Win32/TrojanDownloader.Mebload.AR

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz


Vážení uživaterlé!
Ve dnech 4. - 6-9.2026 budou někteříí naši členové na každoročním srazu fóra. Žádáme vás, abyste měli strpení, nemusí se na na řešení vašeho problému dostat hned. Děkujeme za pochopení.
Odpovědět
Zpráva
Autor
rendie
Návštěvník
Návštěvník
Příspěvky: 11
Registrován: 02 Dub 2012 18:46

Win32/TrojanDownloader.Mebload.AR

#1 Příspěvek od rendie »

Ahoj, mam podobny problem jako jiz nekolik lidi zde. ESET mi nasel Win32/TrojanDownloader.Mebload.AR :(
Muzete moc prosim pomoci?

Logfile of random's system information tool 1.09 (written by random/random)
Run by Renáta at 2012-04-02 19:43:54
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 9 GB (26%) free of 35 GB
Total RAM: 4001 MB (54% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:43:59, on 2.4.2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
C:\Program Files (x86)\ASUS\USBChargerPlus\UsbChargerPlus.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\DAEMON Tools Lite\DTShellHlp.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files (x86)\totalcmd\TOTALCMD.EXE
C:\Program Files\trend micro\Renáta.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: IESpeakDoc - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [SonicMasterTray] C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe
O4 - HKLM\..\Run: [FLxHCIm] "C:\Program Files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe"
O4 - HKLM\..\Run: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
O4 - HKLM\..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
O4 - HKLM\..\Run: [Wireless Console 3] C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
O4 - HKLM\..\Run: [USBChargerPlusTray] C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe
O4 - HKLM\..\Run: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-4142588759-912011533-2692799507-1001\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'UpdatusUser')
O4 - HKUS\S-1-5-21-4142588759-912011533-2692799507-1001\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'UpdatusUser')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
O9 - Extra 'Tools' menuitem: Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\Windows\SysWOW64\nvinit.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: AFBAgent - Unknown owner - C:\Windows\system32\FBAgent.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: ASLDR Service (ASLDRService) - ASUS - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
O23 - Service: Atheros Bt&Wlan Coex Agent - Atheros - C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
O23 - Service: AtherosSvc - Atheros Commnucations - C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - ASUS - C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: Intel(R) Turbo Boost Technology Monitor 2.0 (TurboBoost) - Intel(R) Corporation - C:\Program Files\Intel\TurboBoost\TurboBoost.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 9959 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
winlogon.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
"C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe"
C:\Windows\system32\nvvsvc.exe -session -first
"C:\Windows\system32\FBAgent.exe"
"C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe"
"C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"taskhost.exe"
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
C:\Windows\Explorer.EXE
"C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe"
taskeng.exe {B85A9A41-3406-4940-A479-874E22D2D94A}
taskeng.exe {3ABF0492-416D-4ECD-A2FB-65179DB53C86}
"C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe"
"C:\Program Files\P4G\BatteryLife.exe"
"C:\Program Files (x86)\ASUS\Splendid\ACMON.exe"
"C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe"
"C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe"
"C:\Program Files (x86)\Bluetooth Suite\adminservice.exe"
"C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe"
"C:\Windows\SysWOW64\ACEngSvr.exe" -Embedding
"C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe"
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Windows\System32\igfxtray.exe"
"C:\Windows\System32\hkcmd.exe"
"C:\Windows\System32\igfxpers.exe"
"C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe" /SF3
"C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
"C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe"
"C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe"
"C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe"
"C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
"C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
C:\Windows\system32\wbem\wmiprvse.exe
ATKOSD.exe
"C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe"
"C:\Program Files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe"
"C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe"
"C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe"
"C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe"
"C:\Program Files (x86)\ASUS\USBChargerPlus\UsbChargerPlus.exe"
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
WDC.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files\Synaptics\SynTP\SynTPHelper.exe"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
"C:\Program Files (x86)\DAEMON Tools Lite\DTShellHlp.exe"
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
"C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe"
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe"
"C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel=5844.136c0300.339618630 "C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll" E7CF176E110C211B -greomni "C:\Program Files (x86)\Mozilla Firefox\omni.ja" 5844 "\\.\pipe\gecko-crash-server-pipe.5844" plugin
"C:\Program Files (x86)\totalcmd\TOTALCMD.EXE"
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe5_ Global\UsGthrCtrlFltPipeMssGthrPipe5 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 516 520 528 65536 524
"C:\Users\Renáta\Desktop\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe

=========Mozilla firefox=========

ProfilePath - C:\Users\Renáta\AppData\Roaming\Mozilla\Firefox\Profiles\ta9daagf.default

prefs.js - "browser.startup.homepage" - "http://www.seznam.cz/"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

C:\Program Files (x86)\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files (x86)\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files (x86)\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-01-03 63912]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8D10F6C4-0E01-4BD4-8601-11AC1FDF8126}]
CIESpeechBHO Class - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll [2011-03-13 60576]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2012-03-11 41760]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2011-02-10 167960]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2011-02-10 391704]
"Persistence"=C:\Windows\system32\igfxpers.exe [2011-02-10 418328]
"RtHDVBg"=C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2011-06-03 2226280]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2010-10-08 2392360]
"AtherosBtStack"=C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [2011-03-13 617120]
"AthBtTray"=C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [2011-03-13 379552]
"AmIcoSinglun64"=C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [2010-08-11 324096]
"IntelTBRunOnce"=wscript.exe //b //nologo C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs []
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2011-01-12 2918656]
"AdobeAAMUpdater-1.0"=C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2012-03-10 500208]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-21 1475584]
"Skype"=C:\Program Files (x86)\Skype\Phone\Skype.exe [2012-02-15 17146504]
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2012-02-13 3481408]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2011-06-07 11858536]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"SonicMasterTray"=C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe [2010-07-09 984400]
"FLxHCIm"=C:\Program Files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe [2011-04-08 43008]
"ATKOSD2"=C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [2010-08-17 5732992]
"ATKMEDIA"=C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [2010-10-07 170624]
"HControlUser"=C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [2009-06-19 105016]
"Wireless Console 3"=C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [2010-09-23 1601536]
"USBChargerPlusTray"=C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe [2011-03-28 495536]
"AdobeCS5ServiceManager"=C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [2010-02-22 406992]
"SwitchBoard"=C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2010-10-29 249064]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-01-03 843712]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\Windows\system32\nvinitx.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2011-01-27 385024]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"MSVideo8"=VfWWDM32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave2"=wdmaud.drv
"mixer2"=wdmaud.drv
"midi2"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2012-04-02 19:43:54 ----D---- C:\rsit
2012-04-02 19:43:54 ----D---- C:\Program Files\trend micro
2012-04-01 10:38:18 ----D---- C:\Program Files\CCleaner
2012-04-01 10:09:10 ----A---- C:\TDSSKiller.2.7.23.0_01.04.2012_10.09.10_log.txt
2012-03-31 22:30:22 ----D---- C:\Users\Renáta\AppData\Roaming\Malwarebytes
2012-03-31 22:30:12 ----D---- C:\ProgramData\Malwarebytes
2012-03-31 14:24:44 ----D---- C:\Program Files (x86)\Emsisoft Anti-Malware
2012-03-29 18:16:54 ----D---- C:\Users\Renáta\AppData\Roaming\Mozilla
2012-03-29 18:16:50 ----D---- C:\Program Files (x86)\Mozilla Firefox
2012-03-17 18:55:54 ----D---- C:\ProgramData\Windows
2012-03-14 21:04:01 ----A---- C:\Windows\system32\ntoskrnl.exe
2012-03-14 21:04:00 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2012-03-14 21:03:59 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2012-03-14 21:02:34 ----A---- C:\Windows\SYSWOW64\DWrite.dll
2012-03-14 21:02:34 ----A---- C:\Windows\system32\win32k.sys
2012-03-14 21:02:34 ----A---- C:\Windows\system32\DWrite.dll
2012-03-14 19:25:15 ----A---- C:\Windows\SYSWOW64\rdpcore.dll
2012-03-14 19:25:15 ----A---- C:\Windows\system32\rdpcore.dll
2012-03-14 19:25:14 ----A---- C:\Windows\system32\rdrmemptylst.exe
2012-03-14 19:25:14 ----A---- C:\Windows\system32\rdpwsx.dll
2012-03-14 19:25:14 ----A---- C:\Windows\system32\rdpcorekmts.dll
2012-03-14 19:25:14 ----A---- C:\Windows\system32\drivers\tdtcp.sys
2012-03-14 19:25:14 ----A---- C:\Windows\system32\drivers\rdpwd.sys
2012-03-11 14:43:00 ----D---- C:\ProgramData\Sun
2012-03-11 14:42:47 ----A---- C:\Windows\SYSWOW64\javaws.exe
2012-03-11 14:42:47 ----A---- C:\Windows\SYSWOW64\javaw.exe
2012-03-11 14:42:47 ----A---- C:\Windows\SYSWOW64\java.exe
2012-03-11 14:42:47 ----A---- C:\Windows\SYSWOW64\deployJava1.dll
2012-03-11 14:42:39 ----D---- C:\Program Files (x86)\Java
2012-03-10 17:27:47 ----A---- C:\Windows\system32\drivers\usbuhci.sys
2012-03-10 17:27:47 ----A---- C:\Windows\system32\drivers\usbport.sys
2012-03-10 17:27:47 ----A---- C:\Windows\system32\drivers\usbohci.sys
2012-03-10 17:27:47 ----A---- C:\Windows\system32\drivers\usbhub.sys
2012-03-10 17:27:47 ----A---- C:\Windows\system32\drivers\usbehci.sys
2012-03-10 17:27:47 ----A---- C:\Windows\system32\drivers\usbd.sys
2012-03-10 17:27:47 ----A---- C:\Windows\system32\drivers\usbccgp.sys
2012-03-10 17:27:44 ----A---- C:\Windows\system32\fsutil.exe
2012-03-10 17:27:44 ----A---- C:\Windows\system32\esent.dll
2012-03-10 17:27:44 ----A---- C:\Windows\system32\drivers\amdxata.sys
2012-03-10 17:27:43 ----A---- C:\Windows\SYSWOW64\fsutil.exe
2012-03-10 17:27:43 ----A---- C:\Windows\SYSWOW64\esent.dll
2012-03-10 17:27:43 ----A---- C:\Windows\system32\drivers\USBSTOR.SYS
2012-03-10 17:27:43 ----A---- C:\Windows\system32\drivers\storport.sys
2012-03-10 17:27:43 ----A---- C:\Windows\system32\drivers\nvstor.sys
2012-03-10 17:27:43 ----A---- C:\Windows\system32\drivers\nvraid.sys
2012-03-10 17:27:43 ----A---- C:\Windows\system32\drivers\ntfs.sys
2012-03-10 17:27:43 ----A---- C:\Windows\system32\drivers\iaStorV.sys
2012-03-10 17:27:43 ----A---- C:\Windows\system32\drivers\amdsata.sys
2012-03-10 17:27:38 ----A---- C:\Windows\system32\drivers\BTHUSB.SYS
2012-03-10 17:27:38 ----A---- C:\Windows\system32\drivers\bthport.sys
2012-03-10 17:18:18 ----D---- C:\ProgramData\regid.1986-12.com.adobe
2012-03-10 17:13:50 ----D---- C:\Program Files\Adobe
2012-03-10 17:12:44 ----D---- C:\Program Files (x86)\Adobe Media Player
2012-03-10 17:12:25 ----D---- C:\Program Files\Common Files\Adobe
2012-03-10 17:11:50 ----D---- C:\Program Files (x86)\Adobe
2012-03-10 16:36:02 ----D---- C:\ProgramData\Adobe
2012-03-10 15:40:00 ----D---- C:\Program Files\7-Zip
2012-03-10 15:35:29 ----A---- C:\Windows\system32\drivers\dtsoftbus01.sys
2012-03-10 15:35:24 ----D---- C:\Program Files (x86)\DAEMON Tools Lite
2012-03-10 15:34:09 ----D---- C:\Users\Renáta\AppData\Roaming\DAEMON Tools Lite
2012-03-10 15:34:01 ----D---- C:\ProgramData\DAEMON Tools Lite
2012-03-10 15:21:47 ----D---- C:\Program Files (x86)\SMPlayer
2012-03-10 15:15:52 ----D---- C:\Users\Renáta\AppData\Roaming\Skype
2012-03-10 15:15:43 ----RD---- C:\Program Files (x86)\Skype
2012-03-10 15:15:43 ----D---- C:\ProgramData\Skype
2012-03-10 15:10:46 ----D---- C:\Program Files (x86)\QIP 2012
2012-03-10 15:05:28 ----A---- C:\Windows\system32\drivers\athrx.sys
2012-03-10 14:41:49 ----D---- C:\Windows\SYSWOW64\Wat
2012-03-10 14:41:49 ----D---- C:\Windows\system32\Wat
2012-03-10 14:15:28 ----A---- C:\Windows\SYSWOW64\wininet.dll
2012-03-10 14:15:28 ----A---- C:\Windows\SYSWOW64\wextract.exe
2012-03-10 14:15:28 ----A---- C:\Windows\SYSWOW64\webcheck.dll
2012-03-10 14:15:28 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2012-03-10 14:15:28 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2012-03-10 14:15:28 ----A---- C:\Windows\SYSWOW64\url.dll
2012-03-10 14:15:28 ----A---- C:\Windows\SYSWOW64\SetIEInstalledDate.exe
2012-03-10 14:15:28 ----A---- C:\Windows\SYSWOW64\RegisterIEPKEYs.exe
2012-03-10 14:15:28 ----A---- C:\Windows\SYSWOW64\pngfilt.dll
2012-03-10 14:15:28 ----A---- C:\Windows\SYSWOW64\msrating.dll
2012-03-10 14:15:28 ----A---- C:\Windows\SYSWOW64\msls31.dll
2012-03-10 14:15:28 ----A---- C:\Windows\SYSWOW64\mshtmler.dll
2012-03-10 14:15:28 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2012-03-10 14:15:28 ----A---- C:\Windows\SYSWOW64\msfeedssync.exe
2012-03-10 14:15:28 ----A---- C:\Windows\SYSWOW64\msfeedsbs.dll
2012-03-10 14:15:28 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2012-03-10 14:15:28 ----A---- C:\Windows\SYSWOW64\licmgr10.dll
2012-03-10 14:15:28 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2012-03-10 14:15:28 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2012-03-10 14:15:28 ----A---- C:\Windows\SYSWOW64\jscript.dll
2012-03-10 14:15:28 ----A---- C:\Windows\SYSWOW64\inseng.dll
2012-03-10 14:15:28 ----A---- C:\Windows\SYSWOW64\iexpress.exe
2012-03-10 14:15:28 ----A---- C:\Windows\SYSWOW64\ieui.dll
2012-03-10 14:15:28 ----A---- C:\Windows\SYSWOW64\iesysprep.dll
2012-03-10 14:15:28 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2012-03-10 14:15:28 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2012-03-10 14:15:28 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2012-03-10 14:15:28 ----A---- C:\Windows\SYSWOW64\iepeers.dll
2012-03-10 14:15:28 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2012-03-10 14:15:28 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2012-03-10 14:15:28 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2012-03-10 14:15:28 ----A---- C:\Windows\SYSWOW64\ieapfltr.dat
2012-03-10 14:15:28 ----A---- C:\Windows\SYSWOW64\ieakeng.dll
2012-03-10 14:15:28 ----A---- C:\Windows\SYSWOW64\IEAdvpack.dll
2012-03-10 14:15:28 ----A---- C:\Windows\SYSWOW64\ie4uinit.exe
2012-03-10 14:15:28 ----A---- C:\Windows\SYSWOW64\icardie.dll
2012-03-10 14:15:28 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2012-03-10 14:15:28 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2012-03-10 14:15:27 ----A---- C:\Windows\SYSWOW64\occache.dll
2012-03-10 14:15:27 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2012-03-10 14:15:27 ----A---- C:\Windows\SYSWOW64\mshta.exe
2012-03-10 14:15:27 ----A---- C:\Windows\SYSWOW64\imgutil.dll
2012-03-10 14:15:27 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2012-03-10 14:15:27 ----A---- C:\Windows\SYSWOW64\ieakui.dll
2012-03-10 14:15:27 ----A---- C:\Windows\SYSWOW64\ieaksie.dll
2012-03-10 14:15:27 ----A---- C:\Windows\SYSWOW64\admparse.dll
2012-03-10 14:15:27 ----A---- C:\Windows\system32\wininet.dll
2012-03-10 14:15:27 ----A---- C:\Windows\system32\urlmon.dll
2012-03-10 14:15:27 ----A---- C:\Windows\system32\RegisterIEPKEYs.exe
2012-03-10 14:15:27 ----A---- C:\Windows\system32\msrating.dll
2012-03-10 14:15:27 ----A---- C:\Windows\system32\msls31.dll
2012-03-10 14:15:27 ----A---- C:\Windows\system32\jsproxy.dll
2012-03-10 14:15:27 ----A---- C:\Windows\system32\iertutil.dll
2012-03-10 14:15:26 ----A---- C:\Windows\system32\wextract.exe
2012-03-10 14:15:26 ----A---- C:\Windows\system32\webcheck.dll
2012-03-10 14:15:26 ----A---- C:\Windows\system32\vbscript.dll
2012-03-10 14:15:26 ----A---- C:\Windows\system32\url.dll
2012-03-10 14:15:26 ----A---- C:\Windows\system32\SetIEInstalledDate.exe
2012-03-10 14:15:26 ----A---- C:\Windows\system32\pngfilt.dll
2012-03-10 14:15:26 ----A---- C:\Windows\system32\occache.dll
2012-03-10 14:15:26 ----A---- C:\Windows\system32\mshtmler.dll
2012-03-10 14:15:26 ----A---- C:\Windows\system32\mshtmled.dll
2012-03-10 14:15:26 ----A---- C:\Windows\system32\mshtml.dll
2012-03-10 14:15:26 ----A---- C:\Windows\system32\mshta.exe
2012-03-10 14:15:26 ----A---- C:\Windows\system32\msfeedssync.exe
2012-03-10 14:15:26 ----A---- C:\Windows\system32\msfeedsbs.dll
2012-03-10 14:15:26 ----A---- C:\Windows\system32\msfeeds.dll
2012-03-10 14:15:26 ----A---- C:\Windows\system32\licmgr10.dll
2012-03-10 14:15:26 ----A---- C:\Windows\system32\jscript9.dll
2012-03-10 14:15:26 ----A---- C:\Windows\system32\jscript.dll
2012-03-10 14:15:26 ----A---- C:\Windows\system32\inseng.dll
2012-03-10 14:15:26 ----A---- C:\Windows\system32\imgutil.dll
2012-03-10 14:15:26 ----A---- C:\Windows\system32\iexpress.exe
2012-03-10 14:15:26 ----A---- C:\Windows\system32\ieUnatt.exe
2012-03-10 14:15:26 ----A---- C:\Windows\system32\ieui.dll
2012-03-10 14:15:26 ----A---- C:\Windows\system32\iesysprep.dll
2012-03-10 14:15:26 ----A---- C:\Windows\system32\iesetup.dll
2012-03-10 14:15:26 ----A---- C:\Windows\system32\iernonce.dll
2012-03-10 14:15:26 ----A---- C:\Windows\system32\iepeers.dll
2012-03-10 14:15:26 ----A---- C:\Windows\system32\ieframe.dll
2012-03-10 14:15:26 ----A---- C:\Windows\system32\iedkcs32.dll
2012-03-10 14:15:26 ----A---- C:\Windows\system32\ieapfltr.dll
2012-03-10 14:15:26 ----A---- C:\Windows\system32\ieapfltr.dat
2012-03-10 14:15:26 ----A---- C:\Windows\system32\ieakui.dll
2012-03-10 14:15:26 ----A---- C:\Windows\system32\ieaksie.dll
2012-03-10 14:15:26 ----A---- C:\Windows\system32\ieakeng.dll
2012-03-10 14:15:26 ----A---- C:\Windows\system32\IEAdvpack.dll
2012-03-10 14:15:26 ----A---- C:\Windows\system32\ie4uinit.exe
2012-03-10 14:15:26 ----A---- C:\Windows\system32\icardie.dll
2012-03-10 14:15:26 ----A---- C:\Windows\system32\dxtrans.dll
2012-03-10 14:15:26 ----A---- C:\Windows\system32\dxtmsft.dll
2012-03-10 14:15:26 ----A---- C:\Windows\system32\admparse.dll
2012-03-10 14:04:29 ----A---- C:\Windows\system32\MRT.exe
2012-03-10 12:58:09 ----A---- C:\Windows\UC.PIF
2012-03-10 12:58:09 ----A---- C:\Windows\RAR.PIF
2012-03-10 12:58:09 ----A---- C:\Windows\PKZIP.PIF
2012-03-10 12:58:09 ----A---- C:\Windows\PKUNZIP.PIF
2012-03-10 12:58:09 ----A---- C:\Windows\NOCLOSE.PIF
2012-03-10 12:58:09 ----A---- C:\Windows\LHA.PIF
2012-03-10 12:58:09 ----A---- C:\Windows\ARJ.PIF
2012-03-10 12:58:08 ----D---- C:\Users\Renáta\AppData\Roaming\GHISLER
2012-03-10 12:58:08 ----D---- C:\Program Files (x86)\totalcmd
2012-03-10 12:47:33 ----D---- C:\Users\Renáta\AppData\Roaming\ESET
2012-03-10 12:46:57 ----D---- C:\ProgramData\ESET
2012-03-10 12:46:57 ----D---- C:\Program Files\ESET
2012-03-10 12:38:46 ----A---- C:\Windows\SYSWOW64\xmllite.dll
2012-03-10 12:38:46 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2012-03-10 12:38:46 ----A---- C:\Windows\system32\xmllite.dll
2012-03-10 12:38:46 ----A---- C:\Windows\system32\kerberos.dll
2012-03-10 12:38:45 ----A---- C:\Windows\SYSWOW64\odbctrac.dll
2012-03-10 12:38:45 ----A---- C:\Windows\SYSWOW64\odbcjt32.dll
2012-03-10 12:38:45 ----A---- C:\Windows\SYSWOW64\odbccu32.dll
2012-03-10 12:38:45 ----A---- C:\Windows\SYSWOW64\odbccr32.dll
2012-03-10 12:38:45 ----A---- C:\Windows\SYSWOW64\odbccp32.dll
2012-03-10 12:38:45 ----A---- C:\Windows\system32\odbctrac.dll
2012-03-10 12:38:45 ----A---- C:\Windows\system32\odbccu32.dll
2012-03-10 12:38:45 ----A---- C:\Windows\system32\odbccr32.dll
2012-03-10 12:38:45 ----A---- C:\Windows\system32\odbccp32.dll
2012-03-10 12:38:40 ----A---- C:\Windows\SYSWOW64\poqexec.exe
2012-03-10 12:38:40 ----A---- C:\Windows\system32\poqexec.exe
2012-03-10 12:38:38 ----A---- C:\Windows\SYSWOW64\sbe.dll
2012-03-10 12:38:38 ----A---- C:\Windows\SYSWOW64\explorer.exe
2012-03-10 12:38:38 ----A---- C:\Windows\SYSWOW64\CPFilters.dll
2012-03-10 12:38:38 ----A---- C:\Windows\system32\sbe.dll
2012-03-10 12:38:38 ----A---- C:\Windows\system32\CPFilters.dll
2012-03-10 12:38:38 ----A---- C:\Windows\explorer.exe
2012-03-10 12:38:32 ----A---- C:\Windows\SYSWOW64\quartz.dll
2012-03-10 12:38:32 ----A---- C:\Windows\SYSWOW64\qdvd.dll
2012-03-10 12:38:32 ----A---- C:\Windows\system32\quartz.dll
2012-03-10 12:38:32 ----A---- C:\Windows\system32\qdvd.dll
2012-03-10 12:38:31 ----A---- C:\Windows\SYSWOW64\shell32.dll
2012-03-10 12:38:31 ----A---- C:\Windows\system32\shell32.dll
2012-03-10 12:38:30 ----A---- C:\Windows\SYSWOW64\ntshrui.dll
2012-03-10 12:38:30 ----A---- C:\Windows\system32\ntshrui.dll
2012-03-10 12:38:27 ----A---- C:\Windows\SYSWOW64\tquery.dll
2012-03-10 12:38:27 ----A---- C:\Windows\SYSWOW64\SearchProtocolHost.exe
2012-03-10 12:38:27 ----A---- C:\Windows\SYSWOW64\SearchIndexer.exe
2012-03-10 12:38:27 ----A---- C:\Windows\SYSWOW64\SearchFilterHost.exe
2012-03-10 12:38:27 ----A---- C:\Windows\SYSWOW64\mssvp.dll
2012-03-10 12:38:27 ----A---- C:\Windows\SYSWOW64\mssrch.dll
2012-03-10 12:38:27 ----A---- C:\Windows\SYSWOW64\mssphtb.dll
2012-03-10 12:38:27 ----A---- C:\Windows\SYSWOW64\mssph.dll
2012-03-10 12:38:27 ----A---- C:\Windows\SYSWOW64\msscntrs.dll
2012-03-10 12:38:27 ----A---- C:\Windows\system32\tquery.dll
2012-03-10 12:38:27 ----A---- C:\Windows\system32\SearchProtocolHost.exe
2012-03-10 12:38:27 ----A---- C:\Windows\system32\SearchIndexer.exe
2012-03-10 12:38:27 ----A---- C:\Windows\system32\SearchFilterHost.exe
2012-03-10 12:38:27 ----A---- C:\Windows\system32\mssvp.dll
2012-03-10 12:38:27 ----A---- C:\Windows\system32\mssrch.dll
2012-03-10 12:38:27 ----A---- C:\Windows\system32\mssphtb.dll
2012-03-10 12:38:27 ----A---- C:\Windows\system32\mssph.dll
2012-03-10 12:38:27 ----A---- C:\Windows\system32\msscntrs.dll
2012-03-10 12:38:21 ----A---- C:\Windows\SYSWOW64\webio.dll
2012-03-10 12:38:21 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2012-03-10 12:38:21 ----A---- C:\Windows\SYSWOW64\schannel.dll
2012-03-10 12:38:21 ----A---- C:\Windows\SYSWOW64\secur32.dll
2012-03-10 12:38:21 ----A---- C:\Windows\system32\webio.dll
2012-03-10 12:38:21 ----A---- C:\Windows\system32\sspisrv.dll
2012-03-10 12:38:21 ----A---- C:\Windows\system32\sspicli.dll
2012-03-10 12:38:21 ----A---- C:\Windows\system32\schannel.dll
2012-03-10 12:38:21 ----A---- C:\Windows\system32\secur32.dll
2012-03-10 12:38:21 ----A---- C:\Windows\system32\lsass.exe
2012-03-10 12:38:21 ----A---- C:\Windows\system32\lsasrv.dll
2012-03-10 12:38:21 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2012-03-10 12:38:21 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2012-03-10 12:38:21 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2012-03-10 12:38:21 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2012-03-10 12:38:21 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2012-03-10 12:38:21 ----A---- C:\Windows\system32\drivers\cng.sys
2012-03-10 12:38:18 ----A---- C:\Windows\system32\csrsrv.dll
2012-03-10 12:38:17 ----A---- C:\Windows\SYSWOW64\XpsGdiConverter.dll
2012-03-10 12:38:17 ----A---- C:\Windows\system32\XpsGdiConverter.dll
2012-03-10 12:38:15 ----A---- C:\Windows\system32\drivers\tcpip.sys
2012-03-10 12:38:08 ----A---- C:\Windows\SYSWOW64\XpsPrint.dll
2012-03-10 12:38:08 ----A---- C:\Windows\SYSWOW64\mfc42.dll
2012-03-10 12:38:08 ----A---- C:\Windows\system32\XpsPrint.dll
2012-03-10 12:38:08 ----A---- C:\Windows\system32\mfc42u.dll
2012-03-10 12:38:08 ----A---- C:\Windows\system32\mfc42.dll
2012-03-10 12:38:07 ----A---- C:\Windows\SYSWOW64\mfc42u.dll
2012-03-10 12:37:50 ----A---- C:\Windows\SYSWOW64\fontsub.dll
2012-03-10 12:37:50 ----A---- C:\Windows\SYSWOW64\atmlib.dll
2012-03-10 12:37:50 ----A---- C:\Windows\SYSWOW64\atmfd.dll
2012-03-10 12:37:50 ----A---- C:\Windows\system32\fontsub.dll
2012-03-10 12:37:50 ----A---- C:\Windows\system32\atmlib.dll
2012-03-10 12:37:50 ----A---- C:\Windows\system32\atmfd.dll
2012-03-10 12:37:49 ----A---- C:\Windows\SYSWOW64\dnscacheugc.exe
2012-03-10 12:37:49 ----A---- C:\Windows\SYSWOW64\dnsapi.dll
2012-03-10 12:37:49 ----A---- C:\Windows\system32\drivers\Diskdump.sys
2012-03-10 12:37:49 ----A---- C:\Windows\system32\dnsrslvr.dll
2012-03-10 12:37:49 ----A---- C:\Windows\system32\dnscacheugc.exe
2012-03-10 12:37:49 ----A---- C:\Windows\system32\dnsapi.dll
2012-03-10 12:37:48 ----A---- C:\Windows\SYSWOW64\d3d10_1.dll
2012-03-10 12:37:48 ----A---- C:\Windows\system32\drivers\srvnet.sys
2012-03-10 12:37:48 ----A---- C:\Windows\system32\drivers\srv2.sys
2012-03-10 12:37:48 ----A---- C:\Windows\system32\drivers\srv.sys
2012-03-10 12:37:48 ----A---- C:\Windows\system32\d3d10_1.dll
2012-03-10 12:37:39 ----A---- C:\Windows\SYSWOW64\psisdecd.dll
2012-03-10 12:37:39 ----A---- C:\Windows\system32\psisdecd.dll
2012-03-10 12:37:39 ----A---- C:\Windows\system32\drivers\afd.sys
2012-03-10 12:36:38 ----A---- C:\Windows\system32\winresume.exe
2012-03-10 12:36:38 ----A---- C:\Windows\system32\winload.exe
2012-03-10 12:36:38 ----A---- C:\Windows\system32\kdusb.dll
2012-03-10 12:36:38 ----A---- C:\Windows\system32\kdcom.dll
2012-03-10 12:36:38 ----A---- C:\Windows\system32\kd1394.dll
2012-03-10 12:34:36 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2012-03-10 12:34:36 ----A---- C:\Windows\system32\wow64win.dll
2012-03-10 12:34:36 ----A---- C:\Windows\system32\winsrv.dll
2012-03-10 12:34:36 ----A---- C:\Windows\system32\KernelBase.dll
2012-03-10 12:34:36 ----A---- C:\Windows\system32\kernel32.dll
2012-03-10 12:34:36 ----A---- C:\Windows\system32\conhost.exe
2012-03-10 12:34:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2012-03-10 12:34:35 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2012-03-10 12:34:35 ----A---- C:\Windows\SYSWOW64\wow32.dll
2012-03-10 12:34:35 ----A---- C:\Windows\SYSWOW64\user.exe
2012-03-10 12:34:35 ----A---- C:\Windows\SYSWOW64\setup16.exe
2012-03-10 12:34:35 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2012-03-10 12:34:35 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2012-03-10 12:34:35 ----A---- C:\Windows\SYSWOW64\instnm.exe
2012-03-10 12:34:35 ----A---- C:\Windows\system32\wow64cpu.dll
2012-03-10 12:34:35 ----A---- C:\Windows\system32\wow64.dll
2012-03-10 12:34:35 ----A---- C:\Windows\system32\ntvdm64.dll
2012-03-10 12:34:23 ----A---- C:\Windows\SYSWOW64\drvinst.exe
2012-03-10 12:34:23 ----A---- C:\Windows\SYSWOW64\devrtl.dll
2012-03-10 12:34:23 ----A---- C:\Windows\SYSWOW64\devobj.dll
2012-03-10 12:34:23 ----A---- C:\Windows\SYSWOW64\cfgmgr32.dll
2012-03-10 12:34:23 ----A---- C:\Windows\system32\umpnpmgr.dll
2012-03-10 12:34:22 ----A---- C:\Windows\SYSWOW64\prevhost.exe
2012-03-10 12:34:22 ----A---- C:\Windows\system32\prevhost.exe
2012-03-10 12:34:20 ----A---- C:\Windows\system32\FXSCOVER.exe
2012-03-10 12:34:19 ----A---- C:\Windows\SYSWOW64\inetcomm.dll
2012-03-10 12:34:19 ----A---- C:\Windows\system32\inetcomm.dll
2012-03-10 12:34:16 ----A---- C:\Windows\SYSWOW64\msvcrt.dll
2012-03-10 12:34:16 ----A---- C:\Windows\system32\msvcrt.dll
2012-03-10 12:34:15 ----A---- C:\Windows\system32\drivers\bowser.sys
2012-03-10 12:34:13 ----A---- C:\Windows\SYSWOW64\oleaut32.dll
2012-03-10 12:34:13 ----A---- C:\Windows\SYSWOW64\oleacc.dll
2012-03-10 12:34:13 ----A---- C:\Windows\system32\oleaut32.dll
2012-03-10 12:34:13 ----A---- C:\Windows\system32\oleacc.dll
2012-03-10 12:34:12 ----A---- C:\Windows\SYSWOW64\EncDec.dll
2012-03-10 12:34:12 ----A---- C:\Windows\system32\EncDec.dll
2012-03-10 12:34:11 ----A---- C:\Windows\SYSWOW64\tzres.dll
2012-03-10 12:34:11 ----A---- C:\Windows\system32\tzres.dll
2012-03-10 12:34:03 ----A---- C:\Windows\SYSWOW64\ntdll.dll
2012-03-10 12:34:03 ----A---- C:\Windows\system32\ntdll.dll
2012-03-10 12:33:48 ----A---- C:\Windows\SYSWOW64\packager.dll
2012-03-10 12:33:48 ----A---- C:\Windows\system32\packager.dll
2012-03-10 12:30:52 ----D---- C:\Users\Renáta\AppData\Roaming\Macromedia
2012-03-10 12:30:52 ----D---- C:\Users\Renáta\AppData\Roaming\Adobe
2012-03-10 12:30:40 ----D---- C:\Windows\SYSWOW64\Macromed
2012-03-10 12:30:39 ----D---- C:\Windows\system32\Macromed
2012-03-10 12:06:34 ----D---- C:\Program Files (x86)\Microsoft Works
2012-03-10 12:06:28 ----D---- C:\Program Files (x86)\Microsoft Visual Studio
2012-03-10 12:06:19 ----D---- C:\Windows\PCHEALTH
2012-03-10 12:06:19 ----D---- C:\Program Files (x86)\Microsoft.NET
2012-03-10 12:04:28 ----D---- C:\Program Files\Microsoft Office
2012-03-10 12:04:13 ----D---- C:\ProgramData\Microsoft Help
2012-03-10 12:04:13 ----D---- C:\Program Files (x86)\Microsoft Office
2012-03-10 12:03:55 ----RHD---- C:\MSOCache
2012-03-10 11:51:26 ----A---- C:\Windows\ATKPF.ini
2012-03-10 11:49:00 ----D---- C:\ProgramData\ASUS
2012-03-10 11:44:17 ----D---- C:\Program Files\Intel
2012-03-10 11:43:47 ----D---- C:\ProgramData\USBChargerPlus
2012-03-10 11:43:27 ----A---- C:\Windows\system32\acovcnt.exe
2012-03-10 11:42:15 ----DC---- C:\Windows\system32\DRVSTORE
2012-03-10 11:42:15 ----A---- C:\Windows\system32\drivers\AiCharger.sys
2012-03-10 11:39:45 ----D---- C:\ProgramData\P4G
2012-03-10 11:39:45 ----D---- C:\Program Files\P4G
2012-03-10 11:39:02 ----D---- C:\Program Files\ASUS
2012-03-10 11:39:02 ----A---- C:\Windows\system32\ServiceFilter.ini
2012-03-10 11:39:02 ----A---- C:\Windows\system32\RemoveFont.ini
2012-03-10 11:39:02 ----A---- C:\Windows\system32\FBAgent.exe
2012-03-10 11:39:02 ----A---- C:\Windows\system32\FastBoot.ini
2012-03-10 11:39:02 ----A---- C:\Windows\system32\Defrag.ini
2012-03-10 11:39:02 ----A---- C:\Windows\system32\BootTime.ini
2012-03-10 11:39:02 ----A---- C:\Windows\system32\AutoRunFilter.ini
2012-03-10 11:38:55 ----A---- C:\Windows\SYSWOW64\ACEngSvr.exe
2012-03-10 11:37:28 ----A---- C:\Windows\system32\drivers\kbfiltr.sys
2012-03-10 11:36:58 ----D---- C:\ProgramData\AmUStor
2012-03-10 11:36:56 ----D---- C:\Program Files (x86)\AmIcoSingLun
2012-03-10 11:35:00 ----D---- C:\Program Files (x86)\Bluetooth Suite
2012-03-10 11:31:15 ----D---- C:\Program Files (x86)\Atheros
2012-03-10 11:31:15 ----A---- C:\Windows\system32\athrx.sys
2012-03-10 11:29:04 ----D---- C:\ProgramData\Atheros
2012-03-10 11:28:52 ----A---- C:\Windows\system32\drivers\L1C62x64.sys
2012-03-10 11:28:35 ----D---- C:\Program Files\Synaptics
2012-03-10 11:28:30 ----A---- C:\Windows\SYSWOW64\SynTPCOM.dll
2012-03-10 11:28:30 ----A---- C:\Windows\SYSWOW64\SynCtrl.dll
2012-03-10 11:28:30 ----A---- C:\Windows\SYSWOW64\SynCOM.dll
2012-03-10 11:28:30 ----A---- C:\Windows\system32\SynTPCo4.dll
2012-03-10 11:28:30 ----A---- C:\Windows\system32\SynTPAPI.dll
2012-03-10 11:28:30 ----A---- C:\Windows\system32\SynCtrl.dll
2012-03-10 11:28:30 ----A---- C:\Windows\system32\drivers\SynTP.sys
2012-03-10 11:27:07 ----D---- C:\Program Files\Fresco Logic Inc
2012-03-10 11:26:57 ----D---- C:\Program Files (x86)\ASUS
2012-03-10 11:26:46 ----D---- C:\ProgramData\SonicFocus
2012-03-10 11:26:44 ----D---- C:\Windows\SYSWOW64\RTCOM
2012-03-10 11:26:44 ----D---- C:\Program Files\Realtek
2012-03-10 11:26:28 ----A---- C:\Windows\SYSWOW64\SFCOM.dll
2012-03-10 11:26:28 ----A---- C:\Windows\system32\WavesGUILib.dll
2012-03-10 11:26:28 ----A---- C:\Windows\system32\SRSWOW64.dll
2012-03-10 11:26:28 ----A---- C:\Windows\system32\SRSTSX64.dll
2012-03-10 11:26:28 ----A---- C:\Windows\system32\SRSTSH64.dll
2012-03-10 11:26:28 ----A---- C:\Windows\system32\SRSHP64.dll
2012-03-10 11:26:28 ----A---- C:\Windows\system32\SFSAPO64.dll
2012-03-10 11:26:28 ----A---- C:\Windows\system32\SFProc64.dll
2012-03-10 11:26:28 ----A---- C:\Windows\system32\SFNHK64.dll
2012-03-10 11:26:28 ----A---- C:\Windows\system32\SFHAPO64.dll
2012-03-10 11:26:28 ----A---- C:\Windows\system32\SFDAPO64.dll
2012-03-10 11:26:28 ----A---- C:\Windows\system32\SFComm64.dll
2012-03-10 11:26:28 ----A---- C:\Windows\system32\SFCOM64.dll
2012-03-10 11:26:28 ----A---- C:\Windows\system32\SFAPO64.dll
2012-03-10 11:26:27 ----A---- C:\Windows\system32\RtlCPAPI64.dll
2012-03-10 11:26:26 ----A---- C:\Windows\system32\RtkCfg64.dll
2012-03-10 11:26:25 ----A---- C:\Windows\system32\RtkAPO64.dll
2012-03-10 11:26:25 ----A---- C:\Windows\system32\RtkApi64.dll
2012-03-10 11:26:24 ----A---- C:\Windows\system32\RtPgEx64.dll
2012-03-10 11:26:24 ----A---- C:\Windows\system32\RTCOM64.dll
2012-03-10 11:26:23 ----A---- C:\Windows\system32\RTEEP64A.dll
2012-03-10 11:26:23 ----A---- C:\Windows\system32\RTEEL64A.dll
2012-03-10 11:26:23 ----A---- C:\Windows\system32\RTEEG64A.dll
2012-03-10 11:26:23 ----A---- C:\Windows\system32\RTEED64A.dll
2012-03-10 11:26:23 ----A---- C:\Windows\system32\RP3DHT64.dll
2012-03-10 11:26:23 ----A---- C:\Windows\system32\RP3DAA64.dll
2012-03-10 11:26:23 ----A---- C:\Windows\system32\RCoRes64.dat
2012-03-10 11:26:23 ----A---- C:\Windows\system32\RCoInst64.dll
2012-03-10 11:26:23 ----A---- C:\Windows\system32\drivers\RTKVHD64.sys
2012-03-10 11:26:18 ----A---- C:\Windows\system32\MaxxAudioEQ.dll
2012-03-10 11:26:18 ----A---- C:\Windows\system32\MaxxAudioAPO20.dll
2012-03-10 11:26:13 ----A---- C:\Windows\system32\FMAPO64.dll
2012-03-10 11:26:12 ----A---- C:\Windows\system32\DTSVoiceClarityDLL64.dll
2012-03-10 11:26:12 ----A---- C:\Windows\system32\DTSS2SpeakerDLL64.dll
2012-03-10 11:26:11 ----A---- C:\Windows\system32\DTSS2HeadphoneDLL64.dll
2012-03-10 11:26:11 ----A---- C:\Windows\system32\DTSNeoPCDLL64.dll
2012-03-10 11:26:11 ----A---- C:\Windows\system32\DTSLimiterDLL64.dll
2012-03-10 11:26:11 ----A---- C:\Windows\system32\DTSLFXAPO64.dll
2012-03-10 11:26:11 ----A---- C:\Windows\system32\DTSGFXAPO64.dll
2012-03-10 11:26:11 ----A---- C:\Windows\system32\DTSGainCompensatorDLL64.dll
2012-03-10 11:26:11 ----A---- C:\Windows\system32\DTSBoostDLL64.dll
2012-03-10 11:26:11 ----A---- C:\Windows\system32\DTSBassEnhancementDLL64.dll
2012-03-10 11:26:10 ----A---- C:\Windows\system32\AERTAR64.dll
2012-03-10 11:26:10 ----A---- C:\Windows\system32\AERTAC64.dll
2012-03-10 11:26:09 ----D---- C:\Program Files (x86)\Realtek
2012-03-10 11:26:04 ----HD---- C:\Program Files (x86)\Temp
2012-03-10 11:26:03 ----R---- C:\Windows\RtlExUpd.dll
2012-03-10 11:23:32 ----A---- C:\Windows\system32\drivers\IntelMEFWVer.dll
2012-03-10 11:23:30 ----A---- C:\Windows\SYSWOW64\log.txt
2012-03-10 11:23:22 ----A---- C:\Windows\system32\drivers\HECIx64.sys
2012-03-10 11:23:21 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2012-03-10 11:23:20 ----D---- C:\Users\Renáta\AppData\Roaming\InstallShield
2012-03-10 11:23:07 ----D---- C:\Windows\SYSWOW64\NV
2012-03-10 11:23:07 ----D---- C:\Windows\system32\NV
2012-03-10 11:21:45 ----D---- C:\ProgramData\NVIDIA
2012-03-10 11:19:58 ----SHD---- C:\Windows\Installer
2012-03-10 11:19:18 ----D---- C:\ProgramData\NVIDIA Corporation
2012-03-10 11:19:16 ----D---- C:\Program Files (x86)\NVIDIA Corporation
2012-03-10 11:19:09 ----A---- C:\Windows\system32\nvgenco642040.dll
2012-03-10 11:19:09 ----A---- C:\Windows\system32\nvdispco642090.dll
2012-03-10 11:17:07 ----A---- C:\Windows\SYSWOW64\OpenCL.dll
2012-03-10 11:17:07 ----A---- C:\Windows\system32\OpenCL.dll
2012-03-10 11:17:06 ----A---- C:\Windows\system32\nvwgf2umx.dll
2012-03-10 11:17:05 ----A---- C:\Windows\SYSWOW64\nvwgf2um.dll
2012-03-10 11:17:05 ----A---- C:\Windows\SYSWOW64\nvumdshim.dll
2012-03-10 11:17:05 ----A---- C:\Windows\SYSWOW64\nvoptimusmft.dll
2012-03-10 11:17:05 ----A---- C:\Windows\system32\nvumdshimx.dll
2012-03-10 11:17:05 ----A---- C:\Windows\system32\nvoptimusmft.dll
2012-03-10 11:17:05 ----A---- C:\Windows\system32\drivers\nvpciflt.sys
2012-03-10 11:17:04 ----A---- C:\Windows\system32\nvoglv64.dll
2012-03-10 11:17:03 ----A---- C:\Windows\SYSWOW64\nvoglv32.dll
2012-03-10 11:17:02 ----A---- C:\Windows\system32\drivers\nvlddmkm.sys
2012-03-10 11:17:01 ----A---- C:\Windows\SYSWOW64\nvinit.dll
2012-03-10 11:17:01 ----A---- C:\Windows\SYSWOW64\nvdecodemft.dll
2012-03-10 11:17:01 ----A---- C:\Windows\system32\nvinitx.dll
2012-03-10 11:17:01 ----A---- C:\Windows\system32\nvdecodemft.dll
2012-03-10 11:17:00 ----A---- C:\Windows\system32\nvd3dumx.dll
2012-03-10 11:16:59 ----A---- C:\Windows\SYSWOW64\nvd3dum.dll
2012-03-10 11:16:58 ----A---- C:\Windows\SYSWOW64\nvcuvid.dll
2012-03-10 11:16:58 ----A---- C:\Windows\system32\nvcuvid.dll
2012-03-10 11:16:57 ----A---- C:\Windows\SYSWOW64\nvcuvenc.dll
2012-03-10 11:16:57 ----A---- C:\Windows\SYSWOW64\nvcuda.dll
2012-03-10 11:16:57 ----A---- C:\Windows\system32\nvcuvenc.dll
2012-03-10 11:16:56 ----A---- C:\Windows\system32\nvcuda.dll
2012-03-10 11:16:45 ----A---- C:\Windows\SYSWOW64\nvcompiler.dll
2012-03-10 11:16:44 ----A---- C:\Windows\system32\nvcompiler.dll
2012-03-10 11:16:43 ----A---- C:\Windows\SYSWOW64\nvapi.dll
2012-03-10 11:16:43 ----A---- C:\Windows\system32\nvapi64.dll
2012-03-10 11:13:55 ----D---- C:\Program Files\NVIDIA Corporation
2012-03-10 11:13:41 ----D---- C:\ProgramData\Intel
2012-03-10 11:11:06 ----D---- C:\Program Files\Common Files\Intel
2012-03-10 11:10:49 ----A---- C:\Windows\system32\IntcDAuC.dll
2012-03-10 11:10:49 ----A---- C:\Windows\system32\drivers\IntcDAud.sys
2012-03-10 11:10:30 ----A---- C:\Windows\SYSWOW64\iglhsip32.dll
2012-03-10 11:10:30 ----A---- C:\Windows\SYSWOW64\iglhcp32.dll
2012-03-10 11:10:30 ----A---- C:\Windows\SYSWOW64\igfxexps32.dll
2012-03-10 11:10:30 ----A---- C:\Windows\SYSWOW64\igfxdv32.dll
2012-03-10 11:10:30 ----A---- C:\Windows\SYSWOW64\igfxcmrt32.dll
2012-03-10 11:10:30 ----A---- C:\Windows\SYSWOW64\igdumdx32.dll
2012-03-10 11:10:30 ----A---- C:\Windows\SYSWOW64\igdumd32.dll
2012-03-10 11:10:30 ----A---- C:\Windows\SYSWOW64\igd10umd32.dll
2012-03-10 11:10:30 ----A---- C:\Windows\SYSWOW64\ig4icd32.dll
2012-03-10 11:10:30 ----A---- C:\Windows\system32\iglhsip64.dll
2012-03-10 11:10:30 ----A---- C:\Windows\system32\iglhcp64.dll
2012-03-10 11:10:30 ----A---- C:\Windows\system32\igfxtray.exe
2012-03-10 11:10:30 ----A---- C:\Windows\system32\igfxTMM.dll
2012-03-10 11:10:30 ----A---- C:\Windows\system32\igfxsrvc.exe
2012-03-10 11:10:30 ----A---- C:\Windows\system32\igfxsrvc.dll
2012-03-10 11:10:30 ----A---- C:\Windows\system32\igfxress.dll
2012-03-10 11:10:30 ----A---- C:\Windows\system32\igfxpph.dll
2012-03-10 11:10:30 ----A---- C:\Windows\system32\igfxpers.exe
2012-03-10 11:10:30 ----A---- C:\Windows\system32\igfxext.exe
2012-03-10 11:10:30 ----A---- C:\Windows\system32\igfxexps.dll
2012-03-10 11:10:30 ----A---- C:\Windows\system32\igfxdo.dll
2012-03-10 11:10:30 ----A---- C:\Windows\system32\IGFXDEVLib.dll
2012-03-10 11:10:30 ----A---- C:\Windows\system32\igfxdev.dll
2012-03-10 11:10:30 ----A---- C:\Windows\system32\igfxCoIn_v2291.dll
2012-03-10 11:10:30 ----A---- C:\Windows\system32\igfxcmrt64.dll
2012-03-10 11:10:30 ----A---- C:\Windows\system32\igdumd64.dll
2012-03-10 11:10:30 ----A---- C:\Windows\system32\igd10umd64.dll
2012-03-10 11:10:30 ----A---- C:\Windows\system32\ig4icd64.dll
2012-03-10 11:10:30 ----A---- C:\Windows\system32\IccLibDll_x64.dll
2012-03-10 11:10:30 ----A---- C:\Windows\system32\hkcmd.exe
2012-03-10 11:10:30 ----A---- C:\Windows\system32\hccutils.dll
2012-03-10 11:10:30 ----A---- C:\Windows\system32\GfxUI.exe
2012-03-10 11:10:30 ----A---- C:\Windows\system32\gfxSrvc.dll
2012-03-10 11:10:30 ----A---- C:\Windows\system32\drivers\igdkmd64.sys
2012-03-10 11:10:30 ----A---- C:\Windows\system32\difx64.exe
2012-03-10 11:07:59 ----RA---- C:\Windows\SYSWOW64\CSVer.dll
2012-03-10 11:07:59 ----D---- C:\Program Files (x86)\Intel
2012-03-10 11:07:35 ----D---- C:\Intel
2012-03-09 19:35:05 ----D---- C:\Users\Renáta\AppData\Roaming\Identities
2012-03-09 19:34:46 ----SD---- C:\Users\Renáta\AppData\Roaming\Microsoft
2012-03-09 19:34:46 ----D---- C:\Users\Renáta\AppData\Roaming\Media Center Programs
2012-03-09 19:34:38 ----SHD---- C:\Recovery
2012-03-09 19:34:38 ----SHD---- C:\ProgramData\Šablony
2012-03-09 19:34:38 ----SHD---- C:\ProgramData\Plocha
2012-03-09 19:34:38 ----SHD---- C:\ProgramData\Oblíbené položky
2012-03-09 19:34:38 ----SHD---- C:\ProgramData\Nabídka Start
2012-03-09 19:34:38 ----SHD---- C:\ProgramData\Dokumenty
2012-03-09 19:34:38 ----SHD---- C:\ProgramData\Data aplikací
2012-03-09 02:31:33 ----D---- C:\Windows\SoftwareDistribution
2012-03-09 02:29:18 ----D---- C:\Windows\Prefetch
2012-03-09 02:28:13 ----ASH---- C:\pagefile.sys
2012-03-09 02:28:12 ----ASH---- C:\hiberfil.sys
2012-03-09 02:25:56 ----SHD---- C:\System Volume Information
2012-03-09 02:25:04 ----D---- C:\Windows\Panther

======List of files/folders modified in the last 1 month======

2012-04-02 19:43:59 ----D---- C:\Windows\Temp
2012-04-02 19:43:54 ----RD---- C:\Program Files
2012-04-02 18:24:03 ----D---- C:\Windows\system32\config
2012-04-02 18:23:31 ----D---- C:\Windows\system32\Tasks
2012-04-01 17:13:56 ----D---- C:\Windows\System32
2012-04-01 17:13:56 ----D---- C:\Windows\inf
2012-04-01 17:13:56 ----A---- C:\Windows\system32\PerfStringBackup.INI
2012-04-01 14:25:48 ----D---- C:\Windows
2012-04-01 10:48:04 ----D---- C:\Windows\Logs
2012-04-01 10:48:04 ----D---- C:\Windows\debug
2012-04-01 10:13:21 ----RD---- C:\Program Files (x86)
2012-04-01 10:09:12 ----D---- C:\Windows\system32\drivers
2012-03-31 22:30:12 ----HD---- C:\ProgramData
2012-03-31 21:35:22 ----SD---- C:\ProgramData\Microsoft
2012-03-24 12:13:18 ----D---- C:\Windows\rescache
2012-03-23 22:58:07 ----D---- C:\Windows\system32\catroot2
2012-03-23 22:36:00 ----D---- C:\Windows\system32\LogFiles
2012-03-17 21:28:11 ----RSD---- C:\Windows\assembly
2012-03-17 21:28:11 ----D---- C:\Windows\Microsoft.NET
2012-03-17 18:56:07 ----D---- C:\Windows\system32\sysprep
2012-03-14 21:36:55 ----D---- C:\Windows\winsxs
2012-03-14 21:35:16 ----D---- C:\Windows\SysWOW64
2012-03-14 21:04:04 ----D---- C:\Windows\system32\catroot
2012-03-11 20:54:31 ----D---- C:\Windows\system32\wdi
2012-03-11 14:43:00 ----D---- C:\Program Files (x86)\Common Files
2012-03-11 09:24:57 ----A---- C:\Windows\win.ini
2012-03-10 17:34:40 ----RSD---- C:\Windows\Fonts
2012-03-10 17:34:04 ----D---- C:\Windows\SYSWOW64\cs-CZ
2012-03-10 17:34:04 ----D---- C:\Windows\system32\DriverStore
2012-03-10 17:34:04 ----D---- C:\Windows\system32\cs-CZ
2012-03-10 17:23:03 ----D---- C:\Windows\SYSWOW64\en-US
2012-03-10 17:23:03 ----D---- C:\Windows\system32\en-US
2012-03-10 17:12:25 ----D---- C:\Program Files\Common Files
2012-03-10 14:41:55 ----D---- C:\Program Files\Common Files\System
2012-03-10 14:41:54 ----D---- C:\Windows\ehome
2012-03-10 14:41:53 ----D---- C:\Windows\AppPatch
2012-03-10 14:41:53 ----D---- C:\Program Files\Internet Explorer
2012-03-10 14:41:53 ----D---- C:\Program Files (x86)\Internet Explorer
2012-03-10 14:41:52 ----D---- C:\Windows\SYSWOW64\migration
2012-03-10 14:41:51 ----D---- C:\Windows\system32\migration
2012-03-10 14:41:51 ----D---- C:\Windows\PolicyDefinitions
2012-03-10 14:41:48 ----D---- C:\Windows\system32\Boot
2012-03-10 12:06:28 ----D---- C:\Windows\ShellNew
2012-03-10 12:05:56 ----D---- C:\Program Files\Common Files\Microsoft Shared
2012-03-10 11:56:17 ----D---- C:\Windows\SYSWOW64\drivers
2012-03-10 11:36:40 ----D---- C:\Windows\system32\restore
2012-03-10 11:21:46 ----RD---- C:\Users
2012-03-10 11:20:15 ----D---- C:\Windows\Help
2012-03-10 10:55:08 ----D---- C:\Windows\system32\CodeIntegrity
2012-03-09 19:35:02 ----SHD---- C:\$Recycle.Bin
2012-03-09 19:34:38 ----D---- C:\Program Files\Windows NT
2012-03-09 02:31:13 ----D---- C:\Windows\system32\drivers\UMDF
2012-03-09 02:29:13 ----D---- C:\Windows\CSC

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iaStor;Intel AHCI Controller; C:\Windows\system32\DRIVERS\iaStor.sys [2010-11-05 438808]
R0 nvpciflt;nvpciflt; C:\Windows\system32\DRIVERS\nvpciflt.sys [2011-03-08 25960]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R1 ATKWMIACPIIO;ATKWMIACPI Driver; \??\C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [2010-07-26 17024]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-21 514560]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2012-03-10 283200]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2010-12-21 141264]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 ASMMAP64;ASMMAP64; \??\C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-07-02 15416]
R2 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2010-12-21 170640]
R2 epfw;epfw; C:\Windows\system32\DRIVERS\epfw.sys [2010-12-21 170640]
R2 epfwwfp;epfwwfp; C:\Windows\system32\DRIVERS\epfwwfp.sys [2010-12-21 50624]
R2 TurboB;Turbo Boost UI Monitor driver; C:\Windows\system32\DRIVERS\TurboB.sys [2010-11-29 16120]
R3 AiCharger;ASUS Charger Driver; C:\Windows\system32\DRIVERS\AiCharger.sys [2011-02-25 16768]
R3 AthBTPort;Atheros Virtual Bluetooth Class; C:\Windows\system32\DRIVERS\btath_flt.sys [2011-03-13 36000]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athrx.sys [2011-10-07 2770944]
R3 BTATH_A2DP;Bluetooth A2DP Audio Driver; C:\Windows\system32\drivers\btath_a2dp.sys [2011-03-13 298656]
R3 BTATH_BUS;Atheros Bluetooth Bus; C:\Windows\system32\DRIVERS\btath_bus.sys [2011-03-13 28832]
R3 BTATH_HCRP;Bluetooth HCRP Server driver; C:\Windows\system32\DRIVERS\btath_hcrp.sys [2011-03-13 201376]
R3 BTATH_LWFLT;Bluetooth LWFLT Device; C:\Windows\system32\DRIVERS\btath_lwflt.sys [2011-03-13 55456]
R3 BTATH_RCP;Bluetooth AVRCP Device; C:\Windows\system32\DRIVERS\btath_rcp.sys [2011-03-13 154272]
R3 BtFilter;BtFilter; C:\Windows\system32\DRIVERS\btfilter.sys [2011-03-13 280224]
R3 BthEnum;Ovladač pro Bluetooth Request Block; C:\Windows\system32\drivers\BthEnum.sys [2009-07-14 41984]
R3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
R3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2011-04-28 80384]
R3 Epfwndis;Eset Personal Firewall; C:\Windows\system32\DRIVERS\Epfwndis.sys [2010-12-21 34144]
R3 FLxHCIc;Fresco Logic xHCI (USB3) Device Driver; C:\Windows\system32\DRIVERS\FLxHCIc.sys [2011-04-08 177152]
R3 FLxHCIh;Fresco Logic xHCI (USB3) Hub Device Driver; C:\Windows\system32\DRIVERS\FLxHCIh.sys [2011-04-08 56320]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2011-01-27 12273408]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2011-06-07 2890984]
R3 IntcDAud;Intel(R) Display Audio; C:\Windows\system32\DRIVERS\IntcDAud.sys [2010-10-14 317440]
R3 kbfiltr;Keyboard Filter; C:\Windows\system32\DRIVERS\kbfiltr.sys [2009-07-20 15416]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller; C:\Windows\system32\DRIVERS\L1C62x64.sys [2010-08-24 76912]
R3 MEIx64;Intel(R) Management Engine Interface; C:\Windows\system32\DRIVERS\HECIx64.sys [2010-10-19 56344]
R3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2010-10-08 1395248]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2011-04-28 552960]
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-21 165888]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-21 6656]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-21 34688]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-21 199552]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-21 21760]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
R2 AFBAgent;AFBAgent; C:\Windows\system32\FBAgent.exe [2011-01-25 379520]
R2 ASLDRService;ASLDR Service; C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe [2009-06-15 84536]
R2 Atheros Bt&Wlan Coex Agent;Atheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [2011-03-13 138400]
R2 AtherosSvc;AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [2011-03-13 74912]
R2 ATKGFNEXSrv;ATKGFNEX Service; C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe [2009-12-15 96896]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [2011-01-12 810144]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2010-12-20 325656]
R2 NVSvc;NVIDIA Driver Helper Service; C:\Windows\system32\nvvsvc.exe [2011-03-06 993896]
R2 nvUpdatusService;NVIDIA Update Service Daemon; C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-03-14 2009704]
R2 UNS;Intel(R) Management and Security Application User Notification Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-12-20 2656280]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-02-15 158856]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2011-01-12 42360]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-07-20 440696]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 SwitchBoard;SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
S3 TurboBoost;Intel(R) Turbo Boost Technology Monitor 2.0; C:\Program Files\Intel\TurboBoost\TurboBoost.exe [2010-11-29 149504]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2012-03-10 1255736]

-----------------EOF-----------------

rendie
Návštěvník
Návštěvník
Příspěvky: 11
Registrován: 02 Dub 2012 18:46

Re: Win32/TrojanDownloader.Mebload.AR

#2 Příspěvek od rendie »

10:09:10.0310 4492 TDSS rootkit removing tool 2.7.23.0 Mar 26 2012 13:40:18
10:09:12.0161 4492 ============================================================
10:09:12.0161 4492 Current date / time: 2012/04/01 10:09:12.0161
10:09:12.0161 4492 SystemInfo:
10:09:12.0161 4492
10:09:12.0161 4492 OS Version: 6.1.7601 ServicePack: 1.0
10:09:12.0161 4492 Product type: Workstation
10:09:12.0161 4492 ComputerName: SNEHURKA
10:09:12.0161 4492 UserName: Renáta
10:09:12.0161 4492 Windows directory: C:\Windows
10:09:12.0161 4492 System windows directory: C:\Windows
10:09:12.0161 4492 Running under WOW64
10:09:12.0161 4492 Processor architecture: Intel x64
10:09:12.0161 4492 Number of processors: 4
10:09:12.0161 4492 Page size: 0x1000
10:09:12.0161 4492 Boot type: Normal boot
10:09:12.0161 4492 ============================================================
10:09:12.0658 4492 Drive \Device\Harddisk0\DR0 - Size: 0xAEA8CDE000 (698.64 Gb), SectorSize: 0x200, Cylinders: 0x16441, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
10:09:12.0672 4492 \Device\Harddisk0\DR0:
10:09:12.0672 4492 MBR used
10:09:12.0672 4492 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
10:09:12.0672 4492 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x442A000
10:09:12.0672 4492 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x445C800, BlocksNum 0xC350000
10:09:12.0672 4492 \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x107AC800, BlocksNum 0x46D99000
10:09:12.0915 4492 Initialize success
10:09:12.0915 4492 ============================================================
10:09:36.0114 5496 ============================================================
10:09:36.0114 5496 Scan started
10:09:36.0114 5496 Mode: Manual; SigCheck; TDLFS;
10:09:36.0114 5496 ============================================================
10:09:36.0615 5496 1394ohci (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
10:09:36.0754 5496 1394ohci - ok
10:09:36.0794 5496 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
10:09:36.0808 5496 ACPI - ok
10:09:36.0830 5496 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
10:09:36.0906 5496 AcpiPmi - ok
10:09:37.0019 5496 AdobeARMservice (62b7936f9036dd6ed36e6a7efa805dc0) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
10:09:37.0026 5496 AdobeARMservice - ok
10:09:37.0174 5496 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\drivers\adp94xx.sys
10:09:37.0209 5496 adp94xx - ok
10:09:37.0232 5496 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\drivers\adpahci.sys
10:09:37.0265 5496 adpahci - ok
10:09:37.0276 5496 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\drivers\adpu320.sys
10:09:37.0290 5496 adpu320 - ok
10:09:37.0329 5496 AeLookupSvc (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll
10:09:37.0416 5496 AeLookupSvc - ok
10:09:37.0475 5496 AFBAgent (6e79a119b0ce418fe44e0c824bf3f039) C:\Windows\system32\FBAgent.exe
10:09:37.0543 5496 AFBAgent - ok
10:09:37.0616 5496 AFD (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys
10:09:37.0674 5496 AFD - ok
10:09:37.0710 5496 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
10:09:37.0732 5496 agp440 - ok
10:09:37.0790 5496 AiCharger (14370049d8c9912eac7603809a77c378) C:\Windows\system32\DRIVERS\AiCharger.sys
10:09:37.0797 5496 AiCharger - ok
10:09:37.0835 5496 ALG (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe
10:09:37.0875 5496 ALG - ok
10:09:37.0913 5496 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
10:09:37.0930 5496 aliide - ok
10:09:37.0953 5496 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
10:09:37.0969 5496 amdide - ok
10:09:37.0986 5496 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\drivers\amdk8.sys
10:09:38.0017 5496 AmdK8 - ok
10:09:38.0027 5496 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\drivers\amdppm.sys
10:09:38.0072 5496 AmdPPM - ok
10:09:38.0113 5496 amdsata (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
10:09:38.0141 5496 amdsata - ok
10:09:38.0158 5496 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\drivers\amdsbs.sys
10:09:38.0179 5496 amdsbs - ok
10:09:38.0199 5496 amdxata (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
10:09:38.0216 5496 amdxata - ok
10:09:38.0249 5496 AppID (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
10:09:38.0300 5496 AppID - ok
10:09:38.0326 5496 AppIDSvc (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll
10:09:38.0365 5496 AppIDSvc - ok
10:09:38.0400 5496 Appinfo (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll
10:09:38.0449 5496 Appinfo - ok
10:09:38.0500 5496 AppMgmt (4aba3e75a76195a3e38ed2766c962899) C:\Windows\System32\appmgmts.dll
10:09:38.0530 5496 AppMgmt - ok
10:09:38.0575 5496 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\drivers\arc.sys
10:09:38.0593 5496 arc - ok
10:09:38.0603 5496 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\drivers\arcsas.sys
10:09:38.0612 5496 arcsas - ok
10:09:38.0702 5496 ASLDRService (18e5c2f937f9deb8c282df66a3761925) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
10:09:38.0711 5496 ASLDRService - ok
10:09:38.0749 5496 ASMMAP64 (4c016fd76ed5c05e84ca8cab77993961) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys
10:09:38.0764 5496 ASMMAP64 - ok
10:09:38.0796 5496 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
10:09:38.0844 5496 AsyncMac - ok
10:09:38.0878 5496 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
10:09:38.0896 5496 atapi - ok
10:09:38.0961 5496 AthBTPort (cbe61b4494165f458bd87e37181ee934) C:\Windows\system32\DRIVERS\btath_flt.sys
10:09:38.0967 5496 AthBTPort - ok
10:09:39.0031 5496 Atheros Bt&Wlan Coex Agent (4c4a576818ea028257c624ae36ff7a03) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
10:09:39.0039 5496 Atheros Bt&Wlan Coex Agent - ok
10:09:39.0057 5496 AtherosSvc (21753130331188c4b474e1d3b396e629) C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
10:09:39.0063 5496 AtherosSvc - ok
10:09:39.0140 5496 athr (b4174564ad5834a1680610572477878c) C:\Windows\system32\DRIVERS\athrx.sys
10:09:39.0255 5496 athr - ok
10:09:39.0369 5496 ATKGFNEXSrv (7910158929571214a959d5a6d16dd9c0) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
10:09:39.0378 5496 ATKGFNEXSrv - ok
10:09:39.0404 5496 ATKWMIACPIIO (1f7238a37389ed92e9d8eee975cabd54) C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys
10:09:39.0422 5496 ATKWMIACPIIO - ok
10:09:39.0489 5496 AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
10:09:39.0534 5496 AudioEndpointBuilder - ok
10:09:39.0543 5496 AudioSrv (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
10:09:39.0574 5496 AudioSrv - ok
10:09:39.0625 5496 AxInstSV (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll
10:09:39.0667 5496 AxInstSV - ok
10:09:39.0727 5496 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\drivers\bxvbda.sys
10:09:39.0768 5496 b06bdrv - ok
10:09:39.0811 5496 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
10:09:39.0852 5496 b57nd60a - ok
10:09:39.0884 5496 BDESVC (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll
10:09:39.0917 5496 BDESVC - ok
10:09:39.0940 5496 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
10:09:39.0992 5496 Beep - ok
10:09:40.0078 5496 BFE (82974d6a2fd19445cc5171fc378668a4) C:\Windows\System32\bfe.dll
10:09:40.0129 5496 BFE - ok
10:09:40.0167 5496 BITS (1ea7969e3271cbc59e1730697dc74682) C:\Windows\System32\qmgr.dll
10:09:40.0224 5496 BITS - ok
10:09:40.0281 5496 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
10:09:40.0315 5496 blbdrive - ok
10:09:40.0367 5496 bowser (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
10:09:40.0416 5496 bowser - ok
10:09:40.0450 5496 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\drivers\BrFiltLo.sys
10:09:40.0471 5496 BrFiltLo - ok
10:09:40.0495 5496 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\drivers\BrFiltUp.sys
10:09:40.0507 5496 BrFiltUp - ok
10:09:40.0551 5496 Browser (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll
10:09:40.0600 5496 Browser - ok
10:09:40.0624 5496 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
10:09:40.0679 5496 Brserid - ok
10:09:40.0689 5496 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
10:09:40.0721 5496 BrSerWdm - ok
10:09:40.0764 5496 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
10:09:40.0799 5496 BrUsbMdm - ok
10:09:40.0810 5496 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
10:09:40.0844 5496 BrUsbSer - ok
10:09:40.0903 5496 BTATH_A2DP (fe70889a85c57a9268101b2db0474509) C:\Windows\system32\drivers\btath_a2dp.sys
10:09:40.0917 5496 BTATH_A2DP - ok
10:09:40.0959 5496 BTATH_BUS (a83a91d07d1fe6bbe7a9db46ca00434b) C:\Windows\system32\DRIVERS\btath_bus.sys
10:09:40.0982 5496 BTATH_BUS - ok
10:09:40.0993 5496 BTATH_HCRP (c864ff85ee16d61c2bdd5ef76824625f) C:\Windows\system32\DRIVERS\btath_hcrp.sys
10:09:41.0005 5496 BTATH_HCRP - ok
10:09:41.0040 5496 BTATH_LWFLT (0dea505efb5d771826d177ef8b8a208f) C:\Windows\system32\DRIVERS\btath_lwflt.sys
10:09:41.0047 5496 BTATH_LWFLT - ok
10:09:41.0068 5496 BTATH_RCP (724c8088c96efe7a3e63fec21d4681c0) C:\Windows\system32\DRIVERS\btath_rcp.sys
10:09:41.0098 5496 BTATH_RCP - ok
10:09:41.0143 5496 BtFilter (aa0f5afcf077c5246589b32eceeae566) C:\Windows\system32\DRIVERS\btfilter.sys
10:09:41.0162 5496 BtFilter - ok
10:09:41.0207 5496 BthEnum (cf98190a94f62e405c8cb255018b2315) C:\Windows\system32\drivers\BthEnum.sys
10:09:41.0254 5496 BthEnum - ok
10:09:41.0296 5496 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\drivers\bthmodem.sys
10:09:41.0326 5496 BTHMODEM - ok
10:09:41.0363 5496 BthPan (02dd601b708dd0667e1331fa8518e9ff) C:\Windows\system32\DRIVERS\bthpan.sys
10:09:41.0385 5496 BthPan - ok
10:09:41.0411 5496 BTHPORT (64c198198501f7560ee41d8d1efa7952) C:\Windows\System32\Drivers\BTHport.sys
10:09:41.0449 5496 BTHPORT - ok
10:09:41.0480 5496 bthserv (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll
10:09:41.0510 5496 bthserv - ok
10:09:41.0528 5496 BTHUSB (f188b7394d81010767b6df3178519a37) C:\Windows\System32\Drivers\BTHUSB.sys
10:09:41.0556 5496 BTHUSB - ok
10:09:41.0582 5496 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
10:09:41.0639 5496 cdfs - ok
10:09:41.0678 5496 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\DRIVERS\cdrom.sys
10:09:41.0700 5496 cdrom - ok
10:09:41.0740 5496 CertPropSvc (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
10:09:41.0790 5496 CertPropSvc - ok
10:09:41.0818 5496 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\drivers\circlass.sys
10:09:41.0839 5496 circlass - ok
10:09:41.0851 5496 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
10:09:41.0864 5496 CLFS - ok
10:09:41.0922 5496 clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
10:09:41.0933 5496 clr_optimization_v2.0.50727_32 - ok
10:09:41.0997 5496 clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
10:09:42.0005 5496 clr_optimization_v2.0.50727_64 - ok
10:09:42.0068 5496 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
10:09:42.0078 5496 clr_optimization_v4.0.30319_32 - ok
10:09:42.0110 5496 clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
10:09:42.0117 5496 clr_optimization_v4.0.30319_64 - ok
10:09:42.0194 5496 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
10:09:42.0220 5496 CmBatt - ok
10:09:42.0230 5496 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
10:09:42.0246 5496 cmdide - ok
10:09:42.0278 5496 CNG (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys
10:09:42.0334 5496 CNG - ok
10:09:42.0356 5496 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
10:09:42.0366 5496 Compbatt - ok
10:09:42.0419 5496 CompositeBus (03edb043586cceba243d689bdda370a8) C:\Windows\system32\DRIVERS\CompositeBus.sys
10:09:42.0442 5496 CompositeBus - ok
10:09:42.0463 5496 COMSysApp - ok
10:09:42.0480 5496 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\drivers\crcdisk.sys
10:09:42.0490 5496 crcdisk - ok
10:09:42.0533 5496 CryptSvc (15597883fbe9b056f276ada3ad87d9af) C:\Windows\system32\cryptsvc.dll
10:09:42.0575 5496 CryptSvc - ok
10:09:42.0606 5496 CSC (54da3dfd29ed9f1619b6f53f3ce55e49) C:\Windows\system32\drivers\csc.sys
10:09:42.0663 5496 CSC - ok
10:09:42.0744 5496 CscService (3ab183ab4d2c79dcf459cd2c1266b043) C:\Windows\System32\cscsvc.dll
10:09:42.0764 5496 CscService - ok
10:09:42.0818 5496 DcomLaunch (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
10:09:42.0849 5496 DcomLaunch - ok
10:09:42.0886 5496 defragsvc (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll
10:09:42.0930 5496 defragsvc - ok
10:09:42.0976 5496 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
10:09:43.0016 5496 DfsC - ok
10:09:43.0053 5496 Dhcp (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll
10:09:43.0093 5496 Dhcp - ok
10:09:43.0103 5496 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
10:09:43.0151 5496 discache - ok
10:09:43.0196 5496 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\drivers\disk.sys
10:09:43.0214 5496 Disk - ok
10:09:43.0276 5496 dmvsc (5db085a8a6600be6401f2b24eecb5415) C:\Windows\system32\drivers\dmvsc.sys
10:09:43.0314 5496 dmvsc - ok
10:09:43.0351 5496 Dnscache (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll
10:09:43.0388 5496 Dnscache - ok
10:09:43.0419 5496 dot3svc (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll
10:09:43.0451 5496 dot3svc - ok
10:09:43.0474 5496 DPS (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll
10:09:43.0513 5496 DPS - ok
10:09:43.0568 5496 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
10:09:43.0594 5496 drmkaud - ok
10:09:43.0641 5496 dtsoftbus01 (46571ed73ae84469dca53081d33cf3c8) C:\Windows\system32\DRIVERS\dtsoftbus01.sys
10:09:43.0652 5496 dtsoftbus01 - ok
10:09:43.0695 5496 DXGKrnl (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
10:09:43.0723 5496 DXGKrnl - ok
10:09:43.0767 5496 eamonm (aca3fe4f18a945b7bf2618a79f6f670b) C:\Windows\system32\DRIVERS\eamonm.sys
10:09:43.0788 5496 eamonm - ok
10:09:43.0822 5496 EapHost (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll
10:09:43.0858 5496 EapHost - ok
10:09:43.0926 5496 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\drivers\evbda.sys
10:09:44.0030 5496 ebdrv - ok
10:09:44.0106 5496 EFS (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe
10:09:44.0136 5496 EFS - ok
10:09:44.0198 5496 ehdrv (6672438bdcbfd87250d22112d458294d) C:\Windows\system32\DRIVERS\ehdrv.sys
10:09:44.0226 5496 ehdrv - ok
10:09:44.0272 5496 ehRecvr (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe
10:09:44.0317 5496 ehRecvr - ok
10:09:44.0323 5496 ehSched (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe
10:09:44.0334 5496 ehSched - ok
10:09:44.0422 5496 EhttpSrv (deb2b067745d92ff17a5068dfd2360bc) C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
10:09:44.0429 5496 EhttpSrv - ok
10:09:44.0482 5496 ekrn (191d8eccc40f05b52fac0513f35ba01d) C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
10:09:44.0503 5496 ekrn - ok
10:09:44.0613 5496 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\drivers\elxstor.sys
10:09:44.0635 5496 elxstor - ok
10:09:44.0676 5496 epfw (443805b5b11c859ac8ca35297648ff0c) C:\Windows\system32\DRIVERS\epfw.sys
10:09:44.0696 5496 epfw - ok
10:09:44.0727 5496 Epfwndis (66e61bc6c9f519a99275eb0f0e530bf4) C:\Windows\system32\DRIVERS\Epfwndis.sys
10:09:44.0751 5496 Epfwndis - ok
10:09:44.0808 5496 epfwwfp (f72c97f3d34ea5ec919c73e3901266bb) C:\Windows\system32\DRIVERS\epfwwfp.sys
10:09:44.0832 5496 epfwwfp - ok
10:09:44.0864 5496 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
10:09:44.0893 5496 ErrDev - ok
10:09:44.0922 5496 EventSystem (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll
10:09:44.0963 5496 EventSystem - ok
10:09:44.0981 5496 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
10:09:45.0029 5496 exfat - ok
10:09:45.0062 5496 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
10:09:45.0124 5496 fastfat - ok
10:09:45.0227 5496 Fax (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe
10:09:45.0273 5496 Fax - ok
10:09:45.0325 5496 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\drivers\fdc.sys
10:09:45.0360 5496 fdc - ok
10:09:45.0401 5496 fdPHost (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll
10:09:45.0442 5496 fdPHost - ok
10:09:45.0458 5496 FDResPub (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll
10:09:45.0494 5496 FDResPub - ok
10:09:45.0512 5496 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
10:09:45.0529 5496 FileInfo - ok
10:09:45.0538 5496 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
10:09:45.0586 5496 Filetrace - ok
10:09:45.0602 5496 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\drivers\flpydisk.sys
10:09:45.0613 5496 flpydisk - ok
10:09:45.0636 5496 FltMgr (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
10:09:45.0669 5496 FltMgr - ok
10:09:45.0709 5496 FLxHCIc (7de8a770487fc4b5e3a168ad97e1d370) C:\Windows\system32\DRIVERS\FLxHCIc.sys
10:09:45.0752 5496 FLxHCIc - ok
10:09:45.0776 5496 FLxHCIh (2d54a3319fc955029e4b371cdc088ff4) C:\Windows\system32\DRIVERS\FLxHCIh.sys
10:09:45.0798 5496 FLxHCIh - ok
10:09:45.0843 5496 FontCache (b4447f606bb19fd8ad0bafb59b90f5d9) C:\Windows\system32\FntCache.dll
10:09:45.0902 5496 FontCache - ok
10:09:45.0969 5496 FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
10:09:45.0976 5496 FontCache3.0.0.0 - ok
10:09:46.0020 5496 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
10:09:46.0038 5496 FsDepends - ok
10:09:46.0048 5496 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys
10:09:46.0064 5496 Fs_Rec - ok
10:09:46.0089 5496 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
10:09:46.0101 5496 fvevol - ok
10:09:46.0126 5496 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\drivers\gagp30kx.sys
10:09:46.0166 5496 gagp30kx - ok
10:09:46.0203 5496 gpsvc (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll
10:09:46.0240 5496 gpsvc - ok
10:09:46.0255 5496 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
10:09:46.0280 5496 hcw85cir - ok
10:09:46.0334 5496 HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
10:09:46.0362 5496 HdAudAddService - ok
10:09:46.0379 5496 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\DRIVERS\HDAudBus.sys
10:09:46.0407 5496 HDAudBus - ok
10:09:46.0422 5496 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\drivers\HidBatt.sys
10:09:46.0456 5496 HidBatt - ok
10:09:46.0479 5496 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\drivers\hidbth.sys
10:09:46.0511 5496 HidBth - ok
10:09:46.0525 5496 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\drivers\hidir.sys
10:09:46.0557 5496 HidIr - ok
10:09:46.0587 5496 hidserv (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll
10:09:46.0625 5496 hidserv - ok
10:09:46.0666 5496 HidUsb (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys
10:09:46.0685 5496 HidUsb - ok
10:09:46.0712 5496 hkmsvc (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll
10:09:46.0762 5496 hkmsvc - ok
10:09:46.0781 5496 HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll
10:09:46.0825 5496 HomeGroupListener - ok
10:09:46.0853 5496 HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll
10:09:46.0865 5496 HomeGroupProvider - ok
10:09:46.0908 5496 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
10:09:46.0917 5496 HpSAMD - ok
10:09:46.0952 5496 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
10:09:47.0001 5496 HTTP - ok
10:09:47.0010 5496 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
10:09:47.0016 5496 hwpolicy - ok
10:09:47.0029 5496 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\DRIVERS\i8042prt.sys
10:09:47.0049 5496 i8042prt - ok
10:09:47.0124 5496 iaStor (d7921d5a870b11cc1adab198a519d50a) C:\Windows\system32\DRIVERS\iaStor.sys
10:09:47.0134 5496 iaStor - ok
10:09:47.0179 5496 iaStorV (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
10:09:47.0205 5496 iaStorV - ok
10:09:47.0267 5496 idsvc (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
10:09:47.0292 5496 idsvc - ok
10:09:47.0508 5496 igfx (efe5a0af39a8e179624117c521f1e012) C:\Windows\system32\DRIVERS\igdkmd64.sys
10:09:47.0832 5496 igfx - ok
10:09:47.0884 5496 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\drivers\iirsp.sys
10:09:47.0894 5496 iirsp - ok
10:09:47.0930 5496 IKEEXT (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll
10:09:47.0974 5496 IKEEXT - ok
10:09:48.0061 5496 IntcAzAudAddService (392d5c87f282e8e36df5154418a7bb20) C:\Windows\system32\drivers\RTKVHD64.sys
10:09:48.0164 5496 IntcAzAudAddService - ok
10:09:48.0223 5496 IntcDAud (fc727061c0f47c8059e88e05d5c8e381) C:\Windows\system32\DRIVERS\IntcDAud.sys
10:09:48.0258 5496 IntcDAud - ok
10:09:48.0290 5496 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
10:09:48.0299 5496 intelide - ok
10:09:48.0333 5496 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
10:09:48.0359 5496 intelppm - ok
10:09:48.0390 5496 IPBusEnum (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll
10:09:48.0430 5496 IPBusEnum - ok
10:09:48.0451 5496 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
10:09:48.0479 5496 IpFilterDriver - ok
10:09:48.0510 5496 iphlpsvc (a34a587fffd45fa649fba6d03784d257) C:\Windows\System32\iphlpsvc.dll
10:09:48.0559 5496 iphlpsvc - ok
10:09:48.0585 5496 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
10:09:48.0598 5496 IPMIDRV - ok
10:09:48.0609 5496 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
10:09:48.0660 5496 IPNAT - ok
10:09:48.0741 5496 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
10:09:48.0756 5496 IRENUM - ok
10:09:48.0765 5496 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
10:09:48.0781 5496 isapnp - ok
10:09:48.0833 5496 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
10:09:48.0858 5496 iScsiPrt - ok
10:09:48.0880 5496 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys
10:09:48.0889 5496 kbdclass - ok
10:09:48.0941 5496 kbdhid (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\DRIVERS\kbdhid.sys
10:09:48.0956 5496 kbdhid - ok
10:09:49.0000 5496 kbfiltr (e63ef8c3271d014f14e2469ce75fecb4) C:\Windows\system32\DRIVERS\kbfiltr.sys
10:09:49.0016 5496 kbfiltr - ok
10:09:49.0045 5496 KeyIso (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
10:09:49.0054 5496 KeyIso - ok
10:09:49.0076 5496 KSecDD (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys
10:09:49.0086 5496 KSecDD - ok
10:09:49.0101 5496 KSecPkg (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys
10:09:49.0123 5496 KSecPkg - ok
10:09:49.0162 5496 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
10:09:49.0209 5496 ksthunk - ok
10:09:49.0244 5496 KtmRm (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll
10:09:49.0284 5496 KtmRm - ok
10:09:49.0322 5496 L1C (a4a9ca24e54e81c6c3e469eaeb4b3f42) C:\Windows\system32\DRIVERS\L1C62x64.sys
10:09:49.0338 5496 L1C - ok
10:09:49.0389 5496 LanmanServer (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\system32\srvsvc.dll
10:09:49.0433 5496 LanmanServer - ok
10:09:49.0466 5496 LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll
10:09:49.0509 5496 LanmanWorkstation - ok
10:09:49.0568 5496 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
10:09:49.0617 5496 lltdio - ok
10:09:49.0651 5496 lltdsvc (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll
10:09:49.0699 5496 lltdsvc - ok
10:09:49.0723 5496 lmhosts (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll
10:09:49.0761 5496 lmhosts - ok
10:09:49.0825 5496 LMS (7f32d4c47a50e7223491e8fb9359907d) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
10:09:49.0835 5496 LMS - ok
10:09:49.0910 5496 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\drivers\lsi_fc.sys
10:09:49.0929 5496 LSI_FC - ok
10:09:49.0945 5496 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\drivers\lsi_sas.sys
10:09:49.0964 5496 LSI_SAS - ok
10:09:49.0973 5496 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\drivers\lsi_sas2.sys
10:09:49.0992 5496 LSI_SAS2 - ok
10:09:50.0013 5496 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\drivers\lsi_scsi.sys
10:09:50.0031 5496 LSI_SCSI - ok
10:09:50.0055 5496 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
10:09:50.0092 5496 luafv - ok
10:09:50.0131 5496 MBAMProtector - ok
10:09:50.0203 5496 MBAMService (056b19651bd7b7ce5f89a3ac46dbdc08) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
10:09:50.0223 5496 MBAMService - ok
10:09:50.0261 5496 Mcx2Svc (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll
10:09:50.0273 5496 Mcx2Svc - ok
10:09:50.0311 5496 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\drivers\megasas.sys
10:09:50.0339 5496 megasas - ok
10:09:50.0359 5496 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\drivers\MegaSR.sys
10:09:50.0384 5496 MegaSR - ok
10:09:50.0430 5496 MEIx64 (a6518dcc42f7a6e999bb3bea8fd87567) C:\Windows\system32\DRIVERS\HECIx64.sys
10:09:50.0438 5496 MEIx64 - ok
10:09:50.0473 5496 MMCSS (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
10:09:50.0507 5496 MMCSS - ok
10:09:50.0521 5496 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
10:09:50.0563 5496 Modem - ok
10:09:50.0589 5496 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
10:09:50.0614 5496 monitor - ok
10:09:50.0630 5496 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
10:09:50.0638 5496 mouclass - ok
10:09:50.0704 5496 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
10:09:50.0714 5496 mouhid - ok
10:09:50.0760 5496 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
10:09:50.0777 5496 mountmgr - ok
10:09:50.0816 5496 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
10:09:50.0830 5496 mpio - ok
10:09:50.0877 5496 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
10:09:50.0914 5496 mpsdrv - ok
10:09:50.0970 5496 MpsSvc (54ffc9c8898113ace189d4aa7199d2c1) C:\Windows\system32\mpssvc.dll
10:09:51.0020 5496 MpsSvc - ok
10:09:51.0060 5496 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
10:09:51.0087 5496 MRxDAV - ok
10:09:51.0129 5496 mrxsmb (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
10:09:51.0166 5496 mrxsmb - ok
10:09:51.0187 5496 mrxsmb10 (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
10:09:51.0217 5496 mrxsmb10 - ok
10:09:51.0247 5496 mrxsmb20 (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
10:09:51.0268 5496 mrxsmb20 - ok
10:09:51.0306 5496 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
10:09:51.0326 5496 msahci - ok
10:09:51.0343 5496 msdsm (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
10:09:51.0364 5496 msdsm - ok
10:09:51.0399 5496 MSDTC (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe
10:09:51.0425 5496 MSDTC - ok
10:09:51.0445 5496 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
10:09:51.0473 5496 Msfs - ok
10:09:51.0562 5496 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
10:09:51.0595 5496 mshidkmdf - ok
10:09:51.0605 5496 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
10:09:51.0622 5496 msisadrv - ok
10:09:51.0660 5496 MSiSCSI (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll
10:09:51.0706 5496 MSiSCSI - ok
10:09:51.0713 5496 msiserver - ok
10:09:51.0799 5496 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
10:09:51.0840 5496 MSKSSRV - ok
10:09:51.0876 5496 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
10:09:51.0910 5496 MSPCLOCK - ok
10:09:51.0951 5496 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
10:09:51.0986 5496 MSPQM - ok
10:09:52.0039 5496 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
10:09:52.0055 5496 MsRPC - ok
10:09:52.0067 5496 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\DRIVERS\mssmbios.sys
10:09:52.0074 5496 mssmbios - ok
10:09:52.0108 5496 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
10:09:52.0148 5496 MSTEE - ok
10:09:52.0168 5496 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\drivers\MTConfig.sys
10:09:52.0189 5496 MTConfig - ok
10:09:52.0204 5496 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
10:09:52.0222 5496 Mup - ok
10:09:52.0264 5496 napagent (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll
10:09:52.0311 5496 napagent - ok
10:09:52.0395 5496 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
10:09:52.0443 5496 NativeWifiP - ok
10:09:52.0492 5496 NDIS (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
10:09:52.0537 5496 NDIS - ok
10:09:52.0618 5496 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
10:09:52.0668 5496 NdisCap - ok
10:09:52.0697 5496 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
10:09:52.0724 5496 NdisTapi - ok
10:09:52.0759 5496 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
10:09:52.0787 5496 Ndisuio - ok
10:09:52.0832 5496 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
10:09:52.0881 5496 NdisWan - ok
10:09:52.0891 5496 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
10:09:52.0934 5496 NDProxy - ok
10:09:52.0951 5496 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
10:09:53.0027 5496 NetBIOS - ok
10:09:53.0099 5496 NetBT (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
10:09:53.0137 5496 NetBT - ok
10:09:53.0162 5496 Netlogon (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
10:09:53.0170 5496 Netlogon - ok
10:09:53.0223 5496 Netman (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll
10:09:53.0256 5496 Netman - ok
10:09:53.0335 5496 netprofm (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll
10:09:53.0382 5496 netprofm - ok
10:09:53.0445 5496 NetTcpPortSharing (3e5a36127e201ddf663176b66828fafe) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
10:09:53.0454 5496 NetTcpPortSharing - ok
10:09:53.0498 5496 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\drivers\nfrd960.sys
10:09:53.0524 5496 nfrd960 - ok
10:09:53.0557 5496 NlaSvc (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll
10:09:53.0592 5496 NlaSvc - ok
10:09:53.0602 5496 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
10:09:53.0639 5496 Npfs - ok
10:09:53.0667 5496 nsi (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll
10:09:53.0712 5496 nsi - ok
10:09:53.0721 5496 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
10:09:53.0749 5496 nsiproxy - ok
10:09:53.0836 5496 Ntfs (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
10:09:53.0899 5496 Ntfs - ok
10:09:54.0004 5496 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
10:09:54.0050 5496 Null - ok
10:09:54.0311 5496 nvlddmkm (7328528daf9b8a486e16595a35043db0) C:\Windows\system32\DRIVERS\nvlddmkm.sys
10:09:54.0670 5496 nvlddmkm - ok
10:09:54.0741 5496 nvpciflt (8ae5a124f3b65c3ec531d251a3e9c87f) C:\Windows\system32\DRIVERS\nvpciflt.sys
10:09:54.0757 5496 nvpciflt - ok
10:09:54.0792 5496 nvraid (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
10:09:54.0813 5496 nvraid - ok
10:09:54.0844 5496 nvstor (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
10:09:54.0876 5496 nvstor - ok
10:09:54.0925 5496 NVSvc (cea3416907c17bb6623d9cb1e015b3c4) C:\Windows\system32\nvvsvc.exe
10:09:54.0949 5496 NVSvc - ok
10:09:55.0011 5496 nvUpdatusService (741688e5a65cc43567bcc329ae130075) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
10:09:55.0074 5496 nvUpdatusService - ok
10:09:55.0132 5496 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
10:09:55.0151 5496 nv_agp - ok
10:09:55.0226 5496 odserv (785f487a64950f3cb8e9f16253ba3b7b) C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
10:09:55.0244 5496 odserv - ok
10:09:55.0268 5496 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
10:09:55.0302 5496 ohci1394 - ok
10:09:55.0330 5496 ose (5a432a042dae460abe7199b758e8606c) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
10:09:55.0342 5496 ose - ok
10:09:55.0397 5496 p2pimsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
10:09:55.0433 5496 p2pimsvc - ok
10:09:55.0457 5496 p2psvc (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll
10:09:55.0475 5496 p2psvc - ok
10:09:55.0527 5496 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\drivers\parport.sys
10:09:55.0556 5496 Parport - ok
10:09:55.0579 5496 partmgr (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys
10:09:55.0595 5496 partmgr - ok
10:09:55.0619 5496 PcaSvc (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll
10:09:55.0645 5496 PcaSvc - ok
10:09:55.0670 5496 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
10:09:55.0700 5496 pci - ok
10:09:55.0709 5496 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
10:09:55.0726 5496 pciide - ok
10:09:55.0758 5496 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\drivers\pcmcia.sys
10:09:55.0780 5496 pcmcia - ok
10:09:55.0793 5496 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
10:09:55.0810 5496 pcw - ok
10:09:55.0855 5496 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
10:09:55.0916 5496 PEAUTH - ok
10:09:55.0976 5496 PeerDistSvc (b9b0a4299dd2d76a4243f75fd54dc680) C:\Windows\system32\peerdistsvc.dll
10:09:56.0030 5496 PeerDistSvc - ok
10:09:56.0084 5496 PerfHost (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe
10:09:56.0102 5496 PerfHost - ok
10:09:56.0182 5496 pla (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll
10:09:56.0247 5496 pla - ok
10:09:56.0282 5496 PlugPlay (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll
10:09:56.0315 5496 PlugPlay - ok
10:09:56.0347 5496 PNRPAutoReg (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll
10:09:56.0366 5496 PNRPAutoReg - ok
10:09:56.0396 5496 PNRPsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
10:09:56.0407 5496 PNRPsvc - ok
10:09:56.0445 5496 PolicyAgent (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll
10:09:56.0486 5496 PolicyAgent - ok
10:09:56.0523 5496 Power (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll
10:09:56.0566 5496 Power - ok
10:09:56.0614 5496 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
10:09:56.0678 5496 PptpMiniport - ok
10:09:56.0710 5496 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\drivers\processr.sys
10:09:56.0739 5496 Processor - ok
10:09:56.0772 5496 ProfSvc (5c78838b4d166d1a27db3a8a820c799a) C:\Windows\system32\profsvc.dll
10:09:56.0819 5496 ProfSvc - ok
10:09:56.0849 5496 ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
10:09:56.0858 5496 ProtectedStorage - ok
10:09:56.0907 5496 Psched (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
10:09:56.0945 5496 Psched - ok
10:09:57.0005 5496 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\drivers\ql2300.sys
10:09:57.0057 5496 ql2300 - ok
10:09:57.0068 5496 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\drivers\ql40xx.sys
10:09:57.0079 5496 ql40xx - ok
10:09:57.0113 5496 QWAVE (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll
10:09:57.0132 5496 QWAVE - ok
10:09:57.0141 5496 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
10:09:57.0174 5496 QWAVEdrv - ok
10:09:57.0217 5496 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
10:09:57.0265 5496 RasAcd - ok
10:09:57.0308 5496 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
10:09:57.0336 5496 RasAgileVpn - ok
10:09:57.0357 5496 RasAuto (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll
10:09:57.0394 5496 RasAuto - ok
10:09:57.0413 5496 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
10:09:57.0476 5496 Rasl2tp - ok
10:09:57.0519 5496 RasMan (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll
10:09:57.0554 5496 RasMan - ok
10:09:57.0592 5496 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
10:09:57.0630 5496 RasPppoe - ok
10:09:57.0657 5496 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
10:09:57.0701 5496 RasSstp - ok
10:09:57.0727 5496 rdbss (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
10:09:57.0770 5496 rdbss - ok
10:09:57.0779 5496 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
10:09:57.0845 5496 rdpbus - ok
10:09:57.0933 5496 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
10:09:57.0974 5496 RDPCDD - ok
10:09:58.0007 5496 RDPDR (1b6163c503398b23ff8b939c67747683) C:\Windows\system32\drivers\rdpdr.sys
10:09:58.0044 5496 RDPDR - ok
10:09:58.0070 5496 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
10:09:58.0114 5496 RDPENCDD - ok
10:09:58.0220 5496 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
10:09:58.0246 5496 RDPREFMP - ok
10:09:58.0289 5496 RDPWD (6d76e6433574b058adcb0c50df834492) C:\Windows\system32\drivers\RDPWD.sys
10:09:58.0337 5496 RDPWD - ok
10:09:58.0360 5496 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
10:09:58.0374 5496 rdyboost - ok
10:09:58.0436 5496 RemoteAccess (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll
10:09:58.0471 5496 RemoteAccess - ok
10:09:58.0503 5496 RemoteRegistry (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll
10:09:58.0541 5496 RemoteRegistry - ok
10:09:58.0595 5496 RFCOMM (3dd798846e2c28102b922c56e71b7932) C:\Windows\system32\DRIVERS\rfcomm.sys
10:09:58.0631 5496 RFCOMM - ok
10:09:58.0641 5496 RpcEptMapper (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll
10:09:58.0681 5496 RpcEptMapper - ok
10:09:58.0746 5496 RpcLocator (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe
10:09:58.0771 5496 RpcLocator - ok
10:09:58.0786 5496 RpcSs (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
10:09:58.0817 5496 RpcSs - ok
10:09:58.0872 5496 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
10:09:58.0909 5496 rspndr - ok
10:09:58.0940 5496 s3cap (e60c0a09f997826c7627b244195ab581) C:\Windows\system32\drivers\vms3cap.sys
10:09:58.0963 5496 s3cap - ok
10:09:58.0990 5496 SamSs (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
10:09:58.0998 5496 SamSs - ok
10:09:59.0009 5496 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
10:09:59.0027 5496 sbp2port - ok
10:09:59.0049 5496 SCardSvr (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll
10:09:59.0082 5496 SCardSvr - ok
10:09:59.0103 5496 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
10:09:59.0148 5496 scfilter - ok
10:09:59.0185 5496 Schedule (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll
10:09:59.0245 5496 Schedule - ok
10:09:59.0269 5496 SCPolicySvc (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
10:09:59.0294 5496 SCPolicySvc - ok
10:09:59.0313 5496 SDRSVC (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll
10:09:59.0349 5496 SDRSVC - ok
10:09:59.0400 5496 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
10:09:59.0442 5496 secdrv - ok
10:09:59.0465 5496 seclogon (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll
10:09:59.0493 5496 seclogon - ok
10:09:59.0522 5496 SENS (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll
10:09:59.0560 5496 SENS - ok
10:09:59.0579 5496 SensrSvc (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll
10:09:59.0637 5496 SensrSvc - ok
10:09:59.0676 5496 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\drivers\serenum.sys
10:09:59.0704 5496 Serenum - ok
10:09:59.0730 5496 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\drivers\serial.sys
10:09:59.0784 5496 Serial - ok
10:09:59.0799 5496 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\drivers\sermouse.sys
10:09:59.0832 5496 sermouse - ok
10:09:59.0869 5496 SessionEnv (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll
10:09:59.0913 5496 SessionEnv - ok
10:09:59.0921 5496 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
10:09:59.0981 5496 sffdisk - ok
10:10:00.0035 5496 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
10:10:00.0068 5496 sffp_mmc - ok
10:10:00.0089 5496 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
10:10:00.0117 5496 sffp_sd - ok
10:10:00.0173 5496 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\drivers\sfloppy.sys
10:10:00.0198 5496 sfloppy - ok
10:10:00.0268 5496 SharedAccess (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll
10:10:00.0315 5496 SharedAccess - ok
10:10:00.0354 5496 ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll
10:10:00.0398 5496 ShellHWDetection - ok
10:10:00.0488 5496 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\drivers\SiSRaid2.sys
10:10:00.0514 5496 SiSRaid2 - ok
10:10:00.0523 5496 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\drivers\sisraid4.sys
10:10:00.0540 5496 SiSRaid4 - ok
10:10:00.0618 5496 SkypeUpdate (db0405d9aad62f0762e0876ac142b7e1) C:\Program Files (x86)\Skype\Updater\Updater.exe
10:10:00.0636 5496 SkypeUpdate - ok
10:10:00.0673 5496 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
10:10:00.0712 5496 Smb - ok
10:10:00.0757 5496 SNMPTRAP (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe
10:10:00.0777 5496 SNMPTRAP - ok
10:10:00.0818 5496 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
10:10:00.0835 5496 spldr - ok
10:10:00.0856 5496 Spooler (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe
10:10:00.0892 5496 Spooler - ok
10:10:00.0961 5496 sppsvc (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe
10:10:01.0110 5496 sppsvc - ok
10:10:01.0190 5496 sppuinotify (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll
10:10:01.0219 5496 sppuinotify - ok
10:10:01.0265 5496 srv (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
10:10:01.0327 5496 srv - ok
10:10:01.0384 5496 srv2 (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
10:10:01.0435 5496 srv2 - ok
10:10:01.0451 5496 srvnet (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
10:10:01.0462 5496 srvnet - ok
10:10:01.0521 5496 SSDPSRV (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll
10:10:01.0558 5496 SSDPSRV - ok
10:10:01.0568 5496 SstpSvc (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll
10:10:01.0597 5496 SstpSvc - ok
10:10:01.0656 5496 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\drivers\stexstor.sys
10:10:01.0671 5496 stexstor - ok
10:10:01.0717 5496 stisvc (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll
10:10:01.0736 5496 stisvc - ok
10:10:01.0766 5496 storflt (7785dc213270d2fc066538daf94087e7) C:\Windows\system32\drivers\vmstorfl.sys
10:10:01.0776 5496 storflt - ok
10:10:01.0801 5496 StorSvc (c40841817ef57d491f22eb103da587cc) C:\Windows\system32\storsvc.dll
10:10:01.0828 5496 StorSvc - ok
10:10:01.0847 5496 storvsc (d34e4943d5ac096c8edeebfd80d76e23) C:\Windows\system32\drivers\storvsc.sys
10:10:01.0864 5496 storvsc - ok
10:10:01.0909 5496 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\DRIVERS\swenum.sys
10:10:01.0927 5496 swenum - ok
10:10:02.0040 5496 SwitchBoard (f577910a133a592234ebaad3f3afa258) C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
10:10:02.0072 5496 SwitchBoard ( UnsignedFile.Multi.Generic ) - warning
10:10:02.0072 5496 SwitchBoard - detected UnsignedFile.Multi.Generic (1)
10:10:02.0144 5496 swprv (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll
10:10:02.0183 5496 swprv - ok
10:10:02.0241 5496 SynTP (bc642d540aedf9a253c74d10c848ebd2) C:\Windows\system32\DRIVERS\SynTP.sys
10:10:02.0293 5496 SynTP - ok
10:10:02.0351 5496 SysMain (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll
10:10:02.0430 5496 SysMain - ok
10:10:02.0440 5496 TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll
10:10:02.0455 5496 TabletInputService - ok
10:10:02.0483 5496 TapiSrv (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll
10:10:02.0531 5496 TapiSrv - ok
10:10:02.0550 5496 TBS (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll
10:10:02.0579 5496 TBS - ok
10:10:02.0704 5496 Tcpip (fc62769e7bff2896035aeed399108162) C:\Windows\system32\drivers\tcpip.sys
10:10:02.0759 5496 Tcpip - ok
10:10:02.0824 5496 TCPIP6 (fc62769e7bff2896035aeed399108162) C:\Windows\system32\DRIVERS\tcpip.sys
10:10:02.0853 5496 TCPIP6 - ok
10:10:02.0908 5496 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
10:10:02.0955 5496 tcpipreg - ok
10:10:02.0978 5496 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
10:10:03.0010 5496 TDPIPE - ok
10:10:03.0046 5496 TDTCP (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys
10:10:03.0071 5496 TDTCP - ok
10:10:03.0103 5496 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
10:10:03.0149 5496 tdx - ok
10:10:03.0159 5496 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\DRIVERS\termdd.sys
10:10:03.0176 5496 TermDD - ok
10:10:03.0246 5496 TermService (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll
10:10:03.0300 5496 TermService - ok
10:10:03.0321 5496 Themes (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll
10:10:03.0336 5496 Themes - ok
10:10:03.0369 5496 THREADORDER (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
10:10:03.0396 5496 THREADORDER - ok
10:10:03.0413 5496 TrkWks (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll
10:10:03.0453 5496 TrkWks - ok
10:10:03.0496 5496 TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe
10:10:03.0527 5496 TrustedInstaller - ok
10:10:03.0587 5496 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
10:10:03.0627 5496 tssecsrv - ok
10:10:03.0663 5496 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
10:10:03.0712 5496 TsUsbFlt - ok
10:10:03.0731 5496 TsUsbGD (9cc2ccae8a84820eaecb886d477cbcb8) C:\Windows\system32\drivers\TsUsbGD.sys
10:10:03.0741 5496 TsUsbGD - ok
10:10:03.0775 5496 tunnel (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
10:10:03.0818 5496 tunnel - ok
10:10:03.0865 5496 TurboB (fd24f98d2898be093fe926604be7db99) C:\Windows\system32\DRIVERS\TurboB.sys
10:10:03.0873 5496 TurboB - ok
10:10:03.0929 5496 TurboBoost (600b406a04d90f577fea8a88d7379f08) C:\Program Files\Intel\TurboBoost\TurboBoost.exe
10:10:03.0940 5496 TurboBoost - ok
10:10:03.0965 5496 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\drivers\uagp35.sys
10:10:03.0984 5496 uagp35 - ok
10:10:04.0005 5496 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
10:10:04.0050 5496 udfs - ok
10:10:04.0083 5496 UI0Detect (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe
10:10:04.0107 5496 UI0Detect - ok
10:10:04.0139 5496 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
10:10:04.0157 5496 uliagpkx - ok
10:10:04.0181 5496 umbus (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\DRIVERS\umbus.sys
10:10:04.0207 5496 umbus - ok
10:10:04.0217 5496 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\drivers\umpass.sys
10:10:04.0245 5496 UmPass - ok
10:10:04.0279 5496 UmRdpService (a293dcd756d04d8492a750d03b9a297c) C:\Windows\System32\umrdp.dll
10:10:04.0302 5496 UmRdpService - ok
10:10:04.0423 5496 UNS (2c16648a12999ae69a9ebf41974b0ba2) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
10:10:04.0503 5496 UNS - ok
10:10:04.0570 5496 upnphost (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll
10:10:04.0607 5496 upnphost - ok
10:10:04.0655 5496 usbccgp (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys
10:10:04.0684 5496 usbccgp - ok
10:10:04.0726 5496 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
10:10:04.0740 5496 usbcir - ok
10:10:04.0755 5496 usbehci (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\drivers\usbehci.sys
10:10:04.0785 5496 usbehci - ok
10:10:04.0817 5496 usbhub (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
10:10:04.0854 5496 usbhub - ok
10:10:04.0887 5496 usbohci (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\drivers\usbohci.sys
10:10:04.0910 5496 usbohci - ok
10:10:04.0933 5496 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\drivers\usbprint.sys
10:10:04.0962 5496 usbprint - ok
10:10:04.0992 5496 USBSTOR (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
10:10:05.0050 5496 USBSTOR - ok
10:10:05.0081 5496 usbuhci (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys
10:10:05.0098 5496 usbuhci - ok
10:10:05.0144 5496 usbvideo (454800c2bc7f3927ce030141ee4f4c50) C:\Windows\system32\Drivers\usbvideo.sys
10:10:05.0183 5496 usbvideo - ok
10:10:05.0214 5496 UxSms (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll
10:10:05.0249 5496 UxSms - ok
10:10:05.0279 5496 VaultSvc (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
10:10:05.0287 5496 VaultSvc - ok
10:10:05.0334 5496 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
10:10:05.0361 5496 vdrvroot - ok
10:10:05.0392 5496 vds (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe
10:10:05.0430 5496 vds - ok
10:10:05.0453 5496 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
10:10:05.0466 5496 vga - ok
10:10:05.0475 5496 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
10:10:05.0523 5496 VgaSave - ok
10:10:05.0546 5496 vhdmp (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
10:10:05.0568 5496 vhdmp - ok
10:10:05.0577 5496 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
10:10:05.0594 5496 viaide - ok
10:10:05.0640 5496 vmbus (86ea3e79ae350fea5331a1303054005f) C:\Windows\system32\drivers\vmbus.sys
10:10:05.0685 5496 vmbus - ok
10:10:05.0717 5496 VMBusHID (7de90b48f210d29649380545db45a187) C:\Windows\system32\drivers\VMBusHID.sys
10:10:05.0747 5496 VMBusHID - ok
10:10:05.0758 5496 volmgr (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
10:10:05.0784 5496 volmgr - ok
10:10:05.0800 5496 volmgrx (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
10:10:05.0813 5496 volmgrx - ok
10:10:05.0872 5496 volsnap (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
10:10:05.0899 5496 volsnap - ok
10:10:05.0920 5496 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\drivers\vsmraid.sys
10:10:05.0942 5496 vsmraid - ok
10:10:05.0994 5496 VSS (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe
10:10:06.0071 5496 VSS - ok
10:10:06.0114 5496 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys
10:10:06.0144 5496 vwifibus - ok
10:10:06.0161 5496 vwififlt (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys
10:10:06.0188 5496 vwififlt - ok
10:10:06.0209 5496 vwifimp (6a638fc4bfddc4d9b186c28c91bd1a01) C:\Windows\system32\DRIVERS\vwifimp.sys
10:10:06.0262 5496 vwifimp - ok
10:10:06.0323 5496 W32Time (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll
10:10:06.0358 5496 W32Time - ok
10:10:06.0601 5496 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\drivers\wacompen.sys
10:10:06.0619 5496 WacomPen - ok
10:10:06.0665 5496 WANARP (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
10:10:06.0704 5496 WANARP - ok
10:10:06.0712 5496 Wanarpv6 (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
10:10:06.0738 5496 Wanarpv6 - ok
10:10:06.0800 5496 WatAdminSvc (3cec96de223e49eaae3651fcf8faea6c) C:\Windows\system32\Wat\WatAdminSvc.exe
10:10:06.0833 5496 WatAdminSvc - ok
10:10:06.0887 5496 wbengine (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe
10:10:06.0967 5496 wbengine - ok
10:10:06.0994 5496 WbioSrvc (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll
10:10:07.0012 5496 WbioSrvc - ok
10:10:07.0025 5496 wcncsvc (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll
10:10:07.0056 5496 wcncsvc - ok
10:10:07.0102 5496 WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll
10:10:07.0126 5496 WcsPlugInService - ok
10:10:07.0159 5496 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\drivers\wd.sys
10:10:07.0168 5496 Wd - ok
10:10:07.0191 5496 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
10:10:07.0213 5496 Wdf01000 - ok
10:10:07.0244 5496 WdiServiceHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
10:10:07.0307 5496 WdiServiceHost - ok
10:10:07.0311 5496 WdiSystemHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
10:10:07.0326 5496 WdiSystemHost - ok
10:10:07.0431 5496 WebClient (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll
10:10:07.0464 5496 WebClient - ok
10:10:07.0500 5496 Wecsvc (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll
10:10:07.0543 5496 Wecsvc - ok
10:10:07.0575 5496 wercplsupport (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll
10:10:07.0604 5496 wercplsupport - ok
10:10:07.0641 5496 WerSvc (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll
10:10:07.0669 5496 WerSvc - ok
10:10:07.0716 5496 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
10:10:07.0756 5496 WfpLwf - ok
10:10:07.0788 5496 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
10:10:07.0804 5496 WIMMount - ok
10:10:07.0818 5496 WinDefend - ok
10:10:07.0822 5496 WinHttpAutoProxySvc - ok
10:10:07.0874 5496 Winmgmt (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll
10:10:07.0921 5496 Winmgmt - ok
10:10:07.0995 5496 WinRM (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll
10:10:08.0073 5496 WinRM - ok
10:10:08.0117 5496 Wlansvc (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll
10:10:08.0153 5496 Wlansvc - ok
10:10:08.0200 5496 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\DRIVERS\wmiacpi.sys
10:10:08.0218 5496 WmiAcpi - ok
10:10:08.0259 5496 wmiApSrv (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe
10:10:08.0282 5496 wmiApSrv - ok
10:10:08.0303 5496 WMPNetworkSvc - ok
10:10:08.0335 5496 WPCSvc (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll
10:10:08.0393 5496 WPCSvc - ok
10:10:08.0428 5496 WPDBusEnum (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll
10:10:08.0448 5496 WPDBusEnum - ok
10:10:08.0497 5496 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
10:10:08.0533 5496 ws2ifsl - ok
10:10:08.0585 5496 wscsvc (e8b1fe6669397d1772d8196df0e57a9e) C:\Windows\System32\wscsvc.dll
10:10:08.0612 5496 wscsvc - ok
10:10:08.0620 5496 WSearch - ok
10:10:08.0690 5496 wuauserv (9df12edbc698b0bc353b3ef84861e430) C:\Windows\system32\wuaueng.dll
10:10:08.0782 5496 wuauserv - ok
10:10:08.0827 5496 WudfPf (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
10:10:08.0870 5496 WudfPf - ok
10:10:08.0895 5496 WUDFRd (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
10:10:08.0933 5496 WUDFRd - ok
10:10:08.0966 5496 wudfsvc (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll
10:10:08.0995 5496 wudfsvc - ok
10:10:09.0021 5496 WwanSvc (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll
10:10:09.0049 5496 WwanSvc - ok
10:10:09.0086 5496 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
10:10:09.0253 5496 \Device\Harddisk0\DR0 - ok
10:10:09.0256 5496 Boot (0x1200) (224a771ea111e65fa2afb62f32bc1529) \Device\Harddisk0\DR0\Partition0
10:10:09.0257 5496 \Device\Harddisk0\DR0\Partition0 - ok
10:10:09.0363 5496 Boot (0x1200) (47ab609eae64c748bffeb16ae43c6cea) \Device\Harddisk0\DR0\Partition1
10:10:09.0365 5496 \Device\Harddisk0\DR0\Partition1 - ok
10:10:09.0380 5496 Boot (0x1200) (1480f42c2bbf19755237d35c5a7e4e7b) \Device\Harddisk0\DR0\Partition2
10:10:09.0383 5496 \Device\Harddisk0\DR0\Partition2 - ok
10:10:09.0399 5496 Boot (0x1200) (ccfc4f71bc49a136f2328315d1692dc6) \Device\Harddisk0\DR0\Partition3
10:10:09.0413 5496 \Device\Harddisk0\DR0\Partition3 - ok
10:10:09.0415 5496 ============================================================
10:10:09.0415 5496 Scan finished
10:10:09.0415 5496 ============================================================
10:10:09.0426 4504 Detected object count: 1
10:10:09.0426 4504 Actual detected object count: 1
10:10:21.0190 4504 SwitchBoard ( UnsignedFile.Multi.Generic ) - skipped by user
10:10:21.0190 4504 SwitchBoard ( UnsignedFile.Multi.Generic ) - User select action: Skip
10:12:27.0719 3244 Deinitialize success

rendie
Návštěvník
Návštěvník
Příspěvky: 11
Registrován: 02 Dub 2012 18:46

Re: Win32/TrojanDownloader.Mebload.AR

#3 Příspěvek od rendie »

tak mi to napsalo toto: cannot create file c:\Users\Renáta\Desktop\cmd.bat a zda se, ze se na tom zakousnul :(

Jinak ESET hlasi toto: 2.4.2012 19:23:46 Kontrola při startu soubor Operační paměť » firefox.exe(5844) pravděpodobně varianta infiltrace Win32/TrojanDownloader.Mebload.AR trojský kůň nelze léčit (uz ho nalezl minuly tyden v nedeli a od te doby jsem se ho snazila nejak zbavit...)

rendie
Návštěvník
Návštěvník
Příspěvky: 11
Registrován: 02 Dub 2012 18:46

Re: Win32/TrojanDownloader.Mebload.AR

#4 Příspěvek od rendie »

Ha, tak ocividne velmi pomohlo, kdyz jsem mu zavrela Mozillu :)
Přílohy
OTL.zip
(106.08 KiB) Staženo 40 x

rendie
Návštěvník
Návštěvník
Příspěvky: 11
Registrován: 02 Dub 2012 18:46

Re: Win32/TrojanDownloader.Mebload.AR

#5 Příspěvek od rendie »

Ha, ono to chce vytisknout....musim to nechat na zitra a pokusit se to vytisknout v praci, doma bohuzel nemam tiskarnu :(
zatim diky moc za pomoc! urcite to sem nahodim zitra vecer.

rendie
Návštěvník
Návštěvník
Příspěvky: 11
Registrován: 02 Dub 2012 18:46

Re: Win32/TrojanDownloader.Mebload.AR

#6 Příspěvek od rendie »

Povedlo se mi zprovoznit velmi starou herku tiskarnu :)
Takze log z Combofixu:

ComboFix 12-04-04.02 - Renáta 04.04.2012 20:15:41.1.4 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.4001.2519 [GMT 2:00]
Spuštěný z: c:\users\Renßta\Desktop\ComboFix.exe
AV: ESET Smart Security 4.2 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
FW: ESET personal firewall *Enabled* {4FE52EC8-CB26-1113-0EFE-8842E2773BAA}
SP: ESET Smart Security 4.2 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Windows
c:\programdata\Windows\ccdxmmde.dat
c:\programdata\windows\drss.dat
c:\programdata\Windows\msseedir.dll
c:\programdata\Windows\xessmsxe.dat
c:\windows\AsPatch10430001.exe
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-03-04 do 2012-04-04 )))))))))))))))))))))))))))))))
.
.
2012-04-04 18:18 . 2012-04-04 18:18 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-04-04 18:05 . 2008-05-07 17:59 99840 ----a-w- c:\windows\system32\Spool\prtprocs\x64\HPZPPLHN.DLL
2012-04-04 05:57 . 2012-03-14 03:27 8669240 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{EB84ED3C-2043-41A9-9089-60CEC47E9D08}\mpengine.dll
2012-04-02 18:12 . 2012-04-02 18:55 512 ----a-w- C:\PhysicalMBR.bin
2012-04-02 17:43 . 2012-04-02 17:44 -------- d-----w- C:\rsit
2012-04-02 17:43 . 2012-04-02 17:43 -------- d-----w- c:\program files\trend micro
2012-04-01 08:38 . 2012-04-01 08:38 -------- d-----w- c:\program files\CCleaner
2012-03-31 20:30 . 2012-03-31 20:30 -------- d-----w- c:\programdata\Malwarebytes
2012-03-31 12:24 . 2012-03-31 20:26 -------- d-----w- c:\program files (x86)\Emsisoft Anti-Malware
2012-03-14 19:04 . 2011-11-19 15:20 5559152 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-03-14 19:04 . 2011-11-19 14:50 3968368 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2012-03-14 19:03 . 2011-11-19 14:50 3913584 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2012-03-14 19:02 . 2012-02-10 06:36 1544192 ----a-w- c:\windows\system32\DWrite.dll
2012-03-14 19:02 . 2012-02-10 05:38 1077248 ----a-w- c:\windows\SysWow64\DWrite.dll
2012-03-14 19:02 . 2012-02-03 04:34 3145728 ----a-w- c:\windows\system32\win32k.sys
2012-03-14 17:25 . 2012-02-17 06:38 1031680 ----a-w- c:\windows\system32\rdpcore.dll
2012-03-14 17:25 . 2012-02-17 05:34 826880 ----a-w- c:\windows\SysWow64\rdpcore.dll
2012-03-14 17:25 . 2012-02-17 04:58 210944 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-03-14 17:25 . 2012-02-17 04:57 23552 ----a-w- c:\windows\system32\drivers\tdtcp.sys
2012-03-14 17:25 . 2012-01-25 06:38 77312 ----a-w- c:\windows\system32\rdpwsx.dll
2012-03-14 17:25 . 2012-01-25 06:38 149504 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-03-14 17:25 . 2012-01-25 06:33 9216 ----a-w- c:\windows\system32\rdrmemptylst.exe
2012-03-11 12:43 . 2012-03-11 12:43 -------- d-----w- c:\program files (x86)\Common Files\Java
2012-03-11 12:42 . 2012-03-11 12:42 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll
2012-03-11 12:42 . 2012-03-11 12:42 -------- d-----w- c:\program files (x86)\Java
2012-03-10 15:31 . 2012-03-10 15:31 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help
2012-03-10 15:18 . 2012-03-10 15:18 -------- d-----w- c:\programdata\regid.1986-12.com.adobe
2012-03-10 15:12 . 2012-03-10 15:12 -------- d-----w- c:\program files (x86)\Adobe Media Player
2012-03-10 15:12 . 2012-03-10 15:15 -------- d-----w- c:\program files\Common Files\Adobe
2012-03-10 15:11 . 2012-03-10 15:11 -------- d-----w- c:\program files (x86)\Common Files\Adobe AIR
2012-03-10 14:35 . 2012-03-11 13:13 -------- d-----w- c:\program files (x86)\Common Files\Adobe
2012-03-10 13:40 . 2012-03-10 13:40 -------- d-----w- c:\program files\7-Zip
2012-03-10 13:35 . 2012-03-10 13:35 283200 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2012-03-10 13:35 . 2012-03-10 13:35 -------- d-----w- c:\program files (x86)\DAEMON Tools Lite
2012-03-10 13:34 . 2012-03-10 13:34 -------- d-----w- c:\programdata\DAEMON Tools Lite
2012-03-10 13:21 . 2012-03-10 13:29 -------- d-----w- c:\program files (x86)\SMPlayer
2012-03-10 13:15 . 2012-03-10 13:15 -------- d-----w- c:\program files (x86)\Common Files\Skype
2012-03-10 13:15 . 2012-03-11 07:22 -------- d-----w- c:\programdata\Skype
2012-03-10 13:15 . 2012-03-10 13:15 -------- d-----r- c:\program files (x86)\Skype
2012-03-10 13:10 . 2012-03-10 13:10 -------- d-----w- c:\program files (x86)\QIP 2012
2012-03-10 13:05 . 2011-10-07 09:49 2770944 ----a-w- c:\windows\system32\drivers\athrx.sys
2012-03-10 12:41 . 2012-03-10 12:41 -------- d-----w- c:\windows\SysWow64\Wat
2012-03-10 12:41 . 2012-03-10 12:41 -------- d-----w- c:\windows\system32\Wat
2012-03-10 10:58 . 2012-02-24 06:57 545 ----a-w- c:\windows\UC.PIF
2012-03-10 10:58 . 2012-02-24 06:57 545 ----a-w- c:\windows\RAR.PIF
2012-03-10 10:58 . 2012-02-24 06:57 545 ----a-w- c:\windows\NOCLOSE.PIF
2012-03-10 10:58 . 2012-02-24 06:57 545 ----a-w- c:\windows\LHA.PIF
2012-03-10 10:58 . 2012-02-24 06:57 545 ----a-w- c:\windows\ARJ.PIF
2012-03-10 10:58 . 2012-03-10 10:58 -------- d-----w- c:\program files (x86)\totalcmd
2012-03-10 10:46 . 2012-03-10 10:46 -------- d-----w- c:\program files\ESET
2012-03-10 10:37 . 2011-02-19 12:03 46080 ----a-w- c:\windows\system32\atmlib.dll
2012-03-10 10:36 . 2011-02-05 17:10 642944 ----a-w- c:\windows\system32\winload.efi
2012-03-10 10:36 . 2011-02-05 17:10 20352 ----a-w- c:\windows\system32\kdusb.dll
2012-03-10 10:36 . 2011-02-05 17:10 19328 ----a-w- c:\windows\system32\kd1394.dll
2012-03-10 10:36 . 2011-02-05 17:10 17792 ----a-w- c:\windows\system32\kdcom.dll
2012-03-10 10:36 . 2011-02-05 17:06 605552 ----a-w- c:\windows\system32\winload.exe
2012-03-10 10:36 . 2011-02-05 17:06 566208 ----a-w- c:\windows\system32\winresume.efi
2012-03-10 10:36 . 2011-02-05 17:06 518672 ----a-w- c:\windows\system32\winresume.exe
2012-03-10 10:33 . 2011-11-19 14:58 77312 ----a-w- c:\windows\system32\packager.dll
2012-03-10 10:33 . 2011-11-19 14:01 67072 ----a-w- c:\windows\SysWow64\packager.dll
2012-03-10 10:30 . 2012-03-11 14:09 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-03-10 10:30 . 2012-03-10 10:30 -------- d-----w- c:\windows\SysWow64\Macromed
2012-03-10 10:30 . 2012-03-10 10:30 -------- d-----w- c:\windows\system32\Macromed
2012-03-10 10:06 . 2012-03-10 12:09 -------- d-----w- c:\program files (x86)\Microsoft Works
2012-03-10 10:06 . 2012-03-10 15:22 -------- d-----w- c:\program files (x86)\Microsoft.NET
2012-03-10 10:06 . 2012-03-10 10:06 -------- d-----w- c:\windows\PCHEALTH
2012-03-10 10:04 . 2012-03-14 19:35 -------- d-----w- c:\programdata\Microsoft Help
2012-03-10 10:03 . 2012-03-10 10:03 -------- d-----r- C:\MSOCache
2012-03-10 09:49 . 2012-03-10 09:49 -------- d-----w- c:\programdata\ASUS
2012-03-10 09:44 . 2012-03-10 09:44 -------- d-----w- c:\program files\Intel
2012-03-10 09:43 . 2012-03-10 09:43 -------- d-----w- c:\programdata\USBChargerPlus
2012-03-10 09:43 . 2012-04-04 16:45 45056 ----a-w- c:\windows\system32\acovcnt.exe
2012-03-10 09:42 . 2012-03-10 09:42 -------- dc----w- c:\windows\system32\DRVSTORE
2012-03-10 09:42 . 2011-02-25 16:42 16768 ----a-w- c:\windows\system32\drivers\AiCharger.sys
2012-03-10 09:39 . 2010-08-03 14:30 196224 ----a-w- c:\program files\Windows Sidebar\Shared Gadgets\P4GUpdate.Gadget\P4GUpdate.dll
2012-03-10 09:39 . 2012-03-10 09:41 -------- d-----w- c:\program files\P4G
2012-03-10 09:39 . 2012-03-10 09:39 -------- d-----w- c:\programdata\P4G
2012-03-10 09:39 . 2012-03-10 09:39 -------- d-----w- c:\program files\ASUS
2012-03-10 09:39 . 2011-01-25 13:11 379520 ----a-w- c:\windows\system32\FBAgent.exe
2012-03-10 09:38 . 2006-10-09 18:07 183296 ----a-w- c:\windows\SysWow64\ACEngSvr.exe
2012-03-10 09:37 . 2009-07-20 09:29 15416 ----a-w- c:\windows\system32\drivers\kbfiltr.sys
2012-03-10 09:36 . 2012-03-10 09:36 -------- d-----w- c:\programdata\AmUStor
2012-03-10 09:36 . 2012-03-10 09:37 -------- d-----w- c:\program files (x86)\AmIcoSingLun
2012-03-10 09:35 . 2012-03-10 09:35 -------- d-----w- c:\program files (x86)\Common Files\Atheros
2012-03-10 09:35 . 2012-03-10 09:35 -------- d-----w- c:\program files (x86)\Bluetooth Suite
2012-03-10 09:31 . 2012-03-10 09:31 -------- d-----w- c:\program files (x86)\Atheros
2012-03-10 09:31 . 2010-07-08 01:03 2228736 ----a-w- c:\windows\system32\athrx.sys
2012-03-10 09:29 . 2012-03-10 09:38 -------- d-----w- c:\programdata\Atheros
2012-03-10 09:28 . 2010-08-24 09:55 76912 ----a-w- c:\windows\system32\drivers\L1C62x64.sys
2012-03-10 09:28 . 2012-03-10 09:28 -------- d-----w- c:\program files\Synaptics
2012-03-10 09:28 . 2010-10-08 10:32 1395248 ----a-w- c:\windows\system32\drivers\SynTP.sys
2012-03-10 09:28 . 2010-10-08 10:29 107816 ----a-w- c:\windows\SysWow64\SynTPCOM.dll
2012-03-10 09:28 . 2010-10-08 10:29 148264 ----a-w- c:\windows\system32\SynTPCo4.dll
2012-03-10 09:28 . 2010-10-08 10:29 221480 ----a-w- c:\windows\system32\SynTPAPI.dll
2012-03-10 09:28 . 2010-10-08 10:29 273704 ----a-w- c:\windows\system32\SynCtrl.dll
2012-03-10 09:28 . 2010-10-08 10:29 218408 ----a-w- c:\windows\SysWow64\SynCtrl.dll
2012-03-10 09:28 . 2010-10-08 10:29 173352 ----a-w- c:\windows\SysWow64\SynCOM.dll
2012-03-10 09:27 . 2012-03-10 09:27 -------- d-----w- c:\program files\Fresco Logic Inc
2012-03-10 09:23 . 2010-12-20 17:08 8192 ----a-w- c:\windows\system32\drivers\IntelMEFWVer.dll
2012-03-10 09:23 . 2012-03-10 09:23 -------- d-----w- c:\program files (x86)\Common Files\postureAgent
2012-03-10 09:23 . 2010-10-19 15:34 56344 ----a-w- c:\windows\system32\drivers\HECIx64.sys
2012-03-10 09:23 . 2012-03-10 09:44 -------- d--h--w- c:\program files (x86)\InstallShield Installation Information
2012-03-10 09:23 . 2012-03-10 09:24 -------- d-----w- c:\windows\SysWow64\NV
2012-03-10 09:23 . 2012-03-10 09:24 -------- d-----w- c:\windows\system32\NV
2012-03-10 09:21 . 2012-03-10 12:46 -------- d-----w- c:\users\UpdatusUser
2012-03-10 09:21 . 2012-03-10 09:23 -------- d-----w- c:\programdata\NVIDIA
2012-03-10 09:19 . 2012-03-15 21:19 -------- d-sh--w- c:\windows\Installer
2012-03-10 09:19 . 2012-03-10 09:19 -------- d-----w- c:\programdata\NVIDIA Corporation
2012-03-10 09:19 . 2012-03-10 09:21 -------- d-----w- c:\program files (x86)\NVIDIA Corporation
2012-03-10 09:19 . 2011-03-08 05:35 1614440 ----a-w- c:\windows\system32\nvdispco642090.dll
2012-03-10 09:19 . 2011-03-08 05:35 1359976 ----a-w- c:\windows\system32\nvgenco642040.dll
2012-03-10 09:16 . 2011-03-08 05:35 10059368 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2012-03-10 09:16 . 2011-03-08 05:35 3182184 ----a-w- c:\windows\system32\nvcuvid.dll
2012-03-10 09:16 . 2011-03-08 05:35 2954856 ----a-w- c:\windows\SysWow64\nvcuvid.dll
2012-03-10 09:16 . 2011-03-08 05:35 2871400 ----a-w- c:\windows\system32\nvcuvenc.dll
2012-03-10 09:16 . 2011-03-08 05:35 2579560 ----a-w- c:\windows\SysWow64\nvcuvenc.dll
2012-03-10 09:16 . 2011-03-08 05:35 4936808 ----a-w- c:\windows\SysWow64\nvcuda.dll
2012-03-10 09:16 . 2011-03-08 05:35 6597736 ----a-w- c:\windows\system32\nvcuda.dll
2012-03-10 09:16 . 2011-03-08 05:35 13011560 ----a-w- c:\windows\SysWow64\nvcompiler.dll
2012-03-10 09:16 . 2011-03-08 05:35 18580072 ----a-w- c:\windows\system32\nvcompiler.dll
2012-03-10 09:16 . 2011-03-08 05:35 11240 ----a-w- c:\windows\system32\drivers\nvBridge.kmd
2012-03-10 09:16 . 2011-03-08 05:35 2206824 ----a-w- c:\windows\system32\nvapi64.dll
2012-03-10 09:16 . 2011-03-08 05:35 1969768 ----a-w- c:\windows\SysWow64\nvapi.dll
2012-03-10 09:13 . 2012-03-10 09:20 -------- d-----w- c:\program files\NVIDIA Corporation
2012-03-10 09:13 . 2012-03-10 09:13 -------- d-----w- c:\programdata\Intel
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-02-23 08:18 . 2010-11-21 03:27 279656 ------w- c:\windows\system32\MpSigStub.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-02-15 17146504]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2012-02-13 3481408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SonicMasterTray"="c:\program files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe" [2010-07-09 984400]
"FLxHCIm"="c:\program files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe" [2011-04-08 43008]
"ATKOSD2"="c:\program files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2010-08-17 5732992]
"ATKMEDIA"="c:\program files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2010-10-07 170624]
"HControlUser"="c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]
"Wireless Console 3"="c:\program files (x86)\ASUS\Wireless Console 3\wcourier.exe" [2010-09-23 1601536]
"USBChargerPlusTray"="c:\program files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe" [2011-03-28 495536]
"AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-02-15 158856]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]
R3 TurboBoost;Intel(R) Turbo Boost Technology Monitor 2.0;c:\program files\Intel\TurboBoost\TurboBoost.exe [2010-11-29 149504]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys [x]
S1 ATKWMIACPIIO;ATKWMIACPI Driver;c:\program files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [2010-07-26 17024]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe [x]
S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-07-02 15416]
S2 Atheros Bt&Wlan Coex Agent;Atheros Bt&Wlan Coex Agent;c:\program files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [2011-03-13 138400]
S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe [2011-03-13 74912]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe [2011-01-12 810144]
S2 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [x]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-03-14 2009704]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-12-20 2656280]
S3 AiCharger;ASUS Charger Driver;c:\windows\system32\DRIVERS\AiCharger.sys [x]
S3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys [x]
S3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys [x]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys [x]
S3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys [x]
S3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys [x]
S3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys [x]
S3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys [x]
S3 FLxHCIc;Fresco Logic xHCI (USB3) Device Driver;c:\windows\system32\DRIVERS\FLxHCIc.sys [x]
S3 FLxHCIh;Fresco Logic xHCI (USB3) Hub Device Driver;c:\windows\system32\DRIVERS\FLxHCIh.sys [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [x]
S3 MEIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-02-10 167960]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-10 391704]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-10 418328]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-06-03 2226280]
"AtherosBtStack"="c:\program files (x86)\Bluetooth Suite\BtvStack.exe" [2011-03-13 617120]
"AthBtTray"="c:\program files (x86)\Bluetooth Suite\AthBtTray.exe" [2011-03-13 379552]
"AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2010-08-11 324096]
"IntelTBRunOnce"="wscript.exe" [2009-07-14 168960]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2011-01-12 2918656]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-03-10 500208]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x1
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.seznam.cz/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 10.0.0.138
FF - ProfilePath - c:\users\Renáta\AppData\Roaming\Mozilla\Firefox\Profiles\ta9daagf.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2012-04-04 20:19:39
ComboFix-quarantined-files.txt 2012-04-04 18:19
.
Před spuštěním: 9 029 500 928
Po spuštění: 8 880 152 576
.
- - End Of File - - 9D3E7EFE581A641A825A41922210AF8C

rendie
Návštěvník
Návštěvník
Příspěvky: 11
Registrován: 02 Dub 2012 18:46

Re: Win32/TrojanDownloader.Mebload.AR

#7 Příspěvek od rendie »

ale soubor C:\Windows\System32\drivers\kbfiltr.sys nemuzu u sebe nikde najit :( ..jediny .sys soubor co mam u drivers je wimmount.sys :(

rendie
Návštěvník
Návštěvník
Příspěvky: 11
Registrován: 02 Dub 2012 18:46

Re: Win32/TrojanDownloader.Mebload.AR

#8 Příspěvek od rendie »

OTL log

========== OTL ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKEY_USERS\S-1-5-21-4142588759-912011533-2692799507-1000\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_USERS\S-1-5-21-4142588759-912011533-2692799507-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.

OTL by OldTimer - Version 3.2.39.2 log created on 04042012_203147

rendie
Návštěvník
Návštěvník
Příspěvky: 11
Registrován: 02 Dub 2012 18:46

Re: Win32/TrojanDownloader.Mebload.AR

#9 Příspěvek od rendie »

ComboFix 12-04-04.02 - Renáta 06.04.2012 16:34:55.2.4 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.4001.2609 [GMT 2:00]
Spuštěný z: c:\users\Renáta\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Renáta\Desktop\CFScript.txt
AV: ESET Smart Security 4.2 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
FW: ESET personal firewall *Enabled* {4FE52EC8-CB26-1113-0EFE-8842E2773BAA}
SP: ESET Smart Security 4.2 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-03-06 do 2012-04-06 )))))))))))))))))))))))))))))))
.
.
2012-04-06 14:40 . 2012-04-06 14:40 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-04-06 14:32 . 2012-04-06 14:32 69000 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{EB84ED3C-2043-41A9-9089-60CEC47E9D08}\offreg.dll
2012-04-04 18:31 . 2012-04-04 18:31 -------- d-----w- C:\_OTL
2012-04-04 18:19 . 2011-02-19 12:05 1139200 ----a-w- c:\windows\system32\FntCache.dll
2012-04-04 18:19 . 2011-02-19 12:04 902656 ----a-w- c:\windows\system32\d2d1.dll
2012-04-04 18:19 . 2011-02-19 06:30 739840 ----a-w- c:\windows\SysWow64\d2d1.dll
2012-04-04 18:05 . 2008-05-07 17:59 99840 ----a-w- c:\windows\system32\Spool\prtprocs\x64\HPZPPLHN.DLL
2012-04-04 05:57 . 2012-03-14 03:27 8669240 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{EB84ED3C-2043-41A9-9089-60CEC47E9D08}\mpengine.dll
2012-04-02 18:12 . 2012-04-02 18:55 512 ----a-w- C:\PhysicalMBR.bin
2012-04-02 17:43 . 2012-04-02 17:44 -------- d-----w- C:\rsit
2012-04-02 17:43 . 2012-04-02 17:43 -------- d-----w- c:\program files\trend micro
2012-04-01 08:38 . 2012-04-01 08:38 -------- d-----w- c:\program files\CCleaner
2012-03-31 20:30 . 2012-03-31 20:30 -------- d-----w- c:\programdata\Malwarebytes
2012-03-31 12:24 . 2012-03-31 20:26 -------- d-----w- c:\program files (x86)\Emsisoft Anti-Malware
2012-03-14 19:04 . 2011-11-19 15:20 5559152 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-03-14 19:04 . 2011-11-19 14:50 3968368 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2012-03-14 19:03 . 2011-11-19 14:50 3913584 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2012-03-14 19:02 . 2012-02-10 06:36 1544192 ----a-w- c:\windows\system32\DWrite.dll
2012-03-14 19:02 . 2012-02-10 05:38 1077248 ----a-w- c:\windows\SysWow64\DWrite.dll
2012-03-14 19:02 . 2012-02-03 04:34 3145728 ----a-w- c:\windows\system32\win32k.sys
2012-03-14 17:25 . 2012-02-17 06:38 1031680 ----a-w- c:\windows\system32\rdpcore.dll
2012-03-14 17:25 . 2012-02-17 05:34 826880 ----a-w- c:\windows\SysWow64\rdpcore.dll
2012-03-14 17:25 . 2012-02-17 04:58 210944 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-03-14 17:25 . 2012-02-17 04:57 23552 ----a-w- c:\windows\system32\drivers\tdtcp.sys
2012-03-14 17:25 . 2012-01-25 06:38 77312 ----a-w- c:\windows\system32\rdpwsx.dll
2012-03-14 17:25 . 2012-01-25 06:38 149504 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-03-14 17:25 . 2012-01-25 06:33 9216 ----a-w- c:\windows\system32\rdrmemptylst.exe
2012-03-11 12:43 . 2012-03-11 12:43 -------- d-----w- c:\program files (x86)\Common Files\Java
2012-03-11 12:42 . 2012-03-11 12:42 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll
2012-03-11 12:42 . 2012-03-11 12:42 -------- d-----w- c:\program files (x86)\Java
2012-03-10 15:31 . 2012-03-10 15:31 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help
2012-03-10 15:18 . 2012-03-10 15:18 -------- d-----w- c:\programdata\regid.1986-12.com.adobe
2012-03-10 15:12 . 2012-03-10 15:12 -------- d-----w- c:\program files (x86)\Adobe Media Player
2012-03-10 15:12 . 2012-03-10 15:15 -------- d-----w- c:\program files\Common Files\Adobe
2012-03-10 15:11 . 2012-03-10 15:11 -------- d-----w- c:\program files (x86)\Common Files\Adobe AIR
2012-03-10 14:35 . 2012-03-11 13:13 -------- d-----w- c:\program files (x86)\Common Files\Adobe
2012-03-10 13:40 . 2012-03-10 13:40 -------- d-----w- c:\program files\7-Zip
2012-03-10 13:35 . 2012-03-10 13:35 283200 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2012-03-10 13:35 . 2012-03-10 13:35 -------- d-----w- c:\program files (x86)\DAEMON Tools Lite
2012-03-10 13:34 . 2012-03-10 13:34 -------- d-----w- c:\programdata\DAEMON Tools Lite
2012-03-10 13:21 . 2012-03-10 13:29 -------- d-----w- c:\program files (x86)\SMPlayer
2012-03-10 13:15 . 2012-03-10 13:15 -------- d-----w- c:\program files (x86)\Common Files\Skype
2012-03-10 13:15 . 2012-03-11 07:22 -------- d-----w- c:\programdata\Skype
2012-03-10 13:15 . 2012-03-10 13:15 -------- d-----r- c:\program files (x86)\Skype
2012-03-10 13:10 . 2012-03-10 13:10 -------- d-----w- c:\program files (x86)\QIP 2012
2012-03-10 13:05 . 2011-10-07 09:49 2770944 ----a-w- c:\windows\system32\drivers\athrx.sys
2012-03-10 12:41 . 2012-03-10 12:41 -------- d-----w- c:\windows\SysWow64\Wat
2012-03-10 12:41 . 2012-03-10 12:41 -------- d-----w- c:\windows\system32\Wat
2012-03-10 10:58 . 2012-02-24 06:57 545 ----a-w- c:\windows\UC.PIF
2012-03-10 10:58 . 2012-02-24 06:57 545 ----a-w- c:\windows\RAR.PIF
2012-03-10 10:58 . 2012-02-24 06:57 545 ----a-w- c:\windows\NOCLOSE.PIF
2012-03-10 10:58 . 2012-02-24 06:57 545 ----a-w- c:\windows\LHA.PIF
2012-03-10 10:58 . 2012-02-24 06:57 545 ----a-w- c:\windows\ARJ.PIF
2012-03-10 10:58 . 2012-03-10 10:58 -------- d-----w- c:\program files (x86)\totalcmd
2012-03-10 10:46 . 2012-03-10 10:46 -------- d-----w- c:\program files\ESET
2012-03-10 10:37 . 2011-02-19 12:03 46080 ----a-w- c:\windows\system32\atmlib.dll
2012-03-10 10:36 . 2011-02-05 17:10 642944 ----a-w- c:\windows\system32\winload.efi
2012-03-10 10:36 . 2011-02-05 17:10 20352 ----a-w- c:\windows\system32\kdusb.dll
2012-03-10 10:36 . 2011-02-05 17:10 19328 ----a-w- c:\windows\system32\kd1394.dll
2012-03-10 10:36 . 2011-02-05 17:10 17792 ----a-w- c:\windows\system32\kdcom.dll
2012-03-10 10:36 . 2011-02-05 17:06 605552 ----a-w- c:\windows\system32\winload.exe
2012-03-10 10:36 . 2011-02-05 17:06 566208 ----a-w- c:\windows\system32\winresume.efi
2012-03-10 10:36 . 2011-02-05 17:06 518672 ----a-w- c:\windows\system32\winresume.exe
2012-03-10 10:33 . 2011-11-19 14:58 77312 ----a-w- c:\windows\system32\packager.dll
2012-03-10 10:33 . 2011-11-19 14:01 67072 ----a-w- c:\windows\SysWow64\packager.dll
2012-03-10 10:30 . 2012-03-11 14:09 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-03-10 10:30 . 2012-03-10 10:30 -------- d-----w- c:\windows\SysWow64\Macromed
2012-03-10 10:30 . 2012-03-10 10:30 -------- d-----w- c:\windows\system32\Macromed
2012-03-10 10:06 . 2012-03-10 12:09 -------- d-----w- c:\program files (x86)\Microsoft Works
2012-03-10 10:06 . 2012-03-10 15:22 -------- d-----w- c:\program files (x86)\Microsoft.NET
2012-03-10 10:06 . 2012-03-10 10:06 -------- d-----w- c:\windows\PCHEALTH
2012-03-10 10:04 . 2012-03-14 19:35 -------- d-----w- c:\programdata\Microsoft Help
2012-03-10 10:03 . 2012-03-10 10:03 -------- d-----r- C:\MSOCache
2012-03-10 09:49 . 2012-03-10 09:49 -------- d-----w- c:\programdata\ASUS
2012-03-10 09:44 . 2012-03-10 09:44 -------- d-----w- c:\program files\Intel
2012-03-10 09:43 . 2012-03-10 09:43 -------- d-----w- c:\programdata\USBChargerPlus
2012-03-10 09:43 . 2012-04-06 10:48 45056 ----a-w- c:\windows\system32\acovcnt.exe
2012-03-10 09:42 . 2012-03-10 09:42 -------- dc----w- c:\windows\system32\DRVSTORE
2012-03-10 09:42 . 2011-02-25 16:42 16768 ----a-w- c:\windows\system32\drivers\AiCharger.sys
2012-03-10 09:39 . 2010-08-03 14:30 196224 ----a-w- c:\program files\Windows Sidebar\Shared Gadgets\P4GUpdate.Gadget\P4GUpdate.dll
2012-03-10 09:39 . 2012-03-10 09:41 -------- d-----w- c:\program files\P4G
2012-03-10 09:39 . 2012-03-10 09:39 -------- d-----w- c:\programdata\P4G
2012-03-10 09:39 . 2012-03-10 09:39 -------- d-----w- c:\program files\ASUS
2012-03-10 09:39 . 2011-01-25 13:11 379520 ----a-w- c:\windows\system32\FBAgent.exe
2012-03-10 09:38 . 2006-10-09 18:07 183296 ----a-w- c:\windows\SysWow64\ACEngSvr.exe
2012-03-10 09:37 . 2009-07-20 09:29 15416 ----a-w- c:\windows\system32\drivers\kbfiltr.sys
2012-03-10 09:36 . 2012-03-10 09:36 -------- d-----w- c:\programdata\AmUStor
2012-03-10 09:36 . 2012-03-10 09:37 -------- d-----w- c:\program files (x86)\AmIcoSingLun
2012-03-10 09:35 . 2012-03-10 09:35 -------- d-----w- c:\program files (x86)\Common Files\Atheros
2012-03-10 09:35 . 2012-03-10 09:35 -------- d-----w- c:\program files (x86)\Bluetooth Suite
2012-03-10 09:31 . 2012-03-10 09:31 -------- d-----w- c:\program files (x86)\Atheros
2012-03-10 09:31 . 2010-07-08 01:03 2228736 ----a-w- c:\windows\system32\athrx.sys
2012-03-10 09:29 . 2012-03-10 09:38 -------- d-----w- c:\programdata\Atheros
2012-03-10 09:28 . 2010-08-24 09:55 76912 ----a-w- c:\windows\system32\drivers\L1C62x64.sys
2012-03-10 09:28 . 2012-03-10 09:28 -------- d-----w- c:\program files\Synaptics
2012-03-10 09:28 . 2010-10-08 10:32 1395248 ----a-w- c:\windows\system32\drivers\SynTP.sys
2012-03-10 09:28 . 2010-10-08 10:29 107816 ----a-w- c:\windows\SysWow64\SynTPCOM.dll
2012-03-10 09:28 . 2010-10-08 10:29 148264 ----a-w- c:\windows\system32\SynTPCo4.dll
2012-03-10 09:28 . 2010-10-08 10:29 221480 ----a-w- c:\windows\system32\SynTPAPI.dll
2012-03-10 09:28 . 2010-10-08 10:29 273704 ----a-w- c:\windows\system32\SynCtrl.dll
2012-03-10 09:28 . 2010-10-08 10:29 218408 ----a-w- c:\windows\SysWow64\SynCtrl.dll
2012-03-10 09:28 . 2010-10-08 10:29 173352 ----a-w- c:\windows\SysWow64\SynCOM.dll
2012-03-10 09:27 . 2012-03-10 09:27 -------- d-----w- c:\program files\Fresco Logic Inc
2012-03-10 09:23 . 2010-12-20 17:08 8192 ----a-w- c:\windows\system32\drivers\IntelMEFWVer.dll
2012-03-10 09:23 . 2012-03-10 09:23 -------- d-----w- c:\program files (x86)\Common Files\postureAgent
2012-03-10 09:23 . 2010-10-19 15:34 56344 ----a-w- c:\windows\system32\drivers\HECIx64.sys
2012-03-10 09:23 . 2012-03-10 09:44 -------- d--h--w- c:\program files (x86)\InstallShield Installation Information
2012-03-10 09:23 . 2012-03-10 09:24 -------- d-----w- c:\windows\SysWow64\NV
2012-03-10 09:23 . 2012-03-10 09:24 -------- d-----w- c:\windows\system32\NV
2012-03-10 09:21 . 2012-03-10 12:46 -------- d-----w- c:\users\UpdatusUser
2012-03-10 09:21 . 2012-03-10 09:23 -------- d-----w- c:\programdata\NVIDIA
2012-03-10 09:19 . 2012-03-15 21:19 -------- d-sh--w- c:\windows\Installer
2012-03-10 09:19 . 2012-03-10 09:19 -------- d-----w- c:\programdata\NVIDIA Corporation
2012-03-10 09:19 . 2012-03-10 09:21 -------- d-----w- c:\program files (x86)\NVIDIA Corporation
2012-03-10 09:19 . 2011-03-08 05:35 1614440 ----a-w- c:\windows\system32\nvdispco642090.dll
2012-03-10 09:19 . 2011-03-08 05:35 1359976 ----a-w- c:\windows\system32\nvgenco642040.dll
2012-03-10 09:16 . 2011-03-08 05:35 10059368 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2012-03-10 09:16 . 2011-03-08 05:35 3182184 ----a-w- c:\windows\system32\nvcuvid.dll
2012-03-10 09:16 . 2011-03-08 05:35 2954856 ----a-w- c:\windows\SysWow64\nvcuvid.dll
2012-03-10 09:16 . 2011-03-08 05:35 2871400 ----a-w- c:\windows\system32\nvcuvenc.dll
2012-03-10 09:16 . 2011-03-08 05:35 2579560 ----a-w- c:\windows\SysWow64\nvcuvenc.dll
2012-03-10 09:16 . 2011-03-08 05:35 4936808 ----a-w- c:\windows\SysWow64\nvcuda.dll
2012-03-10 09:16 . 2011-03-08 05:35 6597736 ----a-w- c:\windows\system32\nvcuda.dll
2012-03-10 09:16 . 2011-03-08 05:35 13011560 ----a-w- c:\windows\SysWow64\nvcompiler.dll
2012-03-10 09:16 . 2011-03-08 05:35 18580072 ----a-w- c:\windows\system32\nvcompiler.dll
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-02-23 08:18 . 2010-11-21 03:27 279656 ------w- c:\windows\system32\MpSigStub.exe
.
.
((((((((((((((((((((((((((((( SnapShot@2012-04-04_18.18.28 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-14 05:10 . 2012-04-06 10:50 30052 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2012-03-10 08:47 . 2012-04-06 10:50 5338 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-4142588759-912011533-2692799507-1000_UserData.bin
+ 2012-04-06 10:48 . 2012-04-06 10:48 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2012-04-04 16:44 . 2012-04-04 16:44 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-04-06 10:48 . 2012-04-06 10:48 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2012-04-04 16:44 . 2012-04-04 16:44 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-07-14 04:46 . 2012-04-06 06:10 106072 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat
- 2009-07-14 05:01 . 2012-04-04 06:12 473564 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2012-04-06 06:48 473564 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 04:45 . 2012-04-05 19:17 7438632 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat
- 2009-07-14 04:45 . 2012-03-14 19:38 7438632 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat
+ 2012-03-10 12:42 . 2012-04-06 06:48 8847836 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-4142588759-912011533-2692799507-1000-8192.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-02-15 17146504]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2012-02-13 3481408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SonicMasterTray"="c:\program files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe" [2010-07-09 984400]
"FLxHCIm"="c:\program files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe" [2011-04-08 43008]
"ATKOSD2"="c:\program files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2010-08-17 5732992]
"ATKMEDIA"="c:\program files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2010-10-07 170624]
"HControlUser"="c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]
"Wireless Console 3"="c:\program files (x86)\ASUS\Wireless Console 3\wcourier.exe" [2010-09-23 1601536]
"USBChargerPlusTray"="c:\program files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe" [2011-03-28 495536]
"AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-02-15 158856]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]
R3 TurboBoost;Intel(R) Turbo Boost Technology Monitor 2.0;c:\program files\Intel\TurboBoost\TurboBoost.exe [2010-11-29 149504]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys [x]
S1 ATKWMIACPIIO;ATKWMIACPI Driver;c:\program files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [2010-07-26 17024]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe [x]
S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-07-02 15416]
S2 Atheros Bt&Wlan Coex Agent;Atheros Bt&Wlan Coex Agent;c:\program files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [2011-03-13 138400]
S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe [2011-03-13 74912]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe [2011-01-12 810144]
S2 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [x]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-03-14 2009704]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-12-20 2656280]
S3 AiCharger;ASUS Charger Driver;c:\windows\system32\DRIVERS\AiCharger.sys [x]
S3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys [x]
S3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys [x]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys [x]
S3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys [x]
S3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys [x]
S3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys [x]
S3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys [x]
S3 FLxHCIc;Fresco Logic xHCI (USB3) Device Driver;c:\windows\system32\DRIVERS\FLxHCIc.sys [x]
S3 FLxHCIh;Fresco Logic xHCI (USB3) Hub Device Driver;c:\windows\system32\DRIVERS\FLxHCIh.sys [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [x]
S3 MEIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-02-10 167960]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-10 391704]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-10 418328]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-06-03 2226280]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"AtherosBtStack"="c:\program files (x86)\Bluetooth Suite\BtvStack.exe" [2011-03-13 617120]
"AthBtTray"="c:\program files (x86)\Bluetooth Suite\AthBtTray.exe" [2011-03-13 379552]
"AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2010-08-11 324096]
"IntelTBRunOnce"="wscript.exe" [2009-07-14 168960]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2011-01-12 2918656]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-03-10 500208]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.seznam.cz/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 10.0.0.138
FF - ProfilePath - c:\users\Renáta\AppData\Roaming\Mozilla\Firefox\Profiles\ta9daagf.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2012-04-06 16:41:33
ComboFix-quarantined-files.txt 2012-04-06 14:41
ComboFix2.txt 2012-04-04 18:19
.
Před spuštěním: 9 099 382 784
Po spuštění: 8 924 692 480
.
- - End Of File - - E82D131163A6F4240FD43C659F16C20A
Nahr nˇ probŘhlo ŁspŘçnŘ

rendie
Návštěvník
Návštěvník
Příspěvky: 11
Registrován: 02 Dub 2012 18:46

Re: Win32/TrojanDownloader.Mebload.AR

#10 Příspěvek od rendie »

juuu, takze muzu jasat? :D
dotaz bych mela jeden...jak tomu predchazet (krome toho, ze mam ESET i firewall)...

rendie
Návštěvník
Návštěvník
Příspěvky: 11
Registrován: 02 Dub 2012 18:46

Re: Win32/TrojanDownloader.Mebload.AR

#11 Příspěvek od rendie »

Dekuju mnohokrat! Jsem nanejvyse vdecna, ze tam tu havet uz nemam! Diky, diky!

Sandbox a virtualka asi bohuzel netusim co je :D ...nebo jako podle nazvu si asi dovedu predstavit, co by se tam mohlo dit, ale uz si nejsem tak jista, ze bych se v tom chtela hrabat :D
Naistalovala jsem doplnek ABL, aby na me neskakaly reklamy, ze kterych to nejspis i bylo???? mam takovy dojem...tak snad :)

Odpovědět