Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz

Pro motji prosim o kontrolu

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Odpovědět
Zpráva
Autor
Marwin
Vzorný návštěvník
Vzorný návštěvník
Příspěvky: 92
Registrován: 01 bře 2007 13:33
Kontaktovat uživatele:
Kontaktovat uživatele Marwin

Pro motji prosim o kontrolu

#1 Příspěvek od Marwin »

Je tam nekde rootkit a nemuzu ho dostat pryc prosim kouknete nato davam log z Rsit i z combofixu:

Logfile of random's system information tool 1.06 (written by random/random)
Run by Karel at 2010-01-27 17:02:32
Systém Microsoft Windows XP Professional Service Pack 2
System drive C: has 72 GB (94%) free of 76 GB
Total RAM: 767 MB (60% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:02:41, on 27.1.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\WINDOWS\ATKKBService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Documents and Settings\Karel\Plocha\RSIT.exe
C:\Program Files\Alwil Software\Avast5\setup\avast.setup
C:\Program Files\trend micro\Karel.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=60497
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: _uninst_setup_9.0.0.722_27.01.2010_14-27.exe.lnk = C:\Documents and Settings\Karel\Local Settings\temp\_uninst_setup_9.0.0.722_27.01.2010_14-27.exe.bat
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

--
End of file - 3992 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll [2003-11-03 54248]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"=C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe [2006-09-25 90112]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2006-03-01 577536]
"RemoteControl"=C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [2003-10-31 32768]
"avast5"=C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe [2010-01-19 2743104]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2009-10-09 25623336]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE

C:\Documents and Settings\Karel\Nabídka Start\Programy\Po spuštění
_uninst_setup_9.0.0.722_27.01.2010_14-27.exe.lnk - C:\Documents and Settings\Karel\Local Settings\temp\_uninst_setup_9.0.0.722_27.01.2010_14-27.exe.bat

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2006-12-16 110592]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 1 months======

2010-01-27 17:02:33 ----D---- C:\Program Files\trend micro
2010-01-27 17:02:32 ----D---- C:\rsit
2010-01-27 13:14:25 ----D---- C:\WINDOWS\temp
2010-01-27 13:14:20 ----A---- C:\ComboFix.txt
2010-01-27 11:09:55 ----D---- C:\Program Files\Lavalys
2010-01-26 15:33:07 ----D---- C:\Documents and Settings\All Users\Data aplikací\Alwil Software
2010-01-26 13:42:25 ----D---- C:\Documents and Settings\Karel\Data aplikací\Malwarebytes
2010-01-26 13:42:19 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-01-26 13:42:19 ----D---- C:\Documents and Settings\All Users\Data aplikací\Malwarebytes
2010-01-26 13:15:22 ----A---- C:\WINDOWS\zip.exe
2010-01-26 13:15:22 ----A---- C:\WINDOWS\SWXCACLS.exe
2010-01-26 13:15:22 ----A---- C:\WINDOWS\SWSC.exe
2010-01-26 13:15:22 ----A---- C:\WINDOWS\SWREG.exe
2010-01-26 13:15:22 ----A---- C:\WINDOWS\sed.exe
2010-01-26 13:15:22 ----A---- C:\WINDOWS\PEV.exe
2010-01-26 13:15:22 ----A---- C:\WINDOWS\NIRCMD.exe
2010-01-26 13:15:22 ----A---- C:\WINDOWS\MBR.exe
2010-01-26 13:15:22 ----A---- C:\WINDOWS\grep.exe

======List of files/folders modified in the last 1 months======

2010-01-27 17:02:39 ----D---- C:\WINDOWS\Prefetch
2010-01-27 17:02:33 ----RD---- C:\Program Files
2010-01-27 17:02:10 ----D---- C:\Documents and Settings\Karel\Data aplikací\Skype
2010-01-27 17:01:30 ----D---- C:\Documents and Settings\Karel\Data aplikací\skypePM
2010-01-27 17:01:15 ----D---- C:\WINDOWS
2010-01-27 17:00:43 ----D---- C:\WINDOWS\system32\drivers
2010-01-27 16:59:04 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-01-27 16:59:00 ----D---- C:\WINDOWS\system32\CatRoot2
2010-01-27 13:46:28 ----SHD---- C:\System Volume Information
2010-01-27 13:45:26 ----HD---- C:\WINDOWS\inf
2010-01-27 13:14:27 ----D---- C:\Qoobox
2010-01-27 13:09:35 ----A---- C:\WINDOWS\system.ini
2010-01-27 13:05:56 ----D---- C:\WINDOWS\system32
2010-01-27 13:05:56 ----D---- C:\WINDOWS\AppPatch
2010-01-27 13:05:51 ----D---- C:\Program Files\Common Files
2010-01-27 13:03:00 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-01-27 12:59:56 ----D---- C:\WINDOWS\system32\config
2010-01-27 12:59:49 ----D---- C:\WINDOWS\ERDNT
2010-01-26 16:10:50 ----D---- C:\Program Files\Google
2010-01-26 16:08:57 ----D---- C:\Documents and Settings\All Users\Data aplikací\Google
2010-01-26 15:35:04 ----D---- C:\Program Files\Alwil Software
2010-01-26 15:33:24 ----SHD---- C:\WINDOWS\Installer
2010-01-26 15:33:24 ----D---- C:\Config.Msi
2010-01-26 15:33:23 ----D---- C:\WINDOWS\WinSxS
2010-01-26 15:33:22 ----D---- C:\Program Files\Common Files\Microsoft Shared
2010-01-26 15:04:47 ----D---- C:\WINDOWS\srchasst
2010-01-26 13:27:06 ----RSD---- C:\WINDOWS\Fonts
2010-01-19 12:57:39 ----A---- C:\WINDOWS\system32\aswBoot.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2010-01-19 28240]
R1 asuskbnt;Enhanced Display Driver Helper Service; C:\WINDOWS\system32\drivers\atkkbnt.sys [2006-10-31 11008]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2010-01-19 162640]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2010-01-19 46544]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-17 39936]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2010-01-19 19024]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2010-01-19 100304]
R2 EIO;EIO; \??\C:\WINDOWS\system32\drivers\EIO.sys []
R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2004-08-03 11868]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2006-04-21 3964352]
R3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2004-08-17 60800]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2006-12-16 1918464]
R3 HSF_DP;HSF_DP; C:\WINDOWS\system32\DRIVERS\HSFDPSP2.sys [2004-08-03 1041536]
R3 HSFHWBS2;HSFHWBS2; C:\WINDOWS\system32\DRIVERS\HSFBS2S2.sys [2004-08-03 220032]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2004-08-17 61824]
R3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-03 20992]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624]
R3 usbhub;Rozbočovač umožnující USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 usbstor;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-03 20480]
R3 Video3D;ASUS Video3D Service; C:\WINDOWS\System32\Drivers\Video3D32.sys [2006-09-29 10752]
R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSFCXTS2.sys [2004-08-03 685056]
R4 atidgllk;atidgllk; \??\C:\WINDOWS\atidgllk.sys []
S1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-17 14848]
S3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2010-01-19 23248]
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024]
S3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-10-25 9600]
S3 mbr;mbr; \??\C:\DOCUME~1\Karel\LOCALS~1\Temp\mbr.sys []
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-25 12160]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360]
S3 usbaudio;Ovladač zvukové karty USB (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2004-08-03 59264]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616]
S3 usbvideo;Zobrazovací zařízení USB (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2004-08-03 78464]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2006-12-16 434176]
R2 ATKKeyboardService;ATK Keyboard Service; C:\WINDOWS\ATKKBService.exe [2006-09-29 258560]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-01-19 40384]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-01-19 40384]
S3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-01-19 40384]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S4 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe []

-----------------EOF-----------------



ComboFix 10-01-25.06 - Karel 26.01.2010 13:22:42.1.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.767.542 [GMT 1:00]
Spuštěný z: c:\documents and settings\Karel\Plocha\ComboFix.exe
AV: avast! antivirus 4.8.1368 [VPS 100125-2] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Karel\oashdihasidhasuidhiasdhiashdiuasdhasd
c:\windows\Fonts\mlog
c:\windows\Install.txt
c:\windows\system32\2498425189.dat
c:\windows\system32\6.tmp
c:\windows\system32\Install.txt

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-12-26 do 2010-01-26 )))))))))))))))))))))))))))))))
.

V tomto časovém úseku nebyly vytvořeny žádné nové soubory.

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-24 23:54 . 2003-01-02 20:36 1280480 ----a-w- c:\windows\system32\aswBoot.exe
2009-11-24 23:51 . 2003-01-02 20:37 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-11-24 23:50 . 2003-01-02 20:37 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-11-24 23:50 . 2003-01-02 20:37 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-11-24 23:50 . 2003-01-02 20:37 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-11-24 23:49 . 2003-01-02 20:37 48560 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-11-24 23:48 . 2003-01-02 20:37 23120 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-11-24 23:47 . 2003-01-02 20:37 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-11-24 23:47 . 2003-01-02 20:37 97480 ----a-w- c:\windows\system32\AvastSS.scr
.

------- Sigcheck -------

[-] 2003-01-02 . 558635D3AF1C7546D26067D5D9B6959E . 212480 . . [5.1.2600.2180] . . c:\windows\system32\drivers\ndis.sys
[-] 2003-01-02 . 558635D3AF1C7546D26067D5D9B6959E . 212480 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ndis.sys
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-10-09 25623336]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2003-01-03 39408]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-17 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 90112]
"SoundMan"="SOUNDMAN.EXE" [2006-03-01 577536]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 32768]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-17 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-18 65588]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 axwhisky;axwhisky;c:\windows\system32\drivers\axwhisky.sys [2.7.2003 17:41 5248]
R0 axwskbus;axwskbus;c:\windows\system32\drivers\axwskbus.sys [2.7.2003 16:49 124160]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2.1.2003 21:37 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2.1.2003 21:37 20560]
R4 atidgllk;atidgllk;c:\windows\atidgllk.sys [2.1.2003 20:46 5376]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-26 13:30
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...


c:\docume~1\Karel\LOCALS~1\Temp\VMS38.tmp 5073 bytes

sken byl úspešně dokončen
skryté soubory: 1

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe >>UNKNOWN [0x82E67530]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf7592fc3
\Driver\ACPI -> ACPI.sys @ 0xf74e5cb8
\Driver\atapi -> 0x82be9e90
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a1afe
ParseProcedure -> ntoskrnl.exe @ 0x80570a6e
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a1afe
ParseProcedure -> ntoskrnl.exe @ 0x80570a6e
NDIS: Realtek RTL8139 Family PCI Fast Ethernet NIC -> SendCompleteHandler -> NDIS.sys @ 0x82e4fbc3
PacketIndicateHandler -> NDIS.sys @ 0x82e5bb21
SendHandler -> NDIS.sys @ 0x82e4fd33
Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(668)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(4228)
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\windows\SOUNDMAN.EXE
c:\program files\ATI Technologies\ATI.ACE\CLI.EXE
c:\windows\ATKKBService.exe
c:\windows\system32\wscntfy.exe
c:\program files\ATI Technologies\ATI.ACE\cli.exe
c:\program files\ATI Technologies\ATI.ACE\cli.exe
.
**************************************************************************
.
Celkový čas: 2010-01-26 13:34:40 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-01-26 12:34

Před spuštěním: Volných bajtů: 74 875 695 104
Po spuštění: Volných bajtů: 74 951 122 944

- - End Of File - - 8FBE74B6B90581D784E340B7F3676509
Nahoru
Uživatelský avatar
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 říj 2008 08:02

Re: Pro motji prosim o kontrolu

#2 Příspěvek od motji »

:arrow: Start - ovládací panely - možnosti složky - zobrazení - odkrýt skryté a systémové soubory

:arrow: Dejte soubor otestovat na http://www.virustotal.com

C:\Documents and Settings\Karel\Local Settings\temp\_uninst_setup_9.0.0.722_27.01.2010_14-27.exe.bat
c:\windows\system32\drivers\ndis.sys
c:\windows\system32\drivers\axwhisky.sys
c:\windows\system32\drivers\axwskbus.sys

Do okénka zkopírujte cestu k souboru , pokud napíše, že soubor byl už testován, dejte otestovat znovu.
Sem vložte link s výsledky.


:arrow: odinstalujte všechny virtuální jednotky (Daemon nebo alcohol)

:arrow: Stáhněte SPTD http://www.duplexsecure.com/en/downloads
-vyberte verzi podle svého operačního systému. SPTD for Windows (32 bit) nebo (64b)
-uložte na plochu a spusťte
- zvolte možnost Uninstall
- restart PC
- spusťte gmer


:arrow: Stáhněte Gmer http://www.viry.cz/forum/viewtopic.php?f=29&t=62878
- rozbalte a spusťte
-proběhne sken, po skončení se otevře okno s výsledky, kliknete na Save a tím si uložíte log,který sem vložíte

-Podle návodu v odkazu proveďte druhý sken a log sem také vložte.

:arrow: stáhněte MBR
http://www2.gmer.net/mbr/mbr.exe
-uložte ho na plochu


:arrow: start-spustit
do okénka zkopírujte

Kód: Vybrat vše

"%userprofile%\plocha\mbr" -t
ok

:arrow: vytvoří se log s názvem mbr.log, vložte ho zde
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
Marwin
Vzorný návštěvník
Vzorný návštěvník
Příspěvky: 92
Registrován: 01 bře 2007 13:33
Kontaktovat uživatele:
Kontaktovat uživatele Marwin

Re: Pro motji prosim o kontrolu

#3 Příspěvek od Marwin »

Zdravim

tohle v PC sem nenasel C:\Documents and Settings\Karel\Local Settings\temp\_uninst_setup_9.0.0.722_27.01.2010_14-27.exe.bat

c:\windows\system32\drivers\ndis.sys nejde otestovat pri 61% odesila souboru se to zastavi a pak skonci s errorem ale mam tu ndis2.sys tak aspon ten sem poslal na kontrolu tady je vysledek: :arrow:
http://www.virustotal.com/cs/analisis/8 ... 1264671878

c:\windows\system32\drivers\axwhisky.sys nenasel sem
c:\windows\system32\drivers\axwskbus.sys nenasel sem


logy gmer :arrow:
GMER 1.0.15.15281 - http://www.gmer.net
Rootkit quick scan 2010-01-28 09:56:55
Windows 5.1.2600 Service Pack 2
Running: gmer.exe; Driver: C:\DOCUME~1\Karel\LOCALS~1\Temp\uwtdqpod.sys


---- System - GMER 1.0.15 ----

Code 82F0F530 pIofCallDriver

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)
AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device \Driver\NDIS \Device\Ndis [82EE9982] NDIS.sys[.reloc]

---- EOF - GMER 1.0.15 ----

druhej log gmer :arrow:
GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-01-28 10:40:02
Windows 5.1.2600 Service Pack 2
Running: gmer.exe; Driver: C:\DOCUME~1\Karel\LOCALS~1\Temp\uwtdqpod.sys


---- System - GMER 1.0.15 ----

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwClose [0xAAD18BBC]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateKey [0xAAD18A78]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteKey [0xAAD1902C]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteValueKey [0xAAD18F56]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDuplicateObject [0xAAD1864E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenKey [0xAAD18B52]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenProcess [0xAAD1858E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenThread [0xAAD185F2]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwQueryValueKey [0xAAD18C72]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRenameKey [0xAAD190FA]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRestoreKey [0xAAD18C32]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwSetValueKey [0xAAD18DB2]

Code 82F0F530 pIofCallDriver

---- Kernel code sections - GMER 1.0.15 ----

.reloc C:\WINDOWS\system32\drivers\NDIS.sys section is executable [0x82EE2200, 0x32BAA, 0xE0000060]

---- User code sections - GMER 1.0.15 ----

? C:\WINDOWS\System32\svchost.exe[200] image checksum mismatch; number of sections mismatch; time/date stamp mismatch;
? C:\WINDOWS\System32\svchost.exe[524] image checksum mismatch; number of sections mismatch; time/date stamp mismatch;
? C:\WINDOWS\System32\svchost.exe[1916] image checksum mismatch; number of sections mismatch; time/date stamp mismatch;
? C:\WINDOWS\System32\svchost.exe[1972] image checksum mismatch; number of sections mismatch; time/date stamp mismatch;
? C:\WINDOWS\System32\svchost.exe[2100] image checksum mismatch; number of sections mismatch; time/date stamp mismatch; unknown module: gdiplus.dllunknown module: OLEAUT32.dllunknown module: urlmon.dll
.text C:\WINDOWS\System32\svchost.exe[2100] USER32.dll!SetForegroundWindow 77D466A7 8 Bytes [B8, 01, 00, 00, 00, C2, 04, ...] {MOV EAX, 0x1; RET 0x4}
? C:\WINDOWS\System32\svchost.exe[2108] image checksum mismatch; number of sections mismatch; time/date stamp mismatch; unknown module: gdiplus.dllunknown module: OLEAUT32.dllunknown module: urlmon.dll
.text C:\WINDOWS\System32\svchost.exe[2108] USER32.dll!SetForegroundWindow 77D466A7 8 Bytes [B8, 01, 00, 00, 00, C2, 04, ...] {MOV EAX, 0x1; RET 0x4}

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegQueryValueExW] 9B8401C7
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorDacl] 46E90043
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetEntriesInAclW] 560001AA
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorGroup] 06C7F18B
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorOwner] [00439B84] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!InitializeSecurityDescriptor] 01AA38E8
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!GetTokenInformation] 2444F600
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!OpenProcessToken] 07740108
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!OpenThreadToken] AC0FE856
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetServiceStatus] 8B590001
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegisterServiceCtrlHandlerW] 04C25EC6
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegCloseKey] 8B55C300
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegOpenKeyExW] 1475FFEC
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!StartServiceCtrlDispatcherW] FF1075FF
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!WideCharToMultiByte] 10C48308
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrlenW] 8B55C35D
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LocalFree] 1475FFEC
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentProcess] FF1075FF
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentThread] 75FF0C75
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetProcAddress] B108E808
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LoadLibraryExW] 458B0001
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LCMapStringW] F0A4E800
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!FreeLibrary] F18B0001
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrcpyW] E8F07589
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!ExpandEnvironmentStringsW] 0001A906
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrcmpiW] 00FC6583
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!ExitProcess] 8D0875FF
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCommandLineW] 06C70C4E
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!InitializeCriticalSection] [00439B90] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetProcessHeap] 001D67E8
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!SetErrorMode] E8C68B00
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!SetUnhandledExceptionFilter] 0001F156
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!RegisterWaitForSingleObject] 560004C2
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!InterlockedCompareExchange] 006AF18B
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LoadLibraryA] 4E8D016A
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!QueryPerformanceCounter] 9006C70C
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetTickCount] E800439B
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentThreadId] 000022DD
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentProcessId] E95ECE8B
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetSystemTimeAsFileTime] 0001A999
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!TerminateProcess] E8F18B56
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!UnhandledExceptionFilter] FFFFFFDB
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LocalAlloc] 082444F6
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrcmpW] 56077401
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!DelayLoadFailureHook] 01AB68E8
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!NtQuerySecurityObject] 0004C25E
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlFreeHeap] 9B9C01C7
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!NtOpenKey] BCE90043
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!wcscat] 56FFFFFF
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!wcscpy] 06C7F18B
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlAllocateHeap] [00439B9C] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlCompareUnicodeString] FFFFAEE8
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlInitUnicodeString] 2444F6FF
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlInitializeSid] 07740108
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlLengthRequiredSid] AB3BE856
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlSubAuthoritySid] 8B590001
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!NtClose] 04C25EC6
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlSubAuthorityCountSid] B8046A00
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlGetDaclSecurityDescriptor] [00433E58] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlQueryInformationAcl] 01F009E8
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlGetAce] 89F18B00
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlImageNtHeader] 7D8BF075
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!wcslen] DEE85708
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlUnhandledExceptionFilter] 830001A8
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlCopySid] 8300FC65
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerUnregisterIfEx] 06C70C4E
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcMgmtWaitServerListen] [00439B90] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcMgmtSetServerStackSize] 001CC7E8
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerUnregisterIf] E8C68B00
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerListen] 0001F0B6
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerUseProtseqEpW] 830004C2
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerRegisterIf] 60830020
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!I_RpcMapWin32Status] 0A8B0004
IAT C:\WINDOWS\System32\svchost.exe[200] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcMgmtStopServerListening] 04728B56
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegQueryValueExW] 9B8401C7
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorDacl] 46E90043
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetEntriesInAclW] 560001AA
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorGroup] 06C7F18B
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorOwner] [00439B84] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!InitializeSecurityDescriptor] 01AA38E8
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!GetTokenInformation] 2444F600
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!OpenProcessToken] 07740108
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!OpenThreadToken] AC0FE856
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetServiceStatus] 8B590001
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegisterServiceCtrlHandlerW] 04C25EC6
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegCloseKey] 8B55C300
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegOpenKeyExW] 1475FFEC
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!StartServiceCtrlDispatcherW] FF1075FF
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!WideCharToMultiByte] 10C48308
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrlenW] 8B55C35D
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LocalFree] 1475FFEC
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentProcess] FF1075FF
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentThread] 75FF0C75
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetProcAddress] B108E808
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LoadLibraryExW] 458B0001
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LCMapStringW] F0A4E800
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!FreeLibrary] F18B0001
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrcpyW] E8F07589
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!ExpandEnvironmentStringsW] 0001A906
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrcmpiW] 00FC6583
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!ExitProcess] 8D0875FF
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCommandLineW] 06C70C4E
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!InitializeCriticalSection] [00439B90] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetProcessHeap] 001D67E8
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!SetErrorMode] E8C68B00
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!SetUnhandledExceptionFilter] 0001F156
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!RegisterWaitForSingleObject] 560004C2
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!InterlockedCompareExchange] 006AF18B
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LoadLibraryA] 4E8D016A
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!QueryPerformanceCounter] 9006C70C
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetTickCount] E800439B
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentThreadId] 000022DD
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentProcessId] E95ECE8B
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetSystemTimeAsFileTime] 0001A999
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!TerminateProcess] E8F18B56
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!UnhandledExceptionFilter] FFFFFFDB
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LocalAlloc] 082444F6
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrcmpW] 56077401
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!DelayLoadFailureHook] 01AB68E8
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!NtQuerySecurityObject] 0004C25E
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlFreeHeap] 9B9C01C7
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!NtOpenKey] BCE90043
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!wcscat] 56FFFFFF
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!wcscpy] 06C7F18B
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlAllocateHeap] [00439B9C] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlCompareUnicodeString] FFFFAEE8
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlInitUnicodeString] 2444F6FF
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlInitializeSid] 07740108
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlLengthRequiredSid] AB3BE856
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlSubAuthoritySid] 8B590001
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!NtClose] 04C25EC6
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlSubAuthorityCountSid] B8046A00
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlGetDaclSecurityDescriptor] [00433E58] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlQueryInformationAcl] 01F009E8
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlGetAce] 89F18B00
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlImageNtHeader] 7D8BF075
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!wcslen] DEE85708
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlUnhandledExceptionFilter] 830001A8
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlCopySid] 8300FC65
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerUnregisterIfEx] 06C70C4E
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcMgmtWaitServerListen] [00439B90] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcMgmtSetServerStackSize] 001CC7E8
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerUnregisterIf] E8C68B00
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerListen] 0001F0B6
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerUseProtseqEpW] 830004C2
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerRegisterIf] 60830020
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!I_RpcMapWin32Status] 0A8B0004
IAT C:\WINDOWS\System32\svchost.exe[524] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcMgmtStopServerListening] 04728B56
IAT C:\WINDOWS\system32\services.exe[680] @ C:\WINDOWS\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW] 003C0002
IAT C:\WINDOWS\system32\services.exe[680] @ C:\WINDOWS\system32\services.exe [KERNEL32.dll!CreateProcessW] 003C0000
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegQueryValueExW] 9B8401C7
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorDacl] 46E90043
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetEntriesInAclW] 560001AA
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorGroup] 06C7F18B
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorOwner] [00439B84] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!InitializeSecurityDescriptor] 01AA38E8
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!GetTokenInformation] 2444F600
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!OpenProcessToken] 07740108
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!OpenThreadToken] AC0FE856
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetServiceStatus] 8B590001
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegisterServiceCtrlHandlerW] 04C25EC6
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegCloseKey] 8B55C300
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegOpenKeyExW] 1475FFEC
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!StartServiceCtrlDispatcherW] FF1075FF
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!WideCharToMultiByte] 10C48308
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrlenW] 8B55C35D
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LocalFree] 1475FFEC
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentProcess] FF1075FF
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentThread] 75FF0C75
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetProcAddress] B108E808
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LoadLibraryExW] 458B0001
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LCMapStringW] F0A4E800
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!FreeLibrary] F18B0001
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrcpyW] E8F07589
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!ExpandEnvironmentStringsW] 0001A906
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrcmpiW] 00FC6583
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!ExitProcess] 8D0875FF
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCommandLineW] 06C70C4E
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!InitializeCriticalSection] [00439B90] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetProcessHeap] 001D67E8
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!SetErrorMode] E8C68B00
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!SetUnhandledExceptionFilter] 0001F156
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!RegisterWaitForSingleObject] 560004C2
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!InterlockedCompareExchange] 006AF18B
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LoadLibraryA] 4E8D016A
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!QueryPerformanceCounter] 9006C70C
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetTickCount] E800439B
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentThreadId] 000022DD
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentProcessId] E95ECE8B
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetSystemTimeAsFileTime] 0001A999
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!TerminateProcess] E8F18B56
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!UnhandledExceptionFilter] FFFFFFDB
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LocalAlloc] 082444F6
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrcmpW] 56077401
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!DelayLoadFailureHook] 01AB68E8
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!NtQuerySecurityObject] 0004C25E
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlFreeHeap] 9B9C01C7
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!NtOpenKey] BCE90043
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!wcscat] 56FFFFFF
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!wcscpy] 06C7F18B
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlAllocateHeap] [00439B9C] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlCompareUnicodeString] FFFFAEE8
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlInitUnicodeString] 2444F6FF
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlInitializeSid] 07740108
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlLengthRequiredSid] AB3BE856
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlSubAuthoritySid] 8B590001
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!NtClose] 04C25EC6
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlSubAuthorityCountSid] B8046A00
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlGetDaclSecurityDescriptor] [00433E58] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlQueryInformationAcl] 01F009E8
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlGetAce] 89F18B00
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlImageNtHeader] 7D8BF075
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!wcslen] DEE85708
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlUnhandledExceptionFilter] 830001A8
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlCopySid] 8300FC65
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerUnregisterIfEx] 06C70C4E
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcMgmtWaitServerListen] [00439B90] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcMgmtSetServerStackSize] 001CC7E8
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerUnregisterIf] E8C68B00
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerListen] 0001F0B6
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerUseProtseqEpW] 830004C2
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerRegisterIf] 60830020
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!I_RpcMapWin32Status] 0A8B0004
IAT C:\WINDOWS\System32\svchost.exe[1916] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcMgmtStopServerListening] 04728B56
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegQueryValueExW] 9B8401C7
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorDacl] 46E90043
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetEntriesInAclW] 560001AA
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorGroup] 06C7F18B
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorOwner] [00439B84] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!InitializeSecurityDescriptor] 01AA38E8
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!GetTokenInformation] 2444F600
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!OpenProcessToken] 07740108
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!OpenThreadToken] AC0FE856
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetServiceStatus] 8B590001
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegisterServiceCtrlHandlerW] 04C25EC6
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegCloseKey] 8B55C300
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegOpenKeyExW] 1475FFEC
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!StartServiceCtrlDispatcherW] FF1075FF
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!WideCharToMultiByte] 10C48308
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrlenW] 8B55C35D
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LocalFree] 1475FFEC
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentProcess] FF1075FF
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentThread] 75FF0C75
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetProcAddress] B108E808
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LoadLibraryExW] 458B0001
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LCMapStringW] F0A4E800
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!FreeLibrary] F18B0001
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrcpyW] E8F07589
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!ExpandEnvironmentStringsW] 0001A906
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrcmpiW] 00FC6583
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!ExitProcess] 8D0875FF
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCommandLineW] 06C70C4E
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!InitializeCriticalSection] [00439B90] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetProcessHeap] 001D67E8
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!SetErrorMode] E8C68B00
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!SetUnhandledExceptionFilter] 0001F156
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!RegisterWaitForSingleObject] 560004C2
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!InterlockedCompareExchange] 006AF18B
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LoadLibraryA] 4E8D016A
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!QueryPerformanceCounter] 9006C70C
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetTickCount] E800439B
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentThreadId] 000022DD
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentProcessId] E95ECE8B
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetSystemTimeAsFileTime] 0001A999
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!TerminateProcess] E8F18B56
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!UnhandledExceptionFilter] FFFFFFDB
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LocalAlloc] 082444F6
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrcmpW] 56077401
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!DelayLoadFailureHook] 01AB68E8
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!NtQuerySecurityObject] 0004C25E
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlFreeHeap] 9B9C01C7
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!NtOpenKey] BCE90043
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!wcscat] 56FFFFFF
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!wcscpy] 06C7F18B
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlAllocateHeap] [00439B9C] C:\WINDOWS\System32\svchost.exe (Generic Host
Nahoru
Marwin
Vzorný návštěvník
Vzorný návštěvník
Příspěvky: 92
Registrován: 01 bře 2007 13:33
Kontaktovat uživatele:
Kontaktovat uživatele Marwin

Re: Pro motji prosim o kontrolu

#4 Příspěvek od Marwin »

Process for Win32 Services/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlCompareUnicodeString] FFFFAEE8
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlInitUnicodeString] 2444F6FF
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlInitializeSid] 07740108
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlLengthRequiredSid] AB3BE856
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlSubAuthoritySid] 8B590001
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!NtClose] 04C25EC6
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlSubAuthorityCountSid] B8046A00
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlGetDaclSecurityDescriptor] [00433E58] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlQueryInformationAcl] 01F009E8
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlGetAce] 89F18B00
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlImageNtHeader] 7D8BF075
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!wcslen] DEE85708
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlUnhandledExceptionFilter] 830001A8
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlCopySid] 8300FC65
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerUnregisterIfEx] 06C70C4E
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcMgmtWaitServerListen] [00439B90] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcMgmtSetServerStackSize] 001CC7E8
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerUnregisterIf] E8C68B00
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerListen] 0001F0B6
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerUseProtseqEpW] 830004C2
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerRegisterIf] 60830020
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!I_RpcMapWin32Status] 0A8B0004
IAT C:\WINDOWS\System32\svchost.exe[1972] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcMgmtStopServerListening] 04728B56
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegQueryValueExW] [004005B8] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorDacl] 0008C280
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetEntriesInAclW] 83EC8B55
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorGroup] 75001C7D
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorOwner] 0C7D831E
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!InitializeSecurityDescriptor] 6A1E7501
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!GetTokenInformation] 03E86800
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!OpenProcessToken] [016A0000] C:\WINDOWS\system32\ieframe.dll (Internet Explorer/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!OpenThreadToken] FF0471FF
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetServiceStatus] 43A2B015
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegisterServiceCtrlHandlerW] 18458B00
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegCloseKey] 33002083
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegOpenKeyExW] 18C25DC0
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!StartServiceCtrlDispatcherW] 0C7D8100
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!WideCharToMultiByte] F0E85106
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrlenW] 8B00010D
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LocalFree] 20831845
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentProcess] 40C03300
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentThread] 006ADBEB
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetProcAddress] 436927B8
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LoadLibraryExW] 52ECE800
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LCMapStringW] 8B00FC65
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!FreeLibrary] C0852446
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrcpyW] 088B0A74
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!ExpandEnvironmentStringsW] 0851FF50
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrcmpiW] 00246683
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!ExitProcess] FFFC4D83
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCommandLineW] 8514768B
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!InitializeCriticalSection] 560674F6
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetProcessHeap] 0206E6E8
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!SetErrorMode] 5357E800
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!SetUnhandledExceptionFilter] 04C20002
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!RegisterWaitForSingleObject] F18B5600
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!InterlockedCompareExchange] FFB4E856
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LoadLibraryA] 44F6FFFF
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!QueryPerformanceCounter] 74010824
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetTickCount] A3E85607
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentThreadId] 5900020A
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentProcessId] C25EC68B
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetSystemTimeAsFileTime] 408B0004
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!TerminateProcess] 74C08514
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!UnhandledExceptionFilter] B4E85006
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LocalAlloc] C3000206
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrcmpW] 0824448B
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!DelayLoadFailureHook] 33002083
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!NtQuerySecurityObject] [004005B8] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlFreeHeap] 0018C280
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!NtOpenKey] [004005B8] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!wcscat] 0024C280
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!wcscpy] 1024448B
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlAllocateHeap] B8002083
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlCompareUnicodeString] 80004001
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlInitUnicodeString] 8B0010C2
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlInitializeSid] 83082444
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlLengthRequiredSid] 02B80020
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlSubAuthoritySid] C2800040
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!NtClose] C0330008
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlSubAuthorityCountSid] 0014C240
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlGetDaclSecurityDescriptor] 0824448B
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlQueryInformationAcl] 000440C7
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlGetAce] 33000002
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlImageNtHeader] 0008C2C0
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!wcslen] 18C2C033
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlUnhandledExceptionFilter] 40C03300
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlCopySid] 330008C2
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerUnregisterIfEx] 4001B800
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcMgmtWaitServerListen] 0CC28000
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcMgmtSetServerStackSize] 24448B00
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerUnregisterIf] 0020830C
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerListen] [004001B8] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerUseProtseqEpW] 000CC280
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerRegisterIf] 51EC8B55
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!I_RpcMapWin32Status] [00FC6583] C:\WINDOWS\system32\msls31.dll (Microsoft Line Services library file/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[2100] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcMgmtStopServerListening] FC458D56
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegQueryValueExW] [004005B8] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorDacl] 0008C280
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetEntriesInAclW] 83EC8B55
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorGroup] 75001C7D
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorOwner] 0C7D831E
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!InitializeSecurityDescriptor] 6A1E7501
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!GetTokenInformation] 03E86800
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!OpenProcessToken] 016A0000
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!OpenThreadToken] FF0471FF
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetServiceStatus] 43A2B015
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegisterServiceCtrlHandlerW] 18458B00
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegCloseKey] 33002083
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegOpenKeyExW] 18C25DC0
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!StartServiceCtrlDispatcherW] 0C7D8100
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!WideCharToMultiByte] F0E85106
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrlenW] 8B00010D
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LocalFree] 20831845
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentProcess] 40C03300
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentThread] 006ADBEB
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetProcAddress] 436927B8
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LoadLibraryExW] 52ECE800
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LCMapStringW] 8B00FC65
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!FreeLibrary] C0852446
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrcpyW] 088B0A74
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!ExpandEnvironmentStringsW] 0851FF50
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrcmpiW] 00246683
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!ExitProcess] FFFC4D83
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCommandLineW] 8514768B
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!InitializeCriticalSection] 560674F6
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetProcessHeap] 0206E6E8
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!SetErrorMode] 5357E800
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!SetUnhandledExceptionFilter] 04C20002
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!RegisterWaitForSingleObject] F18B5600
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!InterlockedCompareExchange] FFB4E856
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LoadLibraryA] 44F6FFFF
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!QueryPerformanceCounter] 74010824
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetTickCount] A3E85607
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentThreadId] 5900020A
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentProcessId] C25EC68B
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetSystemTimeAsFileTime] 408B0004
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!TerminateProcess] 74C08514
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!UnhandledExceptionFilter] B4E85006
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LocalAlloc] C3000206
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrcmpW] 0824448B
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!DelayLoadFailureHook] 33002083
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!NtQuerySecurityObject] [004005B8] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlFreeHeap] 0018C280
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!NtOpenKey] [004005B8] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!wcscat] 0024C280
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!wcscpy] 1024448B
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlAllocateHeap] B8002083
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlCompareUnicodeString] 80004001
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlInitUnicodeString] 8B0010C2
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlInitializeSid] 83082444
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlLengthRequiredSid] 02B80020
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlSubAuthoritySid] C2800040
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!NtClose] C0330008
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlSubAuthorityCountSid] 0014C240
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlGetDaclSecurityDescriptor] 0824448B
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlQueryInformationAcl] 000440C7
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlGetAce] 33000002
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlImageNtHeader] 0008C2C0
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!wcslen] 18C2C033
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlUnhandledExceptionFilter] 40C03300
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlCopySid] 330008C2
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerUnregisterIfEx] 4001B800
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcMgmtWaitServerListen] 0CC28000
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcMgmtSetServerStackSize] 24448B00
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerUnregisterIf] 0020830C
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerListen] [004001B8] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerUseProtseqEpW] 000CC280
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerRegisterIf] 51EC8B55
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!I_RpcMapWin32Status] 00FC6583
IAT C:\WINDOWS\System32\svchost.exe[2108] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcMgmtStopServerListening] FC458D56

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)

Device \Driver\NDIS \Device\Ndis [82EE9982] NDIS.sys[.reloc]

AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)

---- Files - GMER 1.0.15 ----

File C:\WINDOWS\system32\dllcache\ndis.sys (size mismatch) 212480/182912 bytes executable
File C:\WINDOWS\system32\drivers\ndis.sys (size mismatch) 212480/182912 bytes executable

---- EOF - GMER 1.0.15 ----


a log mbr :arrow:

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.6 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe >>UNKNOWN [0x82F0F530]<<
kernel: MBR read successfully
user & kernel MBR OK
Nahoru
Uživatelský avatar
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 říj 2008 08:02

Re: Pro motji prosim o kontrolu

#5 Příspěvek od motji »

:arrow: Stáhněte SystemLook
http://jpshortstuff.247fixes.com/SystemLook.exe

-uložte ho na plochu a spustte.
-do okénka zkopírujte

Kód: Vybrat vše

:filefind
ndis.sys
_uninst_setup_9.0.0.722_27.01.2010_14-27.exe.bat
-klikněte na Look, proběhne sken, na konci se zobrazí log, jehož obsah zkopírujete sem
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
Marwin
Vzorný návštěvník
Vzorný návštěvník
Příspěvky: 92
Registrován: 01 bře 2007 13:33
Kontaktovat uživatele:
Kontaktovat uživatele Marwin

Re: Pro motji prosim o kontrolu

#6 Příspěvek od Marwin »

SystemLook v1.0 by jpshortstuff (11.01.10)
Log created at 16:12 on 28/01/2010 by Karel (Administrator - Elevation successful)

========== filefind ==========

Searching for "ndis.sys"
C:\WINDOWS\system32\dllcache\ndis.sys --a--c 182912 bytes [21:14 03/08/2004] [11:07 02/01/2003] 558635D3AF1C7546D26067D5D9B6959E
C:\WINDOWS\system32\drivers\ndis.sys --a--- 182912 bytes [21:14 03/08/2004] [11:07 02/01/2003] 558635D3AF1C7546D26067D5D9B6959E

Searching for "_uninst_setup_9.0.0.722_27.01.2010_14-27.exe.bat"
No files found.

-=End Of File=-
Nahoru
Uživatelský avatar
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 říj 2008 08:02

Re: Pro motji prosim o kontrolu

#7 Příspěvek od motji »

Máte po ruce pc se Windows XP Professional Service Pack 2?
Potřebujeme tento soubor C:\WINDOWS\system32\drivers\ndis.sys.
Pokud nemáte, zkusím sehnat :) .

Nebo zkuste doinstalovat sp3, soubor by se měl přepsat.
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
Marwin
Vzorný návštěvník
Vzorný návštěvník
Příspěvky: 92
Registrován: 01 bře 2007 13:33
Kontaktovat uživatele:
Kontaktovat uživatele Marwin

Re: Pro motji prosim o kontrolu

#8 Příspěvek od Marwin »

instalacku mam to neni problem,takze z instalacky mam ten soubor nahradit?
Nahoru
Uživatelský avatar
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 říj 2008 08:02

Re: Pro motji prosim o kontrolu

#9 Příspěvek od motji »

Počkejte, ještě něco zkusíme, jestli combofix nenajde čistý soubor v bodu obnovení :)

:arrow: Pokud nemáte, přesuňte Combofix na plochu
-otevřete si Poznámkový blok
-Do něj zkopírujte text z tohoto okénka

Kód: Vybrat vše

srpeek::
c:\windows\system32\drivers\ndis.sys
c:\windows\system32\dllcache\ndis.sys
Restore::
c:\windows\system32\drivers\ndis.sys
c:\windows\system32\dllcache\ndis.sys
-uložte Vámi vytvořený TXT soubor jako CFScript.txt na plochu
-po uložení uchopte vámi vytvořený skript levým myšítkem a -přesuňte ho nad ikonu Combofixu, kde ho upustíte:

Obrázek


-po aplikaci na Vás vypadne další log,vložte ho sem

Upozornění : může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou, v tom případě znovu restartujte a přitom mačkejte F8, pak zvolte Poslední známou funkční konfiguraci
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
Marwin
Vzorný návštěvník
Vzorný návštěvník
Příspěvky: 92
Registrován: 01 bře 2007 13:33
Kontaktovat uživatele:
Kontaktovat uživatele Marwin

Re: Pro motji prosim o kontrolu

#10 Příspěvek od Marwin »

ComboFix 10-01-27.06 - Karel 28.01.2010 16:39:30.4.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.767.563 [GMT 1:00]
Spuštěný z: c:\documents and settings\Karel\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Karel\Plocha\CFScript.txt
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\dllcache\ndis.sys . . . je infikován!!

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-12-28 do 2010-01-28 )))))))))))))))))))))))))))))))
.

2010-01-28 08:32 . 2010-01-28 08:33 -------- d-----w- C:\totalcmd
2010-01-28 08:32 . 2009-09-09 06:50 545 ----a-w- c:\windows\UC.PIF
2010-01-28 08:32 . 2009-09-09 06:50 545 ----a-w- c:\windows\RAR.PIF
2010-01-28 08:32 . 2009-09-09 06:50 545 ----a-w- c:\windows\PKZIP.PIF
2010-01-28 08:32 . 2009-09-09 06:50 545 ----a-w- c:\windows\PKUNZIP.PIF
2010-01-28 08:32 . 2009-09-09 06:50 545 ----a-w- c:\windows\NOCLOSE.PIF
2010-01-28 08:32 . 2009-09-09 06:50 545 ----a-w- c:\windows\LHA.PIF
2010-01-28 08:32 . 2009-09-09 06:50 545 ----a-w- c:\windows\ARJ.PIF
2010-01-27 16:02 . 2010-01-27 16:02 -------- d-----w- c:\program files\trend micro
2010-01-27 16:02 . 2010-01-27 16:02 -------- d-----w- C:\rsit
2010-01-27 10:09 . 2010-01-27 10:09 -------- d-----w- c:\program files\Lavalys
2010-01-26 15:53 . 2010-01-26 15:53 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2010-01-26 12:42 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-26 12:42 . 2010-01-26 12:43 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-26 12:42 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-27 14:31 . 2003-01-02 10:16 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-01-27 14:31 . 2003-01-02 10:16 2426 ----a-w- c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2010-01-27 14:21 . 2003-01-02 10:17 8972 ----a-w- c:\windows\pchealth\helpctr\Config\Cntstore.bin
2010-01-26 15:10 . 2003-01-02 20:19 -------- d-----w- c:\program files\Google
2010-01-26 14:35 . 2003-01-02 20:36 -------- d-----w- c:\program files\Alwil Software
2010-01-19 13:13 . 2003-01-02 20:37 162640 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-01-19 11:57 . 2003-01-02 20:37 38848 ----a-w- c:\windows\system32\avastSS.scr
2010-01-19 11:57 . 2003-01-02 20:36 152672 ----a-w- c:\windows\system32\aswBoot.exe
2010-01-19 11:46 . 2003-01-02 20:37 46544 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-01-19 11:43 . 2003-01-02 20:37 23248 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-01-19 11:43 . 2003-01-02 20:37 100304 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-01-19 11:43 . 2003-01-02 20:37 94672 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-01-19 11:42 . 2003-01-02 20:37 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-01-19 11:42 . 2003-01-02 20:37 28240 ----a-w- c:\windows\system32\drivers\aavmker4.sys
.

(((((((((((((((((((((((((((((((((((((((((( SR_Search ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
------- Sigcheck -------

[-] 2003-01-02 . 558635D3AF1C7546D26067D5D9B6959E . 212480 . . [5.1.2600.2180] . . c:\windows\system32\drivers\ndis.sys
.
((((((((((((((((((((((((((((( SnapShot@2010-01-26_12.30.01 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-11 23:02 . 2009-07-11 23:02 51008 c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa\vcomp90.dll
+ 2009-07-11 23:02 . 2009-07-11 23:02 59728 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90rus.dll
+ 2009-07-11 23:02 . 2009-07-11 23:02 42832 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90kor.dll
+ 2009-07-11 23:02 . 2009-07-11 23:02 43344 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90jpn.dll
+ 2009-07-11 23:02 . 2009-07-11 23:02 61264 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90ita.dll
+ 2009-07-11 23:02 . 2009-07-11 23:02 36688 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90cht.dll
+ 2009-07-11 23:02 . 2009-07-11 23:02 35648 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90chs.dll
+ 2009-07-11 23:02 . 2009-07-11 23:02 62800 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90fra.dll
+ 2009-07-11 23:02 . 2009-07-11 23:02 61760 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esp.dll
+ 2009-07-11 23:02 . 2009-07-11 23:02 61776 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esn.dll
+ 2009-07-11 23:02 . 2009-07-11 23:02 53568 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90enu.dll
+ 2009-07-11 23:02 . 2009-07-11 23:02 63296 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90deu.dll
+ 2009-07-11 23:05 . 2009-07-11 23:05 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90u.dll
+ 2009-07-11 23:05 . 2009-07-11 23:05 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90.dll
- 2003-01-02 10:24 . 2003-01-02 11:19 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2003-01-02 10:24 . 2010-01-26 15:51 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2010-01-26 15:52 . 2010-01-26 15:51 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012010012620100127\index.dat
+ 2003-01-02 10:24 . 2010-01-26 15:51 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2003-01-02 10:24 . 2003-01-02 11:19 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2010-01-26 15:53 . 2010-01-26 15:52 16384 c:\windows\system32\config\systemprofile\IETldCache\index.dat
+ 2010-01-26 15:51 . 2010-01-26 15:52 5120 c:\windows\system32\config\systemprofile\Local Settings\Data aplikací\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{A7826D93-0A92-11DF-AABD-0040CA6A3274}.dat
+ 2010-01-26 15:51 . 2010-01-26 15:51 5120 c:\windows\system32\config\systemprofile\Local Settings\Data aplikací\Microsoft\Internet Explorer\Recovery\Active\{A7826D94-0A92-11DF-AABD-0040CA6A3274}.dat
+ 2009-07-11 23:02 . 2009-07-11 23:02 653120 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcr90.dll
+ 2009-07-11 23:02 . 2009-07-11 23:02 569664 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcp90.dll
+ 2009-07-11 23:05 . 2009-07-11 23:05 225280 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcm90.dll
+ 2009-07-11 23:02 . 2009-07-11 23:02 159032 c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2\atl90.dll
+ 2010-01-26 14:33 . 2010-01-26 14:33 219648 c:\windows\Installer\1a4972.msi
+ 2009-07-11 23:02 . 2009-07-11 23:02 3780424 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90u.dll
+ 2009-07-11 23:02 . 2009-07-11 23:02 3765048 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-10-09 25623336]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 90112]
"SoundMan"="SOUNDMAN.EXE" [2006-03-01 577536]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 32768]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-01-19 2743104]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-17 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-18 65588]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2.1.2003 21:37 162640]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2.1.2003 21:37 19024]
R4 atidgllk;atidgllk;c:\windows\atidgllk.sys [2.1.2003 20:46 5376]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-28 16:46
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe >>UNKNOWN [0x82F3B530]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf7592fc3
\Driver\ACPI -> ACPI.sys @ 0xf74e5cb8
\Driver\atapi -> atapi.sys @ 0xf74777b4
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a1afe
ParseProcedure -> ntoskrnl.exe @ 0x80570a6e
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a1afe
ParseProcedure -> ntoskrnl.exe @ 0x80570a6e
NDIS: Realtek RTL8139 Family PCI Fast Ethernet NIC -> SendCompleteHandler -> NDIS.sys @ 0x82ed6bc3
PacketIndicateHandler -> NDIS.sys @ 0x82ee2b21
SendHandler -> NDIS.sys @ 0x82ed6d33
user & kernel MBR OK

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(640)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(4692)
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files\ATI Technologies\ATI.ACE\CLI.EXE
c:\windows\SOUNDMAN.EXE
c:\windows\ATKKBService.exe
c:\windows\system32\wscntfy.exe
c:\program files\ATI Technologies\ATI.ACE\cli.exe
c:\program files\ATI Technologies\ATI.ACE\cli.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Celkový čas: 2010-01-28 16:50:22 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-01-28 15:50
ComboFix2.txt 2010-01-27 12:14
ComboFix3.txt 2010-01-27 10:33
ComboFix4.txt 2010-01-26 12:34

Před spuštěním: Volných bajtů: 75 717 619 712
Po spuštění: Volných bajtů: 75 689 127 936

- - End Of File - - F942D67566222D59C3CA280C3E3B32AF
Nahoru
Uživatelský avatar
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 říj 2008 08:02

Re: Pro motji prosim o kontrolu

#11 Příspěvek od motji »

Dokážete ten ndis .sys nahradit z instalačního cd? :) , ale musí to být stejný OS a sp.
Nebo doinstalujte ten sp3.

Až ho nahradíte, spustte ještě AVPtool

:arrow: Stahněte z mého podpisu AVPTOOl http://www.viry.cz/forum/viewtopic.php?f=29&t=58179

-Podle návodu nainstalujte a proveďte sken
-co najde nechejte léčit, mazat
-sken může trvat několik hodin
-vložte zde log z výsledky
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
Marwin
Vzorný návštěvník
Vzorný návštěvník
Příspěvky: 92
Registrován: 01 bře 2007 13:33
Kontaktovat uživatele:
Kontaktovat uživatele Marwin

Re: Pro motji prosim o kontrolu

#12 Příspěvek od Marwin »

jj dokazu to neni problem,zejtra se nato vrhnu a poslu log,snad ho zase neco hned nenakazi
Nahoru
Uživatelský avatar
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 říj 2008 08:02

Re: Pro motji prosim o kontrolu

#13 Příspěvek od motji »

Přepište čistou kopií oba soubory
c:\windows\system32\drivers\ndis.sys
c:\windows\system32\dllcache\ndis.sys

Zítra uvidíme, jak to bude s počítačem vypadat :)
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
Marwin
Vzorný návštěvník
Vzorný návštěvník
Příspěvky: 92
Registrován: 01 bře 2007 13:33
Kontaktovat uživatele:
Kontaktovat uživatele Marwin

Re: Pro motji prosim o kontrolu

#14 Příspěvek od Marwin »

Zdravim tak ty soubory sem nahradil ale ted mi nejde preinstalovat a ani nainstalovat sitovka pise to hlasku ze ovladac chybi nebo je poskozen, log z AVPTool dodam hned jak to pujde.
Nahoru
Uživatelský avatar
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 říj 2008 08:02

Re: Pro motji prosim o kontrolu

#15 Příspěvek od motji »

:o ten soubor co jste přepisoval, patří k síťovce. Přepsal jste ho stejnou verzí? bylo to instalační cd xp profesional sp2?
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
Odpovědět

Zpět na „Řešení problémů, logy“