w- c:\windows\system32\igfxrsky.lrc
2012-02-14 16:57 . 2012-02-14 16:57 437760 ----a-w- c:\windows\system32\igfxrtrk.lrc
2012-02-14 16:57 . 2012-02-14 16:57 437760 ----a-w- c:\windows\system32\igfxrsve.lrc
2012-02-14 16:57 . 2012-02-14 16:57 437760 ----a-w- c:\windows\system32\igfxrslv.lrc
2012-02-14 16:57 . 2012-02-14 16:57 437248 ----a-w- c:\windows\system32\igfxrtha.lrc
2012-02-14 16:57 . 2012-02-14 16:57 439296 ----a-w- c:\windows\system32\igfxrrus.lrc
2012-02-14 16:57 . 2012-02-14 16:57 438784 ----a-w- c:\windows\system32\igfxrptg.lrc
2012-02-14 16:57 . 2012-02-14 16:57 438784 ----a-w- c:\windows\system32\igfxrplk.lrc
2012-02-14 16:57 . 2012-02-14 16:57 438784 ----a-w- c:\windows\system32\igfxrita.lrc
2012-02-14 16:57 . 2012-02-14 16:57 437760 ----a-w- c:\windows\system32\igfxrptb.lrc
2012-02-14 16:57 . 2012-02-14 16:57 437760 ----a-w- c:\windows\system32\igfxrnor.lrc
2012-02-14 16:57 . 2012-02-14 16:57 432128 ----a-w- c:\windows\system32\igfxrjpn.lrc
2012-02-14 16:57 . 2012-02-14 16:57 430592 ----a-w- c:\windows\system32\igfxrkor.lrc
2012-02-14 16:57 . 2012-02-14 16:57 440320 ----a-w- c:\windows\system32\igfxrell.lrc
2012-02-14 16:57 . 2012-02-14 16:57 439808 ----a-w- c:\windows\system32\igfxrfra.lrc
2012-02-14 16:57 . 2012-02-14 16:57 438784 ----a-w- c:\windows\system32\igfxrdeu.lrc
2012-02-14 16:57 . 2012-02-14 16:57 438272 ----a-w- c:\windows\system32\igfxrhun.lrc
2012-02-14 16:57 . 2012-02-14 16:57 438272 ----a-w- c:\windows\system32\igfxrfin.lrc
2012-02-14 16:57 . 2012-02-14 16:57 435712 ----a-w- c:\windows\system32\igfxrheb.lrc
2012-02-14 16:57 . 2012-02-14 16:57 438784 ----a-w- c:\windows\system32\igfxrnld.lrc
2012-02-14 16:57 . 2012-02-14 16:57 438272 ----a-w- c:\windows\system32\igfxrcsy.lrc
2012-02-14 16:57 . 2012-02-14 16:57 437248 ----a-w- c:\windows\system32\igfxrdan.lrc
2012-02-14 16:57 . 2012-02-14 16:57 429056 ----a-w- c:\windows\system32\igfxrcht.lrc
2012-02-14 16:57 . 2012-02-14 16:57 428544 ----a-w- c:\windows\system32\igfxrchs.lrc
2012-02-14 16:57 . 2012-02-14 16:57 435712 ----a-w- c:\windows\system32\igfxrara.lrc
2012-02-14 16:57 . 2012-02-14 16:57 126976 ----a-w- c:\windows\system32\igfxcpl.cpl
2012-02-14 16:57 . 2012-02-14 16:57 386048 ----a-w- c:\windows\system32\igfxpph.dll
2012-02-14 16:57 . 2012-02-14 16:57 410624 ----a-w- c:\windows\system32\igfxTMM.dll
2012-02-14 16:57 . 2012-02-14 16:57 28672 ----a-w- c:\windows\system32\igfxexps.dll
2012-02-14 16:57 . 2011-09-13 19:37 63488 ----a-w- c:\windows\system32\igfxsrvc.dll
2012-02-14 16:56 . 2011-09-13 19:37 110592 ----a-w- c:\windows\system32\hccutils.dll
2012-02-14 16:56 . 2012-02-14 16:56 9216 ----a-w- c:\windows\system32\IGFXDEVLib.dll
2012-02-14 16:56 . 2012-02-14 16:56 430080 ----a-w- c:\windows\system32\igfxdev.dll
2012-02-14 16:56 . 2012-02-14 16:56 172032 ----a-w- c:\windows\system32\gfxSrvc.dll
2012-02-14 16:56 . 2012-02-14 16:56 286208 ----a-w- c:\windows\system32\igfxrenu.lrc
2012-02-14 16:56 . 2012-02-14 16:56 142336 ----a-w- c:\windows\system32\igfxdo.dll
2012-02-14 16:56 . 2011-09-13 19:37 9007616 ----a-w- c:\windows\system32\igfxress.dll
2012-02-14 16:55 . 2012-02-14 16:55 25088 ----a-w- c:\windows\SysWow64\igfxexps32.dll
2012-02-14 16:54 . 2012-02-14 16:54 321024 ----a-w- c:\windows\SysWow64\igfxdv32.dll
2012-02-14 16:53 . 2012-02-14 16:53 524800 ----a-w- c:\windows\system32\iglhsip64.dll
2012-02-14 16:53 . 2012-02-14 16:53 519680 ----a-w- c:\windows\SysWow64\iglhsip32.dll
2012-02-14 16:53 . 2012-02-14 16:53 2967040 ----a-w- c:\windows\system32\igfxcmjit64.dll
2012-02-14 16:53 . 2012-02-14 16:53 237056 ----a-w- c:\windows\SysWow64\igfxcmrt32.dll
2012-02-14 16:53 . 2012-02-14 16:53 2321408 ----a-w- c:\windows\SysWow64\igfxcmjit32.dll
2012-02-14 16:53 . 2012-02-14 16:53 213504 ----a-w- c:\windows\system32\iglhcp64.dll
2012-02-14 16:53 . 2012-02-14 16:53 193024 ----a-w- c:\windows\system32\igfxcmrt64.dll
2012-02-14 16:53 . 2012-02-14 16:53 177152 ----a-w- c:\windows\SysWow64\iglhcp32.dll
2012-01-10 13:37 . 2012-01-10 13:37 90112 ----a-w- c:\windows\system32\igfxCoIn_v2622.dll
2012-01-10 13:12 . 2012-01-10 13:12 581120 ----a-w- c:\windows\SysWow64\igdumdx32.dll
2012-01-04 10:44 . 2012-02-16 15:51 509952 ----a-w- c:\windows\system32\ntshrui.dll
2012-01-04 08:58 . 2012-02-16 15:51 442880 ----a-w- c:\windows\SysWow64\ntshrui.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"Winsplit"="c:\program files (x86)\WinSplit Revolution\WinSplit.exe" [2011-04-12 3951616]
"Infium"="c:\program files (x86)\QIP 2010\qip.exe" [2011-08-22 6821248]
"PCSpeedUp"="c:\program files (x86)\Zrychleni Pocitace\PCSpeedUp.lnk" [2011-10-31 2421]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"BCU"="c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe" [2009-10-26 375000]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2010-01-19 43632]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-01-13 460872]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-03-06 4241512]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
AVer HID Receiver.lnk - c:\program files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe [2011-10-9 155648]
AVerQuick.lnk - c:\program files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe [2011-10-9 675840]
SnugTV Quick Start.lnk - c:\windows\Installer\{33CFCB69-2FA5-43E8-B8A8-FAA155F870B5}\NewShortcut1_46FEF19C05F1475DAA14D9007DC15270_2.exe [2011-10-9 57344]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Služba Google Update (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-04-02 136176]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 253600]
R3 ATHDFU;Atheros Valkyrie USB BootROM;c:\windows\system32\Drivers\AthDfu.sys [x]
R3 cphs;Intel(R) Content Protection HECI Service;c:\windows\SysWow64\IntelCpHeciSvc.exe [2012-02-14 276248]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [x]
R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2011-11-09 1431888]
R3 gupdatem;Služba Google Update (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-04-02 136176]
R3 HTCAND64;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys [x]
R3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\DRIVERS\htcnprot.sys [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [x]
S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe [2011-03-13 74912]
S2 Autodesk Content Service;Autodesk Content Service;c:\program files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [2011-02-02 18656]
S2 AVerRemote;AVerRemote;c:\program files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe [2010-04-27 348160]
S2 AVerScheduleService;AVerScheduleService;c:\program files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe [2011-04-01 403456]
S2 AVerUpdateServer;AVerUpdateServer;c:\program files (x86)\AVerMedia\AVerUpdate\AVerUpdateServer.exe [2011-01-06 168448]
S2 BCUService;Browser Configuration Utility Service;c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe [2009-10-26 223464]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys [x]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys [x]
S3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys [x]
S3 AVerAF35;AVerMedia A867 USB DVB-T;c:\windows\system32\Drivers\AVerAF35.sys [x]
S3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys [x]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys [x]
S3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys [x]
S3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys [x]
S3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys [x]
S3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys [x]
S3 e1cexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver C;c:\windows\system32\DRIVERS\e1c62x64.sys [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - ASWSNX
.
Obsah adresáře 'Naplánované úlohy'
.
2012-04-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 08:45]
.
2012-04-02 c:\windows\Tasks\AutoKMS.job
- c:\windows\AutoKMS\AutoKMS.exe [2011-10-14 14:49]
.
2012-04-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-04-02 16:16]
.
2012-04-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-04-02 16:16]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-03-06 23:15 135408 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-11-19 11613288]
"AtherosBtStack"="c:\program files (x86)\Bluetooth Suite\BtvStack.exe" [2011-03-13 617120]
"AthBtTray"="c:\program files (x86)\Bluetooth Suite\AthBtTray.exe" [2011-03-13 379552]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 112512]
"Free PDF Print Dispatcher"="c:\program files (x86)\pdfconverter.com\FreePDF Creator\itFPCPrnDisp.exe" [2010-01-15 25600]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-02-14 170264]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-02-14 398616]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-02-14 440600]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.seznam.cz/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~1\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~1\Office14\ONBttnIE.dll/105
IE: Převést cíl vazby do Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Převést do Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Připojit cíl vazby k existujícímu PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Připojit k existujícímu PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
TCP: DhcpNameServer = 192.168.1.1 10.92.1.254
FF - ProfilePath - c:\users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\jxi8mt5e.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.seznam.cz
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
HKLM-Run-TNOD UP - c:\program files (x86)\TNod User & Password Finder\TNODUP.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_228_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_228_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_228.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_228.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_228.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_228.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2012-04-02 19:41:11
ComboFix-quarantined-files.txt 2012-04-02 17:41
.
Před spuštěním: Volných bajtů: 12 047 384 576
Po spuštění: Volných bajtů: 12 052 762 624
.
- - End Of File - - 3D9915F8CC24721BDBEE2C679279858D
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.8099.6180 [GMT 2:00]
Spuštěný z: c:\users\Jan\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\TNod User & Password Finder\TNODUP.exe
c:\programdata\Windows
c:\programdata\Windows\ccdxmmde.dat
c:\programdata\windows\drss.dat
c:\programdata\Windows\xessmsxe.dat
c:\windows\PFRO.log
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
c:\windows\SysWow64\pthreadVC.dll
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-03-02 do 2012-04-02 )))))))))))))))))))))))))))))))
.
.
2012-04-02 17:40 . 2012-04-02 17:40 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-04-02 17:37 . 2012-04-02 17:37 69000 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{9961AA39-0328-4C85-88FC-F8DB09DF8CAB}\offreg.dll
2012-04-02 09:43 . 2012-04-02 16:27 -------- d-----w- c:\program files\trend micro
2012-04-02 09:43 . 2012-04-02 09:43 -------- d-----w- C:\rsit
2012-04-02 08:52 . 2012-04-02 08:52 -------- d-----w- c:\users\Jan\AppData\Roaming\Malwarebytes
2012-04-02 08:52 . 2012-04-02 08:52 -------- d-----w- c:\programdata\Malwarebytes
2012-04-02 08:52 . 2012-04-02 08:52 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-04-02 08:52 . 2011-12-10 13:24 23152 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-04-02 08:45 . 2012-04-02 08:45 8767136 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
2012-04-02 08:40 . 2012-04-02 08:45 418464 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-03-31 07:17 . 2012-03-14 03:27 8669240 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{9961AA39-0328-4C85-88FC-F8DB09DF8CAB}\mpengine.dll
2012-03-30 10:12 . 2012-03-30 10:12 -------- d-----w- c:\program files\CCleaner
2012-03-19 05:49 . 2012-03-19 05:49 592824 ----a-w- c:\program files (x86)\Mozilla Firefox\gkmedias.dll
2012-03-19 05:49 . 2012-03-19 05:49 44472 ----a-w- c:\program files (x86)\Mozilla Firefox\mozglue.dll
2012-03-14 17:49 . 2011-11-19 15:20 5559152 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-03-14 17:48 . 2011-11-19 14:50 3968368 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2012-03-14 17:48 . 2011-11-19 14:50 3913584 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2012-03-14 06:34 . 2012-02-10 06:36 1544192 ----a-w- c:\windows\system32\DWrite.dll
2012-03-14 06:34 . 2012-02-03 04:34 3145728 ----a-w- c:\windows\system32\win32k.sys
2012-03-14 06:34 . 2012-02-10 05:38 1077248 ----a-w- c:\windows\SysWow64\DWrite.dll
2012-03-14 06:32 . 2012-02-17 06:38 1031680 ----a-w- c:\windows\system32\rdpcore.dll
2012-03-14 06:32 . 2012-02-17 05:34 826880 ----a-w- c:\windows\SysWow64\rdpcore.dll
2012-03-14 06:32 . 2012-02-17 04:58 210944 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-03-14 06:32 . 2012-02-17 04:57 23552 ----a-w- c:\windows\system32\drivers\tdtcp.sys
2012-03-14 06:32 . 2012-01-25 06:38 77312 ----a-w- c:\windows\system32\rdpwsx.dll
2012-03-14 06:32 . 2012-01-25 06:38 149504 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-03-14 06:32 . 2012-01-25 06:33 9216 ----a-w- c:\windows\system32\rdrmemptylst.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-04-02 08:45 . 2011-09-13 19:58 70304 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-02-25 13:09 . 2011-10-31 16:27 484176 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2012-02-23 08:18 . 2010-11-21 03:27 279656 ------w- c:\windows\system32\MpSigStub.exe
2012-02-14 17:55 . 2012-02-14 17:55 276248 ----a-w- c:\windows\SysWow64\IntelCpHeciSvc.exe
2012-02-14 17:55 . 2012-02-14 17:55 5886232 ----a-w- c:\windows\system32\GfxUI.exe
2012-02-14 17:55 . 2012-02-14 17:55 511768 ----a-w- c:\windows\system32\igfxsrvc.exe
2012-02-14 17:55 . 2012-02-14 17:55 440600 ----a-w- c:\windows\system32\igfxpers.exe
2012-02-14 17:55 . 2012-02-14 17:55 398616 ----a-w- c:\windows\system32\hkcmd.exe
2012-02-14 17:55 . 2012-02-14 17:55 250136 ----a-w- c:\windows\system32\igfxext.exe
2012-02-14 17:55 . 2012-02-14 17:55 184600 ----a-w- c:\windows\system32\difx64.exe
2012-02-14 17:55 . 2012-02-14 17:55 170264 ----a-w- c:\windows\system32\igfxtray.exe
2012-02-14 17:53 . 2012-02-14 17:53 90112 ----a-w- c:\windows\system32\igfxCoIn_v2653.dll
2012-02-14 17:47 . 2012-02-14 17:47 8086528 ----a-w- c:\windows\system32\igdumd64.dll
2012-02-14 17:47 . 2012-02-14 17:47 14692224 ----a-w- c:\windows\system32\drivers\igdkmd64.sys
2012-02-14 17:47 . 2012-02-14 17:47 963912 ----a-w- c:\windows\system32\igkrng600.bin
2012-02-14 17:47 . 2012-02-14 17:47 79360 ----a-w- c:\windows\system32\igdde64.dll
2012-02-14 17:47 . 2012-02-14 17:47 261208 ----a-w- c:\windows\system32\igfcg600m.bin
2012-02-14 17:44 . 2012-02-14 17:44 6120960 ----a-w- c:\windows\SysWow64\igdumd32.dll
2012-02-14 17:44 . 2012-02-14 17:44 58880 ----a-w- c:\windows\SysWow64\igdde32.dll
2012-02-14 17:42 . 2011-09-13 19:37 9605632 ----a-w- c:\windows\system32\igd10umd64.dll
2012-02-14 17:35 . 2011-09-13 19:37 7794688 ----a-w- c:\windows\SysWow64\igd10umd32.dll
2012-02-14 17:07 . 2012-02-14 17:07 18125312 ----a-w- c:\windows\system32\ig4icd64.dll
2012-02-14 16:59 . 2012-02-14 16:59 13209600 ----a-w- c:\windows\SysWow64\ig4icd32.dll
2012-02-14 16:57 . 2012-02-14 16:57 439808 ----a-w- c:\windows\system32\igfxresn.lrc
2012-02-14 16:57 . 2012-02-14 16:57 439296 ----a-w- c:\windows\system32\igfxrrom.lrc
2012-02-14 16:57 . 2012-02-14 16:57 438784 ----a-w- c:\windows\system32\igfxrhrv.lrc
2012-02-14 16:57 . 2012-02-14 16:57 438272 ----a-w- c:\windows\system32\igfxrsky.lrc
2012-02-14 16:57 . 2012-02-14 16:57 437760 ----a-w- c:\windows\system32\igfxrtrk.lrc
2012-02-14 16:57 . 2012-02-14 16:57 437760 ----a-w- c:\windows\system32\igfxrsve.lrc
2012-02-14 16:57 . 2012-02-14 16:57 437760 ----a-w- c:\windows\system32\igfxrslv.lrc
2012-02-14 16:57 . 2012-02-14 16:57 437248 ----a-w- c:\windows\system32\igfxrtha.lrc
2012-02-14 16:57 . 2012-02-14 16:57 439296 ----a-w- c:\windows\system32\igfxrrus.lrc
2012-02-14 16:57 . 2012-02-14 16:57 438784 ----a-w- c:\windows\system32\igfxrptg.lrc
2012-02-14 16:57 . 2012-02-14 16:57 438784 ----a-w- c:\windows\system32\igfxrplk.lrc
2012-02-14 16:57 . 2012-02-14 16:57 438784 ----a-w- c:\windows\system32\igfxrita.lrc
2012-02-14 16:57 . 2012-02-14 16:57 437760 ----a-w- c:\windows\system32\igfxrptb.lrc
2012-02-14 16:57 . 2012-02-14 16:57 437760 ----a-w- c:\windows\system32\igfxrnor.lrc
2012-02-14 16:57 . 2012-02-14 16:57 432128 ----a-w- c:\windows\system32\igfxrjpn.lrc
2012-02-14 16:57 . 2012-02-14 16:57 430592 ----a-w- c:\windows\system32\igfxrkor.lrc
2012-02-14 16:57 . 2012-02-14 16:57 440320 ----a-w- c:\windows\system32\igfxrell.lrc
2012-02-14 16:57 . 2012-02-14 16:57 439808 ----a-w- c:\windows\system32\igfxrfra.lrc
2012-02-14 16:57 . 2012-02-14 16:57 438784 ----a-w- c:\windows\system32\igfxrdeu.lrc
2012-02-14 16:57 . 2012-02-14 16:57 438272 ----a-w- c:\windows\system32\igfxrhun.lrc
2012-02-14 16:57 . 2012-02-14 16:57 438272 ----a-w- c:\windows\system32\igfxrfin.lrc
2012-02-14 16:57 . 2012-02-14 16:57 435712 ----a-w- c:\windows\system32\igfxrheb.lrc
2012-02-14 16:57 . 2012-02-14 16:57 438784 ----a-w- c:\windows\system32\igfxrnld.lrc
2012-02-14 16:57 . 2012-02-14 16:57 438272 ----a-w- c:\windows\system32\igfxrcsy.lrc
2012-02-14 16:57 . 2012-02-14 16:57 437248 ----a-w- c:\windows\system32\igfxrdan.lrc
2012-02-14 16:57 . 2012-02-14 16:57 429056 ----a-w- c:\windows\system32\igfxrcht.lrc
2012-02-14 16:57 . 2012-02-14 16:57 428544 ----a-w- c:\windows\system32\igfxrchs.lrc
2012-02-14 16:57 . 2012-02-14 16:57 435712 ----a-w- c:\windows\system32\igfxrara.lrc
2012-02-14 16:57 . 2012-02-14 16:57 126976 ----a-w- c:\windows\system32\igfxcpl.cpl
2012-02-14 16:57 . 2012-02-14 16:57 386048 ----a-w- c:\windows\system32\igfxpph.dll
2012-02-14 16:57 . 2012-02-14 16:57 410624 ----a-w- c:\windows\system32\igfxTMM.dll
2012-02-14 16:57 . 2012-02-14 16:57 28672 ----a-w- c:\windows\system32\igfxexps.dll
2012-02-14 16:57 . 2011-09-13 19:37 63488 ----a-w- c:\windows\system32\igfxsrvc.dll
2012-02-14 16:56 . 2011-09-13 19:37 110592 ----a-w- c:\windows\system32\hccutils.dll
2012-02-14 16:56 . 2012-02-14 16:56 9216 ----a-w- c:\windows\system32\IGFXDEVLib.dll
2012-02-14 16:56 . 2012-02-14 16:56 430080 ----a-w- c:\windows\system32\igfxdev.dll
2012-02-14 16:56 . 2012-02-14 16:56 172032 ----a-w- c:\windows\system32\gfxSrvc.dll
2012-02-14 16:56 . 2012-02-14 16:56 286208 ----a-w- c:\windows\system32\igfxrenu.lrc
2012-02-14 16:56 . 2012-02-14 16:56 142336 ----a-w- c:\windows\system32\igfxdo.dll
2012-02-14 16:56 . 2011-09-13 19:37 9007616 ----a-w- c:\windows\system32\igfxress.dll
2012-02-14 16:55 . 2012-02-14 16:55 25088 ----a-w- c:\windows\SysWow64\igfxexps32.dll
2012-02-14 16:54 . 2012-02-14 16:54 321024 ----a-w- c:\windows\SysWow64\igfxdv32.dll
2012-02-14 16:53 . 2012-02-14 16:53 524800 ----a-w- c:\windows\system32\iglhsip64.dll
2012-02-14 16:53 . 2012-02-14 16:53 519680 ----a-w- c:\windows\SysWow64\iglhsip32.dll
2012-02-14 16:53 . 2012-02-14 16:53 2967040 ----a-w- c:\windows\system32\igfxcmjit64.dll
2012-02-14 16:53 . 2012-02-14 16:53 237056 ----a-w- c:\windows\SysWow64\igfxcmrt32.dll
2012-02-14 16:53 . 2012-02-14 16:53 2321408 ----a-w- c:\windows\SysWow64\igfxcmjit32.dll
2012-02-14 16:53 . 2012-02-14 16:53 213504 ----a-w- c:\windows\system32\iglhcp64.dll
2012-02-14 16:53 . 2012-02-14 16:53 193024 ----a-w- c:\windows\system32\igfxcmrt64.dll
2012-02-14 16:53 . 2012-02-14 16:53 177152 ----a-w- c:\windows\SysWow64\iglhcp32.dll
2012-01-10 13:37 . 2012-01-10 13:37 90112 ----a-w- c:\windows\system32\igfxCoIn_v2622.dll
2012-01-10 13:12 . 2012-01-10 13:12 581120 ----a-w- c:\windows\SysWow64\igdumdx32.dll
2012-01-04 10:44 . 2012-02-16 15:51 509952 ----a-w- c:\windows\system32\ntshrui.dll
2012-01-04 08:58 . 2012-02-16 15:51 442880 ----a-w- c:\windows\SysWow64\ntshrui.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"Winsplit"="c:\program files (x86)\WinSplit Revolution\WinSplit.exe" [2011-04-12 3951616]
"Infium"="c:\program files (x86)\QIP 2010\qip.exe" [2011-08-22 6821248]
"PCSpeedUp"="c:\program files (x86)\Zrychleni Pocitace\PCSpeedUp.lnk" [2011-10-31 2421]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"BCU"="c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe" [2009-10-26 375000]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2010-01-19 43632]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-01-13 460872]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-03-06 4241512]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
AVer HID Receiver.lnk - c:\program files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe [2011-10-9 155648]
AVerQuick.lnk - c:\program files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe [2011-10-9 675840]
SnugTV Quick Start.lnk - c:\windows\Installer\{33CFCB69-2FA5-43E8-B8A8-FAA155F870B5}\NewShortcut1_46FEF19C05F1475DAA14D9007DC15270_2.exe [2011-10-9 57344]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Služba Google Update (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-04-02 136176]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 253600]
R3 ATHDFU;Atheros Valkyrie USB BootROM;c:\windows\system32\Drivers\AthDfu.sys [x]
R3 cphs;Intel(R) Content Protection HECI Service;c:\windows\SysWow64\IntelCpHeciSvc.exe [2012-02-14 276248]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [x]
R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2011-11-09 1431888]
R3 gupdatem;Služba Google Update (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-04-02 136176]
R3 HTCAND64;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys [x]
R3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\DRIVERS\htcnprot.sys [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [x]
S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe [2011-03-13 74912]
S2 Autodesk Content Service;Autodesk Content Service;c:\program files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [2011-02-02 18656]
S2 AVerRemote;AVerRemote;c:\program files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe [2010-04-27 348160]
S2 AVerScheduleService;AVerScheduleService;c:\program files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe [2011-04-01 403456]
S2 AVerUpdateServer;AVerUpdateServer;c:\program files (x86)\AVerMedia\AVerUpdate\AVerUpdateServer.exe [2011-01-06 168448]
S2 BCUService;Browser Configuration Utility Service;c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe [2009-10-26 223464]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys [x]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys [x]
S3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys [x]
S3 AVerAF35;AVerMedia A867 USB DVB-T;c:\windows\system32\Drivers\AVerAF35.sys [x]
S3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys [x]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys [x]
S3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys [x]
S3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys [x]
S3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys [x]
S3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys [x]
S3 e1cexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver C;c:\windows\system32\DRIVERS\e1c62x64.sys [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - ASWSNX
.
Obsah adresáře 'Naplánované úlohy'
.
2012-04-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 08:45]
.
2012-04-02 c:\windows\Tasks\AutoKMS.job
- c:\windows\AutoKMS\AutoKMS.exe [2011-10-14 14:49]
.
2012-04-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-04-02 16:16]
.
2012-04-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-04-02 16:16]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-03-06 23:15 135408 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-11-19 11613288]
"AtherosBtStack"="c:\program files (x86)\Bluetooth Suite\BtvStack.exe" [2011-03-13 617120]
"AthBtTray"="c:\program files (x86)\Bluetooth Suite\AthBtTray.exe" [2011-03-13 379552]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 112512]
"Free PDF Print Dispatcher"="c:\program files (x86)\pdfconverter.com\FreePDF Creator\itFPCPrnDisp.exe" [2010-01-15 25600]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-02-14 170264]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-02-14 398616]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-02-14 440600]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.seznam.cz/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~1\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~1\Office14\ONBttnIE.dll/105
IE: Převést cíl vazby do Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Převést do Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Připojit cíl vazby k existujícímu PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Připojit k existujícímu PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
TCP: DhcpNameServer = 192.168.1.1 10.92.1.254
FF - ProfilePath - c:\users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\jxi8mt5e.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.seznam.cz
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
HKLM-Run-TNOD UP - c:\program files (x86)\TNod User & Password Finder\TNODUP.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_228_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_228_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_228.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_228.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_228.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_228.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2012-04-02 19:41:11
ComboFix-quarantined-files.txt 2012-04-02 17:41
.
Před spuštěním: Volných bajtů: 12 047 384 576
Po spuštění: Volných bajtů: 12 052 762 624
.
- - End Of File - - 3D9915F8CC24721BDBEE2C679279858D
Re: Win32/TrojanDownloader.Mebload.AR
Pokud nemate, tak presunte Combofix na plochu
- Spustte poznamkovy blok (Start-spustit-notepad)
- Zkopirujte skript nize
Kód: Vybrat vše
KillAll:: Folder:: c:\program files (x86)\TNod User & Password Finder c:\program files (x86)\Zrychleni Pocitace c:\windows\AutoKMS File:: c:\windows\Tasks\Adobe Flash Player Updater.job c:\windows\Tasks\GoogleUpdateTaskMachineCore.job c:\windows\Tasks\GoogleUpdateTaskMachineUA.job Collect:: c:\windows\AutoKMS\AutoKMS.exe c:\windows\Tasks\AutoKMS.job Registry:: [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Infium"=- "PCSpeedUp"=- [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "BCU"=- "SunJavaUpdateSched"=- "Adobe ARM"="- "Malwarebytes' Anti-Malware"=- Driver:: gupdate gupdatem RegLock:: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] ClearJavaCache:: AtJob:: Reboot::- Ulozte vytvoreny TXT jako CFScript.txt
- Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
- Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte
Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen od 1. února 2011.
Člen
od 1. února 2011.Re: Win32/TrojanDownloader.Mebload.AR
ComboFix 12-04-01.03 - Jan 02.04.2012 20:22:59.2.4 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.8099.5924 [GMT 2:00]
Spuštěný z: c:\users\Jan\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Jan\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\windows\Tasks\Adobe Flash Player Updater.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
.
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\TNod User & Password Finder
c:\program files (x86)\TNod User & Password Finder\CREDITOS.txt
c:\program files (x86)\TNod User & Password Finder\LEEME.txt
c:\program files (x86)\TNod User & Password Finder\tnodicons.icl
c:\program files (x86)\TNod User & Password Finder\uninst-tnod.exe
c:\program files (x86)\Zrychleni Pocitace
c:\program files (x86)\Zrychleni Pocitace\PCSpeedUp.lnk
c:\program files (x86)\Zrychleni Pocitace\PCSUService.log
c:\windows\AutoKMS
c:\windows\AutoKMS\AutoKMS.exe
c:\windows\AutoKMS\AutoKMS.ini
c:\windows\AutoKMS\AutoKMS.log
c:\windows\Tasks\Adobe Flash Player Updater.job
c:\windows\Tasks\AutoKMS.job
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_gupdate
-------\Service_gupdatem
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-03-02 do 2012-04-02 )))))))))))))))))))))))))))))))
.
.
2012-04-02 09:43 . 2012-04-02 16:27 -------- d-----w- c:\program files\trend micro
2012-04-02 09:43 . 2012-04-02 09:43 -------- d-----w- C:\rsit
2012-04-02 08:52 . 2012-04-02 08:52 -------- d-----w- c:\users\Jan\AppData\Roaming\Malwarebytes
2012-04-02 08:52 . 2012-04-02 08:52 -------- d-----w- c:\programdata\Malwarebytes
2012-04-02 08:52 . 2012-04-02 08:52 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-04-02 08:52 . 2011-12-10 13:24 23152 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-04-02 08:45 . 2012-04-02 08:45 8767136 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
2012-04-02 08:40 . 2012-04-02 08:45 418464 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-03-31 07:17 . 2012-03-14 03:27 8669240 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{9961AA39-0328-4C85-88FC-F8DB09DF8CAB}\mpengine.dll
2012-03-30 10:12 . 2012-03-30 10:12 -------- d-----w- c:\program files\CCleaner
2012-03-19 05:49 . 2012-03-19 05:49 592824 ----a-w- c:\program files (x86)\Mozilla Firefox\gkmedias.dll
2012-03-19 05:49 . 2012-03-19 05:49 44472 ----a-w- c:\program files (x86)\Mozilla Firefox\mozglue.dll
2012-03-14 17:49 . 2011-11-19 15:20 5559152 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-03-14 17:48 . 2011-11-19 14:50 3968368 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2012-03-14 17:48 . 2011-11-19 14:50 3913584 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2012-03-14 06:34 . 2012-02-10 06:36 1544192 ----a-w- c:\windows\system32\DWrite.dll
2012-03-14 06:34 . 2012-02-03 04:34 3145728 ----a-w- c:\windows\system32\win32k.sys
2012-03-14 06:34 . 2012-02-10 05:38 1077248 ----a-w- c:\windows\SysWow64\DWrite.dll
2012-03-14 06:32 . 2012-02-17 06:38 1031680 ----a-w- c:\windows\system32\rdpcore.dll
2012-03-14 06:32 . 2012-02-17 05:34 826880 ----a-w- c:\windows\SysWow64\rdpcore.dll
2012-03-14 06:32 . 2012-02-17 04:58 210944 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-03-14 06:32 . 2012-02-17 04:57 23552 ----a-w- c:\windows\system32\drivers\tdtcp.sys
2012-03-14 06:32 . 2012-01-25 06:38 77312 ----a-w- c:\windows\system32\rdpwsx.dll
2012-03-14 06:32 . 2012-01-25 06:38 149504 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-03-14 06:32 . 2012-01-25 06:33 9216 ----a-w- c:\windows\system32\rdrmemptylst.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-04-02 08:45 . 2011-09-13 19:58 70304 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-02-25 13:09 . 2011-10-31 16:27 484176 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2012-02-23 08:18 . 2010-11-21 03:27 279656 ------w- c:\windows\system32\MpSigStub.exe
2012-02-14 17:55 . 2012-02-14 17:55 276248 ----a-w- c:\windows\SysWow64\IntelCpHeciSvc.exe
2012-02-14 17:55 . 2012-02-14 17:55 5886232 ----a-w- c:\windows\system32\GfxUI.exe
2012-02-14 17:55 . 2012-02-14 17:55 511768 ----a-w- c:\windows\system32\igfxsrvc.exe
2012-02-14 17:55 . 2012-02-14 17:55 440600 ----a-w- c:\windows\system32\igfxpers.exe
2012-02-14 17:55 . 2012-02-14 17:55 398616 ----a-w- c:\windows\system32\hkcmd.exe
2012-02-14 17:55 . 2012-02-14 17:55 250136 ----a-w- c:\windows\system32\igfxext.exe
2012-02-14 17:55 . 2012-02-14 17:55 184600 ----a-w- c:\windows\system32\difx64.exe
2012-02-14 17:55 . 2012-02-14 17:55 170264 ----a-w- c:\windows\system32\igfxtray.exe
2012-02-14 17:53 . 2012-02-14 17:53 90112 ----a-w- c:\windows\system32\igfxCoIn_v2653.dll
2012-02-14 17:47 . 2012-02-14 17:47 8086528 ----a-w- c:\windows\system32\igdumd64.dll
2012-02-14 17:47 . 2012-02-14 17:47 14692224 ----a-w- c:\windows\system32\drivers\igdkmd64.sys
2012-02-14 17:47 . 2012-02-14 17:47 963912 ----a-w- c:\windows\system32\igkrng600.bin
2012-02-14 17:47 . 2012-02-14 17:47 79360 ----a-w- c:\windows\system32\igdde64.dll
2012-02-14 17:47 . 2012-02-14 17:47 261208 ----a-w- c:\windows\system32\igfcg600m.bin
2012-02-14 17:44 . 2012-02-14 17:44 6120960 ----a-w- c:\windows\SysWow64\igdumd32.dll
2012-02-14 17:44 . 2012-02-14 17:44 58880 ----a-w- c:\windows\SysWow64\igdde32.dll
2012-02-14 17:42 . 2011-09-13 19:37 9605632 ----a-w- c:\windows\system32\igd10umd64.dll
2012-02-14 17:35 . 2011-09-13 19:37 7794688 ----a-w- c:\windows\SysWow64\igd10umd32.dll
2012-02-14 17:07 . 2012-02-14 17:07 18125312 ----a-w- c:\windows\system32\ig4icd64.dll
2012-02-14 16:59 . 2012-02-14 16:59 13209600 ----a-w- c:\windows\SysWow64\ig4icd32.dll
2012-02-14 16:57 . 2012-02-14 16:57 439808 ----a-w- c:\windows\system32\igfxresn.lrc
2012-02-14 16:57 . 2012-02-14 16:57 439296 ----a-w- c:\windows\system32\igfxrrom.lrc
2012-02-14 16:57 . 2012-02-14 16:57 438784 ----a-w- c:\windows\system32\igfxrhrv.lrc
2012-02-14 16:57 . 2012-02-14 16:57 438272 ----a-w- c:\windows\system32\igfxrsky.lrc
2012-02-14 16:57 . 2012-02-14 16:57 437760 ----a-w- c:\windows\system32\igfxrtrk.lrc
2012-02-14 16:57 . 2012-02-14 16:57 437760 ----a-w- c:\windows\system32\igfxrsve.lrc
2012-02-14 16:57 . 2012-02-14 16:57 437760 ----a-w- c:\windows\system32\igfxrslv.lrc
2012-02-14 16:57 . 2012-02-14 16:57 437248 ----a-w- c:\windows\system32\igfxrtha.lrc
2012-02-14 16:57 . 2012-02-14 16:57 439296 ----a-w- c:\windows\system32\igfxrrus.lrc
2012-02-14 16:57 . 2012-02-14 16:57 438784 ----a-w- c:\windows\system32\igfxrptg.lrc
2012-02-14 16:57 . 2012-02-14 16:57 438784 ----a-w- c:\windows\system32\igfxrplk.lrc
2012-02-14 16:57 . 2012-02-14 16:57 438784 ----a-w- c:\windows\system32\igfxrita.lrc
2012-02-14 16:57 . 2012-02-14 16:57 437760 ----a-w- c:\windows\system32\igfxrptb.lrc
2012-02-14 16:57 . 2012-02-14 16:57 437760 ----a-w- c:\windows\system32\igfxrnor.lrc
2012-02-14 16:57 . 2012-02-14 16:57 432128 ----a-w- c:\windows\system32\igfxrjpn.lrc
2012-02-14 16:57 . 2012-02-14 16:57 430592 ----a-w- c:\windows\system32\igfxrkor.lrc
2012-02-14 16:57 . 2012-02-14 16:57 440320 ----a-w- c:\windows\system32\igfxrell.lrc
2012-02-14 16:57 . 2012-02-14 16:57 439808 ----a-w- c:\windows\system32\igfxrfra.lrc
2012-02-14 16:57 . 2012-02-14 16:57 438784 ----a-w- c:\windows\system32\igfxrdeu.lrc
2012-02-14 16:57 . 2012-02-14 16:57 438272 ----a-w- c:\windows\system32\igfxrhun.lrc
2012-02-14 16:57 . 2012-02-14 16:57 438272 ----a-w- c:\windows\system32\igfxrfin.lrc
2012-02-14 16:57 . 2012-02-14 16:57 435712 ----a-w- c:\windows\system32\igfxrheb.lrc
2012-02-14 16:57 . 2012-02-14 16:57 438784 ----a-w- c:\windows\system32\igfxrnld.lrc
2012-02-14 16:57 . 2012-02-14 16:57 438272 ----a-w- c:\windows\system32\igfxrcsy.lrc
2012-02-14 16:57 . 2012-02-14 16:57 437248 ----a-w- c:\windows\system32\igfxrdan.lrc
2012-02-14 16:57 . 2012-02-14 16:57 429056 ----a-w- c:\windows\system32\igfxrcht.lrc
2012-02-14 16:57 . 2012-02-14 16:57 428544 ----a-w- c:\windows\system32\igfxrchs.lrc
2012-02-14 16:57 . 2012-02-14 16:57 435712 ----a-w- c:\windows\system32\igfxrara.lrc
2012-02-14 16:57 . 2012-02-14 16:57 126976 ----a-w- c:\windows\system32\igfxcpl.cpl
2012-02-14 16:57 . 2012-02-14 16:57 386048 ----a-w- c:\windows\system32\igfxpph.dll
2012-02-14 16:57 . 2012-02-14 16:57 410624 ----a-w- c:\windows\system32\igfxTMM.dll
2012-02-14 16:57 . 2012-02-14 16:57 28672 ----a-w- c:\windows\system32\igfxexps.dll
2012-02-14 16:57 . 2011-09-13 19:37 63488 ----a-w- c:\windows\system32\igfxsrvc.dll
2012-02-14 16:56 . 2011-09-13 19:37 110592 ----a-w- c:\windows\system32\hccutils.dll
2012-02-14 16:56 . 2012-02-14 16:56 9216 ----a-w- c:\windows\system32\IGFXDEVLib.dll
2012-02-14 16:56 . 2012-02-14 16:56 430080 ----a-w- c:\windows\system32\igfxdev.dll
2012-02-14 16:56 . 2012-02-14 16:56 172032 ----a-w- c:\windows\system32\gfxSrvc.dll
2012-02-14 16:56 . 2012-02-14 16:56 286208 ----a-w- c:\windows\system32\igfxrenu.lrc
2012-02-14 16:56 . 2012-02-14 16:56 142336 ----a-w- c:\windows\system32\igfxdo.dll
2012-02-14 16:56 . 2011-09-13 19:37 9007616 ----a-w- c:\windows\system32\igfxress.dll
2012-02-14 16:55 . 2012-02-14 16:55 25088 ----a-w- c:\windows\SysWow64\igfxexps32.dll
2012-02-14 16:54 . 2012-02-14 16:54 321024 ----a-w- c:\windows\SysWow64\igfxdv32.dll
2012-02-14 16:53 . 2012-02-14 16:53 524800 ----a-w- c:\windows\system32\iglhsip64.dll
2012-02-14 16:53 . 2012-02-14 16:53 519680 ----a-w- c:\windows\SysWow64\iglhsip32.dll
2012-02-14 16:53 . 2012-02-14 16:53 2967040 ----a-w- c:\windows\system32\igfxcmjit64.dll
2012-02-14 16:53 . 2012-02-14 16:53 237056 ----a-w- c:\windows\SysWow64\igfxcmrt32.dll
2012-02-14 16:53 . 2012-02-14 16:53 2321408 ----a-w- c:\windows\SysWow64\igfxcmjit32.dll
2012-02-14 16:53 . 2012-02-14 16:53 213504 ----a-w- c:\windows\system32\iglhcp64.dll
2012-02-14 16:53 . 2012-02-14 16:53 193024 ----a-w- c:\windows\system32\igfxcmrt64.dll
2012-02-14 16:53 . 2012-02-14 16:53 177152 ----a-w- c:\windows\SysWow64\iglhcp32.dll
2012-01-10 13:37 . 2012-01-10 13:37 90112 ----a-w- c:\windows\system32\igfxCoIn_v2622.dll
2012-01-10 13:12 . 2012-01-10 13:12 581120 ----a-w- c:\windows\SysWow64\igdumdx32.dll
2012-01-04 10:44 . 2012-02-16 15:51 509952 ----a-w- c:\windows\system32\ntshrui.dll
2012-01-04 08:58 . 2012-02-16 15:51 442880 ----a-w- c:\windows\SysWow64\ntshrui.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2012-04-02_17.40.08 )))))))))))))))))))))))))))))))))))))))))
.
- 2012-04-02 16:26 . 2012-04-02 16:26 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-04-02 18:26 . 2012-04-02 18:26 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2012-04-02 16:26 . 2012-04-02 16:26 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2012-04-02 18:26 . 2012-04-02 18:26 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-07-14 05:01 . 2012-04-02 18:25 434180 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2009-07-14 05:01 . 2012-04-02 16:26 434180 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2011-09-13 20:05 . 2012-04-02 18:25 27305232 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1699888946-4257952244-2652322587-1000-8192.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"Winsplit"="c:\program files (x86)\WinSplit Revolution\WinSplit.exe" [2011-04-12 3951616]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2010-01-19 43632]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-03-06 4241512]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
AVer HID Receiver.lnk - c:\program files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe [2011-10-9 155648]
AVerQuick.lnk - c:\program files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe [2011-10-9 675840]
SnugTV Quick Start.lnk - c:\windows\Installer\{33CFCB69-2FA5-43E8-B8A8-FAA155F870B5}\NewShortcut1_46FEF19C05F1475DAA14D9007DC15270_2.exe [2011-10-9 57344]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-01-13 652360]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 253600]
R3 ATHDFU;Atheros Valkyrie USB BootROM;c:\windows\system32\Drivers\AthDfu.sys [x]
R3 cphs;Intel(R) Content Protection HECI Service;c:\windows\SysWow64\IntelCpHeciSvc.exe [2012-02-14 276248]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [x]
R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2011-11-09 1431888]
R3 HTCAND64;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys [x]
R3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\DRIVERS\htcnprot.sys [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 51740536]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [x]
S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe [2011-03-13 74912]
S2 Autodesk Content Service;Autodesk Content Service;c:\program files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [2011-02-02 18656]
S2 AVerRemote;AVerRemote;c:\program files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe [2010-04-27 348160]
S2 AVerScheduleService;AVerScheduleService;c:\program files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe [2011-04-01 403456]
S2 AVerUpdateServer;AVerUpdateServer;c:\program files (x86)\AVerMedia\AVerUpdate\AVerUpdateServer.exe [2011-01-06 168448]
S2 BCUService;Browser Configuration Utility Service;c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe [2009-10-26 223464]
S2 PassThru Service;Internet Pass-Through Service;c:\program files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [2011-08-12 87040]
S2 SnugTV Service;SnugTV Service;c:\program files (x86)\SnugTV\SnugTV Station\AMAServer.exe [2011-04-06 571904]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys [x]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys [x]
S3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys [x]
S3 AVerAF35;AVerMedia A867 USB DVB-T;c:\windows\system32\Drivers\AVerAF35.sys [x]
S3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys [x]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys [x]
S3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys [x]
S3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys [x]
S3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys [x]
S3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys [x]
S3 e1cexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver C;c:\windows\system32\DRIVERS\e1c62x64.sys [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x]
S3 KovaPlusFltr;ROCCAT Kova[+] Mouse;c:\windows\system32\drivers\KovaPlusFltr.sys [x]
S3 MEIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - WS2IFSL
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-03-06 23:15 135408 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-11-19 11613288]
"AtherosBtStack"="c:\program files (x86)\Bluetooth Suite\BtvStack.exe" [2011-03-13 617120]
"AthBtTray"="c:\program files (x86)\Bluetooth Suite\AthBtTray.exe" [2011-03-13 379552]
"TNOD UP"="c:\program files (x86)\TNod User & Password Finder\TNODUP.exe" [BU]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 112512]
"Free PDF Print Dispatcher"="c:\program files (x86)\pdfconverter.com\FreePDF Creator\itFPCPrnDisp.exe" [2010-01-15 25600]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-02-14 170264]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-02-14 398616]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-02-14 440600]
"combofix"="c:\combofix\CF16413.3XE" [2010-11-21 345088]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.seznam.cz/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~1\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~1\Office14\ONBttnIE.dll/105
IE: Převést cíl vazby do Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Převést do Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Připojit cíl vazby k existujícímu PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Připojit k existujícímu PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
TCP: DhcpNameServer = 192.168.1.1 10.92.1.254
FF - ProfilePath - c:\users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\jxi8mt5e.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.seznam.cz
.
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files (x86)\Google\Update\GoogleUpdate.exe
.
**************************************************************************
.
Celkový čas: 2012-04-02 20:27:21 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-04-02 18:27
ComboFix2.txt 2012-04-02 17:41
.
Před spuštěním: Volných bajtů: 12 067 803 136
Po spuštění: Volných bajtů: 11 656 855 552
.
- - End Of File - - 4D2742CEDBB02B7A29954F76638FF3D5
Nahr nˇ probŘhlo ŁspŘçnŘ
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.8099.5924 [GMT 2:00]
Spuštěný z: c:\users\Jan\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Jan\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\windows\Tasks\Adobe Flash Player Updater.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
.
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\TNod User & Password Finder
c:\program files (x86)\TNod User & Password Finder\CREDITOS.txt
c:\program files (x86)\TNod User & Password Finder\LEEME.txt
c:\program files (x86)\TNod User & Password Finder\tnodicons.icl
c:\program files (x86)\TNod User & Password Finder\uninst-tnod.exe
c:\program files (x86)\Zrychleni Pocitace
c:\program files (x86)\Zrychleni Pocitace\PCSpeedUp.lnk
c:\program files (x86)\Zrychleni Pocitace\PCSUService.log
c:\windows\AutoKMS
c:\windows\AutoKMS\AutoKMS.exe
c:\windows\AutoKMS\AutoKMS.ini
c:\windows\AutoKMS\AutoKMS.log
c:\windows\Tasks\Adobe Flash Player Updater.job
c:\windows\Tasks\AutoKMS.job
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_gupdate
-------\Service_gupdatem
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-03-02 do 2012-04-02 )))))))))))))))))))))))))))))))
.
.
2012-04-02 09:43 . 2012-04-02 16:27 -------- d-----w- c:\program files\trend micro
2012-04-02 09:43 . 2012-04-02 09:43 -------- d-----w- C:\rsit
2012-04-02 08:52 . 2012-04-02 08:52 -------- d-----w- c:\users\Jan\AppData\Roaming\Malwarebytes
2012-04-02 08:52 . 2012-04-02 08:52 -------- d-----w- c:\programdata\Malwarebytes
2012-04-02 08:52 . 2012-04-02 08:52 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-04-02 08:52 . 2011-12-10 13:24 23152 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-04-02 08:45 . 2012-04-02 08:45 8767136 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
2012-04-02 08:40 . 2012-04-02 08:45 418464 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-03-31 07:17 . 2012-03-14 03:27 8669240 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{9961AA39-0328-4C85-88FC-F8DB09DF8CAB}\mpengine.dll
2012-03-30 10:12 . 2012-03-30 10:12 -------- d-----w- c:\program files\CCleaner
2012-03-19 05:49 . 2012-03-19 05:49 592824 ----a-w- c:\program files (x86)\Mozilla Firefox\gkmedias.dll
2012-03-19 05:49 . 2012-03-19 05:49 44472 ----a-w- c:\program files (x86)\Mozilla Firefox\mozglue.dll
2012-03-14 17:49 . 2011-11-19 15:20 5559152 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-03-14 17:48 . 2011-11-19 14:50 3968368 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2012-03-14 17:48 . 2011-11-19 14:50 3913584 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2012-03-14 06:34 . 2012-02-10 06:36 1544192 ----a-w- c:\windows\system32\DWrite.dll
2012-03-14 06:34 . 2012-02-03 04:34 3145728 ----a-w- c:\windows\system32\win32k.sys
2012-03-14 06:34 . 2012-02-10 05:38 1077248 ----a-w- c:\windows\SysWow64\DWrite.dll
2012-03-14 06:32 . 2012-02-17 06:38 1031680 ----a-w- c:\windows\system32\rdpcore.dll
2012-03-14 06:32 . 2012-02-17 05:34 826880 ----a-w- c:\windows\SysWow64\rdpcore.dll
2012-03-14 06:32 . 2012-02-17 04:58 210944 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-03-14 06:32 . 2012-02-17 04:57 23552 ----a-w- c:\windows\system32\drivers\tdtcp.sys
2012-03-14 06:32 . 2012-01-25 06:38 77312 ----a-w- c:\windows\system32\rdpwsx.dll
2012-03-14 06:32 . 2012-01-25 06:38 149504 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-03-14 06:32 . 2012-01-25 06:33 9216 ----a-w- c:\windows\system32\rdrmemptylst.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-04-02 08:45 . 2011-09-13 19:58 70304 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-02-25 13:09 . 2011-10-31 16:27 484176 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2012-02-23 08:18 . 2010-11-21 03:27 279656 ------w- c:\windows\system32\MpSigStub.exe
2012-02-14 17:55 . 2012-02-14 17:55 276248 ----a-w- c:\windows\SysWow64\IntelCpHeciSvc.exe
2012-02-14 17:55 . 2012-02-14 17:55 5886232 ----a-w- c:\windows\system32\GfxUI.exe
2012-02-14 17:55 . 2012-02-14 17:55 511768 ----a-w- c:\windows\system32\igfxsrvc.exe
2012-02-14 17:55 . 2012-02-14 17:55 440600 ----a-w- c:\windows\system32\igfxpers.exe
2012-02-14 17:55 . 2012-02-14 17:55 398616 ----a-w- c:\windows\system32\hkcmd.exe
2012-02-14 17:55 . 2012-02-14 17:55 250136 ----a-w- c:\windows\system32\igfxext.exe
2012-02-14 17:55 . 2012-02-14 17:55 184600 ----a-w- c:\windows\system32\difx64.exe
2012-02-14 17:55 . 2012-02-14 17:55 170264 ----a-w- c:\windows\system32\igfxtray.exe
2012-02-14 17:53 . 2012-02-14 17:53 90112 ----a-w- c:\windows\system32\igfxCoIn_v2653.dll
2012-02-14 17:47 . 2012-02-14 17:47 8086528 ----a-w- c:\windows\system32\igdumd64.dll
2012-02-14 17:47 . 2012-02-14 17:47 14692224 ----a-w- c:\windows\system32\drivers\igdkmd64.sys
2012-02-14 17:47 . 2012-02-14 17:47 963912 ----a-w- c:\windows\system32\igkrng600.bin
2012-02-14 17:47 . 2012-02-14 17:47 79360 ----a-w- c:\windows\system32\igdde64.dll
2012-02-14 17:47 . 2012-02-14 17:47 261208 ----a-w- c:\windows\system32\igfcg600m.bin
2012-02-14 17:44 . 2012-02-14 17:44 6120960 ----a-w- c:\windows\SysWow64\igdumd32.dll
2012-02-14 17:44 . 2012-02-14 17:44 58880 ----a-w- c:\windows\SysWow64\igdde32.dll
2012-02-14 17:42 . 2011-09-13 19:37 9605632 ----a-w- c:\windows\system32\igd10umd64.dll
2012-02-14 17:35 . 2011-09-13 19:37 7794688 ----a-w- c:\windows\SysWow64\igd10umd32.dll
2012-02-14 17:07 . 2012-02-14 17:07 18125312 ----a-w- c:\windows\system32\ig4icd64.dll
2012-02-14 16:59 . 2012-02-14 16:59 13209600 ----a-w- c:\windows\SysWow64\ig4icd32.dll
2012-02-14 16:57 . 2012-02-14 16:57 439808 ----a-w- c:\windows\system32\igfxresn.lrc
2012-02-14 16:57 . 2012-02-14 16:57 439296 ----a-w- c:\windows\system32\igfxrrom.lrc
2012-02-14 16:57 . 2012-02-14 16:57 438784 ----a-w- c:\windows\system32\igfxrhrv.lrc
2012-02-14 16:57 . 2012-02-14 16:57 438272 ----a-w- c:\windows\system32\igfxrsky.lrc
2012-02-14 16:57 . 2012-02-14 16:57 437760 ----a-w- c:\windows\system32\igfxrtrk.lrc
2012-02-14 16:57 . 2012-02-14 16:57 437760 ----a-w- c:\windows\system32\igfxrsve.lrc
2012-02-14 16:57 . 2012-02-14 16:57 437760 ----a-w- c:\windows\system32\igfxrslv.lrc
2012-02-14 16:57 . 2012-02-14 16:57 437248 ----a-w- c:\windows\system32\igfxrtha.lrc
2012-02-14 16:57 . 2012-02-14 16:57 439296 ----a-w- c:\windows\system32\igfxrrus.lrc
2012-02-14 16:57 . 2012-02-14 16:57 438784 ----a-w- c:\windows\system32\igfxrptg.lrc
2012-02-14 16:57 . 2012-02-14 16:57 438784 ----a-w- c:\windows\system32\igfxrplk.lrc
2012-02-14 16:57 . 2012-02-14 16:57 438784 ----a-w- c:\windows\system32\igfxrita.lrc
2012-02-14 16:57 . 2012-02-14 16:57 437760 ----a-w- c:\windows\system32\igfxrptb.lrc
2012-02-14 16:57 . 2012-02-14 16:57 437760 ----a-w- c:\windows\system32\igfxrnor.lrc
2012-02-14 16:57 . 2012-02-14 16:57 432128 ----a-w- c:\windows\system32\igfxrjpn.lrc
2012-02-14 16:57 . 2012-02-14 16:57 430592 ----a-w- c:\windows\system32\igfxrkor.lrc
2012-02-14 16:57 . 2012-02-14 16:57 440320 ----a-w- c:\windows\system32\igfxrell.lrc
2012-02-14 16:57 . 2012-02-14 16:57 439808 ----a-w- c:\windows\system32\igfxrfra.lrc
2012-02-14 16:57 . 2012-02-14 16:57 438784 ----a-w- c:\windows\system32\igfxrdeu.lrc
2012-02-14 16:57 . 2012-02-14 16:57 438272 ----a-w- c:\windows\system32\igfxrhun.lrc
2012-02-14 16:57 . 2012-02-14 16:57 438272 ----a-w- c:\windows\system32\igfxrfin.lrc
2012-02-14 16:57 . 2012-02-14 16:57 435712 ----a-w- c:\windows\system32\igfxrheb.lrc
2012-02-14 16:57 . 2012-02-14 16:57 438784 ----a-w- c:\windows\system32\igfxrnld.lrc
2012-02-14 16:57 . 2012-02-14 16:57 438272 ----a-w- c:\windows\system32\igfxrcsy.lrc
2012-02-14 16:57 . 2012-02-14 16:57 437248 ----a-w- c:\windows\system32\igfxrdan.lrc
2012-02-14 16:57 . 2012-02-14 16:57 429056 ----a-w- c:\windows\system32\igfxrcht.lrc
2012-02-14 16:57 . 2012-02-14 16:57 428544 ----a-w- c:\windows\system32\igfxrchs.lrc
2012-02-14 16:57 . 2012-02-14 16:57 435712 ----a-w- c:\windows\system32\igfxrara.lrc
2012-02-14 16:57 . 2012-02-14 16:57 126976 ----a-w- c:\windows\system32\igfxcpl.cpl
2012-02-14 16:57 . 2012-02-14 16:57 386048 ----a-w- c:\windows\system32\igfxpph.dll
2012-02-14 16:57 . 2012-02-14 16:57 410624 ----a-w- c:\windows\system32\igfxTMM.dll
2012-02-14 16:57 . 2012-02-14 16:57 28672 ----a-w- c:\windows\system32\igfxexps.dll
2012-02-14 16:57 . 2011-09-13 19:37 63488 ----a-w- c:\windows\system32\igfxsrvc.dll
2012-02-14 16:56 . 2011-09-13 19:37 110592 ----a-w- c:\windows\system32\hccutils.dll
2012-02-14 16:56 . 2012-02-14 16:56 9216 ----a-w- c:\windows\system32\IGFXDEVLib.dll
2012-02-14 16:56 . 2012-02-14 16:56 430080 ----a-w- c:\windows\system32\igfxdev.dll
2012-02-14 16:56 . 2012-02-14 16:56 172032 ----a-w- c:\windows\system32\gfxSrvc.dll
2012-02-14 16:56 . 2012-02-14 16:56 286208 ----a-w- c:\windows\system32\igfxrenu.lrc
2012-02-14 16:56 . 2012-02-14 16:56 142336 ----a-w- c:\windows\system32\igfxdo.dll
2012-02-14 16:56 . 2011-09-13 19:37 9007616 ----a-w- c:\windows\system32\igfxress.dll
2012-02-14 16:55 . 2012-02-14 16:55 25088 ----a-w- c:\windows\SysWow64\igfxexps32.dll
2012-02-14 16:54 . 2012-02-14 16:54 321024 ----a-w- c:\windows\SysWow64\igfxdv32.dll
2012-02-14 16:53 . 2012-02-14 16:53 524800 ----a-w- c:\windows\system32\iglhsip64.dll
2012-02-14 16:53 . 2012-02-14 16:53 519680 ----a-w- c:\windows\SysWow64\iglhsip32.dll
2012-02-14 16:53 . 2012-02-14 16:53 2967040 ----a-w- c:\windows\system32\igfxcmjit64.dll
2012-02-14 16:53 . 2012-02-14 16:53 237056 ----a-w- c:\windows\SysWow64\igfxcmrt32.dll
2012-02-14 16:53 . 2012-02-14 16:53 2321408 ----a-w- c:\windows\SysWow64\igfxcmjit32.dll
2012-02-14 16:53 . 2012-02-14 16:53 213504 ----a-w- c:\windows\system32\iglhcp64.dll
2012-02-14 16:53 . 2012-02-14 16:53 193024 ----a-w- c:\windows\system32\igfxcmrt64.dll
2012-02-14 16:53 . 2012-02-14 16:53 177152 ----a-w- c:\windows\SysWow64\iglhcp32.dll
2012-01-10 13:37 . 2012-01-10 13:37 90112 ----a-w- c:\windows\system32\igfxCoIn_v2622.dll
2012-01-10 13:12 . 2012-01-10 13:12 581120 ----a-w- c:\windows\SysWow64\igdumdx32.dll
2012-01-04 10:44 . 2012-02-16 15:51 509952 ----a-w- c:\windows\system32\ntshrui.dll
2012-01-04 08:58 . 2012-02-16 15:51 442880 ----a-w- c:\windows\SysWow64\ntshrui.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2012-04-02_17.40.08 )))))))))))))))))))))))))))))))))))))))))
.
- 2012-04-02 16:26 . 2012-04-02 16:26 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-04-02 18:26 . 2012-04-02 18:26 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2012-04-02 16:26 . 2012-04-02 16:26 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2012-04-02 18:26 . 2012-04-02 18:26 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-07-14 05:01 . 2012-04-02 18:25 434180 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2009-07-14 05:01 . 2012-04-02 16:26 434180 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2011-09-13 20:05 . 2012-04-02 18:25 27305232 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1699888946-4257952244-2652322587-1000-8192.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"Winsplit"="c:\program files (x86)\WinSplit Revolution\WinSplit.exe" [2011-04-12 3951616]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2010-01-19 43632]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-03-06 4241512]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
AVer HID Receiver.lnk - c:\program files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe [2011-10-9 155648]
AVerQuick.lnk - c:\program files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe [2011-10-9 675840]
SnugTV Quick Start.lnk - c:\windows\Installer\{33CFCB69-2FA5-43E8-B8A8-FAA155F870B5}\NewShortcut1_46FEF19C05F1475DAA14D9007DC15270_2.exe [2011-10-9 57344]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-01-13 652360]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 253600]
R3 ATHDFU;Atheros Valkyrie USB BootROM;c:\windows\system32\Drivers\AthDfu.sys [x]
R3 cphs;Intel(R) Content Protection HECI Service;c:\windows\SysWow64\IntelCpHeciSvc.exe [2012-02-14 276248]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [x]
R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2011-11-09 1431888]
R3 HTCAND64;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys [x]
R3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\DRIVERS\htcnprot.sys [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 51740536]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [x]
S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe [2011-03-13 74912]
S2 Autodesk Content Service;Autodesk Content Service;c:\program files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [2011-02-02 18656]
S2 AVerRemote;AVerRemote;c:\program files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe [2010-04-27 348160]
S2 AVerScheduleService;AVerScheduleService;c:\program files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe [2011-04-01 403456]
S2 AVerUpdateServer;AVerUpdateServer;c:\program files (x86)\AVerMedia\AVerUpdate\AVerUpdateServer.exe [2011-01-06 168448]
S2 BCUService;Browser Configuration Utility Service;c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe [2009-10-26 223464]
S2 PassThru Service;Internet Pass-Through Service;c:\program files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [2011-08-12 87040]
S2 SnugTV Service;SnugTV Service;c:\program files (x86)\SnugTV\SnugTV Station\AMAServer.exe [2011-04-06 571904]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys [x]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys [x]
S3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys [x]
S3 AVerAF35;AVerMedia A867 USB DVB-T;c:\windows\system32\Drivers\AVerAF35.sys [x]
S3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys [x]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys [x]
S3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys [x]
S3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys [x]
S3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys [x]
S3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys [x]
S3 e1cexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver C;c:\windows\system32\DRIVERS\e1c62x64.sys [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x]
S3 KovaPlusFltr;ROCCAT Kova[+] Mouse;c:\windows\system32\drivers\KovaPlusFltr.sys [x]
S3 MEIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - WS2IFSL
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-03-06 23:15 135408 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-11-19 11613288]
"AtherosBtStack"="c:\program files (x86)\Bluetooth Suite\BtvStack.exe" [2011-03-13 617120]
"AthBtTray"="c:\program files (x86)\Bluetooth Suite\AthBtTray.exe" [2011-03-13 379552]
"TNOD UP"="c:\program files (x86)\TNod User & Password Finder\TNODUP.exe" [BU]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 112512]
"Free PDF Print Dispatcher"="c:\program files (x86)\pdfconverter.com\FreePDF Creator\itFPCPrnDisp.exe" [2010-01-15 25600]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-02-14 170264]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-02-14 398616]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-02-14 440600]
"combofix"="c:\combofix\CF16413.3XE" [2010-11-21 345088]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.seznam.cz/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~1\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~1\Office14\ONBttnIE.dll/105
IE: Převést cíl vazby do Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Převést do Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Připojit cíl vazby k existujícímu PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Připojit k existujícímu PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
TCP: DhcpNameServer = 192.168.1.1 10.92.1.254
FF - ProfilePath - c:\users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\jxi8mt5e.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.seznam.cz
.
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files (x86)\Google\Update\GoogleUpdate.exe
.
**************************************************************************
.
Celkový čas: 2012-04-02 20:27:21 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-04-02 18:27
ComboFix2.txt 2012-04-02 17:41
.
Před spuštěním: Volných bajtů: 12 067 803 136
Po spuštění: Volných bajtů: 11 656 855 552
.
- - End Of File - - 4D2742CEDBB02B7A29954F76638FF3D5
Nahr nˇ probŘhlo ŁspŘçnŘ
Re: Win32/TrojanDownloader.Mebload.AR
Jak se chova nas pacient
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen od 1. února 2011.
Člen
od 1. února 2011.
Přispějete na provoz fóra?