Dobrý večer!
Prosím o kontrolu logu HJT. Snažím se najít původce častých BSODů mého PC a toto je jedna z věcí, které jsem zatím opomíjel při hledání problému spíše v hardwaru.
Děkuji.
Logfile of random's system information tool 1.08 (written by random/random)
Run by Fana at 2011-04-29 18:34:27
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 35 GB (30%) free of 114 GB
Total RAM: 4094 MB (56% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:34:28, on 29.4.2011
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v8.00 (8.00.7601.17514)
Boot mode: Normal
Running processes:
C:\Program Files (x86)\ScreenShots I\ScreenShots.exe
C:\Program Files (x86)\Seznam.cz\postak.exe
C:\Program Files (x86)\PidginPortable\PidginPortable.exe
C:\Program Files (x86)\ICQ7.4\ICQ.exe
C:\Program Files (x86)\PidginPortable\App\Pidgin\pidgin-portable.exe
C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\Lavalys\everestultimate_build_5.50.2253 Beta\everest.exe
C:\Program Files (x86)\Skype\Plugin Manager\skypePM.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files (x86)\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files (x86)\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files (x86)\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files (x86)\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files (x86)\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files (x86)\Yahoo!\Widgets\YahooWidgets.exe
C:\Users\Fana\AppData\Local\Yahoo\Widget Engine\Unzipped\SimpleMonitor.widget\SimpleMonitor-1.0.5.widget\Contents\resources\exe\SimpleMonitor.exe
C:\Program Files (x86)\Opera\opera.exe
C:\Program Files (x86)\RocketDock\RocketDock.exe
C:\Program Files\trend micro\Fana.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: PK IE Plugin - {1E1B2879-88FF-11D3-8D96-D7ACAC95951A} - C:\Program Files (x86)\Nvidia\PhysXwb.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\ProgramData\LangSoft\WebIE.dll
O2 - BHO: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\ievkbd.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll
O2 - BHO: Ukazatel S-Rank - {EA837F48-5AD1-443E-AE34-FFE03CBF3099} - C:\Program Files (x86)\Seznam.cz\core.3.dll
O3 - Toolbar: Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\ProgramData\LangSoft\WebIE.dll
O4 - HKLM\..\Run: [avp] "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Screenshot] C:\Program Files (x86)\ScreenShots I\ScreenShots.exe
O4 - HKCU\..\Run: [Seznam Postak] "C:\Program Files (x86)\Seznam.cz\postak.exe" -s
O4 - HKCU\..\Run: [Skype Launcher-Calimero] C:\Program Files (x86)\CalimSkypeLauncher\CalimSkypeLauncher.exe
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files (x86)\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [Pidgin] C:\Program Files (x86)\PidginPortable\PidginPortable.exe
O4 - HKCU\..\Run: [ICQ] "C:\Program Files (x86)\ICQ7.4\ICQ.exe" silent loginmode=4
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: Yahoo! Widgets.lnk = C:\Program Files (x86)\Yahoo!\Widgets\YahooWidgets.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
O8 - Extra context menu item: Přidat do Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\ie_banner_deny.htm
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: &Virtuální klávesnice - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll
O9 - Extra button: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files (x86)\ICQ7.4\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files (x86)\ICQ7.4\ICQ.exe
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\ProgramData\LangSoft\WebIE.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\ProgramData\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\ProgramData\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\ProgramData\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\ProgramData\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\ProgramData\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\ProgramData\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\ProgramData\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\ProgramData\LangSoft\WebIE.dll
O9 - Extra button: K&ontrola adres URL - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/get/s ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~2\KASPER~1\KASPER~1\mzvkbd3.dll, C:\PROGRA~2\KASPER~1\KASPER~1\sbhook.dll C:\PROGRA~2\Google\GOOGLE~1\GO36F4~1.DLL
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Služba Kaspersky Anti-Virus (AVP) - Kaspersky Lab ZAO - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Google Desktop Manager 5.9.1005.12335 (GoogleDesktopManager-051210-111108) - Google - C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Intel(R) Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Process Monitor (LVPrcS64) - Logitech Inc. - C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: Sony Ericsson PCCompanion - Avanquest Software - C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: Služba Windows Media Player Network Sharing (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
--
End of file - 12446 bytes
======Listing Processes======
\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
"C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe"
C:\Windows\system32\nvvsvc.exe -session -first
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe" -r
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe"
"C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE"
"C:\Program Files (x86)\Common Files\Logishrd\LVMVFM\LVPrS64H.exe" -Embedding
"C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe"
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\alg.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Windows\system32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-88f59503-0a3b-4cdc-8cc1-f96dd363e52a -SystemEventPortName:HostProcess-e29c821b-c1fe-498b-9575-e4cfda774b95 -IoCancelEventPortName:HostProcess-9cf3e704-5cb2-4858-965f-715a36cba5c5 -NonStateChangingEventPortName:HostProcess-c82b7fb1-7d8a-4236-a563-b2a6252f5817 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:56d9f4c9-32b8-4aed-886e-ec3f75e0489b
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Windows\system32\Dwm.exe"
"taskhost.exe"
C:\Windows\Explorer.EXE
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Program Files\Logitech\SetPointP\SetPoint.exe" /launchGaming
"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
"C:\Program Files (x86)\ScreenShots I\ScreenShots.exe"
"C:\Program Files (x86)\Seznam.cz\postak.exe" -s
"C:\Program Files (x86)\PidginPortable\PidginPortable.exe"
KHALMNPR.EXE /API
"C:\Program Files (x86)\ICQ7.4\ICQ.exe" silent loginmode=4
"C:\Program Files (x86)\PidginPortable\App\Pidgin\pidgin-portable.exe" -c "C:\Program Files (x86)\PidginPortable\Data\settings\.purple"
"C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe"
"C:\Program Files (x86)\Skype\Phone\Skype.exe" /secondary /username:fanynek502 /password:45297412
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
taskeng.exe {898E03BB-0B36-494D-8A30-298D46E72B55}
"C:\Program Files (x86)\Lavalys\everestultimate_build_5.50.2253 Beta\everest.exe"
"C:\Program Files (x86)\Skype\Plugin Manager\skypePM.exe" /SILENT
"C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe"
"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
"C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe"
"C:\Program Files (x86)\Skype\Phone\Skype.exe" /secondary /username:pc-sestavy-servis /password:313213dfhdfh13d13s1f
"C:\Program Files (x86)\Yahoo!\Widgets\YahooWidgets.exe"
C:\Program Files (x86)\Yahoo!\Widgets\YahooWidgets.exe /child "C:\Users\Fana\Documents\My Widgets\Calendar.widget"
C:\Program Files (x86)\Yahoo!\Widgets\YahooWidgets.exe /child "C:\Users\Fana\Documents\My Widgets\DigiClock.widget"
C:\Program Files (x86)\Yahoo!\Widgets\YahooWidgets.exe /child "C:\Users\Fana\Documents\My Widgets\freeSpace.widget"
C:\Windows\sysWOW64\wbem\wmiprvse.exe -Embedding
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\Yahoo!\Widgets\YahooWidgets.exe /child "C:\Users\Fana\Documents\My Widgets\Multiple Processor Monitor-v.3.0.widget"
C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding
C:\Program Files (x86)\Yahoo!\Widgets\YahooWidgets.exe /child "C:\Users\Fana\Documents\My Widgets\Yahoo! Weather.widget"
C:\Program Files (x86)\Yahoo!\Widgets\YahooWidgets.exe /child "C:\Users\Fana\Documents\My Widgets\SimpleMonitor.widget"
"C:\Users\Fana\AppData\Local\Yahoo\Widget Engine\Unzipped\SimpleMonitor.widget\SimpleMonitor-1.0.5.widget\Contents\resources\exe\SimpleMonitor.exe" -Embedding
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Program Files (x86)\Opera\opera.exe"
C:\Windows\System32\svchost.exe -k WerSvcGroup
"C:\Program Files (x86)\RocketDock\RocketDock.exe"
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe19_ Global\UsGthrCtrlFltPipeMssGthrPipe19 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 520 524 532 65536 528
"C:\Program Files\RSIT\RSITx64.exe"
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}]
IEVkbdBHO Class - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\x64\ievkbd.dll [2010-10-05 61624]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL [2010-03-25 6722448]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL [2010-02-28 688528]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E33CF602-D945-461A-83F0-819F76A199F8}]
FilterBHO Class - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\x64\klwtbbho.dll [2010-10-05 234168]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}]
IE Plugin Class - C:\Program Files (x86)\Nvidia\PhysXwb.dll [2010-04-28 40960]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2DB66063-BB98-466A-AA0D-3E7ACF5ED853}]
WebTransBHO Class - C:\ProgramData\LangSoft\WebIE.dll [2011-02-20 520192]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3785D0AD-BFFF-47F6-BF5B-A587C162FED9}]
Canon Easy-WebPrint EX BHO - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll [2010-11-08 202144]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}]
IEVkbdBHO Class - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\ievkbd.dll [2010-10-05 68280]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [2010-03-25 4222864]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL [2010-02-28 561552]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E33CF602-D945-461A-83F0-819F76A199F8}]
FilterBHO Class - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll [2010-10-05 191160]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EA837F48-5AD1-443E-AE34-FFE03CBF3099}]
Ukazatel S-Rank - C:\Program Files (x86)\Seznam.cz\core.3.dll [2010-10-07 1164568]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - Canon Easy-WebPrint EX - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll [2010-11-08 1619352]
{BFC32E1D-EE75-4A48-BC60-104E11EE2431} - WebTranslator - C:\ProgramData\LangSoft\WebIE.dll [2011-02-20 520192]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2010-11-02 11545192]
"EvtMgr6"=C:\Program Files\Logitech\SetPointP\SetPoint.exe [2010-10-29 1680976]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-20 1475584]
"Screenshot"=C:\Program Files (x86)\ScreenShots I\ScreenShots.exe [2006-08-14 196608]
"Seznam Postak"=C:\Program Files (x86)\Seznam.cz\postak.exe [2010-10-07 488728]
"Skype Launcher-Calimero"=C:\Program Files (x86)\CalimSkypeLauncher\CalimSkypeLauncher.exe [2010-06-23 312811]
"RocketDock"=C:\Program Files (x86)\RocketDock\RocketDock.exe [2007-09-02 495616]
"Pidgin"=C:\Program Files (x86)\PidginPortable\PidginPortable.exe [2010-10-22 142264]
"ICQ"=C:\Program Files (x86)\ICQ7.4\ICQ.exe [2011-03-01 119608]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Bluetooth Connection Assistant]
LBTWIZ.EXE -silent []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2010-07-26 2782096]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenu]
C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe [2009-09-04 767312]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
C:\Program Files (x86)\ICQ7.4\ICQ.exe [2011-03-01 119608]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LWS]
C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe [2010-05-07 165208]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ProfilerU]
C:\Program Files\Saitek\SD6\Software\ProfilerU.exe []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SaiMfd]
C:\Program Files\Saitek\SD6\Software\SaiMfd.exe []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Služba Acronis Scheduler2]
C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [2010-12-17 391144]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^Fana^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Logitech . Registrace produktu.lnk]
C:\PROGRA~2\COMMON~1\LogiShrd\eReg\SetPoint\eReg.exe [2009-11-16 517384]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^Fana^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Nikon Monitor.lnk]
C:\PROGRA~2\COMMON~1\Nikon\Monitor\NKMONI~1.EXE [2007-10-18 479232]
[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"avp"=C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe [2010-11-02 365336]
"Adobe Reader Speed Launcher"=C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [2011-01-31 35760]
C:\Users\Fana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Yahoo! Widgets.lnk - C:\Program Files (x86)\Yahoo!\Widgets\YahooWidgets.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\PROGRA~2\KASPER~1\KASPER~1\x64\kloehk.dll,C:\PROGRA~2\KASPER~1\KASPER~1\x64\sbhook64.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
C:\Windows\System32\klogon.dll [2010-10-05 233656]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\LBTWlgn]
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll [2010-10-28 66640]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL [2010-03-25 6722448]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [2010-03-25 4222864]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableLinkedConnections"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0
"NoDriveTypeAutoRun"=28
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
======File associations======
.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*
======List of files/folders created in the last 1 months======
2011-04-29 18:34:27 ----D---- C:\rsit
2011-04-28 12:42:32 ----D---- C:\Program Files (x86)\Turtix
2011-04-28 10:00:51 ----D---- C:\Program Files (x86)\BinarySense
2011-04-27 20:35:42 ----A---- C:\Windows\SYSWOW64\XpsPrint.dll
2011-04-27 20:35:42 ----A---- C:\Windows\SYSWOW64\explorer.exe
2011-04-27 20:35:42 ----A---- C:\Windows\system32\XpsPrint.dll
2011-04-27 20:35:42 ----A---- C:\Windows\explorer.exe
2011-04-27 20:35:35 ----A---- C:\Windows\SYSWOW64\fsutil.exe
2011-04-27 20:35:35 ----A---- C:\Windows\SYSWOW64\esent.dll
2011-04-27 20:35:35 ----A---- C:\Windows\system32\fsutil.exe
2011-04-27 20:35:35 ----A---- C:\Windows\system32\esent.dll
2011-04-27 20:35:35 ----A---- C:\Windows\system32\drivers\USBSTOR.SYS
2011-04-27 20:35:35 ----A---- C:\Windows\system32\drivers\storport.sys
2011-04-27 20:35:35 ----A---- C:\Windows\system32\drivers\nvstor.sys
2011-04-27 20:35:35 ----A---- C:\Windows\system32\drivers\nvraid.sys
2011-04-27 20:35:35 ----A---- C:\Windows\system32\drivers\ntfs.sys
2011-04-27 20:35:35 ----A---- C:\Windows\system32\drivers\iaStorV.sys
2011-04-27 20:35:35 ----A---- C:\Windows\system32\drivers\amdxata.sys
2011-04-27 20:35:35 ----A---- C:\Windows\system32\drivers\amdsata.sys
2011-04-27 20:35:32 ----A---- C:\Windows\SYSWOW64\prevhost.exe
2011-04-27 20:35:32 ----A---- C:\Windows\system32\prevhost.exe
2011-04-26 23:04:36 ----D---- C:\Program Files (x86)\Nvidia
2011-04-26 14:33:30 ----D---- C:\Users\Fana\AppData\Roaming\BPK
2011-04-25 11:35:31 ----D---- C:\found.001
2011-04-23 22:48:06 ----D---- C:\Program Files (x86)\ICQ7.4
2011-04-20 20:45:55 ----D---- C:\Program Files (x86)\FotoSketcher
2011-04-16 14:40:32 ----D---- C:\Program Files (x86)\Filipova dobrodružství - Na stopě rodinným pokladům
2011-04-16 14:01:28 ----D---- C:\Program Files (x86)\Tomb Raider - Legend
2011-04-15 23:34:59 ----D---- C:\Users\Fana\AppData\Roaming\gtk-2.0
2011-04-13 20:09:20 ----D---- C:\Users\Fana\AppData\Roaming\Opera
2011-04-13 20:09:17 ----D---- C:\Program Files (x86)\Opera
2011-04-13 19:55:29 ----A---- C:\Windows\SYSWOW64\XpsGdiConverter.dll
2011-04-13 19:55:29 ----A---- C:\Windows\system32\XpsGdiConverter.dll
2011-04-13 19:55:28 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2011-04-13 19:55:28 ----A---- C:\Windows\SYSWOW64\jscript.dll
2011-04-13 19:55:28 ----A---- C:\Windows\system32\win32k.sys
2011-04-13 19:55:28 ----A---- C:\Windows\system32\vbscript.dll
2011-04-13 19:55:28 ----A---- C:\Windows\system32\jscript.dll
2011-04-13 19:55:27 ----A---- C:\Windows\SYSWOW64\mfc42u.dll
2011-04-13 19:55:27 ----A---- C:\Windows\SYSWOW64\mfc42.dll
2011-04-13 19:55:27 ----A---- C:\Windows\system32\mfc42u.dll
2011-04-13 19:55:27 ----A---- C:\Windows\system32\mfc42.dll
2011-04-13 19:55:27 ----A---- C:\Windows\system32\drivers\srv2.sys
2011-04-13 19:55:26 ----A---- C:\Windows\SYSWOW64\atmlib.dll
2011-04-13 19:55:26 ----A---- C:\Windows\SYSWOW64\atmfd.dll
2011-04-13 19:55:26 ----A---- C:\Windows\system32\drivers\srvnet.sys
2011-04-13 19:55:26 ----A---- C:\Windows\system32\drivers\srv.sys
2011-04-13 19:55:26 ----A---- C:\Windows\system32\atmlib.dll
2011-04-13 19:55:26 ----A---- C:\Windows\system32\atmfd.dll
2011-04-13 19:55:23 ----A---- C:\Windows\system32\mshtml.dll
2011-04-13 19:55:22 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2011-04-13 19:55:22 ----A---- C:\Windows\system32\urlmon.dll
2011-04-13 19:55:22 ----A---- C:\Windows\system32\ieframe.dll
2011-04-13 19:55:21 ----A---- C:\Windows\SYSWOW64\wininet.dll
2011-04-13 19:55:21 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2011-04-13 19:55:21 ----A---- C:\Windows\SYSWOW64\ieui.dll
2011-04-13 19:55:21 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2011-04-13 19:55:21 ----A---- C:\Windows\system32\wininet.dll
2011-04-13 19:55:21 ----A---- C:\Windows\system32\ieui.dll
2011-04-13 19:55:20 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2011-04-13 19:55:20 ----A---- C:\Windows\system32\jsproxy.dll
2011-04-13 19:55:17 ----A---- C:\Windows\SYSWOW64\inetcomm.dll
2011-04-13 19:55:17 ----A---- C:\Windows\SYSWOW64\dnscacheugc.exe
2011-04-13 19:55:17 ----A---- C:\Windows\SYSWOW64\dnsapi.dll
2011-04-13 19:55:17 ----A---- C:\Windows\system32\inetcomm.dll
2011-04-13 19:55:17 ----A---- C:\Windows\system32\dnsrslvr.dll
2011-04-13 19:55:17 ----A---- C:\Windows\system32\dnscacheugc.exe
2011-04-13 19:55:17 ----A---- C:\Windows\system32\dnsapi.dll
2011-04-13 19:55:16 ----A---- C:\Windows\system32\winresume.exe
2011-04-13 19:55:16 ----A---- C:\Windows\system32\winload.exe
2011-04-13 19:55:16 ----A---- C:\Windows\system32\kdusb.dll
2011-04-13 19:55:16 ----A---- C:\Windows\system32\kdcom.dll
2011-04-13 19:55:16 ----A---- C:\Windows\system32\kd1394.dll
2011-04-13 19:55:11 ----A---- C:\Windows\system32\FXSCOVER.exe
2011-04-13 19:55:11 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2011-04-13 19:55:11 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2011-04-13 19:55:11 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2011-04-13 19:55:11 ----A---- C:\Windows\system32\drivers\bowser.sys
2011-04-09 15:10:47 ----D---- C:\Users\Fana\AppData\Roaming\TeamViewer
2011-04-06 21:18:04 ----A---- C:\Windows\WORDPAD.INI
2011-04-06 11:48:05 ----D---- C:\ProgramData\AltrixSoft
2011-04-06 11:32:08 ----D---- C:\Users\Fana\AppData\Roaming\AltrixSoft
2011-04-04 22:48:12 ----D---- C:\Users\Fana\AppData\Roaming\Mozilla
2011-04-04 22:43:34 ----D---- C:\Program Files (x86)\Mozilla Firefox
2011-03-30 22:43:50 ----D---- C:\Program Files (x86)\PidginPortable
======List of files/folders modified in the last 1 months======
2011-04-29 18:34:28 ----D---- C:\Program Files\trend micro
2011-04-29 18:34:23 ----D---- C:\Program Files (x86)\Process Explorer
2011-04-29 18:26:29 ----D---- C:\Users\Fana\AppData\Roaming\Skype
2011-04-29 18:23:29 ----D---- C:\Windows\Temp
2011-04-29 17:25:11 ----D---- C:\ProgramData\Kaspersky Lab
2011-04-29 17:21:58 ----D---- C:\Windows\system32\drivers
2011-04-29 17:05:31 ----D---- C:\Windows\System32
2011-04-29 17:05:31 ----D---- C:\Windows\inf
2011-04-29 17:05:31 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-04-29 17:00:28 ----D---- C:\Users\Fana\AppData\Roaming\skypePM
2011-04-29 17:00:18 ----D---- C:\Users\Fana\AppData\Roaming\ICQ
2011-04-29 17:00:03 ----D---- C:\Windows\Minidump
2011-04-29 16:59:54 ----D---- C:\Windows\SYSWOW64\logishrd
2011-04-29 16:59:54 ----D---- C:\Windows\system32\logishrd
2011-04-29 16:59:54 ----D---- C:\ProgramData\NVIDIA
2011-04-29 16:59:52 ----D---- C:\Windows
2011-04-29 13:37:35 ----D---- C:\Windows\system32\config
2011-04-29 12:32:15 ----SHD---- C:\System Volume Information
2011-04-29 11:12:46 ----D---- C:\Windows\system32\catroot
2011-04-28 17:25:05 ----SHD---- C:\Windows\Installer
2011-04-28 17:24:58 ----D---- C:\Windows\SysWOW64
2011-04-28 12:51:08 ----D---- C:\Windows\winsxs
2011-04-28 12:50:55 ----D---- C:\Windows\system32\catroot2
2011-04-28 12:42:32 ----RD---- C:\Program Files (x86)
2011-04-28 12:36:52 ----D---- C:\Windows\SYSWOW64\migration
2011-04-28 12:36:52 ----D---- C:\Windows\SYSWOW64\en-US
2011-04-28 12:36:52 ----D---- C:\Windows\SYSWOW64\cs-CZ
2011-04-28 12:36:52 ----D---- C:\Windows\system32\migration
2011-04-28 12:36:52 ----D---- C:\Windows\system32\en-US
2011-04-28 12:36:52 ----D---- C:\Windows\system32\cs-CZ
2011-04-28 12:36:52 ----D---- C:\Windows\PolicyDefinitions
2011-04-28 12:36:52 ----D---- C:\Program Files\Internet Explorer
2011-04-28 12:36:52 ----D---- C:\Program Files (x86)\Internet Explorer
2011-04-28 10:07:45 ----D---- C:\ProgramData\Binarysense
2011-04-28 10:03:18 ----AD---- C:\ProgramData\TEMP
2011-04-28 09:47:37 ----D---- C:\Windows\debug
2011-04-27 23:04:49 ----D---- C:\Windows\AppPatch
2011-04-27 23:04:48 ----D---- C:\Windows\system32\DriverStore
2011-04-27 00:04:26 ----D---- C:\Windows\Tasks
2011-04-27 00:04:26 ----D---- C:\Windows\system32\wfp
2011-04-27 00:04:25 ----D---- C:\Windows\system32\wbem
2011-04-27 00:03:46 ----RSD---- C:\Windows\Media
2011-04-27 00:03:46 ----D---- C:\Windows\SYSWOW64\wbem
2011-04-27 00:03:46 ----D---- C:\Windows\rescache
2011-04-27 00:03:39 ----D---- C:\Windows\system32\Tasks
2011-04-27 00:03:39 ----D---- C:\Windows\system32\NDF
2011-04-27 00:03:39 ----D---- C:\Windows\system32\drivers\etc
2011-04-27 00:03:39 ----D---- C:\Windows\system32\CodeIntegrity
2011-04-27 00:03:37 ----D---- C:\Windows\AppCompat
2011-04-27 00:03:37 ----D---- C:\Users\Fana\AppData\Roaming\LangSoft
2011-04-27 00:03:35 ----D---- C:\Program Files\Common Files\Microsoft Shared
2011-04-27 00:03:35 ----D---- C:\Program Files (x86)\ScreenShots II
2011-04-27 00:03:35 ----D---- C:\Program Files (x86)\ScreenShots I
2011-04-27 00:03:35 ----D---- C:\Program Files (x86)\RocketDock
2011-04-27 00:03:35 ----D---- C:\Program Files (x86)\Pinnacle
2011-04-27 00:03:32 ----D---- C:\Windows\registration
2011-04-23 11:22:41 ----D---- C:\Program Files (x86)\LinX
2011-04-22 10:21:34 ----RD---- C:\Program Files
2011-04-22 08:46:18 ----HD---- C:\ProgramData
2011-04-21 19:30:35 ----A---- C:\Users\Fana\AppData\Roaming\burnaware.ini
2011-04-21 19:18:01 ----D---- C:\Users\Fana\AppData\Roaming\Vso
2011-04-21 12:43:11 ----D---- C:\Windows\Logs
2011-04-21 11:38:47 ----D---- C:\Program Files (x86)\Microsoft Silverlight
2011-04-18 16:22:44 ----A---- C:\Windows\system32\MRT.exe
2011-04-14 18:31:38 ----D---- C:\Program Files (x86)\Common Files
2011-04-14 08:46:26 ----D---- C:\Windows\Microsoft.NET
2011-04-14 08:46:08 ----RSD---- C:\Windows\assembly
2011-04-13 21:17:32 ----D---- C:\Windows\system32\Boot
2011-04-13 20:33:38 ----D---- C:\ProgramData\Microsoft Help
2011-04-07 14:22:31 ----D---- C:\Program Files\Prime95-64bit_v.25.11
2011-04-07 11:42:17 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2011-04-07 11:39:55 ----D---- C:\Windows\system32\drivers\UMDF
2011-04-06 22:45:07 ----D---- C:\Program Files (x86)\CPU-Z_152.2
2011-04-06 10:32:43 ----SHD---- C:\$Recycle.Bin
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 iaStor;Intel AHCI Controller; C:\Windows\system32\DRIVERS\iaStor.sys [2010-11-06 438808]
R0 KL1;kl1; C:\Windows\system32\DRIVERS\kl1.sys [2010-06-09 460888]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R0 snapman;Acronis Snapshots Manager; C:\Windows\system32\DRIVERS\snapman.sys [2011-02-18 277088]
R0 tdrpman273;Acronis Try&Decide and Restore Points filter (build 273); C:\Windows\system32\DRIVERS\tdrpm273.sys [2011-02-18 1263200]
R0 timounter;Acronis Backup Archive Explorer; C:\Windows\system32\DRIVERS\timntr.sys [2011-02-18 970336]
R0 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 199552]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 514560]
R1 HWiNFO32;HWiNFO32 Kernel Driver; \??\C:\Program Files (x86)\HWiNFO32\HWiNFO64A.SYS [2009-07-16 30080]
R1 ISODrive;ISO DVD/CD-ROM Device Driver; \??\C:\Program Files (x86)\UltraISO\drivers\ISODrv64.sys [2009-02-10 115600]
R1 kl2;kl2; C:\Windows\system32\DRIVERS\kl2.sys [2010-06-09 11864]
R1 KLIF;Kaspersky Lab Driver; C:\Windows\system32\DRIVERS\klif.sys [2011-02-13 556120]
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter; C:\Windows\system32\DRIVERS\klim6.sys [2010-04-22 27736]
R2 RtNdPt60;Realtek NDIS Protocol Driver; C:\Windows\system32\DRIVERS\RtNdPt60.sys [2009-07-20 27136]
R3 EverestDriver;Lavalys EVEREST Kernel Driver; \??\C:\Program Files (x86)\Lavalys\everestultimate_build_5.50.2253 Beta\kerneld.amd64 [2010-08-29 27264]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2010-11-02 2536040]
R3 klmouflt;Kaspersky Lab KLMOUFLT; C:\Windows\system32\DRIVERS\klmouflt.sys [2009-11-02 22544]
R3 LHidFilt;Logitech SetPoint KMDF HID Filter Driver; C:\Windows\system32\DRIVERS\LHidFilt.Sys [2010-08-24 63568]
R3 LMouFilt;Logitech SetPoint KMDF Mouse Filter Driver; C:\Windows\system32\DRIVERS\LMouFilt.Sys [2010-08-24 57936]
R3 LVPr2M64;Logitech LVPr2M64 Driver; C:\Windows\system32\DRIVERS\LVPr2M64.sys [2010-05-07 30304]
R3 LVRS64;Logitech RightSound Filter Driver; C:\Windows\system32\DRIVERS\lvrs64.sys [2010-11-10 341856]
R3 LVUSBS64;Logitech USB Monitor Filter; C:\Windows\system32\drivers\LVUSBS64.sys [2008-07-26 50072]
R3 LVUVC64;Logitech QuickCam Pro 9000(UVC); C:\Windows\system32\DRIVERS\lvuvc64.sys [2010-11-10 4162784]
R3 pcouffin;VSO Software pcouffin; C:\Windows\System32\Drivers\pcouffin.sys [2011-02-17 82816]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2011-01-21 413800]
S3 61883;61883 Unit Device; C:\Windows\system32\DRIVERS\61883.sys [2009-07-14 60288]
S3 afcdp;afcdp; C:\Windows\system32\DRIVERS\afcdp.sys [2011-02-18 285280]
S3 Avc;Zařízení AVC; C:\Windows\system32\DRIVERS\avc.sys [2009-07-14 48768]
S3 BthEnum;Ovladač pro Bluetooth Request Block; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 41984]
S3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2010-11-20 552448]
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2010-11-20 80384]
S3 cpuz132;cpuz132; \??\C:\Users\Fana\AppData\Local\Temp\cpuz132\cpuz132_x64.sys []
S3 ENTECH64;ENTECH64; \??\C:\Windows\system32\DRIVERS\ENTECH64.sys [2008-04-22 12744]
S3 gdrv;gdrv; \??\C:\Windows\gdrv.sys [2011-04-05 25640]
S3 LVPr2Mon;LVPr2M64 Driver; C:\Windows\system32\DRIVERS\LVPr2M64.sys [2010-05-07 30304]
S3 MSDV;Microsoft DV Camera and VCR; C:\Windows\system32\DRIVERS\msdv.sys [2009-07-14 61440]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 165888]
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
S3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.0); C:\Windows\system32\DRIVERS\RtTeam60.sys [2009-12-21 51712]
S3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.2); C:\Windows\system32\DRIVERS\RtVlan60.sys [2007-12-03 24064]
S3 s0016bus;Sony Ericsson Device 0016 driver (WDM); C:\Windows\system32\DRIVERS\s0016bus.sys [2008-05-16 115240]
S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter; C:\Windows\system32\DRIVERS\s0016mdfl.sys [2008-05-16 19496]
S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver; C:\Windows\system32\DRIVERS\s0016mdm.sys [2008-05-16 158760]
S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM); C:\Windows\system32\DRIVERS\s0016mgmt.sys [2008-05-16 137256]
S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS); C:\Windows\system32\DRIVERS\s0016nd5.sys [2008-05-16 34344]
S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface; C:\Windows\system32\DRIVERS\s0016obex.sys [2008-05-16 136744]
S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM); C:\Windows\system32\DRIVERS\s0016unic.sys [2008-05-16 151592]
S3 s1018bus;Sony Ericsson Device 1018 driver (WDM); C:\Windows\system32\DRIVERS\s1018bus.sys [2009-03-25 113704]
S3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter; C:\Windows\system32\DRIVERS\s1018mdfl.sys [2009-03-25 19496]
S3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver; C:\Windows\system32\DRIVERS\s1018mdm.sys [2009-03-25 153128]
S3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM); C:\Windows\system32\DRIVERS\s1018mgmt.sys [2009-03-25 133160]
S3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS); C:\Windows\system32\DRIVERS\s1018nd5.sys [2009-03-25 34856]
S3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface; C:\Windows\system32\DRIVERS\s1018obex.sys [2009-03-25 128552]
S3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM); C:\Windows\system32\DRIVERS\s1018unic.sys [2009-03-25 146472]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 6656]
S3 SaiK0836;SaiK0836; C:\Windows\system32\DRIVERS\SaiK0836.sys [2008-09-12 131584]
S3 SaiMini;SaiMini; C:\Windows\system32\DRIVERS\SaiMini.sys [2009-06-10 16000]
S3 SaiNtBus;SaiNtBus; C:\Windows\system32\drivers\SaiBus.sys [2009-06-10 43264]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 34688]
S3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.0); C:\Windows\system32\DRIVERS\RtTeam60.sys [2009-12-21 51712]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 59392]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 41984]
S3 VLAN;Realtek Virtual Miniport Driver for VLAN (NDIS 6.2); C:\Windows\system32\DRIVERS\RtVLAN60.sys [2007-12-03 24064]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 21760]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 41984]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 AVP;Služba Kaspersky Anti-Virus; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe [2010-11-02 365336]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology; C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-11-06 13336]
R2 LVPrcS64;Process Monitor; C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe [2010-05-07 197976]
R2 MDM;Machine Debug Manager; C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-20 322120]
R2 NVSvc;NVIDIA Driver Helper Service; C:\Windows\system32\nvvsvc.exe [2011-02-23 1005160]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-02-23 378984]
R3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335; C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe [2011-02-18 30192]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [2011-03-04 73728]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service; C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE [2010-03-25 30969208]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 Sony Ericsson PCCompanion;Sony Ericsson PCCompanion; C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [2011-02-10 150528]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2011-02-13 1255736]
S4 AcrSch2Svc;Služba Acronis Scheduler2; C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe [2010-12-17 1112664]
S4 afcdpsrv;Služba Acronis Nonstop Backup; C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe [2011-02-18 3246040]
S4 GEST Service;GEST Service for program management.; C:\Program Files (x86)\GIGABYTE\EnergySaver\GSvr.exe [2009-12-02 68136]
S4 LBTServ;Logitech Bluetooth Service; C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe [2010-10-28 357456]
S4 TeamViewer6;TeamViewer 6; C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-01-27 2253688]
-----------------EOF-----------------
Prosím o kontrolu logu-častý BSOD
Moderátor: Moderátoři
Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Vážení uživaterlé!
Ve dnech 4. - 6-9.2026 budou někteříí naši členové na každoročním srazu fóra. Žádáme vás, abyste měli strpení, nemusí se na na řešení vašeho problému dostat hned. Děkujeme za pochopení.
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Vážení uživaterlé!
Ve dnech 4. - 6-9.2026 budou někteříí naši členové na každoročním srazu fóra. Žádáme vás, abyste měli strpení, nemusí se na na řešení vašeho problému dostat hned. Děkujeme za pochopení.
Prosím o kontrolu logu-častý BSOD
CPU: Intel® Core™ i5-2500K @4,5GHz+Noctua NH-U12P / MB: MSI P67A-C45 (B3) 1.9/ RAM: Kingston 8GB HyperX 1600MHz DDR3 CL9 XMP/ VGA: MSI N560GTX-Ti Twin Frozr II/OC / HDD: SSD Intel X25-M 120GB + Samsung F1 HD103UJ + WD15EADS / DVD-RW: Lite-On iHAS424 / PSU: Corsair HX620 / CASE: Fractal DEFINE R4 Black Pearl / LCD: Dell 22" 2209WA E-IPS / Combo: Logitech MX500 Revolution
Re: Prosím o kontrolu logu-častý BSOD
Hezký podvečer 
Když pro mě vydolujete výpis z minidumpu z této složky- C:\Windows\Minidump, a pošlete mi ho třeba na www.leteckaposta.cz, zkusím zjistit, co je příčinou Bsod.
Když pro mě vydolujete výpis z minidumpu z této složky- C:\Windows\Minidump, a pošlete mi ho třeba na www.leteckaposta.cz, zkusím zjistit, co je příčinou Bsod.
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data
Chcete podpořit naše forum? Informace zde
K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Vždy před odvirováním počítače zazálohujte důležitá data
Chcete podpořit naše forum? Informace zde
K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Re: Prosím o kontrolu logu-častý BSOD
Mám tu připravené rovnou dva čerstvé, abych se jimi prokousával dnes v noci, ale pokud by jste byl tak hodný, budu moc rád, když se na ně podíváte. Nejsem v tomto přiznám se příliš zběhlý. 
(Testuji po nocích paměti, různé kombinace čtyř 2GB kitů ve všech bancích, ale na HW problém to nevypadá. Dokud jsem měl 32 bit OS s klasickým HDD a 2x2 GB RAM, nazaznamenal jsem roky problém. Přešel jsem na 64bit, 4x2GB RAM a SSD Intel X25-M a nemůžu to nějak pořád vychytat.)
Zde jsou: http://leteckaposta.cz/870620110 a ještě jednou díky moc.
P.S. Ještě se zeptám.... v čem je nejlepší logy *.dmp otevřít?
CPU: Intel® Core™ i5-2500K @4,5GHz+Noctua NH-U12P / MB: MSI P67A-C45 (B3) 1.9/ RAM: Kingston 8GB HyperX 1600MHz DDR3 CL9 XMP/ VGA: MSI N560GTX-Ti Twin Frozr II/OC / HDD: SSD Intel X25-M 120GB + Samsung F1 HD103UJ + WD15EADS / DVD-RW: Lite-On iHAS424 / PSU: Corsair HX620 / CASE: Fractal DEFINE R4 Black Pearl / LCD: Dell 22" 2209WA E-IPS / Combo: Logitech MX500 Revolution
Re: Prosím o kontrolu logu-častý BSOD
V čem je otevřít Vám napíšu pak, musím teď uložit děti 
. A mimochodem, jsem žena .
Já tedy nejsem velký odborník na dumpy, ale chyba je v jádru systému a řadiči
, zkusila bych se první podívat po viru, a jestli nic nenajdeme, pak poprosím kolegu Milinesse, ať na ty dumpy pořádně mrkne.
Stáhněte TDSSKiller http://support.kaspersky.com/downloads/ ... killer.exe
- a uložte ho na plochu.
- 2x klikněte na ikonu programu a spusťte
- dejte volbu Spustit kontrolu - pak potvrdte start sken
- pokud program najde infikovaný soubor, ukáže se Vám předvolená akce Cure, v tom případě potvrdte tlačítko Continue
- pokud bude chtít program restartovat počítač, klikněte na tlačítko Reboot Now
- pokud si restart nevyžádá, klikněte na tlačítko Report. Měl vy na Vás vyskočit log, obsah logu zkopírujte do svého topicu.
- pokud se log nezobrazí, je uložený ve Vašem kořenovém adresáři.
. A mimochodem, jsem žena .Já tedy nejsem velký odborník na dumpy, ale chyba je v jádru systému a řadiči
, zkusila bych se první podívat po viru, a jestli nic nenajdeme, pak poprosím kolegu Milinesse, ať na ty dumpy pořádně mrkne. Stáhněte TDSSKiller http://support.kaspersky.com/downloads/ ... killer.exe- a uložte ho na plochu.
- 2x klikněte na ikonu programu a spusťte
- dejte volbu Spustit kontrolu - pak potvrdte start sken
- pokud program najde infikovaný soubor, ukáže se Vám předvolená akce Cure, v tom případě potvrdte tlačítko Continue
- pokud bude chtít program restartovat počítač, klikněte na tlačítko Reboot Now
- pokud si restart nevyžádá, klikněte na tlačítko Report. Měl vy na Vás vyskočit log, obsah logu zkopírujte do svého topicu.
- pokud se log nezobrazí, je uložený ve Vašem kořenovém adresáři.
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data
Chcete podpořit naše forum? Informace zde
K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Vždy před odvirováním počítače zazálohujte důležitá data
Chcete podpořit naše forum? Informace zde
K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Re: Prosím o kontrolu logu-častý BSOD
TDSSKiller vůbec nic nenašel. Stejně tak jako KIS 2011 na nejvyšší možnou "důkladnost" kontroly a stejně tak ani Malwarebytes' Anti-Malware.
S těmy dumpy jsem začal laborovat až dnes, protože jsem pořád podezříval některý z pam. modulů, nebo banků, nebo pam. řadič na desce. A vzhledem k 8-mi GB RAM jsem měl vypnutý swap a tím pádem se mi logy *.dmp ani neukládaly.
P.S. Já jsem muž a taky musím jít uložit děti.
A díky.
S těmy dumpy jsem začal laborovat až dnes, protože jsem pořád podezříval některý z pam. modulů, nebo banků, nebo pam. řadič na desce. A vzhledem k 8-mi GB RAM jsem měl vypnutý swap a tím pádem se mi logy *.dmp ani neukládaly.
P.S. Já jsem muž a taky musím jít uložit děti.
A díky.
CPU: Intel® Core™ i5-2500K @4,5GHz+Noctua NH-U12P / MB: MSI P67A-C45 (B3) 1.9/ RAM: Kingston 8GB HyperX 1600MHz DDR3 CL9 XMP/ VGA: MSI N560GTX-Ti Twin Frozr II/OC / HDD: SSD Intel X25-M 120GB + Samsung F1 HD103UJ + WD15EADS / DVD-RW: Lite-On iHAS424 / PSU: Corsair HX620 / CASE: Fractal DEFINE R4 Black Pearl / LCD: Dell 22" 2209WA E-IPS / Combo: Logitech MX500 Revolution
Re: Prosím o kontrolu logu-častý BSOD
tak ještě jeden pokus na viry, ať víme, že to nimi není Spusťte combofix podle tohoto návoduhttp://www.bleepingcomputer.com/combofi ... t-combofix
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data
Chcete podpořit naše forum? Informace zde
K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Vždy před odvirováním počítače zazálohujte důležitá data
Chcete podpořit naše forum? Informace zde
K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Re: Prosím o kontrolu logu-častý BSOD
Takže k těm dumpům, jednoduchý je bluesreenview http://www.studna.cz/bluescreenview-p-14271.html, ale bohužel ne vždy vypíše příčinu.
Pak používám ještě tento
citace od kolegy Roliho
Pak používám ještě tento
citace od kolegy Roliho
Návod na analýzu BSOD:
Stáhni a nainstaluj Debugging Tools For Windows .
Přes Start >> Všechny programy vyhledej program s jménem WinDbg ve složce Debugging Tools for Window a spusť. Pokud používáš Windows Vista a máš zapnutý UAC,
spusť WinDbg jako administrátor (budeš přistupovat do adresáře Windows)
První co budeš muset nastavit je cesta k symbolům. Klikni na File -> Symbol File Path a zde nastav http://msdl.microsoft.com/download/symbols
Nyní můžeš začít analyzovat BSOB.
Klikni na File -> Open Crash Dump a najdi složku C:\Windows\Minidump. Ve složce Minidumps se nacházejí soubory Minixxxxxx-xx.dmp (xxxxxx-xx je datum a pořadové číslo).
Pokud je složka prázdná neměl jsi ještě žádnou BSOD nebo jsi jí vymazal.
Jakmile soubor otevřeš začnou se načítat symboly a po chvilce můžeš zadávat přikazy do přikazového řádku, kde stačí napsat !analyze -v (či kliknout myší na příkaz)
Nejdůležitější parametry, které tě mohou zajímat jsou :
PROCESS_NAME (jméno procesu, který způsobil chybu),
MODULE_NAME and IMAGE_NAME (tyto hodnoty stačí zadat do Googlu a řešení je jako na dlani)
Vypadá to asi TAKHLE
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data
Chcete podpořit naše forum? Informace zde
K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Vždy před odvirováním počítače zazálohujte důležitá data
Chcete podpořit naše forum? Informace zde
K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Re: Prosím o kontrolu logu-častý BSOD
Díky za pomoc. Děti jsem uspal a momentálně jsem na noční, tudíž se na toho svého "mazla" dostanu až někdy zítra k večeru.
Pohraju si s ním podle toho, jak jste mi napsala a výsledky svého bádání pošlu.
Zatím ještě jednou díky a přeji dobrou noc.
Pohraju si s ním podle toho, jak jste mi napsala a výsledky svého bádání pošlu.
Zatím ještě jednou díky a přeji dobrou noc.
CPU: Intel® Core™ i5-2500K @4,5GHz+Noctua NH-U12P / MB: MSI P67A-C45 (B3) 1.9/ RAM: Kingston 8GB HyperX 1600MHz DDR3 CL9 XMP/ VGA: MSI N560GTX-Ti Twin Frozr II/OC / HDD: SSD Intel X25-M 120GB + Samsung F1 HD103UJ + WD15EADS / DVD-RW: Lite-On iHAS424 / PSU: Corsair HX620 / CASE: Fractal DEFINE R4 Black Pearl / LCD: Dell 22" 2209WA E-IPS / Combo: Logitech MX500 Revolution
Re: Prosím o kontrolu logu-častý BSOD
Zkuste ten combofix, já bych tu zítra večer měla být. Dobrou
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data
Chcete podpořit naše forum? Informace zde
K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Vždy před odvirováním počítače zazálohujte důležitá data
Chcete podpořit naše forum? Informace zde
K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Re: Prosím o kontrolu logu-častý BSOD
Spolehněte se. Napíšu.motji napsal:Zkuste ten combofix, já bych tu zítra večer měla být. Dobrou
CPU: Intel® Core™ i5-2500K @4,5GHz+Noctua NH-U12P / MB: MSI P67A-C45 (B3) 1.9/ RAM: Kingston 8GB HyperX 1600MHz DDR3 CL9 XMP/ VGA: MSI N560GTX-Ti Twin Frozr II/OC / HDD: SSD Intel X25-M 120GB + Samsung F1 HD103UJ + WD15EADS / DVD-RW: Lite-On iHAS424 / PSU: Corsair HX620 / CASE: Fractal DEFINE R4 Black Pearl / LCD: Dell 22" 2209WA E-IPS / Combo: Logitech MX500 Revolution
Re: Prosím o kontrolu logu-častý BSOD
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data
Chcete podpořit naše forum? Informace zde
K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Vždy před odvirováním počítače zazálohujte důležitá data
Chcete podpořit naše forum? Informace zde
K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Re: Prosím o kontrolu logu-častý BSOD
Jak to vypadá s tím combofixem?
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data
Chcete podpořit naše forum? Informace zde
K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Vždy před odvirováním počítače zazálohujte důležitá data
Chcete podpořit naše forum? Informace zde
K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Re: Prosím o kontrolu logu-častý BSOD
Zdravím!
Říkal jsem k večeru....
Před chvílí jsme se vrátili z aquaparku a teď budu muset ještě odehrát dětem kousek z TR Legend...
Říkal jsem k večeru....
Před chvílí jsme se vrátili z aquaparku a teď budu muset ještě odehrát dětem kousek z TR Legend...
CPU: Intel® Core™ i5-2500K @4,5GHz+Noctua NH-U12P / MB: MSI P67A-C45 (B3) 1.9/ RAM: Kingston 8GB HyperX 1600MHz DDR3 CL9 XMP/ VGA: MSI N560GTX-Ti Twin Frozr II/OC / HDD: SSD Intel X25-M 120GB + Samsung F1 HD103UJ + WD15EADS / DVD-RW: Lite-On iHAS424 / PSU: Corsair HX620 / CASE: Fractal DEFINE R4 Black Pearl / LCD: Dell 22" 2209WA E-IPS / Combo: Logitech MX500 Revolution
Re: Prosím o kontrolu logu-častý BSOD
já už mlčím 
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data
Chcete podpořit naše forum? Informace zde
K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Vždy před odvirováním počítače zazálohujte důležitá data
Chcete podpořit naše forum? Informace zde
K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Re: Prosím o kontrolu logu-častý BSOD
Tak dobrý večer!
Omlouvám se, že píšu tak pozdě, ale vytuhnul jsem u malé při uspávání...
Takže zde slibovaný log z kombofixu:
ComboFix 11-04-29.04 - Fana 30.04.2011 20:50:49.2.4 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.4094.2855 [GMT 2:00]
Spuštěný z: c:\users\Fana\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *Disabled/Updated* {56547CC9-C9B2-849D-8FEF-A496150D6A06}
FW: Kaspersky Internet Security *Disabled* {6E6FFDEC-83DD-85C5-A4B0-0DA3EBDE2D7D}
SP: Kaspersky Internet Security *Disabled/Updated* {ED359D2D-EF88-8B13-B55F-9FE46E8A20BB}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-03-28 do 2011-04-30 )))))))))))))))))))))))))))))))
.
.
2011-04-30 18:55 . 2011-04-30 18:55 -------- d-----w- c:\users\Martínek\AppData\Local\temp
2011-04-30 18:55 . 2011-04-30 18:55 -------- d-----w- c:\users\Luci\AppData\Local\temp
2011-04-30 18:55 . 2011-04-30 18:55 -------- d-----w- c:\users\Klárinka\AppData\Local\temp
2011-04-30 18:55 . 2011-04-30 18:55 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-04-29 16:34 . 2011-04-29 16:34 -------- d-----w- C:\rsit
2011-04-28 10:42 . 2011-04-28 10:42 -------- d-----w- c:\program files (x86)\Turtix
2011-04-28 08:00 . 2011-04-28 08:07 -------- d-----w- c:\program files (x86)\BinarySense
2011-04-26 22:07 . 2011-04-26 22:07 -------- d-----w- c:\users\Luci\AppData\Local\Pinnacle
2011-04-26 21:04 . 2011-04-30 18:15 -------- d-----w- c:\program files (x86)\Nvidia
2011-04-25 09:35 . 2011-04-25 09:35 -------- d-----w- C:\found.001
2011-04-23 20:48 . 2011-04-23 20:49 -------- d-----w- c:\program files (x86)\ICQ7.4
2011-04-20 18:45 . 2011-04-26 22:03 -------- d-----w- c:\program files (x86)\FotoSketcher
2011-04-18 21:51 . 2011-04-18 21:51 -------- d-----w- c:\users\Luci\AppData\Local\Microsoft Help
2011-04-18 15:41 . 2011-04-30 10:36 -------- d-----w- c:\users\Martínek\AppData\Local\Microsoft Games
2011-04-16 12:40 . 2011-04-19 17:17 -------- d-----w- c:\program files (x86)\Filipova dobrodružství - Na stopě rodinným pokladům
2011-04-16 12:01 . 2011-04-16 12:24 -------- d-----w- c:\program files (x86)\Tomb Raider - Legend
2011-04-15 21:34 . 2011-04-16 14:58 -------- d-----w- c:\users\Fana\AppData\Roaming\gtk-2.0
2011-04-14 16:31 . 2011-04-14 16:31 -------- d-----w- c:\program files (x86)\Common Files\LightScribe
2011-04-14 01:39 . 2011-04-14 01:39 103864 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\nppdf32.dll
2011-04-13 18:09 . 2011-04-16 19:32 -------- d-----w- c:\program files (x86)\Opera
2011-04-09 13:10 . 2011-04-26 22:03 -------- d-----w- c:\users\Fana\AppData\Roaming\TeamViewer
2011-04-09 13:10 . 2011-04-09 13:10 -------- d-----w- c:\users\Fana\temp
2011-04-06 09:48 . 2011-04-06 09:48 -------- d-----w- c:\programdata\AltrixSoft
2011-04-06 09:32 . 2011-04-06 09:32 -------- d-----w- c:\users\Fana\AppData\Roaming\AltrixSoft
2011-04-06 09:31 . 2011-04-06 09:49 -------- d-----w- c:\program files (x86)\Common Files\AltrixSoft
2011-04-04 20:48 . 2011-04-04 20:48 -------- d-----w- c:\users\Fana\AppData\Local\Mozilla
2011-04-04 20:43 . 2011-04-04 20:43 -------- d-----w- c:\users\Luci\AppData\Local\Mozilla
2011-04-01 17:16 . 2011-04-01 17:16 -------- d-----w- c:\users\Klárinka\AppData\Local\Microsoft Games
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-13 20:47 . 2011-02-13 13:06 18960 ----a-w- c:\windows\system32\drivers\LNonPnP.sys
2011-04-05 21:02 . 2011-02-13 13:47 25640 ----a-w- c:\windows\gdrv.sys
2011-03-25 07:58 . 2011-03-25 07:58 73728 ----a-w- c:\windows\ST6UNST.EXE
2011-03-25 07:58 . 2011-03-25 07:58 253952 ------w- c:\windows\Setup1.exe
2011-03-04 06:19 . 2011-04-27 18:35 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2011-03-04 06:19 . 2011-04-27 18:35 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2011-03-03 15:34 . 2011-03-03 15:34 53248 ----a-r- c:\users\Fana\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2011-02-27 19:53 . 2002-02-10 01:00 72774 ----a-w- c:\windows\unins000.exe
2011-02-23 15:38 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll
2011-02-23 15:38 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll
2011-02-23 08:28 . 2011-03-11 22:23 7732328 ----a-w- c:\windows\system32\nvwgf2umx.dll
2011-02-23 08:28 . 2011-03-11 22:23 67176 ----a-w- c:\windows\system32\OpenCL.dll
2011-02-23 08:28 . 2011-03-11 22:23 6606440 ----a-w- c:\windows\system32\nvcuda.dll
2011-02-23 08:28 . 2011-03-11 22:23 57960 ----a-w- c:\windows\SysWow64\OpenCL.dll
2011-02-23 08:28 . 2011-03-11 22:23 5654120 ----a-w- c:\windows\SysWow64\nvwgf2um.dll
2011-02-23 08:28 . 2011-03-11 22:23 4942952 ----a-w- c:\windows\SysWow64\nvcuda.dll
2011-02-23 08:28 . 2011-03-11 22:23 3112040 ----a-w- c:\windows\system32\nvcuvid.dll
2011-02-23 08:28 . 2011-03-11 22:23 2895976 ----a-w- c:\windows\SysWow64\nvcuvid.dll
2011-02-23 08:28 . 2011-03-11 22:23 2479720 ----a-w- c:\windows\system32\nvcuvenc.dll
2011-02-23 08:28 . 2011-03-11 22:23 2251368 ----a-w- c:\windows\SysWow64\nvcuvenc.dll
2011-02-23 08:28 . 2011-03-11 22:23 2200680 ----a-w- c:\windows\system32\nvapi64.dll
2011-02-23 08:28 . 2011-03-11 22:23 20473960 ----a-w- c:\windows\system32\nvoglv64.dll
2011-02-23 08:28 . 2011-03-11 22:23 1965672 ----a-w- c:\windows\SysWow64\nvapi.dll
2011-02-23 08:28 . 2011-03-11 22:23 18580072 ----a-w- c:\windows\system32\nvcompiler.dll
2011-02-23 08:28 . 2011-03-11 22:23 1614440 ----a-w- c:\windows\system32\nvdispco642090.dll
2011-02-23 08:28 . 2011-03-11 22:23 15047272 ----a-w- c:\windows\SysWow64\nvoglv32.dll
2011-02-23 08:28 . 2011-03-11 22:23 1359976 ----a-w- c:\windows\system32\nvgenco642040.dll
2011-02-23 08:28 . 2011-03-11 22:23 13011560 ----a-w- c:\windows\SysWow64\nvcompiler.dll
2011-02-23 08:28 . 2011-03-11 22:23 12962792 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2011-02-23 08:28 . 2011-03-11 22:23 12862568 ----a-w- c:\windows\system32\nvd3dumx.dll
2011-02-23 08:28 . 2011-03-11 22:23 10079336 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2011-02-23 00:39 . 2011-02-23 00:39 795752 ----a-w- c:\windows\system32\easyUpdatusAPIU64.dll
2011-02-23 00:39 . 2011-02-23 00:39 6143080 ----a-w- c:\windows\system32\nvcpl.dll
2011-02-23 00:39 . 2011-02-23 00:39 3156072 ----a-w- c:\windows\system32\nvsvc64.dll
2011-02-23 00:38 . 2011-02-23 00:38 61032 ----a-w- c:\windows\system32\nvshext.dll
2011-02-23 00:38 . 2011-02-23 00:38 2558568 ----a-w- c:\windows\system32\nvsvcr.dll
2011-02-23 00:38 . 2011-02-23 00:38 117864 ----a-w- c:\windows\system32\nvmctray.dll
2011-02-23 00:38 . 2011-02-23 00:38 1005160 ----a-w- c:\windows\system32\nvvsvc.exe
2011-02-19 12:05 . 2011-03-09 11:43 1139200 ----a-w- c:\windows\system32\FntCache.dll
2011-02-19 12:04 . 2011-03-09 11:42 1544192 ----a-w- c:\windows\system32\DWrite.dll
2011-02-19 12:04 . 2011-03-09 11:43 902656 ----a-w- c:\windows\system32\d2d1.dll
2011-02-19 06:30 . 2011-03-09 11:43 1076736 ----a-w- c:\windows\SysWow64\DWrite.dll
2011-02-19 06:30 . 2011-03-09 11:42 739840 ----a-w- c:\windows\SysWow64\d2d1.dll
2011-02-18 21:47 . 2011-02-18 21:47 49079 ----a-w- c:\windows\SysWow64\RadLightAPEUninstall.exe
2011-02-18 21:07 . 2011-02-18 21:07 285280 ----a-w- c:\windows\system32\drivers\afcdp.sys
2011-02-18 21:07 . 2011-02-18 21:07 1263200 ----a-w- c:\windows\system32\drivers\tdrpm273.sys
2011-02-18 21:07 . 2011-02-18 21:07 970336 ----a-w- c:\windows\system32\drivers\timntr.sys
2011-02-18 21:07 . 2011-02-18 21:07 277088 ----a-w- c:\windows\system32\drivers\snapman.sys
2011-02-18 14:49 . 2011-02-18 14:49 49152 ----a-r- c:\users\Fana\AppData\Roaming\Microsoft\Installer\{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}\ARPPRODUCTICON.exe
2011-02-18 14:48 . 2003-03-19 11:05 106496 ----a-w- c:\windows\SysWow64\ATL71.DLL
2011-02-17 20:36 . 2011-02-17 20:36 82816 ----a-w- c:\windows\system32\drivers\pcouffin.sys
2011-02-17 20:36 . 2011-02-17 20:36 82816 ----a-w- c:\users\Fana\AppData\Roaming\pcouffin.sys
2011-02-02 16:11 . 2011-02-13 00:36 270720 ------w- c:\windows\system32\MpSigStub.exe
2011-02-02 16:10 . 2011-02-13 00:36 7844688 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{3817D671-B72F-4A57-8774-BED37EEECBC7}\mpengine.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-04-30_18.33.21 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-14 04:54 . 2011-04-30 18:38 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2011-04-30 17:11 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54 . 2011-04-30 18:38 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2011-04-30 17:11 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2011-04-30 18:38 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:54 . 2011-04-30 17:11 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 05:10 . 2011-04-30 18:40 41566 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
- 2009-07-14 05:10 . 2011-04-30 17:13 41566 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2011-02-12 21:55 . 2011-04-30 18:38 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-02-12 21:55 . 2011-04-30 17:12 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-02-12 21:55 . 2011-04-30 17:12 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2011-02-12 21:55 . 2011-04-30 18:38 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2011-02-12 21:55 . 2011-04-30 18:38 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2011-02-12 21:55 . 2011-04-30 17:12 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2011-02-12 21:55 . 2011-04-30 18:09 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-02-12 21:55 . 2011-04-30 18:38 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-02-12 21:55 . 2011-04-30 18:09 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-02-12 21:55 . 2011-04-30 18:38 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-02-12 21:56 . 2011-04-30 18:40 5468 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-767175766-3621902963-112204062-1001_UserData.bin
- 2011-02-12 21:56 . 2011-04-30 17:13 5468 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-767175766-3621902963-112204062-1001_UserData.bin
- 2011-04-30 17:11 . 2011-04-30 17:11 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-04-30 18:38 . 2011-04-30 18:38 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-04-30 17:11 . 2011-04-30 17:11 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-04-30 18:38 . 2011-04-30 18:38 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-07-14 02:36 . 2011-04-30 18:46 618714 c:\windows\system32\perfh009.dat
- 2009-07-14 02:36 . 2011-04-30 17:20 618714 c:\windows\system32\perfh009.dat
- 2009-07-14 15:18 . 2011-04-30 17:20 634308 c:\windows\system32\perfh005.dat
+ 2009-07-14 15:18 . 2011-04-30 18:46 634308 c:\windows\system32\perfh005.dat
+ 2009-07-14 02:36 . 2011-04-30 18:46 107034 c:\windows\system32\perfc009.dat
- 2009-07-14 02:36 . 2011-04-30 17:20 107034 c:\windows\system32\perfc009.dat
- 2009-07-14 15:18 . 2011-04-30 17:20 122898 c:\windows\system32\perfc005.dat
+ 2009-07-14 15:18 . 2011-04-30 18:46 122898 c:\windows\system32\perfc005.dat
- 2009-07-14 05:01 . 2011-04-30 12:04 414948 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2011-04-30 18:37 414948 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"Screenshot"="c:\program files (x86)\ScreenShots I\ScreenShots.exe" [2006-08-14 196608]
"Seznam Postak"="c:\program files (x86)\Seznam.cz\postak.exe" [2010-10-07 488728]
"Skype Launcher-Calimero"="c:\program files (x86)\CalimSkypeLauncher\CalimSkypeLauncher.exe" [2010-06-22 312811]
"RocketDock"="c:\program files (x86)\RocketDock\RocketDock.exe" [2007-09-02 495616]
"Pidgin"="c:\program files (x86)\PidginPortable\PidginPortable.exe" [2010-10-22 142264]
"ICQ"="c:\program files (x86)\ICQ7.4\ICQ.exe" [2011-03-01 119608]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"avp"="c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe" [2010-11-02 365336]
.
c:\users\Fana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Yahoo! Widgets.lnk - c:\program files (x86)\Yahoo!\Widgets\YahooWidgets.exe [2008-3-19 4742184]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~2\KASPER~1\KASPER~1\mzvkbd3.dll c:\progra~2\KASPER~1\KASPER~1\sbhook.dll c:\progra~2\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-disabled]
"TrueImageMonitor.exe"="c:\program files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe"
"SAOB Monitor"=c:\program files (x86)\Acronis\TrueImageHome\OnlineBackupStandalone\TrueImageMonitor.exe
"IAStorIcon"=c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
"Phys_X"=c:\program files (x86)\BPK\Phys_X.exe
"iSafeCW"=c:\program files (x86)\No name\Keylogger\winsrv.exe
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 LVPrcS64;Process Monitor;c:\program files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe [2010-05-07 197976]
R3 afcdp;afcdp;c:\windows\system32\DRIVERS\afcdp.sys [x]
R3 ENTECH64;ENTECH64;c:\windows\system32\DRIVERS\ENTECH64.sys [x]
R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files (x86)\Google\Google Desktop Search\GoogleDesktop.exe [2011-02-18 30192]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2010-03-25 30969208]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.0);c:\windows\system32\DRIVERS\RtTeam60.sys [x]
R3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtVlan60.sys [x]
R3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\DRIVERS\s0016bus.sys [x]
R3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s0016mdfl.sys [x]
R3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s0016mdm.sys [x]
R3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s0016mgmt.sys [x]
R3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\system32\DRIVERS\s0016nd5.sys [x]
R3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s0016obex.sys [x]
R3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\system32\DRIVERS\s0016unic.sys [x]
R3 s1018bus;Sony Ericsson Device 1018 driver (WDM);c:\windows\system32\DRIVERS\s1018bus.sys [x]
R3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s1018mdfl.sys [x]
R3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s1018mdm.sys [x]
R3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s1018mgmt.sys [x]
R3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS);c:\windows\system32\DRIVERS\s1018nd5.sys [x]
R3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s1018obex.sys [x]
R3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM);c:\windows\system32\DRIVERS\s1018unic.sys [x]
R3 SaiK0836;SaiK0836;c:\windows\system32\DRIVERS\SaiK0836.sys [x]
R3 Sony Ericsson PCCompanion;Sony Ericsson PCCompanion;c:\program files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [2011-02-10 150528]
R3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.0);c:\windows\system32\DRIVERS\RtTeam60.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 VLAN;Realtek Virtual Miniport Driver for VLAN (NDIS 6.2);c:\windows\system32\DRIVERS\RtVLAN60.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 afcdpsrv;Služba Acronis Nonstop Backup;c:\program files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe [2011-02-18 3246040]
R4 GEST Service;GEST Service for program management.;c:\program files (x86)\GIGABYTE\EnergySaver\GSvr.exe [2009-12-02 68136]
R4 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-01-27 2253688]
S0 tdrpman273;Acronis Try&Decide and Restore Points filter (build 273);c:\windows\system32\DRIVERS\tdrpm273.sys [x]
S1 HWiNFO32;HWiNFO32 Kernel Driver;c:\program files (x86)\HWiNFO32\HWiNFO64A.SYS [2009-07-16 30080]
S1 kl2;kl2;c:\windows\system32\DRIVERS\kl2.sys [x]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-11-05 13336]
S2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\DRIVERS\RtNdPt60.sys [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-02-23 378984]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [x]
S3 LVPr2M64;Logitech LVPr2M64 Driver;c:\windows\system32\DRIVERS\LVPr2M64.sys [x]
S3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys [x]
S3 LVUSBS64;Logitech USB Monitor Filter;c:\windows\system32\drivers\LVUSBS64.sys [x]
S3 LVUVC64;Logitech QuickCam Pro 9000(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*Deregistered* - PROCEXP141
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2011-03-04 10:29 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{2D46B6DC-2207-486B-B523-A557E6D54B47}]
2010-11-20 12:17 302592 ----a-w- c:\windows\System32\cmd.exe
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-11-02 11545192]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-10-28 1680976]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\progra~2\KASPER~1\KASPER~1\x64\kloehk.dll c:\progra~2\KASPER~1\KASPER~1\x64\sbhook64.dll
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.seznam.cz/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - c:\program files (x86)\ICQ7.4\ICQ.exe
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\programdata\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\programdata\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\programdata\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\programdata\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\programdata\LangSoft\WebIE.dll
FF - ProfilePath - c:\users\Fana\AppData\Roaming\Mozilla\Firefox\Profiles\ealqexou.default\
FF - prefs.js: browser.startup.homepage - http://www.seznam.cz
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2011-04-30 20:57:14
ComboFix-quarantined-files.txt 2011-04-30 18:57
ComboFix2.txt 2011-04-30 18:35
.
Před spuštěním: Volných bajtů: 36 177 080 320
Po spuštění: Volných bajtů: 36 124 483 584
.
- - End Of File - - 5F0A4AE8F6CC420880A962BD29A62796
Omlouvám se, že píšu tak pozdě, ale vytuhnul jsem u malé při uspávání...
Takže zde slibovaný log z kombofixu:
ComboFix 11-04-29.04 - Fana 30.04.2011 20:50:49.2.4 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.4094.2855 [GMT 2:00]
Spuštěný z: c:\users\Fana\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *Disabled/Updated* {56547CC9-C9B2-849D-8FEF-A496150D6A06}
FW: Kaspersky Internet Security *Disabled* {6E6FFDEC-83DD-85C5-A4B0-0DA3EBDE2D7D}
SP: Kaspersky Internet Security *Disabled/Updated* {ED359D2D-EF88-8B13-B55F-9FE46E8A20BB}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-03-28 do 2011-04-30 )))))))))))))))))))))))))))))))
.
.
2011-04-30 18:55 . 2011-04-30 18:55 -------- d-----w- c:\users\Martínek\AppData\Local\temp
2011-04-30 18:55 . 2011-04-30 18:55 -------- d-----w- c:\users\Luci\AppData\Local\temp
2011-04-30 18:55 . 2011-04-30 18:55 -------- d-----w- c:\users\Klárinka\AppData\Local\temp
2011-04-30 18:55 . 2011-04-30 18:55 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-04-29 16:34 . 2011-04-29 16:34 -------- d-----w- C:\rsit
2011-04-28 10:42 . 2011-04-28 10:42 -------- d-----w- c:\program files (x86)\Turtix
2011-04-28 08:00 . 2011-04-28 08:07 -------- d-----w- c:\program files (x86)\BinarySense
2011-04-26 22:07 . 2011-04-26 22:07 -------- d-----w- c:\users\Luci\AppData\Local\Pinnacle
2011-04-26 21:04 . 2011-04-30 18:15 -------- d-----w- c:\program files (x86)\Nvidia
2011-04-25 09:35 . 2011-04-25 09:35 -------- d-----w- C:\found.001
2011-04-23 20:48 . 2011-04-23 20:49 -------- d-----w- c:\program files (x86)\ICQ7.4
2011-04-20 18:45 . 2011-04-26 22:03 -------- d-----w- c:\program files (x86)\FotoSketcher
2011-04-18 21:51 . 2011-04-18 21:51 -------- d-----w- c:\users\Luci\AppData\Local\Microsoft Help
2011-04-18 15:41 . 2011-04-30 10:36 -------- d-----w- c:\users\Martínek\AppData\Local\Microsoft Games
2011-04-16 12:40 . 2011-04-19 17:17 -------- d-----w- c:\program files (x86)\Filipova dobrodružství - Na stopě rodinným pokladům
2011-04-16 12:01 . 2011-04-16 12:24 -------- d-----w- c:\program files (x86)\Tomb Raider - Legend
2011-04-15 21:34 . 2011-04-16 14:58 -------- d-----w- c:\users\Fana\AppData\Roaming\gtk-2.0
2011-04-14 16:31 . 2011-04-14 16:31 -------- d-----w- c:\program files (x86)\Common Files\LightScribe
2011-04-14 01:39 . 2011-04-14 01:39 103864 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\nppdf32.dll
2011-04-13 18:09 . 2011-04-16 19:32 -------- d-----w- c:\program files (x86)\Opera
2011-04-09 13:10 . 2011-04-26 22:03 -------- d-----w- c:\users\Fana\AppData\Roaming\TeamViewer
2011-04-09 13:10 . 2011-04-09 13:10 -------- d-----w- c:\users\Fana\temp
2011-04-06 09:48 . 2011-04-06 09:48 -------- d-----w- c:\programdata\AltrixSoft
2011-04-06 09:32 . 2011-04-06 09:32 -------- d-----w- c:\users\Fana\AppData\Roaming\AltrixSoft
2011-04-06 09:31 . 2011-04-06 09:49 -------- d-----w- c:\program files (x86)\Common Files\AltrixSoft
2011-04-04 20:48 . 2011-04-04 20:48 -------- d-----w- c:\users\Fana\AppData\Local\Mozilla
2011-04-04 20:43 . 2011-04-04 20:43 -------- d-----w- c:\users\Luci\AppData\Local\Mozilla
2011-04-01 17:16 . 2011-04-01 17:16 -------- d-----w- c:\users\Klárinka\AppData\Local\Microsoft Games
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-13 20:47 . 2011-02-13 13:06 18960 ----a-w- c:\windows\system32\drivers\LNonPnP.sys
2011-04-05 21:02 . 2011-02-13 13:47 25640 ----a-w- c:\windows\gdrv.sys
2011-03-25 07:58 . 2011-03-25 07:58 73728 ----a-w- c:\windows\ST6UNST.EXE
2011-03-25 07:58 . 2011-03-25 07:58 253952 ------w- c:\windows\Setup1.exe
2011-03-04 06:19 . 2011-04-27 18:35 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2011-03-04 06:19 . 2011-04-27 18:35 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2011-03-03 15:34 . 2011-03-03 15:34 53248 ----a-r- c:\users\Fana\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2011-02-27 19:53 . 2002-02-10 01:00 72774 ----a-w- c:\windows\unins000.exe
2011-02-23 15:38 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll
2011-02-23 15:38 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll
2011-02-23 08:28 . 2011-03-11 22:23 7732328 ----a-w- c:\windows\system32\nvwgf2umx.dll
2011-02-23 08:28 . 2011-03-11 22:23 67176 ----a-w- c:\windows\system32\OpenCL.dll
2011-02-23 08:28 . 2011-03-11 22:23 6606440 ----a-w- c:\windows\system32\nvcuda.dll
2011-02-23 08:28 . 2011-03-11 22:23 57960 ----a-w- c:\windows\SysWow64\OpenCL.dll
2011-02-23 08:28 . 2011-03-11 22:23 5654120 ----a-w- c:\windows\SysWow64\nvwgf2um.dll
2011-02-23 08:28 . 2011-03-11 22:23 4942952 ----a-w- c:\windows\SysWow64\nvcuda.dll
2011-02-23 08:28 . 2011-03-11 22:23 3112040 ----a-w- c:\windows\system32\nvcuvid.dll
2011-02-23 08:28 . 2011-03-11 22:23 2895976 ----a-w- c:\windows\SysWow64\nvcuvid.dll
2011-02-23 08:28 . 2011-03-11 22:23 2479720 ----a-w- c:\windows\system32\nvcuvenc.dll
2011-02-23 08:28 . 2011-03-11 22:23 2251368 ----a-w- c:\windows\SysWow64\nvcuvenc.dll
2011-02-23 08:28 . 2011-03-11 22:23 2200680 ----a-w- c:\windows\system32\nvapi64.dll
2011-02-23 08:28 . 2011-03-11 22:23 20473960 ----a-w- c:\windows\system32\nvoglv64.dll
2011-02-23 08:28 . 2011-03-11 22:23 1965672 ----a-w- c:\windows\SysWow64\nvapi.dll
2011-02-23 08:28 . 2011-03-11 22:23 18580072 ----a-w- c:\windows\system32\nvcompiler.dll
2011-02-23 08:28 . 2011-03-11 22:23 1614440 ----a-w- c:\windows\system32\nvdispco642090.dll
2011-02-23 08:28 . 2011-03-11 22:23 15047272 ----a-w- c:\windows\SysWow64\nvoglv32.dll
2011-02-23 08:28 . 2011-03-11 22:23 1359976 ----a-w- c:\windows\system32\nvgenco642040.dll
2011-02-23 08:28 . 2011-03-11 22:23 13011560 ----a-w- c:\windows\SysWow64\nvcompiler.dll
2011-02-23 08:28 . 2011-03-11 22:23 12962792 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2011-02-23 08:28 . 2011-03-11 22:23 12862568 ----a-w- c:\windows\system32\nvd3dumx.dll
2011-02-23 08:28 . 2011-03-11 22:23 10079336 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2011-02-23 00:39 . 2011-02-23 00:39 795752 ----a-w- c:\windows\system32\easyUpdatusAPIU64.dll
2011-02-23 00:39 . 2011-02-23 00:39 6143080 ----a-w- c:\windows\system32\nvcpl.dll
2011-02-23 00:39 . 2011-02-23 00:39 3156072 ----a-w- c:\windows\system32\nvsvc64.dll
2011-02-23 00:38 . 2011-02-23 00:38 61032 ----a-w- c:\windows\system32\nvshext.dll
2011-02-23 00:38 . 2011-02-23 00:38 2558568 ----a-w- c:\windows\system32\nvsvcr.dll
2011-02-23 00:38 . 2011-02-23 00:38 117864 ----a-w- c:\windows\system32\nvmctray.dll
2011-02-23 00:38 . 2011-02-23 00:38 1005160 ----a-w- c:\windows\system32\nvvsvc.exe
2011-02-19 12:05 . 2011-03-09 11:43 1139200 ----a-w- c:\windows\system32\FntCache.dll
2011-02-19 12:04 . 2011-03-09 11:42 1544192 ----a-w- c:\windows\system32\DWrite.dll
2011-02-19 12:04 . 2011-03-09 11:43 902656 ----a-w- c:\windows\system32\d2d1.dll
2011-02-19 06:30 . 2011-03-09 11:43 1076736 ----a-w- c:\windows\SysWow64\DWrite.dll
2011-02-19 06:30 . 2011-03-09 11:42 739840 ----a-w- c:\windows\SysWow64\d2d1.dll
2011-02-18 21:47 . 2011-02-18 21:47 49079 ----a-w- c:\windows\SysWow64\RadLightAPEUninstall.exe
2011-02-18 21:07 . 2011-02-18 21:07 285280 ----a-w- c:\windows\system32\drivers\afcdp.sys
2011-02-18 21:07 . 2011-02-18 21:07 1263200 ----a-w- c:\windows\system32\drivers\tdrpm273.sys
2011-02-18 21:07 . 2011-02-18 21:07 970336 ----a-w- c:\windows\system32\drivers\timntr.sys
2011-02-18 21:07 . 2011-02-18 21:07 277088 ----a-w- c:\windows\system32\drivers\snapman.sys
2011-02-18 14:49 . 2011-02-18 14:49 49152 ----a-r- c:\users\Fana\AppData\Roaming\Microsoft\Installer\{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}\ARPPRODUCTICON.exe
2011-02-18 14:48 . 2003-03-19 11:05 106496 ----a-w- c:\windows\SysWow64\ATL71.DLL
2011-02-17 20:36 . 2011-02-17 20:36 82816 ----a-w- c:\windows\system32\drivers\pcouffin.sys
2011-02-17 20:36 . 2011-02-17 20:36 82816 ----a-w- c:\users\Fana\AppData\Roaming\pcouffin.sys
2011-02-02 16:11 . 2011-02-13 00:36 270720 ------w- c:\windows\system32\MpSigStub.exe
2011-02-02 16:10 . 2011-02-13 00:36 7844688 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{3817D671-B72F-4A57-8774-BED37EEECBC7}\mpengine.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-04-30_18.33.21 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-14 04:54 . 2011-04-30 18:38 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2011-04-30 17:11 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54 . 2011-04-30 18:38 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2011-04-30 17:11 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2011-04-30 18:38 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:54 . 2011-04-30 17:11 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 05:10 . 2011-04-30 18:40 41566 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
- 2009-07-14 05:10 . 2011-04-30 17:13 41566 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2011-02-12 21:55 . 2011-04-30 18:38 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-02-12 21:55 . 2011-04-30 17:12 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-02-12 21:55 . 2011-04-30 17:12 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2011-02-12 21:55 . 2011-04-30 18:38 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2011-02-12 21:55 . 2011-04-30 18:38 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2011-02-12 21:55 . 2011-04-30 17:12 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2011-02-12 21:55 . 2011-04-30 18:09 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-02-12 21:55 . 2011-04-30 18:38 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-02-12 21:55 . 2011-04-30 18:09 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-02-12 21:55 . 2011-04-30 18:38 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-02-12 21:56 . 2011-04-30 18:40 5468 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-767175766-3621902963-112204062-1001_UserData.bin
- 2011-02-12 21:56 . 2011-04-30 17:13 5468 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-767175766-3621902963-112204062-1001_UserData.bin
- 2011-04-30 17:11 . 2011-04-30 17:11 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-04-30 18:38 . 2011-04-30 18:38 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-04-30 17:11 . 2011-04-30 17:11 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-04-30 18:38 . 2011-04-30 18:38 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-07-14 02:36 . 2011-04-30 18:46 618714 c:\windows\system32\perfh009.dat
- 2009-07-14 02:36 . 2011-04-30 17:20 618714 c:\windows\system32\perfh009.dat
- 2009-07-14 15:18 . 2011-04-30 17:20 634308 c:\windows\system32\perfh005.dat
+ 2009-07-14 15:18 . 2011-04-30 18:46 634308 c:\windows\system32\perfh005.dat
+ 2009-07-14 02:36 . 2011-04-30 18:46 107034 c:\windows\system32\perfc009.dat
- 2009-07-14 02:36 . 2011-04-30 17:20 107034 c:\windows\system32\perfc009.dat
- 2009-07-14 15:18 . 2011-04-30 17:20 122898 c:\windows\system32\perfc005.dat
+ 2009-07-14 15:18 . 2011-04-30 18:46 122898 c:\windows\system32\perfc005.dat
- 2009-07-14 05:01 . 2011-04-30 12:04 414948 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2011-04-30 18:37 414948 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"Screenshot"="c:\program files (x86)\ScreenShots I\ScreenShots.exe" [2006-08-14 196608]
"Seznam Postak"="c:\program files (x86)\Seznam.cz\postak.exe" [2010-10-07 488728]
"Skype Launcher-Calimero"="c:\program files (x86)\CalimSkypeLauncher\CalimSkypeLauncher.exe" [2010-06-22 312811]
"RocketDock"="c:\program files (x86)\RocketDock\RocketDock.exe" [2007-09-02 495616]
"Pidgin"="c:\program files (x86)\PidginPortable\PidginPortable.exe" [2010-10-22 142264]
"ICQ"="c:\program files (x86)\ICQ7.4\ICQ.exe" [2011-03-01 119608]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"avp"="c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe" [2010-11-02 365336]
.
c:\users\Fana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Yahoo! Widgets.lnk - c:\program files (x86)\Yahoo!\Widgets\YahooWidgets.exe [2008-3-19 4742184]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~2\KASPER~1\KASPER~1\mzvkbd3.dll c:\progra~2\KASPER~1\KASPER~1\sbhook.dll c:\progra~2\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-disabled]
"TrueImageMonitor.exe"="c:\program files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe"
"SAOB Monitor"=c:\program files (x86)\Acronis\TrueImageHome\OnlineBackupStandalone\TrueImageMonitor.exe
"IAStorIcon"=c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
"Phys_X"=c:\program files (x86)\BPK\Phys_X.exe
"iSafeCW"=c:\program files (x86)\No name\Keylogger\winsrv.exe
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 LVPrcS64;Process Monitor;c:\program files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe [2010-05-07 197976]
R3 afcdp;afcdp;c:\windows\system32\DRIVERS\afcdp.sys [x]
R3 ENTECH64;ENTECH64;c:\windows\system32\DRIVERS\ENTECH64.sys [x]
R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files (x86)\Google\Google Desktop Search\GoogleDesktop.exe [2011-02-18 30192]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2010-03-25 30969208]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.0);c:\windows\system32\DRIVERS\RtTeam60.sys [x]
R3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtVlan60.sys [x]
R3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\DRIVERS\s0016bus.sys [x]
R3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s0016mdfl.sys [x]
R3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s0016mdm.sys [x]
R3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s0016mgmt.sys [x]
R3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\system32\DRIVERS\s0016nd5.sys [x]
R3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s0016obex.sys [x]
R3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\system32\DRIVERS\s0016unic.sys [x]
R3 s1018bus;Sony Ericsson Device 1018 driver (WDM);c:\windows\system32\DRIVERS\s1018bus.sys [x]
R3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s1018mdfl.sys [x]
R3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s1018mdm.sys [x]
R3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s1018mgmt.sys [x]
R3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS);c:\windows\system32\DRIVERS\s1018nd5.sys [x]
R3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s1018obex.sys [x]
R3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM);c:\windows\system32\DRIVERS\s1018unic.sys [x]
R3 SaiK0836;SaiK0836;c:\windows\system32\DRIVERS\SaiK0836.sys [x]
R3 Sony Ericsson PCCompanion;Sony Ericsson PCCompanion;c:\program files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [2011-02-10 150528]
R3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.0);c:\windows\system32\DRIVERS\RtTeam60.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 VLAN;Realtek Virtual Miniport Driver for VLAN (NDIS 6.2);c:\windows\system32\DRIVERS\RtVLAN60.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 afcdpsrv;Služba Acronis Nonstop Backup;c:\program files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe [2011-02-18 3246040]
R4 GEST Service;GEST Service for program management.;c:\program files (x86)\GIGABYTE\EnergySaver\GSvr.exe [2009-12-02 68136]
R4 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-01-27 2253688]
S0 tdrpman273;Acronis Try&Decide and Restore Points filter (build 273);c:\windows\system32\DRIVERS\tdrpm273.sys [x]
S1 HWiNFO32;HWiNFO32 Kernel Driver;c:\program files (x86)\HWiNFO32\HWiNFO64A.SYS [2009-07-16 30080]
S1 kl2;kl2;c:\windows\system32\DRIVERS\kl2.sys [x]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-11-05 13336]
S2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\DRIVERS\RtNdPt60.sys [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-02-23 378984]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [x]
S3 LVPr2M64;Logitech LVPr2M64 Driver;c:\windows\system32\DRIVERS\LVPr2M64.sys [x]
S3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys [x]
S3 LVUSBS64;Logitech USB Monitor Filter;c:\windows\system32\drivers\LVUSBS64.sys [x]
S3 LVUVC64;Logitech QuickCam Pro 9000(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*Deregistered* - PROCEXP141
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2011-03-04 10:29 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{2D46B6DC-2207-486B-B523-A557E6D54B47}]
2010-11-20 12:17 302592 ----a-w- c:\windows\System32\cmd.exe
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-11-02 11545192]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-10-28 1680976]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\progra~2\KASPER~1\KASPER~1\x64\kloehk.dll c:\progra~2\KASPER~1\KASPER~1\x64\sbhook64.dll
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.seznam.cz/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - c:\program files (x86)\ICQ7.4\ICQ.exe
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\programdata\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\programdata\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\programdata\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\programdata\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\programdata\LangSoft\WebIE.dll
FF - ProfilePath - c:\users\Fana\AppData\Roaming\Mozilla\Firefox\Profiles\ealqexou.default\
FF - prefs.js: browser.startup.homepage - http://www.seznam.cz
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2011-04-30 20:57:14
ComboFix-quarantined-files.txt 2011-04-30 18:57
ComboFix2.txt 2011-04-30 18:35
.
Před spuštěním: Volných bajtů: 36 177 080 320
Po spuštění: Volných bajtů: 36 124 483 584
.
- - End Of File - - 5F0A4AE8F6CC420880A962BD29A62796
CPU: Intel® Core™ i5-2500K @4,5GHz+Noctua NH-U12P / MB: MSI P67A-C45 (B3) 1.9/ RAM: Kingston 8GB HyperX 1600MHz DDR3 CL9 XMP/ VGA: MSI N560GTX-Ti Twin Frozr II/OC / HDD: SSD Intel X25-M 120GB + Samsung F1 HD103UJ + WD15EADS / DVD-RW: Lite-On iHAS424 / PSU: Corsair HX620 / CASE: Fractal DEFINE R4 Black Pearl / LCD: Dell 22" 2209WA E-IPS / Combo: Logitech MX500 Revolution
Přispějete na provoz fóra?
