Vir z webu, chytlo avg, ale....

[kristynkai7]

Ahoj všem, dnes jsem měla takový problém, na netu jsem hledala Machine Debug Manager a na jednom z odkazů našlo AVGčko IDP.TROJAN.714FBA16 a soubory 64.EXE a FUWIN.EXE a gwind.exe, mno a nyní před chvílí vyskočilo avgčko že našlo 41.EXE, takže asi něco avgčko nechytlo úplně projela jsem PC ještě Malwarebytes anti malware a našlo to tohle:
Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Verze databáze: v2012.07.05.02

Windows XP Service Pack 2 x86 NTFS
Internet Explorer 6.0.2900.2180
Tomáš :: DOMA [administrátor]

6.7.2012 16:39:10
mbam-log-2012-07-06 (17-02-56).txt

Typ: Rychlá kontrola
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 209589
Uplynulý čas: 8 minut, 48 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené hodnoty v registru: 1
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon|Taskman (Trojan.Agent) -> Data: c:\RECYCLER\R-1-5-21-1482476501-1644491937-682003330-1013\gwind.exe -> Žádná instrukce nebyla provedena.

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 1
C:\RECYCLER\R-1-5-21-1482476501-1644491937-682003330-1013 (Worm.AutoRun.Gen) -> Žádná instrukce nebyla provedena.

Nalezené soubory: 1
C:\RECYCLER\R-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini (Worm.AutoRun.Gen) -> Žádná instrukce nebyla provedena.

(konec)


Tak bych chtěla poprosit o radu, co s tím, aby se to nezavirovalo úplně a abych nešířila viry do celého světa... předem děkuju za pomoc, ještě vložím log z rsit

[kristynkai7]

Log z RSIT:

Logfile of random's system information tool 1.09 (written by random/random)
Run by Tomáš at 2012-07-06 17:25:00
Systém Microsoft Windows XP Professional Service Pack 2
System drive C: has 114 GB (75%) free of 153 GB
Total RAM: 1023 MB (19% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:25:48, on 6.7.2012
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\PROGRA~1\AVG\AVG10\avgchsvx.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\AVG\AVG10\avgfws.exe
C:\Program Files\AVG\AVG10\avgtray.exe
C:\Program Files\AVG\AVG10\avgwdsvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AVG Secure Search\vprot.exe
C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
C:\Program Files\AVG\AVG10\avgam.exe
C:\Program Files\AVG\AVG10\avgnsx.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\AVG\AVG10\avgemcx.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\PROGRA~1\AVG\AVG10\avgrsx.exe
C:\Program Files\AVG\AVG10\avgcsrvx.exe
C:\Program Files\AVG\AVG10\avgscanx.exe
C:\Program Files\AVG\AVG10\avgcsrvx.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\AVG\AVG10\avgcsrvx.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\Tomáš\Dokumenty\Stažené soubory\RSIT.exe
C:\Program Files\trend micro\Tomáš.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.centrum.cz/?ms=ge
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.centrum.cz/?ms=ge
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.centrum.cz/?ms=ge
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\WINDOWS\WebIE.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll
O2 - BHO: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\11.1.0.7\AVG Secure Search_toolbar.dll
O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - (no file)
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\WINDOWS\WebIE.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O3 - Toolbar: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\11.1.0.7\AVG Secure Search_toolbar.dll
O4 - HKLM\..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [vProt] "C:\Program Files\AVG Secure Search\vprot.exe"
O4 - HKLM\..\Run: [ROC_roc_dec12] "C:\Program Files\AVG Secure Search\ROC_roc_dec12.exe" /PROMPT /CMPID=roc_dec12
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Bleskově - {141D2E4F-F313-4991-B61A-EE5D6D849361} - http://bleskove.centrum.cz (file missing)
O9 - Extra button: Centrum.cz - {2A5CFB1C-AAA2-4760-8462-1B61CF74B7D8} - http://www.centrum.cz (file missing)
O9 - Extra button: Xchat - {2BCB61BF-DC41-4738-A149-BDAAAD7FF0BD} - http://www.xchat.cz (file missing)
O9 - Extra button: Aktuálně - {2E01031B-AB09-4455-823D-25F1A1C11F48} - http://aktualne.centrum.cz (file missing)
O9 - Extra button: Slovníky - {2F741D0A-150E-40F9-A602-1B2421475F1D} - http://slovniky.centrum.cz (file missing)
O9 - Extra button: Supermapy - {309176E6-E204-40A0-8D13-7F19C0498C40} - http://www.supermapy.cz (file missing)
O9 - Extra button: mp3.centrum.cz - {49681216-5BF4-41A2-AAFA-129A6BD625DA} - http://mp3.centrum.cz/ (file missing)
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\WINDOWS\WebIE.dll
O9 - Extra button: Žena - {8B6E8E01-D262-4980-8C27-B8B2802285C1} - http://www.zena.cz (file missing)
O9 - Extra button: Fotoalba - {8FD64249-590C-4FBC-B181-12A6BAF516AF} - http://www.fotoalba.cz (file missing)
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Počasí - {A5050656-2286-454F-A489-C605ED1B461C} - http://pocasi.centrum.cz (file missing)
O9 - Extra button: Sportplus - {BC78516C-9DC9-40C5-A91E-74593222EF89} - http://sportplus.centrum.cz (file missing)
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\WINDOWS\WebIE.dll
O9 - Extra button: Digitálně - {DAE865E8-970E-4931-A172-119CB56BBAF5} - http://www.digitalne.cz/ (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Stahuj.cz - {FC29EB7D-EDBA-4299-AEE4-D1BDC70EFA15} - http://www.stahuj.cz/ (file missing)
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - http://www.eset.cz/OnlineScanner.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll
O18 - Protocol: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\11.1.0\ViProtocol.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: AVG Security Toolbar Service - Unknown owner - C:\Program Files\AVG\AVG10\Toolbar\ToolbarBroker.exe
O23 - Service: AVG Firewall (avgfws) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\avgfws.exe
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\avgwdsvc.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 8814 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Adobe Flash Player Updater.job

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\Tomáš\Data aplikací\Mozilla\Firefox\Profiles\o229hanx.default

prefs.js - "keyword.URL" - "http://isearch.avg.com/search?cid=%7B8e ... &sap=ku&q="

"avg@igeared"=C:\Program Files\AVG\AVG10\Toolbar\Firefox\avg@igeared
"{1E73965B-8B48-48be-9C8D-68B920ABC1C4}"=C:\Program Files\AVG\AVG10\Firefox4\
"avg@toolbar"=C:\Documents and Settings\All Users\Data aplikací\AVG Secure Search\11.1.0.7\


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.3.300.262 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_262.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin]
"Description"=
"Path"=C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\11.1.0\\npsitesafety.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files\Mozilla Firefox\plugins\
np-mswmp.dll
nppdf32.dll
WMP Firefox Plugin License.rtf
WMP Firefox Plugin RelNotes.txt

C:\Program Files\Mozilla Firefox\searchplugins\
avg-secure-search.xml
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-04-04 63912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2DB66063-BB98-466A-AA0D-3E7ACF5ED853}]
WebTransBHO Class - C:\WINDOWS\WebIE.dll [2007-04-12 491520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files\AVG\AVG10\avgssie.dll [2011-09-09 2276704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
AVG Security Toolbar - C:\Program Files\AVG Secure Search\11.1.0.7\AVG Secure Search_toolbar.dll [2012-06-12 2068536]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{327C2873-E90D-4c37-AA9D-10AC9BABA46C} - Easy-WebPrint - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll [2004-08-26 405504]
{BFC32E1D-EE75-4A48-BC60-104E11EE2431} - WebTranslator - C:\WINDOWS\WebIE.dll [2007-04-12 491520]
{CCC7A320-B3CA-4199-B1A6-9F516DD69829}
{95B7759C-8C7F-4BF1-B163-73684A933233} - AVG Security Toolbar - C:\Program Files\AVG Secure Search\11.1.0.7\AVG Secure Search_toolbar.dll [2012-06-12 2068536]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG_TRAY"=C:\Program Files\AVG\AVG10\avgtray.exe [2012-01-17 2339168]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2011-01-07 13880424]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2008-10-28 17331200]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2008-06-19 57344]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-01-03 843712]
"vProt"=C:\Program Files\AVG Secure Search\vprot.exe [2012-06-12 1104440]
"ROC_roc_dec12"=C:\Program Files\AVG Secure Search\ROC_roc_dec12.exe [2012-01-15 928096]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe [2004-08-17 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
C:\WINDOWS\RTHDCPL.EXE [2008-10-28 17331200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL [2011-05-04 551296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2011-07-19 113024]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\!SASCORE]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Documents and Settings\Administrator\Plocha\Tomáš\Miranda Pack instalovaný\MirandaPack\MirandaPack\miranda32.exe"="C:\Documents and Settings\Administrator\Plocha\Tomáš\Miranda Pack instalovaný\MirandaPack\MirandaPack\miranda32.exe:*:Enabled:Miranda IM"
"C:\totalcmd\TOTALCMD.EXE"="C:\totalcmd\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows"
"C:\Program Files\Mozilla Firefox\firefox.exe"="C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox"
"C:\Program Files\BitLord\BitLord.exe"="C:\Program Files\BitLord\BitLord.exe:*:Disabled:BitLord"
"C:\Documents and Settings\Tomáš\Plocha\Vysoká škola\MirandaPack - stará\miranda32.exe"="C:\Documents and Settings\Tomáš\Plocha\Vysoká škola\MirandaPack - stará\miranda32.exe:*:Enabled:Miranda IM"
"C:\Program Files\Opera\opera.exe"="C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"
"C:\WINDOWS\system32\javaw.exe"="C:\WINDOWS\system32\javaw.exe:*:Disabled:Java(TM) Platform SE binary"
"C:\Documents and Settings\Tomáš\Dokumenty\Vysoká škola\MirandaPack - stará\miranda32.exe"="C:\Documents and Settings\Tomáš\Dokumenty\Vysoká škola\MirandaPack - stará\miranda32.exe:*:Enabled:Miranda IM"
"C:\Program Files\AVG\AVG10\avgmfapx.exe"="C:\Program Files\AVG\AVG10\avgmfapx.exe:*:Enabled:Instalátor AVG"
"C:\Program Files\AVG\AVG10\avgdiagex.exe"="C:\Program Files\AVG\AVG10\avgdiagex.exe:*:Enabled:AVG Diagnostika 2011"
"C:\Program Files\AVG\AVG10\avgnsx.exe"="C:\Program Files\AVG\AVG10\avgnsx.exe:*:Enabled:Webový štít"
"C:\Program Files\AVG\AVG10\avgam.exe"="C:\Program Files\AVG\AVG10\avgam.exe:*:Enabled:Správce událostí AVG"
"C:\Program Files\AVG\AVG10\avgemcx.exe"="C:\Program Files\AVG\AVG10\avgemcx.exe:*:Enabled:Obecná kontrola pošty"
"C:\Program Files\Opera\pluginwrapper\opera_plugin_wrapper.exe"="C:\Program Files\Opera\pluginwrapper\opera_plugin_wrapper.exe:*:Enabled:Opera Internet Browser - Plugin wrapper"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"aux2"=wdmaud.drv

======List of files/folders created in the last 1 month======

2012-07-06 17:25:00 ----D---- C:\rsit
2012-07-06 16:38:56 ----A---- C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2012-07-01 17:06:43 ----D---- C:\Program Files\CCleaner

======List of files/folders modified in the last 1 month======

2012-07-06 17:25:42 ----D---- C:\Program Files\trend micro
2012-07-06 17:17:37 ----D---- C:\WINDOWS\system32
2012-07-06 17:17:15 ----D---- C:\WINDOWS\temp
2012-07-06 16:59:20 ----D---- C:\WINDOWS
2012-07-06 16:39:05 ----D---- C:\WINDOWS\system32\CatRoot2
2012-07-06 16:38:56 ----D---- C:\WINDOWS\system32\drivers
2012-07-06 16:38:55 ----RD---- C:\Program Files
2012-07-06 16:37:40 ----D---- C:\Documents and Settings\All Users\Data aplikací\AVG10
2012-07-06 16:34:23 ----N---- C:\WINDOWS\SchedLgU.Txt
2012-07-06 16:26:05 ----D---- C:\WINDOWS\system32\drivers\AVG
2012-07-06 16:21:44 ----D---- C:\WINDOWS\SoftwareDistribution
2012-07-05 13:03:37 ----D---- C:\WINDOWS\inf
2012-07-05 11:18:28 ----D---- C:\WINDOWS\system32\ReinstallBackups
2012-07-05 09:24:28 ----A---- C:\WINDOWS\NeroDigital.ini
2012-07-01 09:20:52 ----A---- C:\WINDOWS\system32\FlashPlayerApp.exe
2012-07-01 08:39:48 ----SD---- C:\WINDOWS\Tasks
2012-06-30 23:58:39 ----SHD---- C:\WINDOWS\Installer
2012-06-23 18:11:52 ----D---- C:\Program Files\SUPERAntiSpyware
2012-06-23 14:57:05 ----D---- C:\Program Files\Mozilla Maintenance Service
2012-06-23 08:29:39 ----D---- C:\Program Files\Mozilla Firefox
2012-06-14 18:38:53 ----D---- C:\Program Files\Opera
2012-06-12 17:14:42 ----D---- C:\Documents and Settings\All Users\Data aplikací\AVG Secure Search
2012-06-12 17:14:36 ----D---- C:\Program Files\AVG Secure Search
2012-06-12 17:14:29 ----D---- C:\WINDOWS\system32\cache
2012-06-12 17:14:20 ----D---- C:\Program Files\Common Files\AVG Secure Search

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 AVGIDSEH;AVGIDSEH; C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys [2011-02-22 22992]
R0 Avgrkx86;AVG Anti-Rootkit Driver; C:\WINDOWS\system32\DRIVERS\avgrkx86.sys [2011-03-16 32592]
R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2007-03-08 43528]
R1 Avgldx86;AVG AVI Loader Driver; C:\WINDOWS\system32\DRIVERS\avgldx86.sys [2011-01-07 248656]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield; C:\WINDOWS\system32\DRIVERS\avgmfx86.sys [2011-03-01 34896]
R1 Avgtdix;AVG TDI Driver; C:\WINDOWS\system32\DRIVERS\avgtdix.sys [2011-04-05 297168]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-17 39936]
R1 kbfilter;Keyboard Filter Driver; C:\WINDOWS\system32\drivers\kbfilter.sys [2002-07-11 12856]
R1 SASDIFSV;SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS []
R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS []
R1 UsbFltr;WayTechUSBFilterDriver; C:\WINDOWS\system32\drivers\UsbFltr.sys [2003-12-29 8576]
R3 Avgfwdx;Avgfwdx; C:\WINDOWS\system32\DRIVERS\avgfwdx.sys [2010-07-12 30432]
R3 AVGIDSDriver;AVGIDSDriver; C:\WINDOWS\system32\DRIVERS\AVGIDSDriver.Sys [2011-05-27 134480]
R3 AVGIDSFilter;AVGIDSFilter; C:\WINDOWS\system32\DRIVERS\AVGIDSFilter.Sys [2011-02-10 24144]
R3 AVGIDSShim;AVGIDSShim; C:\WINDOWS\system32\DRIVERS\AVGIDSShim.Sys [2011-02-10 27216]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2008-10-31 4942336]
R3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\WINDOWS\system32\drivers\mbamswissarmy.sys []
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2011-01-08 9888672]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2008-10-30 117888]
R3 SMBios;Intel (R) System Management BIOS Service; C:\WINDOWS\system32\DRIVERS\SMBios.sys [2004-06-07 36484]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-03 20480]
S3 Avgfwfd;AVG network filter service; C:\WINDOWS\system32\DRIVERS\avgfwdx.sys [2010-07-12 30432]
S3 catchme;catchme; \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\catchme.sys []
S3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-04 20992]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 VBoxNetFlt;VBoxNetFlt Service; C:\WINDOWS\system32\DRIVERS\VBoxNetFlt.sys []
S3 ZD1211U(ZyDAS);ZyDAS ZD1211 IEEE 802.11b+g Wireless LAN Driver (USB)(ZyDAS); C:\WINDOWS\system32\DRIVERS\zd1211u.sys [2004-12-22 259584]
S4 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-10-25 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avgfws;AVG Firewall; C:\Program Files\AVG\AVG10\avgfws.exe [2011-03-09 2708024]
R2 AVGIDSAgent;AVGIDSAgent; C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [2012-01-31 7391072]
R2 avgwd;AVG WatchDog; C:\Program Files\AVG\AVG10\avgwdsvc.exe [2011-02-08 269520]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2011-01-07 156776]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-01 250056]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service; C:\Program Files\AVG\AVG10\Toolbar\ToolbarBroker.exe [2011-11-10 167264]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-23 113120]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S4 !SASCORE;SAS Core Service; C:\Program Files\SUPERAntiSpyware\SASCORE.EXE [2011-08-12 116608]
S4 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
S4 vToolbarUpdater11.1.0;vToolbarUpdater11.1.0; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.1.0\ToolbarUpdater.exe [2012-06-12 935480]

-----------------EOF-----------------

[kristynkai7]

Omlouvám se za další příspěvek, ale aby to někdo špatně nepochopil to co našlo Malwarebytes Anti-Malware jsem ještě nemazala, to bych raději nechala posoudit jiné zda mazat či ne.....bylo to při rychlém testu nalezeno

[kristynkai7]

Ahoj, ano problém je aktuální, nevím zda smazat to z malwarebytes a zda tam ještě něco nezůstalo v tom PC, moc se v počítačích nevyznám.

[kristynkai7]

Ahojík je to hodně zlé, před chvílí celý počítač zatuhnul a musela jsem restartovat, takže znovu spouštím malwarebytes abych mohla smazat co našel, ten soubor C:\PhysicalMBR.bin jsem nenašla ani když jsem dala zobrazovat skryté soubory, a avg hned ohlásilo další virus co zablokovalo, jakmile doběhne malwarebytes tak smažu co najde a pak pustím to OTL, moc děkuju za rady, jsi moc moc hodnej

edit
smazáno malwarebytes:
Malwarebytes Anti-Malware 1.61.0.1400
http://www.malwarebytes.org

Verze databáze: v2012.07.06.09

Windows XP Service Pack 2 x86 NTFS
Internet Explorer 6.0.2900.2180
Tomáš :: DOMA [administrátor]

6.7.2012 17:58:32
mbam-log-2012-07-06 (17-58-32).txt

Typ: Rychlá kontrola
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 210080
Uplynulý čas: 9 minut,

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené hodnoty v registru: 1
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon|Taskman (Trojan.Agent) -> Data: c:\RECYCLER\R-1-5-21-1482476501-1644491937-682003330-1013\gwind.exe -> Umístnění do karantény a smazání se zdařilo.

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 1
C:\RECYCLER\R-1-5-21-1482476501-1644491937-682003330-1013 (Worm.AutoRun.Gen) -> Umístnění do karantény a smazání se zdařilo.

Nalezené soubory: 1
C:\RECYCLER\R-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini (Worm.AutoRun.Gen) -> Umístnění do karantény a smazání se zdařilo.

(konec)


edit2
u nás před chvílí proběhla bouřka spíš se bojím že PC (systém) zdechne, když budeš muset jít tak se nic neděje, i tak jsi pro mě hodně udělal a za to moc děkuju

[kristynkai7]

Děkuju za podporu a povzbuzení,

zkoušla jsem znovu testovat ten soubor PhysicalMBR.bin
oproti tomu předtím vidím mnohem víc předtím skrytých souborů a jiných, je to divné, nevím zda je mohl předtím schovávat nějak ten vir a nebo jestli jsem tak slepá

výsledek - odkaz:
https://www.virustotal.com/file/50e2f3d ... 341592118/

ještě zkusím přiložit ty logy z otl ale nevím moc jak na to tak zkouška (jinak příště varovat že tam bude blikat nějaké okno s příkazovým řádkem, jsem se lekla že je konečná )

Moc děkuju za pomoc, jinak to avg už nic dalšího nehlásí, těžko říct zda je to dobré či špatné...


edit
antivir při skenu otl nebyl vypnutý omlouvám se

[kristynkai7]

Tak avg zase něco našlo C:/windows/system32/71.exe
IDP.Trojan.714FBA16 tak jsem dala zase odstranit a chce to restart
Ach jiu snad to pak naběhne

PS: ty lomítka jsou opačně páč nevím jak dát ta správná

edit
Tak jsem zpět, avg našlo ukončilo a smazalo 71.EXE, gwind.exe a FUWIN.EXE
to jsou asi ty samé co na začátku jen se vrátili, ach jiu bojím se

[kristynkai7]

Tak mám problém nevím jak při kombofixu vypnout AVG

[kristynkai7]

A když jen zastavím štíty AVG v centru AVG to by mohlo stačit?

Myslím Rezidentní, Firewall, Identity protection, kontrolu pošty, linkskener....

[kristynkai7]

Ahoj jsem zpět,
měl jsi naprostou pravdu, řeklo to že avg tam ještě obtěžuje, tak jsem ho podle tvé rady odinstalovala, snad ho pak zvládnu nainstalovat, přikládám log a jdu na zbytek:

ComboFix 12-07-06.01 - Tomáš 06.07.2012 19:28:39.1.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.1023.685 [GMT 2:00]
Spuštěný z: c:\documents and settings\TomßÜ\Plocha\ComboFix.exe
AV: AVG Internet Security 2011 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: AVG Firewall *Enabled* {8decf618-9569-4340-b34a-d78d28969b66}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Dokumenty\Settings
c:\documents and settings\All Users\Dokumenty\Settings\desktop.ini
c:\windows\system32\Cache
c:\windows\system32\Cache\272512937d9e61a4.fb
c:\windows\system32\Cache\287204568329e189.fb
c:\windows\system32\Cache\28bc8f716fd76a47.fb
c:\windows\system32\Cache\2c53092c95605355.fb
c:\windows\system32\Cache\31a0997e9a5b5eb3.fb
c:\windows\system32\Cache\32c84fe32bb74d60.fb
c:\windows\system32\Cache\3917078cb68ec657.fb
c:\windows\system32\Cache\4f0cf1c8313d9b8b.fb
c:\windows\system32\Cache\590ba23ce359fd0c.fb
c:\windows\system32\Cache\610289e025a3ee9a.fb
c:\windows\system32\Cache\651c5d3cdbfb8bd1.fb
c:\windows\system32\Cache\6c59ac5e7e7a3ad0.fb
c:\windows\system32\Cache\6d03dad1035885d3.fb
c:\windows\system32\Cache\a8556537add6dfc5.fb
c:\windows\system32\Cache\ac283ed5348b6d6b.fb
c:\windows\system32\Cache\ad10a52aff5e038d.fb
c:\windows\system32\Cache\c1fa887b03019701.fb
c:\windows\system32\Cache\c4d28dca2e7648be.fb
c:\windows\system32\Cache\d201ef9910cd39de.fb
c:\windows\system32\Cache\d2e94710a5708128.fb
c:\windows\system32\Cache\d79b9dfe81484ec4.fb
c:\windows\system32\Cache\dacc921b12b2bfa7.fb
c:\windows\system32\Cache\e0de16f883bea794.fb
c:\windows\system32\Cache\f998975c9cc711ee.fb
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-06-06 do 2012-07-06 )))))))))))))))))))))))))))))))
.
.
2012-07-06 17:23 . 2012-07-06 17:23 -------- d-----w- c:\windows\LastGood
2012-07-06 16:15 . 2012-07-06 16:15 512 ----a-w- C:\PhysicalMBR.bin
2012-07-06 15:25 . 2012-07-06 15:25 -------- d-----w- C:\rsit
2012-07-01 15:06 . 2012-07-01 15:06 -------- d-----w- c:\program files\CCleaner
2012-06-14 16:43 . 2012-06-14 16:43 770384 ----a-w- c:\program files\Mozilla Firefox\msvcr100.dll
2012-06-14 16:43 . 2012-06-14 16:43 421200 ----a-w- c:\program files\Mozilla Firefox\msvcp100.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-01 07:20 . 2012-05-27 13:48 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-07-01 07:20 . 2011-08-26 07:27 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-06-23 06:28 . 2011-12-21 16:14 85472 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2011-01-07 13880424]
"RTHDCPL"="RTHDCPL.EXE" [2008-10-28 17331200]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"="start http://www.avg.cz/cz.special-uninstalla ... =10.0.1424" [?]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-17 15360]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2011-05-04 17:54 551296 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2004-08-17 13:49 15360 ----a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2008-10-28 09:18 17331200 ----a-w- c:\windows\RTHDCPL.EXE
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\BitLord\\BitLord.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Opera\\pluginwrapper\\opera_plugin_wrapper.exe"=
.
R1 kbfilter;Keyboard Filter Driver;c:\windows\system32\drivers\kbfilter.sys [13.5.2008 23:44 12856]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [22.7.2011 18:27 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [12.7.2011 23:55 67664]
R1 UsbFltr;WayTechUSBFilterDriver;c:\windows\system32\drivers\UsbFltr.sys [13.5.2008 23:44 8576]
R4 Avgfwdx;Avgfwdx;c:\windows\system32\DRIVERS\avgfwdx.sys --> c:\windows\system32\DRIVERS\avgfwdx.sys [?]
R4 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\AVGIDSDriver.Sys --> c:\windows\system32\DRIVERS\AVGIDSDriver.Sys [?]
R4 AVGIDSEH;AVGIDSEH;c:\windows\system32\DRIVERS\AVGIDSEH.Sys --> c:\windows\system32\DRIVERS\AVGIDSEH.Sys [?]
R4 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\AVGIDSFilter.Sys --> c:\windows\system32\DRIVERS\AVGIDSFilter.Sys [?]
R4 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\AVGIDSShim.Sys --> c:\windows\system32\DRIVERS\AVGIDSShim.Sys [?]
R4 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys --> c:\windows\system32\DRIVERS\avgrkx86.sys [?]
R4 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys --> c:\windows\system32\DRIVERS\avgtdix.sys [?]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [27.5.2012 15:48 250056]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG10\Toolbar\ToolbarBroker.exe --> c:\program files\AVG\AVG10\Toolbar\ToolbarBroker.exe [?]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [11.5.2012 10:03 113120]
S3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys --> c:\windows\system32\DRIVERS\VBoxNetFlt.sys [?]
S4 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCore.exe [12.8.2011 1:38 116608]
.
--- Ostatní služby/ovladače v paměti ---
.
*Deregistered* - Avgldx86
.
Obsah adresáře 'Naplánované úlohy'
.
2012-07-06 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-27 07:20]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
mStart Page = hxxp://www.centrum.cz/?ms=ge
uInternet Settings,ProxyOverride = local
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {{141D2E4F-F313-4991-B61A-EE5D6D849361} - http://bleskove.centrum.cz
IE: {{2A5CFB1C-AAA2-4760-8462-1B61CF74B7D8} - http://www.centrum.cz
IE: {{2BCB61BF-DC41-4738-A149-BDAAAD7FF0BD} - http://www.xchat.cz
IE: {{2E01031B-AB09-4455-823D-25F1A1C11F48} - http://aktualne.centrum.cz
IE: {{2F741D0A-150E-40F9-A602-1B2421475F1D} - http://slovniky.centrum.cz
IE: {{309176E6-E204-40A0-8D13-7F19C0498C40} - http://www.supermapy.cz
IE: {{49681216-5BF4-41A2-AAFA-129A6BD625DA} - http://mp3.centrum.cz/
IE: {{8B6E8E01-D262-4980-8C27-B8B2802285C1} - http://www.zena.cz
IE: {{8FD64249-590C-4FBC-B181-12A6BAF516AF} - http://www.fotoalba.cz
IE: {{A5050656-2286-454F-A489-C605ED1B461C} - http://pocasi.centrum.cz
IE: {{BC78516C-9DC9-40C5-A91E-74593222EF89} - http://sportplus.centrum.cz
IE: {{DAE865E8-970E-4931-A172-119CB56BBAF5} - http://www.digitalne.cz/
IE: {{FC29EB7D-EDBA-4299-AEE4-D1BDC70EFA15} - http://www.stahuj.cz/
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\windows\WebIE.dll
TCP: DhcpNameServer = 213.46.172.36 213.46.172.37
FF - ProfilePath - c:\documents and settings\Tomáš\Data aplikací\Mozilla\Firefox\Profiles\o229hanx.default\
FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7B8e3ff7a3-ab9c-4fb9-bc8d-aa36a31976b1%7D&mid=260f05760bc147d6b718d15097b81e08-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&ds=AVG&v=9.0.0.18.1&lang=cz&pr=pa&d=2011-12-01%2014%3A59%3A34&sap=ku&q=
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
URLSearchHooks-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file)
HKLM-Run-ROC_roc_dec12 - c:\program files\AVG Secure Search\ROC_roc_dec12.exe
Notify-AtiExtEvent - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-07-06 19:33
Windows 5.1.2600 Service Pack 2 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-1220945662-2077806209-725345543-1004\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(976)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
Celkový čas: 2012-07-06 19:35:18
ComboFix-quarantined-files.txt 2012-07-06 17:35
.
Před spuštěním: Volných bajtů: 119 793 324 032
Po spuštění: Volných bajtů: 119 774 408 704
.
WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - 15EAA7AE0C9AC5D7C08F5D2488D93B25

edit
Dobře, snad se ještě dnes vrátíš, já zatím zkusím ten zbytek....

[kristynkai7]

Log z TDSSKilleru

19:40:54.0546 1504 TDSS rootkit removing tool 2.7.44.0 Jul 2 2012 20:01:08
19:40:54.0890 1504 ============================================================
19:40:54.0890 1504 Current date / time: 2012/07/06 19:40:54.0890
19:40:54.0890 1504 SystemInfo:
19:40:54.0890 1504
19:40:54.0890 1504 OS Version: 5.1.2600 ServicePack: 2.0
19:40:54.0890 1504 Product type: Workstation
19:40:54.0890 1504 ComputerName: DOMA
19:40:54.0890 1504 UserName: Tomáš
19:40:54.0890 1504 Windows directory: C:\WINDOWS
19:40:54.0890 1504 System windows directory: C:\WINDOWS
19:40:54.0890 1504 Processor architecture: Intel x86
19:40:54.0890 1504 Number of processors: 2
19:40:54.0890 1504 Page size: 0x1000
19:40:54.0890 1504 Boot type: Normal boot
19:40:54.0890 1504 ============================================================
19:40:55.0812 1504 Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
19:40:55.0812 1504 ============================================================
19:40:55.0812 1504 \Device\Harddisk0\DR0:
19:40:55.0812 1504 MBR partitions:
19:40:55.0812 1504 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x12A14BC1
19:40:55.0812 1504 ============================================================
19:40:55.0828 1504 C: <-> \Device\Harddisk0\DR0\Partition0
19:40:55.0828 1504 ============================================================
19:40:55.0828 1504 Initialize success
19:40:55.0828 1504 ============================================================
19:41:42.0546 1420 ============================================================
19:41:42.0546 1420 Scan started
19:41:42.0546 1420 Mode: Manual; SigCheck; TDLFS;
19:41:42.0546 1420 ============================================================
19:41:42.0859 1420 !SASCORE (c0393eb99a6c72c6bef9bfc4a72b33a6) C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
19:41:43.0031 1420 !SASCORE ( UnsignedFile.Multi.Generic ) - warning
19:41:43.0031 1420 !SASCORE - detected UnsignedFile.Multi.Generic (1)
19:41:43.0109 1420 Abiosdsk - ok
19:41:43.0125 1420 abp480n5 - ok
19:41:43.0156 1420 ACPI (fa2fbcda96d2385f773b059fe5a125a6) C:\WINDOWS\system32\DRIVERS\ACPI.sys
19:41:43.0406 1420 ACPI - ok
19:41:43.0437 1420 ACPIEC (afdff022a01f0b11c776f0860c3b282f) C:\WINDOWS\system32\drivers\ACPIEC.sys
19:41:43.0593 1420 ACPIEC - ok
19:41:43.0703 1420 AdobeFlashPlayerUpdateSvc (990dc6edc9f933194d7cd4e65146bc94) C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
19:41:43.0734 1420 AdobeFlashPlayerUpdateSvc ( UnsignedFile.Multi.Generic ) - warning
19:41:43.0734 1420 AdobeFlashPlayerUpdateSvc - detected UnsignedFile.Multi.Generic (1)
19:41:43.0734 1420 adpu160m - ok
19:41:43.0796 1420 aec (841f385c6cfaf66b58fbd898722bb4f0) C:\WINDOWS\system32\drivers\aec.sys
19:41:43.0968 1420 aec - ok
19:41:44.0031 1420 AFD (5ac495f4cb807b2b98ad2ad591e6d92e) C:\WINDOWS\System32\drivers\afd.sys
19:41:44.0203 1420 AFD - ok
19:41:44.0203 1420 Aha154x - ok
19:41:44.0218 1420 aic78u2 - ok
19:41:44.0218 1420 aic78xx - ok
19:41:44.0250 1420 Alerter (026ddaa7e6f8d49df82c7a98bae5d0d1) C:\WINDOWS\system32\alrsvc.dll
19:41:44.0421 1420 Alerter - ok
19:41:44.0453 1420 ALG (b3f690bf43f93a012a52f28f234faa1b) C:\WINDOWS\System32\alg.exe
19:41:44.0562 1420 ALG - ok
19:41:44.0562 1420 AliIde - ok
19:41:44.0578 1420 amsint - ok
19:41:44.0609 1420 AppMgmt (421184f91eae5c6e78e653c6b32aae84) C:\WINDOWS\System32\appmgmts.dll
19:41:44.0703 1420 AppMgmt - ok
19:41:44.0718 1420 asc - ok
19:41:44.0718 1420 asc3350p - ok
19:41:44.0734 1420 asc3550 - ok
19:41:44.0765 1420 AsyncMac (02000abf34af4c218c35d257024807d6) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
19:41:44.0953 1420 AsyncMac - ok
19:41:45.0000 1420 atapi (cdfe4411a69c224bd1d11b2da92dac51) C:\WINDOWS\system32\DRIVERS\atapi.sys
19:41:45.0140 1420 atapi - ok
19:41:45.0156 1420 Atdisk - ok
19:41:45.0218 1420 Atmarpc (ec88da854ab7d7752ec8be11a741bb7f) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
19:41:45.0406 1420 Atmarpc - ok
19:41:45.0437 1420 AudioSrv (40d78f514c8588ef12ec718d2af0fc4e) C:\WINDOWS\System32\audiosrv.dll
19:41:45.0625 1420 AudioSrv - ok
19:41:45.0656 1420 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
19:41:45.0843 1420 audstub - ok
19:41:45.0875 1420 AVG Security Toolbar Service - ok
19:41:45.0890 1420 Avgfwdx - ok
19:41:45.0890 1420 AVGIDSDriver - ok
19:41:45.0906 1420 AVGIDSEH - ok
19:41:45.0921 1420 AVGIDSFilter - ok
19:41:45.0921 1420 AVGIDSShim - ok
19:41:45.0937 1420 Avgrkx86 - ok
19:41:45.0937 1420 Avgtdix - ok
19:41:46.0000 1420 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
19:41:46.0187 1420 Beep - ok
19:41:46.0234 1420 BITS (e774a26610ec92674273486612c11cfc) C:\WINDOWS\system32\qmgr.dll
19:41:46.0421 1420 BITS - ok
19:41:46.0453 1420 Browser (f219e27e88107a50544153898dd8178e) C:\WINDOWS\System32\browser.dll
19:41:46.0640 1420 Browser - ok
19:41:46.0812 1420 catchme - ok
19:41:46.0859 1420 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
19:41:47.0031 1420 cbidf2k - ok
19:41:47.0031 1420 cd20xrnt - ok
19:41:47.0078 1420 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
19:41:47.0265 1420 Cdaudio - ok
19:41:47.0312 1420 Cdfs (cd7d5152df32b47f4e36f710b35aae02) C:\WINDOWS\system32\drivers\Cdfs.sys
19:41:47.0500 1420 Cdfs - ok
19:41:47.0531 1420 Cdrom (af9c19b3100fe010496b1a27181fbf72) C:\WINDOWS\system32\DRIVERS\cdrom.sys
19:41:47.0718 1420 Cdrom - ok
19:41:47.0734 1420 Changer - ok
19:41:47.0765 1420 CiSvc (9e21229e04e1d301bb40222fe4641cb2) C:\WINDOWS\system32\cisvc.exe
19:41:47.0953 1420 CiSvc - ok
19:41:47.0984 1420 ClipSrv (d3dc45553c8025338e08a60e95b1b91d) C:\WINDOWS\system32\clipsrv.exe
19:41:48.0171 1420 ClipSrv - ok
19:41:48.0187 1420 CmdIde - ok
19:41:48.0187 1420 COMSysApp - ok
19:41:48.0218 1420 Cpqarray - ok
19:41:48.0250 1420 CryptSvc (70d2a1756f4b2067658a186c963fcabd) C:\WINDOWS\System32\cryptsvc.dll
19:41:48.0453 1420 CryptSvc - ok
19:41:48.0453 1420 dac2w2k - ok
19:41:48.0468 1420 dac960nt - ok
19:41:48.0515 1420 DcomLaunch (c72c15ee57e248c66e57c76cab086cf2) C:\WINDOWS\system32\rpcss.dll
19:41:48.0703 1420 DcomLaunch - ok
19:41:48.0750 1420 Dhcp (562830efb7cf367fb773fea5256e67c8) C:\WINDOWS\System32\dhcpcsvc.dll
19:41:48.0921 1420 Dhcp - ok
19:41:49.0015 1420 Disk (00ca44e4534865f8a3b64f7c0984bff0) C:\WINDOWS\system32\DRIVERS\disk.sys
19:41:49.0187 1420 Disk - ok
19:41:49.0203 1420 dmadmin - ok
19:41:49.0281 1420 dmboot (e1968edec81c430108feb23ab07bdb14) C:\WINDOWS\system32\drivers\dmboot.sys
19:41:49.0468 1420 dmboot - ok
19:41:49.0531 1420 dmio (1b1520a82e396e46b9ae9fa6b03ff6c6) C:\WINDOWS\system32\drivers\dmio.sys
19:41:49.0703 1420 dmio - ok
19:41:49.0750 1420 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
19:41:49.0937 1420 dmload - ok
19:41:49.0984 1420 dmserver (7b3ca72885923eb947221f17f3e3ac59) C:\WINDOWS\System32\dmserver.dll
19:41:50.0171 1420 dmserver - ok
19:41:50.0218 1420 DMusic (a6f881284ac1150e37d9ae47ff601267) C:\WINDOWS\system32\drivers\DMusic.sys
19:41:50.0406 1420 DMusic - ok
19:41:50.0453 1420 Dnscache (f605b3f5674d67587c4b6c9e92a3e025) C:\WINDOWS\System32\dnsrslvr.dll
19:41:50.0640 1420 Dnscache - ok
19:41:50.0656 1420 dpti2o - ok
19:41:50.0703 1420 drmkaud (1ed4dbbae9f5d558dbba4cc450e3eb2e) C:\WINDOWS\system32\drivers\drmkaud.sys
19:41:50.0875 1420 drmkaud - ok
19:41:50.0906 1420 ERSvc (d6f7428b201e33bc80066b47144cb568) C:\WINDOWS\System32\ersvc.dll
19:41:51.0093 1420 ERSvc - ok
19:41:51.0140 1420 Eventlog (6e401e61f952fbbf708afbecefafae81) C:\WINDOWS\system32\services.exe
19:41:51.0312 1420 Eventlog - ok
19:41:51.0359 1420 EventSystem (972378b907070f64932a87c90a035487) C:\WINDOWS\system32\es.dll
19:41:51.0546 1420 EventSystem - ok
19:41:51.0578 1420 Fastfat (3117f595e9615e04f05a54fc15a03b20) C:\WINDOWS\system32\drivers\Fastfat.sys
19:41:51.0750 1420 Fastfat - ok
19:41:51.0812 1420 FastUserSwitchingCompatibility (8ba76bd2a943f642f267a296a15776d2) C:\WINDOWS\System32\shsvcs.dll
19:41:51.0984 1420 FastUserSwitchingCompatibility - ok
19:41:52.0031 1420 Fdc (ced2e8396a8838e59d8fd529c680e02c) C:\WINDOWS\system32\DRIVERS\fdc.sys
19:41:52.0218 1420 Fdc - ok
19:41:52.0265 1420 Fips (266dab58619b17bdf37fabbd48d875ca) C:\WINDOWS\system32\drivers\Fips.sys
19:41:52.0437 1420 Fips - ok
19:41:52.0500 1420 Flpydisk (0dd1de43115b93f4d85e889d7a86f548) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
19:41:52.0703 1420 Flpydisk - ok
19:41:52.0734 1420 FltMgr (157754f0df355a9e0a6f54721914f9c6) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
19:41:52.0906 1420 FltMgr - ok
19:41:52.0968 1420 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
19:41:53.0156 1420 Fs_Rec - ok
19:41:53.0156 1420 Ftdisk (4e664d8541db4a66b73a24257e322e1f) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
19:41:53.0343 1420 Ftdisk - ok
19:41:53.0375 1420 Gpc (c0f1d4a21de5a415df8170616703debf) C:\WINDOWS\system32\DRIVERS\msgpc.sys
19:41:53.0562 1420 Gpc - ok
19:41:53.0609 1420 HDAudBus (3fcc124b6e08ee0e9351f717dd136939) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
19:41:53.0656 1420 HDAudBus - ok
19:41:53.0750 1420 helpsvc (f59152272782fed8a8197fa788287f68) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
19:41:53.0937 1420 helpsvc - ok
19:41:53.0937 1420 HidServ - ok
19:41:53.0984 1420 HidUsb (1de6783b918f540149aa69943bdfeba8) C:\WINDOWS\system32\DRIVERS\hidusb.sys
19:41:54.0171 1420 HidUsb - ok
19:41:54.0171 1420 hpn - ok
19:41:54.0234 1420 HTTP (c19b522a9ae0bbc3293397f3055e80a1) C:\WINDOWS\system32\Drivers\HTTP.sys
19:41:54.0421 1420 HTTP - ok
19:41:54.0437 1420 HTTPFilter (da826826c5c9116f47e0cd0ca8cc7c11) C:\WINDOWS\System32\w3ssl.dll
19:41:54.0625 1420 HTTPFilter - ok
19:41:54.0625 1420 i2omgmt - ok
19:41:54.0640 1420 i2omp - ok
19:41:54.0687 1420 i8042prt (0f42de9909b5dbf2c48dd1a79d491af5) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
19:41:54.0875 1420 i8042prt - ok
19:41:54.0921 1420 Imapi (f8aa320c6a0409c0380e5d8a99d76ec6) C:\WINDOWS\system32\DRIVERS\imapi.sys
19:41:55.0109 1420 Imapi - ok
19:41:55.0140 1420 ImapiService (cf9d286b34cb4912f3b28b4972d5cb33) C:\WINDOWS\system32\imapi.exe
19:41:55.0328 1420 ImapiService - ok
19:41:55.0328 1420 ini910u - ok
19:41:55.0562 1420 IntcAzAudAddService (19d3781892a3794672cd1962f3d8d3b8) C:\WINDOWS\system32\drivers\RtkHDAud.sys
19:41:55.0796 1420 IntcAzAudAddService - ok
19:41:55.0875 1420 IntelIde - ok
19:41:55.0937 1420 intelppm (10a3ac0f0df720ad3c3fd13861d50eb9) C:\WINDOWS\system32\DRIVERS\intelppm.sys
19:41:56.0109 1420 intelppm - ok
19:41:56.0140 1420 Ip6Fw (4448006b6bc60e6c027932cfc38d6855) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
19:41:56.0312 1420 Ip6Fw - ok
19:41:56.0359 1420 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
19:41:56.0531 1420 IpFilterDriver - ok
19:41:56.0578 1420 IpInIp (e1ec7f5da720b640cd8fb8424f1b14bb) C:\WINDOWS\system32\DRIVERS\ipinip.sys
19:41:56.0765 1420 IpInIp - ok
19:41:56.0796 1420 IpNat (b5a8e215ac29d24d60b4d1250ef05ace) C:\WINDOWS\system32\DRIVERS\ipnat.sys
19:41:56.0984 1420 IpNat - ok
19:41:57.0015 1420 IPSec (64537aa5c003a6afeee1df819062d0d1) C:\WINDOWS\system32\DRIVERS\ipsec.sys
19:41:57.0203 1420 IPSec - ok
19:41:57.0234 1420 IRENUM (50708daa1b1cbb7d6ac1cf8f56a24410) C:\WINDOWS\system32\DRIVERS\irenum.sys
19:41:57.0328 1420 IRENUM - ok
19:41:57.0375 1420 isapnp (1091528512e4dd7ed5fddcc4df1c53d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
19:41:57.0515 1420 isapnp - ok
19:41:57.0578 1420 Kbdclass (6f877bf8dc01a550cd666f3bedb2213c) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
19:41:57.0734 1420 Kbdclass - ok
19:41:57.0781 1420 kbfilter (5c8d9984005f4d67ac58a94fb05aff2e) C:\WINDOWS\system32\drivers\kbfilter.sys
19:41:57.0781 1420 kbfilter ( UnsignedFile.Multi.Generic ) - warning
19:41:57.0781 1420 kbfilter - detected UnsignedFile.Multi.Generic (1)
19:41:57.0828 1420 kmixer (d93cad07c5683db066b0b2d2d3790ead) C:\WINDOWS\system32\drivers\kmixer.sys
19:41:57.0984 1420 kmixer - ok
19:41:58.0031 1420 KSecDD (eb7ffe87fd367ea8fca0506f74a87fbb) C:\WINDOWS\system32\drivers\KSecDD.sys
19:41:58.0218 1420 KSecDD - ok
19:41:58.0265 1420 lanmanserver (6d6bdd68b775986577c48a8df961a05c) C:\WINDOWS\System32\srvsvc.dll
19:41:58.0453 1420 lanmanserver - ok
19:41:58.0500 1420 lanmanworkstation (69b0569aae33f0d5057ca0e8577aaf07) C:\WINDOWS\System32\wkssvc.dll
19:41:58.0671 1420 lanmanworkstation - ok
19:41:58.0687 1420 lbrtfdc - ok
19:41:58.0734 1420 LmHosts (f9ee6d2aab0690b34ae35ba9921a1414) C:\WINDOWS\System32\lmhsvc.dll
19:41:58.0906 1420 LmHosts - ok
19:41:59.0015 1420 MDM (11f714f85530a2bd134074dc30e99fca) C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
19:41:59.0031 1420 MDM - ok
19:41:59.0078 1420 Messenger (8b2fcbd881879b55be40b41f12ffc431) C:\WINDOWS\System32\msgsvc.dll
19:41:59.0250 1420 Messenger - ok
19:41:59.0296 1420 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
19:41:59.0468 1420 mnmdd - ok
19:41:59.0515 1420 mnmsrvc (7d137132d6a9b41ef800e59a771ed48c) C:\WINDOWS\system32\mnmsrvc.exe
19:41:59.0687 1420 mnmsrvc - ok
19:41:59.0718 1420 Modem (60210deb037846afe521ebf349964f6b) C:\WINDOWS\system32\drivers\Modem.sys
19:41:59.0875 1420 Modem - ok
19:41:59.0906 1420 Mouclass (b160ec94114715675509115986400fd9) C:\WINDOWS\system32\DRIVERS\mouclass.sys
19:42:00.0093 1420 Mouclass - ok
19:42:00.0140 1420 mouhid (bb269eba740737ab749b214d568b6812) C:\WINDOWS\system32\DRIVERS\mouhid.sys
19:42:00.0296 1420 mouhid - ok
19:42:00.0343 1420 MountMgr (65653f3b4477f3c63e68a9659f85ee2e) C:\WINDOWS\system32\drivers\MountMgr.sys
19:42:00.0531 1420 MountMgr - ok
19:42:00.0578 1420 MozillaMaintenance (15d5398eed42c2504bb3d4fc875c15d1) C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
19:42:00.0593 1420 MozillaMaintenance - ok
19:42:00.0593 1420 mraid35x - ok
19:42:00.0625 1420 MRxDAV (46edcc8f2db2f322c24f48785cb46366) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
19:42:00.0796 1420 MRxDAV - ok
19:42:00.0875 1420 MRxSmb (1fd607fc67f7f7c633c3da65bfc53d18) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
19:42:01.0062 1420 MRxSmb - ok
19:42:01.0093 1420 MSDTC (944a24032aed84c59455b981f6ca1c1a) C:\WINDOWS\system32\msdtc.exe
19:42:01.0281 1420 MSDTC - ok
19:42:01.0312 1420 Msfs (561b3a4333ca2dbdba28b5b956822519) C:\WINDOWS\system32\drivers\Msfs.sys
19:42:01.0468 1420 Msfs - ok
19:42:01.0484 1420 MSIServer - ok
19:42:01.0515 1420 MSKSSRV (ae431a8dd3c1d0d0610cdbac16057ad0) C:\WINDOWS\system32\drivers\MSKSSRV.sys
19:42:01.0687 1420 MSKSSRV - ok
19:42:01.0718 1420 MSPCLOCK (13e75fef9dfeb08eeded9d0246e1f448) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
19:42:01.0890 1420 MSPCLOCK - ok
19:42:01.0906 1420 MSPQM (1988a33ff19242576c3d0ef9ce785da7) C:\WINDOWS\system32\drivers\MSPQM.sys
19:42:02.0046 1420 MSPQM - ok
19:42:02.0093 1420 mssmbios (469541f8bfd2b32659d5d463a6714bce) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
19:42:02.0265 1420 mssmbios - ok
19:42:02.0296 1420 Mup (82035e0f41c2dd05ae41d27fe6cf7de1) C:\WINDOWS\system32\drivers\Mup.sys
19:42:02.0437 1420 Mup - ok
19:42:02.0453 1420 NDIS (558635d3af1c7546d26067d5d9b6959e) C:\WINDOWS\system32\drivers\NDIS.sys
19:42:02.0625 1420 NDIS - ok
19:42:02.0656 1420 NdisTapi (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
19:42:02.0828 1420 NdisTapi - ok
19:42:02.0890 1420 Ndisuio (34d6cd56409da9a7ed573e1c90a308bf) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
19:42:03.0031 1420 Ndisuio - ok
19:42:03.0093 1420 NdisWan (0b90e255a9490166ab368cd55a529893) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
19:42:03.0265 1420 NdisWan - ok
19:42:03.0312 1420 NDProxy (59fc3fb44d2669bc144fd87826bb571f) C:\WINDOWS\system32\drivers\NDProxy.sys
19:42:03.0484 1420 NDProxy - ok
19:42:03.0515 1420 NetBIOS (3a2aca8fc1d7786902ca434998d7ceb4) C:\WINDOWS\system32\DRIVERS\netbios.sys
19:42:03.0687 1420 NetBIOS - ok
19:42:03.0718 1420 NetBT (0c80e410cd2f47134407ee7dd19cc86b) C:\WINDOWS\system32\DRIVERS\netbt.sys
19:42:03.0906 1420 NetBT - ok
19:42:03.0953 1420 NetDDE (818053225bf4aac5f0f718001e492f70) C:\WINDOWS\system32\netdde.exe
19:42:04.0109 1420 NetDDE - ok
19:42:04.0109 1420 NetDDEdsdm (818053225bf4aac5f0f718001e492f70) C:\WINDOWS\system32\netdde.exe
19:42:04.0265 1420 NetDDEdsdm - ok
19:42:04.0312 1420 Netlogon (82a362fe1d4980b71b588d9c10748511) C:\WINDOWS\system32\lsass.exe
19:42:04.0484 1420 Netlogon - ok
19:42:04.0546 1420 Netman (af342d2781225a8769686e0d47e3123e) C:\WINDOWS\System32\netman.dll
19:42:04.0718 1420 Netman - ok
19:42:04.0765 1420 Nla (64c078bd4efd441c3f159edc5ea4420a) C:\WINDOWS\System32\mswsock.dll
19:42:04.0937 1420 Nla - ok
19:42:04.0968 1420 Npfs (4f601bcb8f64ea3ac0994f98fed03f8e) C:\WINDOWS\system32\drivers\Npfs.sys
19:42:05.0140 1420 Npfs - ok
19:42:05.0218 1420 Ntfs (b78be402c3f63dd55521f73876951cdd) C:\WINDOWS\system32\drivers\Ntfs.sys
19:42:05.0390 1420 Ntfs - ok
19:42:05.0390 1420 NtLmSsp (82a362fe1d4980b71b588d9c10748511) C:\WINDOWS\system32\lsass.exe
19:42:05.0546 1420 NtLmSsp - ok
19:42:05.0593 1420 NtmsSvc (d8d2b13ba93ae830b1a637df571d1195) C:\WINDOWS\system32\ntmssvc.dll
19:42:05.0765 1420 NtmsSvc - ok
19:42:05.0812 1420 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
19:42:05.0984 1420 Null - ok
19:42:06.0437 1420 nv (18c9b152da7bea76b2f9e4b6412e0aaf) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
19:42:06.0765 1420 nv - ok
19:42:06.0906 1420 NVSvc (a8c1e6ff53fb0628a302843ea5fa5ab6) C:\WINDOWS\system32\nvsvc32.exe
19:42:06.0921 1420 NVSvc - ok
19:42:06.0968 1420 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
19:42:07.0140 1420 NwlnkFlt - ok
19:42:07.0171 1420 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
19:42:07.0343 1420 NwlnkFwd - ok
19:42:07.0437 1420 ose (7a56cf3e3f12e8af599963b16f50fb6a) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
19:42:07.0453 1420 ose - ok
19:42:07.0515 1420 Parport (76a18caa2fefb28a4ced38d76837e86e) C:\WINDOWS\system32\DRIVERS\parport.sys
19:42:07.0671 1420 Parport - ok
19:42:07.0718 1420 PartMgr (3334430c29dc338092f79c38ef7b4cd0) C:\WINDOWS\system32\drivers\PartMgr.sys
19:42:07.0875 1420 PartMgr - ok
19:42:07.0921 1420 ParVdm (1fae19d0457176318bba4a8795656ebc) C:\WINDOWS\system32\drivers\ParVdm.sys
19:42:08.0062 1420 ParVdm - ok
19:42:08.0125 1420 PCI (b7979f37bb7b9df2230046134955e6e7) C:\WINDOWS\system32\DRIVERS\pci.sys
19:42:08.0281 1420 PCI - ok
19:42:08.0296 1420 PCIDump - ok
19:42:08.0343 1420 PCIIde (2da4ec85e0ea7a45c6b2a05820492d5a) C:\WINDOWS\system32\DRIVERS\pciide.sys
19:42:08.0484 1420 PCIIde - ok
19:42:08.0515 1420 Pcmcia (90505755634407d4ef4c6dea60fc1df9) C:\WINDOWS\system32\drivers\Pcmcia.sys
19:42:08.0671 1420 Pcmcia - ok
19:42:08.0671 1420 PDCOMP - ok
19:42:08.0687 1420 PDFRAME - ok
19:42:08.0687 1420 PDRELI - ok
19:42:08.0703 1420 PDRFRAME - ok
19:42:08.0703 1420 perc2 - ok
19:42:08.0718 1420 perc2hib - ok
19:42:08.0781 1420 PlugPlay (6e401e61f952fbbf708afbecefafae81) C:\WINDOWS\system32\services.exe
19:42:08.0921 1420 PlugPlay - ok
19:42:08.0937 1420 PolicyAgent (82a362fe1d4980b71b588d9c10748511) C:\WINDOWS\system32\lsass.exe
19:42:09.0078 1420 PolicyAgent - ok
19:42:09.0125 1420 PptpMiniport (1c5cc65aac0783c344f16353e60b72ac) C:\WINDOWS\system32\DRIVERS\raspptp.sys
19:42:09.0296 1420 PptpMiniport - ok
19:42:09.0296 1420 ProtectedStorage (82a362fe1d4980b71b588d9c10748511) C:\WINDOWS\system32\lsass.exe
19:42:09.0453 1420 ProtectedStorage - ok
19:42:09.0484 1420 PSched (48671f327553dcf1d27f6197f622a668) C:\WINDOWS\system32\DRIVERS\psched.sys
19:42:09.0656 1420 PSched - ok
19:42:09.0656 1420 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
19:42:09.0812 1420 Ptilink - ok
19:42:09.0859 1420 PxHelp20 (d86b4a68565e444d76457f14172c875a) C:\WINDOWS\system32\Drivers\PxHelp20.sys
19:42:09.0875 1420 PxHelp20 - ok
19:42:09.0890 1420 ql1080 - ok
19:42:09.0890 1420 Ql10wnt - ok
19:42:09.0906 1420 ql12160 - ok
19:42:09.0906 1420 ql1240 - ok
19:42:09.0921 1420 ql1280 - ok
19:42:09.0953 1420 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
19:42:10.0125 1420 RasAcd - ok
19:42:10.0156 1420 RasAuto (e68b6f9a726a444059705ab43b5656d1) C:\WINDOWS\System32\rasauto.dll
19:42:10.0312 1420 RasAuto - ok
19:42:10.0343 1420 Rasl2tp (98faeb4a4dcf812ba1c6fca4aa3e115c) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
19:42:10.0500 1420 Rasl2tp - ok
19:42:10.0546 1420 RasMan (6e519d777c91e90592403c9f981fdf03) C:\WINDOWS\System32\rasmans.dll
19:42:10.0687 1420 RasMan - ok
19:42:10.0703 1420 RasPppoe (7306eeed8895454cbed4669be9f79faa) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
19:42:10.0875 1420 RasPppoe - ok
19:42:10.0906 1420 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
19:42:11.0078 1420 Raspti - ok
19:42:11.0109 1420 Rdbss (29d66245adba878fff574cd66abd2884) C:\WINDOWS\system32\DRIVERS\rdbss.sys
19:42:11.0281 1420 Rdbss - ok
19:42:11.0312 1420 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
19:42:11.0484 1420 RDPCDD - ok
19:42:11.0531 1420 rdpdr (a2cae2c60bc37e0751ef9dda7ceaf4ad) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
19:42:11.0703 1420 rdpdr - ok
19:42:11.0734 1420 RDPWD (d4f5643d7714ef499ae9527fdcd50894) C:\WINDOWS\system32\drivers\RDPWD.sys
19:42:11.0890 1420 RDPWD - ok
19:42:11.0937 1420 RDSessMgr (125acf258da9633f748131a0e0185af3) C:\WINDOWS\system32\sessmgr.exe
19:42:12.0125 1420 RDSessMgr - ok
19:42:12.0171 1420 redbook (aba13d33e1f888c9a68599a48a8840d6) C:\WINDOWS\system32\DRIVERS\redbook.sys
19:42:12.0312 1420 redbook - ok
19:42:12.0359 1420 RemoteAccess (eb5e1a601e5a1908a87e4d5a41803d98) C:\WINDOWS\System32\mprdim.dll
19:42:12.0515 1420 RemoteAccess - ok
19:42:12.0562 1420 RemoteRegistry (5b21208fcf8970bb61fe98e19d828714) C:\WINDOWS\system32\regsvc.dll
19:42:12.0734 1420 RemoteRegistry - ok
19:42:12.0781 1420 RpcLocator (c8a3b668985d61249f2dc71716c58de8) C:\WINDOWS\system32\locator.exe
19:42:12.0937 1420 RpcLocator - ok
19:42:12.0984 1420 RpcSs (c72c15ee57e248c66e57c76cab086cf2) C:\WINDOWS\System32\rpcss.dll
19:42:13.0140 1420 RpcSs - ok
19:42:13.0203 1420 RSVP (09ab2e71e58b078038e3bfdba7ffc984) C:\WINDOWS\system32\rsvp.exe
19:42:13.0375 1420 RSVP - ok
19:42:13.0406 1420 rtl8139 (d507c1400284176573224903819ffda3) C:\WINDOWS\system32\DRIVERS\RTL8139.SYS
19:42:13.0546 1420 rtl8139 - ok
19:42:13.0593 1420 RTLE8023xp (839141088ad7ee90f5b441b2d1afd22c) C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys
19:42:13.0640 1420 RTLE8023xp - ok
19:42:13.0671 1420 SamSs (82a362fe1d4980b71b588d9c10748511) C:\WINDOWS\system32\lsass.exe
19:42:13.0812 1420 SamSs - ok
19:42:13.0968 1420 SASDIFSV (39763504067962108505bff25f024345) C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
19:42:13.0968 1420 SASDIFSV - ok
19:42:13.0984 1420 SASKUTIL (77b9fc20084b48408ad3e87570eb4a85) C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
19:42:14.0000 1420 SASKUTIL - ok
19:42:14.0031 1420 SCardSvr (c177354e995cc1aa1f767bcd9980434a) C:\WINDOWS\System32\SCardSvr.exe
19:42:14.0203 1420 SCardSvr - ok
19:42:14.0265 1420 Schedule (29ac93307c6182dbe336bca314947f28) C:\WINDOWS\system32\schedsvc.dll
19:42:14.0437 1420 Schedule - ok
19:42:14.0468 1420 Secdrv (d26e26ea516450af9d072635c60387f4) C:\WINDOWS\system32\DRIVERS\secdrv.sys
19:42:14.0546 1420 Secdrv - ok
19:42:14.0593 1420 seclogon (c76cb8a133374fac6805f83ff7b7da03) C:\WINDOWS\System32\seclogon.dll
19:42:14.0765 1420 seclogon - ok
19:42:14.0796 1420 SENS (220ad85ba9c5b3011296354011b901cc) C:\WINDOWS\system32\sens.dll
19:42:14.0953 1420 SENS - ok
19:42:15.0000 1420 serenum (a2d868aeeff612e70e213c451a70cafb) C:\WINDOWS\system32\DRIVERS\serenum.sys
19:42:15.0171 1420 serenum - ok
19:42:15.0218 1420 Serial (c1ddbc85251551a840212999da3d95f3) C:\WINDOWS\system32\DRIVERS\serial.sys
19:42:15.0375 1420 Serial - ok
19:42:15.0421 1420 Sfloppy (0d13b6df6e9e101013a7afb0ce629fe0) C:\WINDOWS\system32\drivers\Sfloppy.sys
19:42:15.0593 1420 Sfloppy - ok
19:42:15.0656 1420 SharedAccess (6a93501bcdebf159109429b022c0ff83) C:\WINDOWS\System32\ipnathlp.dll
19:42:15.0812 1420 SharedAccess - ok
19:42:15.0890 1420 ShellHWDetection (8ba76bd2a943f642f267a296a15776d2) C:\WINDOWS\System32\shsvcs.dll
19:42:16.0031 1420 ShellHWDetection - ok
19:42:16.0046 1420 Simbad - ok
19:42:16.0109 1420 SMBios (d72a21424ca66c7a745bd995eca6a710) C:\WINDOWS\system32\DRIVERS\SMBios.sys
19:42:16.0125 1420 SMBios ( UnsignedFile.Multi.Generic ) - warning
19:42:16.0140 1420 SMBios - detected UnsignedFile.Multi.Generic (1)
19:42:16.0140 1420 Sparrow - ok
19:42:16.0187 1420 splitter (8e186b8f23295d1e42c573b82b80d548) C:\WINDOWS\system32\drivers\splitter.sys
19:42:16.0359 1420 splitter - ok
19:42:16.0406 1420 Spooler (21b6faa88044a41640e03ebb68be93e8) C:\WINDOWS\system32\spoolsv.exe
19:42:16.0578 1420 Spooler - ok
19:42:16.0609 1420 sr (a74035ea526db97d9d50d2143a55f5cf) C:\WINDOWS\system32\DRIVERS\sr.sys
19:42:16.0718 1420 sr - ok
19:42:16.0765 1420 srservice (3cd57f31a64d32fdb28918b16d1e6aac) C:\WINDOWS\system32\srsvc.dll
19:42:16.0890 1420 srservice - ok
19:42:16.0953 1420 Srv (20b7e396720353e4117d64d9dcb926ca) C:\WINDOWS\system32\DRIVERS\srv.sys
19:42:17.0125 1420 Srv - ok
19:42:17.0421 1420 SSDPSRV (88c28f53f53438dafcd95e99c837c61e) C:\WINDOWS\System32\ssdpsrv.dll
19:42:17.0515 1420 SSDPSRV - ok
19:42:17.0640 1420 stisvc (0645ccdddd27f96eea3534c1def736d9) C:\WINDOWS\system32\wiaservc.dll
19:42:17.0843 1420 stisvc - ok
19:42:17.0890 1420 swenum (03c1bae4766e2450219d20b993d6e046) C:\WINDOWS\system32\DRIVERS\swenum.sys
19:42:18.0046 1420 swenum - ok
19:42:18.0093 1420 swmidi (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS\system32\drivers\swmidi.sys
19:42:18.0250 1420 swmidi - ok
19:42:18.0250 1420 SwPrv - ok
19:42:18.0265 1420 symc810 - ok
19:42:18.0265 1420 symc8xx - ok
19:42:18.0281 1420 sym_hi - ok
19:42:18.0281 1420 sym_u3 - ok
19:42:18.0328 1420 sysaudio (650ad082d46bac0e64c9c0e0928492fd) C:\WINDOWS\system32\drivers\sysaudio.sys
19:42:18.0484 1420 sysaudio - ok
19:42:18.0546 1420 SysmonLog (d9c9ecff4904e6151525c533aeedf8f4) C:\WINDOWS\system32\smlogsvc.exe
19:42:18.0828 1420 SysmonLog - ok
19:42:18.0890 1420 TapiSrv (37162d29cd61519e6f5ea0de99786ff6) C:\WINDOWS\System32\tapisrv.dll
19:42:19.0156 1420 TapiSrv - ok
19:42:19.0203 1420 Tcpip (9f4b36614a0fc234525ba224957de55c) C:\WINDOWS\system32\DRIVERS\tcpip.sys
19:42:19.0390 1420 Tcpip - ok
19:42:19.0421 1420 TDPIPE (38d437cf2d98965f239b0abcd66dcb0f) C:\WINDOWS\system32\drivers\TDPIPE.sys
19:42:19.0578 1420 TDPIPE - ok
19:42:19.0593 1420 TDTCP (ed0580af02502d00ad8c4c066b156be9) C:\WINDOWS\system32\drivers\TDTCP.sys
19:42:19.0750 1420 TDTCP - ok
19:42:19.0781 1420 TermDD (a540a99c281d933f3d69d55e48727f47) C:\WINDOWS\system32\DRIVERS\termdd.sys
19:42:19.0953 1420 TermDD - ok
19:42:20.0015 1420 TermService (2f5919f2f6ee7a845893d9c3aa2bc56a) C:\WINDOWS\System32\termsrv.dll
19:42:20.0218 1420 TermService - ok
19:42:20.0281 1420 Themes (8ba76bd2a943f642f267a296a15776d2) C:\WINDOWS\System32\shsvcs.dll
19:42:20.0453 1420 Themes - ok
19:42:20.0625 1420 TlntSvr (535c2fb97336bafa509f4783dd1e5746) C:\WINDOWS\system32\tlntsvr.exe
19:42:20.0750 1420 TlntSvr - ok
19:42:20.0765 1420 TosIde - ok
19:42:20.0812 1420 TrkWks (4dce17221b1a87fb47e36842f3e38753) C:\WINDOWS\system32\trkwks.dll
19:42:20.0984 1420 TrkWks - ok
19:42:21.0062 1420 Udfs (12f70256f140cd7d52c58c7048fde657) C:\WINDOWS\system32\drivers\Udfs.sys
19:42:21.0296 1420 Udfs - ok
19:42:21.0296 1420 ultra - ok
19:42:21.0375 1420 UMWdf (ab0a7ca90d9e3d6a193905dc1715ded0) C:\WINDOWS\system32\wdfmgr.exe
19:42:21.0406 1420 UMWdf - ok
19:42:21.0468 1420 Update (aff2e5045961bbc0a602bb6f95eb1345) C:\WINDOWS\system32\DRIVERS\update.sys
19:42:21.0640 1420 Update - ok
19:42:21.0671 1420 upnphost (984fc1518b0d5b31d76f0e63608e0500) C:\WINDOWS\System32\upnphost.dll
19:42:21.0765 1420 upnphost - ok
19:42:21.0796 1420 UPS (6148a3ba4d9cc628357fc92014fea30e) C:\WINDOWS\System32\ups.exe
19:42:22.0000 1420 UPS - ok
19:42:22.0046 1420 usbccgp (bffd9f120cc63bcbaa3d840f3eef9f79) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
19:42:22.0265 1420 usbccgp - ok
19:42:22.0296 1420 usbehci (15e993ba2f6946b2bfbbfcd30398621e) C:\WINDOWS\system32\DRIVERS\usbehci.sys
19:42:22.0468 1420 usbehci - ok
19:42:22.0531 1420 UsbFltr (2e4d169f534d1d0a3c03a7f19184cc6b) C:\WINDOWS\system32\drivers\UsbFltr.sys
19:42:22.0546 1420 UsbFltr ( UnsignedFile.Multi.Generic ) - warning
19:42:22.0546 1420 UsbFltr - detected UnsignedFile.Multi.Generic (1)
19:42:22.0593 1420 usbhub (c72f40947f92cea56a8fb532edf025f1) C:\WINDOWS\system32\DRIVERS\usbhub.sys
19:42:22.0781 1420 usbhub - ok
19:42:22.0828 1420 usbohci (bdfe799a8531bad8a5a985821fe78760) C:\WINDOWS\system32\DRIVERS\usbohci.sys
19:42:23.0015 1420 usbohci - ok
19:42:23.0062 1420 usbprint (a42369b7cd8886cd7c70f33da6fcbcf5) C:\WINDOWS\system32\DRIVERS\usbprint.sys
19:42:23.0234 1420 usbprint - ok
19:42:23.0281 1420 usbscan (a6bc71402f4f7dd5b77fd7f4a8ddba85) C:\WINDOWS\system32\DRIVERS\usbscan.sys
19:42:23.0453 1420 usbscan - ok
19:42:23.0484 1420 USBSTOR (6cd7b22193718f1d17a47a1cd6d37e75) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
19:42:23.0640 1420 USBSTOR - ok
19:42:23.0671 1420 usbuhci (f8fd1400092e23c8f2f31406ef06167b) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
19:42:23.0812 1420 usbuhci - ok
19:42:23.0828 1420 VBoxNetFlt - ok
19:42:23.0890 1420 VgaSave (8a60edd72b4ea5aea8202daf0e427925) C:\WINDOWS\System32\drivers\vga.sys
19:42:24.0046 1420 VgaSave - ok
19:42:24.0046 1420 ViaIde - ok
19:42:24.0109 1420 VolSnap (cd8cce067f7e9cbd762c00bdddecaa34) C:\WINDOWS\system32\drivers\VolSnap.sys
19:42:24.0265 1420 VolSnap - ok
19:42:24.0328 1420 VSS (043539881667bb37b07524032d6ffc3e) C:\WINDOWS\System32\vssvc.exe
19:42:24.0437 1420 VSS - ok
19:42:24.0484 1420 W32Time (2ceebb402187ae56b585701f3d191fb3) C:\WINDOWS\system32\w32time.dll
19:42:24.0656 1420 W32Time - ok
19:42:24.0687 1420 Wanarp (984ef0b9788abf89974cfed4bfbaacbc) C:\WINDOWS\system32\DRIVERS\wanarp.sys
19:42:24.0859 1420 Wanarp - ok
19:42:24.0859 1420 WDICA - ok
19:42:24.0921 1420 wdmaud (2797f33ebf50466020c430ee4f037933) C:\WINDOWS\system32\drivers\wdmaud.sys
19:42:25.0078 1420 wdmaud - ok
19:42:25.0156 1420 WebClient (3791adf1d3466ac6b4b662d3f79cbfec) C:\WINDOWS\System32\webclnt.dll
19:42:25.0296 1420 WebClient - ok
19:42:25.0406 1420 winmgmt (e12084ea622bdf2262c637bef15dd85c) C:\WINDOWS\system32\wbem\WMIsvc.dll
19:42:25.0562 1420 winmgmt - ok
19:42:25.0609 1420 WmdmPmSN (140ef97b64f560fd78643cae2cdad838) C:\WINDOWS\system32\MsPMSNSv.dll
19:42:25.0625 1420 WmdmPmSN - ok
19:42:25.0687 1420 Wmi (0cdc4a0c6b820fad99fb4ca74cd0c476) C:\WINDOWS\System32\advapi32.dll
19:42:25.0843 1420 Wmi - ok
19:42:25.0906 1420 WmiApSrv (bcd21b989f0fd4ace78287fc01b4693d) C:\WINDOWS\system32\wbem\wmiapsrv.exe
19:42:26.0062 1420 WmiApSrv - ok
19:42:26.0093 1420 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
19:42:26.0234 1420 WS2IFSL - ok
19:42:26.0281 1420 wscsvc (4aded1adef25041d9827f9a79c0fda13) C:\WINDOWS\system32\wscsvc.dll
19:42:26.0453 1420 wscsvc - ok
19:42:26.0484 1420 wuauserv (21f5169ca14e0b25c757644456f637df) C:\WINDOWS\system32\wuauserv.dll
19:42:26.0671 1420 wuauserv - ok
19:42:26.0750 1420 WZCSVC (325cedef696ef4b649ddcd3968d085c9) C:\WINDOWS\System32\wzcsvc.dll
19:42:26.0921 1420 WZCSVC - ok
19:42:26.0984 1420 xmlprov (9b835d4c64860b155a1701d5092ec9e4) C:\WINDOWS\System32\xmlprov.dll
19:42:27.0125 1420 xmlprov - ok
19:42:27.0203 1420 ZD1211U(ZyDAS) (adf52208702b6cb497dcce95a16f1e32) C:\WINDOWS\system32\DRIVERS\zd1211u.sys
19:42:27.0250 1420 ZD1211U(ZyDAS) - ok
19:42:27.0265 1420 MBR (0x1B8) (413fc2a0c716421b3158746d63736515) \Device\Harddisk0\DR0
19:42:27.0921 1420 \Device\Harddisk0\DR0 - ok
19:42:27.0921 1420 Boot (0x1200) (40a2defcf44e7fb5a90cc4e5222ecd8f) \Device\Harddisk0\DR0\Partition0
19:42:27.0937 1420 \Device\Harddisk0\DR0\Partition0 - ok
19:42:27.0937 1420 ============================================================
19:42:27.0937 1420 Scan finished
19:42:27.0937 1420 ============================================================
19:42:28.0046 0996 Detected object count: 5
19:42:28.0046 0996 Actual detected object count: 5
19:43:07.0906 0996 !SASCORE ( UnsignedFile.Multi.Generic ) - skipped by user
19:43:07.0906 0996 !SASCORE ( UnsignedFile.Multi.Generic ) - User select action: Skip
19:43:07.0906 0996 AdobeFlashPlayerUpdateSvc ( UnsignedFile.Multi.Generic ) - skipped by user
19:43:07.0906 0996 AdobeFlashPlayerUpdateSvc ( UnsignedFile.Multi.Generic ) - User select action: Skip
19:43:07.0906 0996 kbfilter ( UnsignedFile.Multi.Generic ) - skipped by user
19:43:07.0906 0996 kbfilter ( UnsignedFile.Multi.Generic ) - User select action: Skip
19:43:07.0906 0996 SMBios ( UnsignedFile.Multi.Generic ) - skipped by user
19:43:07.0906 0996 SMBios ( UnsignedFile.Multi.Generic ) - User select action: Skip
19:43:07.0921 0996 UsbFltr ( UnsignedFile.Multi.Generic ) - skipped by user
19:43:07.0921 0996 UsbFltr ( UnsignedFile.Multi.Generic ) - User select action: Skip

edit
Tak nevím zda mám zpět nainstalovat AVG, počkám co řekneš, moc děkuju za rady

[kristynkai7]

Tak asi zkusím nainstalovat to AVG, nevím do kolika tu budu moci být a snad budu mít alespoň o trochu lepší pocit.....(bezpečí)

edit
Tak to dnes asi už budu muset zabalit, jinak mě naši zakousnou, snad to bude v pořádku, zítra se stavím a kdyžtak dodělám co řekneš
PS: doufám že ta bouřka u tebe nebyla tak strašná, jako ta co tu byla před pár dny, kdy padaly stromy a vše plavalo, měj se hezky a hezkou a klidnou noc bez bouřek, paaaaa

[kristynkai7]

Ahojík, instalace trvala dost dlouho a s trochou pomoci a radou jsem ho dala dohromady (ten počítač bez něj byl rychlejší ale to asi je cena za alespoň trochu bezpečí), projela jsem PC znovu rychlý sken malwarebytes a nic nenašel a plný sken avg a také nic nenašel, avg už nic nevyhodilo (myšleno okno nalezena infekce - klepklep abych to nezakřikla), snad to bude vpořádku, nevím jak to jinak poznat

Jsem ráda že to u tebe dobře dopadlo, tak se tu snad sejdeme zítra, snad nebudu mít průšvih za to dnešní ponocování...

Ještě jednou ti děkuju za pomoc a rady a za to že jsi měl se mnou trpělivost

Paaa pac a pusu brou brou
Kristynka

[kristynkai7]

Tak je mi málo, to už jsi asi poznal, sice jsem prý vyspělá ... ale malá (podle dospělých beruška), je mi přes deset ale pod patnáct, raději bych to nespecifikovala, páč naši by mě zakousli, ale mám za sebou rok na 8letém gymnáziu, to řekne vše

Ty na to nevidíš a já se z toho klepu, protože se bojím že něco udělám špatně takže jsme na tom podobně (ale pravdou je že bych se ráda naučila s počítači mnohem víc než umím)

K problému - uvažovala jsem o avastu (free) všichni ho chválí, ale mám i avg firewall což sice není asi nic moc, ale když bych měla avast tak nevím co k tomu za firewall, jestli win firewall nebo comodo firewall (u toho se bojím že s ním nebudu umět), takový strach ze změny a z neznáma.....

Tak dobrou noc já jdu rychle spát jinak bude zákaz PC

Hezké sny Naughty

[kristynkai7]

Ahojík,

pokud je čisto tak to jsem šťastná jak blecha a moc moc moc mocinky děkuju jsi zlatíčko

Ještě k tomu včera, nějak jsem na začátku nechápala to, že jsem se odpověďmi sama na svůj příspěvek ztratila (pak jsem raději editovala), už jsem to nějak pochopila, když jsem se porozhlížela na foru, že tím že tam je víc příspěvků, tak to vypadá že už si to nějaký rádce/moderátor.... vzal a pak asi už ostatní chodí jen okolo, trochu jsem včera zmatkovala (trochu víc ), omlouvám se a ještě jsem včera zapoměla napsat že jsem udělala i rychlý sken SuperAntispyware, ten našel nějaké cookie (adwarecookie) a ty jsem dala hned smazat a zapoměla jsme to napsat, takže se omlouvám i za to

Mno měla bych ještě jeden asi blbý dotaz, mám nějak odinstalovat konzolu co se zobrazuje při startu a ty prográmky co jsem použila, nebo stači jen smazat

edit
Tak jsem ještě měla puštěný Malwarebytes plný sken a když skenoval system volume inf (to jsou body obnovení pokud se nepletu) tak vyskočilo avg že tam je nějaká havěť (Trojský kůň Pakes.LJM) tak jsem dala do trezoru, ale žádné další problémy nejsou (klepklep abych to nezakřikla), pokud se nebudu vracet k předchozím bodům obnovení z doby zavirování tak by to neměl být problém myslím