INF/Conficker worm a Win32/Conficker.AA worm na externim HDD

[vlachuj]

Zdravím
na externím HDD mám 2 viry
1. je v souboru autorun.inf
2. je nekde zahrabany v souboru jwgkvsq.vmx

1. INF/Conficker worm

Kód: Vybrat vše

H:\autorun.inf - INF/Conficker worm - cleaned by deleting (after the next restart) - quarantined [1,2]

2. Win32/Conficker.AA worm

Kód: Vybrat vše

H:\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx - a variant of Win32/Conficker.AA worm - cleaned by deleting (after the next restart) - quarantined [1,2]

Problém je ten že ho nod najde, nepustí do počítače ale neumí ho smazat...

Poradil by mi někdo jak je dostat pryč?

[Caroprd111]

Zdravím

Dejte log z RSIT http://www.viry.cz/forum/viewtopic.php?f=13&t=82743

[vlachuj]

Logfile of random's system information tool 1.06 (written by random/random)
Run by Vlachos at 2010-03-02 15:32:15
Microsoft Windows 7 Professional Service Pack 2
System drive C: has 55 GB (79%) free of 70 GB
Total RAM: 2046 MB (66% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:32:19, on 2.3.2010
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.Exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Users\Vlachos\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Vlachos\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\taskeng.exe
C:\Users\Vlachos\Documents\Downloads\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Vlachos.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qip.ru
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://qip.ru
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Zobrazit nebo skrýt HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: Apache2.2 - Apache Software Foundation - C:\Program Files\Apache Software Foundation\Apache2.2\bin\httpd.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

--
End of file - 4701 bytes

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-233495617-3522456307-960355657-1000Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-233495617-3522456307-960355657-1000UA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0347C33E-8762-4905-BF09-768834316C61}]
HP Print Enhancer - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll [2009-09-20 328248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-12-21 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-02-21 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856}]
HP Smart BHO Class - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2009-09-20 509496]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2009-09-29 2054360]
"SpywareTerminator"=C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe [2010-03-01 2166784]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\EFS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Power]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\RpcEptMapper]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vmms]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AppInfo]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\BFE]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\bowser]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\dfsc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Dot3Svc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Eaphost]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\EFS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\IKEEXT]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\KeyIso]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MPSDrv]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MPSSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mrxsmb]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mrxsmb10]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mrxsmb20]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NativeWifiP]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\ndiscap]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\netprofm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NlaSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Nsi]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nsiproxy.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NTDS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PolicyAgent]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Power]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\ProfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\rdbss]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\rdpencdd.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\RpcEptMapper]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sacsvr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SCardSvr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SWPRV]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TabletInputService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TBS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TrustedInstaller]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\VaultSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\VDS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vmms]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\volmgr.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\volmgrx.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wlansvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{50DD5230-BA8A-11D1-BF5D-0000F805F530}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{661befab-1ecd-11df-9c99-001fc66da06b}]
shell\AutoRun\command - F:\SETUP.EXE
shell\configure\command - F:\SETUP.EXE
shell\install\command - F:\SETUP.EXE


======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-03-02 14:30:09 ----D---- C:\rsit
2010-03-02 13:33:08 ----D---- C:\Program Files\Trend Micro
2010-03-02 12:32:51 ----D---- C:\ProgramData\Spybot - Search & Destroy
2010-03-02 12:32:51 ----D---- C:\Program Files\Spybot - Search & Destroy
2010-03-02 12:14:16 ----A---- C:\Windows\ntbtlog.txt
2010-03-02 10:55:25 ----D---- C:\Program Files\Common Files\EZB Systems
2010-03-02 10:55:21 ----D---- C:\Program Files\UltraISO
2010-03-01 20:56:42 ----D---- C:\Program Files\WinClamAVShield
2010-03-01 20:09:59 ----D---- C:\Users\Vlachos\AppData\Roaming\Spyware Terminator
2010-03-01 20:09:32 ----D---- C:\ProgramData\Spyware Terminator
2010-03-01 20:09:28 ----D---- C:\Program Files\Spyware Terminator
2010-03-01 19:14:53 ----D---- C:\Program Files\CCleaner
2010-03-01 09:53:53 ----A---- C:\Windows\system32\acaptuser32.dll
2010-02-26 15:17:07 ----D---- C:\Program Files\Apache Software Foundation
2010-02-23 23:06:11 ----D---- C:\Program Files\MediaCoder
2010-02-23 22:59:12 ----A---- C:\Windows\system32\jscript.dll
2010-02-23 22:59:10 ----A---- C:\Windows\system32\psisdecd.dll
2010-02-23 22:59:10 ----A---- C:\Windows\system32\msdri.dll
2010-02-23 22:59:10 ----A---- C:\Windows\system32\CPFilters.dll
2010-02-23 22:59:09 ----A---- C:\Windows\system32\tzres.dll
2010-02-23 22:58:24 ----D---- C:\Users\Vlachos\AppData\Roaming\Mozilla
2010-02-23 22:41:16 ----D---- C:\Users\Vlachos\AppData\Roaming\Broad Intelligence
2010-02-22 18:44:11 ----D---- C:\Users\Vlachos\AppData\Roaming\WinRAR
2010-02-22 14:21:07 ----D---- C:\Users\Vlachos\AppData\Roaming\Media Player Classic
2010-02-21 22:46:30 ----A---- C:\Windows\system32\rmoc3260.dll
2010-02-21 22:46:30 ----A---- C:\Windows\system32\pndx5032.dll
2010-02-21 22:46:30 ----A---- C:\Windows\system32\pndx5016.dll
2010-02-21 22:46:30 ----A---- C:\Windows\system32\pncrt.dll
2010-02-21 22:46:26 ----A---- C:\Windows\system32\unrar.dll
2010-02-21 22:46:25 ----A---- C:\Windows\avisplitter.ini
2010-02-21 22:46:17 ----A---- C:\Windows\system32\yv12vfw.dll
2010-02-21 22:46:16 ----A---- C:\Windows\system32\xvidvfw.dll
2010-02-21 22:46:16 ----A---- C:\Windows\system32\xvidcore.dll
2010-02-21 22:46:13 ----A---- C:\Windows\system32\qt-dx331.dll
2010-02-21 22:46:13 ----A---- C:\Windows\system32\dpl100.dll
2010-02-21 22:46:05 ----A---- C:\Windows\system32\divx.dll
2010-02-21 22:46:02 ----A---- C:\Windows\system32\ff_vfw.dll.manifest
2010-02-21 22:46:02 ----A---- C:\Windows\system32\ff_vfw.dll
2010-02-21 22:45:57 ----D---- C:\Program Files\K-Lite Codec Pack
2010-02-21 21:11:39 ----D---- C:\ProgramData\FLEXnet
2010-02-21 19:07:09 ----D---- C:\Program Files\MSXML 4.0
2010-02-21 18:34:31 ----D---- C:\Program Files\Microsoft Works
2010-02-21 18:34:21 ----D---- C:\Program Files\Microsoft Visual Studio
2010-02-21 18:34:21 ----D---- C:\Program Files\Common Files\DESIGNER
2010-02-21 18:34:13 ----D---- C:\Windows\PCHEALTH
2010-02-21 18:34:13 ----D---- C:\Program Files\Microsoft.NET
2010-02-21 18:32:05 ----D---- C:\ProgramData\Microsoft Help
2010-02-21 18:32:05 ----D---- C:\Program Files\Microsoft Office
2010-02-21 18:31:47 ----RHD---- C:\MSOCache
2010-02-21 17:38:35 ----D---- C:\Program Files\PDF Editor 3
2010-02-21 17:38:35 ----A---- C:\Windows\cadkasdeinst01e.exe
2010-02-21 17:37:58 ----D---- C:\Windows\system32\appmgmt
2010-02-21 16:51:29 ----D---- C:\ProgramData\Sun
2010-02-21 16:51:28 ----D---- C:\Program Files\Common Files\Java
2010-02-21 16:51:14 ----A---- C:\Windows\system32\javaws.exe
2010-02-21 16:51:14 ----A---- C:\Windows\system32\javaw.exe
2010-02-21 16:51:14 ----A---- C:\Windows\system32\java.exe
2010-02-21 16:51:14 ----A---- C:\Windows\system32\deploytk.dll
2010-02-21 16:51:07 ----D---- C:\Program Files\Java
2010-02-21 15:48:06 ----D---- C:\Program Files\Free Screen Recorder
2010-02-21 15:23:36 ----A---- C:\Windows\system32\msv1_0.dll
2010-02-21 15:22:50 ----A---- C:\Windows\system32\MRT.exe
2010-02-21 15:20:24 ----A---- C:\Windows\system32\mshtml.dll
2010-02-21 15:20:21 ----A---- C:\Windows\system32\urlmon.dll
2010-02-21 15:20:21 ----A---- C:\Windows\system32\ieframe.dll
2010-02-21 15:20:20 ----A---- C:\Windows\system32\wininet.dll
2010-02-21 15:20:20 ----A---- C:\Windows\system32\iedkcs32.dll
2010-02-21 15:20:19 ----A---- C:\Windows\system32\msfeedsbs.dll
2010-02-21 15:20:07 ----A---- C:\Windows\system32\wmp.dll
2010-02-21 15:20:04 ----A---- C:\Windows\system32\CertEnroll.dll
2010-02-21 15:20:03 ----A---- C:\Windows\system32\winload.exe
2010-02-21 15:20:01 ----A---- C:\Windows\system32\winresume.exe
2010-02-21 15:19:59 ----A---- C:\Windows\system32\wmploc.DLL
2010-02-21 15:19:56 ----A---- C:\Windows\system32\quartz.dll
2010-02-21 15:19:55 ----A---- C:\Windows\system32\msvidc32.dll
2010-02-21 15:19:55 ----A---- C:\Windows\system32\mciavi32.dll
2010-02-21 15:19:55 ----A---- C:\Windows\system32\avifil32.dll
2010-02-21 15:19:54 ----A---- C:\Windows\system32\tsbyuv.dll
2010-02-21 15:19:54 ----A---- C:\Windows\system32\msyuv.dll
2010-02-21 15:19:54 ----A---- C:\Windows\system32\msrle32.dll
2010-02-21 15:19:54 ----A---- C:\Windows\system32\iyuv_32.dll
2010-02-21 15:19:51 ----A---- C:\Windows\system32\winlogon.exe
2010-02-21 15:19:51 ----A---- C:\Windows\explorer.exe
2010-02-21 15:19:49 ----A---- C:\Windows\system32\msasn1.dll
2010-02-21 15:19:47 ----A---- C:\Windows\system32\t2embed.dll
2010-02-21 15:19:47 ----A---- C:\Windows\system32\fontsub.dll
2010-02-21 15:19:47 ----A---- C:\Windows\system32\atmfd.dll
2010-02-21 15:19:42 ----A---- C:\Windows\system32\secproc_isv.dll
2010-02-21 15:19:41 ----A---- C:\Windows\system32\secproc.dll
2010-02-21 15:19:41 ----A---- C:\Windows\system32\RMActivate_isv.exe
2010-02-21 15:19:41 ----A---- C:\Windows\system32\RMActivate.exe
2010-02-21 15:19:40 ----A---- C:\Windows\system32\secproc_ssp_isv.dll
2010-02-21 15:19:40 ----A---- C:\Windows\system32\secproc_ssp.dll
2010-02-21 15:19:40 ----A---- C:\Windows\system32\RMActivate_ssp_isv.exe
2010-02-21 15:19:39 ----A---- C:\Windows\system32\RMActivate_ssp.exe
2010-02-21 14:51:50 ----D---- C:\Program Files\Steam
2010-02-21 14:45:00 ----D---- C:\Program Files\Common Files\Steam
2010-02-21 14:43:44 ----A---- C:\Windows\system32\D3DX9_39.dll
2010-02-21 14:43:44 ----A---- C:\Windows\system32\d3dx10_39.dll
2010-02-21 14:43:44 ----A---- C:\Windows\system32\D3DCompiler_39.dll
2010-02-21 13:15:00 ----D---- C:\Users\Vlachos\AppData\Roaming\Mikrotik
2010-02-21 12:50:32 ----A---- C:\Windows\system32\vbzlib1.dll
2010-02-21 12:50:29 ----D---- C:\Program Files\DsNET Corp
2010-02-21 12:12:41 ----D---- C:\Users\Vlachos\AppData\Roaming\HP
2010-02-21 12:12:41 ----D---- C:\ProgramData\WEBREG
2010-02-21 11:40:08 ----D---- C:\ProgramData\Hewlett-Packard
2010-02-21 11:14:55 ----D---- C:\ProgramData\HP Product Assistant
2010-02-21 11:14:07 ----D---- C:\Program Files\Common Files\HP
2010-02-21 11:14:00 ----D---- C:\Program Files\Common Files\Hewlett-Packard
2010-02-21 11:13:23 ----HD---- C:\Config.Msi
2010-02-21 11:13:23 ----D---- C:\Program Files\HP
2010-02-21 11:12:35 ----D---- C:\ProgramData\HP
2010-02-21 11:12:17 ----A---- C:\Windows\system32\hpzids01.dll
2010-02-21 11:12:17 ----A---- C:\Windows\system32\hppldcoi.dll
2010-02-21 11:12:17 ----A---- C:\Windows\system32\hpowiax8.dll
2010-02-21 11:12:17 ----A---- C:\Windows\system32\hpovst14.dll
2010-02-21 11:12:17 ----A---- C:\Windows\system32\hpotiop6.dll
2010-02-21 11:00:08 ----A---- C:\Windows\system32\XAudio2_6.dll
2010-02-21 11:00:08 ----A---- C:\Windows\system32\XAPOFX1_4.dll
2010-02-21 11:00:08 ----A---- C:\Windows\system32\xactengine3_6.dll
2010-02-21 11:00:08 ----A---- C:\Windows\system32\X3DAudio1_7.dll
2010-02-21 11:00:07 ----A---- C:\Windows\system32\XAudio2_5.dll
2010-02-21 11:00:07 ----A---- C:\Windows\system32\xactengine3_5.dll
2010-02-21 11:00:07 ----A---- C:\Windows\system32\d3dx11_42.dll
2010-02-21 11:00:07 ----A---- C:\Windows\system32\d3dcsx_42.dll
2010-02-21 11:00:07 ----A---- C:\Windows\system32\D3DCompiler_42.dll
2010-02-21 11:00:06 ----A---- C:\Windows\system32\XAudio2_4.dll
2010-02-21 11:00:06 ----A---- C:\Windows\system32\XAPOFX1_3.dll
2010-02-21 11:00:06 ----A---- C:\Windows\system32\D3DX9_42.dll
2010-02-21 11:00:06 ----A---- C:\Windows\system32\D3DX9_41.dll
2010-02-21 11:00:06 ----A---- C:\Windows\system32\d3dx10_42.dll
2010-02-21 11:00:06 ----A---- C:\Windows\system32\d3dx10_41.dll
2010-02-21 11:00:06 ----A---- C:\Windows\system32\D3DCompiler_41.dll
2010-02-21 11:00:05 ----A---- C:\Windows\system32\XAudio2_3.dll
2010-02-21 11:00:05 ----A---- C:\Windows\system32\XAudio2_2.dll
2010-02-21 11:00:05 ----A---- C:\Windows\system32\XAPOFX1_2.dll
2010-02-21 11:00:05 ----A---- C:\Windows\system32\XAPOFX1_1.dll
2010-02-21 11:00:05 ----A---- C:\Windows\system32\xactengine3_4.dll
2010-02-21 11:00:05 ----A---- C:\Windows\system32\xactengine3_3.dll
2010-02-21 11:00:05 ----A---- C:\Windows\system32\xactengine3_2.dll
2010-02-21 11:00:05 ----A---- C:\Windows\system32\X3DAudio1_6.dll
2010-02-21 11:00:05 ----A---- C:\Windows\system32\X3DAudio1_5.dll
2010-02-21 11:00:05 ----A---- C:\Windows\system32\D3DX9_40.dll
2010-02-21 11:00:05 ----A---- C:\Windows\system32\d3dx10_40.dll
2010-02-21 11:00:05 ----A---- C:\Windows\system32\D3DCompiler_40.dll
2010-02-21 11:00:04 ----A---- C:\Windows\system32\XAudio2_1.dll
2010-02-21 11:00:04 ----A---- C:\Windows\system32\XAudio2_0.dll
2010-02-21 11:00:04 ----A---- C:\Windows\system32\XAPOFX1_0.dll
2010-02-21 11:00:04 ----A---- C:\Windows\system32\xactengine3_1.dll
2010-02-21 11:00:04 ----A---- C:\Windows\system32\xactengine3_0.dll
2010-02-21 11:00:04 ----A---- C:\Windows\system32\X3DAudio1_4.dll
2010-02-21 11:00:04 ----A---- C:\Windows\system32\X3DAudio1_3.dll
2010-02-21 11:00:04 ----A---- C:\Windows\system32\D3DX9_38.dll
2010-02-21 11:00:04 ----A---- C:\Windows\system32\d3dx10_38.dll
2010-02-21 11:00:04 ----A---- C:\Windows\system32\D3DCompiler_38.dll
2010-02-21 11:00:03 ----A---- C:\Windows\system32\xactengine2_10.dll
2010-02-21 11:00:03 ----A---- C:\Windows\system32\D3DX9_37.dll
2010-02-21 11:00:03 ----A---- C:\Windows\system32\d3dx9_36.dll
2010-02-21 11:00:03 ----A---- C:\Windows\system32\d3dx10_37.dll
2010-02-21 11:00:03 ----A---- C:\Windows\system32\d3dx10_36.dll
2010-02-21 11:00:03 ----A---- C:\Windows\system32\D3DCompiler_37.dll
2010-02-21 11:00:03 ----A---- C:\Windows\system32\D3DCompiler_36.dll
2010-02-21 11:00:02 ----A---- C:\Windows\system32\xactengine2_9.dll
2010-02-21 11:00:02 ----A---- C:\Windows\system32\xactengine2_8.dll
2010-02-21 11:00:02 ----A---- C:\Windows\system32\X3DAudio1_2.dll
2010-02-21 11:00:02 ----A---- C:\Windows\system32\d3dx9_35.dll
2010-02-21 11:00:02 ----A---- C:\Windows\system32\d3dx9_34.dll
2010-02-21 11:00:02 ----A---- C:\Windows\system32\d3dx10_35.dll
2010-02-21 11:00:02 ----A---- C:\Windows\system32\d3dx10_34.dll
2010-02-21 11:00:02 ----A---- C:\Windows\system32\D3DCompiler_35.dll
2010-02-21 11:00:02 ----A---- C:\Windows\system32\D3DCompiler_34.dll
2010-02-21 11:00:01 ----A---- C:\Windows\system32\xinput1_3.dll
2010-02-21 11:00:01 ----A---- C:\Windows\system32\xactengine2_7.dll
2010-02-21 11:00:01 ----A---- C:\Windows\system32\xactengine2_6.dll
2010-02-21 11:00:01 ----A---- C:\Windows\system32\d3dx9_33.dll
2010-02-21 11:00:01 ----A---- C:\Windows\system32\d3dx10_33.dll
2010-02-21 11:00:01 ----A---- C:\Windows\system32\D3DCompiler_33.dll
2010-02-21 11:00:00 ----A---- C:\Windows\system32\xactengine2_5.dll
2010-02-21 11:00:00 ----A---- C:\Windows\system32\xactengine2_4.dll
2010-02-21 11:00:00 ----A---- C:\Windows\system32\x3daudio1_1.dll
2010-02-21 11:00:00 ----A---- C:\Windows\system32\d3dx9_32.dll
2010-02-21 11:00:00 ----A---- C:\Windows\system32\d3dx9_31.dll
2010-02-21 11:00:00 ----A---- C:\Windows\system32\d3dx10.dll
2010-02-21 10:59:59 ----A---- C:\Windows\system32\xinput1_2.dll
2010-02-21 10:59:59 ----A---- C:\Windows\system32\xinput1_1.dll
2010-02-21 10:59:59 ----A---- C:\Windows\system32\xactengine2_3.dll
2010-02-21 10:59:59 ----A---- C:\Windows\system32\xactengine2_2.dll
2010-02-21 10:59:59 ----A---- C:\Windows\system32\xactengine2_1.dll
2010-02-21 10:59:57 ----A---- C:\Windows\system32\xactengine2_0.dll
2010-02-21 10:59:57 ----A---- C:\Windows\system32\x3daudio1_0.dll
2010-02-21 10:59:57 ----A---- C:\Windows\system32\d3dx9_30.dll
2010-02-21 10:59:57 ----A---- C:\Windows\system32\d3dx9_29.dll
2010-02-21 10:59:57 ----A---- C:\Windows\system32\d3dx9_28.dll
2010-02-21 10:59:57 ----A---- C:\Windows\system32\d3dx9_27.dll
2010-02-21 10:59:56 ----A---- C:\Windows\system32\d3dx9_26.dll
2010-02-21 10:59:56 ----A---- C:\Windows\system32\d3dx9_25.dll
2010-02-21 10:59:56 ----A---- C:\Windows\system32\d3dx9_24.dll
2010-02-21 10:57:24 ----D---- C:\Windows\system32\directx
2010-02-21 10:54:47 ----D---- C:\Users\Vlachos\AppData\Roaming\QipGuard
2010-02-21 10:54:46 ----D---- C:\Program Files\QIP Infium
2010-02-21 10:52:57 ----D---- C:\ProgramData\Adobe
2010-02-21 10:52:48 ----D---- C:\Program Files\Common Files\Adobe
2010-02-21 10:52:48 ----D---- C:\Program Files\Adobe
2010-02-21 10:49:47 ----D---- C:\Program Files\WinRAR
2010-02-21 10:49:28 ----D---- C:\Users\Vlachos\AppData\Roaming\Macromedia
2010-02-21 10:49:28 ----D---- C:\Users\Vlachos\AppData\Roaming\Adobe
2010-02-21 10:48:37 ----D---- C:\Windows\system32\Adobe
2010-02-21 10:48:33 ----D---- C:\Windows\system32\Macromed
2010-02-21 10:41:05 ----D---- C:\Program Files\DAEMON Tools Lite
2010-02-21 10:40:54 ----D---- C:\Users\Vlachos\AppData\Roaming\DAEMON Tools Lite
2010-02-21 10:40:43 ----D---- C:\ProgramData\DAEMON Tools Lite
2010-02-21 10:40:42 ----N---- C:\Windows\system32\MpSigStub.exe
2010-02-21 10:33:44 ----D---- C:\Users\Vlachos\AppData\Roaming\GHISLER
2010-02-21 10:33:44 ----D---- C:\Program Files\totalcmd
2010-02-21 10:17:36 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-02-21 10:17:08 ----D---- C:\ProgramData\ESET
2010-02-21 10:17:08 ----D---- C:\Program Files\ESET
2010-02-21 10:16:47 ----SHD---- C:\Windows\Installer
2010-02-21 10:13:03 ----D---- C:\Users\Vlachos\AppData\Roaming\Identities
2010-02-21 10:12:51 ----SD---- C:\Users\Vlachos\AppData\Roaming\Microsoft
2010-02-21 10:12:51 ----D---- C:\Users\Vlachos\AppData\Roaming\Media Center Programs
2010-02-21 10:11:00 ----SHD---- C:\Recovery
2010-02-21 10:11:00 ----SHD---- C:\ProgramData\Šablony
2010-02-21 10:11:00 ----SHD---- C:\ProgramData\Plocha
2010-02-21 10:11:00 ----SHD---- C:\ProgramData\Oblíbené položky
2010-02-21 10:11:00 ----SHD---- C:\ProgramData\Nabídka Start
2010-02-21 10:11:00 ----SHD---- C:\ProgramData\Dokumenty
2010-02-21 10:11:00 ----SHD---- C:\ProgramData\Data aplikací
2010-02-21 10:06:12 ----D---- C:\Windows\SoftwareDistribution
2010-02-21 10:03:32 ----D---- C:\Windows\Prefetch
2010-02-21 10:03:07 ----SHD---- C:\System Volume Information
2010-02-21 10:02:12 ----D---- C:\Windows\Panther

======List of files/folders modified in the last 1 months======

2010-03-02 15:32:19 ----D---- C:\Windows\Temp
2010-03-02 15:32:09 ----D---- C:\Windows\system32\Tasks
2010-03-02 14:38:53 ----D---- C:\Windows\system32\config
2010-03-02 14:25:42 ----D---- C:\Windows\system32\catroot2
2010-03-02 13:51:27 ----D---- C:\Windows
2010-03-02 13:33:08 ----RD---- C:\Program Files
2010-03-02 12:40:04 ----SD---- C:\ProgramData\Microsoft
2010-03-02 12:32:51 ----HD---- C:\ProgramData
2010-03-02 10:55:25 ----D---- C:\Program Files\Common Files
2010-03-01 23:13:03 ----D---- C:\Windows\System32
2010-03-01 23:07:25 ----RSD---- C:\Windows\Fonts
2010-03-01 20:10:18 ----D---- C:\Windows\system32\drivers
2010-03-01 19:26:13 ----D---- C:\Windows\debug
2010-03-01 19:10:11 ----D---- C:\Windows\inf
2010-03-01 09:57:31 ----D---- C:\Windows\system32\DriverStore
2010-02-26 14:14:57 ----D---- C:\Windows\system32\catroot
2010-02-26 14:14:54 ----D---- C:\Windows\winsxs
2010-02-24 21:24:45 ----D---- C:\Windows\rescache
2010-02-24 21:05:55 ----D---- C:\Windows\Microsoft.NET
2010-02-24 21:05:54 ----RSD---- C:\Windows\assembly
2010-02-23 23:43:24 ----D---- C:\Windows\system32\cs-CZ
2010-02-23 23:43:08 ----D---- C:\Windows\ehome
2010-02-23 23:42:50 ----D---- C:\Windows\AppPatch
2010-02-22 19:52:50 ----D---- C:\Windows\system32\wdi
2010-02-22 14:17:37 ----D---- C:\Windows\system32\LogFiles
2010-02-21 18:34:30 ----D---- C:\Program Files\Common Files\microsoft shared
2010-02-21 18:32:23 ----D---- C:\Windows\ShellNew
2010-02-21 15:26:39 ----D---- C:\Windows\system32\Boot
2010-02-21 15:26:39 ----D---- C:\Program Files\Windows Media Player
2010-02-21 15:26:39 ----D---- C:\Program Files\Internet Explorer
2010-02-21 15:18:13 ----D---- C:\Windows\Logs
2010-02-21 11:40:52 ----A---- C:\Windows\win.ini
2010-02-21 11:39:56 ----D---- C:\Windows\twain_32
2010-02-21 10:32:24 ----D---- C:\Windows\system32\CodeIntegrity
2010-02-21 10:16:50 ----D---- C:\Windows\system32\wbem
2010-02-21 10:16:43 ----D---- C:\Windows\system32\restore
2010-02-21 10:15:30 ----D---- C:\Windows\Tasks
2010-02-21 10:13:01 ----SHD---- C:\$Recycle.Bin
2010-02-21 10:12:50 ----RD---- C:\Users
2010-02-21 10:11:00 ----D---- C:\Program Files\Windows NT
2010-02-21 10:05:30 ----D---- C:\Windows\system32\sysprep
2010-02-21 10:03:53 ----D---- C:\Windows\CSC
2010-02-21 10:01:49 ----D---- C:\Windows\Setup

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 blbdrive;blbdrive; C:\Windows\system32\DRIVERS\blbdrive.sys [2009-07-14 35328]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 387584]
R1 DfsC;@%systemroot%\system32\drivers\dfsc.sys,-101; C:\Windows\System32\Drivers\dfsc.sys [2009-07-14 78336]
R1 discache;@%systemroot%\system32\drivers\discache.sys,-102; C:\Windows\System32\drivers\discache.sys [2009-07-14 32256]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2009-09-29 108792]
R1 nsiproxy;@%SystemRoot%\system32\drivers\nsiproxy.sys,-2; C:\Windows\system32\drivers\nsiproxy.sys [2009-07-14 16896]
R1 RDPENCDD;@%systemroot%\system32\drivers\RDPENCDD.sys,-101; C:\Windows\system32\drivers\rdpencdd.sys [2009-07-14 6656]
R1 RDPREFMP;@%systemroot%\system32\drivers\RdpRefMp.sys,-101; C:\Windows\system32\drivers\rdprefmp.sys [2009-07-14 7168]
R1 sp_rsdrv2;Spyware Terminator Driver 2; \??\C:\Windows\system32\drivers\sp_rsdrv2.sys [2010-03-01 142592]
R1 tdx;@%SystemRoot%\system32\tcpipcfg.dll,-50004; C:\Windows\system32\DRIVERS\tdx.sys [2009-07-14 74240]
R1 Wanarpv6;@%systemroot%\system32\rascfg.dll,-32012; C:\Windows\system32\DRIVERS\wanarp.sys [2009-07-14 63488]
R1 WfpLwf;WFP Lightweight Filter; C:\Windows\system32\DRIVERS\wfplwf.sys [2009-07-14 9728]
R2 eamon;eamon; C:\Windows\system32\DRIVERS\eamon.sys [2009-09-29 116008]
R2 epfwwfpr;epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys [2009-09-29 95896]
R2 lltdio;Link-Layer Topology Discovery Mapper I/O Driver; C:\Windows\system32\DRIVERS\lltdio.sys [2009-07-14 48128]
R2 luafv;@%systemroot%\system32\drivers\luafv.sys,-100; C:\Windows\system32\drivers\luafv.sys [2009-07-14 86528]
R2 PEAUTH;PEAUTH; C:\Windows\system32\drivers\peauth.sys [2009-07-14 586752]
R2 rspndr;Link-Layer Topology Discovery Responder; C:\Windows\system32\DRIVERS\rspndr.sys [2009-07-14 60928]
R2 tcpipreg;TCP/IP Registry Compatibility; C:\Windows\System32\drivers\tcpipreg.sys [2009-07-14 34816]
R3 AmdPPM;Ovladač procesoru AMD; C:\Windows\system32\DRIVERS\amdppm.sys [2009-07-14 52736]
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2009-08-18 4994560]
R3 bowser;@%systemroot%\system32\browser.dll,-102; C:\Windows\system32\DRIVERS\bowser.sys [2009-07-14 69632]
R3 CompositeBus;Ovladač rozpoznávacího modulu složené sběrnice; C:\Windows\system32\DRIVERS\CompositeBus.sys [2009-07-14 31232]
R3 DXGKrnl;LDDM Graphics Subsystem; C:\Windows\System32\drivers\dxgkrnl.sys [2009-10-02 728648]
R3 HdAudAddService;Ovladač funkce Microsoft 1.1 UAA pro službu zvuku High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2009-07-14 304128]
R3 HDAudBus;Ovladač sběrnice Microsoft UAA pro zvuk High Definition Audio; C:\Windows\system32\DRIVERS\HDAudBus.sys [2009-07-14 108544]
R3 HidUsb;Ovladač třídy standardu HID Microsoft; C:\Windows\system32\DRIVERS\hidusb.sys [2009-07-14 24064]
R3 kbdhid;Ovladač klávesnice standardu HID; C:\Windows\system32\DRIVERS\kbdhid.sys [2009-07-14 28160]
R3 monitor;Služba ovladače funkce třídy monitorů Microsoft; C:\Windows\system32\DRIVERS\monitor.sys [2009-07-14 23552]
R3 mpsdrv;@%SystemRoot%\system32\FirewallAPI.dll,-23092; C:\Windows\System32\drivers\mpsdrv.sys [2009-07-14 60416]
R3 mrxsmb10;@%systemroot%\system32\wkssvc.dll,-1004; C:\Windows\system32\DRIVERS\mrxsmb10.sys [2010-01-08 221184]
R3 mrxsmb20;@%systemroot%\system32\wkssvc.dll,-1006; C:\Windows\system32\DRIVERS\mrxsmb20.sys [2009-07-14 95744]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\Windows\system32\DRIVERS\ASACPI.sys [2004-08-13 5810]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvm62x32.sys [2009-07-13 347264]
R3 RasAgileVpn;WAN Miniport (IKEv2); C:\Windows\system32\DRIVERS\AgileVpn.sys [2009-07-14 49152]
R3 RasSstp;@%systemroot%\system32\sstpsvc.dll,-202; C:\Windows\system32\DRIVERS\rassstp.sys [2009-07-14 75264]
R3 rdpbus;Remote Desktop Device Redirector Bus Driver; C:\Windows\system32\DRIVERS\rdpbus.sys [2009-07-14 18944]
R3 srv2;@%systemroot%\system32\srvsvc.dll,-104; C:\Windows\System32\DRIVERS\srv2.sys [2009-07-14 306688]
R3 srvnet;srvnet; C:\Windows\System32\DRIVERS\srvnet.sys [2009-12-08 113664]
R3 tunnel;Microsoft Tunnel Miniport Adapter Driver; C:\Windows\system32\DRIVERS\tunnel.sys [2009-07-14 108544]
R3 umbus;Ovladač sběrnice UMBus Enumerator; C:\Windows\system32\DRIVERS\umbus.sys [2009-07-14 39936]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\Windows\system32\DRIVERS\usbccgp.sys [2009-07-14 75264]
R3 usbehci;Ovladač miniportu vylepšeného hostitelského řadiče Microsoft USB 2.0; C:\Windows\system32\DRIVERS\usbehci.sys [2009-10-24 41984]
R3 usbhub;Ovladač standardního rozbočovače USB; C:\Windows\system32\DRIVERS\usbhub.sys [2009-10-24 258560]
R3 usbohci;Ovladač miniportu otevřeného hostitelského řadiče Microsoft USB; C:\Windows\system32\DRIVERS\usbohci.sys [2009-07-14 20480]
R3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\Windows\system32\DRIVERS\USBSTOR.SYS [2009-07-14 74752]
R3 WudfPf;User Mode Driver Frameworks Platform Driver; C:\Windows\system32\drivers\WudfPf.sys [2009-07-14 92672]
S3 1394ohci;1394 OHCI Compliant Host Controller; C:\Windows\system32\DRIVERS\1394ohci.sys [2009-07-14 163328]
S3 AcpiPmi;ACPI Power Meter Driver; C:\Windows\system32\DRIVERS\acpipmi.sys [2009-07-14 9728]
S3 adp94xx;adp94xx; C:\Windows\system32\DRIVERS\adp94xx.sys [2009-07-14 422976]
S3 adpahci;adpahci; C:\Windows\system32\DRIVERS\adpahci.sys [2009-07-14 297552]
S3 adpu320;adpu320; C:\Windows\system32\DRIVERS\adpu320.sys [2009-07-14 146512]
S3 agp440;Intel AGP Bus Filter; C:\Windows\system32\DRIVERS\agp440.sys [2009-07-14 53312]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 amdide;amdide; C:\Windows\system32\DRIVERS\amdide.sys [2009-07-14 14912]
S3 AmdK8;AMD K8 Processor Driver; C:\Windows\system32\DRIVERS\amdk8.sys [2009-07-14 55296]
S3 amdsata;amdsata; C:\Windows\system32\DRIVERS\amdsata.sys [2009-07-14 79952]
S3 amdsbs;amdsbs; C:\Windows\system32\DRIVERS\amdsbs.sys [2009-07-14 159312]
S3 AppID;@%systemroot%\system32\appidsvc.dll,-102; C:\Windows\system32\drivers\appid.sys [2009-07-14 50176]
S3 arc;arc; C:\Windows\system32\DRIVERS\arc.sys [2009-07-14 76368]
S3 arcsas;arcsas; C:\Windows\system32\DRIVERS\arcsas.sys [2009-07-14 86608]
S3 azyhhmaq;azyhhmaq; C:\Windows\system32\drivers\azyhhmaq.sys []
S3 b06bdrv;Broadcom NetXtreme II VBD; C:\Windows\system32\DRIVERS\bxvbdx.sys [2009-07-13 430080]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 BrFiltLo;Brother USB Mass-Storage Lower Filter Driver; C:\Windows\system32\DRIVERS\BrFiltLo.sys [2009-07-13 13568]
S3 BrFiltUp;Brother USB Mass-Storage Upper Filter Driver; C:\Windows\system32\DRIVERS\BrFiltUp.sys [2009-07-13 5248]
S3 Brserid;Brother MFC Serial Port Interface Driver (WDM); C:\Windows\System32\Drivers\Brserid.sys [2009-07-14 272128]
S3 BrSerWdm;Brother WDM Serial driver; C:\Windows\System32\Drivers\BrSerWdm.sys [2009-07-13 62336]
S3 BrUsbMdm;Brother MFC USB Fax Only Modem; C:\Windows\System32\Drivers\BrUsbMdm.sys [2009-07-13 12160]
S3 BrUsbSer;Brother MFC USB Serial WDM Driver; C:\Windows\System32\Drivers\BrUsbSer.sys [2009-07-13 11904]
S3 BTHMODEM;Bluetooth Serial Communications Driver; C:\Windows\system32\DRIVERS\bthmodem.sys [2009-07-14 56320]
S3 circlass;Consumer IR Devices; C:\Windows\system32\DRIVERS\circlass.sys [2009-07-14 37888]
S3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\Windows\system32\DRIVERS\CmBatt.sys [2009-07-14 14080]
S3 Compbatt;Compbatt; C:\Windows\system32\DRIVERS\compbatt.sys [2009-07-14 19024]
S3 CrystalSysInfo;CrystalSysInfo; \??\C:\Program Files\MediaCoder\SysInfo.sys [2007-09-25 15152]
S3 Dot4;MS IEEE-1284.4 Driver; C:\Windows\system32\DRIVERS\Dot4.sys [2009-07-14 131072]
S3 Dot4Print;Print Class Driver for IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4Prt.sys [2009-07-14 16384]
S3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\Windows\system32\DRIVERS\dot4usb.sys [2009-07-14 36864]
S3 ebdrv;Broadcom NetXtreme II 10 GigE VBD; C:\Windows\system32\DRIVERS\evbdx.sys [2009-07-13 3100160]
S3 elxstor;elxstor; C:\Windows\system32\DRIVERS\elxstor.sys [2009-07-14 453712]
S3 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\DRIVERS\errdev.sys [2009-07-14 7168]
S3 exfat;exFAT File System Driver; C:\Windows\system32\drivers\exfat.sys [2009-07-14 142336]
S3 Filetrace;@%SystemRoot%\system32\drivers\filetrace.sys,-10001; C:\Windows\system32\drivers\filetrace.sys [2009-07-14 28160]
S3 FsDepends;@%SystemRoot%\system32\drivers\fsdepends.sys,-10001; C:\Windows\System32\drivers\FsDepends.sys [2009-07-14 46160]
S3 gagp30kx;Microsoft Generic AGPv3.0 Filter for K8 Processor Platforms; C:\Windows\system32\DRIVERS\gagp30kx.sys [2009-07-14 57936]
S3 hcw85cir;Hauppauge Consumer Infrared Receiver; C:\Windows\system32\drivers\hcw85cir.sys [2009-07-13 26624]
S3 HidBatt;HID UPS Battery Driver; C:\Windows\system32\DRIVERS\HidBatt.sys [2009-07-14 21504]
S3 HidBth;Microsoft Bluetooth HID Miniport; C:\Windows\system32\DRIVERS\hidbth.sys [2009-07-14 91136]
S3 HidIr;Microsoft Infrared HID Driver; C:\Windows\system32\DRIVERS\hidir.sys [2009-07-14 37888]
S3 HpSAMD;HpSAMD; C:\Windows\system32\DRIVERS\HpSAMD.sys [2009-07-14 67152]
S3 iaStorV;iaStorV; C:\Windows\system32\DRIVERS\iaStorV.sys [2009-07-14 332352]
S3 iirsp;iirsp; C:\Windows\system32\DRIVERS\iirsp.sys [2009-07-14 41040]
S3 intelide;intelide; C:\Windows\system32\DRIVERS\intelide.sys [2009-07-14 15424]
S3 intelppm;Intel Processor Driver; C:\Windows\system32\DRIVERS\intelppm.sys [2009-07-14 53760]
S3 IPMIDRV;IPMIDRV; C:\Windows\system32\DRIVERS\IPMIDrv.sys [2009-07-14 65536]
S3 isapnp;isapnp; C:\Windows\system32\DRIVERS\isapnp.sys [2009-07-14 46656]
S3 iScsiPrt;iScsiPort Driver; C:\Windows\system32\DRIVERS\msiscsi.sys [2009-07-14 186960]
S3 LSI_FC;LSI_FC; C:\Windows\system32\DRIVERS\lsi_fc.sys [2009-07-14 95824]
S3 LSI_SAS;LSI_SAS; C:\Windows\system32\DRIVERS\lsi_sas.sys [2009-07-14 89168]
S3 LSI_SAS2;LSI_SAS2; C:\Windows\system32\DRIVERS\lsi_sas2.sys [2009-07-14 54864]
S3 LSI_SCSI;LSI_SCSI; C:\Windows\system32\DRIVERS\lsi_scsi.sys [2009-07-14 96848]
S3 megasas;megasas; C:\Windows\system32\DRIVERS\megasas.sys [2009-07-14 30800]
S3 MegaSR;MegaSR; C:\Windows\system32\DRIVERS\MegaSR.sys [2009-07-14 235584]
S3 mouhid;Mouse HID Driver; C:\Windows\system32\DRIVERS\mouhid.sys [2009-07-14 26112]
S3 mpio;mpio; C:\Windows\system32\DRIVERS\mpio.sys [2009-07-14 130624]
S3 msahci;msahci; C:\Windows\system32\DRIVERS\msahci.sys [2009-07-14 27712]
S3 msdsm;msdsm; C:\Windows\system32\DRIVERS\msdsm.sys [2009-07-14 115792]
S3 mshidkmdf;@%SystemRoot%\system32\drivers\mshidkmdf.sys,-100; C:\Windows\System32\drivers\mshidkmdf.sys [2009-07-14 4096]
S3 MsRPC;MsRPC; C:\Windows\system32\drivers\MsRPC.sys [2009-07-14 162896]
S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2009-07-14 6144]
S3 MTConfig;Microsoft Input Configuration Driver; C:\Windows\system32\DRIVERS\MTConfig.sys [2009-07-14 12288]
S3 NativeWifiP;NativeWiFi Filter; C:\Windows\system32\DRIVERS\nwifi.sys [2009-07-14 267264]
S3 NdisCap;NDIS Capture LightWeight Filter; C:\Windows\system32\DRIVERS\ndiscap.sys [2009-07-14 27136]
S3 nfrd960;nfrd960; C:\Windows\system32\DRIVERS\nfrd960.sys [2009-07-14 44624]
S3 nv_agp;NVIDIA nForce AGP Bus Filter; C:\Windows\system32\DRIVERS\nv_agp.sys [2009-07-14 105024]
S3 nvraid;nvraid; C:\Windows\system32\DRIVERS\nvraid.sys [2009-07-14 117312]
S3 ohci1394;1394 OHCI Compliant Host Controller (Legacy); C:\Windows\system32\DRIVERS\ohci1394.sys [2009-07-14 62464]
S3 ql2300;ql2300; C:\Windows\system32\DRIVERS\ql2300.sys [2009-07-14 1383488]
S3 ql40xx;ql40xx; C:\Windows\system32\DRIVERS\ql40xx.sys [2009-07-14 106064]
S3 QWAVEdrv;@%SystemRoot%\system32\drivers\qwavedrv.sys,-1; C:\Windows\system32\drivers\qwavedrv.sys [2009-07-14 31744]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 5632]
S3 sbp2port;sbp2port; C:\Windows\system32\DRIVERS\sbp2port.sys [2009-07-14 85568]
S3 scfilter;@%SystemRoot%\System32\drivers\scfilter.sys,-11; C:\Windows\System32\DRIVERS\scfilter.sys [2009-07-14 26624]
S3 sermouse;Serial Mouse Driver; C:\Windows\system32\DRIVERS\sermouse.sys [2009-07-14 19968]
S3 sffdisk;SFF Storage Class Driver; C:\Windows\system32\DRIVERS\sffdisk.sys [2009-07-14 11264]
S3 sffp_mmc;SFF Storage Protocol Driver for MMC; C:\Windows\system32\DRIVERS\sffp_mmc.sys [2009-07-14 12288]
S3 sffp_sd;SFF Storage Protocol Driver for SDBus; C:\Windows\system32\DRIVERS\sffp_sd.sys [2009-07-14 12800]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 SiSRaid2;SiSRaid2; C:\Windows\system32\DRIVERS\SiSRaid2.sys [2009-07-14 40016]
S3 SiSRaid4;SiSRaid4; C:\Windows\system32\DRIVERS\sisraid4.sys [2009-07-14 77888]
S3 Smb;@%SystemRoot%\system32\tcpipcfg.dll,-50005; C:\Windows\system32\DRIVERS\smb.sys [2009-07-14 71168]
S3 stexstor;stexstor; C:\Windows\system32\DRIVERS\stexstor.sys [2009-07-14 21072]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 28224]
S3 TCPIP6;Microsoft IPv6 Protocol Driver; C:\Windows\system32\DRIVERS\tcpip.sys [2009-07-14 1285712]
S3 tssecsrv;@%SystemRoot%\System32\DRIVERS\tssecsrv.sys,-101; C:\Windows\System32\DRIVERS\tssecsrv.sys [2009-07-14 30208]
S3 uagp35;Microsoft AGPv3.5 Filter; C:\Windows\system32\DRIVERS\uagp35.sys [2009-07-14 55888]
S3 uliagpkx;Uli AGP Bus Filter; C:\Windows\system32\DRIVERS\uliagpkx.sys [2009-07-14 57424]
S3 UmPass;Microsoft UMPass Driver; C:\Windows\system32\DRIVERS\umpass.sys [2009-07-14 8192]
S3 usbcir;eHome Infrared Receiver (USBCIR); C:\Windows\system32\DRIVERS\usbcir.sys [2009-07-14 86016]
S3 usbprint;Třída USB Printer; C:\Windows\system32\DRIVERS\usbprint.sys [2009-07-14 19968]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 35840]
S3 usbuhci;Ovladač miniportu univerzálního hostitelského řadiče Microsoft USB; C:\Windows\system32\DRIVERS\usbuhci.sys [2009-07-14 24064]
S3 vga;vga; C:\Windows\system32\DRIVERS\vgapnp.sys [2009-07-14 26112]
S3 vhdmp;vhdmp; C:\Windows\system32\DRIVERS\vhdmp.sys [2009-07-14 159824]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 175824]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 17920]
S3 vsmraid;vsmraid; C:\Windows\system32\DRIVERS\vsmraid.sys [2009-07-14 141904]
S3 vwifibus;@%SystemRoot%\System32\drivers\vwifibus.sys,-257; C:\Windows\System32\drivers\vwifibus.sys [2009-07-14 19968]
S3 WacomPen;Wacom Serial Pen HID Driver; C:\Windows\system32\DRIVERS\wacompen.sys [2009-07-14 21632]
S3 Wd;Wd; C:\Windows\system32\DRIVERS\wd.sys [2009-07-14 19024]
S3 WIMMount;WIMMount; C:\Windows\system32\drivers\wimmount.sys [2009-07-14 19008]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-14 34944]
S3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\DRIVERS\wmiacpi.sys [2009-07-14 11264]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2009-07-14 132224]
S4 crcdisk;Crcdisk Filter Driver; C:\Windows\system32\DRIVERS\crcdisk.sys [2009-07-14 22096]
S4 ws2ifsl;@%systemroot%\System32\drivers\ws2ifsl.sys,-1000; C:\Windows\system32\drivers\ws2ifsl.sys [2009-07-14 16384]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2009-08-18 176128]
R2 Apache2.2;Apache2.2; C:\Program Files\Apache Software Foundation\Apache2.2\bin\httpd.exe [2009-09-28 24645]
R2 AudioEndpointBuilder;@%SystemRoot%\system32\audiosrv.dll,-204; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 BFE;@%SystemRoot%\system32\bfe.dll,-1001; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 DPS;@%systemroot%\system32\dps.dll,-500; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2009-09-29 735960]
R2 gpsvc;@gpapi.dll,-112; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 hpqddsvc;Služba HP CUE DeviceDiscovery; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 iphlpsvc;@%SystemRoot%\system32\iphlpsvc.dll,-500; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 MMCSS;@%systemroot%\system32\mmcss.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 MpsSvc;@%SystemRoot%\system32\FirewallAPI.dll,-23090; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 NlaSvc;@%SystemRoot%\System32\nlasvc.dll,-1; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 nsi;@%SystemRoot%\system32\nsisvc.dll,-200; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 Power;@%SystemRoot%\system32\umpo.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 ProfSvc;@%systemroot%\system32\profsvc.dll,-300; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 RpcEptMapper;@%windir%\system32\RpcEpMap.dll,-1001; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 SBSDWSCService;SBSD Security Center Service; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
R2 sp_rssrv;Spyware Terminator Realtime Shield Service; C:\Program Files\Spyware Terminator\sp_rsser.exe [2010-03-01 488960]
R2 SysMain;@%SystemRoot%\system32\sysmain.dll,-1000; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 UxSms;@%SystemRoot%\system32\dwm.exe,-2000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 WinDefend;@%ProgramFiles%\Windows Defender\MsMpRes.dll,-103; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 WMPNetworkSvc;@%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101; C:\Program Files\Windows Media Player\wmpnetwk.exe [2009-07-14 1121280]
R2 WSearch;@%systemroot%\system32\SearchIndexer.exe,-103; C:\Windows\system32\SearchIndexer.exe [2009-07-14 428032]
R2 wudfsvc;@%SystemRoot%\system32\wudfsvc.dll,-1000; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R3 Appinfo;@%systemroot%\system32\appinfo.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R3 fdPHost;@%systemroot%\system32\fdPHost.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R3 FDResPub;@%systemroot%\system32\fdrespub.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R3 HomeGroupListener;@%SystemRoot%\System32\ListSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R3 HomeGroupProvider;@%SystemRoot%\System32\provsvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R3 hpqcxs08;hpqcxs08; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R3 KeyIso;@keyiso.dll,-100; C:\Windows\system32\lsass.exe [2009-07-14 22528]
R3 netprofm;@%SystemRoot%\system32\netprofm.dll,-202; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R3 p2pimsvc;@%SystemRoot%\system32\pnrpsvc.dll,-8004; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R3 p2psvc;@%SystemRoot%\system32\p2psvc.dll,-8006; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R3 PcaSvc;@%SystemRoot%\system32\pcasvc.dll,-1; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R3 PNRPsvc;@%SystemRoot%\system32\pnrpsvc.dll,-8000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R3 WdiServiceHost;@%systemroot%\system32\wdi.dll,-502; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R3 WdiSystemHost;@%systemroot%\system32\wdi.dll,-500; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S2 sppsvc;@%SystemRoot%\system32\sppsvc.exe,-101; C:\Windows\system32\sppsvc.exe [2009-07-14 3179520]
S3 AeLookupSvc;@%SystemRoot%\system32\aelupsvc.dll,-1; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 AppIDSvc;@%systemroot%\system32\appidsvc.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 AxInstSV;@%SystemRoot%\system32\AxInstSV.dll,-103; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 BDESVC;@%SystemRoot%\system32\bdesvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 bthserv;@%SystemRoot%\System32\bthserv.dll,-101; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 CertPropSvc;@%SystemRoot%\System32\certprop.dll,-11; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 clr_optimization_v2.0.50727_32;Microsoft .NET Framework NGEN v2.0.50727_X86; C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2009-06-10 66384]
S3 defragsvc;@%SystemRoot%\system32\defragsvc.dll,-101; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 EFS;@%SystemRoot%\system32\efssvc.dll,-100; C:\Windows\System32\lsass.exe [2009-07-14 22528]
S3 ehRecvr;@%SystemRoot%\ehome\ehrecvr.exe,-101; C:\Windows\ehome\ehRecvr.exe [2009-07-14 557056]
S3 ehSched;@%SystemRoot%\ehome\ehsched.exe,-101; C:\Windows\ehome\ehsched.exe [2009-07-14 94720]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2009-09-29 20680]
S3 Fax;@%systemroot%\system32\fxsresm.dll,-118; C:\Windows\system32\fxssvc.exe [2009-07-14 522752]
S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 FontCache3.0.0.0;@%SystemRoot%\system32\PresentationHost.exe,-3309; C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2009-06-10 42856]
S3 idsvc;@%systemroot%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelInstallRC.dll,-8193; C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2009-06-10 878416]
S3 IKEEXT;@%SystemRoot%\system32\ikeext.dll,-501; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 IPBusEnum;@%systemroot%\system32\IPBusEnum.dll,-102; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 KtmRm;@comres.dll,-2946; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 lltdsvc;@%SystemRoot%\system32\lltdres.dll,-1; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 MSiSCSI;@%SystemRoot%\system32\iscsidsc.dll,-5000; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 pla;@%systemroot%\system32\pla.dll,-500; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 PNRPAutoReg;@%SystemRoot%\system32\pnrpauto.dll,-8002; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 QWAVE;@%SystemRoot%\system32\qwave.dll,-1; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 SCPolicySvc;@%SystemRoot%\System32\certprop.dll,-13; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 SDRSVC;@%SystemRoot%\system32\sdrsvc.dll,-107; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 SensrSvc;@%SystemRoot%\System32\sensrsvc.dll,-1000; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 SessionEnv;@%SystemRoot%\System32\SessEnv.dll,-1026; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 SNMPTRAP;@%SystemRoot%\system32\snmptrap.exe,-3; C:\Windows\System32\snmptrap.exe [2009-07-14 12800]
S3 sppuinotify;@%SystemRoot%\system32\sppuinotify.dll,-103; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 SstpSvc;@%SystemRoot%\system32\sstpsvc.dll,-200; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 Steam Client Service;Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe [2010-02-24 332720]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 TabletInputService;@%SystemRoot%\system32\TabSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 TBS;@%SystemRoot%\system32\tbssvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 THREADORDER;@%systemroot%\system32\mmcss.dll,-102; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 TrustedInstaller;@%SystemRoot%\servicing\TrustedInstaller.exe,-100; C:\Windows\servicing\TrustedInstaller.exe [2009-07-14 204800]
S3 UI0Detect;@%SystemRoot%\system32\ui0detect.exe,-101; C:\Windows\system32\UI0Detect.exe [2009-07-14 35840]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 VaultSvc;@%SystemRoot%\system32\vaultsvc.dll,-1003; C:\Windows\system32\lsass.exe [2009-07-14 22528]
S3 vds;@%SystemRoot%\system32\vds.exe,-100; C:\Windows\System32\vds.exe [2009-07-14 452608]
S3 wbengine;@%systemroot%\system32\wbengine.exe,-104; C:\Windows\system32\wbengine.exe [2009-07-14 1202688]
S3 WbioSrvc;@%systemroot%\system32\wbiosrvc.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 wcncsvc;@%SystemRoot%\system32\wcncsvc.dll,-3; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WcsPlugInService;@%SystemRoot%\system32\WcsPlugInService.dll,-200; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 Wecsvc;@%SystemRoot%\system32\wecsvc.dll,-200; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 wercplsupport;@%SystemRoot%\System32\wercplsupport.dll,-101; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WerSvc;@%SystemRoot%\System32\wersvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WinHttpAutoProxySvc;@%SystemRoot%\system32\winhttp.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 WinRM;@%Systemroot%\system32\wsmsvc.dll,-101; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 Wlansvc;@%SystemRoot%\System32\wlansvc.dll,-257; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 WPCSvc;@%SystemRoot%\system32\wpcsvc.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 WPDBusEnum;@%SystemRoot%\system32\wpdbusenum.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 WwanSvc;@%SystemRoot%\System32\wwansvc.dll,-257; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S4 Mcx2Svc;@%SystemRoot%\ehome\ehres.dll,-15501; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S4 NetTcpPortSharing;@%systemroot%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelInstallRC.dll,-8201; C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2009-06-10 128848]

-----------------EOF-----------------

[Caroprd111]

Vložte do PC všechny flash disky, které používáte.

Podle návodu http://www.viry.cz/forum/viewtopic.php?f=15&t=72743 aplikujte tento skript.

Kód: Vybrat vše

:files
c:\Autorun.inf
D:\Autorun.inf
E:\Autorun.inf
F:\Autorun.inf
G:\Autorun.inf
H:\Autorun.inf
I:\Autorun.inf
K:\Autorun.inf
L:\Autorun.inf
C:\recycler
D:\recycler
e:\recycler
f:\recycler
g:\recycler
h:\recycler
I:\recycler
C:\resycled
D:\resycled
e:\resycled
f:\resycled
g:\resycled
h:\resycled
I:\resycled
c:\$recycle.bin
d:\$recycle.bin
e:\$recycle.bin
f:\$recycle.bin
g:\$recycle.bin
h:\$recycle.bin
I:\$recycle.bin

:commands
[EmptyTemp]
[Reboot]

Odinstalujte Spybot - Search & Destroy.

[vlachuj]

Kód: Vybrat vše

All processes killed
========== FILES ==========
File/Folder c:\Autorun.inf not found.
File/Folder D:\Autorun.inf not found.
File/Folder E:\Autorun.inf not found.
File/Folder F:\Autorun.inf not found.
File/Folder G:\Autorun.inf not found.
File move failed. H:\autorun.inf scheduled to be moved on reboot.
File/Folder I:\Autorun.inf not found.
File/Folder K:\Autorun.inf not found.
File/Folder L:\Autorun.inf not found.
File/Folder C:\recycler not found.
File/Folder D:\recycler not found.
File/Folder e:\recycler not found.
File/Folder f:\recycler not found.
File/Folder g:\recycler not found.
Folder move failed. h:\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665 scheduled to be moved on reboot.
Folder move failed. h:\RECYCLER scheduled to be moved on reboot.
File/Folder I:\recycler not found.
File/Folder C:\resycled not found.
File/Folder D:\resycled not found.
File/Folder e:\resycled not found.
File/Folder f:\resycled not found.
File/Folder g:\resycled not found.
File/Folder h:\resycled not found.
File/Folder I:\resycled not found.
c:\$RECYCLE.BIN\S-1-5-21-233495617-3522456307-960355657-1000 folder moved successfully.
c:\$RECYCLE.BIN folder moved successfully.
d:\$RECYCLE.BIN\S-1-5-21-233495617-3522456307-960355657-1000 folder moved successfully.
d:\$RECYCLE.BIN folder moved successfully.
File/Folder e:\$recycle.bin not found.
File/Folder f:\$recycle.bin not found.
File/Folder g:\$recycle.bin not found.
h:\$RECYCLE.BIN\S-1-5-21-233495617-3522456307-960355657-1000 folder moved successfully.
h:\$RECYCLE.BIN folder moved successfully.
File/Folder I:\$recycle.bin not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Public
 
User: Vlachos
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 6274276 bytes
->Flash cache emptied: 434 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2774 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 6,00 mb
 
 
OTM by OldTimer - Version 3.1.10.0 log created on 03022010_155604

Files moved on Reboot...
File move failed. H:\autorun.inf scheduled to be moved on reboot.
Folder move failed. h:\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665 scheduled to be moved on reboot.
Folder move failed. h:\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665 scheduled to be moved on reboot.
Folder move failed. h:\RECYCLER scheduled to be moved on reboot.

Registry entries deleted on Reboot...

Po restartu stále soubory nesmazané a vir tam pořád je

[Caroprd111]

Stahněte MBAM http://www.viry.cz/forum/viewtopic.php?f=29&t=67229

• Podle návodu v odkazu nainstalujte, poté dejte úplný sken.
• Nic nemažte MBAM má občas falešné detekce a mohl by smazat např. systémové soubory.
• Log vložte sem.

[vlachuj]

vysledek celkem o nicem

Kód: Vybrat vše

Malwarebytes' Anti-Malware 1.44
Verze databáze: 3813
Windows 6.1.7600
Internet Explorer 8.0.7600.16385

2.3.2010 16:46:28
mbam-log-2010-03-02 (16-46-17).txt

Typ kontroly: Kompletní kontrola (C:\|D:\|H:\|)
Zkontrolované objekty: 186555
Uplynulý čas: 21 minute(s), 39 second(s)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované adresáře: 0
Infikované soubory: 1

Infikované procesy v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované moduly v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované klíče registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované hodnoty registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované datové položky registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované adresáře:
(Nebyly nalezeny žádné škodlivé položky)

Infikované soubory:
H:\Hry\w3-instalacky\cz\xpam.exe (Trojan.MultiDropper) -> No action taken.

[Caroprd111]

Vše, co našel MBAM smažte a restartujte PC.


Vložte do PC všechny flash disky, které používáte.

Podle návodu http://www.viry.cz/forum/viewtopic.php?f=15&t=72743 aplikujte tento skript.

Kód: Vybrat vše

:files
c:\Autorun.inf
D:\Autorun.inf
E:\Autorun.inf
F:\Autorun.inf
G:\Autorun.inf
H:\Autorun.inf
I:\Autorun.inf
K:\Autorun.inf
L:\Autorun.inf
C:\recycler
D:\recycler
e:\recycler
f:\recycler
g:\recycler
h:\recycler
I:\recycler
C:\resycled
D:\resycled
e:\resycled
f:\resycled
g:\resycled
h:\resycled
I:\resycled
c:\$recycle.bin
d:\$recycle.bin
e:\$recycle.bin
f:\$recycle.bin
g:\$recycle.bin
h:\$recycle.bin
I:\$recycle.bin

:commands
[EmptyTemp]
[Reboot]

[vlachuj]

nic nového
soubory jsou stále infikované

log:

Kód: Vybrat vše

All processes killed
========== FILES ==========
File/Folder c:\Autorun.inf not found.
File/Folder D:\Autorun.inf not found.
File/Folder E:\Autorun.inf not found.
File/Folder F:\Autorun.inf not found.
File/Folder G:\Autorun.inf not found.
File move failed. H:\autorun.inf scheduled to be moved on reboot.
File/Folder I:\Autorun.inf not found.
File/Folder K:\Autorun.inf not found.
File/Folder L:\Autorun.inf not found.
File/Folder C:\recycler not found.
File/Folder D:\recycler not found.
File/Folder e:\recycler not found.
File/Folder f:\recycler not found.
File/Folder g:\recycler not found.
Folder move failed. h:\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665 scheduled to be moved on reboot.
Folder move failed. h:\RECYCLER scheduled to be moved on reboot.
File/Folder I:\recycler not found.
File/Folder C:\resycled not found.
File/Folder D:\resycled not found.
File/Folder e:\resycled not found.
File/Folder f:\resycled not found.
File/Folder g:\resycled not found.
File/Folder h:\resycled not found.
File/Folder I:\resycled not found.
c:\$RECYCLE.BIN\S-1-5-21-233495617-3522456307-960355657-1000 folder moved successfully.
c:\$RECYCLE.BIN folder moved successfully.
d:\$RECYCLE.BIN\S-1-5-21-233495617-3522456307-960355657-1000 folder moved successfully.
d:\$RECYCLE.BIN folder moved successfully.
File/Folder e:\$recycle.bin not found.
File/Folder f:\$recycle.bin not found.
File/Folder g:\$recycle.bin not found.
h:\$RECYCLE.BIN\S-1-5-21-233495617-3522456307-960355657-1000 folder moved successfully.
h:\$RECYCLE.BIN folder moved successfully.
File/Folder I:\$recycle.bin not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Public
 
User: Vlachos
->Temp folder emptied: 1004 bytes
->Temporary Internet Files folder emptied: 4274330 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 148506628 bytes
->Flash cache emptied: 1073 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 12741121 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 158,00 mb
 
 
OTM by OldTimer - Version 3.1.10.0 log created on 03022010_190841

Files moved on Reboot...
File move failed. H:\autorun.inf scheduled to be moved on reboot.
Folder move failed. h:\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665 scheduled to be moved on reboot.
Folder move failed. h:\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665 scheduled to be moved on reboot.
Folder move failed. h:\RECYCLER scheduled to be moved on reboot.

Registry entries deleted on Reboot...

[Caroprd111]

Pokračujte podle návodu AVPTool http://www.viry.cz/forum/viewtopic.php?f=29&t=58179 (s připojeným externím diskem)

[vlachuj]

AVP tool zdřejmně zabral

díky za vyřešení problému

[Caroprd111]

Dejte nový log z RSIT, musíme ještě dočistit.