Logfile of random's system information tool 1.09 (written by random/random)
Run by Martin at 2012-08-12 02:53:14
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 5 GB (18%) free of 25 GB
Total RAM: 2047 MB (76% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 2:53:19, on 12.8.2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\PROGRA~1\AVG\AVG2012\avgrsx.exe
C:\Program Files\AVG\AVG2012\avgcsrvx.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\soft602\602updsvc\602updsvc.exe
C:\Program Files\AVG\AVG2012\avgfws.exe
C:\Program Files\AVG\AVG2012\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AVG\AVG2012\avgnsx.exe
C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe
C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe
C:\Program Files\AVG\AVG2012\avgcsrvx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\AVG\AVG2012\avgtray.exe
C:\Program Files\AVG Secure Search\vprot.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Martin\Dokumenty\Downloads\RSIT.exe
C:\Program Files\trend micro\Martin.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [AVG_TRAY] "C:\Program Files\AVG\AVG2012\avgtray.exe"
O4 - HKLM\..\Run: [vProt] "C:\Program Files\AVG Secure Search\vprot.exe"
O4 - HKLM\..\Run: [ROC_roc_dec12] "C:\Program Files\AVG Secure Search\ROC_roc_dec12.exe" /PROMPT /CMPID=roc_dec12
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HF_G_Jul] "C:\Program Files\AVG Secure Search\HF_G_Jul.exe" /DoAction
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files\ICQ7.4\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files\ICQ7.4\ICQ.exe
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 2165289718
O16 - DPF: {672EE252-D813-4F5E-81BB-5DD163DD4FA5} (Active602XMLFiller Control) - https://www.mojedatovaschranka.cz/stati ... ctivex.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 9909101375
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll
O18 - Protocol: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\11.2.0\ViProtocol.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: 602Updater (602XML Updater) - Software602 a.s. - C:\Program Files\Common Files\soft602\602updsvc\602updsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: AVG Security Toolbar Service - Unknown owner - C:\Program Files\AVG\AVG10\Toolbar\ToolbarBroker.exe
O23 - Service: AVG Firewall (avgfws) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2012\avgfws.exe
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2012\avgwdsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: vToolbarUpdater11.2.0 - Unknown owner - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe
--
End of file - 7935 bytes
======Scheduled tasks folder======
C:\WINDOWS\tasks\Adobe Flash Player Updater.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{42653625-03EE-47DF-B0C1-D1BF228DB4DC}.job
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Podpora odkazu pro Adobe PDF Reader - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files\AVG\AVG2012\avgssie.dll [2011-11-11 1378144]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2012-02-18 325408]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
AVG Security Toolbar - C:\Program Files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll [2012-07-12 2074208]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2012-02-18 42272]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2012-02-18 79648]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{95B7759C-8C7F-4BF1-B163-73684A933233} - AVG Security Toolbar - C:\Program Files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll [2012-07-12 2074208]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2005-09-22 90112]
"HPDJ Taskbar Utility"=C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe [2004-03-04 172032]
""= []
"AVG_TRAY"=C:\Program Files\AVG\AVG2012\avgtray.exe [2012-01-24 2416480]
"vProt"=C:\Program Files\AVG Secure Search\vprot.exe [2012-07-12 1107552]
"ROC_roc_dec12"=C:\Program Files\AVG Secure Search\ROC_roc_dec12.exe [2012-01-15 928096]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2012-01-18 254696]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2007-12-05 8523776]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2007-12-05 81920]
"HF_G_Jul"=C:\Program Files\AVG Secure Search\HF_G_Jul.exe [2012-07-18 36960]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ActivControl]
C:\Program Files\Activ Software\ActivDriver\ActivControl2.exe [2010-12-17 1094000]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe [2003-12-22 241664]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe [2010-06-09 49208]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Philips Device Listener]
C:\Program Files\Philips\Philips Songbird Resources\Autolauncher\PhilipsDeviceListener.exe [2010-05-27 375296]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PinnacleDriverCheck]
C:\WINDOWS\system32\PSDrvCheck.exe [2004-03-10 406016]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Shockwave Updater]
C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~1.EXE [2008-08-06 447928]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe [2007-06-13 528384]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
C:\Program Files\Windows Defender\MSASCui.exe [2006-11-03 866584]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2007-02-15 236928]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"=C:\PROGRA~1\WIFD1F~1\MpShHook.dll [2006-11-03 83224]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WinDefend]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=0x91000000
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"D:\Záloha - programy\utorrent-portable\utorrent.exe"="D:\Záloha - programy\utorrent-portable\utorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\ICQ7.4\ICQ.exe"="C:\Program Files\ICQ7.4\ICQ.exe:*:Enabled:ICQ7.4"
"C:\Program Files\AVG\AVG2012\avgmfapx.exe"="C:\Program Files\AVG\AVG2012\avgmfapx.exe:*:Enabled:Instalátor AVG"
"C:\Program Files\AVG\AVG2012\avgnsx.exe"="C:\Program Files\AVG\AVG2012\avgnsx.exe:*:Enabled:Webový štít"
"C:\Program Files\AVG\AVG2012\avgdiagex.exe"="C:\Program Files\AVG\AVG2012\avgdiagex.exe:*:Enabled:AVG Diagnostika 2012"
"C:\Program Files\AVG\AVG2012\avgemcx.exe"="C:\Program Files\AVG\AVG2012\avgemcx.exe:*:Enabled:Obecná kontrola pošty"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\ICQ7.4\ICQ.exe"="C:\Program Files\ICQ7.4\ICQ.exe:*:Enabled:ICQ7.4"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"VIDC.IYUV"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVU9"=tsbyuv.dll
"VIDC.YVYU"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"VIDC.MJPG"=Pvmjpg21.dll
"VIDC.PIM1"=pclepim1.dll
"VIDC.I420"=vdrcodec.dll
"VIDC.FFDS"=ff_vfw.dll
"vidc.XVID"=xvidvfw.dll
"vidc.tscc"=tsccvid.dll
======List of files/folders created in the last 1 month======
2012-08-12 02:53:14 ----DC---- C:\rsit
2012-08-12 02:53:14 ----DC---- C:\Program Files\trend micro
2012-07-26 22:12:16 ----AC---- C:\WINDOWS\system32\FlashPlayerInstaller.exe
2012-07-24 22:05:08 ----DC---- C:\Program Files\Common Files\soft602
2012-07-24 22:05:06 ----DC---- C:\Documents and Settings\Martin\Data aplikací\602XML
2012-07-24 22:04:58 ----DC---- C:\Documents and Settings\Martin\Data aplikací\602Installer
2012-07-24 22:04:29 ----DC---- C:\Program Files\Software602
2012-07-13 09:24:23 ----HDC---- C:\WINDOWS\$NtUninstallKB2691442$
2012-07-13 09:24:13 ----HDC---- C:\WINDOWS\$NtUninstallKB2718523$
2012-07-13 09:24:05 ----HDC---- C:\WINDOWS\$NtUninstallKB2655992$
2012-07-13 09:23:58 ----HDC---- C:\WINDOWS\$NtUninstallKB2719985$
2012-07-13 09:21:50 ----HDC---- C:\WINDOWS\$NtUninstallKB2698365$
======List of files/folders modified in the last 1 month======
2012-08-12 02:53:14 ----RDC---- C:\Program Files
2012-08-12 02:49:55 ----DC---- C:\WINDOWS\Temp
2012-08-12 02:42:56 ----DC---- C:\WINDOWS\Prefetch
2012-08-12 02:14:40 ----DC---- C:\Documents and Settings\All Users\Data aplikací\MFAData
2012-08-12 02:11:32 ----DC---- C:\WINDOWS\system32\CatRoot2
2012-08-12 02:09:35 ----DC---- C:\WINDOWS\system32
2012-08-12 02:08:27 ----DC---- C:\WINDOWS\system32\drivers
2012-08-12 02:07:21 ----DC---- C:\WINDOWS\system32\config
2012-08-12 02:06:56 ----DC---- C:\WINDOWS\system32\wbem
2012-08-12 02:06:56 ----DC---- C:\WINDOWS\Registration
2012-08-12 02:06:35 ----DC---- C:\Documents and Settings\Martin\Data aplikací\U3
2012-08-12 02:06:18 ----A---- C:\WINDOWS\SchedLgU.Txt
2012-08-12 01:31:57 ----DC---- C:\WINDOWS
2012-08-11 23:40:29 ----DC---- C:\WINDOWS\system32\drivers\AVG
2012-08-07 13:26:09 ----AC---- C:\WINDOWS\wincmd.ini
2012-08-04 18:12:23 ----AC---- C:\WINDOWS\system32\FlashPlayerApp.exe
2012-07-26 16:59:25 ----SHDC---- C:\WINDOWS\Installer
2012-07-26 16:59:21 ----DC---- C:\WINDOWS\WinSxS
2012-07-26 16:59:20 ----D---- C:\Program Files\MSXML 4.0
2012-07-25 13:13:17 ----DC---- C:\WINDOWS\Debug
2012-07-24 22:05:12 ----SDC---- C:\WINDOWS\Downloaded Program Files
2012-07-24 22:05:08 ----DC---- C:\Program Files\Common Files
2012-07-24 22:04:45 ----HDC---- C:\WINDOWS\inf
2012-07-18 19:43:33 ----DC---- C:\Program Files\AVG Secure Search
2012-07-13 09:42:08 ----RSHDC---- C:\WINDOWS\system32\dllcache
2012-07-13 09:24:10 ----HDC---- C:\WINDOWS\$hf_mig$
2012-07-13 09:21:59 ----AC---- C:\WINDOWS\system32\MRT.exe
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 AVGIDSEH;AVGIDSEH; C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys [2011-07-11 23120]
R0 Avgrkx86;AVG Anti-Rootkit Driver; C:\WINDOWS\system32\DRIVERS\avgrkx86.sys [2011-09-13 32592]
R0 gagp30kx;Filtr Microsoft Generic AGPv3.0 pro procesorovou platformu K8; C:\WINDOWS\system32\DRIVERS\gagp30kx.sys [2008-04-13 46464]
R0 ohci1394;Hostitelský řadič IEEE 1394 dle standardu OHCI VIA; C:\WINDOWS\system32\DRIVERS\ohci1394.sys [2008-04-13 61696]
R0 viamraid;viamraid; C:\WINDOWS\system32\DRIVERS\viamraid.sys [2006-03-31 100992]
R0 videX32;videX32; C:\WINDOWS\system32\DRIVERS\videX32.sys [2006-02-23 9728]
R0 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-15 76544]
R1 AmdK8;AMD Processor Driver; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2005-03-09 36352]
R1 Avgldx86;AVG AVI Loader Driver; C:\WINDOWS\system32\DRIVERS\avgldx86.sys [2011-10-07 230608]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield; C:\WINDOWS\system32\DRIVERS\avgmfx86.sys [2011-08-08 40016]
R1 Avgtdix;AVG TDI Driver; C:\WINDOWS\system32\DRIVERS\avgtdix.sys [2011-07-11 295248]
R1 PCLEPCI;PCLEPCI; \??\C:\WINDOWS\system32\drivers\pclepci.sys []
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2005-09-22 3727680]
R3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 ASAPIW2k;ASAPIW2K; C:\WINDOWS\system32\drivers\ASAPIW2k.sys [2004-03-10 11264]
R3 Avgfwdx;Avgfwdx; C:\WINDOWS\system32\DRIVERS\avgfwdx.sys [2011-05-23 30944]
R3 AVGIDSDriver;AVGIDSDriver; C:\WINDOWS\system32\DRIVERS\AVGIDSDriver.Sys [2011-07-11 134608]
R3 AVGIDSFilter;AVGIDSFilter; C:\WINDOWS\system32\DRIVERS\AVGIDSFilter.Sys [2011-07-11 24272]
R3 AVGIDSShim;AVGIDSShim; C:\WINDOWS\system32\DRIVERS\AVGIDSShim.Sys [2011-10-04 16720]
R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service; C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2008-09-22 43520]
R3 GEARAspiWDM;GEARAspiWDM; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2010-05-10 15664]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 MarvinBus;Pinnacle Marvin Bus; C:\WINDOWS\system32\DRIVERS\MarvinBus.sys [2004-06-21 78976]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2007-12-05 7435392]
R3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 xcpip;Ovladač protokolu TCP/IP; C:\WINDOWS\system32\drivers\xcpip.sys []
R3 xpsec;Ovladač IPSEC; C:\WINDOWS\system32\drivers\xpsec.sys []
S3 61883;61883 Unit Device; C:\WINDOWS\system32\DRIVERS\61883.sys [2008-04-13 48128]
S3 Avc;AVC Device; C:\WINDOWS\system32\DRIVERS\avc.sys [2008-04-13 38912]
S3 Avgfwfd;AVG network filter service; C:\WINDOWS\system32\DRIVERS\avgfwdx.sys [2011-05-23 30944]
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 CrystalSysInfo;CrystalSysInfo; \??\C:\Program Files\MediaCoder\SysInfo.sys []
S3 FETND5BV;VIA Rhine-Family Fast Ethernet Adapter Driver Service; C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2008-09-22 43520]
S3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\fetnd5.sys [2001-08-17 27165]
S3 MSDV;Microsoft DV Camera and VCR; C:\WINDOWS\system32\DRIVERS\msdv.sys [2008-04-13 51200]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 pcouffin;VSO Software pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [2009-10-04 47360]
S3 Point32;Microsoft IntelliPoint Filter Driver; C:\WINDOWS\system32\DRIVERS\point32.sys []
S3 s125bus;Sony Ericsson Device 125 driver (WDM); C:\WINDOWS\system32\DRIVERS\s125bus.sys [2007-04-24 83336]
S3 s125mdfl;Sony Ericsson Device 125 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\s125mdfl.sys [2007-04-24 15112]
S3 s125mdm;Sony Ericsson Device 125 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\s125mdm.sys [2007-04-24 108680]
S3 s125mgmt;Sony Ericsson Device 125 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\s125mgmt.sys [2007-04-24 100488]
S3 s125obex;Sony Ericsson Device 125 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\s125obex.sys [2007-04-24 98696]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 StMp3Rec;Player Recovery Device Control Driver; C:\WINDOWS\System32\Drivers\StMp3Rec.sys []
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 wceusbsh;Windows CE USB Serial Host Driver; C:\WINDOWS\system32\DRIVERS\wceusbsh.sys [2006-11-06 28672]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-15 82688]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 602XML Updater;602Updater; C:\Program Files\Common Files\soft602\602updsvc\602updsvc.exe [2011-10-10 85344]
R2 avgfws;AVG Firewall; C:\Program Files\AVG\AVG2012\avgfws.exe [2011-11-23 2391832]
R2 AVGIDSAgent;AVGIDSAgent; C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe [2011-10-12 4433248]
R2 avgwd;AVG WatchDog; C:\Program Files\AVG\AVG2012\avgwdsvc.exe [2011-08-02 192776]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2012-02-18 153376]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2007-12-05 155716]
R2 vToolbarUpdater11.2.0;vToolbarUpdater11.2.0; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe [2012-07-12 935008]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 WinDefend;Windows Defender; C:\Program Files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-04 250056]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2010-03-18 35160]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service; C:\Program Files\AVG\AVG10\Toolbar\ToolbarBroker.exe [2011-09-01 1025352]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [2005-11-14 69632]
S3 idsvc;Služba Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 WinRM;Windows Remote Management (WS-Management); C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S4 NetTcpPortSharing;Služba sdílení portů Net.Tcp; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
-----------------EOF-----------------
Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz
Problém s napadeným PC - generic27.AkPW- log z RSIT přiložen
Moderátor: Moderátoři
Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Re: Problém s napadeným PC - generic27.AkPW- log z RSIT přil
Kód: Vybrat vše
MBRScan v1.1.1
OS : Windows XP Home Service Pack 3 (32 bit)
PROCESSOR : x86 Family 15 Model 44 Stepping 2, AuthenticAMD
BOOT : Normal Boot
DATE : 2012/08/12 (ISO 8601) at 10:11:38
________________________________________________________________________________
DISK : Device\Harddisk0\DR0 __SAMSUNG SP1203N (TL100-30)
BUS_TYPE : (0x03) P-ATA
USE_PIO : YES
MAX_TRANSFER : 128 Kb
ALIGNMENT_MASK : word aligned
________________________________________________________________________________
Device\Harddisk0\DR0 111.8 Go [Fixed] ==> Unknown MBR Code
MBR_MD5 : 06C4A6CF948DAD9339030D6E53BF4BCE
MBR_SHA1 : 18DB7B7B89915336C7DACCA373AAA21223B7520E
Device\Harddisk0\Partition1 24.41 Go 0x07 NTFS / HPFS __ BOOTABLE __
Device\Harddisk0\Partition2 87.40 Go 0x07 NTFS / HPFS
________________________________________________________________________________
############################### Additional scan ################################
DRIVER : C:\WINDOWS\system32\drivers\xpsec.sys => Invisible on the disk
ADDRESS : 0xAFD3C000
SIZE : 76.0 Ko
DRIVER : C:\WINDOWS\system32\drivers\xcpip.sys => Invisible on the disk
ADDRESS : 0xAFCE3000
SIZE : 356.0 Ko
SystemStartOptions : NOEXECUTE=OPTIN FASTDETECT
________________________________________________________________________________
_____FAKED \Device\Harddisk0\DR0
0x00000000 33 C0 8E D8 8E C0 8E D0 BC 00 7C BE 1A 7C BF 00 3À.Ø.À.м.|¾.|¿.
0x00000010 06 B9 E6 01 50 57 FC F3 A4 CB BE A4 07 B1 04 90 .¹æ.PWüó¤Ë¾¤.±..
0x00000020 80 3C 80 74 0D 38 2C 0F 85 C0 00 83 C6 10 E2 F0 .<.t.8,..À..Æ.âð
0x00000030 CD 18 66 8B 44 08 8B 14 89 E3 B9 01 00 E8 64 00 Í.f.D....ã¹..èd.
0x00000040 73 0C 8B 4C 02 B8 01 02 CD 13 0F 82 B8 00 B9 55 s..L.¸..Í...¸.¹U
0x00000050 AA 2B 0E FE 7D 0F 85 CF 00 66 B8 00 00 00 00 66 ª+.þ}..Ï.f¸....f
0x00000060 39 44 08 72 08 66 8B 44 08 66 03 44 0C 83 C6 10 9D.r.f.D.f.D..Æ.
0x00000070 81 FE E4 07 72 E9 66 09 C0 74 1E B9 09 00 81 C3 .þä.réf.Àt.¹...Ã
0x00000080 00 02 E8 1F 00 72 12 89 DE 81 C6 0C 02 8D 54 F4 ..è..r..Þ.Æ...Tô
0x00000090 66 81 3C 75 2F F3 A4 74 05 EA 00 7C 00 00 89 DE f.<u/ó¤t.ê.|...Þ
0x000000A0 FF D2 EB F5 66 60 B2 80 BB AA 55 B4 41 CD 13 73 .Òëõf`².»ªU´AÍ.s
0x000000B0 04 F9 66 61 C3 81 FB 55 AA 75 F6 F6 C1 01 74 F1 .ùfaÃ.ûUªuööÁ.tñ
0x000000C0 66 61 66 60 6A 00 6A 00 66 50 06 53 51 6A 10 B4 faf`j.j.fP.SQj.´
0x000000D0 42 89 E6 CD 13 61 66 61 C3 5E AC 08 C0 74 FC 56 B.æÍ.afaÃ^¬.ÀtüV
0x000000E0 1E BB 07 00 B4 0E CD 10 1F EB EE E8 EB FF 49 6E .»..´.Í..ëîèë.In
0x000000F0 76 61 6C 69 64 20 70 61 72 74 69 74 69 6F 6E 20 valid partition
0x00000100 74 61 62 6C 65 00 E8 D0 FF 45 72 72 6F 72 20 6C table.èÐ.Error l
0x00000110 6F 61 64 69 6E 67 20 6F 70 65 72 61 74 69 6E 67 oading operating
0x00000120 20 73 79 73 74 65 6D 00 E8 AE FF 4D 69 73 73 69 system.è®.Missi
0x00000130 6E 67 20 6F 70 65 72 61 74 69 6E 67 20 73 79 73 ng operating sys
0x00000140 74 65 6D 00 00 00 00 00 00 00 00 00 00 00 00 00 tem.............
0x00000150 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x00000160 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x00000170 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x00000180 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x00000190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x000001A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x000001B0 00 00 00 00 00 2C 44 6A E4 43 E5 43 00 00 80 01 .....,DjäCåC....
0x000001C0 01 00 07 FE FF FF 3F 00 00 00 74 3C 0D 03 00 00 ...þ..?...t<....
0x000001D0 C1 FF 0F FE FF FF B3 3C 0D 03 51 B7 EC 0A 00 00 Á..þ..³<..Q·ì...
0x000001E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x000001F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA ..............Uª
__ORIGINAL \Device\Harddisk0\DR0
0x00000000 33 C0 8E D0 BC 00 7C FB 50 07 50 1F FC BE 1B 7C 3À.м.|ûP.P.ü¾.|
0x00000010 BF 1B 06 50 57 B9 E5 01 F3 A4 CB BD BE 07 B1 04 ¿..PW¹å.ó¤Ë½¾.±.
0x00000020 38 6E 00 7C 09 75 13 83 C5 10 E2 F4 CD 18 8B F5 8n.|.u..Å.âôÍ..õ
0x00000030 83 C6 10 49 74 19 38 2C 74 F6 A0 B5 07 B4 07 8B .Æ.It.8,tö.µ.´..
0x00000040 F0 AC 3C 00 74 FC BB 07 00 B4 0E CD 10 EB F2 88 ð¬<.tü»..´.Í.ëò.
0x00000050 4E 10 E8 46 00 73 2A FE 46 10 80 7E 04 0B 74 0B N.èF.s*þF..~..t.
0x00000060 80 7E 04 0C 74 05 A0 B6 07 75 D2 80 46 02 06 83 .~..t..¶.uÒ.F...
0x00000070 46 08 06 83 56 0A 00 E8 21 00 73 05 A0 B6 07 EB F...V..è!.s..¶.ë
0x00000080 BC 81 3E FE 7D 55 AA 74 0B 80 7E 10 00 74 C8 A0 ¼.>þ}Uªt..~..tÈ.
0x00000090 B7 07 EB A9 8B FC 1E 57 8B F5 CB BF 05 00 8A 56 ·.ë©.ü.W.õË¿...V
0x000000A0 00 B4 08 CD 13 72 23 8A C1 24 3F 98 8A DE 8A FC .´.Í.r#.Á$?..Þ.ü
0x000000B0 43 F7 E3 8B D1 86 D6 B1 06 D2 EE 42 F7 E2 39 56 C÷ã.Ñ.Ö±.ÒîB÷â9V
0x000000C0 0A 77 23 72 05 39 46 08 73 1C B8 01 02 BB 00 7C .w#r.9F.s.¸..».|
0x000000D0 8B 4E 02 8B 56 00 CD 13 73 51 4F 74 4E 32 E4 8A .N..V.Í.sQOtN2ä.
0x000000E0 56 00 CD 13 EB E4 8A 56 00 60 BB AA 55 B4 41 CD V.Í.ëä.V.`»ªU´AÍ
0x000000F0 13 72 36 81 FB 55 AA 75 30 F6 C1 01 74 2B 61 60 .r6.ûUªu0öÁ.t+a`
0x00000100 6A 00 6A 00 FF 76 0A FF 76 08 6A 00 68 00 7C 6A j.j..v..v.j.h.|j
0x00000110 01 6A 10 B4 42 8B F4 CD 13 61 61 73 0E 4F 74 0B .j.´B.ôÍ.aas.Ot.
0x00000120 32 E4 8A 56 00 CD 13 EB D6 61 F9 C3 4E 65 70 6C 2ä.V.Í.ëÖaùÃNepl
0x00000130 61 74 6E A0 20 74 61 62 75 6C 6B 61 20 6F 64 64 atn. tabulka odd
0x00000140 A1 6C 85 00 43 68 79 62 61 20 70 FD 69 20 6E 61 ¡l..Chyba pýi na
0x00000150 9F A1 74 A0 6E A1 20 6F 70 65 72 61 9F 6E A1 68 .¡t.n¡ opera.n¡h
0x00000160 6F 20 73 79 73 74 82 6D 75 00 4F 70 65 72 61 9F o syst.mu.Opera.
0x00000170 6E A1 20 73 79 73 74 82 6D 20 6E 65 6E 61 6C 65 n¡ syst.m nenale
0x00000180 7A 65 6E 00 00 00 00 00 00 00 00 00 00 00 00 00 zen.............
0x00000190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x000001A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x000001B0 00 00 00 00 00 2C 44 6A E4 43 E5 43 00 00 80 01 .....,DjäCåC....
0x000001C0 01 00 07 FE FF FF 3F 00 00 00 74 3C 0D 03 00 00 ...þ..?...t<....
0x000001D0 C1 FF 0F FE FF FF B3 3C 0D 03 51 B7 EC 0A 00 00 Á..þ..³<..Q·ì...
0x000001E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x000001F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA ..............Uª
__________________________16_BIT_ASM_CODE
0x0000 33c0 XOR AX, AX
0x0002 8ed8 MOV DS, AX
0x0004 8ec0 MOV ES, AX
0x0006 8ed0 MOV SS, AX
0x0008 bc 007c MOV SP, 0x7c00
0x000B be 1a7c MOV SI, 0x7c1a
0x000E bf 0006 MOV DI, 0x600
0x0011 b9 e601 MOV CX, 0x1e6
0x0014 50 PUSH AX
0x0015 57 PUSH DI
0x0016 fc CLD
0x0017 f3 a4 REP MOVSB
0x0019 cb RETF
0x001A be a407 MOV SI, 0x7a4
0x001D b1 04 MOV CL, 0x4
0x001F 90 NOP
0x0020 803c 80 CMP BYTE [SI], 0x80
0x0023 74 0d JZ 0x32
0x0025 382c CMP [SI], CH
0x0027 0f85 c000 JNZ 0xeb
0x002B 83c6 10 ADD SI, 0x10
0x002E e2 f0 LOOP 0x20
0x0030 cd 18 INT 0x18
0x0032 66 8b44 08 MOV EAX, [SI+0x8]
0x0036 8b14 MOV DX, [SI]
0x0038 89e3 MOV BX, SP
0x003A b9 0100 MOV CX, 0x1
0x003D e8 6400 CALL 0xa4
0x0040 73 0c JAE 0x4e
0x0042 8b4c 02 MOV CX, [SI+0x2]
0x0045 b8 0102 MOV AX, 0x201
0x0048 cd 13 INT 0x13
0x004A 0f82 b800 JB 0x106
0x004E b9 55aa MOV CX, 0xaa55
0x0051 2b0e fe7d SUB CX, [0x7dfe]
0x0055 0f85 cf00 JNZ 0x128
0x0059 66 b8 00000000 MOV EAX, 0x0
0x005F 66 3944 08 CMP [SI+0x8], EAX
0x0063 72 08 JB 0x6d
0x0065 66 8b44 08 MOV EAX, [SI+0x8]
0x0069 66 0344 0c ADD EAX, [SI+0xc]
0x006D 83c6 10 ADD SI, 0x10
0x0070 81fe e407 CMP SI, 0x7e4
0x0074 72 e9 JB 0x5f
0x0076 66 09c0 OR EAX, EAX
0x0079 74 1e JZ 0x99
0x007B b9 0900 MOV CX, 0x9
0x007E 81c3 0002 ADD BX, 0x200
0x0082 e8 1f00 CALL 0xa4
0x0085 72 12 JB 0x99
0x0087 89de MOV SI, BX
0x0089 81c6 0c02 ADD SI, 0x20c
0x008D 8d54 f4 LEA DX, [SI-0xc]
0x0090 66 813c 752ff3a4CMP DWORD [SI], 0xa4f32f75
0x0097 74 05 JZ 0x9e
0x0099 ea 007c 0000 JMP FAR 0x0:0x7c00
0x009E 89de MOV SI, BX
0x00A0 ffd2 CALL DX
0x00A2 eb f5 JMP 0x99
0x00A4 66 60 PUSHAD
0x00A6 b2 80 MOV DL, 0x80
0x00A8 bb aa55 MOV BX, 0x55aa
0x00AB b4 41 MOV AH, 0x41
0x00AD cd 13 INT 0x13
0x00AF 73 04 JAE 0xb5
0x00B1 f9 STC
0x00B2 66 61 POPAD
0x00B4 c3 RET
0x00B5 81fb 55aa CMP BX, 0xaa55
0x00B9 75 f6 JNZ 0xb1
0x00BB f6c1 01 TEST CL, 0x1
0x00BE 74 f1 JZ 0xb1
0x00C0 66 61 POPAD
0x00C2 66 60 PUSHAD
0x00C4 6a 00 PUSH 0x0
0x00C6 6a 00 PUSH 0x0
0x00C8 66 50 PUSH EAX
0x00CA 06 PUSH ES
0x00CB 53 PUSH BX
0x00CC 51 PUSH CX
0x00CD 6a 10 PUSH 0x10
0x00CF b4 42 MOV AH, 0x42
0x00D1 89e6 MOV SI, SP
0x00D3 cd 13 INT 0x13
0x00D5 61 POPA
0x00D6 66 61 POPAD
0x00D8 c3 RET
0x00D9 5e POP SI
0x00DA ac LODSB
0x00DB 08c0 OR AL, AL
0x00DD 74 fc JZ 0xdb
0x00DF 56 PUSH SI
0x00E0 1e PUSH DS
0x00E1 bb 0700 MOV BX, 0x7
0x00E4 b4 0e MOV AH, 0xe
0x00E6 cd 10 INT 0x10
0x00E8 1f POP DS
0x00E9 eb ee JMP 0xd9
0x00EB e8 ebff CALL 0xd9
0x00EE 49 DEC CX
0x00EF 6e OUTSB
0x00F0 76 61 JBE 0x153
0x00F2 6c INSB
0x00F3 6964 20 7061 IMUL SP, [SI+0x20], 0x6170
0x00F8 72 74 JB 0x16e
0x00FA 6974 69 6f6e IMUL SI, [SI+0x69], 0x6e6f
0x00FF 2074 61 AND [SI+0x61], DH
0x0102 626c 65 BOUND BP, [SI+0x65]
0x0105 00e8 ADD AL, CH
0x0107 d0ff SAR BH, 0x1
0x0109 45 INC BP
0x010A 72 72 JB 0x17e
0x010C 6f OUTSW
0x010D 72 20 JB 0x12f
0x010F 6c INSB
0x0110 6f OUTSW
0x0111 61 POPA
0x0112 64 696e 67 206f IMUL BP, FS:[BP+0x67], 0x6f20
0x0118 70 65 JO 0x17f
0x011A 72 61 JB 0x17d
0x011C 74 69 JZ 0x187
0x011E 6e OUTSB
0x011F 67 2073 79 AND [EBX+0x79], DH
0x0123 73 74 JAE 0x199
0x0125 65 6d INS WORD GS:[DI], DX
0x0127 00e8 ADD AL, CH
0x0129 ae SCASB
0x012A ff4d 69 DEC WORD [DI+0x69]
0x012D 73 73 JAE 0x1a2
0x012F 696e 67 206f IMUL BP, [BP+0x67], 0x6f20
0x0134 70 65 JO 0x19b
0x0136 72 61 JB 0x199
0x0138 74 69 JZ 0x1a3
0x013A 6e OUTSB
0x013B 67 2073 79 AND [EBX+0x79], DH
0x013F 73 74 JAE 0x1b5
0x0141 65 6d INS WORD GS:[DI], DX
0x0143 0000 ADD [BX+SI], AL
0x0145 0000 ADD [BX+SI], AL
0x0147 0000 ADD [BX+SI], AL
0x0149 0000 ADD [BX+SI], AL
0x014B 0000 ADD [BX+SI], AL
0x014D 0000 ADD [BX+SI], AL
0x014F 0000 ADD [BX+SI], AL
0x0151 0000 ADD [BX+SI], AL
0x0153 0000 ADD [BX+SI], AL
0x0155 0000 ADD [BX+SI], AL
0x0157 0000 ADD [BX+SI], AL
0x0159 0000 ADD [BX+SI], AL
0x015B 0000 ADD [BX+SI], AL
0x015D 0000 ADD [BX+SI], AL
0x015F 0000 ADD [BX+SI], AL
0x0161 0000 ADD [BX+SI], AL
0x0163 0000 ADD [BX+SI], AL
0x0165 0000 ADD [BX+SI], AL
0x0167 0000 ADD [BX+SI], AL
0x0169 0000 ADD [BX+SI], AL
0x016B 0000 ADD [BX+SI], AL
0x016D 0000 ADD [BX+SI], AL
0x016F 0000 ADD [BX+SI], AL
0x0171 0000 ADD [BX+SI], AL
0x0173 0000 ADD [BX+SI], AL
0x0175 0000 ADD [BX+SI], AL
0x0177 0000 ADD [BX+SI], AL
0x0179 0000 ADD [BX+SI], AL
0x017B 0000 ADD [BX+SI], AL
0x017D 0000 ADD [BX+SI], AL
0x017F 0000 ADD [BX+SI], AL
0x0181 0000 ADD [BX+SI], AL
0x0183 0000 ADD [BX+SI], AL
0x0185 0000 ADD [BX+SI], AL
0x0187 0000 ADD [BX+SI], AL
0x0189 0000 ADD [BX+SI], AL
0x018B 0000 ADD [BX+SI], AL
0x018D 0000 ADD [BX+SI], AL
0x018F 0000 ADD [BX+SI], AL
0x0191 0000 ADD [BX+SI], AL
0x0193 0000 ADD [BX+SI], AL
0x0195 0000 ADD [BX+SI], AL
0x0197 0000 ADD [BX+SI], AL
0x0199 0000 ADD [BX+SI], AL
0x019B 0000 ADD [BX+SI], AL
0x019D 0000 ADD [BX+SI], AL
0x019F 0000 ADD [BX+SI], AL
0x01A1 0000 ADD [BX+SI], AL
0x01A3 0000 ADD [BX+SI], AL
0x01A5 0000 ADD [BX+SI], AL
0x01A7 0000 ADD [BX+SI], AL
0x01A9 0000 ADD [BX+SI], AL
0x01AB 0000 ADD [BX+SI], AL
0x01AD 0000 ADD [BX+SI], AL
0x01AF 0000 ADD [BX+SI], AL
0x01B1 0000 ADD [BX+SI], AL
0x01B3 0000 ADD [BX+SI], AL
0x01B5 2c 44 SUB AL, 0x44
0x01B7 6a e4 PUSH -0x1c
0x01B9 43 INC BX
0x01BA e5 43 IN AX, 0x43
0x01BC 0000 ADD [BX+SI], AL
0x01BE 8001 01 ADD BYTE [BX+DI], 0x1
0x01C1 0007 ADD [BX], AL
0x01C3 fe DB 0xfe
0x01C4 ff DB 0xff
0x01C5 ff DB 0xff
0x01C6 3f AAS
0x01C7 0000 ADD [BX+SI], AL
0x01C9 0074 3c ADD [SI+0x3c], DH
0x01CC 0d 0300 OR AX, 0x3
0x01CF 00c1 ADD CL, AL
0x01D1 ff0f DEC WORD [BX]
0x01D3 fe DB 0xfe
0x01D4 ff DB 0xff
0x01D5 ffb3 3c0d PUSH WORD [BP+DI+0xd3c]
0x01D9 0351 b7 ADD DX, [BX+DI-0x49]
0x01DC ec IN AL, DX
0x01DD 0a00 OR AL, [BX+SI]
0x01DF 0000 ADD [BX+SI], AL
0x01E1 0000 ADD [BX+SI], AL
0x01E3 0000 ADD [BX+SI], AL
0x01E5 0000 ADD [BX+SI], AL
0x01E7 0000 ADD [BX+SI], AL
0x01E9 0000 ADD [BX+SI], AL
0x01EB 0000 ADD [BX+SI], AL
0x01ED 0000 ADD [BX+SI], AL
0x01EF 0000 ADD [BX+SI], AL
0x01F1 0000 ADD [BX+SI], AL
0x01F3 0000 ADD [BX+SI], AL
0x01F5 0000 ADD [BX+SI], AL
0x01F7 0000 ADD [BX+SI], AL
0x01F9 0000 ADD [BX+SI], AL
0x01FB 0000 ADD [BX+SI], AL
0x01FD 0055 aa ADD [DI-0x56], DL
Run date: 2012-08-12 10:14:21
-----------------------------
10:14:21.953 OS Version: Windows 5.1.2600 Service Pack 3
10:14:21.953 Number of processors: 1 586 0x2C02
10:14:21.953 ComputerName: MARTIN-B598CED7 UserName: Martin
10:14:22.593 Initialize success
10:15:08.750 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
10:15:08.750 Disk 0 Vendor: SAMSUNG_SP1203N TL100-30 Size: 114498MB BusType: 3
10:15:08.750 Disk 0 MBR read successfully
10:15:08.750 Disk 0 MBR scan
10:15:08.750 Disk 0 Windows XP default MBR code
10:15:08.750 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 24999 MB offset 63
10:15:08.750 Disk 0 Partition - 00 0F Extended LBA 89494 MB offset 51199155
10:15:08.765 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 89494 MB offset 51199218
10:15:08.765 Disk 0 scanning sectors +234484740
10:15:08.843 Disk 0 scanning C:\WINDOWS\system32\drivers
10:15:15.281 Service scanning
10:15:28.562 Modules scanning
10:15:35.171 Disk 0 trace - called modules:
10:15:35.187 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys videX32.sys PCIIDEX.SYS
10:15:35.687 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x89de7ab8]
10:15:35.687 3 CLASSPNP.SYS[ba108fd7] -> nt!IofCallDriver -> \Device\00000070[0x89df6908]
10:15:35.687 5 ACPI.sys[b9f7f620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x89df7940]
10:15:35.687 Scan finished successfully
10:15:51.062 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Martin\Dokumenty\Downloads\MBR.dat"
10:15:51.078 The log file has been saved successfully to "C:\Documents and Settings\Martin\Dokumenty\Downloads\aswMBR.txt"
SHA256: a89d2d86ecff3a8273cef85621ccf4b89ed8d5ac4e0d8d681d9b00ab75258622
File name: MBR.dat
Detection ratio: 0 / 42
Analysis date: 2012-08-12 08:44:39 UTC ( 1 minuta ago )
AhnLab-V3 - 20120808
AntiVir - 20120808
Antiy-AVL - 20120808
Avast - 20120808
AVG - 20120808
BitDefender - 20120808
ByteHero - 20120723
CAT-QuickHeal - 20120808
ClamAV - 20120808
Commtouch - 20120808
Comodo - 20120808
DrWeb - 20120808
Emsisoft - 20120808
eSafe - 20120808
ESET-NOD32 - 20120808
F-Prot - 20120808
F-Secure - 20120808
Fortinet - 20120808
GData - 20120808
Ikarus - 20120808
Jiangmin - 20120808
K7AntiVirus - 20120808
Kaspersky - 20120808
McAfee - 20120808
McAfee-GW-Edition - 20120808
Microsoft - 20120808
Norman - 20120808
nProtect - 20120808
Panda - 20120808
PCTools - 20120808
Rising - 20120808
Sophos - 20120808
SUPERAntiSpyware - 20120808
Symantec - 20120808
TheHacker - 20120808
TotalDefense - 20120807
TrendMicro - 20120808
TrendMicro-HouseCall - 20120808
VBA32 - 20120807
VIPRE - 20120808
ViRobot - 20120808
VirusBuster - 20120808
Re: Problém s napadeným PC - generic27.AkPW- log z RSIT přil
Test dump souborů na virustoal:
SHA256: 6e2c48141e7eae816a642346e43e0a016fc8c6e0c0ad2ef2ae1b662314aa2dac
File name: Dump_Hdd0_DR0.mbr
Detection ratio: 15 / 42
Analysis date: 2012-08-12 09:18:21 UTC ( 0 minut ago )
AhnLab-V3 - 20120811
AntiVir - 20120812
Antiy-AVL - 20120811
Avast Win32:MBRoot-J [Trj] 20120812
AVG - 20120812
BitDefender Rootkit.MBR.Mebroot.B (Boot image) 20120812
ByteHero - 20120723
CAT-QuickHeal BootKit.Wistler 20120811
ClamAV - 20120811
Commtouch MBRoot.C 20120811
Comodo - 20120812
DrWeb - 20120812
Emsisoft Trojan.DOS.Sinowal!IK 20120812
eSafe - 20120809
ESET-NOD32 - 20120811
F-Prot MBRoot.C 20120810
F-Secure Rootkit.MBR.Mebroot.B \(Boot image\) 20120812
Fortinet - 20120812
GData Rootkit.MBR.Mebroot.B 20120812
Ikarus Trojan.DOS.Sinowal 20120812
Jiangmin - 20120812
K7AntiVirus Backdoor 20120810
Kaspersky Rootkit.Boot.Sinowal.b 20120812
McAfee BackDoor-DWL!mbr 20120812
McAfee-GW-Edition BackDoor-DWL!mbr 20120811
Microsoft - 20120812
Norman - 20120811
nProtect - 20120810
Panda - 20120812
PCTools - 20120812
Rising - 20120810
Sophos - 20120812
SUPERAntiSpyware - 20120811
Symantec - 20120812
TheHacker - 20120812
TotalDefense Sinowal.A 20120812
TrendMicro - 20120812
TrendMicro-HouseCall - 20120812
VBA32 - 20120810
VIPRE Trojan.Boot.Sinowal.Gen (v) 20120812
ViRobot - 20120811
VirusBuster - 20120811
SHA256: a89d2d86ecff3a8273cef85621ccf4b89ed8d5ac4e0d8d681d9b00ab75258622
File name: Dump_Hdd0_DR0.old
Detection ratio: 0 / 38
Analysis date: 2012-08-12 09:20:44 UTC ( 1 minuta ago )
AntiVir - 20120808
Antiy-AVL - 20120808
Avast - 20120808
AVG - 20120808
BitDefender - 20120808
ByteHero - 20120723
CAT-QuickHeal - 20120808
Commtouch - 20120808
Comodo - 20120808
Emsisoft - 20120808
eSafe - 20120808
ESET-NOD32 - 20120808
F-Prot - 20120808
F-Secure - 20120808
Fortinet - 20120808
GData - 20120808
Ikarus - 20120808
Jiangmin - 20120808
K7AntiVirus - 20120808
Kaspersky - 20120808
McAfee - 20120808
McAfee-GW-Edition - 20120808
Microsoft - 20120808
Norman - 20120808
nProtect - 20120808
Panda - 20120808
PCTools - 20120808
Rising - 20120808
Sophos - 20120808
SUPERAntiSpyware - 20120808
Symantec - 20120808
TheHacker - 20120808
TotalDefense - 20120807
TrendMicro - 20120808
TrendMicro-HouseCall - 20120808
VIPRE - 20120808
ViRobot - 20120808
VirusBuster - 20120808
SHA256: 6e2c48141e7eae816a642346e43e0a016fc8c6e0c0ad2ef2ae1b662314aa2dac
File name: Dump_Hdd0_DR0.mbr
Detection ratio: 15 / 42
Analysis date: 2012-08-12 09:18:21 UTC ( 0 minut ago )
AhnLab-V3 - 20120811
AntiVir - 20120812
Antiy-AVL - 20120811
Avast Win32:MBRoot-J [Trj] 20120812
AVG - 20120812
BitDefender Rootkit.MBR.Mebroot.B (Boot image) 20120812
ByteHero - 20120723
CAT-QuickHeal BootKit.Wistler 20120811
ClamAV - 20120811
Commtouch MBRoot.C 20120811
Comodo - 20120812
DrWeb - 20120812
Emsisoft Trojan.DOS.Sinowal!IK 20120812
eSafe - 20120809
ESET-NOD32 - 20120811
F-Prot MBRoot.C 20120810
F-Secure Rootkit.MBR.Mebroot.B \(Boot image\) 20120812
Fortinet - 20120812
GData Rootkit.MBR.Mebroot.B 20120812
Ikarus Trojan.DOS.Sinowal 20120812
Jiangmin - 20120812
K7AntiVirus Backdoor 20120810
Kaspersky Rootkit.Boot.Sinowal.b 20120812
McAfee BackDoor-DWL!mbr 20120812
McAfee-GW-Edition BackDoor-DWL!mbr 20120811
Microsoft - 20120812
Norman - 20120811
nProtect - 20120810
Panda - 20120812
PCTools - 20120812
Rising - 20120810
Sophos - 20120812
SUPERAntiSpyware - 20120811
Symantec - 20120812
TheHacker - 20120812
TotalDefense Sinowal.A 20120812
TrendMicro - 20120812
TrendMicro-HouseCall - 20120812
VBA32 - 20120810
VIPRE Trojan.Boot.Sinowal.Gen (v) 20120812
ViRobot - 20120811
VirusBuster - 20120811
SHA256: a89d2d86ecff3a8273cef85621ccf4b89ed8d5ac4e0d8d681d9b00ab75258622
File name: Dump_Hdd0_DR0.old
Detection ratio: 0 / 38
Analysis date: 2012-08-12 09:20:44 UTC ( 1 minuta ago )
AntiVir - 20120808
Antiy-AVL - 20120808
Avast - 20120808
AVG - 20120808
BitDefender - 20120808
ByteHero - 20120723
CAT-QuickHeal - 20120808
Commtouch - 20120808
Comodo - 20120808
Emsisoft - 20120808
eSafe - 20120808
ESET-NOD32 - 20120808
F-Prot - 20120808
F-Secure - 20120808
Fortinet - 20120808
GData - 20120808
Ikarus - 20120808
Jiangmin - 20120808
K7AntiVirus - 20120808
Kaspersky - 20120808
McAfee - 20120808
McAfee-GW-Edition - 20120808
Microsoft - 20120808
Norman - 20120808
nProtect - 20120808
Panda - 20120808
PCTools - 20120808
Rising - 20120808
Sophos - 20120808
SUPERAntiSpyware - 20120808
Symantec - 20120808
TheHacker - 20120808
TotalDefense - 20120807
TrendMicro - 20120808
TrendMicro-HouseCall - 20120808
VIPRE - 20120808
ViRobot - 20120808
VirusBuster - 20120808
- Přílohy
-
- OTL a Extras.rar
- (94.4 KiB) Staženo 30 x
Re: Problém s napadeným PC - generic27.AkPW- log z RSIT přil
Přikládám vámi žádané soubory Dump a PhysicalMBR.
- Přílohy
-
- Dump z MBR a PhysicalMBR.rar
- (1.44 KiB) Staženo 48 x
Re: Problém s napadeným PC - generic27.AkPW- log z RSIT přil
Přikládám obrázek z příkazového řádku po zadání mbrfix/drive 0 driveinfo.
- obrázek cmd okna.jpg (46.03 KiB) Zobrazeno 1428 x
Re: Problém s napadeným PC - generic27.AkPW- log z RSIT přil
Zde je log z Avengeru:
Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com
Platform: Windows XP
*******************
Script file opened successfully.
Script file read successfully.
Backups directory opened successfully at C:\Avenger
*******************
Beginning to process script file:
Rootkit scan active.
No rootkits found!
Driver "xpsec" deleted successfully.
Driver "xcpip" deleted successfully.
Completed script processing.
*******************
Finished! Terminate.
Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com
Platform: Windows XP
*******************
Script file opened successfully.
Script file read successfully.
Backups directory opened successfully at C:\Avenger
*******************
Beginning to process script file:
Rootkit scan active.
No rootkits found!
Driver "xpsec" deleted successfully.
Driver "xcpip" deleted successfully.
Completed script processing.
*******************
Finished! Terminate.
Re: Problém s napadeným PC - generic27.AkPW- log z RSIT přil
Zde je log z MBRScanu a v příloze z OTL.
Kód: Vybrat vše
MBRScan v1.1.1
OS : Windows XP Home Service Pack 3 (32 bit)
PROCESSOR : x86 Family 15 Model 44 Stepping 2, AuthenticAMD
BOOT : Normal Boot
DATE : 2012/08/12 (ISO 8601) at 17:53:54
________________________________________________________________________________
DISK : Device\Harddisk0\DR0 __SAMSUNG SP1203N (TL100-30)
BUS_TYPE : (0x03) P-ATA
USE_PIO : YES
MAX_TRANSFER : 128 Kb
ALIGNMENT_MASK : word aligned
________________________________________________________________________________
DISK : Device\Harddisk1\DR3 __S31B0906 USB DISK (1100)
BUS_TYPE : (0x07) USB
USE_PIO : NO
MAX_TRANSFER : 64 Kb
ALIGNMENT_MASK : byte aligned
________________________________________________________________________________
Device\Harddisk0\DR0 111.8 Go [Fixed] ==> Unknown MBR Code
MBR_MD5 : 06C4A6CF948DAD9339030D6E53BF4BCE
MBR_SHA1 : 18DB7B7B89915336C7DACCA373AAA21223B7520E
Device\Harddisk0\Partition1 24.41 Go 0x07 NTFS / HPFS __ BOOTABLE __
Device\Harddisk0\Partition2 87.40 Go 0x07 NTFS / HPFS
________________________________________________________________________________
Device\Harddisk1\DR3 1.87 Go [Removable] ==> XP MBR Code
MBR_MD5 : 1A7A0C164C5B91B2D211A9A4EB07DE1F
MBR_SHA1 : 69245C6CECA93550846177BB5BC2F2BAD35DCF70
Device\Harddisk1\Partition1 1.87 Go __ BOOTABLE __
________________________________________________________________________________
############################### Additional scan ################################
DRIVER : C:\WINDOWS\system32\drivers\xpsec.sys => Invisible on the disk
ADDRESS : 0xB01D1000
SIZE : 76.0 Ko
DRIVER : C:\WINDOWS\system32\drivers\xcpip.sys => Invisible on the disk
ADDRESS : 0xB0178000
SIZE : 356.0 Ko
SystemStartOptions : NOEXECUTE=OPTIN FASTDETECT
________________________________________________________________________________
_____FAKED \Device\Harddisk0\DR0
0x00000000 33 C0 8E D8 8E C0 8E D0 BC 00 7C BE 1A 7C BF 00 3À.Ø.À.м.|¾.|¿.
0x00000010 06 B9 E6 01 50 57 FC F3 A4 CB BE A4 07 B1 04 90 .¹æ.PWüó¤Ë¾¤.±..
0x00000020 80 3C 80 74 0D 38 2C 0F 85 C0 00 83 C6 10 E2 F0 .<.t.8,..À..Æ.âð
0x00000030 CD 18 66 8B 44 08 8B 14 89 E3 B9 01 00 E8 64 00 Í.f.D....ã¹..èd.
0x00000040 73 0C 8B 4C 02 B8 01 02 CD 13 0F 82 B8 00 B9 55 s..L.¸..Í...¸.¹U
0x00000050 AA 2B 0E FE 7D 0F 85 CF 00 66 B8 00 00 00 00 66 ª+.þ}..Ï.f¸....f
0x00000060 39 44 08 72 08 66 8B 44 08 66 03 44 0C 83 C6 10 9D.r.f.D.f.D..Æ.
0x00000070 81 FE E4 07 72 E9 66 09 C0 74 1E B9 09 00 81 C3 .þä.réf.Àt.¹...Ã
0x00000080 00 02 E8 1F 00 72 12 89 DE 81 C6 0C 02 8D 54 F4 ..è..r..Þ.Æ...Tô
0x00000090 66 81 3C 75 2F F3 A4 74 05 EA 00 7C 00 00 89 DE f.<u/ó¤t.ê.|...Þ
0x000000A0 FF D2 EB F5 66 60 B2 80 BB AA 55 B4 41 CD 13 73 .Òëõf`².»ªU´AÍ.s
0x000000B0 04 F9 66 61 C3 81 FB 55 AA 75 F6 F6 C1 01 74 F1 .ùfaÃ.ûUªuööÁ.tñ
0x000000C0 66 61 66 60 6A 00 6A 00 66 50 06 53 51 6A 10 B4 faf`j.j.fP.SQj.´
0x000000D0 42 89 E6 CD 13 61 66 61 C3 5E AC 08 C0 74 FC 56 B.æÍ.afaÃ^¬.ÀtüV
0x000000E0 1E BB 07 00 B4 0E CD 10 1F EB EE E8 EB FF 49 6E .»..´.Í..ëîèë.In
0x000000F0 76 61 6C 69 64 20 70 61 72 74 69 74 69 6F 6E 20 valid partition
0x00000100 74 61 62 6C 65 00 E8 D0 FF 45 72 72 6F 72 20 6C table.èÐ.Error l
0x00000110 6F 61 64 69 6E 67 20 6F 70 65 72 61 74 69 6E 67 oading operating
0x00000120 20 73 79 73 74 65 6D 00 E8 AE FF 4D 69 73 73 69 system.è®.Missi
0x00000130 6E 67 20 6F 70 65 72 61 74 69 6E 67 20 73 79 73 ng operating sys
0x00000140 74 65 6D 00 00 00 00 00 00 00 00 00 00 00 00 00 tem.............
0x00000150 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x00000160 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x00000170 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x00000180 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x00000190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x000001A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x000001B0 00 00 00 00 00 2C 44 6A E4 43 E5 43 00 00 80 01 .....,DjäCåC....
0x000001C0 01 00 07 FE FF FF 3F 00 00 00 74 3C 0D 03 00 00 ...þ..?...t<....
0x000001D0 C1 FF 0F FE FF FF B3 3C 0D 03 51 B7 EC 0A 00 00 Á..þ..³<..Q·ì...
0x000001E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x000001F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA ..............Uª
__ORIGINAL \Device\Harddisk0\DR0
0x00000000 33 C0 8E D0 BC 00 7C FB 50 07 50 1F FC BE 1B 7C 3À.м.|ûP.P.ü¾.|
0x00000010 BF 1B 06 50 57 B9 E5 01 F3 A4 CB BD BE 07 B1 04 ¿..PW¹å.ó¤Ë½¾.±.
0x00000020 38 6E 00 7C 09 75 13 83 C5 10 E2 F4 CD 18 8B F5 8n.|.u..Å.âôÍ..õ
0x00000030 83 C6 10 49 74 19 38 2C 74 F6 A0 B5 07 B4 07 8B .Æ.It.8,tö.µ.´..
0x00000040 F0 AC 3C 00 74 FC BB 07 00 B4 0E CD 10 EB F2 88 ð¬<.tü»..´.Í.ëò.
0x00000050 4E 10 E8 46 00 73 2A FE 46 10 80 7E 04 0B 74 0B N.èF.s*þF..~..t.
0x00000060 80 7E 04 0C 74 05 A0 B6 07 75 D2 80 46 02 06 83 .~..t..¶.uÒ.F...
0x00000070 46 08 06 83 56 0A 00 E8 21 00 73 05 A0 B6 07 EB F...V..è!.s..¶.ë
0x00000080 BC 81 3E FE 7D 55 AA 74 0B 80 7E 10 00 74 C8 A0 ¼.>þ}Uªt..~..tÈ.
0x00000090 B7 07 EB A9 8B FC 1E 57 8B F5 CB BF 05 00 8A 56 ·.ë©.ü.W.õË¿...V
0x000000A0 00 B4 08 CD 13 72 23 8A C1 24 3F 98 8A DE 8A FC .´.Í.r#.Á$?..Þ.ü
0x000000B0 43 F7 E3 8B D1 86 D6 B1 06 D2 EE 42 F7 E2 39 56 C÷ã.Ñ.Ö±.ÒîB÷â9V
0x000000C0 0A 77 23 72 05 39 46 08 73 1C B8 01 02 BB 00 7C .w#r.9F.s.¸..».|
0x000000D0 8B 4E 02 8B 56 00 CD 13 73 51 4F 74 4E 32 E4 8A .N..V.Í.sQOtN2ä.
0x000000E0 56 00 CD 13 EB E4 8A 56 00 60 BB AA 55 B4 41 CD V.Í.ëä.V.`»ªU´AÍ
0x000000F0 13 72 36 81 FB 55 AA 75 30 F6 C1 01 74 2B 61 60 .r6.ûUªu0öÁ.t+a`
0x00000100 6A 00 6A 00 FF 76 0A FF 76 08 6A 00 68 00 7C 6A j.j..v..v.j.h.|j
0x00000110 01 6A 10 B4 42 8B F4 CD 13 61 61 73 0E 4F 74 0B .j.´B.ôÍ.aas.Ot.
0x00000120 32 E4 8A 56 00 CD 13 EB D6 61 F9 C3 4E 65 70 6C 2ä.V.Í.ëÖaùÃNepl
0x00000130 61 74 6E A0 20 74 61 62 75 6C 6B 61 20 6F 64 64 atn. tabulka odd
0x00000140 A1 6C 85 00 43 68 79 62 61 20 70 FD 69 20 6E 61 ¡l..Chyba pýi na
0x00000150 9F A1 74 A0 6E A1 20 6F 70 65 72 61 9F 6E A1 68 .¡t.n¡ opera.n¡h
0x00000160 6F 20 73 79 73 74 82 6D 75 00 4F 70 65 72 61 9F o syst.mu.Opera.
0x00000170 6E A1 20 73 79 73 74 82 6D 20 6E 65 6E 61 6C 65 n¡ syst.m nenale
0x00000180 7A 65 6E 00 00 00 00 00 00 00 00 00 00 00 00 00 zen.............
0x00000190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x000001A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x000001B0 00 00 00 00 00 2C 44 6A E4 43 E5 43 00 00 80 01 .....,DjäCåC....
0x000001C0 01 00 07 FE FF FF 3F 00 00 00 74 3C 0D 03 00 00 ...þ..?...t<....
0x000001D0 C1 FF 0F FE FF FF B3 3C 0D 03 51 B7 EC 0A 00 00 Á..þ..³<..Q·ì...
0x000001E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x000001F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA ..............Uª
__________________________16_BIT_ASM_CODE
0x0000 33c0 XOR AX, AX
0x0002 8ed8 MOV DS, AX
0x0004 8ec0 MOV ES, AX
0x0006 8ed0 MOV SS, AX
0x0008 bc 007c MOV SP, 0x7c00
0x000B be 1a7c MOV SI, 0x7c1a
0x000E bf 0006 MOV DI, 0x600
0x0011 b9 e601 MOV CX, 0x1e6
0x0014 50 PUSH AX
0x0015 57 PUSH DI
0x0016 fc CLD
0x0017 f3 a4 REP MOVSB
0x0019 cb RETF
0x001A be a407 MOV SI, 0x7a4
0x001D b1 04 MOV CL, 0x4
0x001F 90 NOP
0x0020 803c 80 CMP BYTE [SI], 0x80
0x0023 74 0d JZ 0x32
0x0025 382c CMP [SI], CH
0x0027 0f85 c000 JNZ 0xeb
0x002B 83c6 10 ADD SI, 0x10
0x002E e2 f0 LOOP 0x20
0x0030 cd 18 INT 0x18
0x0032 66 8b44 08 MOV EAX, [SI+0x8]
0x0036 8b14 MOV DX, [SI]
0x0038 89e3 MOV BX, SP
0x003A b9 0100 MOV CX, 0x1
0x003D e8 6400 CALL 0xa4
0x0040 73 0c JAE 0x4e
0x0042 8b4c 02 MOV CX, [SI+0x2]
0x0045 b8 0102 MOV AX, 0x201
0x0048 cd 13 INT 0x13
0x004A 0f82 b800 JB 0x106
0x004E b9 55aa MOV CX, 0xaa55
0x0051 2b0e fe7d SUB CX, [0x7dfe]
0x0055 0f85 cf00 JNZ 0x128
0x0059 66 b8 00000000 MOV EAX, 0x0
0x005F 66 3944 08 CMP [SI+0x8], EAX
0x0063 72 08 JB 0x6d
0x0065 66 8b44 08 MOV EAX, [SI+0x8]
0x0069 66 0344 0c ADD EAX, [SI+0xc]
0x006D 83c6 10 ADD SI, 0x10
0x0070 81fe e407 CMP SI, 0x7e4
0x0074 72 e9 JB 0x5f
0x0076 66 09c0 OR EAX, EAX
0x0079 74 1e JZ 0x99
0x007B b9 0900 MOV CX, 0x9
0x007E 81c3 0002 ADD BX, 0x200
0x0082 e8 1f00 CALL 0xa4
0x0085 72 12 JB 0x99
0x0087 89de MOV SI, BX
0x0089 81c6 0c02 ADD SI, 0x20c
0x008D 8d54 f4 LEA DX, [SI-0xc]
0x0090 66 813c 752ff3a4CMP DWORD [SI], 0xa4f32f75
0x0097 74 05 JZ 0x9e
0x0099 ea 007c 0000 JMP FAR 0x0:0x7c00
0x009E 89de MOV SI, BX
0x00A0 ffd2 CALL DX
0x00A2 eb f5 JMP 0x99
0x00A4 66 60 PUSHAD
0x00A6 b2 80 MOV DL, 0x80
0x00A8 bb aa55 MOV BX, 0x55aa
0x00AB b4 41 MOV AH, 0x41
0x00AD cd 13 INT 0x13
0x00AF 73 04 JAE 0xb5
0x00B1 f9 STC
0x00B2 66 61 POPAD
0x00B4 c3 RET
0x00B5 81fb 55aa CMP BX, 0xaa55
0x00B9 75 f6 JNZ 0xb1
0x00BB f6c1 01 TEST CL, 0x1
0x00BE 74 f1 JZ 0xb1
0x00C0 66 61 POPAD
0x00C2 66 60 PUSHAD
0x00C4 6a 00 PUSH 0x0
0x00C6 6a 00 PUSH 0x0
0x00C8 66 50 PUSH EAX
0x00CA 06 PUSH ES
0x00CB 53 PUSH BX
0x00CC 51 PUSH CX
0x00CD 6a 10 PUSH 0x10
0x00CF b4 42 MOV AH, 0x42
0x00D1 89e6 MOV SI, SP
0x00D3 cd 13 INT 0x13
0x00D5 61 POPA
0x00D6 66 61 POPAD
0x00D8 c3 RET
0x00D9 5e POP SI
0x00DA ac LODSB
0x00DB 08c0 OR AL, AL
0x00DD 74 fc JZ 0xdb
0x00DF 56 PUSH SI
0x00E0 1e PUSH DS
0x00E1 bb 0700 MOV BX, 0x7
0x00E4 b4 0e MOV AH, 0xe
0x00E6 cd 10 INT 0x10
0x00E8 1f POP DS
0x00E9 eb ee JMP 0xd9
0x00EB e8 ebff CALL 0xd9
0x00EE 49 DEC CX
0x00EF 6e OUTSB
0x00F0 76 61 JBE 0x153
0x00F2 6c INSB
0x00F3 6964 20 7061 IMUL SP, [SI+0x20], 0x6170
0x00F8 72 74 JB 0x16e
0x00FA 6974 69 6f6e IMUL SI, [SI+0x69], 0x6e6f
0x00FF 2074 61 AND [SI+0x61], DH
0x0102 626c 65 BOUND BP, [SI+0x65]
0x0105 00e8 ADD AL, CH
0x0107 d0ff SAR BH, 0x1
0x0109 45 INC BP
0x010A 72 72 JB 0x17e
0x010C 6f OUTSW
0x010D 72 20 JB 0x12f
0x010F 6c INSB
0x0110 6f OUTSW
0x0111 61 POPA
0x0112 64 696e 67 206f IMUL BP, FS:[BP+0x67], 0x6f20
0x0118 70 65 JO 0x17f
0x011A 72 61 JB 0x17d
0x011C 74 69 JZ 0x187
0x011E 6e OUTSB
0x011F 67 2073 79 AND [EBX+0x79], DH
0x0123 73 74 JAE 0x199
0x0125 65 6d INS WORD GS:[DI], DX
0x0127 00e8 ADD AL, CH
0x0129 ae SCASB
0x012A ff4d 69 DEC WORD [DI+0x69]
0x012D 73 73 JAE 0x1a2
0x012F 696e 67 206f IMUL BP, [BP+0x67], 0x6f20
0x0134 70 65 JO 0x19b
0x0136 72 61 JB 0x199
0x0138 74 69 JZ 0x1a3
0x013A 6e OUTSB
0x013B 67 2073 79 AND [EBX+0x79], DH
0x013F 73 74 JAE 0x1b5
0x0141 65 6d INS WORD GS:[DI], DX
0x0143 0000 ADD [BX+SI], AL
0x0145 0000 ADD [BX+SI], AL
0x0147 0000 ADD [BX+SI], AL
0x0149 0000 ADD [BX+SI], AL
0x014B 0000 ADD [BX+SI], AL
0x014D 0000 ADD [BX+SI], AL
0x014F 0000 ADD [BX+SI], AL
0x0151 0000 ADD [BX+SI], AL
0x0153 0000 ADD [BX+SI], AL
0x0155 0000 ADD [BX+SI], AL
0x0157 0000 ADD [BX+SI], AL
0x0159 0000 ADD [BX+SI], AL
0x015B 0000 ADD [BX+SI], AL
0x015D 0000 ADD [BX+SI], AL
0x015F 0000 ADD [BX+SI], AL
0x0161 0000 ADD [BX+SI], AL
0x0163 0000 ADD [BX+SI], AL
0x0165 0000 ADD [BX+SI], AL
0x0167 0000 ADD [BX+SI], AL
0x0169 0000 ADD [BX+SI], AL
0x016B 0000 ADD [BX+SI], AL
0x016D 0000 ADD [BX+SI], AL
0x016F 0000 ADD [BX+SI], AL
0x0171 0000 ADD [BX+SI], AL
0x0173 0000 ADD [BX+SI], AL
0x0175 0000 ADD [BX+SI], AL
0x0177 0000 ADD [BX+SI], AL
0x0179 0000 ADD [BX+SI], AL
0x017B 0000 ADD [BX+SI], AL
0x017D 0000 ADD [BX+SI], AL
0x017F 0000 ADD [BX+SI], AL
0x0181 0000 ADD [BX+SI], AL
0x0183 0000 ADD [BX+SI], AL
0x0185 0000 ADD [BX+SI], AL
0x0187 0000 ADD [BX+SI], AL
0x0189 0000 ADD [BX+SI], AL
0x018B 0000 ADD [BX+SI], AL
0x018D 0000 ADD [BX+SI], AL
0x018F 0000 ADD [BX+SI], AL
0x0191 0000 ADD [BX+SI], AL
0x0193 0000 ADD [BX+SI], AL
0x0195 0000 ADD [BX+SI], AL
0x0197 0000 ADD [BX+SI], AL
0x0199 0000 ADD [BX+SI], AL
0x019B 0000 ADD [BX+SI], AL
0x019D 0000 ADD [BX+SI], AL
0x019F 0000 ADD [BX+SI], AL
0x01A1 0000 ADD [BX+SI], AL
0x01A3 0000 ADD [BX+SI], AL
0x01A5 0000 ADD [BX+SI], AL
0x01A7 0000 ADD [BX+SI], AL
0x01A9 0000 ADD [BX+SI], AL
0x01AB 0000 ADD [BX+SI], AL
0x01AD 0000 ADD [BX+SI], AL
0x01AF 0000 ADD [BX+SI], AL
0x01B1 0000 ADD [BX+SI], AL
0x01B3 0000 ADD [BX+SI], AL
0x01B5 2c 44 SUB AL, 0x44
0x01B7 6a e4 PUSH -0x1c
0x01B9 43 INC BX
0x01BA e5 43 IN AX, 0x43
0x01BC 0000 ADD [BX+SI], AL
0x01BE 8001 01 ADD BYTE [BX+DI], 0x1
0x01C1 0007 ADD [BX], AL
0x01C3 fe DB 0xfe
0x01C4 ff DB 0xff
0x01C5 ff DB 0xff
0x01C6 3f AAS
0x01C7 0000 ADD [BX+SI], AL
0x01C9 0074 3c ADD [SI+0x3c], DH
0x01CC 0d 0300 OR AX, 0x3
0x01CF 00c1 ADD CL, AL
0x01D1 ff0f DEC WORD [BX]
0x01D3 fe DB 0xfe
0x01D4 ff DB 0xff
0x01D5 ffb3 3c0d PUSH WORD [BP+DI+0xd3c]
0x01D9 0351 b7 ADD DX, [BX+DI-0x49]
0x01DC ec IN AL, DX
0x01DD 0a00 OR AL, [BX+SI]
0x01DF 0000 ADD [BX+SI], AL
0x01E1 0000 ADD [BX+SI], AL
0x01E3 0000 ADD [BX+SI], AL
0x01E5 0000 ADD [BX+SI], AL
0x01E7 0000 ADD [BX+SI], AL
0x01E9 0000 ADD [BX+SI], AL
0x01EB 0000 ADD [BX+SI], AL
0x01ED 0000 ADD [BX+SI], AL
0x01EF 0000 ADD [BX+SI], AL
0x01F1 0000 ADD [BX+SI], AL
0x01F3 0000 ADD [BX+SI], AL
0x01F5 0000 ADD [BX+SI], AL
0x01F7 0000 ADD [BX+SI], AL
0x01F9 0000 ADD [BX+SI], AL
0x01FB 0000 ADD [BX+SI], AL
0x01FD 0055 aa ADD [DI-0x56], DL
_______MBR \Device\Harddisk1\DR3
0x00000000 33 C0 8E D0 BC 00 7C FB 50 07 50 1F FC BE 1B 7C 3À.м.|ûP.P.ü¾.|
0x00000010 BF 1B 06 50 57 B9 E5 01 F3 A4 CB BD BE 07 B1 04 ¿..PW¹å.ó¤Ë½¾.±.
0x00000020 38 6E 00 7C 09 75 13 83 C5 10 E2 F4 CD 18 8B F5 8n.|.u..Å.âôÍ..õ
0x00000030 83 C6 10 49 74 19 38 2C 74 F6 A0 B5 07 B4 07 8B .Æ.It.8,tö.µ.´..
0x00000040 F0 AC 3C 00 74 FC BB 07 00 B4 0E CD 10 EB F2 88 ð¬<.tü»..´.Í.ëò.
0x00000050 4E 10 E8 46 00 73 2A FE 46 10 80 7E 04 0B 74 0B N.èF.s*þF..~..t.
0x00000060 80 7E 04 0C 74 05 A0 B6 07 75 D2 80 46 02 06 83 .~..t..¶.uÒ.F...
0x00000070 46 08 06 83 56 0A 00 E8 21 00 73 05 A0 B6 07 EB F...V..è!.s..¶.ë
0x00000080 BC 81 3E FE 7D 55 AA 74 0B 80 7E 10 00 74 C8 A0 ¼.>þ}Uªt..~..tÈ.
0x00000090 B7 07 EB A9 8B FC 1E 57 8B F5 CB BF 05 00 8A 56 ·.ë©.ü.W.õË¿...V
0x000000A0 00 B4 08 CD 13 72 23 8A C1 24 3F 98 8A DE 8A FC .´.Í.r#.Á$?..Þ.ü
0x000000B0 43 F7 E3 8B D1 86 D6 B1 06 D2 EE 42 F7 E2 39 56 C÷ã.Ñ.Ö±.ÒîB÷â9V
0x000000C0 0A 77 23 72 05 39 46 08 73 1C B8 01 02 BB 00 7C .w#r.9F.s.¸..».|
0x000000D0 8B 4E 02 8B 56 00 CD 13 73 51 4F 74 4E 32 E4 8A .N..V.Í.sQOtN2ä.
0x000000E0 56 00 CD 13 EB E4 8A 56 00 60 BB AA 55 B4 41 CD V.Í.ëä.V.`»ªU´AÍ
0x000000F0 13 72 36 81 FB 55 AA 75 30 F6 C1 01 74 2B 61 60 .r6.ûUªu0öÁ.t+a`
0x00000100 6A 00 6A 00 FF 76 0A FF 76 08 6A 00 68 00 7C 6A j.j..v..v.j.h.|j
0x00000110 01 6A 10 B4 42 8B F4 CD 13 61 61 73 0E 4F 74 0B .j.´B.ôÍ.aas.Ot.
0x00000120 32 E4 8A 56 00 CD 13 EB D6 61 F9 C3 49 6E 76 61 2ä.V.Í.ëÖaùÃInva
0x00000130 6C 69 64 20 70 61 72 74 69 74 69 6F 6E 20 74 61 lid partition ta
0x00000140 62 6C 65 00 45 72 72 6F 72 20 6C 6F 61 64 69 6E ble.Error loadin
0x00000150 67 20 6F 70 65 72 61 74 69 6E 67 20 73 79 73 74 g operating syst
0x00000160 65 6D 00 4D 69 73 73 69 6E 67 20 6F 70 65 72 61 em.Missing opera
0x00000170 74 69 6E 67 20 73 79 73 74 65 6D 00 00 00 00 00 ting system.....
0x00000180 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x00000190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x000001A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x000001B0 00 00 00 00 00 2C 44 63 18 2E 07 C3 00 00 80 01 .....,Dc...Ã....
0x000001C0 01 00 0B 80 E0 BC 20 00 00 00 E0 BF 3B 00 00 00 ....༠...à¿;...
0x000001D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x000001E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x000001F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA ..............Uª
__________________________16_BIT_ASM_CODE
0x0000 33c0 XOR AX, AX
0x0002 8ed0 MOV SS, AX
0x0004 bc 007c MOV SP, 0x7c00
0x0007 fb STI
0x0008 50 PUSH AX
0x0009 07 POP ES
0x000A 50 PUSH AX
0x000B 1f POP DS
0x000C fc CLD
0x000D be 1b7c MOV SI, 0x7c1b
0x0010 bf 1b06 MOV DI, 0x61b
0x0013 50 PUSH AX
0x0014 57 PUSH DI
0x0015 b9 e501 MOV CX, 0x1e5
0x0018 f3 a4 REP MOVSB
0x001A cb RETF
0x001B bd be07 MOV BP, 0x7be
0x001E b1 04 MOV CL, 0x4
0x0020 386e 00 CMP [BP+0x0], CH
0x0023 7c 09 JL 0x2e
0x0025 75 13 JNZ 0x3a
0x0027 83c5 10 ADD BP, 0x10
0x002A e2 f4 LOOP 0x20
0x002C cd 18 INT 0x18
0x002E 8bf5 MOV SI, BP
0x0030 83c6 10 ADD SI, 0x10
0x0033 49 DEC CX
0x0034 74 19 JZ 0x4f
0x0036 382c CMP [SI], CH
0x0038 74 f6 JZ 0x30
0x003A a0 b507 MOV AL, [0x7b5]
0x003D b4 07 MOV AH, 0x7
0x003F 8bf0 MOV SI, AX
0x0041 ac LODSB
0x0042 3c 00 CMP AL, 0x0
0x0044 74 fc JZ 0x42
0x0046 bb 0700 MOV BX, 0x7
0x0049 b4 0e MOV AH, 0xe
0x004B cd 10 INT 0x10
0x004D eb f2 JMP 0x41
0x004F 884e 10 MOV [BP+0x10], CL
0x0052 e8 4600 CALL 0x9b
0x0055 73 2a JAE 0x81
0x0057 fe46 10 INC BYTE [BP+0x10]
0x005A 807e 04 0b CMP BYTE [BP+0x4], 0xb
0x005E 74 0b JZ 0x6b
0x0060 807e 04 0c CMP BYTE [BP+0x4], 0xc
0x0064 74 05 JZ 0x6b
0x0066 a0 b607 MOV AL, [0x7b6]
0x0069 75 d2 JNZ 0x3d
0x006B 8046 02 06 ADD BYTE [BP+0x2], 0x6
0x006F 8346 08 06 ADD WORD [BP+0x8], 0x6
0x0073 8356 0a 00 ADC WORD [BP+0xa], 0x0
0x0077 e8 2100 CALL 0x9b
0x007A 73 05 JAE 0x81
0x007C a0 b607 MOV AL, [0x7b6]
0x007F eb bc JMP 0x3d
0x0081 813e fe7d 55aa CMP WORD [0x7dfe], 0xaa55
0x0087 74 0b JZ 0x94
0x0089 807e 10 00 CMP BYTE [BP+0x10], 0x0
0x008D 74 c8 JZ 0x57
0x008F a0 b707 MOV AL, [0x7b7]
0x0092 eb a9 JMP 0x3d
0x0094 8bfc MOV DI, SP
0x0096 1e PUSH DS
0x0097 57 PUSH DI
0x0098 8bf5 MOV SI, BP
0x009A cb RETF
0x009B bf 0500 MOV DI, 0x5
0x009E 8a56 00 MOV DL, [BP+0x0]
0x00A1 b4 08 MOV AH, 0x8
0x00A3 cd 13 INT 0x13
0x00A5 72 23 JB 0xca
0x00A7 8ac1 MOV AL, CL
0x00A9 24 3f AND AL, 0x3f
0x00AB 98 CBW
0x00AC 8ade MOV BL, DH
0x00AE 8afc MOV BH, AH
0x00B0 43 INC BX
0x00B1 f7e3 MUL BX
0x00B3 8bd1 MOV DX, CX
0x00B5 86d6 XCHG DH, DL
0x00B7 b1 06 MOV CL, 0x6
0x00B9 d2ee SHR DH, CL
0x00BB 42 INC DX
0x00BC f7e2 MUL DX
0x00BE 3956 0a CMP [BP+0xa], DX
0x00C1 77 23 JA 0xe6
0x00C3 72 05 JB 0xca
0x00C5 3946 08 CMP [BP+0x8], AX
0x00C8 73 1c JAE 0xe6
0x00CA b8 0102 MOV AX, 0x201
0x00CD bb 007c MOV BX, 0x7c00
0x00D0 8b4e 02 MOV CX, [BP+0x2]
0x00D3 8b56 00 MOV DX, [BP+0x0]
0x00D6 cd 13 INT 0x13
0x00D8 73 51 JAE 0x12b
0x00DA 4f DEC DI
0x00DB 74 4e JZ 0x12b
0x00DD 32e4 XOR AH, AH
0x00DF 8a56 00 MOV DL, [BP+0x0]
0x00E2 cd 13 INT 0x13
0x00E4 eb e4 JMP 0xca
0x00E6 8a56 00 MOV DL, [BP+0x0]
0x00E9 60 PUSHA
0x00EA bb aa55 MOV BX, 0x55aa
0x00ED b4 41 MOV AH, 0x41
0x00EF cd 13 INT 0x13
0x00F1 72 36 JB 0x129
0x00F3 81fb 55aa CMP BX, 0xaa55
0x00F7 75 30 JNZ 0x129
0x00F9 f6c1 01 TEST CL, 0x1
0x00FC 74 2b JZ 0x129
0x00FE 61 POPA
0x00FF 60 PUSHA
0x0100 6a 00 PUSH 0x0
0x0102 6a 00 PUSH 0x0
0x0104 ff76 0a PUSH WORD [BP+0xa]
0x0107 ff76 08 PUSH WORD [BP+0x8]
0x010A 6a 00 PUSH 0x0
0x010C 68 007c PUSH 0x7c00
0x010F 6a 01 PUSH 0x1
0x0111 6a 10 PUSH 0x10
0x0113 b4 42 MOV AH, 0x42
0x0115 8bf4 MOV SI, SP
0x0117 cd 13 INT 0x13
0x0119 61 POPA
0x011A 61 POPA
0x011B 73 0e JAE 0x12b
0x011D 4f DEC DI
0x011E 74 0b JZ 0x12b
0x0120 32e4 XOR AH, AH
0x0122 8a56 00 MOV DL, [BP+0x0]
0x0125 cd 13 INT 0x13
0x0127 eb d6 JMP 0xff
0x0129 61 POPA
0x012A f9 STC
0x012B c3 RET
0x012C 49 DEC CX
0x012D 6e OUTSB
0x012E 76 61 JBE 0x191
0x0130 6c INSB
0x0131 6964 20 7061 IMUL SP, [SI+0x20], 0x6170
0x0136 72 74 JB 0x1ac
0x0138 6974 69 6f6e IMUL SI, [SI+0x69], 0x6e6f
0x013D 2074 61 AND [SI+0x61], DH
0x0140 626c 65 BOUND BP, [SI+0x65]
0x0143 0045 72 ADD [DI+0x72], AL
0x0146 72 6f JB 0x1b7
0x0148 72 20 JB 0x16a
0x014A 6c INSB
0x014B 6f OUTSW
0x014C 61 POPA
0x014D 64 696e 67 206f IMUL BP, FS:[BP+0x67], 0x6f20
0x0153 70 65 JO 0x1ba
0x0155 72 61 JB 0x1b8
0x0157 74 69 JZ 0x1c2
0x0159 6e OUTSB
0x015A 67 2073 79 AND [EBX+0x79], DH
0x015E 73 74 JAE 0x1d4
0x0160 65 6d INS WORD GS:[DI], DX
0x0162 004d 69 ADD [DI+0x69], CL
0x0165 73 73 JAE 0x1da
0x0167 696e 67 206f IMUL BP, [BP+0x67], 0x6f20
0x016C 70 65 JO 0x1d3
0x016E 72 61 JB 0x1d1
0x0170 74 69 JZ 0x1db
0x0172 6e OUTSB
0x0173 67 2073 79 AND [EBX+0x79], DH
0x0177 73 74 JAE 0x1ed
0x0179 65 6d INS WORD GS:[DI], DX
0x017B 0000 ADD [BX+SI], AL
0x017D 0000 ADD [BX+SI], AL
0x017F 0000 ADD [BX+SI], AL
0x0181 0000 ADD [BX+SI], AL
0x0183 0000 ADD [BX+SI], AL
0x0185 0000 ADD [BX+SI], AL
0x0187 0000 ADD [BX+SI], AL
0x0189 0000 ADD [BX+SI], AL
0x018B 0000 ADD [BX+SI], AL
0x018D 0000 ADD [BX+SI], AL
0x018F 0000 ADD [BX+SI], AL
0x0191 0000 ADD [BX+SI], AL
0x0193 0000 ADD [BX+SI], AL
0x0195 0000 ADD [BX+SI], AL
0x0197 0000 ADD [BX+SI], AL
0x0199 0000 ADD [BX+SI], AL
0x019B 0000 ADD [BX+SI], AL
0x019D 0000 ADD [BX+SI], AL
0x019F 0000 ADD [BX+SI], AL
0x01A1 0000 ADD [BX+SI], AL
0x01A3 0000 ADD [BX+SI], AL
0x01A5 0000 ADD [BX+SI], AL
0x01A7 0000 ADD [BX+SI], AL
0x01A9 0000 ADD [BX+SI], AL
0x01AB 0000 ADD [BX+SI], AL
0x01AD 0000 ADD [BX+SI], AL
0x01AF 0000 ADD [BX+SI], AL
0x01B1 0000 ADD [BX+SI], AL
0x01B3 0000 ADD [BX+SI], AL
0x01B5 2c 44 SUB AL, 0x44
0x01B7 6318 ARPL [BX+SI], BX
0x01B9 2e DB 0x2e
0x01B9 2e 07 POP ES
0x01BB c3 RET
0x01BC 0000 ADD [BX+SI], AL
0x01BE 8001 01 ADD BYTE [BX+DI], 0x1
0x01C1 000b ADD [BP+DI], CL
0x01C3 80e0 bc AND AL, 0xbc
0x01C6 2000 AND [BX+SI], AL
0x01C8 0000 ADD [BX+SI], AL
0x01CA e0 bf LOOPNZ 0x18b
0x01CC 3b00 CMP AX, [BX+SI]
0x01CE 0000 ADD [BX+SI], AL
0x01D0 0000 ADD [BX+SI], AL
0x01D2 0000 ADD [BX+SI], AL
0x01D4 0000 ADD [BX+SI], AL
0x01D6 0000 ADD [BX+SI], AL
0x01D8 0000 ADD [BX+SI], AL
0x01DA 0000 ADD [BX+SI], AL
0x01DC 0000 ADD [BX+SI], AL
0x01DE 0000 ADD [BX+SI], AL
0x01E0 0000 ADD [BX+SI], AL
0x01E2 0000 ADD [BX+SI], AL
0x01E4 0000 ADD [BX+SI], AL
0x01E6 0000 ADD [BX+SI], AL
0x01E8 0000 ADD [BX+SI], AL
0x01EA 0000 ADD [BX+SI], AL
0x01EC 0000 ADD [BX+SI], AL
0x01EE 0000 ADD [BX+SI], AL
0x01F0 0000 ADD [BX+SI], AL
0x01F2 0000 ADD [BX+SI], AL
0x01F4 0000 ADD [BX+SI], AL
0x01F6 0000 ADD [BX+SI], AL
0x01F8 0000 ADD [BX+SI], AL
0x01FA 0000 ADD [BX+SI], AL
0x01FC 0000 ADD [BX+SI], AL
0x01FE 55 PUSH BP
0x01FF aa STOSB
- Přílohy
-
- OTL.rar
- (87.41 KiB) Staženo 32 x
Re: Problém s napadeným PC - generic27.AkPW- log z RSIT přil
18:23:35.0812 0268 TDSS rootkit removing tool 2.7.48.0 Jul 24 2012 13:16:32
18:23:37.0812 0268 ============================================================
18:23:37.0812 0268 Current date / time: 2012/08/12 18:23:37.0812
18:23:37.0812 0268 SystemInfo:
18:23:37.0812 0268
18:23:37.0812 0268 OS Version: 5.1.2600 ServicePack: 3.0
18:23:37.0812 0268 Product type: Workstation
18:23:37.0812 0268 ComputerName: MARTIN-B598CED7
18:23:37.0812 0268 UserName: Martin
18:23:37.0812 0268 Windows directory: C:\WINDOWS
18:23:37.0812 0268 System windows directory: C:\WINDOWS
18:23:37.0812 0268 Processor architecture: Intel x86
18:23:37.0812 0268 Number of processors: 1
18:23:37.0812 0268 Page size: 0x1000
18:23:37.0812 0268 Boot type: Normal boot
18:23:37.0812 0268 ============================================================
18:23:40.0250 0268 Drive \Device\Harddisk0\DR0 - Size: 0x1BF4290000 (111.82 Gb), SectorSize: 0x200, Cylinders: 0x3904, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000020
18:23:40.0265 0268 Drive \Device\Harddisk1\DR3 - Size: 0x77800000 (1.87 Gb), SectorSize: 0x200, Cylinders: 0xF3, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
18:23:40.0265 0268 ============================================================
18:23:40.0265 0268 \Device\Harddisk0\DR0:
18:23:40.0265 0268 MBR partitions:
18:23:40.0265 0268 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x30D3C74
18:23:40.0296 0268 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x30D3CF2, BlocksNum 0xAECB712
18:23:40.0296 0268 \Device\Harddisk1\DR3:
18:23:40.0296 0268 MBR partitions:
18:23:40.0296 0268 \Device\Harddisk1\DR3\Partition0: MBR, Type 0xB, StartLBA 0x20, BlocksNum 0x3BBFE0
18:23:40.0296 0268 ============================================================
18:23:40.0343 0268 C: <-> \Device\Harddisk0\DR0\Partition0
18:23:40.0359 0268 D: <-> \Device\Harddisk0\DR0\Partition1
18:23:40.0359 0268 ============================================================
18:23:40.0359 0268 Initialize success
18:23:40.0359 0268 ============================================================
18:24:19.0125 2420 ============================================================
18:24:19.0125 2420 Scan started
18:24:19.0125 2420 Mode: Manual; SigCheck; TDLFS;
18:24:19.0125 2420 ============================================================
18:24:19.0593 2420 !SASCORE (c0393eb99a6c72c6bef9bfc4a72b33a6) C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
18:24:19.0750 2420 !SASCORE - ok
18:24:19.0890 2420 602XML Updater (f11d68e40ed62fdb7c460c445f1ec4e5) C:\Program Files\Common Files\soft602\602updsvc\602updsvc.exe
18:24:19.0921 2420 602XML Updater - ok
18:24:20.0015 2420 61883 (914a9709fc3bf419ad2f85547f2a4832) C:\WINDOWS\system32\DRIVERS\61883.sys
18:24:20.0218 2420 61883 - ok
18:24:20.0234 2420 Abiosdsk - ok
18:24:20.0265 2420 abp480n5 - ok
18:24:20.0312 2420 ACPI (4fe34f1f3126b61fcc6b2043aa8112c9) C:\WINDOWS\system32\DRIVERS\ACPI.sys
18:24:20.0578 2420 ACPI - ok
18:24:20.0609 2420 ACPIEC (afdff022a01f0b11c776f0860c3b282f) C:\WINDOWS\system32\drivers\ACPIEC.sys
18:24:20.0812 2420 ACPIEC - ok
18:24:20.0906 2420 AdobeFlashPlayerUpdateSvc (f19c98ad81d2c0e1bbfd8153d2c80ee8) C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
18:24:20.0953 2420 AdobeFlashPlayerUpdateSvc - ok
18:24:20.0984 2420 adpu160m - ok
18:24:21.0031 2420 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
18:24:21.0218 2420 aec - ok
18:24:21.0265 2420 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
18:24:21.0328 2420 AFD - ok
18:24:21.0343 2420 Aha154x - ok
18:24:21.0375 2420 aic78u2 - ok
18:24:21.0406 2420 aic78xx - ok
18:24:21.0593 2420 ALCXWDM (93f93a8e3e14cbbf1ce9a5af1a70c095) C:\WINDOWS\system32\drivers\ALCXWDM.SYS
18:24:21.0890 2420 ALCXWDM - ok
18:24:22.0000 2420 Alerter (e0a6fa244b8624d78fe5ff6f56a33bae) C:\WINDOWS\system32\alrsvc.dll
18:24:22.0156 2420 Alerter - ok
18:24:22.0203 2420 ALG (88842de939a827577bf24243699ac80a) C:\WINDOWS\System32\alg.exe
18:24:22.0281 2420 ALG - ok
18:24:22.0312 2420 AliIde - ok
18:24:22.0375 2420 AmdK8 (59301936898ae62245a6f09c0aba9475) C:\WINDOWS\system32\DRIVERS\AmdK8.sys
18:24:22.0406 2420 AmdK8 - ok
18:24:22.0421 2420 amsint - ok
18:24:22.0437 2420 AppMgmt - ok
18:24:22.0484 2420 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
18:24:22.0687 2420 Arp1394 - ok
18:24:22.0703 2420 ASAPIW2k (4f9cbbf95e8f7a0d4c0edcfe3b78102e) C:\WINDOWS\system32\drivers\ASAPIW2k.sys
18:24:22.0734 2420 ASAPIW2k ( UnsignedFile.Multi.Generic ) - warning
18:24:22.0734 2420 ASAPIW2k - detected UnsignedFile.Multi.Generic (1)
18:24:22.0765 2420 asc - ok
18:24:22.0796 2420 asc3350p - ok
18:24:22.0828 2420 asc3550 - ok
18:24:23.0000 2420 aspnet_state (776acefa0ca9df0faa51a5fb2f435705) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
18:24:23.0015 2420 aspnet_state - ok
18:24:23.0046 2420 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
18:24:23.0250 2420 AsyncMac - ok
18:24:23.0296 2420 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
18:24:23.0500 2420 atapi - ok
18:24:23.0531 2420 Atdisk - ok
18:24:23.0562 2420 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
18:24:23.0781 2420 Atmarpc - ok
18:24:23.0828 2420 AudioSrv (de31b88962a8645dba5a37b993e7b0f1) C:\WINDOWS\System32\audiosrv.dll
18:24:24.0046 2420 AudioSrv - ok
18:24:24.0093 2420 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
18:24:24.0281 2420 audstub - ok
18:24:24.0328 2420 Avc (f8e6956a614f15a0860474c5e2a7de6b) C:\WINDOWS\system32\DRIVERS\avc.sys
18:24:24.0531 2420 Avc - ok
18:24:24.0703 2420 AVG Security Toolbar Service (3a457c2f798cad79cd30224e723e01fb) C:\Program Files\AVG\AVG10\Toolbar\ToolbarBroker.exe
18:24:24.0796 2420 AVG Security Toolbar Service - ok
18:24:24.0843 2420 Avgfwdx (841b0a982065bffc7d7e84009f2fa76f) C:\WINDOWS\system32\DRIVERS\avgfwdx.sys
18:24:24.0859 2420 Avgfwdx - ok
18:24:24.0875 2420 Avgfwfd (841b0a982065bffc7d7e84009f2fa76f) C:\WINDOWS\system32\DRIVERS\avgfwdx.sys
18:24:24.0890 2420 Avgfwfd - ok
18:24:25.0062 2420 avgfws (5cd22eb540f82c70e33e530003f3903b) C:\Program Files\AVG\AVG2012\avgfws.exe
18:24:25.0296 2420 avgfws - ok
18:24:25.0515 2420 AVGIDSAgent (6d440ff3f44ca72edfd6176c6d6a89c0) C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe
18:24:25.0796 2420 AVGIDSAgent - ok
18:24:25.0890 2420 AVGIDSDriver (4fa401b33c1b50c816486f6951244a14) C:\WINDOWS\system32\DRIVERS\AVGIDSDriver.Sys
18:24:25.0906 2420 AVGIDSDriver - ok
18:24:25.0953 2420 AVGIDSEH (69578bc9d43d614c6b3455db4af19762) C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys
18:24:25.0968 2420 AVGIDSEH - ok
18:24:26.0015 2420 AVGIDSFilter (6df528406aa22201f392b9b19121cd6f) C:\WINDOWS\system32\DRIVERS\AVGIDSFilter.Sys
18:24:26.0031 2420 AVGIDSFilter - ok
18:24:26.0062 2420 AVGIDSShim (1e01c2166b5599802bcd61b9691f7476) C:\WINDOWS\system32\DRIVERS\AVGIDSShim.Sys
18:24:26.0078 2420 AVGIDSShim - ok
18:24:26.0125 2420 Avgldx86 (bf8118cd5e2255387b715b534d64acd1) C:\WINDOWS\system32\DRIVERS\avgldx86.sys
18:24:26.0156 2420 Avgldx86 - ok
18:24:26.0187 2420 Avgmfx86 (1c77ef67f196466adc9924cb288afe87) C:\WINDOWS\system32\DRIVERS\avgmfx86.sys
18:24:26.0203 2420 Avgmfx86 - ok
18:24:26.0218 2420 Avgrkx86 (f2038ed7284b79dcef581468121192a9) C:\WINDOWS\system32\DRIVERS\avgrkx86.sys
18:24:26.0281 2420 Avgrkx86 - ok
18:24:26.0343 2420 Avgtdix (a6d562b612216d8d02a35ebeb92366bd) C:\WINDOWS\system32\DRIVERS\avgtdix.sys
18:24:26.0375 2420 Avgtdix - ok
18:24:26.0484 2420 avgwd (6699ece24fe4b3f752a66c66a602ee86) C:\Program Files\AVG\AVG2012\avgwdsvc.exe
18:24:26.0531 2420 avgwd - ok
18:24:26.0578 2420 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
18:24:26.0796 2420 Beep - ok
18:24:26.0890 2420 BITS (19395d092fd85ddc2d9c7729cf5a2ac8) C:\WINDOWS\system32\qmgr.dll
18:24:27.0109 2420 BITS - ok
18:24:27.0156 2420 Browser (249276d3ef1e74b992299cb96099e4d7) C:\WINDOWS\System32\browser.dll
18:24:27.0390 2420 Browser - ok
18:24:27.0437 2420 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
18:24:27.0671 2420 cbidf2k - ok
18:24:27.0718 2420 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
18:24:27.0937 2420 CCDECODE - ok
18:24:27.0953 2420 cd20xrnt - ok
18:24:28.0000 2420 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
18:24:28.0203 2420 Cdaudio - ok
18:24:28.0296 2420 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
18:24:28.0531 2420 Cdfs - ok
18:24:28.0578 2420 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
18:24:28.0843 2420 Cdrom - ok
18:24:28.0875 2420 Changer - ok
18:24:28.0921 2420 CiSvc (e390dc1d7c461d7d56ec53402f329928) C:\WINDOWS\system32\cisvc.exe
18:24:29.0140 2420 CiSvc - ok
18:24:29.0171 2420 ClipSrv (064507a8dfa8c5c7e2ffddd3e6f424fa) C:\WINDOWS\system32\clipsrv.exe
18:24:29.0406 2420 ClipSrv - ok
18:24:29.0640 2420 clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
18:24:29.0671 2420 clr_optimization_v2.0.50727_32 - ok
18:24:29.0953 2420 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
18:24:29.0968 2420 clr_optimization_v4.0.30319_32 - ok
18:24:30.0000 2420 CmdIde - ok
18:24:30.0031 2420 COMSysApp - ok
18:24:30.0093 2420 Cpqarray - ok
18:24:30.0156 2420 CryptSvc (f3ab0933cbd166d271992f411c27ccaf) C:\WINDOWS\System32\cryptsvc.dll
18:24:30.0359 2420 CryptSvc - ok
18:24:30.0375 2420 CrystalSysInfo - ok
18:24:30.0406 2420 dac2w2k - ok
18:24:30.0437 2420 dac960nt - ok
18:24:30.0734 2420 DcomLaunch (be27674d1cbc3214aec84b4336a38bbf) C:\WINDOWS\system32\rpcss.dll
18:24:30.0796 2420 DcomLaunch - ok
18:24:30.0953 2420 Dhcp (8c9a53e285ac5e6704844d0459ec85be) C:\WINDOWS\System32\dhcpcsvc.dll
18:24:31.0171 2420 Dhcp - ok
18:24:31.0203 2420 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
18:24:31.0421 2420 Disk - ok
18:24:31.0437 2420 dmadmin - ok
18:24:31.0500 2420 dmboot (db5fd2bf5b07dc54bfcb3664ff05bd7c) C:\WINDOWS\system32\drivers\dmboot.sys
18:24:31.0734 2420 dmboot - ok
18:24:31.0796 2420 dmio (fff1720af51171f32f1ead5cf71f2810) C:\WINDOWS\system32\drivers\dmio.sys
18:24:32.0031 2420 dmio - ok
18:24:32.0062 2420 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
18:24:32.0265 2420 dmload - ok
18:24:32.0328 2420 dmserver (2bfefe9e865655a76982f050450b9591) C:\WINDOWS\System32\dmserver.dll
18:24:32.0515 2420 dmserver - ok
18:24:32.0562 2420 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
18:24:32.0812 2420 DMusic - ok
18:24:32.0875 2420 Dnscache (dfaa406bf19f4ee806a6f8d4342137f7) C:\WINDOWS\System32\dnsrslvr.dll
18:24:32.0937 2420 Dnscache - ok
18:24:33.0000 2420 Dot3svc (4a3e2bd20157a0946751229e92eb8621) C:\WINDOWS\System32\dot3svc.dll
18:24:33.0187 2420 Dot3svc - ok
18:24:33.0218 2420 dpti2o - ok
18:24:33.0281 2420 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
18:24:33.0484 2420 drmkaud - ok
18:24:33.0500 2420 EapHost (0887d9c2be8d940778cad1e3b85f2a41) C:\WINDOWS\System32\eapsvc.dll
18:24:33.0734 2420 EapHost - ok
18:24:33.0765 2420 ERSvc (a2a4912798f2be706abadd3d30800d16) C:\WINDOWS\System32\ersvc.dll
18:24:34.0031 2420 ERSvc - ok
18:24:34.0078 2420 Eventlog (9ef697af07bb8dd82c3b02ca953a95b7) C:\WINDOWS\system32\services.exe
18:24:34.0109 2420 Eventlog - ok
18:24:34.0156 2420 EventSystem (a371f11ef07653591c8de26afb13ce7f) C:\WINDOWS\system32\es.dll
18:24:34.0187 2420 EventSystem - ok
18:24:34.0234 2420 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
18:24:34.0390 2420 Fastfat - ok
18:24:34.0437 2420 FastUserSwitchingCompatibility (ee9a2b9ea968a792a053c9d1a86bf870) C:\WINDOWS\System32\shsvcs.dll
18:24:34.0484 2420 FastUserSwitchingCompatibility - ok
18:24:34.0531 2420 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
18:24:34.0781 2420 Fdc - ok
18:24:34.0828 2420 FET5X86V (e7072827d0b5f9bd99d6961571a38973) C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys
18:24:34.0875 2420 FET5X86V - ok
18:24:34.0890 2420 FETND5BV (e7072827d0b5f9bd99d6961571a38973) C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys
18:24:34.0937 2420 FETND5BV - ok
18:24:34.0984 2420 FETNDIS (e9648254056bce81a85380c0c3647dc4) C:\WINDOWS\system32\DRIVERS\fetnd5.sys
18:24:35.0203 2420 FETNDIS - ok
18:24:35.0265 2420 Fips (ac366695a0796560aa37215ad5762aaf) C:\WINDOWS\system32\drivers\Fips.sys
18:24:35.0468 2420 Fips - ok
18:24:35.0500 2420 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
18:24:35.0703 2420 Flpydisk - ok
18:24:35.0765 2420 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
18:24:35.0953 2420 FltMgr - ok
18:24:36.0046 2420 FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
18:24:36.0062 2420 FontCache3.0.0.0 - ok
18:24:36.0125 2420 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
18:24:36.0359 2420 Fs_Rec - ok
18:24:36.0390 2420 Ftdisk (4e664d8541db4a66b73a24257e322e1f) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
18:24:36.0578 2420 Ftdisk - ok
18:24:36.0625 2420 gagp30kx (3a74c423cf6bcca6982715878f450a3b) C:\WINDOWS\system32\DRIVERS\gagp30kx.sys
18:24:37.0015 2420 gagp30kx - ok
18:24:37.0046 2420 gameenum (065639773d8b03f33577f6cdaea21063) C:\WINDOWS\system32\DRIVERS\gameenum.sys
18:24:37.0265 2420 gameenum - ok
18:24:37.0296 2420 GEARAspiWDM (4ac51459805264affd5f6fdfb9d9235f) C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys
18:24:37.0312 2420 GEARAspiWDM - ok
18:24:37.0375 2420 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
18:24:37.0625 2420 Gpc - ok
18:24:37.0703 2420 helpsvc (fcfe31fb75f8a6295b6b0af87a626282) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
18:24:37.0906 2420 helpsvc - ok
18:24:37.0937 2420 HidServ - ok
18:24:38.0000 2420 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
18:24:38.0218 2420 HidUsb - ok
18:24:38.0250 2420 hkmsvc (7a6b320928f86bc851530d63c82965d9) C:\WINDOWS\System32\kmsvc.dll
18:24:38.0453 2420 hkmsvc - ok
18:24:38.0468 2420 hpn - ok
18:24:38.0546 2420 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
18:24:38.0578 2420 HTTP - ok
18:24:38.0609 2420 HTTPFilter (58fe2f2da3bc5573f4a35b3760d3125f) C:\WINDOWS\System32\w3ssl.dll
18:24:38.0859 2420 HTTPFilter - ok
18:24:38.0890 2420 i2omgmt - ok
18:24:38.0921 2420 i2omp - ok
18:24:39.0000 2420 i8042prt (c528e27945367191e7bae364930b6932) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
18:24:39.0328 2420 i8042prt - ok
18:24:39.0437 2420 IDriverT (daf66902f08796f9c694901660e5a64a) C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
18:24:39.0453 2420 IDriverT ( UnsignedFile.Multi.Generic ) - warning
18:24:39.0453 2420 IDriverT - detected UnsignedFile.Multi.Generic (1)
18:24:39.0546 2420 idsvc (c01ac32dc5c03076cfb852cb5da5229c) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
18:24:39.0625 2420 idsvc - ok
18:24:39.0671 2420 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
18:24:39.0890 2420 Imapi - ok
18:24:39.0968 2420 ImapiService (f7b93aafad33b2320954c17e26c8d361) C:\WINDOWS\system32\imapi.exe
18:24:40.0140 2420 ImapiService - ok
18:24:40.0171 2420 ini910u - ok
18:24:40.0203 2420 IntelIde - ok
18:24:40.0250 2420 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
18:24:40.0437 2420 Ip6Fw - ok
18:24:40.0484 2420 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
18:24:40.0703 2420 IpFilterDriver - ok
18:24:40.0718 2420 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
18:24:40.0921 2420 IpInIp - ok
18:24:41.0000 2420 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
18:24:41.0187 2420 IpNat - ok
18:24:41.0218 2420 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
18:24:41.0421 2420 IPSec - ok
18:24:41.0453 2420 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
18:24:41.0531 2420 IRENUM - ok
18:24:41.0578 2420 isapnp (cc9f8a2d60aed1a51a3ac34c59b987ae) C:\WINDOWS\system32\DRIVERS\isapnp.sys
18:24:41.0765 2420 isapnp - ok
18:24:41.0890 2420 JavaQuickStarterService (0a5709543986843d37a92290b7838340) C:\Program Files\Java\jre6\bin\jqs.exe
18:24:41.0906 2420 JavaQuickStarterService - ok
18:24:41.0937 2420 Kbdclass (1b6162fe7f66b1a71a4b70f941c4aa9b) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
18:24:42.0156 2420 Kbdclass - ok
18:24:42.0203 2420 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
18:24:42.0375 2420 kmixer - ok
18:24:42.0421 2420 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
18:24:42.0453 2420 KSecDD - ok
18:24:42.0515 2420 lanmanserver (3428e8f86f8add36b42fb23542c7b3e4) C:\WINDOWS\System32\srvsvc.dll
18:24:42.0546 2420 lanmanserver - ok
18:24:42.0609 2420 lanmanworkstation (936c1d110232d23b621cb0196e4f80f0) C:\WINDOWS\System32\wkssvc.dll
18:24:42.0656 2420 lanmanworkstation - ok
18:24:42.0687 2420 lbrtfdc - ok
18:24:42.0781 2420 LmHosts (0ab159f536e3e8f7f07113702a07cca5) C:\WINDOWS\System32\lmhsvc.dll
18:24:42.0968 2420 LmHosts - ok
18:24:43.0031 2420 MarvinBus (d51e16339213898bc20c58670274ec3e) C:\WINDOWS\system32\DRIVERS\MarvinBus.sys
18:24:43.0062 2420 MarvinBus - ok
18:24:43.0156 2420 MDM (11f714f85530a2bd134074dc30e99fca) C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
18:24:43.0187 2420 MDM - ok
18:24:43.0218 2420 Messenger (221cd1c815b8a6b79389c3f5d1018de8) C:\WINDOWS\System32\msgsvc.dll
18:24:43.0437 2420 Messenger - ok
18:24:43.0468 2420 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
18:24:43.0687 2420 mnmdd - ok
18:24:43.0734 2420 mnmsrvc (9a57d046f88f4b69751b11fd40088a61) C:\WINDOWS\system32\mnmsrvc.exe
18:24:43.0921 2420 mnmsrvc - ok
18:24:43.0984 2420 Modem (44032b0c6d9954d3fd26438330b99ee7) C:\WINDOWS\system32\drivers\Modem.sys
18:24:44.0171 2420 Modem - ok
18:24:44.0218 2420 Mouclass (4cb582831dbde63ce43b45d771218374) C:\WINDOWS\system32\DRIVERS\mouclass.sys
18:24:44.0437 2420 Mouclass - ok
18:24:44.0468 2420 mouhid (bb269eba740737ab749b214d568b6812) C:\WINDOWS\system32\DRIVERS\mouhid.sys
18:24:44.0687 2420 mouhid - ok
18:24:44.0750 2420 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
18:24:44.0906 2420 MountMgr - ok
18:24:44.0921 2420 mraid35x - ok
18:24:44.0953 2420 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
18:24:45.0125 2420 MRxDAV - ok
18:24:45.0203 2420 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
18:24:45.0250 2420 MRxSmb - ok
18:24:45.0296 2420 MSDTC (6db4d1521caba9a5ffab54ade0ae867d) C:\WINDOWS\system32\msdtc.exe
18:24:45.0531 2420 MSDTC - ok
18:24:45.0609 2420 MSDV (1477849772712bac69c144dcf2c9ce81) C:\WINDOWS\system32\DRIVERS\msdv.sys
18:24:45.0796 2420 MSDV - ok
18:24:45.0843 2420 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
18:24:46.0046 2420 Msfs - ok
18:24:46.0062 2420 MSIServer - ok
18:24:46.0093 2420 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
18:24:46.0296 2420 MSKSSRV - ok
18:24:46.0328 2420 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
18:24:46.0546 2420 MSPCLOCK - ok
18:24:46.0578 2420 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
18:24:46.0796 2420 MSPQM - ok
18:24:46.0843 2420 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
18:24:47.0046 2420 mssmbios - ok
18:24:47.0078 2420 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
18:24:47.0250 2420 MSTEE - ok
18:24:47.0296 2420 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
18:24:47.0343 2420 Mup - ok
18:24:47.0375 2420 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
18:24:47.0578 2420 NABTSFEC - ok
18:24:47.0671 2420 napagent (6ea362e9db03d44f6b996f4d8be237e9) C:\WINDOWS\System32\qagentrt.dll
18:24:47.0859 2420 napagent - ok
18:24:47.0937 2420 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
18:24:48.0140 2420 NDIS - ok
18:24:48.0171 2420 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
18:24:48.0375 2420 NdisIP - ok
18:24:48.0421 2420 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
18:24:48.0453 2420 NdisTapi - ok
18:24:48.0500 2420 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
18:24:48.0687 2420 Ndisuio - ok
18:24:48.0703 2420 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
18:24:48.0890 2420 NdisWan - ok
18:24:48.0937 2420 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
18:24:49.0015 2420 NDProxy - ok
18:24:49.0046 2420 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
18:24:49.0234 2420 NetBIOS - ok
18:24:49.0281 2420 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
18:24:49.0468 2420 NetBT - ok
18:24:49.0515 2420 NetDDE (933de774986ec85e48210c44ab431de6) C:\WINDOWS\system32\netdde.exe
18:24:49.0718 2420 NetDDE - ok
18:24:49.0750 2420 NetDDEdsdm (933de774986ec85e48210c44ab431de6) C:\WINDOWS\system32\netdde.exe
18:24:49.0921 2420 NetDDEdsdm - ok
18:24:49.0968 2420 Netlogon (ed0a176354487ceed65b80a7148ab739) C:\WINDOWS\system32\lsass.exe
18:24:50.0171 2420 Netlogon - ok
18:24:50.0218 2420 Netman (72e1e9e2977be08bdeedb6d8fd9d4d40) C:\WINDOWS\System32\netman.dll
18:24:50.0421 2420 Netman - ok
18:24:50.0515 2420 NetTcpPortSharing (d34612c5d02d026535b3095d620626ae) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
18:24:50.0562 2420 NetTcpPortSharing - ok
18:24:50.0578 2420 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
18:24:50.0765 2420 NIC1394 - ok
18:24:50.0828 2420 Nla (39ee7c3bfbc64ba87cc8cf67386e814c) C:\WINDOWS\System32\mswsock.dll
18:24:50.0859 2420 Nla - ok
18:24:50.0890 2420 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
18:24:51.0109 2420 Npfs - ok
18:24:51.0187 2420 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
18:24:51.0390 2420 Ntfs - ok
18:24:51.0406 2420 NtLmSsp (ed0a176354487ceed65b80a7148ab739) C:\WINDOWS\system32\lsass.exe
18:24:51.0593 2420 NtLmSsp - ok
18:24:51.0671 2420 NtmsSvc (023dd70573d644f3d9c8b1258a7bfd08) C:\WINDOWS\system32\ntmssvc.dll
18:24:51.0890 2420 NtmsSvc - ok
18:24:51.0937 2420 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
18:24:52.0140 2420 Null - ok
18:24:52.0531 2420 nv (8c0456001b6900114bbb1c548bd8aaf5) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
18:24:52.0984 2420 nv - ok
18:24:53.0093 2420 NVSvc (472a00d2183c9e5edb3e076272741812) C:\WINDOWS\system32\nvsvc32.exe
18:24:53.0140 2420 NVSvc - ok
18:24:53.0171 2420 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
18:24:53.0421 2420 NwlnkFlt - ok
18:24:53.0453 2420 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
18:24:53.0656 2420 NwlnkFwd - ok
18:24:53.0718 2420 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
18:24:53.0921 2420 ohci1394 - ok
18:24:53.0984 2420 ose (7a56cf3e3f12e8af599963b16f50fb6a) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
18:24:54.0015 2420 ose - ok
18:24:54.0078 2420 Parport (46f8db73b4a53e543f8e371dc7c75bae) C:\WINDOWS\system32\DRIVERS\parport.sys
18:24:54.0281 2420 Parport - ok
18:24:54.0312 2420 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
18:24:54.0484 2420 PartMgr - ok
18:24:54.0546 2420 ParVdm (1fae19d0457176318bba4a8795656ebc) C:\WINDOWS\system32\drivers\ParVdm.sys
18:24:54.0765 2420 ParVdm - ok
18:24:54.0796 2420 PCI (6ce351d149cb4befc702951e471e1730) C:\WINDOWS\system32\DRIVERS\pci.sys
18:24:54.0984 2420 PCI - ok
18:24:55.0000 2420 PCIDump - ok
18:24:55.0031 2420 PCIIde - ok
18:24:55.0062 2420 PCLEPCI (1bebe7de8508a02650cdce45c664c2a2) C:\WINDOWS\system32\drivers\pclepci.sys
18:24:55.0093 2420 PCLEPCI ( UnsignedFile.Multi.Generic ) - warning
18:24:55.0093 2420 PCLEPCI - detected UnsignedFile.Multi.Generic (1)
18:24:55.0125 2420 Pcmcia (4fc31e6c19a5ce5198b1abff94cae758) C:\WINDOWS\system32\drivers\Pcmcia.sys
18:24:55.0312 2420 Pcmcia - ok
18:24:55.0375 2420 pcouffin (5b6c11de7e839c05248ced8825470fef) C:\WINDOWS\system32\Drivers\pcouffin.sys
18:24:55.0406 2420 pcouffin ( UnsignedFile.Multi.Generic ) - warning
18:24:55.0406 2420 pcouffin - detected UnsignedFile.Multi.Generic (1)
18:24:55.0437 2420 PDCOMP - ok
18:24:55.0468 2420 PDFRAME - ok
18:24:55.0500 2420 PDRELI - ok
18:24:55.0531 2420 PDRFRAME - ok
18:24:55.0562 2420 perc2 - ok
18:24:55.0593 2420 perc2hib - ok
18:24:55.0734 2420 PlugPlay (9ef697af07bb8dd82c3b02ca953a95b7) C:\WINDOWS\system32\services.exe
18:24:55.0765 2420 PlugPlay - ok
18:24:55.0781 2420 Point32 - ok
18:24:55.0843 2420 PolicyAgent (ed0a176354487ceed65b80a7148ab739) C:\WINDOWS\system32\lsass.exe
18:24:56.0015 2420 PolicyAgent - ok
18:24:56.0046 2420 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
18:24:56.0265 2420 PptpMiniport - ok
18:24:56.0296 2420 Processor (7eb15dce4ec3a0220bd796a15c18186e) C:\WINDOWS\system32\DRIVERS\processr.sys
18:24:56.0468 2420 Processor - ok
18:24:56.0500 2420 ProtectedStorage (ed0a176354487ceed65b80a7148ab739) C:\WINDOWS\system32\lsass.exe
18:24:56.0687 2420 ProtectedStorage - ok
18:24:56.0703 2420 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
18:24:56.0953 2420 PSched - ok
18:24:56.0984 2420 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
18:24:57.0171 2420 Ptilink - ok
18:24:57.0187 2420 ql1080 - ok
18:24:57.0203 2420 Ql10wnt - ok
18:24:57.0234 2420 ql12160 - ok
18:24:57.0265 2420 ql1240 - ok
18:24:57.0296 2420 ql1280 - ok
18:24:57.0343 2420 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
18:24:57.0531 2420 RasAcd - ok
18:24:57.0593 2420 RasAuto (2b5e44ea009f2f374b980e1e9a70635d) C:\WINDOWS\System32\rasauto.dll
18:24:57.0781 2420 RasAuto - ok
18:24:57.0812 2420 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
18:24:58.0031 2420 Rasl2tp - ok
18:24:58.0078 2420 RasMan (d57554c664b64604bd1ee13ea2c07e77) C:\WINDOWS\System32\rasmans.dll
18:24:58.0250 2420 RasMan - ok
18:24:58.0296 2420 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
18:24:58.0484 2420 RasPppoe - ok
18:24:58.0515 2420 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
18:24:58.0687 2420 Raspti - ok
18:24:58.0734 2420 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
18:24:58.0937 2420 Rdbss - ok
18:24:58.0984 2420 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
18:24:59.0156 2420 RDPCDD - ok
18:24:59.0218 2420 RDPWD (6589db6e5969f8eee594cf71171c5028) C:\WINDOWS\system32\drivers\RDPWD.sys
18:24:59.0281 2420 RDPWD - ok
18:24:59.0312 2420 RDSessMgr (c0d9d9711cb74ee9bc66353d8cbdab0e) C:\WINDOWS\system32\sessmgr.exe
18:24:59.0500 2420 RDSessMgr - ok
18:24:59.0546 2420 redbook (611bfd220305be3a85ae876ea47d4aa5) C:\WINDOWS\system32\DRIVERS\redbook.sys
18:24:59.0750 2420 redbook - ok
18:24:59.0781 2420 RemoteAccess (127c26b5371651043450e52542099aba) C:\WINDOWS\System32\mprdim.dll
18:24:59.0984 2420 RemoteAccess - ok
18:25:00.0015 2420 RpcLocator (718b3bdc0bc3c2f7d065a53d26202af9) C:\WINDOWS\system32\locator.exe
18:25:00.0250 2420 RpcLocator - ok
18:25:00.0328 2420 RpcSs (be27674d1cbc3214aec84b4336a38bbf) C:\WINDOWS\system32\rpcss.dll
18:25:00.0359 2420 RpcSs - ok
18:25:00.0421 2420 RSVP (09ab2e71e58b078038e3bfdba7ffc984) C:\WINDOWS\system32\rsvp.exe
18:25:00.0593 2420 RSVP - ok
18:25:00.0625 2420 s125bus (06847aa6f3a9bf7c44134d00a2e578c0) C:\WINDOWS\system32\DRIVERS\s125bus.sys
18:25:00.0640 2420 s125bus - ok
18:25:00.0687 2420 s125mdfl (f83f88e1b125308fb5015ea0349502b0) C:\WINDOWS\system32\DRIVERS\s125mdfl.sys
18:25:00.0703 2420 s125mdfl - ok
18:25:00.0843 2420 s125mdm (402a97756c14940ad6ae5169c2fb105e) C:\WINDOWS\system32\DRIVERS\s125mdm.sys
18:25:00.0875 2420 s125mdm - ok
18:25:00.0906 2420 s125mgmt (82b14c51de76825ec769a6374e4c57d6) C:\WINDOWS\system32\DRIVERS\s125mgmt.sys
18:25:00.0937 2420 s125mgmt - ok
18:25:00.0968 2420 s125obex (bedfc5707c356fd073bf1a4afe442d91) C:\WINDOWS\system32\DRIVERS\s125obex.sys
18:25:00.0984 2420 s125obex - ok
18:25:01.0046 2420 SamSs (ed0a176354487ceed65b80a7148ab739) C:\WINDOWS\system32\lsass.exe
18:25:01.0218 2420 SamSs - ok
18:25:01.0281 2420 SASDIFSV (39763504067962108505bff25f024345) C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
18:25:01.0328 2420 SASDIFSV - ok
18:25:01.0359 2420 SASKUTIL (77b9fc20084b48408ad3e87570eb4a85) C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
18:25:01.0390 2420 SASKUTIL - ok
18:25:01.0421 2420 SCardSvr (410046e401eb11e1e6749e9deea41d4a) C:\WINDOWS\System32\SCardSvr.exe
18:25:01.0640 2420 SCardSvr - ok
18:25:01.0703 2420 Schedule (3ff232a7731621b8902d81d42418c93c) C:\WINDOWS\system32\schedsvc.dll
18:25:01.0906 2420 Schedule - ok
18:25:02.0031 2420 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
18:25:02.0171 2420 Secdrv - ok
18:25:02.0296 2420 seclogon (477e2c3cc5e4a0d635bcb0ea8dcac3c6) C:\WINDOWS\System32\seclogon.dll
18:25:02.0515 2420 seclogon - ok
18:25:02.0593 2420 SENS (a530b75c10c23c9ab28fdb6ce719e21f) C:\WINDOWS\system32\sens.dll
18:25:02.0796 2420 SENS - ok
18:25:02.0843 2420 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
18:25:03.0031 2420 serenum - ok
18:25:03.0062 2420 Serial (b842729337c9b921615c40d3c1a1af96) C:\WINDOWS\system32\DRIVERS\serial.sys
18:25:03.0281 2420 Serial - ok
18:25:03.0390 2420 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\DRIVERS\sfloppy.sys
18:25:03.0625 2420 Sfloppy - ok
18:25:04.0500 2420 SharedAccess (f58faca9621d2db01bd0927d9a0a208e) C:\WINDOWS\System32\ipnathlp.dll
18:25:04.0703 2420 SharedAccess - ok
18:25:05.0093 2420 ShellHWDetection (ee9a2b9ea968a792a053c9d1a86bf870) C:\WINDOWS\System32\shsvcs.dll
18:25:05.0109 2420 ShellHWDetection - ok
18:25:05.0140 2420 Simbad - ok
18:25:05.0187 2420 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
18:25:05.0406 2420 SLIP - ok
18:25:05.0453 2420 Sparrow - ok
18:25:05.0484 2420 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
18:25:05.0718 2420 splitter - ok
18:25:05.0890 2420 Spooler (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe
18:25:05.0937 2420 Spooler - ok
18:25:06.0265 2420 sr (94610c8653635e4459316a0050d55ce7) C:\WINDOWS\system32\DRIVERS\sr.sys
18:25:06.0390 2420 sr - ok
18:25:06.0796 2420 srservice (35b91147124f64ac8081a2edb9ea4dee) C:\WINDOWS\system32\srsvc.dll
18:25:06.0890 2420 srservice - ok
18:25:06.0984 2420 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
18:25:07.0031 2420 Srv - ok
18:25:07.0062 2420 SSDPSRV (becd5271dc4e3b7c3d035f790fcbc1e5) C:\WINDOWS\System32\ssdpsrv.dll
18:25:07.0156 2420 SSDPSRV - ok
18:25:07.0218 2420 stisvc (c1cdd9275f6a115bb0ae1d55d8d27ba6) C:\WINDOWS\system32\wiaservc.dll
18:25:07.0406 2420 stisvc - ok
18:25:07.0437 2420 StMp3Rec - ok
18:25:07.0484 2420 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
18:25:07.0687 2420 streamip - ok
18:25:07.0734 2420 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
18:25:07.0968 2420 swenum - ok
18:25:08.0015 2420 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
18:25:08.0218 2420 swmidi - ok
18:25:08.0250 2420 SwPrv - ok
18:25:08.0296 2420 symc810 - ok
18:25:08.0328 2420 symc8xx - ok
18:25:08.0359 2420 sym_hi - ok
18:25:08.0390 2420 sym_u3 - ok
18:25:08.0437 2420 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
18:25:08.0640 2420 sysaudio - ok
18:25:08.0671 2420 SysmonLog (ce06f01b88ace199a1bf460cac29c110) C:\WINDOWS\system32\smlogsvc.exe
18:25:08.0875 2420 SysmonLog - ok
18:25:08.0953 2420 TapiSrv (c2546cd7a398476f9df5614b2ae160e8) C:\WINDOWS\System32\tapisrv.dll
18:25:09.0125 2420 TapiSrv - ok
18:25:09.0218 2420 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
18:25:09.0265 2420 Tcpip - ok
18:25:09.0296 2420 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
18:25:09.0484 2420 TDPIPE - ok
18:25:09.0531 2420 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
18:25:09.0703 2420 TDTCP - ok
18:25:09.0750 2420 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
18:25:09.0953 2420 TermDD - ok
18:25:10.0031 2420 TermService (a75dd6fc3dbee4fff5ebc9f2c28bb66e) C:\WINDOWS\System32\termsrv.dll
18:25:10.0250 2420 TermService - ok
18:25:10.0312 2420 Themes (ee9a2b9ea968a792a053c9d1a86bf870) C:\WINDOWS\System32\shsvcs.dll
18:25:10.0328 2420 Themes - ok
18:25:10.0343 2420 TosIde - ok
18:25:10.0406 2420 TrkWks (38853304ccb938d30e0c4cde8d2c2a8a) C:\WINDOWS\system32\trkwks.dll
18:25:10.0578 2420 TrkWks - ok
18:25:10.0640 2420 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
18:25:10.0843 2420 Udfs - ok
18:25:10.0875 2420 ultra - ok
18:25:10.0968 2420 UnlockerDriver5 (bb879dcfd22926efbeb3298129898cbb) C:\Program Files\Unlocker\UnlockerDriver5.sys
18:25:10.0984 2420 UnlockerDriver5 ( UnsignedFile.Multi.Generic ) - warning
18:25:10.0984 2420 UnlockerDriver5 - detected UnsignedFile.Multi.Generic (1)
18:25:11.0078 2420 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
18:25:11.0265 2420 Update - ok
18:25:11.0328 2420 upnphost (651bd90dcee5b7bdc74a2eb7c9266f9e) C:\WINDOWS\System32\upnphost.dll
18:25:11.0437 2420 upnphost - ok
18:25:11.0468 2420 UPS (20a0f6a11959e92908717d09e87d670d) C:\WINDOWS\System32\ups.exe
18:25:11.0640 2420 UPS - ok
18:25:11.0687 2420 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
18:25:11.0890 2420 usbccgp - ok
18:25:11.0921 2420 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
18:25:12.0140 2420 usbehci - ok
18:25:12.0203 2420 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
18:25:12.0375 2420 usbhub - ok
18:25:12.0421 2420 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
18:25:12.0625 2420 usbprint - ok
18:25:12.0656 2420 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
18:25:12.0828 2420 usbscan - ok
18:25:12.0875 2420 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
18:25:13.0062 2420 USBSTOR - ok
18:25:13.0109 2420 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
18:25:13.0296 2420 usbuhci - ok
18:25:13.0328 2420 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
18:25:13.0562 2420 VgaSave - ok
18:25:13.0593 2420 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys
18:25:13.0781 2420 ViaIde - ok
18:25:13.0812 2420 viamraid (9f3f276c7300ed211129757a411b605f) C:\WINDOWS\system32\DRIVERS\viamraid.sys
18:25:13.0859 2420 viamraid - ok
18:25:13.0890 2420 videX32 (c8ee49fa76eb7c41a9cddfe58151a74e) C:\WINDOWS\system32\DRIVERS\videX32.sys
18:25:13.0921 2420 videX32 - ok
18:25:13.0968 2420 VolSnap (28a4b296b47782173c346e376cb374d1) C:\WINDOWS\system32\drivers\VolSnap.sys
18:25:14.0171 2420 VolSnap - ok
18:25:14.0218 2420 VSS (d6ba1a63d9e00933f1cd2a885573afb2) C:\WINDOWS\System32\vssvc.exe
18:25:14.0312 2420 VSS - ok
18:25:14.0437 2420 vToolbarUpdater11.2.0 (8ed347bad8d1fb7c40b593bfb01786d2) C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe
18:25:14.0531 2420 vToolbarUpdater11.2.0 - ok
18:25:14.0593 2420 W32Time (fa4e1cdba256787f2149f4aad07bc91f) C:\WINDOWS\system32\w32time.dll
18:25:14.0765 2420 W32Time - ok
18:25:14.0828 2420 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
18:25:15.0000 2420 Wanarp - ok
18:25:15.0046 2420 wceusbsh (46a247f6617526afe38b6f12f5512120) C:\WINDOWS\system32\DRIVERS\wceusbsh.sys
18:25:15.0093 2420 wceusbsh - ok
18:25:15.0125 2420 WDICA - ok
18:25:15.0171 2420 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
18:25:15.0375 2420 wdmaud - ok
18:25:15.0421 2420 WebClient (47ae51048a82dfa1cd6b51d369f7e169) C:\WINDOWS\System32\webclnt.dll
18:25:15.0625 2420 WebClient - ok
18:25:15.0703 2420 WinDefend (f45dd1e1365d857dd08bc23563370d0e) C:\Program Files\Windows Defender\MsMpEng.exe
18:25:15.0734 2420 WinDefend - ok
18:25:15.0859 2420 winmgmt (e488332126e3b1182d2b8a0c35408ec6) C:\WINDOWS\system32\wbem\WMIsvc.dll
18:25:16.0031 2420 winmgmt - ok
18:25:16.0125 2420 WinRM (4d34cedd74bdbf2b6a935eae3bf80543) C:\WINDOWS\system32\WsmSvc.dll
18:25:16.0218 2420 WinRM - ok
18:25:16.0296 2420 WmdmPmSN (c51b4a5c05a5475708e3c81c7765b71d) C:\WINDOWS\system32\MsPMSNSv.dll
18:25:16.0328 2420 WmdmPmSN - ok
18:25:16.0421 2420 WmiApSrv (23f6f03272f7e5679f1f050aed5acee6) C:\WINDOWS\system32\wbem\wmiapsrv.exe
18:25:16.0671 2420 WmiApSrv - ok
18:25:16.0765 2420 WMPNetworkSvc (3739866d20abd42f26a7b85f9e2560af) C:\Program Files\Windows Media Player\WMPNetwk.exe
18:25:16.0859 2420 WMPNetworkSvc - ok
18:25:16.0906 2420 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys
18:25:16.0953 2420 WpdUsb - ok
18:25:17.0109 2420 WPFFontCache_v0400 (dcf3e3edf5109ee8bc02fe6e1f045795) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
18:25:17.0171 2420 WPFFontCache_v0400 - ok
18:25:17.0250 2420 wscsvc (4c86d5faf78194995af9cc1075f65dd3) C:\WINDOWS\system32\wscsvc.dll
18:25:17.0437 2420 wscsvc - ok
18:25:17.0453 2420 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
18:25:17.0656 2420 WSTCODEC - ok
18:25:17.0687 2420 wuauserv (c1364564800ee9784192145324a23308) C:\WINDOWS\system32\wuauserv.dll
18:25:17.0875 2420 wuauserv - ok
18:25:17.0921 2420 WudfPf (50eb9e21963b4f06fd010d007d54351b) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
18:25:17.0953 2420 WudfPf - ok
18:25:18.0000 2420 WudfRd (6e209664bdea8a15b5e8e480d6c607c2) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
18:25:18.0031 2420 WudfRd - ok
18:25:18.0062 2420 WudfSvc (ae93084d2d236887ba56467ae42b4955) C:\WINDOWS\System32\WUDFSvc.dll
18:25:18.0109 2420 WudfSvc - ok
18:25:18.0171 2420 WZCSVC (a27d4ba7264c0bf52f32d10405bea1d4) C:\WINDOWS\System32\wzcsvc.dll
18:25:18.0375 2420 WZCSVC - ok
18:25:18.0406 2420 xcpip - ok
18:25:18.0453 2420 xmlprov (eaa4bb9edb3fb10cf8979fe65e63658f) C:\WINDOWS\System32\xmlprov.dll
18:25:18.0640 2420 xmlprov - ok
18:25:18.0687 2420 xpsec - ok
18:25:18.0781 2420 MBR (0x1B8) (413fc2a0c716421b3158746d63736515) \Device\Harddisk0\DR0
18:25:19.0296 2420 \Device\Harddisk0\DR0 - ok
18:25:19.0328 2420 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk1\DR3
18:25:23.0312 2420 \Device\Harddisk1\DR3 - ok
18:25:23.0359 2420 Boot (0x1200) (2a428c9241450d392bb02fe064243745) \Device\Harddisk0\DR0\Partition0
18:25:23.0359 2420 \Device\Harddisk0\DR0\Partition0 - ok
18:25:23.0375 2420 Boot (0x1200) (742aeba24479ecdfc8cdef1830220a35) \Device\Harddisk0\DR0\Partition1
18:25:23.0390 2420 \Device\Harddisk0\DR0\Partition1 - ok
18:25:23.0390 2420 Boot (0x1200) (74ccb0072e0331b7cbc9b6307ae89ca9) \Device\Harddisk1\DR3\Partition0
18:25:23.0406 2420 \Device\Harddisk1\DR3\Partition0 - ok
18:25:23.0406 2420 ============================================================
18:25:23.0406 2420 Scan finished
18:25:23.0406 2420 ============================================================
18:25:23.0562 2876 Detected object count: 5
18:25:23.0578 2876 Actual detected object count: 5
18:26:02.0656 2876 ASAPIW2k ( UnsignedFile.Multi.Generic ) - skipped by user
18:26:02.0656 2876 ASAPIW2k ( UnsignedFile.Multi.Generic ) - User select action: Skip
18:26:02.0671 2876 IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user
18:26:02.0671 2876 IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip
18:26:02.0671 2876 PCLEPCI ( UnsignedFile.Multi.Generic ) - skipped by user
18:26:02.0671 2876 PCLEPCI ( UnsignedFile.Multi.Generic ) - User select action: Skip
18:26:02.0671 2876 pcouffin ( UnsignedFile.Multi.Generic ) - skipped by user
18:26:02.0671 2876 pcouffin ( UnsignedFile.Multi.Generic ) - User select action: Skip
18:26:02.0687 2876 UnlockerDriver5 ( UnsignedFile.Multi.Generic ) - skipped by user
18:26:02.0687 2876 UnlockerDriver5 ( UnsignedFile.Multi.Generic ) - User select action: Skip
18:23:37.0812 0268 ============================================================
18:23:37.0812 0268 Current date / time: 2012/08/12 18:23:37.0812
18:23:37.0812 0268 SystemInfo:
18:23:37.0812 0268
18:23:37.0812 0268 OS Version: 5.1.2600 ServicePack: 3.0
18:23:37.0812 0268 Product type: Workstation
18:23:37.0812 0268 ComputerName: MARTIN-B598CED7
18:23:37.0812 0268 UserName: Martin
18:23:37.0812 0268 Windows directory: C:\WINDOWS
18:23:37.0812 0268 System windows directory: C:\WINDOWS
18:23:37.0812 0268 Processor architecture: Intel x86
18:23:37.0812 0268 Number of processors: 1
18:23:37.0812 0268 Page size: 0x1000
18:23:37.0812 0268 Boot type: Normal boot
18:23:37.0812 0268 ============================================================
18:23:40.0250 0268 Drive \Device\Harddisk0\DR0 - Size: 0x1BF4290000 (111.82 Gb), SectorSize: 0x200, Cylinders: 0x3904, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000020
18:23:40.0265 0268 Drive \Device\Harddisk1\DR3 - Size: 0x77800000 (1.87 Gb), SectorSize: 0x200, Cylinders: 0xF3, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
18:23:40.0265 0268 ============================================================
18:23:40.0265 0268 \Device\Harddisk0\DR0:
18:23:40.0265 0268 MBR partitions:
18:23:40.0265 0268 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x30D3C74
18:23:40.0296 0268 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x30D3CF2, BlocksNum 0xAECB712
18:23:40.0296 0268 \Device\Harddisk1\DR3:
18:23:40.0296 0268 MBR partitions:
18:23:40.0296 0268 \Device\Harddisk1\DR3\Partition0: MBR, Type 0xB, StartLBA 0x20, BlocksNum 0x3BBFE0
18:23:40.0296 0268 ============================================================
18:23:40.0343 0268 C: <-> \Device\Harddisk0\DR0\Partition0
18:23:40.0359 0268 D: <-> \Device\Harddisk0\DR0\Partition1
18:23:40.0359 0268 ============================================================
18:23:40.0359 0268 Initialize success
18:23:40.0359 0268 ============================================================
18:24:19.0125 2420 ============================================================
18:24:19.0125 2420 Scan started
18:24:19.0125 2420 Mode: Manual; SigCheck; TDLFS;
18:24:19.0125 2420 ============================================================
18:24:19.0593 2420 !SASCORE (c0393eb99a6c72c6bef9bfc4a72b33a6) C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
18:24:19.0750 2420 !SASCORE - ok
18:24:19.0890 2420 602XML Updater (f11d68e40ed62fdb7c460c445f1ec4e5) C:\Program Files\Common Files\soft602\602updsvc\602updsvc.exe
18:24:19.0921 2420 602XML Updater - ok
18:24:20.0015 2420 61883 (914a9709fc3bf419ad2f85547f2a4832) C:\WINDOWS\system32\DRIVERS\61883.sys
18:24:20.0218 2420 61883 - ok
18:24:20.0234 2420 Abiosdsk - ok
18:24:20.0265 2420 abp480n5 - ok
18:24:20.0312 2420 ACPI (4fe34f1f3126b61fcc6b2043aa8112c9) C:\WINDOWS\system32\DRIVERS\ACPI.sys
18:24:20.0578 2420 ACPI - ok
18:24:20.0609 2420 ACPIEC (afdff022a01f0b11c776f0860c3b282f) C:\WINDOWS\system32\drivers\ACPIEC.sys
18:24:20.0812 2420 ACPIEC - ok
18:24:20.0906 2420 AdobeFlashPlayerUpdateSvc (f19c98ad81d2c0e1bbfd8153d2c80ee8) C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
18:24:20.0953 2420 AdobeFlashPlayerUpdateSvc - ok
18:24:20.0984 2420 adpu160m - ok
18:24:21.0031 2420 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
18:24:21.0218 2420 aec - ok
18:24:21.0265 2420 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
18:24:21.0328 2420 AFD - ok
18:24:21.0343 2420 Aha154x - ok
18:24:21.0375 2420 aic78u2 - ok
18:24:21.0406 2420 aic78xx - ok
18:24:21.0593 2420 ALCXWDM (93f93a8e3e14cbbf1ce9a5af1a70c095) C:\WINDOWS\system32\drivers\ALCXWDM.SYS
18:24:21.0890 2420 ALCXWDM - ok
18:24:22.0000 2420 Alerter (e0a6fa244b8624d78fe5ff6f56a33bae) C:\WINDOWS\system32\alrsvc.dll
18:24:22.0156 2420 Alerter - ok
18:24:22.0203 2420 ALG (88842de939a827577bf24243699ac80a) C:\WINDOWS\System32\alg.exe
18:24:22.0281 2420 ALG - ok
18:24:22.0312 2420 AliIde - ok
18:24:22.0375 2420 AmdK8 (59301936898ae62245a6f09c0aba9475) C:\WINDOWS\system32\DRIVERS\AmdK8.sys
18:24:22.0406 2420 AmdK8 - ok
18:24:22.0421 2420 amsint - ok
18:24:22.0437 2420 AppMgmt - ok
18:24:22.0484 2420 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
18:24:22.0687 2420 Arp1394 - ok
18:24:22.0703 2420 ASAPIW2k (4f9cbbf95e8f7a0d4c0edcfe3b78102e) C:\WINDOWS\system32\drivers\ASAPIW2k.sys
18:24:22.0734 2420 ASAPIW2k ( UnsignedFile.Multi.Generic ) - warning
18:24:22.0734 2420 ASAPIW2k - detected UnsignedFile.Multi.Generic (1)
18:24:22.0765 2420 asc - ok
18:24:22.0796 2420 asc3350p - ok
18:24:22.0828 2420 asc3550 - ok
18:24:23.0000 2420 aspnet_state (776acefa0ca9df0faa51a5fb2f435705) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
18:24:23.0015 2420 aspnet_state - ok
18:24:23.0046 2420 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
18:24:23.0250 2420 AsyncMac - ok
18:24:23.0296 2420 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
18:24:23.0500 2420 atapi - ok
18:24:23.0531 2420 Atdisk - ok
18:24:23.0562 2420 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
18:24:23.0781 2420 Atmarpc - ok
18:24:23.0828 2420 AudioSrv (de31b88962a8645dba5a37b993e7b0f1) C:\WINDOWS\System32\audiosrv.dll
18:24:24.0046 2420 AudioSrv - ok
18:24:24.0093 2420 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
18:24:24.0281 2420 audstub - ok
18:24:24.0328 2420 Avc (f8e6956a614f15a0860474c5e2a7de6b) C:\WINDOWS\system32\DRIVERS\avc.sys
18:24:24.0531 2420 Avc - ok
18:24:24.0703 2420 AVG Security Toolbar Service (3a457c2f798cad79cd30224e723e01fb) C:\Program Files\AVG\AVG10\Toolbar\ToolbarBroker.exe
18:24:24.0796 2420 AVG Security Toolbar Service - ok
18:24:24.0843 2420 Avgfwdx (841b0a982065bffc7d7e84009f2fa76f) C:\WINDOWS\system32\DRIVERS\avgfwdx.sys
18:24:24.0859 2420 Avgfwdx - ok
18:24:24.0875 2420 Avgfwfd (841b0a982065bffc7d7e84009f2fa76f) C:\WINDOWS\system32\DRIVERS\avgfwdx.sys
18:24:24.0890 2420 Avgfwfd - ok
18:24:25.0062 2420 avgfws (5cd22eb540f82c70e33e530003f3903b) C:\Program Files\AVG\AVG2012\avgfws.exe
18:24:25.0296 2420 avgfws - ok
18:24:25.0515 2420 AVGIDSAgent (6d440ff3f44ca72edfd6176c6d6a89c0) C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe
18:24:25.0796 2420 AVGIDSAgent - ok
18:24:25.0890 2420 AVGIDSDriver (4fa401b33c1b50c816486f6951244a14) C:\WINDOWS\system32\DRIVERS\AVGIDSDriver.Sys
18:24:25.0906 2420 AVGIDSDriver - ok
18:24:25.0953 2420 AVGIDSEH (69578bc9d43d614c6b3455db4af19762) C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys
18:24:25.0968 2420 AVGIDSEH - ok
18:24:26.0015 2420 AVGIDSFilter (6df528406aa22201f392b9b19121cd6f) C:\WINDOWS\system32\DRIVERS\AVGIDSFilter.Sys
18:24:26.0031 2420 AVGIDSFilter - ok
18:24:26.0062 2420 AVGIDSShim (1e01c2166b5599802bcd61b9691f7476) C:\WINDOWS\system32\DRIVERS\AVGIDSShim.Sys
18:24:26.0078 2420 AVGIDSShim - ok
18:24:26.0125 2420 Avgldx86 (bf8118cd5e2255387b715b534d64acd1) C:\WINDOWS\system32\DRIVERS\avgldx86.sys
18:24:26.0156 2420 Avgldx86 - ok
18:24:26.0187 2420 Avgmfx86 (1c77ef67f196466adc9924cb288afe87) C:\WINDOWS\system32\DRIVERS\avgmfx86.sys
18:24:26.0203 2420 Avgmfx86 - ok
18:24:26.0218 2420 Avgrkx86 (f2038ed7284b79dcef581468121192a9) C:\WINDOWS\system32\DRIVERS\avgrkx86.sys
18:24:26.0281 2420 Avgrkx86 - ok
18:24:26.0343 2420 Avgtdix (a6d562b612216d8d02a35ebeb92366bd) C:\WINDOWS\system32\DRIVERS\avgtdix.sys
18:24:26.0375 2420 Avgtdix - ok
18:24:26.0484 2420 avgwd (6699ece24fe4b3f752a66c66a602ee86) C:\Program Files\AVG\AVG2012\avgwdsvc.exe
18:24:26.0531 2420 avgwd - ok
18:24:26.0578 2420 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
18:24:26.0796 2420 Beep - ok
18:24:26.0890 2420 BITS (19395d092fd85ddc2d9c7729cf5a2ac8) C:\WINDOWS\system32\qmgr.dll
18:24:27.0109 2420 BITS - ok
18:24:27.0156 2420 Browser (249276d3ef1e74b992299cb96099e4d7) C:\WINDOWS\System32\browser.dll
18:24:27.0390 2420 Browser - ok
18:24:27.0437 2420 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
18:24:27.0671 2420 cbidf2k - ok
18:24:27.0718 2420 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
18:24:27.0937 2420 CCDECODE - ok
18:24:27.0953 2420 cd20xrnt - ok
18:24:28.0000 2420 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
18:24:28.0203 2420 Cdaudio - ok
18:24:28.0296 2420 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
18:24:28.0531 2420 Cdfs - ok
18:24:28.0578 2420 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
18:24:28.0843 2420 Cdrom - ok
18:24:28.0875 2420 Changer - ok
18:24:28.0921 2420 CiSvc (e390dc1d7c461d7d56ec53402f329928) C:\WINDOWS\system32\cisvc.exe
18:24:29.0140 2420 CiSvc - ok
18:24:29.0171 2420 ClipSrv (064507a8dfa8c5c7e2ffddd3e6f424fa) C:\WINDOWS\system32\clipsrv.exe
18:24:29.0406 2420 ClipSrv - ok
18:24:29.0640 2420 clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
18:24:29.0671 2420 clr_optimization_v2.0.50727_32 - ok
18:24:29.0953 2420 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
18:24:29.0968 2420 clr_optimization_v4.0.30319_32 - ok
18:24:30.0000 2420 CmdIde - ok
18:24:30.0031 2420 COMSysApp - ok
18:24:30.0093 2420 Cpqarray - ok
18:24:30.0156 2420 CryptSvc (f3ab0933cbd166d271992f411c27ccaf) C:\WINDOWS\System32\cryptsvc.dll
18:24:30.0359 2420 CryptSvc - ok
18:24:30.0375 2420 CrystalSysInfo - ok
18:24:30.0406 2420 dac2w2k - ok
18:24:30.0437 2420 dac960nt - ok
18:24:30.0734 2420 DcomLaunch (be27674d1cbc3214aec84b4336a38bbf) C:\WINDOWS\system32\rpcss.dll
18:24:30.0796 2420 DcomLaunch - ok
18:24:30.0953 2420 Dhcp (8c9a53e285ac5e6704844d0459ec85be) C:\WINDOWS\System32\dhcpcsvc.dll
18:24:31.0171 2420 Dhcp - ok
18:24:31.0203 2420 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
18:24:31.0421 2420 Disk - ok
18:24:31.0437 2420 dmadmin - ok
18:24:31.0500 2420 dmboot (db5fd2bf5b07dc54bfcb3664ff05bd7c) C:\WINDOWS\system32\drivers\dmboot.sys
18:24:31.0734 2420 dmboot - ok
18:24:31.0796 2420 dmio (fff1720af51171f32f1ead5cf71f2810) C:\WINDOWS\system32\drivers\dmio.sys
18:24:32.0031 2420 dmio - ok
18:24:32.0062 2420 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
18:24:32.0265 2420 dmload - ok
18:24:32.0328 2420 dmserver (2bfefe9e865655a76982f050450b9591) C:\WINDOWS\System32\dmserver.dll
18:24:32.0515 2420 dmserver - ok
18:24:32.0562 2420 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
18:24:32.0812 2420 DMusic - ok
18:24:32.0875 2420 Dnscache (dfaa406bf19f4ee806a6f8d4342137f7) C:\WINDOWS\System32\dnsrslvr.dll
18:24:32.0937 2420 Dnscache - ok
18:24:33.0000 2420 Dot3svc (4a3e2bd20157a0946751229e92eb8621) C:\WINDOWS\System32\dot3svc.dll
18:24:33.0187 2420 Dot3svc - ok
18:24:33.0218 2420 dpti2o - ok
18:24:33.0281 2420 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
18:24:33.0484 2420 drmkaud - ok
18:24:33.0500 2420 EapHost (0887d9c2be8d940778cad1e3b85f2a41) C:\WINDOWS\System32\eapsvc.dll
18:24:33.0734 2420 EapHost - ok
18:24:33.0765 2420 ERSvc (a2a4912798f2be706abadd3d30800d16) C:\WINDOWS\System32\ersvc.dll
18:24:34.0031 2420 ERSvc - ok
18:24:34.0078 2420 Eventlog (9ef697af07bb8dd82c3b02ca953a95b7) C:\WINDOWS\system32\services.exe
18:24:34.0109 2420 Eventlog - ok
18:24:34.0156 2420 EventSystem (a371f11ef07653591c8de26afb13ce7f) C:\WINDOWS\system32\es.dll
18:24:34.0187 2420 EventSystem - ok
18:24:34.0234 2420 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
18:24:34.0390 2420 Fastfat - ok
18:24:34.0437 2420 FastUserSwitchingCompatibility (ee9a2b9ea968a792a053c9d1a86bf870) C:\WINDOWS\System32\shsvcs.dll
18:24:34.0484 2420 FastUserSwitchingCompatibility - ok
18:24:34.0531 2420 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
18:24:34.0781 2420 Fdc - ok
18:24:34.0828 2420 FET5X86V (e7072827d0b5f9bd99d6961571a38973) C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys
18:24:34.0875 2420 FET5X86V - ok
18:24:34.0890 2420 FETND5BV (e7072827d0b5f9bd99d6961571a38973) C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys
18:24:34.0937 2420 FETND5BV - ok
18:24:34.0984 2420 FETNDIS (e9648254056bce81a85380c0c3647dc4) C:\WINDOWS\system32\DRIVERS\fetnd5.sys
18:24:35.0203 2420 FETNDIS - ok
18:24:35.0265 2420 Fips (ac366695a0796560aa37215ad5762aaf) C:\WINDOWS\system32\drivers\Fips.sys
18:24:35.0468 2420 Fips - ok
18:24:35.0500 2420 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
18:24:35.0703 2420 Flpydisk - ok
18:24:35.0765 2420 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
18:24:35.0953 2420 FltMgr - ok
18:24:36.0046 2420 FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
18:24:36.0062 2420 FontCache3.0.0.0 - ok
18:24:36.0125 2420 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
18:24:36.0359 2420 Fs_Rec - ok
18:24:36.0390 2420 Ftdisk (4e664d8541db4a66b73a24257e322e1f) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
18:24:36.0578 2420 Ftdisk - ok
18:24:36.0625 2420 gagp30kx (3a74c423cf6bcca6982715878f450a3b) C:\WINDOWS\system32\DRIVERS\gagp30kx.sys
18:24:37.0015 2420 gagp30kx - ok
18:24:37.0046 2420 gameenum (065639773d8b03f33577f6cdaea21063) C:\WINDOWS\system32\DRIVERS\gameenum.sys
18:24:37.0265 2420 gameenum - ok
18:24:37.0296 2420 GEARAspiWDM (4ac51459805264affd5f6fdfb9d9235f) C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys
18:24:37.0312 2420 GEARAspiWDM - ok
18:24:37.0375 2420 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
18:24:37.0625 2420 Gpc - ok
18:24:37.0703 2420 helpsvc (fcfe31fb75f8a6295b6b0af87a626282) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
18:24:37.0906 2420 helpsvc - ok
18:24:37.0937 2420 HidServ - ok
18:24:38.0000 2420 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
18:24:38.0218 2420 HidUsb - ok
18:24:38.0250 2420 hkmsvc (7a6b320928f86bc851530d63c82965d9) C:\WINDOWS\System32\kmsvc.dll
18:24:38.0453 2420 hkmsvc - ok
18:24:38.0468 2420 hpn - ok
18:24:38.0546 2420 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
18:24:38.0578 2420 HTTP - ok
18:24:38.0609 2420 HTTPFilter (58fe2f2da3bc5573f4a35b3760d3125f) C:\WINDOWS\System32\w3ssl.dll
18:24:38.0859 2420 HTTPFilter - ok
18:24:38.0890 2420 i2omgmt - ok
18:24:38.0921 2420 i2omp - ok
18:24:39.0000 2420 i8042prt (c528e27945367191e7bae364930b6932) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
18:24:39.0328 2420 i8042prt - ok
18:24:39.0437 2420 IDriverT (daf66902f08796f9c694901660e5a64a) C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
18:24:39.0453 2420 IDriverT ( UnsignedFile.Multi.Generic ) - warning
18:24:39.0453 2420 IDriverT - detected UnsignedFile.Multi.Generic (1)
18:24:39.0546 2420 idsvc (c01ac32dc5c03076cfb852cb5da5229c) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
18:24:39.0625 2420 idsvc - ok
18:24:39.0671 2420 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
18:24:39.0890 2420 Imapi - ok
18:24:39.0968 2420 ImapiService (f7b93aafad33b2320954c17e26c8d361) C:\WINDOWS\system32\imapi.exe
18:24:40.0140 2420 ImapiService - ok
18:24:40.0171 2420 ini910u - ok
18:24:40.0203 2420 IntelIde - ok
18:24:40.0250 2420 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
18:24:40.0437 2420 Ip6Fw - ok
18:24:40.0484 2420 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
18:24:40.0703 2420 IpFilterDriver - ok
18:24:40.0718 2420 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
18:24:40.0921 2420 IpInIp - ok
18:24:41.0000 2420 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
18:24:41.0187 2420 IpNat - ok
18:24:41.0218 2420 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
18:24:41.0421 2420 IPSec - ok
18:24:41.0453 2420 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
18:24:41.0531 2420 IRENUM - ok
18:24:41.0578 2420 isapnp (cc9f8a2d60aed1a51a3ac34c59b987ae) C:\WINDOWS\system32\DRIVERS\isapnp.sys
18:24:41.0765 2420 isapnp - ok
18:24:41.0890 2420 JavaQuickStarterService (0a5709543986843d37a92290b7838340) C:\Program Files\Java\jre6\bin\jqs.exe
18:24:41.0906 2420 JavaQuickStarterService - ok
18:24:41.0937 2420 Kbdclass (1b6162fe7f66b1a71a4b70f941c4aa9b) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
18:24:42.0156 2420 Kbdclass - ok
18:24:42.0203 2420 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
18:24:42.0375 2420 kmixer - ok
18:24:42.0421 2420 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
18:24:42.0453 2420 KSecDD - ok
18:24:42.0515 2420 lanmanserver (3428e8f86f8add36b42fb23542c7b3e4) C:\WINDOWS\System32\srvsvc.dll
18:24:42.0546 2420 lanmanserver - ok
18:24:42.0609 2420 lanmanworkstation (936c1d110232d23b621cb0196e4f80f0) C:\WINDOWS\System32\wkssvc.dll
18:24:42.0656 2420 lanmanworkstation - ok
18:24:42.0687 2420 lbrtfdc - ok
18:24:42.0781 2420 LmHosts (0ab159f536e3e8f7f07113702a07cca5) C:\WINDOWS\System32\lmhsvc.dll
18:24:42.0968 2420 LmHosts - ok
18:24:43.0031 2420 MarvinBus (d51e16339213898bc20c58670274ec3e) C:\WINDOWS\system32\DRIVERS\MarvinBus.sys
18:24:43.0062 2420 MarvinBus - ok
18:24:43.0156 2420 MDM (11f714f85530a2bd134074dc30e99fca) C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
18:24:43.0187 2420 MDM - ok
18:24:43.0218 2420 Messenger (221cd1c815b8a6b79389c3f5d1018de8) C:\WINDOWS\System32\msgsvc.dll
18:24:43.0437 2420 Messenger - ok
18:24:43.0468 2420 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
18:24:43.0687 2420 mnmdd - ok
18:24:43.0734 2420 mnmsrvc (9a57d046f88f4b69751b11fd40088a61) C:\WINDOWS\system32\mnmsrvc.exe
18:24:43.0921 2420 mnmsrvc - ok
18:24:43.0984 2420 Modem (44032b0c6d9954d3fd26438330b99ee7) C:\WINDOWS\system32\drivers\Modem.sys
18:24:44.0171 2420 Modem - ok
18:24:44.0218 2420 Mouclass (4cb582831dbde63ce43b45d771218374) C:\WINDOWS\system32\DRIVERS\mouclass.sys
18:24:44.0437 2420 Mouclass - ok
18:24:44.0468 2420 mouhid (bb269eba740737ab749b214d568b6812) C:\WINDOWS\system32\DRIVERS\mouhid.sys
18:24:44.0687 2420 mouhid - ok
18:24:44.0750 2420 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
18:24:44.0906 2420 MountMgr - ok
18:24:44.0921 2420 mraid35x - ok
18:24:44.0953 2420 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
18:24:45.0125 2420 MRxDAV - ok
18:24:45.0203 2420 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
18:24:45.0250 2420 MRxSmb - ok
18:24:45.0296 2420 MSDTC (6db4d1521caba9a5ffab54ade0ae867d) C:\WINDOWS\system32\msdtc.exe
18:24:45.0531 2420 MSDTC - ok
18:24:45.0609 2420 MSDV (1477849772712bac69c144dcf2c9ce81) C:\WINDOWS\system32\DRIVERS\msdv.sys
18:24:45.0796 2420 MSDV - ok
18:24:45.0843 2420 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
18:24:46.0046 2420 Msfs - ok
18:24:46.0062 2420 MSIServer - ok
18:24:46.0093 2420 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
18:24:46.0296 2420 MSKSSRV - ok
18:24:46.0328 2420 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
18:24:46.0546 2420 MSPCLOCK - ok
18:24:46.0578 2420 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
18:24:46.0796 2420 MSPQM - ok
18:24:46.0843 2420 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
18:24:47.0046 2420 mssmbios - ok
18:24:47.0078 2420 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
18:24:47.0250 2420 MSTEE - ok
18:24:47.0296 2420 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
18:24:47.0343 2420 Mup - ok
18:24:47.0375 2420 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
18:24:47.0578 2420 NABTSFEC - ok
18:24:47.0671 2420 napagent (6ea362e9db03d44f6b996f4d8be237e9) C:\WINDOWS\System32\qagentrt.dll
18:24:47.0859 2420 napagent - ok
18:24:47.0937 2420 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
18:24:48.0140 2420 NDIS - ok
18:24:48.0171 2420 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
18:24:48.0375 2420 NdisIP - ok
18:24:48.0421 2420 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
18:24:48.0453 2420 NdisTapi - ok
18:24:48.0500 2420 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
18:24:48.0687 2420 Ndisuio - ok
18:24:48.0703 2420 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
18:24:48.0890 2420 NdisWan - ok
18:24:48.0937 2420 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
18:24:49.0015 2420 NDProxy - ok
18:24:49.0046 2420 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
18:24:49.0234 2420 NetBIOS - ok
18:24:49.0281 2420 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
18:24:49.0468 2420 NetBT - ok
18:24:49.0515 2420 NetDDE (933de774986ec85e48210c44ab431de6) C:\WINDOWS\system32\netdde.exe
18:24:49.0718 2420 NetDDE - ok
18:24:49.0750 2420 NetDDEdsdm (933de774986ec85e48210c44ab431de6) C:\WINDOWS\system32\netdde.exe
18:24:49.0921 2420 NetDDEdsdm - ok
18:24:49.0968 2420 Netlogon (ed0a176354487ceed65b80a7148ab739) C:\WINDOWS\system32\lsass.exe
18:24:50.0171 2420 Netlogon - ok
18:24:50.0218 2420 Netman (72e1e9e2977be08bdeedb6d8fd9d4d40) C:\WINDOWS\System32\netman.dll
18:24:50.0421 2420 Netman - ok
18:24:50.0515 2420 NetTcpPortSharing (d34612c5d02d026535b3095d620626ae) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
18:24:50.0562 2420 NetTcpPortSharing - ok
18:24:50.0578 2420 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
18:24:50.0765 2420 NIC1394 - ok
18:24:50.0828 2420 Nla (39ee7c3bfbc64ba87cc8cf67386e814c) C:\WINDOWS\System32\mswsock.dll
18:24:50.0859 2420 Nla - ok
18:24:50.0890 2420 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
18:24:51.0109 2420 Npfs - ok
18:24:51.0187 2420 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
18:24:51.0390 2420 Ntfs - ok
18:24:51.0406 2420 NtLmSsp (ed0a176354487ceed65b80a7148ab739) C:\WINDOWS\system32\lsass.exe
18:24:51.0593 2420 NtLmSsp - ok
18:24:51.0671 2420 NtmsSvc (023dd70573d644f3d9c8b1258a7bfd08) C:\WINDOWS\system32\ntmssvc.dll
18:24:51.0890 2420 NtmsSvc - ok
18:24:51.0937 2420 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
18:24:52.0140 2420 Null - ok
18:24:52.0531 2420 nv (8c0456001b6900114bbb1c548bd8aaf5) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
18:24:52.0984 2420 nv - ok
18:24:53.0093 2420 NVSvc (472a00d2183c9e5edb3e076272741812) C:\WINDOWS\system32\nvsvc32.exe
18:24:53.0140 2420 NVSvc - ok
18:24:53.0171 2420 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
18:24:53.0421 2420 NwlnkFlt - ok
18:24:53.0453 2420 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
18:24:53.0656 2420 NwlnkFwd - ok
18:24:53.0718 2420 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
18:24:53.0921 2420 ohci1394 - ok
18:24:53.0984 2420 ose (7a56cf3e3f12e8af599963b16f50fb6a) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
18:24:54.0015 2420 ose - ok
18:24:54.0078 2420 Parport (46f8db73b4a53e543f8e371dc7c75bae) C:\WINDOWS\system32\DRIVERS\parport.sys
18:24:54.0281 2420 Parport - ok
18:24:54.0312 2420 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
18:24:54.0484 2420 PartMgr - ok
18:24:54.0546 2420 ParVdm (1fae19d0457176318bba4a8795656ebc) C:\WINDOWS\system32\drivers\ParVdm.sys
18:24:54.0765 2420 ParVdm - ok
18:24:54.0796 2420 PCI (6ce351d149cb4befc702951e471e1730) C:\WINDOWS\system32\DRIVERS\pci.sys
18:24:54.0984 2420 PCI - ok
18:24:55.0000 2420 PCIDump - ok
18:24:55.0031 2420 PCIIde - ok
18:24:55.0062 2420 PCLEPCI (1bebe7de8508a02650cdce45c664c2a2) C:\WINDOWS\system32\drivers\pclepci.sys
18:24:55.0093 2420 PCLEPCI ( UnsignedFile.Multi.Generic ) - warning
18:24:55.0093 2420 PCLEPCI - detected UnsignedFile.Multi.Generic (1)
18:24:55.0125 2420 Pcmcia (4fc31e6c19a5ce5198b1abff94cae758) C:\WINDOWS\system32\drivers\Pcmcia.sys
18:24:55.0312 2420 Pcmcia - ok
18:24:55.0375 2420 pcouffin (5b6c11de7e839c05248ced8825470fef) C:\WINDOWS\system32\Drivers\pcouffin.sys
18:24:55.0406 2420 pcouffin ( UnsignedFile.Multi.Generic ) - warning
18:24:55.0406 2420 pcouffin - detected UnsignedFile.Multi.Generic (1)
18:24:55.0437 2420 PDCOMP - ok
18:24:55.0468 2420 PDFRAME - ok
18:24:55.0500 2420 PDRELI - ok
18:24:55.0531 2420 PDRFRAME - ok
18:24:55.0562 2420 perc2 - ok
18:24:55.0593 2420 perc2hib - ok
18:24:55.0734 2420 PlugPlay (9ef697af07bb8dd82c3b02ca953a95b7) C:\WINDOWS\system32\services.exe
18:24:55.0765 2420 PlugPlay - ok
18:24:55.0781 2420 Point32 - ok
18:24:55.0843 2420 PolicyAgent (ed0a176354487ceed65b80a7148ab739) C:\WINDOWS\system32\lsass.exe
18:24:56.0015 2420 PolicyAgent - ok
18:24:56.0046 2420 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
18:24:56.0265 2420 PptpMiniport - ok
18:24:56.0296 2420 Processor (7eb15dce4ec3a0220bd796a15c18186e) C:\WINDOWS\system32\DRIVERS\processr.sys
18:24:56.0468 2420 Processor - ok
18:24:56.0500 2420 ProtectedStorage (ed0a176354487ceed65b80a7148ab739) C:\WINDOWS\system32\lsass.exe
18:24:56.0687 2420 ProtectedStorage - ok
18:24:56.0703 2420 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
18:24:56.0953 2420 PSched - ok
18:24:56.0984 2420 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
18:24:57.0171 2420 Ptilink - ok
18:24:57.0187 2420 ql1080 - ok
18:24:57.0203 2420 Ql10wnt - ok
18:24:57.0234 2420 ql12160 - ok
18:24:57.0265 2420 ql1240 - ok
18:24:57.0296 2420 ql1280 - ok
18:24:57.0343 2420 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
18:24:57.0531 2420 RasAcd - ok
18:24:57.0593 2420 RasAuto (2b5e44ea009f2f374b980e1e9a70635d) C:\WINDOWS\System32\rasauto.dll
18:24:57.0781 2420 RasAuto - ok
18:24:57.0812 2420 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
18:24:58.0031 2420 Rasl2tp - ok
18:24:58.0078 2420 RasMan (d57554c664b64604bd1ee13ea2c07e77) C:\WINDOWS\System32\rasmans.dll
18:24:58.0250 2420 RasMan - ok
18:24:58.0296 2420 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
18:24:58.0484 2420 RasPppoe - ok
18:24:58.0515 2420 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
18:24:58.0687 2420 Raspti - ok
18:24:58.0734 2420 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
18:24:58.0937 2420 Rdbss - ok
18:24:58.0984 2420 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
18:24:59.0156 2420 RDPCDD - ok
18:24:59.0218 2420 RDPWD (6589db6e5969f8eee594cf71171c5028) C:\WINDOWS\system32\drivers\RDPWD.sys
18:24:59.0281 2420 RDPWD - ok
18:24:59.0312 2420 RDSessMgr (c0d9d9711cb74ee9bc66353d8cbdab0e) C:\WINDOWS\system32\sessmgr.exe
18:24:59.0500 2420 RDSessMgr - ok
18:24:59.0546 2420 redbook (611bfd220305be3a85ae876ea47d4aa5) C:\WINDOWS\system32\DRIVERS\redbook.sys
18:24:59.0750 2420 redbook - ok
18:24:59.0781 2420 RemoteAccess (127c26b5371651043450e52542099aba) C:\WINDOWS\System32\mprdim.dll
18:24:59.0984 2420 RemoteAccess - ok
18:25:00.0015 2420 RpcLocator (718b3bdc0bc3c2f7d065a53d26202af9) C:\WINDOWS\system32\locator.exe
18:25:00.0250 2420 RpcLocator - ok
18:25:00.0328 2420 RpcSs (be27674d1cbc3214aec84b4336a38bbf) C:\WINDOWS\system32\rpcss.dll
18:25:00.0359 2420 RpcSs - ok
18:25:00.0421 2420 RSVP (09ab2e71e58b078038e3bfdba7ffc984) C:\WINDOWS\system32\rsvp.exe
18:25:00.0593 2420 RSVP - ok
18:25:00.0625 2420 s125bus (06847aa6f3a9bf7c44134d00a2e578c0) C:\WINDOWS\system32\DRIVERS\s125bus.sys
18:25:00.0640 2420 s125bus - ok
18:25:00.0687 2420 s125mdfl (f83f88e1b125308fb5015ea0349502b0) C:\WINDOWS\system32\DRIVERS\s125mdfl.sys
18:25:00.0703 2420 s125mdfl - ok
18:25:00.0843 2420 s125mdm (402a97756c14940ad6ae5169c2fb105e) C:\WINDOWS\system32\DRIVERS\s125mdm.sys
18:25:00.0875 2420 s125mdm - ok
18:25:00.0906 2420 s125mgmt (82b14c51de76825ec769a6374e4c57d6) C:\WINDOWS\system32\DRIVERS\s125mgmt.sys
18:25:00.0937 2420 s125mgmt - ok
18:25:00.0968 2420 s125obex (bedfc5707c356fd073bf1a4afe442d91) C:\WINDOWS\system32\DRIVERS\s125obex.sys
18:25:00.0984 2420 s125obex - ok
18:25:01.0046 2420 SamSs (ed0a176354487ceed65b80a7148ab739) C:\WINDOWS\system32\lsass.exe
18:25:01.0218 2420 SamSs - ok
18:25:01.0281 2420 SASDIFSV (39763504067962108505bff25f024345) C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
18:25:01.0328 2420 SASDIFSV - ok
18:25:01.0359 2420 SASKUTIL (77b9fc20084b48408ad3e87570eb4a85) C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
18:25:01.0390 2420 SASKUTIL - ok
18:25:01.0421 2420 SCardSvr (410046e401eb11e1e6749e9deea41d4a) C:\WINDOWS\System32\SCardSvr.exe
18:25:01.0640 2420 SCardSvr - ok
18:25:01.0703 2420 Schedule (3ff232a7731621b8902d81d42418c93c) C:\WINDOWS\system32\schedsvc.dll
18:25:01.0906 2420 Schedule - ok
18:25:02.0031 2420 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
18:25:02.0171 2420 Secdrv - ok
18:25:02.0296 2420 seclogon (477e2c3cc5e4a0d635bcb0ea8dcac3c6) C:\WINDOWS\System32\seclogon.dll
18:25:02.0515 2420 seclogon - ok
18:25:02.0593 2420 SENS (a530b75c10c23c9ab28fdb6ce719e21f) C:\WINDOWS\system32\sens.dll
18:25:02.0796 2420 SENS - ok
18:25:02.0843 2420 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
18:25:03.0031 2420 serenum - ok
18:25:03.0062 2420 Serial (b842729337c9b921615c40d3c1a1af96) C:\WINDOWS\system32\DRIVERS\serial.sys
18:25:03.0281 2420 Serial - ok
18:25:03.0390 2420 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\DRIVERS\sfloppy.sys
18:25:03.0625 2420 Sfloppy - ok
18:25:04.0500 2420 SharedAccess (f58faca9621d2db01bd0927d9a0a208e) C:\WINDOWS\System32\ipnathlp.dll
18:25:04.0703 2420 SharedAccess - ok
18:25:05.0093 2420 ShellHWDetection (ee9a2b9ea968a792a053c9d1a86bf870) C:\WINDOWS\System32\shsvcs.dll
18:25:05.0109 2420 ShellHWDetection - ok
18:25:05.0140 2420 Simbad - ok
18:25:05.0187 2420 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
18:25:05.0406 2420 SLIP - ok
18:25:05.0453 2420 Sparrow - ok
18:25:05.0484 2420 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
18:25:05.0718 2420 splitter - ok
18:25:05.0890 2420 Spooler (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe
18:25:05.0937 2420 Spooler - ok
18:25:06.0265 2420 sr (94610c8653635e4459316a0050d55ce7) C:\WINDOWS\system32\DRIVERS\sr.sys
18:25:06.0390 2420 sr - ok
18:25:06.0796 2420 srservice (35b91147124f64ac8081a2edb9ea4dee) C:\WINDOWS\system32\srsvc.dll
18:25:06.0890 2420 srservice - ok
18:25:06.0984 2420 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
18:25:07.0031 2420 Srv - ok
18:25:07.0062 2420 SSDPSRV (becd5271dc4e3b7c3d035f790fcbc1e5) C:\WINDOWS\System32\ssdpsrv.dll
18:25:07.0156 2420 SSDPSRV - ok
18:25:07.0218 2420 stisvc (c1cdd9275f6a115bb0ae1d55d8d27ba6) C:\WINDOWS\system32\wiaservc.dll
18:25:07.0406 2420 stisvc - ok
18:25:07.0437 2420 StMp3Rec - ok
18:25:07.0484 2420 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
18:25:07.0687 2420 streamip - ok
18:25:07.0734 2420 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
18:25:07.0968 2420 swenum - ok
18:25:08.0015 2420 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
18:25:08.0218 2420 swmidi - ok
18:25:08.0250 2420 SwPrv - ok
18:25:08.0296 2420 symc810 - ok
18:25:08.0328 2420 symc8xx - ok
18:25:08.0359 2420 sym_hi - ok
18:25:08.0390 2420 sym_u3 - ok
18:25:08.0437 2420 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
18:25:08.0640 2420 sysaudio - ok
18:25:08.0671 2420 SysmonLog (ce06f01b88ace199a1bf460cac29c110) C:\WINDOWS\system32\smlogsvc.exe
18:25:08.0875 2420 SysmonLog - ok
18:25:08.0953 2420 TapiSrv (c2546cd7a398476f9df5614b2ae160e8) C:\WINDOWS\System32\tapisrv.dll
18:25:09.0125 2420 TapiSrv - ok
18:25:09.0218 2420 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
18:25:09.0265 2420 Tcpip - ok
18:25:09.0296 2420 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
18:25:09.0484 2420 TDPIPE - ok
18:25:09.0531 2420 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
18:25:09.0703 2420 TDTCP - ok
18:25:09.0750 2420 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
18:25:09.0953 2420 TermDD - ok
18:25:10.0031 2420 TermService (a75dd6fc3dbee4fff5ebc9f2c28bb66e) C:\WINDOWS\System32\termsrv.dll
18:25:10.0250 2420 TermService - ok
18:25:10.0312 2420 Themes (ee9a2b9ea968a792a053c9d1a86bf870) C:\WINDOWS\System32\shsvcs.dll
18:25:10.0328 2420 Themes - ok
18:25:10.0343 2420 TosIde - ok
18:25:10.0406 2420 TrkWks (38853304ccb938d30e0c4cde8d2c2a8a) C:\WINDOWS\system32\trkwks.dll
18:25:10.0578 2420 TrkWks - ok
18:25:10.0640 2420 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
18:25:10.0843 2420 Udfs - ok
18:25:10.0875 2420 ultra - ok
18:25:10.0968 2420 UnlockerDriver5 (bb879dcfd22926efbeb3298129898cbb) C:\Program Files\Unlocker\UnlockerDriver5.sys
18:25:10.0984 2420 UnlockerDriver5 ( UnsignedFile.Multi.Generic ) - warning
18:25:10.0984 2420 UnlockerDriver5 - detected UnsignedFile.Multi.Generic (1)
18:25:11.0078 2420 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
18:25:11.0265 2420 Update - ok
18:25:11.0328 2420 upnphost (651bd90dcee5b7bdc74a2eb7c9266f9e) C:\WINDOWS\System32\upnphost.dll
18:25:11.0437 2420 upnphost - ok
18:25:11.0468 2420 UPS (20a0f6a11959e92908717d09e87d670d) C:\WINDOWS\System32\ups.exe
18:25:11.0640 2420 UPS - ok
18:25:11.0687 2420 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
18:25:11.0890 2420 usbccgp - ok
18:25:11.0921 2420 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
18:25:12.0140 2420 usbehci - ok
18:25:12.0203 2420 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
18:25:12.0375 2420 usbhub - ok
18:25:12.0421 2420 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
18:25:12.0625 2420 usbprint - ok
18:25:12.0656 2420 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
18:25:12.0828 2420 usbscan - ok
18:25:12.0875 2420 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
18:25:13.0062 2420 USBSTOR - ok
18:25:13.0109 2420 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
18:25:13.0296 2420 usbuhci - ok
18:25:13.0328 2420 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
18:25:13.0562 2420 VgaSave - ok
18:25:13.0593 2420 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys
18:25:13.0781 2420 ViaIde - ok
18:25:13.0812 2420 viamraid (9f3f276c7300ed211129757a411b605f) C:\WINDOWS\system32\DRIVERS\viamraid.sys
18:25:13.0859 2420 viamraid - ok
18:25:13.0890 2420 videX32 (c8ee49fa76eb7c41a9cddfe58151a74e) C:\WINDOWS\system32\DRIVERS\videX32.sys
18:25:13.0921 2420 videX32 - ok
18:25:13.0968 2420 VolSnap (28a4b296b47782173c346e376cb374d1) C:\WINDOWS\system32\drivers\VolSnap.sys
18:25:14.0171 2420 VolSnap - ok
18:25:14.0218 2420 VSS (d6ba1a63d9e00933f1cd2a885573afb2) C:\WINDOWS\System32\vssvc.exe
18:25:14.0312 2420 VSS - ok
18:25:14.0437 2420 vToolbarUpdater11.2.0 (8ed347bad8d1fb7c40b593bfb01786d2) C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe
18:25:14.0531 2420 vToolbarUpdater11.2.0 - ok
18:25:14.0593 2420 W32Time (fa4e1cdba256787f2149f4aad07bc91f) C:\WINDOWS\system32\w32time.dll
18:25:14.0765 2420 W32Time - ok
18:25:14.0828 2420 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
18:25:15.0000 2420 Wanarp - ok
18:25:15.0046 2420 wceusbsh (46a247f6617526afe38b6f12f5512120) C:\WINDOWS\system32\DRIVERS\wceusbsh.sys
18:25:15.0093 2420 wceusbsh - ok
18:25:15.0125 2420 WDICA - ok
18:25:15.0171 2420 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
18:25:15.0375 2420 wdmaud - ok
18:25:15.0421 2420 WebClient (47ae51048a82dfa1cd6b51d369f7e169) C:\WINDOWS\System32\webclnt.dll
18:25:15.0625 2420 WebClient - ok
18:25:15.0703 2420 WinDefend (f45dd1e1365d857dd08bc23563370d0e) C:\Program Files\Windows Defender\MsMpEng.exe
18:25:15.0734 2420 WinDefend - ok
18:25:15.0859 2420 winmgmt (e488332126e3b1182d2b8a0c35408ec6) C:\WINDOWS\system32\wbem\WMIsvc.dll
18:25:16.0031 2420 winmgmt - ok
18:25:16.0125 2420 WinRM (4d34cedd74bdbf2b6a935eae3bf80543) C:\WINDOWS\system32\WsmSvc.dll
18:25:16.0218 2420 WinRM - ok
18:25:16.0296 2420 WmdmPmSN (c51b4a5c05a5475708e3c81c7765b71d) C:\WINDOWS\system32\MsPMSNSv.dll
18:25:16.0328 2420 WmdmPmSN - ok
18:25:16.0421 2420 WmiApSrv (23f6f03272f7e5679f1f050aed5acee6) C:\WINDOWS\system32\wbem\wmiapsrv.exe
18:25:16.0671 2420 WmiApSrv - ok
18:25:16.0765 2420 WMPNetworkSvc (3739866d20abd42f26a7b85f9e2560af) C:\Program Files\Windows Media Player\WMPNetwk.exe
18:25:16.0859 2420 WMPNetworkSvc - ok
18:25:16.0906 2420 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys
18:25:16.0953 2420 WpdUsb - ok
18:25:17.0109 2420 WPFFontCache_v0400 (dcf3e3edf5109ee8bc02fe6e1f045795) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
18:25:17.0171 2420 WPFFontCache_v0400 - ok
18:25:17.0250 2420 wscsvc (4c86d5faf78194995af9cc1075f65dd3) C:\WINDOWS\system32\wscsvc.dll
18:25:17.0437 2420 wscsvc - ok
18:25:17.0453 2420 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
18:25:17.0656 2420 WSTCODEC - ok
18:25:17.0687 2420 wuauserv (c1364564800ee9784192145324a23308) C:\WINDOWS\system32\wuauserv.dll
18:25:17.0875 2420 wuauserv - ok
18:25:17.0921 2420 WudfPf (50eb9e21963b4f06fd010d007d54351b) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
18:25:17.0953 2420 WudfPf - ok
18:25:18.0000 2420 WudfRd (6e209664bdea8a15b5e8e480d6c607c2) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
18:25:18.0031 2420 WudfRd - ok
18:25:18.0062 2420 WudfSvc (ae93084d2d236887ba56467ae42b4955) C:\WINDOWS\System32\WUDFSvc.dll
18:25:18.0109 2420 WudfSvc - ok
18:25:18.0171 2420 WZCSVC (a27d4ba7264c0bf52f32d10405bea1d4) C:\WINDOWS\System32\wzcsvc.dll
18:25:18.0375 2420 WZCSVC - ok
18:25:18.0406 2420 xcpip - ok
18:25:18.0453 2420 xmlprov (eaa4bb9edb3fb10cf8979fe65e63658f) C:\WINDOWS\System32\xmlprov.dll
18:25:18.0640 2420 xmlprov - ok
18:25:18.0687 2420 xpsec - ok
18:25:18.0781 2420 MBR (0x1B8) (413fc2a0c716421b3158746d63736515) \Device\Harddisk0\DR0
18:25:19.0296 2420 \Device\Harddisk0\DR0 - ok
18:25:19.0328 2420 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk1\DR3
18:25:23.0312 2420 \Device\Harddisk1\DR3 - ok
18:25:23.0359 2420 Boot (0x1200) (2a428c9241450d392bb02fe064243745) \Device\Harddisk0\DR0\Partition0
18:25:23.0359 2420 \Device\Harddisk0\DR0\Partition0 - ok
18:25:23.0375 2420 Boot (0x1200) (742aeba24479ecdfc8cdef1830220a35) \Device\Harddisk0\DR0\Partition1
18:25:23.0390 2420 \Device\Harddisk0\DR0\Partition1 - ok
18:25:23.0390 2420 Boot (0x1200) (74ccb0072e0331b7cbc9b6307ae89ca9) \Device\Harddisk1\DR3\Partition0
18:25:23.0406 2420 \Device\Harddisk1\DR3\Partition0 - ok
18:25:23.0406 2420 ============================================================
18:25:23.0406 2420 Scan finished
18:25:23.0406 2420 ============================================================
18:25:23.0562 2876 Detected object count: 5
18:25:23.0578 2876 Actual detected object count: 5
18:26:02.0656 2876 ASAPIW2k ( UnsignedFile.Multi.Generic ) - skipped by user
18:26:02.0656 2876 ASAPIW2k ( UnsignedFile.Multi.Generic ) - User select action: Skip
18:26:02.0671 2876 IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user
18:26:02.0671 2876 IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip
18:26:02.0671 2876 PCLEPCI ( UnsignedFile.Multi.Generic ) - skipped by user
18:26:02.0671 2876 PCLEPCI ( UnsignedFile.Multi.Generic ) - User select action: Skip
18:26:02.0671 2876 pcouffin ( UnsignedFile.Multi.Generic ) - skipped by user
18:26:02.0671 2876 pcouffin ( UnsignedFile.Multi.Generic ) - User select action: Skip
18:26:02.0687 2876 UnlockerDriver5 ( UnsignedFile.Multi.Generic ) - skipped by user
18:26:02.0687 2876 UnlockerDriver5 ( UnsignedFile.Multi.Generic ) - User select action: Skip
Re: Problém s napadeným PC - generic27.AkPW- log z RSIT přil
Pro informaci, toto nalezl AVG - v příloze.
- Přílohy
-
- info avg.jpeg (98.36 KiB) Zobrazeno 1400 x
Re: Problém s napadeným PC - generic27.AkPW- log z RSIT přil
Na uvedený odkaz se neze dostat.
Re: Problém s napadeným PC - generic27.AkPW- log z RSIT přil
Mam nabotovano. Omlouvam se za spozdeni pc je strasne pomale.
Re: Problém s napadeným PC - generic27.AkPW- log z RSIT přil
Tak zde je log z Avengeru:
Script file opened successfully.
Script file read successfully.
Backups directory opened successfully at C:\Avenger
*******************
Beginning to process script file:
Rootkit scan active.
No rootkits found!
Driver "xpsec" deleted successfully.
Driver "xcpip" deleted successfully.
Completed script processing.
*******************
Finished! Terminate.
Script file opened successfully.
Script file read successfully.
Backups directory opened successfully at C:\Avenger
*******************
Beginning to process script file:
Rootkit scan active.
No rootkits found!
Driver "xpsec" deleted successfully.
Driver "xcpip" deleted successfully.
Completed script processing.
*******************
Finished! Terminate.
Re: Problém s napadeným PC - generic27.AkPW- log z RSIT přil
A zde z MBRScan:
Kód: Vybrat vše
MBRScan v1.1.1
OS : Windows XP Home Service Pack 3 (32 bit)
PROCESSOR : x86 Family 15 Model 44 Stepping 2, AuthenticAMD
BOOT : Normal Boot
DATE : 2012/08/12 (ISO 8601) at 21:12:29
________________________________________________________________________________
DISK : Device\Harddisk0\DR0 __SAMSUNG SP1203N (TL100-30)
BUS_TYPE : (0x03) P-ATA
USE_PIO : YES
MAX_TRANSFER : 128 Kb
ALIGNMENT_MASK : word aligned
________________________________________________________________________________
DISK : Device\Harddisk1\DR3 __S31B0906 USB DISK (1100)
BUS_TYPE : (0x07) USB
USE_PIO : NO
MAX_TRANSFER : 64 Kb
ALIGNMENT_MASK : byte aligned
________________________________________________________________________________
Device\Harddisk0\DR0 111.8 Go [Fixed] ==> XP MBR Code
MBR_MD5 : 1BB15324C0096C2F2D153733503B7D58
MBR_SHA1 : 49425A091FFAD6994D4CACA6CEAAD21FA58C450A
Device\Harddisk0\Partition1 24.41 Go 0x07 NTFS / HPFS __ BOOTABLE __
Device\Harddisk0\Partition2 87.40 Go 0x07 NTFS / HPFS
________________________________________________________________________________
Device\Harddisk1\DR3 1.87 Go [Removable] ==> XP MBR Code
MBR_MD5 : 1A7A0C164C5B91B2D211A9A4EB07DE1F
MBR_SHA1 : 69245C6CECA93550846177BB5BC2F2BAD35DCF70
Device\Harddisk1\Partition1 1.87 Go __ BOOTABLE __
________________________________________________________________________________
############################### Additional scan ################################
SystemStartOptions : NOEXECUTE=OPTIN FASTDETECT
________________________________________________________________________________
_______MBR \Device\Harddisk0\DR0
0x00000000 33 C0 8E D0 BC 00 7C FB 50 07 50 1F FC BE 1B 7C 3À.м.|ûP.P.ü¾.|
0x00000010 BF 1B 06 50 57 B9 E5 01 F3 A4 CB BD BE 07 B1 04 ¿..PW¹å.ó¤Ë½¾.±.
0x00000020 38 6E 00 7C 09 75 13 83 C5 10 E2 F4 CD 18 8B F5 8n.|.u..Å.âôÍ..õ
0x00000030 83 C6 10 49 74 19 38 2C 74 F6 A0 B5 07 B4 07 8B .Æ.It.8,tö.µ.´..
0x00000040 F0 AC 3C 00 74 FC BB 07 00 B4 0E CD 10 EB F2 88 ð¬<.tü»..´.Í.ëò.
0x00000050 4E 10 E8 46 00 73 2A FE 46 10 80 7E 04 0B 74 0B N.èF.s*þF..~..t.
0x00000060 80 7E 04 0C 74 05 A0 B6 07 75 D2 80 46 02 06 83 .~..t..¶.uÒ.F...
0x00000070 46 08 06 83 56 0A 00 E8 21 00 73 05 A0 B6 07 EB F...V..è!.s..¶.ë
0x00000080 BC 81 3E FE 7D 55 AA 74 0B 80 7E 10 00 74 C8 A0 ¼.>þ}Uªt..~..tÈ.
0x00000090 B7 07 EB A9 8B FC 1E 57 8B F5 CB BF 05 00 8A 56 ·.ë©.ü.W.õË¿...V
0x000000A0 00 B4 08 CD 13 72 23 8A C1 24 3F 98 8A DE 8A FC .´.Í.r#.Á$?..Þ.ü
0x000000B0 43 F7 E3 8B D1 86 D6 B1 06 D2 EE 42 F7 E2 39 56 C÷ã.Ñ.Ö±.ÒîB÷â9V
0x000000C0 0A 77 23 72 05 39 46 08 73 1C B8 01 02 BB 00 7C .w#r.9F.s.¸..».|
0x000000D0 8B 4E 02 8B 56 00 CD 13 73 51 4F 74 4E 32 E4 8A .N..V.Í.sQOtN2ä.
0x000000E0 56 00 CD 13 EB E4 8A 56 00 60 BB AA 55 B4 41 CD V.Í.ëä.V.`»ªU´AÍ
0x000000F0 13 72 36 81 FB 55 AA 75 30 F6 C1 01 74 2B 61 60 .r6.ûUªu0öÁ.t+a`
0x00000100 6A 00 6A 00 FF 76 0A FF 76 08 6A 00 68 00 7C 6A j.j..v..v.j.h.|j
0x00000110 01 6A 10 B4 42 8B F4 CD 13 61 61 73 0E 4F 74 0B .j.´B.ôÍ.aas.Ot.
0x00000120 32 E4 8A 56 00 CD 13 EB D6 61 F9 C3 4E 65 70 6C 2ä.V.Í.ëÖaùÃNepl
0x00000130 61 74 6E A0 20 74 61 62 75 6C 6B 61 20 6F 64 64 atn. tabulka odd
0x00000140 A1 6C 85 00 43 68 79 62 61 20 70 FD 69 20 6E 61 ¡l..Chyba pýi na
0x00000150 9F A1 74 A0 6E A1 20 6F 70 65 72 61 9F 6E A1 68 .¡t.n¡ opera.n¡h
0x00000160 6F 20 73 79 73 74 82 6D 75 00 4F 70 65 72 61 9F o syst.mu.Opera.
0x00000170 6E A1 20 73 79 73 74 82 6D 20 6E 65 6E 61 6C 65 n¡ syst.m nenale
0x00000180 7A 65 6E 00 00 00 00 00 00 00 00 00 00 00 00 00 zen.............
0x00000190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x000001A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x000001B0 00 00 00 00 00 2C 44 6A E4 43 E5 43 00 00 80 01 .....,DjäCåC....
0x000001C0 01 00 07 FE FF FF 3F 00 00 00 74 3C 0D 03 00 00 ...þ..?...t<....
0x000001D0 C1 FF 0F FE FF FF B3 3C 0D 03 51 B7 EC 0A 00 00 Á..þ..³<..Q·ì...
0x000001E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x000001F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA ..............Uª
__________________________16_BIT_ASM_CODE
0x0000 33c0 XOR AX, AX
0x0002 8ed0 MOV SS, AX
0x0004 bc 007c MOV SP, 0x7c00
0x0007 fb STI
0x0008 50 PUSH AX
0x0009 07 POP ES
0x000A 50 PUSH AX
0x000B 1f POP DS
0x000C fc CLD
0x000D be 1b7c MOV SI, 0x7c1b
0x0010 bf 1b06 MOV DI, 0x61b
0x0013 50 PUSH AX
0x0014 57 PUSH DI
0x0015 b9 e501 MOV CX, 0x1e5
0x0018 f3 a4 REP MOVSB
0x001A cb RETF
0x001B bd be07 MOV BP, 0x7be
0x001E b1 04 MOV CL, 0x4
0x0020 386e 00 CMP [BP+0x0], CH
0x0023 7c 09 JL 0x2e
0x0025 75 13 JNZ 0x3a
0x0027 83c5 10 ADD BP, 0x10
0x002A e2 f4 LOOP 0x20
0x002C cd 18 INT 0x18
0x002E 8bf5 MOV SI, BP
0x0030 83c6 10 ADD SI, 0x10
0x0033 49 DEC CX
0x0034 74 19 JZ 0x4f
0x0036 382c CMP [SI], CH
0x0038 74 f6 JZ 0x30
0x003A a0 b507 MOV AL, [0x7b5]
0x003D b4 07 MOV AH, 0x7
0x003F 8bf0 MOV SI, AX
0x0041 ac LODSB
0x0042 3c 00 CMP AL, 0x0
0x0044 74 fc JZ 0x42
0x0046 bb 0700 MOV BX, 0x7
0x0049 b4 0e MOV AH, 0xe
0x004B cd 10 INT 0x10
0x004D eb f2 JMP 0x41
0x004F 884e 10 MOV [BP+0x10], CL
0x0052 e8 4600 CALL 0x9b
0x0055 73 2a JAE 0x81
0x0057 fe46 10 INC BYTE [BP+0x10]
0x005A 807e 04 0b CMP BYTE [BP+0x4], 0xb
0x005E 74 0b JZ 0x6b
0x0060 807e 04 0c CMP BYTE [BP+0x4], 0xc
0x0064 74 05 JZ 0x6b
0x0066 a0 b607 MOV AL, [0x7b6]
0x0069 75 d2 JNZ 0x3d
0x006B 8046 02 06 ADD BYTE [BP+0x2], 0x6
0x006F 8346 08 06 ADD WORD [BP+0x8], 0x6
0x0073 8356 0a 00 ADC WORD [BP+0xa], 0x0
0x0077 e8 2100 CALL 0x9b
0x007A 73 05 JAE 0x81
0x007C a0 b607 MOV AL, [0x7b6]
0x007F eb bc JMP 0x3d
0x0081 813e fe7d 55aa CMP WORD [0x7dfe], 0xaa55
0x0087 74 0b JZ 0x94
0x0089 807e 10 00 CMP BYTE [BP+0x10], 0x0
0x008D 74 c8 JZ 0x57
0x008F a0 b707 MOV AL, [0x7b7]
0x0092 eb a9 JMP 0x3d
0x0094 8bfc MOV DI, SP
0x0096 1e PUSH DS
0x0097 57 PUSH DI
0x0098 8bf5 MOV SI, BP
0x009A cb RETF
0x009B bf 0500 MOV DI, 0x5
0x009E 8a56 00 MOV DL, [BP+0x0]
0x00A1 b4 08 MOV AH, 0x8
0x00A3 cd 13 INT 0x13
0x00A5 72 23 JB 0xca
0x00A7 8ac1 MOV AL, CL
0x00A9 24 3f AND AL, 0x3f
0x00AB 98 CBW
0x00AC 8ade MOV BL, DH
0x00AE 8afc MOV BH, AH
0x00B0 43 INC BX
0x00B1 f7e3 MUL BX
0x00B3 8bd1 MOV DX, CX
0x00B5 86d6 XCHG DH, DL
0x00B7 b1 06 MOV CL, 0x6
0x00B9 d2ee SHR DH, CL
0x00BB 42 INC DX
0x00BC f7e2 MUL DX
0x00BE 3956 0a CMP [BP+0xa], DX
0x00C1 77 23 JA 0xe6
0x00C3 72 05 JB 0xca
0x00C5 3946 08 CMP [BP+0x8], AX
0x00C8 73 1c JAE 0xe6
0x00CA b8 0102 MOV AX, 0x201
0x00CD bb 007c MOV BX, 0x7c00
0x00D0 8b4e 02 MOV CX, [BP+0x2]
0x00D3 8b56 00 MOV DX, [BP+0x0]
0x00D6 cd 13 INT 0x13
0x00D8 73 51 JAE 0x12b
0x00DA 4f DEC DI
0x00DB 74 4e JZ 0x12b
0x00DD 32e4 XOR AH, AH
0x00DF 8a56 00 MOV DL, [BP+0x0]
0x00E2 cd 13 INT 0x13
0x00E4 eb e4 JMP 0xca
0x00E6 8a56 00 MOV DL, [BP+0x0]
0x00E9 60 PUSHA
0x00EA bb aa55 MOV BX, 0x55aa
0x00ED b4 41 MOV AH, 0x41
0x00EF cd 13 INT 0x13
0x00F1 72 36 JB 0x129
0x00F3 81fb 55aa CMP BX, 0xaa55
0x00F7 75 30 JNZ 0x129
0x00F9 f6c1 01 TEST CL, 0x1
0x00FC 74 2b JZ 0x129
0x00FE 61 POPA
0x00FF 60 PUSHA
0x0100 6a 00 PUSH 0x0
0x0102 6a 00 PUSH 0x0
0x0104 ff76 0a PUSH WORD [BP+0xa]
0x0107 ff76 08 PUSH WORD [BP+0x8]
0x010A 6a 00 PUSH 0x0
0x010C 68 007c PUSH 0x7c00
0x010F 6a 01 PUSH 0x1
0x0111 6a 10 PUSH 0x10
0x0113 b4 42 MOV AH, 0x42
0x0115 8bf4 MOV SI, SP
0x0117 cd 13 INT 0x13
0x0119 61 POPA
0x011A 61 POPA
0x011B 73 0e JAE 0x12b
0x011D 4f DEC DI
0x011E 74 0b JZ 0x12b
0x0120 32e4 XOR AH, AH
0x0122 8a56 00 MOV DL, [BP+0x0]
0x0125 cd 13 INT 0x13
0x0127 eb d6 JMP 0xff
0x0129 61 POPA
0x012A f9 STC
0x012B c3 RET
0x012C 4e DEC SI
0x012D 65 DB 0x65
0x012D 65 70 6c JO 0x19c
0x0130 61 POPA
0x0131 74 6e JZ 0x1a1
0x0133 a0 2074 MOV AL, [0x7420]
0x0136 61 POPA
0x0137 6275 6c BOUND SI, [DI+0x6c]
0x013A 6b61 20 6f IMUL SP, [BX+DI+0x20], 0x6f
0x013E 64 DB 0x64
0x013F 64 a1 6c85 MOV AX, FS:[0x856c]
0x0143 0043 68 ADD [BP+DI+0x68], AL
0x0146 79 62 JNS 0x1aa
0x0148 61 POPA
0x0149 2070 fd AND [BX+SI-0x3], DH
0x014C 6920 6e61 IMUL SP, [BX+SI], 0x616e
0x0150 9f LAHF
0x0151 a1 74a0 MOV AX, [0xa074]
0x0154 6e OUTSB
0x0155 a1 206f MOV AX, [0x6f20]
0x0158 70 65 JO 0x1bf
0x015A 72 61 JB 0x1bd
0x015C 9f LAHF
0x015D 6e OUTSB
0x015E a1 686f MOV AX, [0x6f68]
0x0161 2073 79 AND [BP+DI+0x79], DH
0x0164 73 74 JAE 0x1da
0x0166 826d 75 00 SUB BYTE [DI+0x75], 0x0
0x016A 4f DEC DI
0x016B 70 65 JO 0x1d2
0x016D 72 61 JB 0x1d0
0x016F 9f LAHF
0x0170 6e OUTSB
0x0171 a1 2073 MOV AX, [0x7320]
0x0174 79 73 JNS 0x1e9
0x0176 74 82 JZ 0xfa
0x0178 6d INSW
0x0179 206e 65 AND [BP+0x65], CH
0x017C 6e OUTSB
0x017D 61 POPA
0x017E 6c INSB
0x017F 65 DB 0x65
0x017F 65 7a 65 JP 0x1e7
0x0182 6e OUTSB
0x0183 0000 ADD [BX+SI], AL
0x0185 0000 ADD [BX+SI], AL
0x0187 0000 ADD [BX+SI], AL
0x0189 0000 ADD [BX+SI], AL
0x018B 0000 ADD [BX+SI], AL
0x018D 0000 ADD [BX+SI], AL
0x018F 0000 ADD [BX+SI], AL
0x0191 0000 ADD [BX+SI], AL
0x0193 0000 ADD [BX+SI], AL
0x0195 0000 ADD [BX+SI], AL
0x0197 0000 ADD [BX+SI], AL
0x0199 0000 ADD [BX+SI], AL
0x019B 0000 ADD [BX+SI], AL
0x019D 0000 ADD [BX+SI], AL
0x019F 0000 ADD [BX+SI], AL
0x01A1 0000 ADD [BX+SI], AL
0x01A3 0000 ADD [BX+SI], AL
0x01A5 0000 ADD [BX+SI], AL
0x01A7 0000 ADD [BX+SI], AL
0x01A9 0000 ADD [BX+SI], AL
0x01AB 0000 ADD [BX+SI], AL
0x01AD 0000 ADD [BX+SI], AL
0x01AF 0000 ADD [BX+SI], AL
0x01B1 0000 ADD [BX+SI], AL
0x01B3 0000 ADD [BX+SI], AL
0x01B5 2c 44 SUB AL, 0x44
0x01B7 6a e4 PUSH -0x1c
0x01B9 43 INC BX
0x01BA e5 43 IN AX, 0x43
0x01BC 0000 ADD [BX+SI], AL
0x01BE 8001 01 ADD BYTE [BX+DI], 0x1
0x01C1 0007 ADD [BX], AL
0x01C3 fe DB 0xfe
0x01C4 ff DB 0xff
0x01C5 ff DB 0xff
0x01C6 3f AAS
0x01C7 0000 ADD [BX+SI], AL
0x01C9 0074 3c ADD [SI+0x3c], DH
0x01CC 0d 0300 OR AX, 0x3
0x01CF 00c1 ADD CL, AL
0x01D1 ff0f DEC WORD [BX]
0x01D3 fe DB 0xfe
0x01D4 ff DB 0xff
0x01D5 ffb3 3c0d PUSH WORD [BP+DI+0xd3c]
0x01D9 0351 b7 ADD DX, [BX+DI-0x49]
0x01DC ec IN AL, DX
0x01DD 0a00 OR AL, [BX+SI]
0x01DF 0000 ADD [BX+SI], AL
0x01E1 0000 ADD [BX+SI], AL
0x01E3 0000 ADD [BX+SI], AL
0x01E5 0000 ADD [BX+SI], AL
0x01E7 0000 ADD [BX+SI], AL
0x01E9 0000 ADD [BX+SI], AL
0x01EB 0000 ADD [BX+SI], AL
0x01ED 0000 ADD [BX+SI], AL
0x01EF 0000 ADD [BX+SI], AL
0x01F1 0000 ADD [BX+SI], AL
0x01F3 0000 ADD [BX+SI], AL
0x01F5 0000 ADD [BX+SI], AL
0x01F7 0000 ADD [BX+SI], AL
0x01F9 0000 ADD [BX+SI], AL
0x01FB 0000 ADD [BX+SI], AL
0x01FD 0055 aa ADD [DI-0x56], DL
_______MBR \Device\Harddisk1\DR3
0x00000000 33 C0 8E D0 BC 00 7C FB 50 07 50 1F FC BE 1B 7C 3À.м.|ûP.P.ü¾.|
0x00000010 BF 1B 06 50 57 B9 E5 01 F3 A4 CB BD BE 07 B1 04 ¿..PW¹å.ó¤Ë½¾.±.
0x00000020 38 6E 00 7C 09 75 13 83 C5 10 E2 F4 CD 18 8B F5 8n.|.u..Å.âôÍ..õ
0x00000030 83 C6 10 49 74 19 38 2C 74 F6 A0 B5 07 B4 07 8B .Æ.It.8,tö.µ.´..
0x00000040 F0 AC 3C 00 74 FC BB 07 00 B4 0E CD 10 EB F2 88 ð¬<.tü»..´.Í.ëò.
0x00000050 4E 10 E8 46 00 73 2A FE 46 10 80 7E 04 0B 74 0B N.èF.s*þF..~..t.
0x00000060 80 7E 04 0C 74 05 A0 B6 07 75 D2 80 46 02 06 83 .~..t..¶.uÒ.F...
0x00000070 46 08 06 83 56 0A 00 E8 21 00 73 05 A0 B6 07 EB F...V..è!.s..¶.ë
0x00000080 BC 81 3E FE 7D 55 AA 74 0B 80 7E 10 00 74 C8 A0 ¼.>þ}Uªt..~..tÈ.
0x00000090 B7 07 EB A9 8B FC 1E 57 8B F5 CB BF 05 00 8A 56 ·.ë©.ü.W.õË¿...V
0x000000A0 00 B4 08 CD 13 72 23 8A C1 24 3F 98 8A DE 8A FC .´.Í.r#.Á$?..Þ.ü
0x000000B0 43 F7 E3 8B D1 86 D6 B1 06 D2 EE 42 F7 E2 39 56 C÷ã.Ñ.Ö±.ÒîB÷â9V
0x000000C0 0A 77 23 72 05 39 46 08 73 1C B8 01 02 BB 00 7C .w#r.9F.s.¸..».|
0x000000D0 8B 4E 02 8B 56 00 CD 13 73 51 4F 74 4E 32 E4 8A .N..V.Í.sQOtN2ä.
0x000000E0 56 00 CD 13 EB E4 8A 56 00 60 BB AA 55 B4 41 CD V.Í.ëä.V.`»ªU´AÍ
0x000000F0 13 72 36 81 FB 55 AA 75 30 F6 C1 01 74 2B 61 60 .r6.ûUªu0öÁ.t+a`
0x00000100 6A 00 6A 00 FF 76 0A FF 76 08 6A 00 68 00 7C 6A j.j..v..v.j.h.|j
0x00000110 01 6A 10 B4 42 8B F4 CD 13 61 61 73 0E 4F 74 0B .j.´B.ôÍ.aas.Ot.
0x00000120 32 E4 8A 56 00 CD 13 EB D6 61 F9 C3 49 6E 76 61 2ä.V.Í.ëÖaùÃInva
0x00000130 6C 69 64 20 70 61 72 74 69 74 69 6F 6E 20 74 61 lid partition ta
0x00000140 62 6C 65 00 45 72 72 6F 72 20 6C 6F 61 64 69 6E ble.Error loadin
0x00000150 67 20 6F 70 65 72 61 74 69 6E 67 20 73 79 73 74 g operating syst
0x00000160 65 6D 00 4D 69 73 73 69 6E 67 20 6F 70 65 72 61 em.Missing opera
0x00000170 74 69 6E 67 20 73 79 73 74 65 6D 00 00 00 00 00 ting system.....
0x00000180 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x00000190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x000001A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x000001B0 00 00 00 00 00 2C 44 63 18 2E 07 C3 00 00 80 01 .....,Dc...Ã....
0x000001C0 01 00 0B 80 E0 BC 20 00 00 00 E0 BF 3B 00 00 00 ....༠...à¿;...
0x000001D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x000001E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x000001F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA ..............Uª
__________________________16_BIT_ASM_CODE
0x0000 33c0 XOR AX, AX
0x0002 8ed0 MOV SS, AX
0x0004 bc 007c MOV SP, 0x7c00
0x0007 fb STI
0x0008 50 PUSH AX
0x0009 07 POP ES
0x000A 50 PUSH AX
0x000B 1f POP DS
0x000C fc CLD
0x000D be 1b7c MOV SI, 0x7c1b
0x0010 bf 1b06 MOV DI, 0x61b
0x0013 50 PUSH AX
0x0014 57 PUSH DI
0x0015 b9 e501 MOV CX, 0x1e5
0x0018 f3 a4 REP MOVSB
0x001A cb RETF
0x001B bd be07 MOV BP, 0x7be
0x001E b1 04 MOV CL, 0x4
0x0020 386e 00 CMP [BP+0x0], CH
0x0023 7c 09 JL 0x2e
0x0025 75 13 JNZ 0x3a
0x0027 83c5 10 ADD BP, 0x10
0x002A e2 f4 LOOP 0x20
0x002C cd 18 INT 0x18
0x002E 8bf5 MOV SI, BP
0x0030 83c6 10 ADD SI, 0x10
0x0033 49 DEC CX
0x0034 74 19 JZ 0x4f
0x0036 382c CMP [SI], CH
0x0038 74 f6 JZ 0x30
0x003A a0 b507 MOV AL, [0x7b5]
0x003D b4 07 MOV AH, 0x7
0x003F 8bf0 MOV SI, AX
0x0041 ac LODSB
0x0042 3c 00 CMP AL, 0x0
0x0044 74 fc JZ 0x42
0x0046 bb 0700 MOV BX, 0x7
0x0049 b4 0e MOV AH, 0xe
0x004B cd 10 INT 0x10
0x004D eb f2 JMP 0x41
0x004F 884e 10 MOV [BP+0x10], CL
0x0052 e8 4600 CALL 0x9b
0x0055 73 2a JAE 0x81
0x0057 fe46 10 INC BYTE [BP+0x10]
0x005A 807e 04 0b CMP BYTE [BP+0x4], 0xb
0x005E 74 0b JZ 0x6b
0x0060 807e 04 0c CMP BYTE [BP+0x4], 0xc
0x0064 74 05 JZ 0x6b
0x0066 a0 b607 MOV AL, [0x7b6]
0x0069 75 d2 JNZ 0x3d
0x006B 8046 02 06 ADD BYTE [BP+0x2], 0x6
0x006F 8346 08 06 ADD WORD [BP+0x8], 0x6
0x0073 8356 0a 00 ADC WORD [BP+0xa], 0x0
0x0077 e8 2100 CALL 0x9b
0x007A 73 05 JAE 0x81
0x007C a0 b607 MOV AL, [0x7b6]
0x007F eb bc JMP 0x3d
0x0081 813e fe7d 55aa CMP WORD [0x7dfe], 0xaa55
0x0087 74 0b JZ 0x94
0x0089 807e 10 00 CMP BYTE [BP+0x10], 0x0
0x008D 74 c8 JZ 0x57
0x008F a0 b707 MOV AL, [0x7b7]
0x0092 eb a9 JMP 0x3d
0x0094 8bfc MOV DI, SP
0x0096 1e PUSH DS
0x0097 57 PUSH DI
0x0098 8bf5 MOV SI, BP
0x009A cb RETF
0x009B bf 0500 MOV DI, 0x5
0x009E 8a56 00 MOV DL, [BP+0x0]
0x00A1 b4 08 MOV AH, 0x8
0x00A3 cd 13 INT 0x13
0x00A5 72 23 JB 0xca
0x00A7 8ac1 MOV AL, CL
0x00A9 24 3f AND AL, 0x3f
0x00AB 98 CBW
0x00AC 8ade MOV BL, DH
0x00AE 8afc MOV BH, AH
0x00B0 43 INC BX
0x00B1 f7e3 MUL BX
0x00B3 8bd1 MOV DX, CX
0x00B5 86d6 XCHG DH, DL
0x00B7 b1 06 MOV CL, 0x6
0x00B9 d2ee SHR DH, CL
0x00BB 42 INC DX
0x00BC f7e2 MUL DX
0x00BE 3956 0a CMP [BP+0xa], DX
0x00C1 77 23 JA 0xe6
0x00C3 72 05 JB 0xca
0x00C5 3946 08 CMP [BP+0x8], AX
0x00C8 73 1c JAE 0xe6
0x00CA b8 0102 MOV AX, 0x201
0x00CD bb 007c MOV BX, 0x7c00
0x00D0 8b4e 02 MOV CX, [BP+0x2]
0x00D3 8b56 00 MOV DX, [BP+0x0]
0x00D6 cd 13 INT 0x13
0x00D8 73 51 JAE 0x12b
0x00DA 4f DEC DI
0x00DB 74 4e JZ 0x12b
0x00DD 32e4 XOR AH, AH
0x00DF 8a56 00 MOV DL, [BP+0x0]
0x00E2 cd 13 INT 0x13
0x00E4 eb e4 JMP 0xca
0x00E6 8a56 00 MOV DL, [BP+0x0]
0x00E9 60 PUSHA
0x00EA bb aa55 MOV BX, 0x55aa
0x00ED b4 41 MOV AH, 0x41
0x00EF cd 13 INT 0x13
0x00F1 72 36 JB 0x129
0x00F3 81fb 55aa CMP BX, 0xaa55
0x00F7 75 30 JNZ 0x129
0x00F9 f6c1 01 TEST CL, 0x1
0x00FC 74 2b JZ 0x129
0x00FE 61 POPA
0x00FF 60 PUSHA
0x0100 6a 00 PUSH 0x0
0x0102 6a 00 PUSH 0x0
0x0104 ff76 0a PUSH WORD [BP+0xa]
0x0107 ff76 08 PUSH WORD [BP+0x8]
0x010A 6a 00 PUSH 0x0
0x010C 68 007c PUSH 0x7c00
0x010F 6a 01 PUSH 0x1
0x0111 6a 10 PUSH 0x10
0x0113 b4 42 MOV AH, 0x42
0x0115 8bf4 MOV SI, SP
0x0117 cd 13 INT 0x13
0x0119 61 POPA
0x011A 61 POPA
0x011B 73 0e JAE 0x12b
0x011D 4f DEC DI
0x011E 74 0b JZ 0x12b
0x0120 32e4 XOR AH, AH
0x0122 8a56 00 MOV DL, [BP+0x0]
0x0125 cd 13 INT 0x13
0x0127 eb d6 JMP 0xff
0x0129 61 POPA
0x012A f9 STC
0x012B c3 RET
0x012C 49 DEC CX
0x012D 6e OUTSB
0x012E 76 61 JBE 0x191
0x0130 6c INSB
0x0131 6964 20 7061 IMUL SP, [SI+0x20], 0x6170
0x0136 72 74 JB 0x1ac
0x0138 6974 69 6f6e IMUL SI, [SI+0x69], 0x6e6f
0x013D 2074 61 AND [SI+0x61], DH
0x0140 626c 65 BOUND BP, [SI+0x65]
0x0143 0045 72 ADD [DI+0x72], AL
0x0146 72 6f JB 0x1b7
0x0148 72 20 JB 0x16a
0x014A 6c INSB
0x014B 6f OUTSW
0x014C 61 POPA
0x014D 64 696e 67 206f IMUL BP, FS:[BP+0x67], 0x6f20
0x0153 70 65 JO 0x1ba
0x0155 72 61 JB 0x1b8
0x0157 74 69 JZ 0x1c2
0x0159 6e OUTSB
0x015A 67 2073 79 AND [EBX+0x79], DH
0x015E 73 74 JAE 0x1d4
0x0160 65 6d INS WORD GS:[DI], DX
0x0162 004d 69 ADD [DI+0x69], CL
0x0165 73 73 JAE 0x1da
0x0167 696e 67 206f IMUL BP, [BP+0x67], 0x6f20
0x016C 70 65 JO 0x1d3
0x016E 72 61 JB 0x1d1
0x0170 74 69 JZ 0x1db
0x0172 6e OUTSB
0x0173 67 2073 79 AND [EBX+0x79], DH
0x0177 73 74 JAE 0x1ed
0x0179 65 6d INS WORD GS:[DI], DX
0x017B 0000 ADD [BX+SI], AL
0x017D 0000 ADD [BX+SI], AL
0x017F 0000 ADD [BX+SI], AL
0x0181 0000 ADD [BX+SI], AL
0x0183 0000 ADD [BX+SI], AL
0x0185 0000 ADD [BX+SI], AL
0x0187 0000 ADD [BX+SI], AL
0x0189 0000 ADD [BX+SI], AL
0x018B 0000 ADD [BX+SI], AL
0x018D 0000 ADD [BX+SI], AL
0x018F 0000 ADD [BX+SI], AL
0x0191 0000 ADD [BX+SI], AL
0x0193 0000 ADD [BX+SI], AL
0x0195 0000 ADD [BX+SI], AL
0x0197 0000 ADD [BX+SI], AL
0x0199 0000 ADD [BX+SI], AL
0x019B 0000 ADD [BX+SI], AL
0x019D 0000 ADD [BX+SI], AL
0x019F 0000 ADD [BX+SI], AL
0x01A1 0000 ADD [BX+SI], AL
0x01A3 0000 ADD [BX+SI], AL
0x01A5 0000 ADD [BX+SI], AL
0x01A7 0000 ADD [BX+SI], AL
0x01A9 0000 ADD [BX+SI], AL
0x01AB 0000 ADD [BX+SI], AL
0x01AD 0000 ADD [BX+SI], AL
0x01AF 0000 ADD [BX+SI], AL
0x01B1 0000 ADD [BX+SI], AL
0x01B3 0000 ADD [BX+SI], AL
0x01B5 2c 44 SUB AL, 0x44
0x01B7 6318 ARPL [BX+SI], BX
0x01B9 2e DB 0x2e
0x01B9 2e 07 POP ES
0x01BB c3 RET
0x01BC 0000 ADD [BX+SI], AL
0x01BE 8001 01 ADD BYTE [BX+DI], 0x1
0x01C1 000b ADD [BP+DI], CL
0x01C3 80e0 bc AND AL, 0xbc
0x01C6 2000 AND [BX+SI], AL
0x01C8 0000 ADD [BX+SI], AL
0x01CA e0 bf LOOPNZ 0x18b
0x01CC 3b00 CMP AX, [BX+SI]
0x01CE 0000 ADD [BX+SI], AL
0x01D0 0000 ADD [BX+SI], AL
0x01D2 0000 ADD [BX+SI], AL
0x01D4 0000 ADD [BX+SI], AL
0x01D6 0000 ADD [BX+SI], AL
0x01D8 0000 ADD [BX+SI], AL
0x01DA 0000 ADD [BX+SI], AL
0x01DC 0000 ADD [BX+SI], AL
0x01DE 0000 ADD [BX+SI], AL
0x01E0 0000 ADD [BX+SI], AL
0x01E2 0000 ADD [BX+SI], AL
0x01E4 0000 ADD [BX+SI], AL
0x01E6 0000 ADD [BX+SI], AL
0x01E8 0000 ADD [BX+SI], AL
0x01EA 0000 ADD [BX+SI], AL
0x01EC 0000 ADD [BX+SI], AL
0x01EE 0000 ADD [BX+SI], AL
0x01F0 0000 ADD [BX+SI], AL
0x01F2 0000 ADD [BX+SI], AL
0x01F4 0000 ADD [BX+SI], AL
0x01F6 0000 ADD [BX+SI], AL
0x01F8 0000 ADD [BX+SI], AL
0x01FA 0000 ADD [BX+SI], AL
0x01FC 0000 ADD [BX+SI], AL
0x01FE 55 PUSH BP
0x01FF aa STOSB
Re: Problém s napadeným PC - generic27.AkPW- log z RSIT přil
Kód: Vybrat vše
MBRScan v1.1.1
OS : Windows XP Home Service Pack 3 (32 bit)
PROCESSOR : x86 Family 15 Model 44 Stepping 2, AuthenticAMD
BOOT : Normal Boot
DATE : 2012/08/12 (ISO 8601) at 21:20:53
________________________________________________________________________________
DISK : Device\Harddisk0\DR0 __SAMSUNG SP1203N (TL100-30)
BUS_TYPE : (0x03) P-ATA
USE_PIO : YES
MAX_TRANSFER : 128 Kb
ALIGNMENT_MASK : word aligned
________________________________________________________________________________
DISK : Device\Harddisk1\DR3 __S31B0906 USB DISK (1100)
BUS_TYPE : (0x07) USB
USE_PIO : NO
MAX_TRANSFER : 64 Kb
ALIGNMENT_MASK : byte aligned
________________________________________________________________________________
Device\Harddisk0\DR0 111.8 Go [Fixed] ==> XP MBR Code
MBR_MD5 : 1BB15324C0096C2F2D153733503B7D58
MBR_SHA1 : 49425A091FFAD6994D4CACA6CEAAD21FA58C450A
Device\Harddisk0\Partition1 24.41 Go 0x07 NTFS / HPFS __ BOOTABLE __
Device\Harddisk0\Partition2 87.40 Go 0x07 NTFS / HPFS
________________________________________________________________________________
Device\Harddisk1\DR3 1.87 Go [Removable] ==> XP MBR Code
MBR_MD5 : 1A7A0C164C5B91B2D211A9A4EB07DE1F
MBR_SHA1 : 69245C6CECA93550846177BB5BC2F2BAD35DCF70
Device\Harddisk1\Partition1 1.87 Go __ BOOTABLE __
________________________________________________________________________________
############################### Additional scan ################################
SystemStartOptions : NOEXECUTE=OPTIN FASTDETECT
________________________________________________________________________________
_______MBR \Device\Harddisk0\DR0
0x00000000 33 C0 8E D0 BC 00 7C FB 50 07 50 1F FC BE 1B 7C 3À.м.|ûP.P.ü¾.|
0x00000010 BF 1B 06 50 57 B9 E5 01 F3 A4 CB BD BE 07 B1 04 ¿..PW¹å.ó¤Ë½¾.±.
0x00000020 38 6E 00 7C 09 75 13 83 C5 10 E2 F4 CD 18 8B F5 8n.|.u..Å.âôÍ..õ
0x00000030 83 C6 10 49 74 19 38 2C 74 F6 A0 B5 07 B4 07 8B .Æ.It.8,tö.µ.´..
0x00000040 F0 AC 3C 00 74 FC BB 07 00 B4 0E CD 10 EB F2 88 ð¬<.tü»..´.Í.ëò.
0x00000050 4E 10 E8 46 00 73 2A FE 46 10 80 7E 04 0B 74 0B N.èF.s*þF..~..t.
0x00000060 80 7E 04 0C 74 05 A0 B6 07 75 D2 80 46 02 06 83 .~..t..¶.uÒ.F...
0x00000070 46 08 06 83 56 0A 00 E8 21 00 73 05 A0 B6 07 EB F...V..è!.s..¶.ë
0x00000080 BC 81 3E FE 7D 55 AA 74 0B 80 7E 10 00 74 C8 A0 ¼.>þ}Uªt..~..tÈ.
0x00000090 B7 07 EB A9 8B FC 1E 57 8B F5 CB BF 05 00 8A 56 ·.ë©.ü.W.õË¿...V
0x000000A0 00 B4 08 CD 13 72 23 8A C1 24 3F 98 8A DE 8A FC .´.Í.r#.Á$?..Þ.ü
0x000000B0 43 F7 E3 8B D1 86 D6 B1 06 D2 EE 42 F7 E2 39 56 C÷ã.Ñ.Ö±.ÒîB÷â9V
0x000000C0 0A 77 23 72 05 39 46 08 73 1C B8 01 02 BB 00 7C .w#r.9F.s.¸..».|
0x000000D0 8B 4E 02 8B 56 00 CD 13 73 51 4F 74 4E 32 E4 8A .N..V.Í.sQOtN2ä.
0x000000E0 56 00 CD 13 EB E4 8A 56 00 60 BB AA 55 B4 41 CD V.Í.ëä.V.`»ªU´AÍ
0x000000F0 13 72 36 81 FB 55 AA 75 30 F6 C1 01 74 2B 61 60 .r6.ûUªu0öÁ.t+a`
0x00000100 6A 00 6A 00 FF 76 0A FF 76 08 6A 00 68 00 7C 6A j.j..v..v.j.h.|j
0x00000110 01 6A 10 B4 42 8B F4 CD 13 61 61 73 0E 4F 74 0B .j.´B.ôÍ.aas.Ot.
0x00000120 32 E4 8A 56 00 CD 13 EB D6 61 F9 C3 4E 65 70 6C 2ä.V.Í.ëÖaùÃNepl
0x00000130 61 74 6E A0 20 74 61 62 75 6C 6B 61 20 6F 64 64 atn. tabulka odd
0x00000140 A1 6C 85 00 43 68 79 62 61 20 70 FD 69 20 6E 61 ¡l..Chyba pýi na
0x00000150 9F A1 74 A0 6E A1 20 6F 70 65 72 61 9F 6E A1 68 .¡t.n¡ opera.n¡h
0x00000160 6F 20 73 79 73 74 82 6D 75 00 4F 70 65 72 61 9F o syst.mu.Opera.
0x00000170 6E A1 20 73 79 73 74 82 6D 20 6E 65 6E 61 6C 65 n¡ syst.m nenale
0x00000180 7A 65 6E 00 00 00 00 00 00 00 00 00 00 00 00 00 zen.............
0x00000190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x000001A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x000001B0 00 00 00 00 00 2C 44 6A E4 43 E5 43 00 00 80 01 .....,DjäCåC....
0x000001C0 01 00 07 FE FF FF 3F 00 00 00 74 3C 0D 03 00 00 ...þ..?...t<....
0x000001D0 C1 FF 0F FE FF FF B3 3C 0D 03 51 B7 EC 0A 00 00 Á..þ..³<..Q·ì...
0x000001E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x000001F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA ..............Uª
__________________________16_BIT_ASM_CODE
0x0000 33c0 XOR AX, AX
0x0002 8ed0 MOV SS, AX
0x0004 bc 007c MOV SP, 0x7c00
0x0007 fb STI
0x0008 50 PUSH AX
0x0009 07 POP ES
0x000A 50 PUSH AX
0x000B 1f POP DS
0x000C fc CLD
0x000D be 1b7c MOV SI, 0x7c1b
0x0010 bf 1b06 MOV DI, 0x61b
0x0013 50 PUSH AX
0x0014 57 PUSH DI
0x0015 b9 e501 MOV CX, 0x1e5
0x0018 f3 a4 REP MOVSB
0x001A cb RETF
0x001B bd be07 MOV BP, 0x7be
0x001E b1 04 MOV CL, 0x4
0x0020 386e 00 CMP [BP+0x0], CH
0x0023 7c 09 JL 0x2e
0x0025 75 13 JNZ 0x3a
0x0027 83c5 10 ADD BP, 0x10
0x002A e2 f4 LOOP 0x20
0x002C cd 18 INT 0x18
0x002E 8bf5 MOV SI, BP
0x0030 83c6 10 ADD SI, 0x10
0x0033 49 DEC CX
0x0034 74 19 JZ 0x4f
0x0036 382c CMP [SI], CH
0x0038 74 f6 JZ 0x30
0x003A a0 b507 MOV AL, [0x7b5]
0x003D b4 07 MOV AH, 0x7
0x003F 8bf0 MOV SI, AX
0x0041 ac LODSB
0x0042 3c 00 CMP AL, 0x0
0x0044 74 fc JZ 0x42
0x0046 bb 0700 MOV BX, 0x7
0x0049 b4 0e MOV AH, 0xe
0x004B cd 10 INT 0x10
0x004D eb f2 JMP 0x41
0x004F 884e 10 MOV [BP+0x10], CL
0x0052 e8 4600 CALL 0x9b
0x0055 73 2a JAE 0x81
0x0057 fe46 10 INC BYTE [BP+0x10]
0x005A 807e 04 0b CMP BYTE [BP+0x4], 0xb
0x005E 74 0b JZ 0x6b
0x0060 807e 04 0c CMP BYTE [BP+0x4], 0xc
0x0064 74 05 JZ 0x6b
0x0066 a0 b607 MOV AL, [0x7b6]
0x0069 75 d2 JNZ 0x3d
0x006B 8046 02 06 ADD BYTE [BP+0x2], 0x6
0x006F 8346 08 06 ADD WORD [BP+0x8], 0x6
0x0073 8356 0a 00 ADC WORD [BP+0xa], 0x0
0x0077 e8 2100 CALL 0x9b
0x007A 73 05 JAE 0x81
0x007C a0 b607 MOV AL, [0x7b6]
0x007F eb bc JMP 0x3d
0x0081 813e fe7d 55aa CMP WORD [0x7dfe], 0xaa55
0x0087 74 0b JZ 0x94
0x0089 807e 10 00 CMP BYTE [BP+0x10], 0x0
0x008D 74 c8 JZ 0x57
0x008F a0 b707 MOV AL, [0x7b7]
0x0092 eb a9 JMP 0x3d
0x0094 8bfc MOV DI, SP
0x0096 1e PUSH DS
0x0097 57 PUSH DI
0x0098 8bf5 MOV SI, BP
0x009A cb RETF
0x009B bf 0500 MOV DI, 0x5
0x009E 8a56 00 MOV DL, [BP+0x0]
0x00A1 b4 08 MOV AH, 0x8
0x00A3 cd 13 INT 0x13
0x00A5 72 23 JB 0xca
0x00A7 8ac1 MOV AL, CL
0x00A9 24 3f AND AL, 0x3f
0x00AB 98 CBW
0x00AC 8ade MOV BL, DH
0x00AE 8afc MOV BH, AH
0x00B0 43 INC BX
0x00B1 f7e3 MUL BX
0x00B3 8bd1 MOV DX, CX
0x00B5 86d6 XCHG DH, DL
0x00B7 b1 06 MOV CL, 0x6
0x00B9 d2ee SHR DH, CL
0x00BB 42 INC DX
0x00BC f7e2 MUL DX
0x00BE 3956 0a CMP [BP+0xa], DX
0x00C1 77 23 JA 0xe6
0x00C3 72 05 JB 0xca
0x00C5 3946 08 CMP [BP+0x8], AX
0x00C8 73 1c JAE 0xe6
0x00CA b8 0102 MOV AX, 0x201
0x00CD bb 007c MOV BX, 0x7c00
0x00D0 8b4e 02 MOV CX, [BP+0x2]
0x00D3 8b56 00 MOV DX, [BP+0x0]
0x00D6 cd 13 INT 0x13
0x00D8 73 51 JAE 0x12b
0x00DA 4f DEC DI
0x00DB 74 4e JZ 0x12b
0x00DD 32e4 XOR AH, AH
0x00DF 8a56 00 MOV DL, [BP+0x0]
0x00E2 cd 13 INT 0x13
0x00E4 eb e4 JMP 0xca
0x00E6 8a56 00 MOV DL, [BP+0x0]
0x00E9 60 PUSHA
0x00EA bb aa55 MOV BX, 0x55aa
0x00ED b4 41 MOV AH, 0x41
0x00EF cd 13 INT 0x13
0x00F1 72 36 JB 0x129
0x00F3 81fb 55aa CMP BX, 0xaa55
0x00F7 75 30 JNZ 0x129
0x00F9 f6c1 01 TEST CL, 0x1
0x00FC 74 2b JZ 0x129
0x00FE 61 POPA
0x00FF 60 PUSHA
0x0100 6a 00 PUSH 0x0
0x0102 6a 00 PUSH 0x0
0x0104 ff76 0a PUSH WORD [BP+0xa]
0x0107 ff76 08 PUSH WORD [BP+0x8]
0x010A 6a 00 PUSH 0x0
0x010C 68 007c PUSH 0x7c00
0x010F 6a 01 PUSH 0x1
0x0111 6a 10 PUSH 0x10
0x0113 b4 42 MOV AH, 0x42
0x0115 8bf4 MOV SI, SP
0x0117 cd 13 INT 0x13
0x0119 61 POPA
0x011A 61 POPA
0x011B 73 0e JAE 0x12b
0x011D 4f DEC DI
0x011E 74 0b JZ 0x12b
0x0120 32e4 XOR AH, AH
0x0122 8a56 00 MOV DL, [BP+0x0]
0x0125 cd 13 INT 0x13
0x0127 eb d6 JMP 0xff
0x0129 61 POPA
0x012A f9 STC
0x012B c3 RET
0x012C 4e DEC SI
0x012D 65 DB 0x65
0x012D 65 70 6c JO 0x19c
0x0130 61 POPA
0x0131 74 6e JZ 0x1a1
0x0133 a0 2074 MOV AL, [0x7420]
0x0136 61 POPA
0x0137 6275 6c BOUND SI, [DI+0x6c]
0x013A 6b61 20 6f IMUL SP, [BX+DI+0x20], 0x6f
0x013E 64 DB 0x64
0x013F 64 a1 6c85 MOV AX, FS:[0x856c]
0x0143 0043 68 ADD [BP+DI+0x68], AL
0x0146 79 62 JNS 0x1aa
0x0148 61 POPA
0x0149 2070 fd AND [BX+SI-0x3], DH
0x014C 6920 6e61 IMUL SP, [BX+SI], 0x616e
0x0150 9f LAHF
0x0151 a1 74a0 MOV AX, [0xa074]
0x0154 6e OUTSB
0x0155 a1 206f MOV AX, [0x6f20]
0x0158 70 65 JO 0x1bf
0x015A 72 61 JB 0x1bd
0x015C 9f LAHF
0x015D 6e OUTSB
0x015E a1 686f MOV AX, [0x6f68]
0x0161 2073 79 AND [BP+DI+0x79], DH
0x0164 73 74 JAE 0x1da
0x0166 826d 75 00 SUB BYTE [DI+0x75], 0x0
0x016A 4f DEC DI
0x016B 70 65 JO 0x1d2
0x016D 72 61 JB 0x1d0
0x016F 9f LAHF
0x0170 6e OUTSB
0x0171 a1 2073 MOV AX, [0x7320]
0x0174 79 73 JNS 0x1e9
0x0176 74 82 JZ 0xfa
0x0178 6d INSW
0x0179 206e 65 AND [BP+0x65], CH
0x017C 6e OUTSB
0x017D 61 POPA
0x017E 6c INSB
0x017F 65 DB 0x65
0x017F 65 7a 65 JP 0x1e7
0x0182 6e OUTSB
0x0183 0000 ADD [BX+SI], AL
0x0185 0000 ADD [BX+SI], AL
0x0187 0000 ADD [BX+SI], AL
0x0189 0000 ADD [BX+SI], AL
0x018B 0000 ADD [BX+SI], AL
0x018D 0000 ADD [BX+SI], AL
0x018F 0000 ADD [BX+SI], AL
0x0191 0000 ADD [BX+SI], AL
0x0193 0000 ADD [BX+SI], AL
0x0195 0000 ADD [BX+SI], AL
0x0197 0000 ADD [BX+SI], AL
0x0199 0000 ADD [BX+SI], AL
0x019B 0000 ADD [BX+SI], AL
0x019D 0000 ADD [BX+SI], AL
0x019F 0000 ADD [BX+SI], AL
0x01A1 0000 ADD [BX+SI], AL
0x01A3 0000 ADD [BX+SI], AL
0x01A5 0000 ADD [BX+SI], AL
0x01A7 0000 ADD [BX+SI], AL
0x01A9 0000 ADD [BX+SI], AL
0x01AB 0000 ADD [BX+SI], AL
0x01AD 0000 ADD [BX+SI], AL
0x01AF 0000 ADD [BX+SI], AL
0x01B1 0000 ADD [BX+SI], AL
0x01B3 0000 ADD [BX+SI], AL
0x01B5 2c 44 SUB AL, 0x44
0x01B7 6a e4 PUSH -0x1c
0x01B9 43 INC BX
0x01BA e5 43 IN AX, 0x43
0x01BC 0000 ADD [BX+SI], AL
0x01BE 8001 01 ADD BYTE [BX+DI], 0x1
0x01C1 0007 ADD [BX], AL
0x01C3 fe DB 0xfe
0x01C4 ff DB 0xff
0x01C5 ff DB 0xff
0x01C6 3f AAS
0x01C7 0000 ADD [BX+SI], AL
0x01C9 0074 3c ADD [SI+0x3c], DH
0x01CC 0d 0300 OR AX, 0x3
0x01CF 00c1 ADD CL, AL
0x01D1 ff0f DEC WORD [BX]
0x01D3 fe DB 0xfe
0x01D4 ff DB 0xff
0x01D5 ffb3 3c0d PUSH WORD [BP+DI+0xd3c]
0x01D9 0351 b7 ADD DX, [BX+DI-0x49]
0x01DC ec IN AL, DX
0x01DD 0a00 OR AL, [BX+SI]
0x01DF 0000 ADD [BX+SI], AL
0x01E1 0000 ADD [BX+SI], AL
0x01E3 0000 ADD [BX+SI], AL
0x01E5 0000 ADD [BX+SI], AL
0x01E7 0000 ADD [BX+SI], AL
0x01E9 0000 ADD [BX+SI], AL
0x01EB 0000 ADD [BX+SI], AL
0x01ED 0000 ADD [BX+SI], AL
0x01EF 0000 ADD [BX+SI], AL
0x01F1 0000 ADD [BX+SI], AL
0x01F3 0000 ADD [BX+SI], AL
0x01F5 0000 ADD [BX+SI], AL
0x01F7 0000 ADD [BX+SI], AL
0x01F9 0000 ADD [BX+SI], AL
0x01FB 0000 ADD [BX+SI], AL
0x01FD 0055 aa ADD [DI-0x56], DL
_______MBR \Device\Harddisk1\DR3
0x00000000 33 C0 8E D0 BC 00 7C FB 50 07 50 1F FC BE 1B 7C 3À.м.|ûP.P.ü¾.|
0x00000010 BF 1B 06 50 57 B9 E5 01 F3 A4 CB BD BE 07 B1 04 ¿..PW¹å.ó¤Ë½¾.±.
0x00000020 38 6E 00 7C 09 75 13 83 C5 10 E2 F4 CD 18 8B F5 8n.|.u..Å.âôÍ..õ
0x00000030 83 C6 10 49 74 19 38 2C 74 F6 A0 B5 07 B4 07 8B .Æ.It.8,tö.µ.´..
0x00000040 F0 AC 3C 00 74 FC BB 07 00 B4 0E CD 10 EB F2 88 ð¬<.tü»..´.Í.ëò.
0x00000050 4E 10 E8 46 00 73 2A FE 46 10 80 7E 04 0B 74 0B N.èF.s*þF..~..t.
0x00000060 80 7E 04 0C 74 05 A0 B6 07 75 D2 80 46 02 06 83 .~..t..¶.uÒ.F...
0x00000070 46 08 06 83 56 0A 00 E8 21 00 73 05 A0 B6 07 EB F...V..è!.s..¶.ë
0x00000080 BC 81 3E FE 7D 55 AA 74 0B 80 7E 10 00 74 C8 A0 ¼.>þ}Uªt..~..tÈ.
0x00000090 B7 07 EB A9 8B FC 1E 57 8B F5 CB BF 05 00 8A 56 ·.ë©.ü.W.õË¿...V
0x000000A0 00 B4 08 CD 13 72 23 8A C1 24 3F 98 8A DE 8A FC .´.Í.r#.Á$?..Þ.ü
0x000000B0 43 F7 E3 8B D1 86 D6 B1 06 D2 EE 42 F7 E2 39 56 C÷ã.Ñ.Ö±.ÒîB÷â9V
0x000000C0 0A 77 23 72 05 39 46 08 73 1C B8 01 02 BB 00 7C .w#r.9F.s.¸..».|
0x000000D0 8B 4E 02 8B 56 00 CD 13 73 51 4F 74 4E 32 E4 8A .N..V.Í.sQOtN2ä.
0x000000E0 56 00 CD 13 EB E4 8A 56 00 60 BB AA 55 B4 41 CD V.Í.ëä.V.`»ªU´AÍ
0x000000F0 13 72 36 81 FB 55 AA 75 30 F6 C1 01 74 2B 61 60 .r6.ûUªu0öÁ.t+a`
0x00000100 6A 00 6A 00 FF 76 0A FF 76 08 6A 00 68 00 7C 6A j.j..v..v.j.h.|j
0x00000110 01 6A 10 B4 42 8B F4 CD 13 61 61 73 0E 4F 74 0B .j.´B.ôÍ.aas.Ot.
0x00000120 32 E4 8A 56 00 CD 13 EB D6 61 F9 C3 49 6E 76 61 2ä.V.Í.ëÖaùÃInva
0x00000130 6C 69 64 20 70 61 72 74 69 74 69 6F 6E 20 74 61 lid partition ta
0x00000140 62 6C 65 00 45 72 72 6F 72 20 6C 6F 61 64 69 6E ble.Error loadin
0x00000150 67 20 6F 70 65 72 61 74 69 6E 67 20 73 79 73 74 g operating syst
0x00000160 65 6D 00 4D 69 73 73 69 6E 67 20 6F 70 65 72 61 em.Missing opera
0x00000170 74 69 6E 67 20 73 79 73 74 65 6D 00 00 00 00 00 ting system.....
0x00000180 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x00000190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x000001A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x000001B0 00 00 00 00 00 2C 44 63 18 2E 07 C3 00 00 80 01 .....,Dc...Ã....
0x000001C0 01 00 0B 80 E0 BC 20 00 00 00 E0 BF 3B 00 00 00 ....༠...à¿;...
0x000001D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x000001E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x000001F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA ..............Uª
__________________________16_BIT_ASM_CODE
0x0000 33c0 XOR AX, AX
0x0002 8ed0 MOV SS, AX
0x0004 bc 007c MOV SP, 0x7c00
0x0007 fb STI
0x0008 50 PUSH AX
0x0009 07 POP ES
0x000A 50 PUSH AX
0x000B 1f POP DS
0x000C fc CLD
0x000D be 1b7c MOV SI, 0x7c1b
0x0010 bf 1b06 MOV DI, 0x61b
0x0013 50 PUSH AX
0x0014 57 PUSH DI
0x0015 b9 e501 MOV CX, 0x1e5
0x0018 f3 a4 REP MOVSB
0x001A cb RETF
0x001B bd be07 MOV BP, 0x7be
0x001E b1 04 MOV CL, 0x4
0x0020 386e 00 CMP [BP+0x0], CH
0x0023 7c 09 JL 0x2e
0x0025 75 13 JNZ 0x3a
0x0027 83c5 10 ADD BP, 0x10
0x002A e2 f4 LOOP 0x20
0x002C cd 18 INT 0x18
0x002E 8bf5 MOV SI, BP
0x0030 83c6 10 ADD SI, 0x10
0x0033 49 DEC CX
0x0034 74 19 JZ 0x4f
0x0036 382c CMP [SI], CH
0x0038 74 f6 JZ 0x30
0x003A a0 b507 MOV AL, [0x7b5]
0x003D b4 07 MOV AH, 0x7
0x003F 8bf0 MOV SI, AX
0x0041 ac LODSB
0x0042 3c 00 CMP AL, 0x0
0x0044 74 fc JZ 0x42
0x0046 bb 0700 MOV BX, 0x7
0x0049 b4 0e MOV AH, 0xe
0x004B cd 10 INT 0x10
0x004D eb f2 JMP 0x41
0x004F 884e 10 MOV [BP+0x10], CL
0x0052 e8 4600 CALL 0x9b
0x0055 73 2a JAE 0x81
0x0057 fe46 10 INC BYTE [BP+0x10]
0x005A 807e 04 0b CMP BYTE [BP+0x4], 0xb
0x005E 74 0b JZ 0x6b
0x0060 807e 04 0c CMP BYTE [BP+0x4], 0xc
0x0064 74 05 JZ 0x6b
0x0066 a0 b607 MOV AL, [0x7b6]
0x0069 75 d2 JNZ 0x3d
0x006B 8046 02 06 ADD BYTE [BP+0x2], 0x6
0x006F 8346 08 06 ADD WORD [BP+0x8], 0x6
0x0073 8356 0a 00 ADC WORD [BP+0xa], 0x0
0x0077 e8 2100 CALL 0x9b
0x007A 73 05 JAE 0x81
0x007C a0 b607 MOV AL, [0x7b6]
0x007F eb bc JMP 0x3d
0x0081 813e fe7d 55aa CMP WORD [0x7dfe], 0xaa55
0x0087 74 0b JZ 0x94
0x0089 807e 10 00 CMP BYTE [BP+0x10], 0x0
0x008D 74 c8 JZ 0x57
0x008F a0 b707 MOV AL, [0x7b7]
0x0092 eb a9 JMP 0x3d
0x0094 8bfc MOV DI, SP
0x0096 1e PUSH DS
0x0097 57 PUSH DI
0x0098 8bf5 MOV SI, BP
0x009A cb RETF
0x009B bf 0500 MOV DI, 0x5
0x009E 8a56 00 MOV DL, [BP+0x0]
0x00A1 b4 08 MOV AH, 0x8
0x00A3 cd 13 INT 0x13
0x00A5 72 23 JB 0xca
0x00A7 8ac1 MOV AL, CL
0x00A9 24 3f AND AL, 0x3f
0x00AB 98 CBW
0x00AC 8ade MOV BL, DH
0x00AE 8afc MOV BH, AH
0x00B0 43 INC BX
0x00B1 f7e3 MUL BX
0x00B3 8bd1 MOV DX, CX
0x00B5 86d6 XCHG DH, DL
0x00B7 b1 06 MOV CL, 0x6
0x00B9 d2ee SHR DH, CL
0x00BB 42 INC DX
0x00BC f7e2 MUL DX
0x00BE 3956 0a CMP [BP+0xa], DX
0x00C1 77 23 JA 0xe6
0x00C3 72 05 JB 0xca
0x00C5 3946 08 CMP [BP+0x8], AX
0x00C8 73 1c JAE 0xe6
0x00CA b8 0102 MOV AX, 0x201
0x00CD bb 007c MOV BX, 0x7c00
0x00D0 8b4e 02 MOV CX, [BP+0x2]
0x00D3 8b56 00 MOV DX, [BP+0x0]
0x00D6 cd 13 INT 0x13
0x00D8 73 51 JAE 0x12b
0x00DA 4f DEC DI
0x00DB 74 4e JZ 0x12b
0x00DD 32e4 XOR AH, AH
0x00DF 8a56 00 MOV DL, [BP+0x0]
0x00E2 cd 13 INT 0x13
0x00E4 eb e4 JMP 0xca
0x00E6 8a56 00 MOV DL, [BP+0x0]
0x00E9 60 PUSHA
0x00EA bb aa55 MOV BX, 0x55aa
0x00ED b4 41 MOV AH, 0x41
0x00EF cd 13 INT 0x13
0x00F1 72 36 JB 0x129
0x00F3 81fb 55aa CMP BX, 0xaa55
0x00F7 75 30 JNZ 0x129
0x00F9 f6c1 01 TEST CL, 0x1
0x00FC 74 2b JZ 0x129
0x00FE 61 POPA
0x00FF 60 PUSHA
0x0100 6a 00 PUSH 0x0
0x0102 6a 00 PUSH 0x0
0x0104 ff76 0a PUSH WORD [BP+0xa]
0x0107 ff76 08 PUSH WORD [BP+0x8]
0x010A 6a 00 PUSH 0x0
0x010C 68 007c PUSH 0x7c00
0x010F 6a 01 PUSH 0x1
0x0111 6a 10 PUSH 0x10
0x0113 b4 42 MOV AH, 0x42
0x0115 8bf4 MOV SI, SP
0x0117 cd 13 INT 0x13
0x0119 61 POPA
0x011A 61 POPA
0x011B 73 0e JAE 0x12b
0x011D 4f DEC DI
0x011E 74 0b JZ 0x12b
0x0120 32e4 XOR AH, AH
0x0122 8a56 00 MOV DL, [BP+0x0]
0x0125 cd 13 INT 0x13
0x0127 eb d6 JMP 0xff
0x0129 61 POPA
0x012A f9 STC
0x012B c3 RET
0x012C 49 DEC CX
0x012D 6e OUTSB
0x012E 76 61 JBE 0x191
0x0130 6c INSB
0x0131 6964 20 7061 IMUL SP, [SI+0x20], 0x6170
0x0136 72 74 JB 0x1ac
0x0138 6974 69 6f6e IMUL SI, [SI+0x69], 0x6e6f
0x013D 2074 61 AND [SI+0x61], DH
0x0140 626c 65 BOUND BP, [SI+0x65]
0x0143 0045 72 ADD [DI+0x72], AL
0x0146 72 6f JB 0x1b7
0x0148 72 20 JB 0x16a
0x014A 6c INSB
0x014B 6f OUTSW
0x014C 61 POPA
0x014D 64 696e 67 206f IMUL BP, FS:[BP+0x67], 0x6f20
0x0153 70 65 JO 0x1ba
0x0155 72 61 JB 0x1b8
0x0157 74 69 JZ 0x1c2
0x0159 6e OUTSB
0x015A 67 2073 79 AND [EBX+0x79], DH
0x015E 73 74 JAE 0x1d4
0x0160 65 6d INS WORD GS:[DI], DX
0x0162 004d 69 ADD [DI+0x69], CL
0x0165 73 73 JAE 0x1da
0x0167 696e 67 206f IMUL BP, [BP+0x67], 0x6f20
0x016C 70 65 JO 0x1d3
0x016E 72 61 JB 0x1d1
0x0170 74 69 JZ 0x1db
0x0172 6e OUTSB
0x0173 67 2073 79 AND [EBX+0x79], DH
0x0177 73 74 JAE 0x1ed
0x0179 65 6d INS WORD GS:[DI], DX
0x017B 0000 ADD [BX+SI], AL
0x017D 0000 ADD [BX+SI], AL
0x017F 0000 ADD [BX+SI], AL
0x0181 0000 ADD [BX+SI], AL
0x0183 0000 ADD [BX+SI], AL
0x0185 0000 ADD [BX+SI], AL
0x0187 0000 ADD [BX+SI], AL
0x0189 0000 ADD [BX+SI], AL
0x018B 0000 ADD [BX+SI], AL
0x018D 0000 ADD [BX+SI], AL
0x018F 0000 ADD [BX+SI], AL
0x0191 0000 ADD [BX+SI], AL
0x0193 0000 ADD [BX+SI], AL
0x0195 0000 ADD [BX+SI], AL
0x0197 0000 ADD [BX+SI], AL
0x0199 0000 ADD [BX+SI], AL
0x019B 0000 ADD [BX+SI], AL
0x019D 0000 ADD [BX+SI], AL
0x019F 0000 ADD [BX+SI], AL
0x01A1 0000 ADD [BX+SI], AL
0x01A3 0000 ADD [BX+SI], AL
0x01A5 0000 ADD [BX+SI], AL
0x01A7 0000 ADD [BX+SI], AL
0x01A9 0000 ADD [BX+SI], AL
0x01AB 0000 ADD [BX+SI], AL
0x01AD 0000 ADD [BX+SI], AL
0x01AF 0000 ADD [BX+SI], AL
0x01B1 0000 ADD [BX+SI], AL
0x01B3 0000 ADD [BX+SI], AL
0x01B5 2c 44 SUB AL, 0x44
0x01B7 6318 ARPL [BX+SI], BX
0x01B9 2e DB 0x2e
0x01B9 2e 07 POP ES
0x01BB c3 RET
0x01BC 0000 ADD [BX+SI], AL
0x01BE 8001 01 ADD BYTE [BX+DI], 0x1
0x01C1 000b ADD [BP+DI], CL
0x01C3 80e0 bc AND AL, 0xbc
0x01C6 2000 AND [BX+SI], AL
0x01C8 0000 ADD [BX+SI], AL
0x01CA e0 bf LOOPNZ 0x18b
0x01CC 3b00 CMP AX, [BX+SI]
0x01CE 0000 ADD [BX+SI], AL
0x01D0 0000 ADD [BX+SI], AL
0x01D2 0000 ADD [BX+SI], AL
0x01D4 0000 ADD [BX+SI], AL
0x01D6 0000 ADD [BX+SI], AL
0x01D8 0000 ADD [BX+SI], AL
0x01DA 0000 ADD [BX+SI], AL
0x01DC 0000 ADD [BX+SI], AL
0x01DE 0000 ADD [BX+SI], AL
0x01E0 0000 ADD [BX+SI], AL
0x01E2 0000 ADD [BX+SI], AL
0x01E4 0000 ADD [BX+SI], AL
0x01E6 0000 ADD [BX+SI], AL
0x01E8 0000 ADD [BX+SI], AL
0x01EA 0000 ADD [BX+SI], AL
0x01EC 0000 ADD [BX+SI], AL
0x01EE 0000 ADD [BX+SI], AL
0x01F0 0000 ADD [BX+SI], AL
0x01F2 0000 ADD [BX+SI], AL
0x01F4 0000 ADD [BX+SI], AL
0x01F6 0000 ADD [BX+SI], AL
0x01F8 0000 ADD [BX+SI], AL
0x01FA 0000 ADD [BX+SI], AL
0x01FC 0000 ADD [BX+SI], AL
0x01FE 55 PUSH BP
0x01FF aa STOSB
Re: Problém s napadeným PC - generic27.AkPW- log z RSIT přil
V příloze přikládám log z OTL. AVG spuštěno, čekám na dokončení kontroly.
- Přílohy
-
- OTL.rar
- (88.16 KiB) Staženo 57 x
Přispějete na provoz fóra?