Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz
Zpomalil se počítač.
Moderátor: Moderátoři
Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Zpomalil se počítač.
Jsem zde úplný nováček. Kaspersky odhalil a odstranil.
Trojsky kun Trojan-GameThief. Win32. Staem.hi C:\System Volume Information\_restore{7BE5B964-F343-43E9-B088-5A03FE0A9BD3}Vy>257\A0046996.EXE
Od tohoto okamžiku se mě zdá, že počítač je pomalý. Potřeboval bych od někoho zjistit, zda je počítač stále ohrožen vnitřní hrozbou. Děkuji. Zde je log:
Logfile of random's system information tool 1.08 (written by random/random)
Run by moje1 at 2011-04-12 13:44:49
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 7 GB (23%) free of 30 GB
Total RAM: 768 MB (25% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:46:49, on 12.4.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ABBYY Screenshot Reader\NetworkLicenseServer.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ABBYY Screenshot Reader\ScreenshotReader.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtblfs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Opera\opera.exe
D:\Záloha\Programy\VYTVOŘENÍ LOGU PRO KONTROLU PC\RSIT.exe
C:\Program Files\trend micro\moje1.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.myheritage.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: MHURLSearchHook Class - {1C4AB6A5-595F-4e86-B15F-F93CCE2BBD48} - C:\Program Files\Family Toolbar\tbhelper.dll
O2 - BHO: MHTBPos00 - {0C37B053-FD68-456a-82E1-D788EE342E6F} - C:\Program Files\Family Toolbar\tbcore3.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\ievkbd.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll
O3 - Toolbar: Family Toolbar - {FD2FD708-1F6F-4B68-B141-C5778F0C19BB} - C:\Program Files\Family Toolbar\tbcore3.dll
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero 7\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [Family Tree Builder Update] C:\Program Files\MyHeritage\Bin\FTBCheckUpdates.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ABBYY Screenshot Reader Retail] "C:\Program Files\ABBYY Screenshot Reader\ScreenshotReader.exe" -autorun
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = ?
O4 - Global Startup: Adobe Reader Synchronizer.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Přidat do Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\ie_banner_deny.htm
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: &Virtuální klávesnice - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: K&ontrola adres URL - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partne ... nicode.cab
O16 - DPF: {6218F7B5-0D3A-48BA-AE4C-49DCFA63D400} (CSEQueryObject Object) - http://www.myheritage.cz/Genoogle/Compo ... eQuery.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 2037324722
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/get/f ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B7CEC668-BECE-4FDD-A588-7B0E24F5A32B}: NameServer = 93.153.117.1 62.141.0.2
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - (no file)
O20 - AppInit_DLLs: C:\DOCUME~1\ALLUSE~1.WIN\AVP11\mzvkbd3.dll,C:\DOCUME~1\ALLUSE~1.WIN\AVP11\kloehk.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: ABBYY.Licensing.FineReader.ScreenshotReader.9.0 - ABBYY (BIT Software) - C:\Program Files\ABBYY Screenshot Reader\NetworkLicenseServer.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Služba Kaspersky Anti-Virus (AVP) - Kaspersky Lab ZAO - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe
O23 - Service: Služba Google Update (gupdate1c9be876827bd70) (gupdate1c9be876827bd70) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
--
End of file - 9413 bytes
======Scheduled tasks folder======
C:\WINDOWS\tasks\20071118_144400_záloha_výpln_ZC5.job
C:\WINDOWS\tasks\20081115_205000_Posta.job
C:\WINDOWS\tasks\Google Software Updater.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{0A0CCE5C-13F9-484D-BFD4-6C9F2BC67947}.job
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0C37B053-FD68-456a-82E1-D788EE342E6F}]
MHTBPos00 Class - C:\Program Files\Family Toolbar\tbcore3.dll [2009-05-07 2642432]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}]
IEVkbdBHO Class - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\ievkbd.dll [2010-07-01 68280]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Plug-In - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-11-22 1242504]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll [2009-04-16 668656]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E33CF602-D945-461A-83F0-819F76A199F8}]
FilterBHO Class - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll [2010-07-01 191160]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{FD2FD708-1F6F-4B68-B141-C5778F0C19BB} - Family Toolbar - C:\Program Files\Family Toolbar\tbcore3.dll [2009-05-07 2642432]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"HPDJ Taskbar Utility"=C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe [2003-03-26 172032]
"NBKeyScan"=C:\Program Files\Nero\Nero 7\Nero BackItUp\NBKeyScan.exe [2008-04-08 1647912]
"AdslTaskBar"=stmctrl.dll,TaskBar []
"Family Tree Builder Update"=C:\Program Files\MyHeritage\Bin\FTBCheckUpdates.exe [2010-10-31 226832]
"AVP"=C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe [2011-03-22 352976]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-09-20 932288]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"AdslTaskBar"=stmctrl.dll,TaskBar []
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [2008-01-22 152872]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"ABBYY Screenshot Reader Retail"=C:\Program Files\ABBYY Screenshot Reader\ScreenshotReader.exe [2008-12-09 959776]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2011-01-26 15026056]
C:\Documents and Settings\All Users.WINDOWS\Nabídka Start\Programy\Po spuštění
Adobe Gamma Loader.exe.lnk -
Adobe Reader Synchronizer.lnk -
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\DOCUME~1\ALLUSE~1.WIN\AVP11\mzvkbd3.dll,C:\DOCUME~1\ALLUSE~1.WIN\AVP11\kloehk.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2004-10-26 90112]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
C:\WINDOWS\system32\klogon.dll [2010-07-01 228024]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Driver]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Guard]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AVG Anti-Spyware Driver]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AVG Anti-Spyware Guard]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SymEFA.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoInstrumentation"=1
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoResolveSearch"=1
"HonorAutoRunSetting"=1
"NoDriveTypeAutoRun"=28
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Opera\opera.exe"="C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
======File associations======
.js - open - %SystemRoot%\System32\CScript.exe "%1" %*
.vbs - open - %SystemRoot%\System32\CScript.exe "%1" %*
======List of files/folders created in the last 1 months======
2011-04-12 13:44:49 ----DC---- C:\rsit
2011-03-31 23:11:19 ----A---- C:\WINDOWS\system32\uxtuneup.dll
2011-03-31 22:53:57 ----A---- C:\WINDOWS\system32\TURegOpt.exe
2011-03-31 22:53:21 ----D---- C:\Program Files\TuneUp Utilities 2010
2011-03-31 17:39:29 ----SHDC---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
2011-03-24 11:25:13 ----HDC---- C:\WINDOWS\$NtUninstallKB2524375$
2011-03-19 12:21:09 ----DC---- C:\Documents and Settings\moje1\Data aplikací\skypePM
2011-03-19 12:11:38 ----D---- C:\Program Files\Common Files\Skype
2011-03-19 12:11:07 ----RD---- C:\Program Files\Skype
2011-03-19 12:11:05 ----DC---- C:\Documents and Settings\moje1\Data aplikací\Skype
2011-03-19 12:10:50 ----DC---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Skype
======List of files/folders modified in the last 1 months======
2011-04-12 13:46:49 ----D---- C:\Program Files\Trend Micro
2011-04-12 13:44:41 ----D---- C:\WINDOWS\Prefetch
2011-04-12 13:34:47 ----DC---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Kaspersky Lab
2011-04-12 12:26:00 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-04-12 11:37:52 ----D---- C:\WINDOWS\Temp
2011-04-12 11:34:22 ----D---- C:\WINDOWS\system32
2011-04-11 06:25:52 ----DC---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Google Updater
2011-04-08 16:49:56 ----D---- C:\Program Files\Opera
2011-04-05 21:55:42 ----AC---- C:\WINDOWS\NeroDigital.ini
2011-04-04 18:28:43 ----D---- C:\WINDOWS\system32\drivers
2011-04-04 07:38:22 ----DC---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Adobe
2011-03-31 23:38:21 ----DC---- C:\Config.Msi
2011-03-31 23:11:28 ----SHD---- C:\WINDOWS\Installer
2011-03-31 22:53:21 ----RD---- C:\Program Files
2011-03-31 22:52:51 ----D---- C:\WINDOWS
2011-03-31 18:23:43 ----D---- C:\WINDOWS\system32\config
2011-03-31 17:46:27 ----DC---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\TuneUp Software
2011-03-31 16:53:28 ----D---- C:\Program Files\Common Files\Adobe
2011-03-31 16:51:18 ----D---- C:\Program Files\Adobe
2011-03-31 16:50:18 ----D---- C:\WINDOWS\WinSxS
2011-03-30 22:30:49 ----AC---- C:\WINDOWS\MyHeritage.INI
2011-03-27 08:13:52 ----AC---- C:\WINDOWS\system32\PerfStringBackup.INI
2011-03-26 17:11:22 ----D---- C:\Program Files\Hry
2011-03-26 17:00:45 ----D---- C:\WINDOWS\system32\CatRoot2
2011-03-26 16:04:19 ----D---- C:\WINDOWS\repair
2011-03-26 16:02:50 ----D---- C:\WINDOWS\Registration
2011-03-24 11:25:22 ----HD---- C:\WINDOWS\inf
2011-03-24 11:24:11 ----HD---- C:\WINDOWS\$hf_mig$
2011-03-24 09:28:04 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2011-03-23 00:28:10 ----D---- C:\WINDOWS\security
2011-03-23 00:21:47 ----RSHDC---- C:\WINDOWS\system32\dllcache
2011-03-22 23:46:47 ----D---- C:\Program Files\TuxPaint
2011-03-22 22:53:16 ----A---- C:\WINDOWS\imsins.BAK
2011-03-22 22:53:08 ----D---- C:\WINDOWS\Help
2011-03-22 22:53:07 ----D---- C:\WINDOWS\Cursors
2011-03-22 22:53:06 ----D---- C:\Program Files\Windows NT
2011-03-22 22:52:39 ----D---- C:\WINDOWS\system32\wbem
2011-03-22 16:12:32 ----SHD---- C:\System Volume Information
2011-03-22 15:07:42 ----D---- C:\WINDOWS\system32\CatRoot
2011-03-22 15:04:51 ----DC---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Kaspersky Lab Setup Files
2011-03-22 15:03:23 ----D---- C:\Program Files\Kaspersky Lab
2011-03-19 12:11:38 ----D---- C:\Program Files\Common Files
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 imagedrv;imagedrv; C:\WINDOWS\System32\Drivers\imagedrv.sys [2008-01-22 11304]
R0 imagesrv;imagesrv; C:\WINDOWS\system32\DRIVERS\imagesrv.sys [2008-01-22 132904]
R0 kl1;kl1; C:\WINDOWS\system32\DRIVERS\kl1.sys [2010-06-09 132184]
R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2007-03-08 43528]
R0 viaagp;Filtr VIA sběrnice AGP ; C:\WINDOWS\System32\DRIVERS\viaagp.sys [2008-04-14 42240]
R1 kl2;kl2; C:\WINDOWS\system32\DRIVERS\kl2.sys [2010-06-09 11352]
R1 KLIF;Kaspersky Lab Driver; C:\WINDOWS\system32\DRIVERS\klif.sys [2011-03-22 475736]
R2 Fallback;Fallback; C:\WINDOWS\System32\DRIVERS\HSF_FALL.sys [2001-08-17 289887]
R2 Fsks;Fsks; C:\WINDOWS\System32\DRIVERS\HSF_FSKS.sys [2001-08-17 115807]
R2 K56;K56; C:\WINDOWS\System32\DRIVERS\HSF_K56K.sys [2001-08-17 391199]
R2 mdmxsdk;mdmxsdk; C:\WINDOWS\System32\DRIVERS\mdmxsdk.sys [2004-08-03 11868]
R2 SoftFax;SoftFax; C:\WINDOWS\System32\DRIVERS\HSF_FAXX.sys [2001-08-17 199711]
R2 Tones;Tones; C:\WINDOWS\System32\DRIVERS\HSF_TONE.sys [2001-08-17 50751]
R2 V124;V124; C:\WINDOWS\System32\DRIVERS\HSF_V124.sys [2001-08-17 488383]
R3 Afc;PPdus ASPI Shell; C:\WINDOWS\system32\drivers\Afc.sys [2005-02-23 11776]
R3 ALCXWDM;Service for Avance AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2002-07-12 655596]
R3 ati2mtag;ati2mtag; C:\WINDOWS\System32\DRIVERS\ati2mtag.sys [2004-10-26 820224]
R3 bbcap;bbcap; C:\WINDOWS\system32\DRIVERS\bbcap.sys [2008-12-20 4096]
R3 HSF_DP;HSF_DP; C:\WINDOWS\System32\DRIVERS\HSFDPSP2.sys [2004-08-03 1041536]
R3 HSFHWBS2;HSFHWBS2; C:\WINDOWS\System32\DRIVERS\HSFBS2S2.sys [2004-08-03 220032]
R3 klim5;Kaspersky Anti-Virus NDIS Filter; C:\WINDOWS\system32\DRIVERS\klim5.sys [2010-05-07 32856]
R3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver; C:\WINDOWS\system32\drivers\msmpu401.sys [2001-08-18 2944]
R3 NtApm;Ovladač rozhraní služby NT Apm/Legacy; C:\WINDOWS\System32\DRIVERS\NtApm.sys [2001-10-24 9472]
R3 Stmatm;ATM/ADSL miniport; C:\WINDOWS\system32\DRIVERS\stmatm.sys [2003-08-12 60255]
R3 TaurusUsb;ADSL Modem USB Service; C:\WINDOWS\system32\DRIVERS\torususb.sys [2003-12-23 549421]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv; \??\C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys []
R3 usbprint;Třída USB Printer; C:\WINDOWS\System32\DRIVERS\usbprint.sys [2008-04-14 25856]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2008-04-14 20608]
R3 winachsf;winachsf; C:\WINDOWS\System32\DRIVERS\HSFCXTS2.sys [2004-08-03 685056]
S1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
S3 AF15BDA;AF9015 BDA Filter; C:\WINDOWS\System32\Drivers\AF15BDA.sys [2006-09-28 283776]
S3 basic2;basic2; C:\WINDOWS\System32\DRIVERS\HSF_BSC2.sys [2001-08-17 67167]
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
S3 hsf_msft;hsf_msft; C:\WINDOWS\System32\DRIVERS\HSF_MSFT.sys [2001-08-17 542879]
S3 klmouflt;Kaspersky Lab KLMOUFLT; C:\WINDOWS\system32\DRIVERS\klmouflt.sys [2009-11-02 19472]
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-10-24 12160]
S3 MPE;Filtr MPE BDA; C:\WINDOWS\system32\DRIVERS\MPE.sys [2008-04-14 15232]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 Rksample;Rksample; C:\WINDOWS\System32\DRIVERS\HSF_SAMP.sys [2001-08-17 57471]
S3 s716bus;Sony Ericsson Device 716 driver (WDM); C:\WINDOWS\system32\DRIVERS\s716bus.sys [2007-06-29 83208]
S3 s716mdfl;Sony Ericsson Device 716 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\s716mdfl.sys [2007-06-29 15112]
S3 s716mdm;Sony Ericsson Device 716 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\s716mdm.sys [2007-06-29 108552]
S3 s716mgmt;Sony Ericsson Device 716 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\s716mgmt.sys [2007-04-04 100360]
S3 s716nd5;Sony Ericsson Device 716 USB Ethernet Emulation SEMC716 (NDIS); C:\WINDOWS\system32\DRIVERS\s716nd5.sys [2007-04-04 23176]
S3 s716obex;Sony Ericsson Device 716 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\s716obex.sys [2007-04-04 98568]
S3 s716unic;Sony Ericsson Device 716 USB Ethernet Emulation SEMC716 (WDM); C:\WINDOWS\system32\DRIVERS\s716unic.sys [2007-04-04 98952]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [2008-04-14 32128]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 ABBYY.Licensing.FineReader.ScreenshotReader.9.0;ABBYY.Licensing.FineReader.ScreenshotReader.9.0; C:\Program Files\ABBYY Screenshot Reader\NetworkLicenseServer.exe [2008-10-27 759072]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\System32\Ati2evxx.exe [2004-10-26 413696]
R2 AVP;Služba Kaspersky Anti-Virus; C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe [2011-03-22 352976]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]
R2 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; C:\WINDOWS\system32\IoctlSvc.exe [2006-12-19 81920]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service; C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [2011-03-08 1051968]
R3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2008-01-22 275752]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2004-10-26 516096]
S2 gupdate1c9be876827bd70;Služba Google Update (gupdate1c9be876827bd70); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-04-16 133104]
S2 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-04-16 183280]
S2 UxTuneUp;TuneUp Theme Extension; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Služba Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2008-04-08 800040]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service; C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe [2011-03-31 435008]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Služba sdílení portů Net.Tcp; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
-----------------EOF-----------------
Trojsky kun Trojan-GameThief. Win32. Staem.hi C:\System Volume Information\_restore{7BE5B964-F343-43E9-B088-5A03FE0A9BD3}Vy>257\A0046996.EXE
Od tohoto okamžiku se mě zdá, že počítač je pomalý. Potřeboval bych od někoho zjistit, zda je počítač stále ohrožen vnitřní hrozbou. Děkuji. Zde je log:
Logfile of random's system information tool 1.08 (written by random/random)
Run by moje1 at 2011-04-12 13:44:49
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 7 GB (23%) free of 30 GB
Total RAM: 768 MB (25% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:46:49, on 12.4.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ABBYY Screenshot Reader\NetworkLicenseServer.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ABBYY Screenshot Reader\ScreenshotReader.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtblfs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Opera\opera.exe
D:\Záloha\Programy\VYTVOŘENÍ LOGU PRO KONTROLU PC\RSIT.exe
C:\Program Files\trend micro\moje1.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.myheritage.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: MHURLSearchHook Class - {1C4AB6A5-595F-4e86-B15F-F93CCE2BBD48} - C:\Program Files\Family Toolbar\tbhelper.dll
O2 - BHO: MHTBPos00 - {0C37B053-FD68-456a-82E1-D788EE342E6F} - C:\Program Files\Family Toolbar\tbcore3.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\ievkbd.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll
O3 - Toolbar: Family Toolbar - {FD2FD708-1F6F-4B68-B141-C5778F0C19BB} - C:\Program Files\Family Toolbar\tbcore3.dll
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero 7\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [Family Tree Builder Update] C:\Program Files\MyHeritage\Bin\FTBCheckUpdates.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ABBYY Screenshot Reader Retail] "C:\Program Files\ABBYY Screenshot Reader\ScreenshotReader.exe" -autorun
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = ?
O4 - Global Startup: Adobe Reader Synchronizer.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Přidat do Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\ie_banner_deny.htm
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: &Virtuální klávesnice - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: K&ontrola adres URL - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partne ... nicode.cab
O16 - DPF: {6218F7B5-0D3A-48BA-AE4C-49DCFA63D400} (CSEQueryObject Object) - http://www.myheritage.cz/Genoogle/Compo ... eQuery.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 2037324722
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/get/f ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B7CEC668-BECE-4FDD-A588-7B0E24F5A32B}: NameServer = 93.153.117.1 62.141.0.2
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - (no file)
O20 - AppInit_DLLs: C:\DOCUME~1\ALLUSE~1.WIN\AVP11\mzvkbd3.dll,C:\DOCUME~1\ALLUSE~1.WIN\AVP11\kloehk.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: ABBYY.Licensing.FineReader.ScreenshotReader.9.0 - ABBYY (BIT Software) - C:\Program Files\ABBYY Screenshot Reader\NetworkLicenseServer.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Služba Kaspersky Anti-Virus (AVP) - Kaspersky Lab ZAO - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe
O23 - Service: Služba Google Update (gupdate1c9be876827bd70) (gupdate1c9be876827bd70) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
--
End of file - 9413 bytes
======Scheduled tasks folder======
C:\WINDOWS\tasks\20071118_144400_záloha_výpln_ZC5.job
C:\WINDOWS\tasks\20081115_205000_Posta.job
C:\WINDOWS\tasks\Google Software Updater.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{0A0CCE5C-13F9-484D-BFD4-6C9F2BC67947}.job
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0C37B053-FD68-456a-82E1-D788EE342E6F}]
MHTBPos00 Class - C:\Program Files\Family Toolbar\tbcore3.dll [2009-05-07 2642432]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}]
IEVkbdBHO Class - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\ievkbd.dll [2010-07-01 68280]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Plug-In - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-11-22 1242504]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll [2009-04-16 668656]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E33CF602-D945-461A-83F0-819F76A199F8}]
FilterBHO Class - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll [2010-07-01 191160]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{FD2FD708-1F6F-4B68-B141-C5778F0C19BB} - Family Toolbar - C:\Program Files\Family Toolbar\tbcore3.dll [2009-05-07 2642432]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"HPDJ Taskbar Utility"=C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe [2003-03-26 172032]
"NBKeyScan"=C:\Program Files\Nero\Nero 7\Nero BackItUp\NBKeyScan.exe [2008-04-08 1647912]
"AdslTaskBar"=stmctrl.dll,TaskBar []
"Family Tree Builder Update"=C:\Program Files\MyHeritage\Bin\FTBCheckUpdates.exe [2010-10-31 226832]
"AVP"=C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe [2011-03-22 352976]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-09-20 932288]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"AdslTaskBar"=stmctrl.dll,TaskBar []
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [2008-01-22 152872]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"ABBYY Screenshot Reader Retail"=C:\Program Files\ABBYY Screenshot Reader\ScreenshotReader.exe [2008-12-09 959776]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2011-01-26 15026056]
C:\Documents and Settings\All Users.WINDOWS\Nabídka Start\Programy\Po spuštění
Adobe Gamma Loader.exe.lnk -
Adobe Reader Synchronizer.lnk -
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\DOCUME~1\ALLUSE~1.WIN\AVP11\mzvkbd3.dll,C:\DOCUME~1\ALLUSE~1.WIN\AVP11\kloehk.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2004-10-26 90112]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
C:\WINDOWS\system32\klogon.dll [2010-07-01 228024]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Driver]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Guard]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AVG Anti-Spyware Driver]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AVG Anti-Spyware Guard]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SymEFA.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoInstrumentation"=1
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoResolveSearch"=1
"HonorAutoRunSetting"=1
"NoDriveTypeAutoRun"=28
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Opera\opera.exe"="C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
======File associations======
.js - open - %SystemRoot%\System32\CScript.exe "%1" %*
.vbs - open - %SystemRoot%\System32\CScript.exe "%1" %*
======List of files/folders created in the last 1 months======
2011-04-12 13:44:49 ----DC---- C:\rsit
2011-03-31 23:11:19 ----A---- C:\WINDOWS\system32\uxtuneup.dll
2011-03-31 22:53:57 ----A---- C:\WINDOWS\system32\TURegOpt.exe
2011-03-31 22:53:21 ----D---- C:\Program Files\TuneUp Utilities 2010
2011-03-31 17:39:29 ----SHDC---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
2011-03-24 11:25:13 ----HDC---- C:\WINDOWS\$NtUninstallKB2524375$
2011-03-19 12:21:09 ----DC---- C:\Documents and Settings\moje1\Data aplikací\skypePM
2011-03-19 12:11:38 ----D---- C:\Program Files\Common Files\Skype
2011-03-19 12:11:07 ----RD---- C:\Program Files\Skype
2011-03-19 12:11:05 ----DC---- C:\Documents and Settings\moje1\Data aplikací\Skype
2011-03-19 12:10:50 ----DC---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Skype
======List of files/folders modified in the last 1 months======
2011-04-12 13:46:49 ----D---- C:\Program Files\Trend Micro
2011-04-12 13:44:41 ----D---- C:\WINDOWS\Prefetch
2011-04-12 13:34:47 ----DC---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Kaspersky Lab
2011-04-12 12:26:00 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-04-12 11:37:52 ----D---- C:\WINDOWS\Temp
2011-04-12 11:34:22 ----D---- C:\WINDOWS\system32
2011-04-11 06:25:52 ----DC---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Google Updater
2011-04-08 16:49:56 ----D---- C:\Program Files\Opera
2011-04-05 21:55:42 ----AC---- C:\WINDOWS\NeroDigital.ini
2011-04-04 18:28:43 ----D---- C:\WINDOWS\system32\drivers
2011-04-04 07:38:22 ----DC---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Adobe
2011-03-31 23:38:21 ----DC---- C:\Config.Msi
2011-03-31 23:11:28 ----SHD---- C:\WINDOWS\Installer
2011-03-31 22:53:21 ----RD---- C:\Program Files
2011-03-31 22:52:51 ----D---- C:\WINDOWS
2011-03-31 18:23:43 ----D---- C:\WINDOWS\system32\config
2011-03-31 17:46:27 ----DC---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\TuneUp Software
2011-03-31 16:53:28 ----D---- C:\Program Files\Common Files\Adobe
2011-03-31 16:51:18 ----D---- C:\Program Files\Adobe
2011-03-31 16:50:18 ----D---- C:\WINDOWS\WinSxS
2011-03-30 22:30:49 ----AC---- C:\WINDOWS\MyHeritage.INI
2011-03-27 08:13:52 ----AC---- C:\WINDOWS\system32\PerfStringBackup.INI
2011-03-26 17:11:22 ----D---- C:\Program Files\Hry
2011-03-26 17:00:45 ----D---- C:\WINDOWS\system32\CatRoot2
2011-03-26 16:04:19 ----D---- C:\WINDOWS\repair
2011-03-26 16:02:50 ----D---- C:\WINDOWS\Registration
2011-03-24 11:25:22 ----HD---- C:\WINDOWS\inf
2011-03-24 11:24:11 ----HD---- C:\WINDOWS\$hf_mig$
2011-03-24 09:28:04 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2011-03-23 00:28:10 ----D---- C:\WINDOWS\security
2011-03-23 00:21:47 ----RSHDC---- C:\WINDOWS\system32\dllcache
2011-03-22 23:46:47 ----D---- C:\Program Files\TuxPaint
2011-03-22 22:53:16 ----A---- C:\WINDOWS\imsins.BAK
2011-03-22 22:53:08 ----D---- C:\WINDOWS\Help
2011-03-22 22:53:07 ----D---- C:\WINDOWS\Cursors
2011-03-22 22:53:06 ----D---- C:\Program Files\Windows NT
2011-03-22 22:52:39 ----D---- C:\WINDOWS\system32\wbem
2011-03-22 16:12:32 ----SHD---- C:\System Volume Information
2011-03-22 15:07:42 ----D---- C:\WINDOWS\system32\CatRoot
2011-03-22 15:04:51 ----DC---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Kaspersky Lab Setup Files
2011-03-22 15:03:23 ----D---- C:\Program Files\Kaspersky Lab
2011-03-19 12:11:38 ----D---- C:\Program Files\Common Files
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 imagedrv;imagedrv; C:\WINDOWS\System32\Drivers\imagedrv.sys [2008-01-22 11304]
R0 imagesrv;imagesrv; C:\WINDOWS\system32\DRIVERS\imagesrv.sys [2008-01-22 132904]
R0 kl1;kl1; C:\WINDOWS\system32\DRIVERS\kl1.sys [2010-06-09 132184]
R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2007-03-08 43528]
R0 viaagp;Filtr VIA sběrnice AGP ; C:\WINDOWS\System32\DRIVERS\viaagp.sys [2008-04-14 42240]
R1 kl2;kl2; C:\WINDOWS\system32\DRIVERS\kl2.sys [2010-06-09 11352]
R1 KLIF;Kaspersky Lab Driver; C:\WINDOWS\system32\DRIVERS\klif.sys [2011-03-22 475736]
R2 Fallback;Fallback; C:\WINDOWS\System32\DRIVERS\HSF_FALL.sys [2001-08-17 289887]
R2 Fsks;Fsks; C:\WINDOWS\System32\DRIVERS\HSF_FSKS.sys [2001-08-17 115807]
R2 K56;K56; C:\WINDOWS\System32\DRIVERS\HSF_K56K.sys [2001-08-17 391199]
R2 mdmxsdk;mdmxsdk; C:\WINDOWS\System32\DRIVERS\mdmxsdk.sys [2004-08-03 11868]
R2 SoftFax;SoftFax; C:\WINDOWS\System32\DRIVERS\HSF_FAXX.sys [2001-08-17 199711]
R2 Tones;Tones; C:\WINDOWS\System32\DRIVERS\HSF_TONE.sys [2001-08-17 50751]
R2 V124;V124; C:\WINDOWS\System32\DRIVERS\HSF_V124.sys [2001-08-17 488383]
R3 Afc;PPdus ASPI Shell; C:\WINDOWS\system32\drivers\Afc.sys [2005-02-23 11776]
R3 ALCXWDM;Service for Avance AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2002-07-12 655596]
R3 ati2mtag;ati2mtag; C:\WINDOWS\System32\DRIVERS\ati2mtag.sys [2004-10-26 820224]
R3 bbcap;bbcap; C:\WINDOWS\system32\DRIVERS\bbcap.sys [2008-12-20 4096]
R3 HSF_DP;HSF_DP; C:\WINDOWS\System32\DRIVERS\HSFDPSP2.sys [2004-08-03 1041536]
R3 HSFHWBS2;HSFHWBS2; C:\WINDOWS\System32\DRIVERS\HSFBS2S2.sys [2004-08-03 220032]
R3 klim5;Kaspersky Anti-Virus NDIS Filter; C:\WINDOWS\system32\DRIVERS\klim5.sys [2010-05-07 32856]
R3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver; C:\WINDOWS\system32\drivers\msmpu401.sys [2001-08-18 2944]
R3 NtApm;Ovladač rozhraní služby NT Apm/Legacy; C:\WINDOWS\System32\DRIVERS\NtApm.sys [2001-10-24 9472]
R3 Stmatm;ATM/ADSL miniport; C:\WINDOWS\system32\DRIVERS\stmatm.sys [2003-08-12 60255]
R3 TaurusUsb;ADSL Modem USB Service; C:\WINDOWS\system32\DRIVERS\torususb.sys [2003-12-23 549421]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv; \??\C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys []
R3 usbprint;Třída USB Printer; C:\WINDOWS\System32\DRIVERS\usbprint.sys [2008-04-14 25856]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2008-04-14 20608]
R3 winachsf;winachsf; C:\WINDOWS\System32\DRIVERS\HSFCXTS2.sys [2004-08-03 685056]
S1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
S3 AF15BDA;AF9015 BDA Filter; C:\WINDOWS\System32\Drivers\AF15BDA.sys [2006-09-28 283776]
S3 basic2;basic2; C:\WINDOWS\System32\DRIVERS\HSF_BSC2.sys [2001-08-17 67167]
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
S3 hsf_msft;hsf_msft; C:\WINDOWS\System32\DRIVERS\HSF_MSFT.sys [2001-08-17 542879]
S3 klmouflt;Kaspersky Lab KLMOUFLT; C:\WINDOWS\system32\DRIVERS\klmouflt.sys [2009-11-02 19472]
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-10-24 12160]
S3 MPE;Filtr MPE BDA; C:\WINDOWS\system32\DRIVERS\MPE.sys [2008-04-14 15232]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 Rksample;Rksample; C:\WINDOWS\System32\DRIVERS\HSF_SAMP.sys [2001-08-17 57471]
S3 s716bus;Sony Ericsson Device 716 driver (WDM); C:\WINDOWS\system32\DRIVERS\s716bus.sys [2007-06-29 83208]
S3 s716mdfl;Sony Ericsson Device 716 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\s716mdfl.sys [2007-06-29 15112]
S3 s716mdm;Sony Ericsson Device 716 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\s716mdm.sys [2007-06-29 108552]
S3 s716mgmt;Sony Ericsson Device 716 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\s716mgmt.sys [2007-04-04 100360]
S3 s716nd5;Sony Ericsson Device 716 USB Ethernet Emulation SEMC716 (NDIS); C:\WINDOWS\system32\DRIVERS\s716nd5.sys [2007-04-04 23176]
S3 s716obex;Sony Ericsson Device 716 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\s716obex.sys [2007-04-04 98568]
S3 s716unic;Sony Ericsson Device 716 USB Ethernet Emulation SEMC716 (WDM); C:\WINDOWS\system32\DRIVERS\s716unic.sys [2007-04-04 98952]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [2008-04-14 32128]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 ABBYY.Licensing.FineReader.ScreenshotReader.9.0;ABBYY.Licensing.FineReader.ScreenshotReader.9.0; C:\Program Files\ABBYY Screenshot Reader\NetworkLicenseServer.exe [2008-10-27 759072]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\System32\Ati2evxx.exe [2004-10-26 413696]
R2 AVP;Služba Kaspersky Anti-Virus; C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe [2011-03-22 352976]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]
R2 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; C:\WINDOWS\system32\IoctlSvc.exe [2006-12-19 81920]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service; C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [2011-03-08 1051968]
R3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2008-01-22 275752]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2004-10-26 516096]
S2 gupdate1c9be876827bd70;Služba Google Update (gupdate1c9be876827bd70); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-04-16 133104]
S2 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-04-16 183280]
S2 UxTuneUp;TuneUp Theme Extension; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Služba Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2008-04-08 800040]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service; C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe [2011-03-31 435008]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Služba sdílení portů Net.Tcp; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
-----------------EOF-----------------
Re: Zpomalil se počítač.
Zdravim a pekny den preji
Havet se usadila v bodech obnoveni - smazte je dle navodu kolegy riffa http://www.viry.cz/forum/viewtopic.php?f=11&t=47040
Stahnete Malwarebytes' Anti-Malware (zkracene MBAM) (viz muj podpis)
Havet se usadila v bodech obnoveni - smazte je dle navodu kolegy riffa http://www.viry.cz/forum/viewtopic.php?f=11&t=47040
Stahnete Malwarebytes' Anti-Malware (zkracene MBAM) (viz muj podpis)
- Provedte aktualizaci - treti zalozka
- Provedte uplny sken - nic nemazte
- MBAM miva obcas falesne detekce, proto vlozte log do prispevku a pockejte na posouzeni
Re: Zpomalil se počítač.
Pěkný den.
Musím se hned zeptat, než na to zapomenu. Až provedu odstranění bodu obnovy, dle návodu, mohu jej zase zapnout?
Musím se hned zeptat, než na to zapomenu. Až provedu odstranění bodu obnovy, dle návodu, mohu jej zase zapnout?
Re: Zpomalil se počítač.
Ano, vzdyt je to tam i napsano
Re: Zpomalil se počítač.
Pěkný den.
V prvé řadě se omlouvám za spam. Všiml jsem si toho, až když jsem napsal dotaz.
Zde zasílám log z MBAM.
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Verze databáze: 6341
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
12.4.2011 18:25:28
mbam-log-2011-04-12 (18-24-47).txt
Typ kontroly: Úplný test (C:\|D:\|)
Testované objekty: 299183
Uplynulý čas: 1 hodin, 8 minut, 31 sekund
Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 0
Infikované hodnoty v registru: 0
Infikované datové položky v registru: 0
Infikované složky: 0
Infikované soubory: 1
Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)
Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)
Infikované klíče v registru:
(Žádné škodlivé položky nebyly zjištěny)
Infikované hodnoty v registru:
(Žádné škodlivé položky nebyly zjištěny)
Infikované datové položky v registru:
(Žádné škodlivé položky nebyly zjištěny)
Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)
Infikované soubory:
d:\system volume information\_restore{6768fba0-ef19-4480-9047-a90fb23da263}\RP172\A0044341.exe (Adware.MyWebSearch) -> No action taken.
V prvé řadě se omlouvám za spam. Všiml jsem si toho, až když jsem napsal dotaz.
Zde zasílám log z MBAM.
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Verze databáze: 6341
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
12.4.2011 18:25:28
mbam-log-2011-04-12 (18-24-47).txt
Typ kontroly: Úplný test (C:\|D:\|)
Testované objekty: 299183
Uplynulý čas: 1 hodin, 8 minut, 31 sekund
Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 0
Infikované hodnoty v registru: 0
Infikované datové položky v registru: 0
Infikované složky: 0
Infikované soubory: 1
Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)
Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)
Infikované klíče v registru:
(Žádné škodlivé položky nebyly zjištěny)
Infikované hodnoty v registru:
(Žádné škodlivé položky nebyly zjištěny)
Infikované datové položky v registru:
(Žádné škodlivé položky nebyly zjištěny)
Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)
Infikované soubory:
d:\system volume information\_restore{6768fba0-ef19-4480-9047-a90fb23da263}\RP172\A0044341.exe (Adware.MyWebSearch) -> No action taken.
Re: Zpomalil se počítač.
Nalez MBAMu smazte
TFC http://oldtimer.geekstogo.com/TFC.exe
Panel čistič
Doporucuji provest defragmentaci disku
TFC http://oldtimer.geekstogo.com/TFC.exe
- Stahnete a spustte
- Kliknete na Start a potvrdte OK
- Program uklidi a restartuje pc
- Po pouziti utilitu smazte
Panel čistič
- Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner
- dejte Hledej problémy
- nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
- postup opakujte dokud nebude bez problemu - vetsinou cca 3x
- Zde muzete odinstalovat nepotrebne programy
Doporucuji provest defragmentaci disku
- Nejjednodussi (ale nejmene ucinny) zpusob je pomoci utility ve windowsech
- Kliknete na Tento pocitac, dale na disk kliknete pravym tlacitkem, vyberte Vlastnosti
- prepnete se do zalozky Nastroje
- Nyni vidite pomucky Defragmentace - spustte ji kliknutim na Defragmentovat
- Toto provedte se vsemi disky
- Dalsi moznosti (a mnou doporucenou) je pres programek Defraggler http://www.stahuj.centrum.cz/utility_a_ ... efraggler/
- Program stahnete, nainstalujte (dejte fajfku pryc u yahoo toolbaru) a spustte
- Kliknete na Analyzovat
- Pokud je ve sloupci Fragmentováno vice jak 5%, doporucuji provest defragmentaci (klik na Defragmentovat)
- Postup provedte se vsemi disky
- Posledni moznost je pres jednoduchy programek JKDefrag http://www.stahuj.centrum.cz/utility_a_ ... /jkdefrag/
- Vyhodou programku je, ze se neinstaluje
- Staci tedy jen stahnout dle verze vaseho OS a rozbalit
- Nasledne spustit pomoci souboru JKDefrag pripadne JKDefrag64
- Probehne analyza disku a nasledne i defragmentace
Re: Zpomalil se počítač.
K čistění a defragmentaci používám program TuneUp Utilities. Čistění a defragmentace probíhá každé tři dny. To nestačí?
Re: Zpomalil se počítač.
TuneUp neumi cistit to co CClenaer a TFC
Re: Zpomalil se počítač.
Děkuji za pomoc. Zatím jsem použil TFC. Pokračovat budu až zítra. Dnes mám jiné povinnosti. Pak dám vědět jak se podařilo.
Re: Zpomalil se počítač.
Pěkný den!
Tak jsem provedl všechny doporučené akce. Výsledek byl výborný. Balast zabíral přes 3 Giga. Rychlost je v normálu. Ale.....
Před určitou dobou, jsem si na doporučení časopisu Chip, nainstaloval prográmek UPM. Po všech akcích jsem dal scan tímto programem. A co nevidím: Hlásí, že jsou tam asi 2 rootkity. Tak co dál s detoxikací PC? Děkuji za váš čas, který mě ještě bude věnovat.
Scan přikládám.
Windows XP SP 3 (build 2600)
Boot Mode: Normal
Ověření souborů Microsoftu: Ano
Whitelist: Ano
Internet Explorer v8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
Log vygenerován: 13.4.2011 14:23:40
================================================================
SmallARK
================================================================
[R]NtAdjustPrivilegesToken -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtClearEvent -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtClose -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtConnectPort -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtCreateEvent -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtCreateFile -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtCreateJobObject -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtCreateKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtCreateMutant -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtCreateNamedPipeFile -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtCreatePort -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtCreateSection -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtCreateSemaphore -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtCreateThread -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtCreateWaitablePort -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtDebugActiveProcess -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtDeleteKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtDeleteValueKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtDeviceIoControlFile -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtDuplicateObject -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtEnumerateKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtEnumerateValueKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtFsControlFile -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtLoadDriver -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtLoadKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtLoadKey2 -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtMapViewOfSection -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtNotifyChangeKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtOpenEvent -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtOpenFile -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtOpenKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtOpenMutant -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtOpenProcess -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtOpenSection -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtOpenSemaphore -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtOpenThread -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtQueryKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtQueryMultipleValueKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtQuerySection -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtQueryValueKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtQueueApcThread -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtRenameKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtReplaceKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtReplyPort -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtReplyWaitReceivePort -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtRequestWaitReplyPort -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtRestoreKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtResumeThread -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtSaveKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtSecureConnectPort -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtSetContextThread -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtSetInformationToken -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtSetSecurityObject -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtSetSystemInformation -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtSetValueKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtSuspendProcess -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtSuspendThread -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtSystemDebugControl -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtTerminateJobObject -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtTerminateProcess -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtTerminateThread -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtUnmapViewOfSection -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtWriteVirtualMemory -> C:\WINDOWS\system32\drivers\klif.sys
Běžící procesy
================================================================
(rootkit?)
(rootkit?) System
C:\WINDOWS\SYSTEM32\SERVICES.EXE
C:\WINDOWS\SYSTEM32\ATI2EVXX.EXE
C:\WINDOWS\SYSTEM32\SPOOLSV.EXE
C:\WINDOWS\SYSTEM32\ATI2EVXX.EXE
C:\PROGRAM FILES\UPM\UPM.EXE
Scanner
================================================================
Proces se nepodařilo otevřít
ROOTKIT? Skrytá cesta
Spouští se po startu HKCU Run [AdslTaskBar]
Nelze otevřít
Nemá okno
System
ROOTKIT? Skrytá cesta
Spouští se po startu HKCU Run [AdslTaskBar]
Jiná ImageBase 00000000h
BaseAddress
Skrytá cesta EXE:
Nemá okno
[S, novf!] services.exe
Non Microsoft v System32:
Ověřený Microsoft: Ne
Nemá okno
[?] ati2evxx.exe
Non Microsoft v System32:
[S, novf!] spoolsv.exe
Non Microsoft v System32:
Ověřený Microsoft: Ne
Nemá okno
[R] avp.exe
Spouští se po startu HKLM Run [AVP]
[R] MDM.EXE
Ověřený Microsoft: Ne
[?] ati2evxx.exe
Non Microsoft v System32:
[S] explorer.exe
Spouští se po startu HKLM Winlogon [Shell]
[R] avp.exe
Spouští se po startu HKLM Run [AVP]
[R] NMBgMonitor.exe
Spouští se po startu HKCU Run [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
[S] ctfmon.exe
Spouští se po startu HKCU Run [ctfmon.exe]
[R] ScreenshotReader.exe
Spouští se po startu HKCU Run [ABBYY Screenshot Reader Retail]
[R] Skype.exe
Spouští se po startu HKCU Run [Skype]
Podvržená cesta modulu: (00400000) C:\Program Files\Skype\Phone\Skype.exe
[R] skypePM.exe
EntryPoint v sekci: CODE
|_ Celkový počet sekcí: 8
[?] UPM.exe
Soubor 7%
Po spuštění
================================================================
HKCU Run
|_ [?][AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
|_ [R][ABBYY Screenshot Reader Retail] C:\Program Files\ABBYY Screenshot Reader\ScreenshotReader.exe -autorun
|_ [R][Skype] C:\Program Files\Skype\Phone\Skype.exe /nosplash /minimized
HKLM Run
|_ [?][HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
|_ [?][AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
HKLM ShellServiceObjectDelayLoad
|_ [?][PostBootReminder] C:\WINDOWS\system32\SHELL32.dll
|_ [?][CDBurn] C:\WINDOWS\system32\SHELL32.dll
|_ [?][WebCheck] C:\WINDOWS\system32\webcheck.dll
|_ [?][WPDShServiceObj] C:\WINDOWS\system32\WPDShServiceObj.dll
HKLM IC
|_ [?][<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}] C:\WINDOWS\system32\ieudinit.exe
|_ [?][>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] C:\WINDOWS\inf\unregmp2.exe /ShowWMP
|_ [?][>{26923b43-4d38-484f-9b9e-de460746276c}] C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
|_ [?][{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] C:\WINDOWS\INF\msnetmtg.inf ,NetMtg.Install.PerUser.NT
|_ [?][{5945c046-1e7d-11d1-bc44-00c04fd912be}] C:\WINDOWS\INF\msmsgs.inf ,BLC.QuietInstall.PerUser
|_ [?][{6BF52A52-394A-11d3-B153-00C04F79FAA6}] C:\WINDOWS\INF\wmp11.inf ,PerUserStub
|_ [?][{89820200-ECBD-11cf-8B85-00AA005B4340}] regsvr32.exe /s /n /i:U shell32.dll
|_ [?][{89820200-ECBD-11cf-8B85-00AA005B4383}] C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
HKLM Winlogon Notify
|_ [?][AtiExtEvent] C:\WINDOWS\system32\Ati2evxx.dll
HKLM AppInit_DLLs
|_ [R][AppInit_DLLs] C:\DOCUME~1\ALLUSE~1.WIN\AVP11\mzvkbd3.dll , C:\DOCUME~1\ALLUSE~1.WIN\AVP11\kloehk.dll
Job
|_ [?][User_Feed_Synchronization-{0A0CCE5C-13F9-484D-BFD4-6C9F2BC67947}.job] C:\WINDOWS\system32\msfeedssync.exe
|_ [?][User_Feed_Synchronization-{0A0CCE5C-13F9-484D-BFD4-6C9F2BC67947}.job] C:\WINDOWS\system32\msfeedssync.exe
HKLM BHO
|_ [?][{0C37B053-FD68-456a-82E1-D788EE342E6F}] C:\Program Files\Family Toolbar\tbcore3.dll
HKCU IE WebBrowser Toolbar
|_ [?][{0E5CBF21-D15F-11D0-8301-00AA005B4383}] C:\WINDOWS\system32\SHELL32.dll
|_ [?][{FD2FD708-1F6F-4B68-B141-C5778F0C19BB}] C:\Program Files\Family Toolbar\tbcore3.dll
HKLM IE Toolbar
|_ [?][{FD2FD708-1F6F-4B68-B141-C5778F0C19BB}] C:\Program Files\Family Toolbar\tbcore3.dll
Služby (Zobraz běžící: True, Zobraz zastavené: False, Zobraz i bezpečné služby: False)
================================================================
[X] ABBYY.Licensing.FineReader.ScreenshotReader.9.0
|_ Cesta: C:\Program Files\ABBYY Screenshot Reader\NetworkLicenseServer.exe -service
| |_ Výrobce:
| |_ Popis:
| |_ MD5:
|
|_ Jméno: ABBYY.Licensing.FineReader.ScreenshotReader.9.0
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Win32 Own Process
|_ Dependency: RPCSS
[?] Ati HotKey Poller
|_ Cesta: C:\WINDOWS\System32\Ati2evxx.exe
| |_ Výrobce: ATI Technologies Inc.
| |_ Popis: ATI External Event Utility EXE Module
| |_ MD5: E9E4CAAF26D436D1DF177AE484090750
|
|_ Jméno: Ati HotKey Poller
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ:
|_ Dependency:
[?] ATI Smart
|_ Cesta: C:\WINDOWS\system32\ati2sgag.exe
| |_ Výrobce:
| |_ Popis: ATI Smart
| |_ MD5: 7A20E3A78A97C9E3D5BFE1FA36AA7A50
|
|_ Jméno: ATI Smart
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Zastaveno
|_ Typ:
|_ Dependency:
[?] Spouštěč procesů serveru DCOM
|_ Cesta: C:\WINDOWS\system32\svchost.exe
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Generic Host Process for Win32 Services
| |_ MD5: BE4A520E29B6391F49E79CCC52044D93
|
|_ ServiceDLL: C:\WINDOWS\system32\rpcss.dll
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Distributed COM Services
| |_ MD5: BE27674D1CBC3214AEC84B4336A38BBF
|
|_ Jméno: DcomLaunch
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Win32 Share Process
|_ Dependency:
[?] Protokol událostí
|_ Cesta: C:\WINDOWS\system32\services.exe
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Services and Controller app
| |_ MD5: 9EF697AF07BB8DD82C3B02CA953A95B7
|
|_ Jméno: Eventlog
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Win32 Share Process
|_ Dependency:
[X] Služba Google Update (gupdate1c9be876827bd70)
|_ Cesta: C:\Program Files\Google\Update\GoogleUpdate.exe /svc
| |_ Výrobce:
| |_ Popis:
| |_ MD5:
|
|_ Jméno: gupdate1c9be876827bd70
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Zastaveno
|_ Typ: Win32 Own Process
|_ Dependency: RPCSS
[?] Server
|_ Cesta: C:\WINDOWS\System32\svchost.exe
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Generic Host Process for Win32 Services
| |_ MD5: BE4A520E29B6391F49E79CCC52044D93
|
|_ ServiceDLL: C:\WINDOWS\System32\srvsvc.dll
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Server Service DLL
| |_ MD5: 3428E8F86F8ADD36B42FB23542C7B3E4
|
|_ Jméno: lanmanserver
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Win32 Share Process
|_ Dependency:
[?] Pracovní stanice
|_ Cesta: C:\WINDOWS\System32\svchost.exe
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Generic Host Process for Win32 Services
| |_ MD5: BE4A520E29B6391F49E79CCC52044D93
|
|_ ServiceDLL: C:\WINDOWS\System32\wkssvc.dll
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Workstation Service DLL
| |_ MD5: 936C1D110232D23B621CB0196E4F80F0
|
|_ Jméno: lanmanworkstation
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Win32 Share Process
|_ Dependency:
[?] Plug and Play
|_ Cesta: C:\WINDOWS\system32\services.exe
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Services and Controller app
| |_ MD5: 9EF697AF07BB8DD82C3B02CA953A95B7
|
|_ Jméno: PlugPlay
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Win32 Share Process
|_ Dependency:
[?] Vzdálené volání procedur (RPC)
|_ Cesta: C:\WINDOWS\system32\svchost.exe
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Generic Host Process for Win32 Services
| |_ MD5: BE4A520E29B6391F49E79CCC52044D93
|
|_ ServiceDLL: C:\WINDOWS\system32\rpcss.dll
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Distributed COM Services
| |_ MD5: BE27674D1CBC3214AEC84B4336A38BBF
|
|_ Jméno: RpcSs
|_ StartName: NT Authority\NetworkService
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Win32 Own Process
|_ Dependency:
[?] Rozpoznávání hardwaru
|_ Cesta: C:\WINDOWS\System32\svchost.exe
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Generic Host Process for Win32 Services
| |_ MD5: BE4A520E29B6391F49E79CCC52044D93
|
|_ ServiceDLL: C:\WINDOWS\System32\shsvcs.dll
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Windows Shell Services Dll
| |_ MD5: EE9A2B9EA968A792A053C9D1A86BF870
|
|_ Jméno: ShellHWDetection
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Win32 Share Process
|_ Dependency: RpcSs
[?] Zařazování tisku
|_ Cesta: C:\WINDOWS\system32\spoolsv.exe
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Spooler SubSystem App
| |_ MD5: 60784F891563FB1B767F70117FC2428F
|
|_ Jméno: Spooler
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ:
|_ Dependency: RPCSS
[?] Motivy
|_ Cesta: C:\WINDOWS\System32\svchost.exe
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Generic Host Process for Win32 Services
| |_ MD5: BE4A520E29B6391F49E79CCC52044D93
|
|_ ServiceDLL: C:\WINDOWS\System32\shsvcs.dll
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Windows Shell Services Dll
| |_ MD5: EE9A2B9EA968A792A053C9D1A86BF870
|
|_ Jméno: Themes
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Zastaveno
|_ Typ: Win32 Share Process
|_ Dependency:
[R] TuneUp Theme Extension
|_ Cesta: C:\WINDOWS\System32\svchost.exe
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Generic Host Process for Win32 Services
| |_ MD5: BE4A520E29B6391F49E79CCC52044D93
|
|_ ServiceDLL: C:\WINDOWS\System32\uxtuneup.dll
| |_ Výrobce: TuneUp Software
| |_ Popis: TuneUp Theme Extension
| |_ MD5: D4BD1E2B3EA4E02A526B41514F31D3BC
|
|_ Jméno: UxTuneUp
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Zastaveno
|_ Typ: Win32 Share Process
|_ Dependency: Themes
Ovladače (Zobraz běžící: True, Zobraz zastavené: False, Zobraz i bezpečné služby: False)
================================================================
[?] PPdus ASPI Shell
|_ Cesta: C:\WINDOWS\system32\drivers\Afc.sys
| |_ Výrobce: Arcsoft, Inc.
| |_ Popis: Arcsoft(R) ASPI Shell
| |_ MD5: A7B8A3A79D35215D798A300DF49ED23F
|
|_ Jméno: Afc
|_ StartName:
|_ Typ spouštění: Ruční spuštění
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:
[?] Service for Avance AC97 Audio (WDM)
|_ Cesta: C:\WINDOWS\system32\drivers\ALCXWDM.SYS
| |_ Výrobce: Avance Logic, Inc.
| |_ Popis: Avance AC'97 Audio Driver (WDM)
| |_ MD5: 7BFE59F5EFF8896D043CFDE731B262E9
|
|_ Jméno: ALCXWDM
|_ StartName:
|_ Typ spouštění: Ruční spuštění
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:
[?] ati2mtag
|_ Cesta: C:\WINDOWS\System32\DRIVERS\ati2mtag.sys
| |_ Výrobce: ATI Technologies Inc.
| |_ Popis: ATI Radeon WindowsNT Miniport Driver
| |_ MD5: 85C673F5862441F231099809235B5657
|
|_ Jméno: ati2mtag
|_ StartName:
|_ Typ spouštění: Ruční spuštění
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:
[?] Fallback
|_ Cesta: C:\WINDOWS\System32\DRIVERS\HSF_FALL.sys
| |_ Výrobce: Conexant
| |_ Popis: Fallback driver
| |_ MD5: C823DEBE2548656549F84A875D65237B
|
|_ Jméno: Fallback
|_ StartName:
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:
[?] Fsks
|_ Cesta: C:\WINDOWS\System32\DRIVERS\HSF_FSKS.sys
| |_ Výrobce: Conexant
| |_ Popis: FSKsNT driver
| |_ MD5: 6483414841D4CAB6C3B4DB2AC6EDD70B
|
|_ Jméno: Fsks
|_ StartName:
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:
[?] HSFHWBS2
|_ Cesta: C:\WINDOWS\System32\DRIVERS\HSFBS2S2.sys
| |_ Výrobce: Conexant Systems, Inc.
| |_ Popis: HSF_HWB2 WDM driver
| |_ MD5: 970178E8E003EB1481293830069624B9
|
|_ Jméno: HSFHWBS2
|_ StartName:
|_ Typ spouštění: Ruční spuštění
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:
[?] HSF_DP
|_ Cesta: C:\WINDOWS\System32\DRIVERS\HSFDPSP2.sys
| |_ Výrobce: Conexant Systems, Inc.
| |_ Popis: HSF_DP driver
| |_ MD5: EBB354438A4C5A3327FB97306260714A
|
|_ Jméno: HSF_DP
|_ StartName:
|_ Typ spouštění: Ruční spuštění
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:
[?] Služba HTTP
|_ Cesta: C:\WINDOWS\System32\Drivers\HTTP.sys
| |_ Výrobce: Microsoft Corporation
| |_ Popis: HTTP Protocol Stack
| |_ MD5: F80A415EF82CD06FFAF0D971528EAD38
|
|_ Jméno: HTTP
|_ StartName:
|_ Typ spouštění: Ruční spuštění
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:
[?] K56
|_ Cesta: C:\WINDOWS\System32\DRIVERS\HSF_K56K.sys
| |_ Výrobce: Conexant
| |_ Popis: K56NT driver
| |_ MD5: 9C5E3FDBFCC30CF71A49CA178B9AD442
|
|_ Jméno: K56
|_ StartName:
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:
[?] KSecDD
|_ Cesta: C:\WINDOWS\system32\drivers\KSecDD.sys
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Kernel Security Support Provider Interface
| |_ MD5: B467646C54CC746128904E1654C750C1
|
|_ Jméno: KSecDD
|_ StartName:
|_ Typ spouštění: Boot Start
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:
[?] mdmxsdk
|_ Cesta: C:\WINDOWS\System32\DRIVERS\mdmxsdk.sys
| |_ Výrobce: Conexant
| |_ Popis: Diagnostic Interface DRIVER
| |_ MD5: 195741AEE20369980796B557358CD774
|
|_ Jméno: mdmxsdk
|_ StartName:
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:
[?] MRXSMB
|_ Cesta: C:\WINDOWS\System32\DRIVERS\mrxsmb.sys
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Windows NT SMB Minirdr
| |_ MD5: F3AEFB11ABC521122B67095044169E98
|
|_ Jméno: MRxSmb
|_ StartName:
|_ Typ spouštění: System Start
|_ Status: Spuštěno
|_ Typ: File System Driver
|_ Dependency:
[?] Služba NDIS Proxy
|_ Cesta: C:\WINDOWS\system32\drivers\NDProxy.sys
| |_ Výrobce: Microsoft Corporation
| |_ Popis: NDIS Proxy
| |_ MD5: 9282BD12DFB069D3889EB3FCC1000A9B
|
|_ Jméno: NDProxy
|_ StartName:
|_ Typ spouštění: Ruční spuštění
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:
[?] SoftFax
|_ Cesta: C:\WINDOWS\System32\DRIVERS\HSF_FAXX.sys
| |_ Výrobce: Conexant
| |_ Popis: FaxNT driver
| |_ MD5: D9E8E0CE154A2F6430D9EFABDF730867
|
|_ Jméno: SoftFax
|_ StartName:
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:
[?] Srv
|_ Cesta: C:\WINDOWS\System32\DRIVERS\srv.sys
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Server driver
| |_ MD5: 0F6AEFAD3641A657E18081F52D0C15AF
|
|_ Jméno: Srv
|_ StartName:
|_ Typ spouštění: Ruční spuštění
|_ Status: Spuštěno
|_ Typ: File System Driver
|_ Dependency:
[?] ATM/ADSL miniport
|_ Cesta: C:\WINDOWS\system32\DRIVERS\stmatm.sys
| |_ Výrobce: STMicroelectronics
| |_ Popis: ATM/ADSL miniport
| |_ MD5: 2FC0C3D5615395585ABDB16660EFBC3A
|
|_ Jméno: Stmatm
|_ StartName:
|_ Typ spouštění: Ruční spuštění
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:
[?] ADSL Modem USB Service
|_ Cesta: C:\WINDOWS\system32\DRIVERS\torususb.sys
| |_ Výrobce: ?
| |_ Popis: ?
| |_ MD5: 22826EEDAAAEFBB0B95E33CD24314375
|
|_ Jméno: TaurusUsb
|_ StartName:
|_ Typ spouštění: Ruční spuštění
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:
[?] Tones
|_ Cesta: C:\WINDOWS\System32\DRIVERS\HSF_TONE.sys
| |_ Výrobce: Conexant
| |_ Popis: TonesNT driver
| |_ MD5: 8021A499DB46B2961C285168671CB9AF
|
|_ Jméno: Tones
|_ StartName:
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:
[?] V124
|_ Cesta: C:\WINDOWS\System32\DRIVERS\HSF_V124.sys
| |_ Výrobce: Conexant
| |_ Popis: V124NT driver
| |_ MD5: 269C0ADE94B90029B12497747BE408CB
|
|_ Jméno: V124
|_ StartName:
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:
[?] winachsf
|_ Cesta: C:\WINDOWS\System32\DRIVERS\HSFCXTS2.sys
| |_ Výrobce: Conexant Systems, Inc.
| |_ Popis: HSF_CNXT driver
| |_ MD5: 1225EBEA76AAC3C84DF6C54FE5E5D8BE
|
|_ Jméno: winachsf
|_ StartName:
|_ Typ spouštění: Ruční spuštění
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:
lNetStat
================================================================
Typ: PID Proces Local <-> Remote Status
-----------------------------------------------------------------------------------------
TCP (1812) Skype.exe 0.0.0.0:80 LISTENING
TCP (1068) svchost.exe 0.0.0.0:135 LISTENING
TCP (1812) Skype.exe 0.0.0.0:443 LISTENING
TCP (4) Systém 0.0.0.0:445 LISTENING
TCP (1600) avp.exe 0.0.0.0:1110 LISTENING
TCP (1812) Skype.exe 0.0.0.0:59642 LISTENING
TCP (1812) Skype.exe 78.80.6.20:443 <-> 78.100.38.30:36425 ESTABLISHED
TCP (1812) Skype.exe 78.80.6.20:443 <-> 195.113.201.101:23413 ESTABLISHED
TCP (1812) Skype.exe 78.80.6.20:443 <-> 217.77.161.17:19116 ESTABLISHED
TCP (1600) avp.exe 78.80.6.20:4008 <-> 85.239.154.117:10487 ESTABLISHED
TCP (1600) avp.exe 78.80.6.20:4014 <-> 212.161.8.4:12350 ESTABLISHED
TCP (1600) avp.exe 78.80.6.20:4113 CLOSE_WAIT
TCP (1600) avp.exe 78.80.6.20:4118 <-> 93.99.17.238:80 ESTABLISHED
TCP (1812) Skype.exe 78.80.6.20:59642 <-> 81.200.55.82:4459 ESTABLISHED
TCP (1600) avp.exe 127.0.0.1:1110 <-> 127.0.0.1:4007 ESTABLISHED
TCP (1600) avp.exe 127.0.0.1:1110 <-> 127.0.0.1:4013 ESTABLISHED
TCP (1600) avp.exe 127.0.0.1:1110 FIN_WAIT2
TCP (0) 127.0.0.1:1110 TIME_WAIT
TCP (1600) avp.exe 127.0.0.1:1110 <-> 127.0.0.1:4117 ESTABLISHED
TCP (1812) Skype.exe 127.0.0.1:4007 <-> 127.0.0.1:1110 ESTABLISHED
TCP (1812) Skype.exe 127.0.0.1:4013 <-> 127.0.0.1:1110 ESTABLISHED
TCP (1664) UPM.exe 127.0.0.1:4112 CLOSE_WAIT
UDP (1812) Skype.exe 0.0.0.0:443 <-> 127.0.0.1:1110 ESTABLISHED
UDP (4) Systém 0.0.0.0:445
UDP (744) lsass.exe 0.0.0.0:500
UDP (1600) avp.exe 0.0.0.0:2581
UDP (744) lsass.exe 0.0.0.0:4500
UDP (1812) Skype.exe 0.0.0.0:59642
UDP (1296) svchost.exe 78.80.6.20:1900
UDP (1732) opera.exe 78.80.6.20:1900
UDP (1732) opera.exe 78.80.6.20:4114
UDP (1296) svchost.exe 127.0.0.1:1900
UDP (2076) ScreenshotReader.exe127.0.0.1:3934
UDP (1812) Skype.exe 127.0.0.1:4006
UDP (1812) Skype.exe 127.0.0.1:4017
Moduly (Zobraz i bezpečné DLL: False, Jen bez výrobce: True, Zobraz registrované: False)
================================================================
[!] kjim.kdl.0b52ef7124235e8f8711175b8fad0aad
|_ Cesta: C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Kaspersky Lab\AVP11\Bases\Cache\kjim.kdl.0b52ef7124235e8f8711175b8fad0aad
|_ MD5: 0B52EF7124235E8F8711175B8FAD0AAD
|_ Výrobce: Kaspersky Lab ZAO
|_ Procesy
|_ avp.exe (1600)
[!] pbs.kdl.a3dbdf39fdcbbca23e0dfb303b8030d6
|_ Cesta: C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Kaspersky Lab\AVP11\Bases\Cache\pbs.kdl.a3dbdf39fdcbbca23e0dfb303b8030d6
|_ MD5: A3DBDF39FDCBBCA23E0DFB303B8030D6
|_ Výrobce: Kaspersky Lab ZAO
|_ Procesy
|_ avp.exe (1600)
[?] bsshlp.kdl.c333e2601f1b0d52312ab3ec900c2e4d
|_ Cesta: C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Kaspersky Lab\AVP11\Bases\Cache\bsshlp.kdl.c333e2601f1b0d52312ab3ec900c2e4d
|_ MD5: C333E2601F1B0D52312AB3EC900C2E4D
|_ Výrobce: Kaspersky Lab ZAO
|_ Procesy
|_ avp.exe (1600)
[?] vlns.kdl.002d59a92d55ccbddcca8fba8ea8340d
|_ Cesta: C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Kaspersky Lab\AVP11\Bases\Cache\vlns.kdl.002d59a92d55ccbddcca8fba8ea8340d
|_ MD5: 002D59A92D55CCBDDCCA8FBA8EA8340D
|_ Výrobce: Kaspersky Lab
|_ Procesy
|_ avp.exe (1600)
[!] mark.kdl.4c174a6abe5d8edee2169b038e0925d7
|_ Cesta: C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Kaspersky Lab\AVP11\Bases\Cache\mark.kdl.4c174a6abe5d8edee2169b038e0925d7
|_ MD5: 4C174A6ABE5D8EDEE2169B038E0925D7
|_ Výrobce: Kaspersky Lab ZAO
|_ Procesy
|_ avp.exe (1600)
[!] klavemu.kdl.b2beb3b968abcbef0057cdfe20932efd
|_ Cesta: C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Kaspersky Lab\AVP11\Bases\Cache\klavemu.kdl.b2beb3b968abcbef0057cdfe20932efd
|_ MD5: B2BEB3B968ABCBEF0057CDFE20932EFD
|_ Výrobce: Kaspersky Lab ZAO
|_ Procesy
|_ avp.exe (1600)
[!] qscan.kdl.f5e6e61c7ced81e9880827d5026b35ff
|_ Cesta: C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Kaspersky Lab\AVP11\Bases\Cache\qscan.kdl.f5e6e61c7ced81e9880827d5026b35ff
|_ MD5: F5E6E61C7CED81E9880827D5026B35FF
|_ Výrobce: Kaspersky Lab ZAO
|_ Procesy
|_ avp.exe (1600)
[!] kavsys.kdl.0d885c7ff37beb5f30936020f811d20f
|_ Cesta: C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Kaspersky Lab\AVP11\Bases\Cache\kavsys.kdl.0d885c7ff37beb5f30936020f811d20f
|_ MD5: 0D885C7FF37BEB5F30936020F811D20F
|_ Výrobce: Kaspersky Lab ZAO
|_ Procesy
|_ avp.exe (1600)
[!] klavasyswatch.dll.c6fa7a3c61474aa194bc8c102e524f52
|_ Cesta: C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Kaspersky Lab\AVP11\Bases\Cache\klavasyswatch.dll.c6fa7a3c61474aa194bc8c102e524f52
|_ MD5: C6FA7A3C61474AA194BC8C102E524F52
|_ Výrobce: Kaspersky Lab ZAO
|_ Procesy
|_ avp.exe (1600)
[?] boost_log-vc71-mt-1_33.dll
|_ Cesta: C:\Program Files\Common Files\Teleca Shared\boost_log-vc71-mt-1_33.dll
|_ MD5: 8EB4888D9504D2BC4CEC3209645F55BE
|_ Výrobce:
|_ Procesy
|_ explorer.exe (1312)
[?] fm.dll
|_ Cesta: C:\Program Files\Sony Ericsson\Mobile2\File Manager\FM.dll
|_ MD5: 92339ED33F67A0252308835C5C0088E5
|_ Výrobce: Popwire AB
|_ Procesy
|_ explorer.exe (1312)
[?] rarext.dll
|_ Cesta: C:\Program Files\WinRAR\RarExt.dll
|_ MD5: 30A23A61E651C7487407CF74176C6AB1
|_ Výrobce: ?
|_ Procesy
|_ explorer.exe (1312)
[X] rarlng.dll
|_ Cesta: C:\Program Files\WinRAR\rarlng.dll
|_ MD5: FF96E637FC3D59D0BF1DF9704E3B0D45
|_ Výrobce: ?
|_ Procesy
|_ explorer.exe (1312)
[?] pdm.dll
|_ Cesta: C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\PDM.DLL
|_ MD5: 0316E1DF05A25AD02FFAE44A01E160AC
|_ Výrobce: Microsoft Corporation
|_ Procesy
|_ Skype.exe (1812)
================================================================
Ultimate Process Manager v4.1.3 - [ Lodus Software ] - Not Registered =(
Tak jsem provedl všechny doporučené akce. Výsledek byl výborný. Balast zabíral přes 3 Giga. Rychlost je v normálu. Ale.....
Před určitou dobou, jsem si na doporučení časopisu Chip, nainstaloval prográmek UPM. Po všech akcích jsem dal scan tímto programem. A co nevidím: Hlásí, že jsou tam asi 2 rootkity. Tak co dál s detoxikací PC? Děkuji za váš čas, který mě ještě bude věnovat.
Scan přikládám.
Windows XP SP 3 (build 2600)
Boot Mode: Normal
Ověření souborů Microsoftu: Ano
Whitelist: Ano
Internet Explorer v8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
Log vygenerován: 13.4.2011 14:23:40
================================================================
SmallARK
================================================================
[R]NtAdjustPrivilegesToken -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtClearEvent -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtClose -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtConnectPort -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtCreateEvent -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtCreateFile -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtCreateJobObject -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtCreateKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtCreateMutant -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtCreateNamedPipeFile -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtCreatePort -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtCreateSection -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtCreateSemaphore -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtCreateThread -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtCreateWaitablePort -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtDebugActiveProcess -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtDeleteKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtDeleteValueKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtDeviceIoControlFile -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtDuplicateObject -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtEnumerateKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtEnumerateValueKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtFsControlFile -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtLoadDriver -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtLoadKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtLoadKey2 -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtMapViewOfSection -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtNotifyChangeKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtOpenEvent -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtOpenFile -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtOpenKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtOpenMutant -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtOpenProcess -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtOpenSection -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtOpenSemaphore -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtOpenThread -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtQueryKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtQueryMultipleValueKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtQuerySection -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtQueryValueKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtQueueApcThread -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtRenameKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtReplaceKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtReplyPort -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtReplyWaitReceivePort -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtRequestWaitReplyPort -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtRestoreKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtResumeThread -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtSaveKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtSecureConnectPort -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtSetContextThread -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtSetInformationToken -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtSetSecurityObject -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtSetSystemInformation -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtSetValueKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtSuspendProcess -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtSuspendThread -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtSystemDebugControl -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtTerminateJobObject -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtTerminateProcess -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtTerminateThread -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtUnmapViewOfSection -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtWriteVirtualMemory -> C:\WINDOWS\system32\drivers\klif.sys
Běžící procesy
================================================================
(rootkit?)
(rootkit?) System
C:\WINDOWS\SYSTEM32\SERVICES.EXE
C:\WINDOWS\SYSTEM32\ATI2EVXX.EXE
C:\WINDOWS\SYSTEM32\SPOOLSV.EXE
C:\WINDOWS\SYSTEM32\ATI2EVXX.EXE
C:\PROGRAM FILES\UPM\UPM.EXE
Scanner
================================================================
Proces se nepodařilo otevřít
ROOTKIT? Skrytá cesta
Spouští se po startu HKCU Run [AdslTaskBar]
Nelze otevřít
Nemá okno
System
ROOTKIT? Skrytá cesta
Spouští se po startu HKCU Run [AdslTaskBar]
Jiná ImageBase 00000000h
BaseAddress
Skrytá cesta EXE:
Nemá okno
[S, novf!] services.exe
Non Microsoft v System32:
Ověřený Microsoft: Ne
Nemá okno
[?] ati2evxx.exe
Non Microsoft v System32:
[S, novf!] spoolsv.exe
Non Microsoft v System32:
Ověřený Microsoft: Ne
Nemá okno
[R] avp.exe
Spouští se po startu HKLM Run [AVP]
[R] MDM.EXE
Ověřený Microsoft: Ne
[?] ati2evxx.exe
Non Microsoft v System32:
[S] explorer.exe
Spouští se po startu HKLM Winlogon [Shell]
[R] avp.exe
Spouští se po startu HKLM Run [AVP]
[R] NMBgMonitor.exe
Spouští se po startu HKCU Run [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
[S] ctfmon.exe
Spouští se po startu HKCU Run [ctfmon.exe]
[R] ScreenshotReader.exe
Spouští se po startu HKCU Run [ABBYY Screenshot Reader Retail]
[R] Skype.exe
Spouští se po startu HKCU Run [Skype]
Podvržená cesta modulu: (00400000) C:\Program Files\Skype\Phone\Skype.exe
[R] skypePM.exe
EntryPoint v sekci: CODE
|_ Celkový počet sekcí: 8
[?] UPM.exe
Soubor 7%
Po spuštění
================================================================
HKCU Run
|_ [?][AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
|_ [R][ABBYY Screenshot Reader Retail] C:\Program Files\ABBYY Screenshot Reader\ScreenshotReader.exe -autorun
|_ [R][Skype] C:\Program Files\Skype\Phone\Skype.exe /nosplash /minimized
HKLM Run
|_ [?][HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
|_ [?][AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
HKLM ShellServiceObjectDelayLoad
|_ [?][PostBootReminder] C:\WINDOWS\system32\SHELL32.dll
|_ [?][CDBurn] C:\WINDOWS\system32\SHELL32.dll
|_ [?][WebCheck] C:\WINDOWS\system32\webcheck.dll
|_ [?][WPDShServiceObj] C:\WINDOWS\system32\WPDShServiceObj.dll
HKLM IC
|_ [?][<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}] C:\WINDOWS\system32\ieudinit.exe
|_ [?][>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] C:\WINDOWS\inf\unregmp2.exe /ShowWMP
|_ [?][>{26923b43-4d38-484f-9b9e-de460746276c}] C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
|_ [?][{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] C:\WINDOWS\INF\msnetmtg.inf ,NetMtg.Install.PerUser.NT
|_ [?][{5945c046-1e7d-11d1-bc44-00c04fd912be}] C:\WINDOWS\INF\msmsgs.inf ,BLC.QuietInstall.PerUser
|_ [?][{6BF52A52-394A-11d3-B153-00C04F79FAA6}] C:\WINDOWS\INF\wmp11.inf ,PerUserStub
|_ [?][{89820200-ECBD-11cf-8B85-00AA005B4340}] regsvr32.exe /s /n /i:U shell32.dll
|_ [?][{89820200-ECBD-11cf-8B85-00AA005B4383}] C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
HKLM Winlogon Notify
|_ [?][AtiExtEvent] C:\WINDOWS\system32\Ati2evxx.dll
HKLM AppInit_DLLs
|_ [R][AppInit_DLLs] C:\DOCUME~1\ALLUSE~1.WIN\AVP11\mzvkbd3.dll , C:\DOCUME~1\ALLUSE~1.WIN\AVP11\kloehk.dll
Job
|_ [?][User_Feed_Synchronization-{0A0CCE5C-13F9-484D-BFD4-6C9F2BC67947}.job] C:\WINDOWS\system32\msfeedssync.exe
|_ [?][User_Feed_Synchronization-{0A0CCE5C-13F9-484D-BFD4-6C9F2BC67947}.job] C:\WINDOWS\system32\msfeedssync.exe
HKLM BHO
|_ [?][{0C37B053-FD68-456a-82E1-D788EE342E6F}] C:\Program Files\Family Toolbar\tbcore3.dll
HKCU IE WebBrowser Toolbar
|_ [?][{0E5CBF21-D15F-11D0-8301-00AA005B4383}] C:\WINDOWS\system32\SHELL32.dll
|_ [?][{FD2FD708-1F6F-4B68-B141-C5778F0C19BB}] C:\Program Files\Family Toolbar\tbcore3.dll
HKLM IE Toolbar
|_ [?][{FD2FD708-1F6F-4B68-B141-C5778F0C19BB}] C:\Program Files\Family Toolbar\tbcore3.dll
Služby (Zobraz běžící: True, Zobraz zastavené: False, Zobraz i bezpečné služby: False)
================================================================
[X] ABBYY.Licensing.FineReader.ScreenshotReader.9.0
|_ Cesta: C:\Program Files\ABBYY Screenshot Reader\NetworkLicenseServer.exe -service
| |_ Výrobce:
| |_ Popis:
| |_ MD5:
|
|_ Jméno: ABBYY.Licensing.FineReader.ScreenshotReader.9.0
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Win32 Own Process
|_ Dependency: RPCSS
[?] Ati HotKey Poller
|_ Cesta: C:\WINDOWS\System32\Ati2evxx.exe
| |_ Výrobce: ATI Technologies Inc.
| |_ Popis: ATI External Event Utility EXE Module
| |_ MD5: E9E4CAAF26D436D1DF177AE484090750
|
|_ Jméno: Ati HotKey Poller
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ:
|_ Dependency:
[?] ATI Smart
|_ Cesta: C:\WINDOWS\system32\ati2sgag.exe
| |_ Výrobce:
| |_ Popis: ATI Smart
| |_ MD5: 7A20E3A78A97C9E3D5BFE1FA36AA7A50
|
|_ Jméno: ATI Smart
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Zastaveno
|_ Typ:
|_ Dependency:
[?] Spouštěč procesů serveru DCOM
|_ Cesta: C:\WINDOWS\system32\svchost.exe
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Generic Host Process for Win32 Services
| |_ MD5: BE4A520E29B6391F49E79CCC52044D93
|
|_ ServiceDLL: C:\WINDOWS\system32\rpcss.dll
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Distributed COM Services
| |_ MD5: BE27674D1CBC3214AEC84B4336A38BBF
|
|_ Jméno: DcomLaunch
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Win32 Share Process
|_ Dependency:
[?] Protokol událostí
|_ Cesta: C:\WINDOWS\system32\services.exe
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Services and Controller app
| |_ MD5: 9EF697AF07BB8DD82C3B02CA953A95B7
|
|_ Jméno: Eventlog
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Win32 Share Process
|_ Dependency:
[X] Služba Google Update (gupdate1c9be876827bd70)
|_ Cesta: C:\Program Files\Google\Update\GoogleUpdate.exe /svc
| |_ Výrobce:
| |_ Popis:
| |_ MD5:
|
|_ Jméno: gupdate1c9be876827bd70
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Zastaveno
|_ Typ: Win32 Own Process
|_ Dependency: RPCSS
[?] Server
|_ Cesta: C:\WINDOWS\System32\svchost.exe
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Generic Host Process for Win32 Services
| |_ MD5: BE4A520E29B6391F49E79CCC52044D93
|
|_ ServiceDLL: C:\WINDOWS\System32\srvsvc.dll
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Server Service DLL
| |_ MD5: 3428E8F86F8ADD36B42FB23542C7B3E4
|
|_ Jméno: lanmanserver
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Win32 Share Process
|_ Dependency:
[?] Pracovní stanice
|_ Cesta: C:\WINDOWS\System32\svchost.exe
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Generic Host Process for Win32 Services
| |_ MD5: BE4A520E29B6391F49E79CCC52044D93
|
|_ ServiceDLL: C:\WINDOWS\System32\wkssvc.dll
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Workstation Service DLL
| |_ MD5: 936C1D110232D23B621CB0196E4F80F0
|
|_ Jméno: lanmanworkstation
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Win32 Share Process
|_ Dependency:
[?] Plug and Play
|_ Cesta: C:\WINDOWS\system32\services.exe
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Services and Controller app
| |_ MD5: 9EF697AF07BB8DD82C3B02CA953A95B7
|
|_ Jméno: PlugPlay
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Win32 Share Process
|_ Dependency:
[?] Vzdálené volání procedur (RPC)
|_ Cesta: C:\WINDOWS\system32\svchost.exe
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Generic Host Process for Win32 Services
| |_ MD5: BE4A520E29B6391F49E79CCC52044D93
|
|_ ServiceDLL: C:\WINDOWS\system32\rpcss.dll
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Distributed COM Services
| |_ MD5: BE27674D1CBC3214AEC84B4336A38BBF
|
|_ Jméno: RpcSs
|_ StartName: NT Authority\NetworkService
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Win32 Own Process
|_ Dependency:
[?] Rozpoznávání hardwaru
|_ Cesta: C:\WINDOWS\System32\svchost.exe
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Generic Host Process for Win32 Services
| |_ MD5: BE4A520E29B6391F49E79CCC52044D93
|
|_ ServiceDLL: C:\WINDOWS\System32\shsvcs.dll
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Windows Shell Services Dll
| |_ MD5: EE9A2B9EA968A792A053C9D1A86BF870
|
|_ Jméno: ShellHWDetection
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Win32 Share Process
|_ Dependency: RpcSs
[?] Zařazování tisku
|_ Cesta: C:\WINDOWS\system32\spoolsv.exe
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Spooler SubSystem App
| |_ MD5: 60784F891563FB1B767F70117FC2428F
|
|_ Jméno: Spooler
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ:
|_ Dependency: RPCSS
[?] Motivy
|_ Cesta: C:\WINDOWS\System32\svchost.exe
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Generic Host Process for Win32 Services
| |_ MD5: BE4A520E29B6391F49E79CCC52044D93
|
|_ ServiceDLL: C:\WINDOWS\System32\shsvcs.dll
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Windows Shell Services Dll
| |_ MD5: EE9A2B9EA968A792A053C9D1A86BF870
|
|_ Jméno: Themes
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Zastaveno
|_ Typ: Win32 Share Process
|_ Dependency:
[R] TuneUp Theme Extension
|_ Cesta: C:\WINDOWS\System32\svchost.exe
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Generic Host Process for Win32 Services
| |_ MD5: BE4A520E29B6391F49E79CCC52044D93
|
|_ ServiceDLL: C:\WINDOWS\System32\uxtuneup.dll
| |_ Výrobce: TuneUp Software
| |_ Popis: TuneUp Theme Extension
| |_ MD5: D4BD1E2B3EA4E02A526B41514F31D3BC
|
|_ Jméno: UxTuneUp
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Zastaveno
|_ Typ: Win32 Share Process
|_ Dependency: Themes
Ovladače (Zobraz běžící: True, Zobraz zastavené: False, Zobraz i bezpečné služby: False)
================================================================
[?] PPdus ASPI Shell
|_ Cesta: C:\WINDOWS\system32\drivers\Afc.sys
| |_ Výrobce: Arcsoft, Inc.
| |_ Popis: Arcsoft(R) ASPI Shell
| |_ MD5: A7B8A3A79D35215D798A300DF49ED23F
|
|_ Jméno: Afc
|_ StartName:
|_ Typ spouštění: Ruční spuštění
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:
[?] Service for Avance AC97 Audio (WDM)
|_ Cesta: C:\WINDOWS\system32\drivers\ALCXWDM.SYS
| |_ Výrobce: Avance Logic, Inc.
| |_ Popis: Avance AC'97 Audio Driver (WDM)
| |_ MD5: 7BFE59F5EFF8896D043CFDE731B262E9
|
|_ Jméno: ALCXWDM
|_ StartName:
|_ Typ spouštění: Ruční spuštění
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:
[?] ati2mtag
|_ Cesta: C:\WINDOWS\System32\DRIVERS\ati2mtag.sys
| |_ Výrobce: ATI Technologies Inc.
| |_ Popis: ATI Radeon WindowsNT Miniport Driver
| |_ MD5: 85C673F5862441F231099809235B5657
|
|_ Jméno: ati2mtag
|_ StartName:
|_ Typ spouštění: Ruční spuštění
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:
[?] Fallback
|_ Cesta: C:\WINDOWS\System32\DRIVERS\HSF_FALL.sys
| |_ Výrobce: Conexant
| |_ Popis: Fallback driver
| |_ MD5: C823DEBE2548656549F84A875D65237B
|
|_ Jméno: Fallback
|_ StartName:
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:
[?] Fsks
|_ Cesta: C:\WINDOWS\System32\DRIVERS\HSF_FSKS.sys
| |_ Výrobce: Conexant
| |_ Popis: FSKsNT driver
| |_ MD5: 6483414841D4CAB6C3B4DB2AC6EDD70B
|
|_ Jméno: Fsks
|_ StartName:
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:
[?] HSFHWBS2
|_ Cesta: C:\WINDOWS\System32\DRIVERS\HSFBS2S2.sys
| |_ Výrobce: Conexant Systems, Inc.
| |_ Popis: HSF_HWB2 WDM driver
| |_ MD5: 970178E8E003EB1481293830069624B9
|
|_ Jméno: HSFHWBS2
|_ StartName:
|_ Typ spouštění: Ruční spuštění
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:
[?] HSF_DP
|_ Cesta: C:\WINDOWS\System32\DRIVERS\HSFDPSP2.sys
| |_ Výrobce: Conexant Systems, Inc.
| |_ Popis: HSF_DP driver
| |_ MD5: EBB354438A4C5A3327FB97306260714A
|
|_ Jméno: HSF_DP
|_ StartName:
|_ Typ spouštění: Ruční spuštění
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:
[?] Služba HTTP
|_ Cesta: C:\WINDOWS\System32\Drivers\HTTP.sys
| |_ Výrobce: Microsoft Corporation
| |_ Popis: HTTP Protocol Stack
| |_ MD5: F80A415EF82CD06FFAF0D971528EAD38
|
|_ Jméno: HTTP
|_ StartName:
|_ Typ spouštění: Ruční spuštění
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:
[?] K56
|_ Cesta: C:\WINDOWS\System32\DRIVERS\HSF_K56K.sys
| |_ Výrobce: Conexant
| |_ Popis: K56NT driver
| |_ MD5: 9C5E3FDBFCC30CF71A49CA178B9AD442
|
|_ Jméno: K56
|_ StartName:
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:
[?] KSecDD
|_ Cesta: C:\WINDOWS\system32\drivers\KSecDD.sys
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Kernel Security Support Provider Interface
| |_ MD5: B467646C54CC746128904E1654C750C1
|
|_ Jméno: KSecDD
|_ StartName:
|_ Typ spouštění: Boot Start
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:
[?] mdmxsdk
|_ Cesta: C:\WINDOWS\System32\DRIVERS\mdmxsdk.sys
| |_ Výrobce: Conexant
| |_ Popis: Diagnostic Interface DRIVER
| |_ MD5: 195741AEE20369980796B557358CD774
|
|_ Jméno: mdmxsdk
|_ StartName:
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:
[?] MRXSMB
|_ Cesta: C:\WINDOWS\System32\DRIVERS\mrxsmb.sys
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Windows NT SMB Minirdr
| |_ MD5: F3AEFB11ABC521122B67095044169E98
|
|_ Jméno: MRxSmb
|_ StartName:
|_ Typ spouštění: System Start
|_ Status: Spuštěno
|_ Typ: File System Driver
|_ Dependency:
[?] Služba NDIS Proxy
|_ Cesta: C:\WINDOWS\system32\drivers\NDProxy.sys
| |_ Výrobce: Microsoft Corporation
| |_ Popis: NDIS Proxy
| |_ MD5: 9282BD12DFB069D3889EB3FCC1000A9B
|
|_ Jméno: NDProxy
|_ StartName:
|_ Typ spouštění: Ruční spuštění
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:
[?] SoftFax
|_ Cesta: C:\WINDOWS\System32\DRIVERS\HSF_FAXX.sys
| |_ Výrobce: Conexant
| |_ Popis: FaxNT driver
| |_ MD5: D9E8E0CE154A2F6430D9EFABDF730867
|
|_ Jméno: SoftFax
|_ StartName:
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:
[?] Srv
|_ Cesta: C:\WINDOWS\System32\DRIVERS\srv.sys
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Server driver
| |_ MD5: 0F6AEFAD3641A657E18081F52D0C15AF
|
|_ Jméno: Srv
|_ StartName:
|_ Typ spouštění: Ruční spuštění
|_ Status: Spuštěno
|_ Typ: File System Driver
|_ Dependency:
[?] ATM/ADSL miniport
|_ Cesta: C:\WINDOWS\system32\DRIVERS\stmatm.sys
| |_ Výrobce: STMicroelectronics
| |_ Popis: ATM/ADSL miniport
| |_ MD5: 2FC0C3D5615395585ABDB16660EFBC3A
|
|_ Jméno: Stmatm
|_ StartName:
|_ Typ spouštění: Ruční spuštění
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:
[?] ADSL Modem USB Service
|_ Cesta: C:\WINDOWS\system32\DRIVERS\torususb.sys
| |_ Výrobce: ?
| |_ Popis: ?
| |_ MD5: 22826EEDAAAEFBB0B95E33CD24314375
|
|_ Jméno: TaurusUsb
|_ StartName:
|_ Typ spouštění: Ruční spuštění
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:
[?] Tones
|_ Cesta: C:\WINDOWS\System32\DRIVERS\HSF_TONE.sys
| |_ Výrobce: Conexant
| |_ Popis: TonesNT driver
| |_ MD5: 8021A499DB46B2961C285168671CB9AF
|
|_ Jméno: Tones
|_ StartName:
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:
[?] V124
|_ Cesta: C:\WINDOWS\System32\DRIVERS\HSF_V124.sys
| |_ Výrobce: Conexant
| |_ Popis: V124NT driver
| |_ MD5: 269C0ADE94B90029B12497747BE408CB
|
|_ Jméno: V124
|_ StartName:
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:
[?] winachsf
|_ Cesta: C:\WINDOWS\System32\DRIVERS\HSFCXTS2.sys
| |_ Výrobce: Conexant Systems, Inc.
| |_ Popis: HSF_CNXT driver
| |_ MD5: 1225EBEA76AAC3C84DF6C54FE5E5D8BE
|
|_ Jméno: winachsf
|_ StartName:
|_ Typ spouštění: Ruční spuštění
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:
lNetStat
================================================================
Typ: PID Proces Local <-> Remote Status
-----------------------------------------------------------------------------------------
TCP (1812) Skype.exe 0.0.0.0:80 LISTENING
TCP (1068) svchost.exe 0.0.0.0:135 LISTENING
TCP (1812) Skype.exe 0.0.0.0:443 LISTENING
TCP (4) Systém 0.0.0.0:445 LISTENING
TCP (1600) avp.exe 0.0.0.0:1110 LISTENING
TCP (1812) Skype.exe 0.0.0.0:59642 LISTENING
TCP (1812) Skype.exe 78.80.6.20:443 <-> 78.100.38.30:36425 ESTABLISHED
TCP (1812) Skype.exe 78.80.6.20:443 <-> 195.113.201.101:23413 ESTABLISHED
TCP (1812) Skype.exe 78.80.6.20:443 <-> 217.77.161.17:19116 ESTABLISHED
TCP (1600) avp.exe 78.80.6.20:4008 <-> 85.239.154.117:10487 ESTABLISHED
TCP (1600) avp.exe 78.80.6.20:4014 <-> 212.161.8.4:12350 ESTABLISHED
TCP (1600) avp.exe 78.80.6.20:4113 CLOSE_WAIT
TCP (1600) avp.exe 78.80.6.20:4118 <-> 93.99.17.238:80 ESTABLISHED
TCP (1812) Skype.exe 78.80.6.20:59642 <-> 81.200.55.82:4459 ESTABLISHED
TCP (1600) avp.exe 127.0.0.1:1110 <-> 127.0.0.1:4007 ESTABLISHED
TCP (1600) avp.exe 127.0.0.1:1110 <-> 127.0.0.1:4013 ESTABLISHED
TCP (1600) avp.exe 127.0.0.1:1110 FIN_WAIT2
TCP (0) 127.0.0.1:1110 TIME_WAIT
TCP (1600) avp.exe 127.0.0.1:1110 <-> 127.0.0.1:4117 ESTABLISHED
TCP (1812) Skype.exe 127.0.0.1:4007 <-> 127.0.0.1:1110 ESTABLISHED
TCP (1812) Skype.exe 127.0.0.1:4013 <-> 127.0.0.1:1110 ESTABLISHED
TCP (1664) UPM.exe 127.0.0.1:4112 CLOSE_WAIT
UDP (1812) Skype.exe 0.0.0.0:443 <-> 127.0.0.1:1110 ESTABLISHED
UDP (4) Systém 0.0.0.0:445
UDP (744) lsass.exe 0.0.0.0:500
UDP (1600) avp.exe 0.0.0.0:2581
UDP (744) lsass.exe 0.0.0.0:4500
UDP (1812) Skype.exe 0.0.0.0:59642
UDP (1296) svchost.exe 78.80.6.20:1900
UDP (1732) opera.exe 78.80.6.20:1900
UDP (1732) opera.exe 78.80.6.20:4114
UDP (1296) svchost.exe 127.0.0.1:1900
UDP (2076) ScreenshotReader.exe127.0.0.1:3934
UDP (1812) Skype.exe 127.0.0.1:4006
UDP (1812) Skype.exe 127.0.0.1:4017
Moduly (Zobraz i bezpečné DLL: False, Jen bez výrobce: True, Zobraz registrované: False)
================================================================
[!] kjim.kdl.0b52ef7124235e8f8711175b8fad0aad
|_ Cesta: C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Kaspersky Lab\AVP11\Bases\Cache\kjim.kdl.0b52ef7124235e8f8711175b8fad0aad
|_ MD5: 0B52EF7124235E8F8711175B8FAD0AAD
|_ Výrobce: Kaspersky Lab ZAO
|_ Procesy
|_ avp.exe (1600)
[!] pbs.kdl.a3dbdf39fdcbbca23e0dfb303b8030d6
|_ Cesta: C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Kaspersky Lab\AVP11\Bases\Cache\pbs.kdl.a3dbdf39fdcbbca23e0dfb303b8030d6
|_ MD5: A3DBDF39FDCBBCA23E0DFB303B8030D6
|_ Výrobce: Kaspersky Lab ZAO
|_ Procesy
|_ avp.exe (1600)
[?] bsshlp.kdl.c333e2601f1b0d52312ab3ec900c2e4d
|_ Cesta: C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Kaspersky Lab\AVP11\Bases\Cache\bsshlp.kdl.c333e2601f1b0d52312ab3ec900c2e4d
|_ MD5: C333E2601F1B0D52312AB3EC900C2E4D
|_ Výrobce: Kaspersky Lab ZAO
|_ Procesy
|_ avp.exe (1600)
[?] vlns.kdl.002d59a92d55ccbddcca8fba8ea8340d
|_ Cesta: C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Kaspersky Lab\AVP11\Bases\Cache\vlns.kdl.002d59a92d55ccbddcca8fba8ea8340d
|_ MD5: 002D59A92D55CCBDDCCA8FBA8EA8340D
|_ Výrobce: Kaspersky Lab
|_ Procesy
|_ avp.exe (1600)
[!] mark.kdl.4c174a6abe5d8edee2169b038e0925d7
|_ Cesta: C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Kaspersky Lab\AVP11\Bases\Cache\mark.kdl.4c174a6abe5d8edee2169b038e0925d7
|_ MD5: 4C174A6ABE5D8EDEE2169B038E0925D7
|_ Výrobce: Kaspersky Lab ZAO
|_ Procesy
|_ avp.exe (1600)
[!] klavemu.kdl.b2beb3b968abcbef0057cdfe20932efd
|_ Cesta: C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Kaspersky Lab\AVP11\Bases\Cache\klavemu.kdl.b2beb3b968abcbef0057cdfe20932efd
|_ MD5: B2BEB3B968ABCBEF0057CDFE20932EFD
|_ Výrobce: Kaspersky Lab ZAO
|_ Procesy
|_ avp.exe (1600)
[!] qscan.kdl.f5e6e61c7ced81e9880827d5026b35ff
|_ Cesta: C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Kaspersky Lab\AVP11\Bases\Cache\qscan.kdl.f5e6e61c7ced81e9880827d5026b35ff
|_ MD5: F5E6E61C7CED81E9880827D5026B35FF
|_ Výrobce: Kaspersky Lab ZAO
|_ Procesy
|_ avp.exe (1600)
[!] kavsys.kdl.0d885c7ff37beb5f30936020f811d20f
|_ Cesta: C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Kaspersky Lab\AVP11\Bases\Cache\kavsys.kdl.0d885c7ff37beb5f30936020f811d20f
|_ MD5: 0D885C7FF37BEB5F30936020F811D20F
|_ Výrobce: Kaspersky Lab ZAO
|_ Procesy
|_ avp.exe (1600)
[!] klavasyswatch.dll.c6fa7a3c61474aa194bc8c102e524f52
|_ Cesta: C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Kaspersky Lab\AVP11\Bases\Cache\klavasyswatch.dll.c6fa7a3c61474aa194bc8c102e524f52
|_ MD5: C6FA7A3C61474AA194BC8C102E524F52
|_ Výrobce: Kaspersky Lab ZAO
|_ Procesy
|_ avp.exe (1600)
[?] boost_log-vc71-mt-1_33.dll
|_ Cesta: C:\Program Files\Common Files\Teleca Shared\boost_log-vc71-mt-1_33.dll
|_ MD5: 8EB4888D9504D2BC4CEC3209645F55BE
|_ Výrobce:
|_ Procesy
|_ explorer.exe (1312)
[?] fm.dll
|_ Cesta: C:\Program Files\Sony Ericsson\Mobile2\File Manager\FM.dll
|_ MD5: 92339ED33F67A0252308835C5C0088E5
|_ Výrobce: Popwire AB
|_ Procesy
|_ explorer.exe (1312)
[?] rarext.dll
|_ Cesta: C:\Program Files\WinRAR\RarExt.dll
|_ MD5: 30A23A61E651C7487407CF74176C6AB1
|_ Výrobce: ?
|_ Procesy
|_ explorer.exe (1312)
[X] rarlng.dll
|_ Cesta: C:\Program Files\WinRAR\rarlng.dll
|_ MD5: FF96E637FC3D59D0BF1DF9704E3B0D45
|_ Výrobce: ?
|_ Procesy
|_ explorer.exe (1312)
[?] pdm.dll
|_ Cesta: C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\PDM.DLL
|_ MD5: 0316E1DF05A25AD02FFAE44A01E160AC
|_ Výrobce: Microsoft Corporation
|_ Procesy
|_ Skype.exe (1812)
================================================================
Ultimate Process Manager v4.1.3 - [ Lodus Software ] - Not Registered =(
Re: Zpomalil se počítač.
Dle meho jde o falesne detekce, ale muzeme udelat test na rootkity pro Vas klid...
Stahnete SPTD http://www.duplexsecure.com/en/downloads
Kliknete na Start a pote Spustit, pripadne pouzijte klavesou zkratku Win+R
Stahnete SPTD http://www.duplexsecure.com/en/downloads
- Vyberte z uvedene stranky verzi dle sveho operacniho systemu (32(x86)bit ci 64(x64)bit)
- Ulozte na plochu a spustte
- Zvolte moznost Uninstall a restartujte PC - pokud nepujde kliknout (tlacitko bude sede), krok preskocte
- Ulozte na plochu a spustte
- Kliknete na Disable a restartujte PC - pokud nepujde kliknout (tlacitko bude sede), krok preskocte
Kliknete na Start a pote Spustit, pripadne pouzijte klavesou zkratku Win+R
- Vyskoci na Vas okenko, do ktereho zkopirujte text nize
Kód: Vybrat vše
"%userprofile%\plocha\mbr" -t -s
- Kliknete na OK
- Na plose se Vam vytvori log s nazvem mbr.txt, jeho obsah mi sem vlozte
Re: Zpomalil se počítač.
Provedl jsem operace dle návodu.
- SPTD - šedé tlačítko - přeskočeno
Log z Defogger
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 17:20 on 13/04/2011 (moje1)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
- Log z MBR
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: ST360021A rev.3.19 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4
device: opened successfully
user: MBR read successfully
Disk trace:
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll viaide.sys
1 nt!IofCallDriver[0x804E37D5] -> \Device\Harddisk0\DR0[0x83B95AB8]
3 CLASSPNP[0xF784BFD7] -> nt!IofCallDriver[0x804E37D5] -> \Device\Ide\IdeDeviceP0T0L0-4[0x83B98D98]
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [BP+0x0], CH; JL 0x2e; JNZ 0x3a; }
user & kernel MBR OK
S tímto programem mám potíže. První scan proběhne bez problémů. Ale ten hlavní ne a ne udělat. Proces se zahájí, ale asi tak po 3/4 hodiny dojde k samočinnému restartu. Tím se vše ztratí. Dělal jsem to 2x. Po každé stejná událost.
- Vkládám první scan z GMERu
GMER 1.0.15.15570 - http://www.gmer.net
Rootkit quick scan 2011-04-13 18:07:32
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4 ST360021A rev.3.19
Running: gmer.exe; Driver: C:\DOCUME~1\moje1\LOCALS~1\Temp\pxtdapow.sys
---- System - GMER 1.0.15 ----
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwEnumerateKey [0xB9BA2ED2]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwEnumerateValueKey [0xB9BA2F6A]
Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) FsRtlCheckLockForReadAccess
Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) IoIsOperationSynchronous
---- Devices - GMER 1.0.15 ----
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\Ip kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
AttachedDevice \Driver\Tcpip \Device\Tcp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
AttachedDevice \Driver\Tcpip \Device\Udp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
AttachedDevice \Driver\Tcpip \Device\RawIp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
---- EOF - GMER 1.0.15 ----
- SPTD - šedé tlačítko - přeskočeno
Log z Defogger
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 17:20 on 13/04/2011 (moje1)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
- Log z MBR
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: ST360021A rev.3.19 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4
device: opened successfully
user: MBR read successfully
Disk trace:
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll viaide.sys
1 nt!IofCallDriver[0x804E37D5] -> \Device\Harddisk0\DR0[0x83B95AB8]
3 CLASSPNP[0xF784BFD7] -> nt!IofCallDriver[0x804E37D5] -> \Device\Ide\IdeDeviceP0T0L0-4[0x83B98D98]
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [BP+0x0], CH; JL 0x2e; JNZ 0x3a; }
user & kernel MBR OK
S tímto programem mám potíže. První scan proběhne bez problémů. Ale ten hlavní ne a ne udělat. Proces se zahájí, ale asi tak po 3/4 hodiny dojde k samočinnému restartu. Tím se vše ztratí. Dělal jsem to 2x. Po každé stejná událost.
- Vkládám první scan z GMERu
GMER 1.0.15.15570 - http://www.gmer.net
Rootkit quick scan 2011-04-13 18:07:32
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4 ST360021A rev.3.19
Running: gmer.exe; Driver: C:\DOCUME~1\moje1\LOCALS~1\Temp\pxtdapow.sys
---- System - GMER 1.0.15 ----
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwEnumerateKey [0xB9BA2ED2]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwEnumerateValueKey [0xB9BA2F6A]
Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) FsRtlCheckLockForReadAccess
Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) IoIsOperationSynchronous
---- Devices - GMER 1.0.15 ----
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\Ip kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
AttachedDevice \Driver\Tcpip \Device\Tcp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
AttachedDevice \Driver\Tcpip \Device\Udp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
AttachedDevice \Driver\Tcpip \Device\RawIp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
---- EOF - GMER 1.0.15 ----
Re: Zpomalil se počítač.
Prihlaste se do nouzoveho rezimu (restart PC, mackat F8, zvolit Stav nouze s praci v siti)
Aplikujte gmer
Aplikujte gmer
Re: Zpomalil se počítač.
Nemohl jsem reagovat na odpověď. Rozsypalo se mě připojení na net. Konečně jsem to dal do kupy. Určitě udělám, až najdu zase volnou díru v programu.