VIRY.CZ

Naughty píše:zdarec,

nedaří s emi namontovat ani de facto nejde HKCU apod větvě napojit když nemám user.dat z profilu, prolézt dle článku clsid data viz http://nakedsecurity.sophos.com/2012/06 ... -usermode/ což by mohlo odpovídat tvému problému.

Nechame veci neobjektivme bez posudenia moderatora

Naughty píše:zdarec,
nedaří s emi namontovat ani de facto nejde HKCU apod větvě napojit když nemám user.dat z profilu, prolézt dle článku clsid data viz http://nakedsecurity.sophos.com/2012/06 ... -usermode/ což by mohlo odpovídat tvému problému.

Mno kouknul jsem na ten odkaz, ale moc moudrej z toho nejsem. Co presne bych se mel pokusit najit? v registrech nebo mam hledat ty dva soubory?

Naughty píše: edit: farbar aktulizoval včera svůj FRSIT

32 bit http://www.bleepingcomputer.com/downloa ... ool/dl/81/
64 bit http://www.bleepingcomputer.com/downloa ... ool/dl/82/

Mam tedy stahnout nejakej novej nastroj na techto odkazech?

Zdravim, omlouvam se, ze jsem dlouho nepsal, ale mel jsem jine povinnosti. Mam logy z programu, ktere jste tady uvadeli, bohuzel z ComboFixu se mi nepodarilo udelat, i kdyz jsem to zkousel na mnoha z pocitacu v ucebne.
Dal je asi jeste dulezite poznamenat, ze nasledujici logy jsou z jineho pocitace, nez jsem posilal pred tim ty obsahy adresaru, nebot ten puvodni pocitac jaksi prestal fungovat i v nouzovem rezimu, takze prisel format a total reinstalace.
Sice ted vznikne prispevek dlouhej jak Metuzalem, ale psali jste nakopirovat obsah souboru, tak jdu kopirovat


================ zacatek vypisu MbrScan.log ===================== ================ konec vypisu MbrScan.log =====================



========= zacatek vypisu TDSSKiller.2.7.36.0_10.06.2012_20.19.11_log.txt ===============

20:19:11.0500 1736 TDSS rootkit removing tool 2.7.36.0 May 21 2012 16:40:16
20:19:11.0515 1736 ============================================================
20:19:11.0515 1736 Current date / time: 2012/06/10 20:19:11.0515
20:19:11.0515 1736 SystemInfo:
20:19:11.0515 1736
20:19:11.0515 1736 OS Version: 5.1.2600 ServicePack: 3.0
20:19:11.0515 1736 Product type: Workstation
20:19:11.0515 1736 ComputerName: WX2400885
20:19:11.0515 1736 UserName: Administrator
20:19:11.0515 1736 Windows directory: C:\WINDOWS
20:19:11.0515 1736 System windows directory: C:\WINDOWS
20:19:11.0515 1736 Processor architecture: Intel x86
20:19:11.0515 1736 Number of processors: 2
20:19:11.0515 1736 Page size: 0x1000
20:19:11.0515 1736 Boot type: Safe boot
20:19:11.0515 1736 ============================================================
20:19:13.0421 1736 Drive \Device\Harddisk0\DR0 - Size: 0x9925B0000 (38.29 Gb), SectorSize: 0x200, Cylinders: 0x1386, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
20:19:13.0421 1736 Drive \Device\Harddisk1\DR3 - Size: 0xEF1A8000 (3.74 Gb), SectorSize: 0x200, Cylinders: 0x1E7, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
20:19:13.0421 1736 ============================================================
20:19:13.0421 1736 \Device\Harddisk0\DR0:
20:19:13.0421 1736 MBR partitions:
20:19:13.0421 1736 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x385989F
20:19:13.0437 1736 \Device\Harddisk1\DR3:
20:19:13.0437 1736 MBR partitions:
20:19:13.0437 1736 \Device\Harddisk1\DR3\Partition0: MBR, Type 0xB, StartLBA 0x3F, BlocksNum 0x778D01
20:19:13.0437 1736 ============================================================
20:19:13.0515 1736 C: <-> \Device\Harddisk0\DR0\Partition0
20:19:13.0515 1736 ============================================================
20:19:13.0515 1736 Initialize success
20:19:13.0515 1736 ============================================================
20:19:50.0093 1756 ============================================================
20:19:50.0093 1756 Scan started
20:19:50.0093 1756 Mode: Manual; SigCheck; TDLFS;
20:19:50.0093 1756 ============================================================
20:19:50.0906 1756 Abiosdsk - ok
20:19:50.0937 1756 abp480n5 - ok
20:19:51.0031 1756 ACPI (4fe34f1f3126b61fcc6b2043aa8112c9) C:\WINDOWS\system32\DRIVERS\ACPI.sys
20:19:56.0640 1756 ACPI - ok
20:19:56.0671 1756 ACPIEC (afdff022a01f0b11c776f0860c3b282f) C:\WINDOWS\system32\drivers\ACPIEC.sys
20:19:56.0906 1756 ACPIEC - ok
20:19:56.0921 1756 ACTIVhidmini - ok
20:19:56.0953 1756 ActivHidSerMini - ok
20:19:56.0984 1756 adpu160m - ok
20:19:57.0046 1756 aeaudio (11c04b17ed2abbb4833694bcd644ac90) C:\WINDOWS\system32\drivers\aeaudio.sys
20:19:57.0140 1756 aeaudio - ok
20:19:57.0218 1756 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
20:19:57.0484 1756 aec - ok
20:19:57.0562 1756 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
20:19:57.0671 1756 AFD - ok
20:19:57.0687 1756 Aha154x - ok
20:19:57.0718 1756 aic78u2 - ok
20:19:57.0750 1756 aic78xx - ok
20:19:57.0937 1756 ALCXSENS (fbbcb95f677cbaa924140b6ea2d9a97b) C:\WINDOWS\system32\drivers\ALCXSENS.SYS
20:19:58.0218 1756 ALCXSENS ( UnsignedFile.Multi.Generic ) - warning
20:19:58.0218 1756 ALCXSENS - detected UnsignedFile.Multi.Generic (1)
20:19:58.0453 1756 ALCXWDM (bc5c55b49c4bd1fdfaaa128fe21f9fea) C:\WINDOWS\system32\drivers\ALCXWDM.SYS
20:19:58.0828 1756 ALCXWDM ( UnsignedFile.Multi.Generic ) - warning
20:19:58.0828 1756 ALCXWDM - detected UnsignedFile.Multi.Generic (1)
20:19:58.0875 1756 Alerter (e0a6fa244b8624d78fe5ff6f56a33bae) C:\WINDOWS\system32\alrsvc.dll
20:19:59.0093 1756 Alerter - ok
20:19:59.0140 1756 ALG (88842de939a827577bf24243699ac80a) C:\WINDOWS\System32\alg.exe
20:19:59.0359 1756 ALG - ok
20:19:59.0375 1756 AliIde - ok
20:19:59.0406 1756 amsint - ok
20:19:59.0500 1756 AppMgmt (6b8e7a90e576d4fe308f97c69060a171) C:\WINDOWS\System32\appmgmts.dll
20:19:59.0765 1756 AppMgmt - ok
20:19:59.0781 1756 asc - ok
20:19:59.0812 1756 asc3350p - ok
20:19:59.0843 1756 asc3550 - ok
20:20:00.0000 1756 aspnet_state (0e5e4957549056e2bf2c49f4f6b601ad) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
20:20:00.0062 1756 aspnet_state - ok
20:20:00.0093 1756 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
20:20:00.0359 1756 AsyncMac - ok
20:20:00.0421 1756 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
20:20:00.0656 1756 atapi - ok
20:20:00.0671 1756 Atdisk - ok
20:20:00.0734 1756 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
20:20:00.0968 1756 Atmarpc - ok
20:20:01.0015 1756 AudioSrv (de31b88962a8645dba5a37b993e7b0f1) C:\WINDOWS\System32\audiosrv.dll
20:20:01.0265 1756 AudioSrv - ok
20:20:01.0296 1756 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
20:20:01.0515 1756 audstub - ok
20:20:01.0562 1756 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
20:20:01.0796 1756 Beep - ok
20:20:01.0968 1756 BITS (19395d092fd85ddc2d9c7729cf5a2ac8) C:\WINDOWS\system32\qmgr.dll
20:20:02.0468 1756 BITS - ok
20:20:02.0531 1756 Browser (249276d3ef1e74b992299cb96099e4d7) C:\WINDOWS\System32\browser.dll
20:20:02.0781 1756 Browser - ok
20:20:02.0812 1756 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
20:20:03.0046 1756 cbidf2k - ok
20:20:03.0140 1756 ccEvtMgr (4aa730bb7b79b7ba70b1e30acf97d6ab) C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
20:20:03.0203 1756 ccEvtMgr - ok
20:20:03.0218 1756 ccSetMgr (4aa730bb7b79b7ba70b1e30acf97d6ab) C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
20:20:03.0250 1756 ccSetMgr - ok
20:20:03.0265 1756 cd20xrnt - ok
20:20:03.0312 1756 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
20:20:03.0562 1756 Cdaudio - ok
20:20:03.0609 1756 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
20:20:03.0843 1756 Cdfs - ok
20:20:03.0890 1756 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
20:20:04.0125 1756 Cdrom - ok
20:20:04.0140 1756 Changer - ok
20:20:04.0203 1756 CiSvc (e390dc1d7c461d7d56ec53402f329928) C:\WINDOWS\system32\cisvc.exe
20:20:04.0453 1756 CiSvc - ok
20:20:04.0484 1756 ClipSrv (064507a8dfa8c5c7e2ffddd3e6f424fa) C:\WINDOWS\system32\clipsrv.exe
20:20:04.0703 1756 ClipSrv - ok
20:20:04.0750 1756 clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
20:20:04.0812 1756 clr_optimization_v2.0.50727_32 - ok
20:20:04.0828 1756 CmdIde - ok
20:20:04.0890 1756 COH_Mon (86a22dff16e8ca67601044efe6825537) C:\WINDOWS\system32\Drivers\COH_Mon.sys
20:20:04.0921 1756 COH_Mon - ok
20:20:04.0937 1756 COMSysApp - ok
20:20:04.0984 1756 Cpqarray - ok
20:20:05.0046 1756 CryptSvc (f3ab0933cbd166d271992f411c27ccaf) C:\WINDOWS\System32\cryptsvc.dll
20:20:05.0296 1756 CryptSvc - ok
20:20:05.0312 1756 dac2w2k - ok
20:20:05.0343 1756 dac960nt - ok
20:20:05.0515 1756 DcomLaunch (be27674d1cbc3214aec84b4336a38bbf) C:\WINDOWS\system32\rpcss.dll
20:20:05.0765 1756 DcomLaunch - ok
20:20:05.0843 1756 Dhcp (8c9a53e285ac5e6704844d0459ec85be) C:\WINDOWS\System32\dhcpcsvc.dll
20:20:06.0093 1756 Dhcp - ok
20:20:06.0125 1756 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
20:20:06.0390 1756 Disk - ok
20:20:06.0406 1756 dmadmin - ok
20:20:06.0687 1756 dmboot (db5fd2bf5b07dc54bfcb3664ff05bd7c) C:\WINDOWS\system32\drivers\dmboot.sys
20:20:07.0328 1756 dmboot - ok
20:20:07.0406 1756 dmio (fff1720af51171f32f1ead5cf71f2810) C:\WINDOWS\system32\drivers\dmio.sys
20:20:07.0671 1756 dmio - ok
20:20:07.0703 1756 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
20:20:07.0937 1756 dmload - ok
20:20:07.0968 1756 dmserver (2bfefe9e865655a76982f050450b9591) C:\WINDOWS\System32\dmserver.dll
20:20:08.0187 1756 dmserver - ok
20:20:08.0250 1756 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
20:20:08.0500 1756 DMusic - ok
20:20:08.0546 1756 Dnscache (dfaa406bf19f4ee806a6f8d4342137f7) C:\WINDOWS\System32\dnsrslvr.dll
20:20:08.0656 1756 Dnscache - ok
20:20:08.0734 1756 Dot3svc (4a3e2bd20157a0946751229e92eb8621) C:\WINDOWS\System32\dot3svc.dll
20:20:08.0984 1756 Dot3svc - ok
20:20:09.0015 1756 dpti2o - ok
20:20:09.0046 1756 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
20:20:09.0265 1756 drmkaud - ok
20:20:09.0343 1756 E1000 (16b7726c2d8b4e3e5df64666c16498f5) C:\WINDOWS\system32\DRIVERS\e1000325.sys
20:20:09.0453 1756 E1000 - ok
20:20:09.0515 1756 EapHost (0887d9c2be8d940778cad1e3b85f2a41) C:\WINDOWS\System32\eapsvc.dll
20:20:09.0750 1756 EapHost - ok
20:20:09.0937 1756 eeCtrl (fce87ba643d5e9a8b6e0378508d1b22d) C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
20:20:10.0296 1756 eeCtrl - ok
20:20:10.0359 1756 EraserUtilRebootDrv (115dc729465a8c386615207f28875255) C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
20:20:10.0437 1756 EraserUtilRebootDrv - ok
20:20:10.0468 1756 ERSvc (a2a4912798f2be706abadd3d30800d16) C:\WINDOWS\System32\ersvc.dll
20:20:10.0718 1756 ERSvc - ok
20:20:10.0781 1756 Eventlog (9ef697af07bb8dd82c3b02ca953a95b7) C:\WINDOWS\system32\services.exe
20:20:10.0828 1756 Eventlog - ok
20:20:10.0937 1756 EventSystem (a371f11ef07653591c8de26afb13ce7f) C:\WINDOWS\system32\es.dll
20:20:11.0078 1756 EventSystem - ok
20:20:11.0156 1756 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
20:20:11.0437 1756 Fastfat - ok
20:20:11.0515 1756 FastUserSwitchingCompatibility (ee9a2b9ea968a792a053c9d1a86bf870) C:\WINDOWS\System32\shsvcs.dll
20:20:11.0640 1756 FastUserSwitchingCompatibility - ok
20:20:11.0687 1756 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
20:20:11.0906 1756 Fdc - ok
20:20:11.0953 1756 Fips (ac366695a0796560aa37215ad5762aaf) C:\WINDOWS\system32\drivers\Fips.sys
20:20:12.0203 1756 Fips - ok
20:20:12.0250 1756 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
20:20:12.0453 1756 Flpydisk - ok
20:20:12.0531 1756 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
20:20:12.0781 1756 FltMgr - ok
20:20:12.0875 1756 FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
20:20:12.0921 1756 FontCache3.0.0.0 - ok
20:20:12.0953 1756 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
20:20:13.0187 1756 Fs_Rec - ok
20:20:13.0265 1756 Ftdisk (4e664d8541db4a66b73a24257e322e1f) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
20:20:13.0546 1756 Ftdisk - ok
20:20:13.0562 1756 GMSIPCI - ok
20:20:13.0609 1756 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
20:20:13.0828 1756 Gpc - ok
20:20:13.0890 1756 helpsvc (fcfe31fb75f8a6295b6b0af87a626282) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
20:20:14.0109 1756 helpsvc - ok
20:20:14.0140 1756 HidServ (00e25ee90166b3e1be6e74aebf858306) C:\WINDOWS\System32\hidserv.dll
20:20:14.0406 1756 HidServ - ok
20:20:14.0453 1756 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
20:20:14.0656 1756 HidUsb - ok
20:20:14.0718 1756 hkmsvc (7a6b320928f86bc851530d63c82965d9) C:\WINDOWS\System32\kmsvc.dll
20:20:14.0937 1756 hkmsvc - ok
20:20:14.0953 1756 hpn - ok
20:20:15.0078 1756 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
20:20:15.0281 1756 HTTP - ok
20:20:15.0328 1756 HTTPFilter (58fe2f2da3bc5573f4a35b3760d3125f) C:\WINDOWS\System32\w3ssl.dll
20:20:15.0562 1756 HTTPFilter - ok
20:20:15.0578 1756 i2omgmt - ok
20:20:15.0593 1756 i2omp - ok
20:20:15.0656 1756 i8042prt (c528e27945367191e7bae364930b6932) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
20:20:15.0890 1756 i8042prt - ok
20:20:16.0156 1756 ialm (2858e04751178a47223e0c5ce495478a) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
20:20:16.0656 1756 ialm - ok
20:20:17.0000 1756 idsvc (c01ac32dc5c03076cfb852cb5da5229c) c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
20:20:17.0546 1756 idsvc - ok
20:20:17.0750 1756 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
20:20:17.0984 1756 Imapi - ok
20:20:18.0046 1756 ImapiService (f7b93aafad33b2320954c17e26c8d361) C:\WINDOWS\system32\imapi.exe
20:20:18.0328 1756 ImapiService - ok
20:20:18.0359 1756 ini910u - ok
20:20:18.0421 1756 IntelIde (57d928e548b38502abba7a77a6eb7312) C:\WINDOWS\system32\DRIVERS\intelide.sys
20:20:18.0640 1756 IntelIde - ok
20:20:18.0687 1756 intelppm (27b290d632af2cf3cf40bfddb7370985) C:\WINDOWS\system32\DRIVERS\intelppm.sys
20:20:18.0921 1756 intelppm - ok
20:20:18.0953 1756 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
20:20:19.0187 1756 Ip6Fw - ok
20:20:19.0234 1756 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
20:20:19.0468 1756 IpFilterDriver - ok
20:20:19.0500 1756 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
20:20:19.0718 1756 IpInIp - ok
20:20:19.0796 1756 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
20:20:20.0062 1756 IpNat - ok
20:20:20.0125 1756 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
20:20:20.0390 1756 IPSec - ok
20:20:20.0437 1756 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
20:20:20.0640 1756 IRENUM - ok
20:20:20.0703 1756 isapnp (cc9f8a2d60aed1a51a3ac34c59b987ae) C:\WINDOWS\system32\DRIVERS\isapnp.sys
20:20:20.0921 1756 isapnp - ok
20:20:20.0968 1756 Kbdclass (1b6162fe7f66b1a71a4b70f941c4aa9b) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
20:20:21.0187 1756 Kbdclass - ok
20:20:21.0250 1756 kbdhid (86c8f23616c6c6e5b2776901c17b945b) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
20:20:21.0453 1756 kbdhid - ok
20:20:21.0546 1756 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
20:20:21.0812 1756 kmixer - ok
20:20:21.0875 1756 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
20:20:21.0984 1756 KSecDD - ok
20:20:22.0062 1756 lanmanserver (3428e8f86f8add36b42fb23542c7b3e4) C:\WINDOWS\System32\srvsvc.dll
20:20:22.0187 1756 lanmanserver - ok
20:20:22.0281 1756 lanmanworkstation (936c1d110232d23b621cb0196e4f80f0) C:\WINDOWS\System32\wkssvc.dll
20:20:22.0390 1756 lanmanworkstation - ok
20:20:22.0406 1756 lbrtfdc - ok
20:20:23.0515 1756 LiveUpdate (6293e44f4aa06f7fcda06f4b07cdc0c2) C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
20:20:25.0390 1756 LiveUpdate - ok
20:20:25.0640 1756 LmHosts (0ab159f536e3e8f7f07113702a07cca5) C:\WINDOWS\System32\lmhsvc.dll
20:20:25.0859 1756 LmHosts - ok
20:20:25.0906 1756 Messenger (221cd1c815b8a6b79389c3f5d1018de8) C:\WINDOWS\System32\msgsvc.dll
20:20:26.0125 1756 Messenger - ok
20:20:26.0250 1756 Microsoft Office Groove Audit Service (fafe367d032ed82e9332b4c741a20216) C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe
20:20:26.0296 1756 Microsoft Office Groove Audit Service - ok
20:20:26.0359 1756 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
20:20:26.0578 1756 mnmdd - ok
20:20:26.0625 1756 mnmsrvc (9a57d046f88f4b69751b11fd40088a61) C:\WINDOWS\system32\mnmsrvc.exe
20:20:26.0843 1756 mnmsrvc - ok
20:20:26.0890 1756 Modem (44032b0c6d9954d3fd26438330b99ee7) C:\WINDOWS\system32\drivers\Modem.sys
20:20:27.0093 1756 Modem - ok
20:20:27.0125 1756 Mouclass (4cb582831dbde63ce43b45d771218374) C:\WINDOWS\system32\DRIVERS\mouclass.sys
20:20:27.0375 1756 Mouclass - ok
20:20:27.0390 1756 mouhid (bb269eba740737ab749b214d568b6812) C:\WINDOWS\system32\DRIVERS\mouhid.sys
20:20:27.0640 1756 mouhid - ok
20:20:27.0671 1756 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
20:20:27.0906 1756 MountMgr - ok
20:20:27.0921 1756 mraid35x - ok
20:20:28.0015 1756 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
20:20:28.0296 1756 MRxDAV - ok
20:20:28.0484 1756 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
20:20:28.0765 1756 MRxSmb - ok
20:20:28.0796 1756 MSDTC (6db4d1521caba9a5ffab54ade0ae867d) C:\WINDOWS\system32\msdtc.exe
20:20:29.0000 1756 MSDTC - ok
20:20:29.0046 1756 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
20:20:29.0281 1756 Msfs - ok
20:20:29.0296 1756 MSIServer - ok
20:20:29.0343 1756 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
20:20:29.0546 1756 MSKSSRV - ok
20:20:29.0562 1756 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
20:20:29.0781 1756 MSPCLOCK - ok
20:20:29.0796 1756 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
20:20:30.0015 1756 MSPQM - ok
20:20:30.0062 1756 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
20:20:30.0281 1756 mssmbios - ok
20:20:30.0359 1756 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
20:20:30.0453 1756 Mup - ok
20:20:30.0562 1756 napagent (6ea362e9db03d44f6b996f4d8be237e9) C:\WINDOWS\System32\qagentrt.dll
20:20:30.0859 1756 napagent - ok
20:20:30.0984 1756 NAVENG (f11033730b38260b6892e837c457fb4b) C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20120604.002\NAVENG.SYS
20:20:31.0046 1756 NAVENG - ok
20:20:31.0578 1756 NAVEX15 (4e4e7c0259d3bb97de24a636c0e06aba) C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20120604.002\NAVEX15.SYS
20:20:32.0515 1756 NAVEX15 - ok
20:20:32.0843 1756 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
20:20:33.0109 1756 NDIS - ok
20:20:33.0140 1756 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
20:20:33.0218 1756 NdisTapi - ok
20:20:33.0250 1756 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
20:20:33.0468 1756 Ndisuio - ok
20:20:33.0515 1756 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
20:20:33.0765 1756 NdisWan - ok
20:20:33.0796 1756 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
20:20:33.0875 1756 NDProxy - ok
20:20:33.0906 1756 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
20:20:34.0125 1756 NetBIOS - ok
20:20:34.0218 1756 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
20:20:34.0484 1756 NetBT - ok
20:20:34.0562 1756 NetDDE (933de774986ec85e48210c44ab431de6) C:\WINDOWS\system32\netdde.exe
20:20:34.0812 1756 NetDDE - ok
20:20:34.0828 1756 NetDDEdsdm (933de774986ec85e48210c44ab431de6) C:\WINDOWS\system32\netdde.exe
20:20:35.0031 1756 NetDDEdsdm - ok
20:20:35.0078 1756 Netlogon (ed0a176354487ceed65b80a7148ab739) C:\WINDOWS\system32\lsass.exe
20:20:35.0296 1756 Netlogon - ok
20:20:35.0406 1756 Netman (72e1e9e2977be08bdeedb6d8fd9d4d40) C:\WINDOWS\System32\netman.dll
20:20:35.0671 1756 Netman - ok
20:20:35.0781 1756 NetTcpPortSharing (d34612c5d02d026535b3095d620626ae) c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
20:20:35.0843 1756 NetTcpPortSharing - ok
20:20:35.0937 1756 Nla (39ee7c3bfbc64ba87cc8cf67386e814c) C:\WINDOWS\System32\mswsock.dll
20:20:36.0046 1756 Nla - ok
20:20:36.0078 1756 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
20:20:36.0328 1756 Npfs - ok
20:20:36.0531 1756 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
20:20:37.0000 1756 Ntfs - ok
20:20:37.0015 1756 NtLmSsp (ed0a176354487ceed65b80a7148ab739) C:\WINDOWS\system32\lsass.exe
20:20:37.0234 1756 NtLmSsp - ok
20:20:37.0437 1756 NtmsSvc (023dd70573d644f3d9c8b1258a7bfd08) C:\WINDOWS\system32\ntmssvc.dll
20:20:37.0890 1756 NtmsSvc - ok
20:20:37.0921 1756 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
20:20:38.0140 1756 Null - ok
20:20:38.0250 1756 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
20:20:38.0500 1756 NwlnkFlt - ok
20:20:38.0531 1756 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
20:20:38.0781 1756 NwlnkFwd - ok
20:20:39.0046 1756 odserv (84de1dd996b48b05ace31ad015fa108a) C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
20:20:39.0375 1756 odserv - ok
20:20:39.0453 1756 ose (5a432a042dae460abe7199b758e8606c) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
20:20:39.0531 1756 ose - ok
20:20:39.0609 1756 Parport (46f8db73b4a53e543f8e371dc7c75bae) C:\WINDOWS\system32\DRIVERS\parport.sys
20:20:39.0843 1756 Parport - ok
20:20:39.0875 1756 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
20:20:40.0078 1756 PartMgr - ok
20:20:40.0125 1756 ParVdm (1fae19d0457176318bba4a8795656ebc) C:\WINDOWS\system32\drivers\ParVdm.sys
20:20:40.0375 1756 ParVdm - ok
20:20:40.0421 1756 PCI (6ce351d149cb4befc702951e471e1730) C:\WINDOWS\system32\DRIVERS\pci.sys
20:20:40.0671 1756 PCI - ok
20:20:40.0687 1756 PCIDump - ok
20:20:40.0734 1756 PCIIde (2da4ec85e0ea7a45c6b2a05820492d5a) C:\WINDOWS\system32\drivers\PCIIde.sys
20:20:40.0968 1756 PCIIde - ok
20:20:41.0046 1756 Pcmcia (4fc31e6c19a5ce5198b1abff94cae758) C:\WINDOWS\system32\drivers\Pcmcia.sys
20:20:41.0296 1756 Pcmcia - ok
20:20:41.0484 1756 PDCOMP - ok
20:20:41.0500 1756 PDFRAME - ok
20:20:41.0531 1756 PDRELI - ok
20:20:41.0531 1756 PDRFRAME - ok
20:20:41.0546 1756 perc2 - ok
20:20:41.0546 1756 perc2hib - ok
20:20:41.0625 1756 PlugPlay (9ef697af07bb8dd82c3b02ca953a95b7) C:\WINDOWS\system32\services.exe
20:20:41.0671 1756 PlugPlay - ok
20:20:41.0718 1756 PolicyAgent (ed0a176354487ceed65b80a7148ab739) C:\WINDOWS\system32\lsass.exe
20:20:41.0906 1756 PolicyAgent - ok
20:20:41.0953 1756 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
20:20:42.0187 1756 PptpMiniport - ok
20:20:42.0187 1756 prmvmouse - ok
20:20:42.0203 1756 ProtectedStorage (ed0a176354487ceed65b80a7148ab739) C:\WINDOWS\system32\lsass.exe
20:20:42.0390 1756 ProtectedStorage - ok
20:20:42.0437 1756 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
20:20:42.0656 1756 PSched - ok
20:20:42.0703 1756 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
20:20:42.0937 1756 Ptilink - ok
20:20:42.0937 1756 ql1080 - ok
20:20:42.0953 1756 Ql10wnt - ok
20:20:42.0953 1756 ql12160 - ok
20:20:42.0968 1756 ql1240 - ok
20:20:42.0968 1756 ql1280 - ok
20:20:43.0000 1756 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
20:20:43.0234 1756 RasAcd - ok
20:20:43.0296 1756 RasAuto (2b5e44ea009f2f374b980e1e9a70635d) C:\WINDOWS\System32\rasauto.dll
20:20:43.0515 1756 RasAuto - ok
20:20:43.0562 1756 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
20:20:43.0781 1756 Rasl2tp - ok
20:20:43.0875 1756 RasMan (d57554c664b64604bd1ee13ea2c07e77) C:\WINDOWS\System32\rasmans.dll
20:20:44.0140 1756 RasMan - ok
20:20:44.0328 1756 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
20:20:44.0531 1756 RasPppoe - ok
20:20:44.0718 1756 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
20:20:44.0984 1756 Raspti - ok
20:20:45.0062 1756 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
20:20:45.0359 1756 Rdbss - ok
20:20:45.0390 1756 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
20:20:45.0687 1756 RDPCDD - ok
20:20:45.0796 1756 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
20:20:46.0187 1756 rdpdr - ok
20:20:46.0312 1756 RDPWD (5b3055daa788bd688594d2f5981f2a83) C:\WINDOWS\system32\drivers\RDPWD.sys
20:20:46.0437 1756 RDPWD - ok
20:20:46.0515 1756 RDSessMgr (c0d9d9711cb74ee9bc66353d8cbdab0e) C:\WINDOWS\system32\sessmgr.exe
20:20:46.0875 1756 RDSessMgr - ok
20:20:46.0937 1756 redbook (611bfd220305be3a85ae876ea47d4aa5) C:\WINDOWS\system32\DRIVERS\redbook.sys
20:20:47.0171 1756 redbook - ok
20:20:47.0296 1756 RemoteAccess (127c26b5371651043450e52542099aba) C:\WINDOWS\System32\mprdim.dll
20:20:47.0640 1756 RemoteAccess - ok
20:20:47.0734 1756 RemoteRegistry (8f31505484a190d5b22274708799f4ec) C:\WINDOWS\system32\regsvc.dll
20:20:47.0953 1756 RemoteRegistry - ok
20:20:48.0000 1756 RpcLocator (718b3bdc0bc3c2f7d065a53d26202af9) C:\WINDOWS\system32\locator.exe
20:20:48.0265 1756 RpcLocator - ok
20:20:48.0437 1756 RpcSs (be27674d1cbc3214aec84b4336a38bbf) C:\WINDOWS\system32\rpcss.dll
20:20:48.0578 1756 RpcSs - ok
20:20:48.0750 1756 RSVP (09ab2e71e58b078038e3bfdba7ffc984) C:\WINDOWS\system32\rsvp.exe
20:20:49.0015 1756 RSVP - ok
20:20:49.0062 1756 SamSs (ed0a176354487ceed65b80a7148ab739) C:\WINDOWS\system32\lsass.exe
20:20:49.0265 1756 SamSs - ok
20:20:49.0328 1756 SCardSvr (410046e401eb11e1e6749e9deea41d4a) C:\WINDOWS\System32\SCardSvr.exe
20:20:49.0609 1756 SCardSvr - ok
20:20:49.0750 1756 Schedule (3ff232a7731621b8902d81d42418c93c) C:\WINDOWS\system32\schedsvc.dll
20:20:50.0015 1756 Schedule - ok
20:20:50.0062 1756 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
20:20:50.0265 1756 Secdrv - ok
20:20:50.0312 1756 seclogon (477e2c3cc5e4a0d635bcb0ea8dcac3c6) C:\WINDOWS\System32\seclogon.dll
20:20:50.0531 1756 seclogon - ok
20:20:50.0671 1756 SENS (a530b75c10c23c9ab28fdb6ce719e21f) C:\WINDOWS\system32\sens.dll
20:20:50.0890 1756 SENS - ok
20:20:50.0906 1756 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
20:20:51.0125 1756 serenum - ok
20:20:51.0156 1756 Serial (b842729337c9b921615c40d3c1a1af96) C:\WINDOWS\system32\DRIVERS\serial.sys
20:20:51.0406 1756 Serial - ok
20:20:51.0453 1756 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
20:20:51.0718 1756 Sfloppy - ok
20:20:51.0843 1756 SharedAccess (f58faca9621d2db01bd0927d9a0a208e) C:\WINDOWS\System32\ipnathlp.dll
20:20:52.0234 1756 SharedAccess - ok
20:20:52.0328 1756 ShellHWDetection (ee9a2b9ea968a792a053c9d1a86bf870) C:\WINDOWS\System32\shsvcs.dll
20:20:52.0359 1756 ShellHWDetection - ok
20:20:52.0375 1756 Simbad - ok
20:20:53.0140 1756 SmcService (d916a094dc3b5332cf53f50bde0d0fae) C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
20:20:54.0312 1756 SmcService - ok
20:20:54.0875 1756 smwdm (70b8dd8707dbf6142530c106365df67d) C:\WINDOWS\system32\drivers\smwdm.sys
20:20:55.0203 1756 smwdm - ok
20:20:55.0437 1756 SNAC (d3b6133b0bf6620643e5f36de1f54ab6) C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE
20:20:55.0562 1756 SNAC - ok
20:20:55.0640 1756 SoundMAX Agent Service (default) (3978f082274f723ad5a0a8058c2417dd) C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
20:20:55.0687 1756 SoundMAX Agent Service (default) ( UnsignedFile.Multi.Generic ) - warning
20:20:55.0687 1756 SoundMAX Agent Service (default) - detected UnsignedFile.Multi.Generic (1)
20:20:55.0703 1756 Sparrow - ok
20:20:55.0921 1756 SPBBCDrv (d7bb213566e16bca372e2cb517eda907) C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys
20:20:56.0171 1756 SPBBCDrv - ok
20:20:56.0218 1756 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
20:20:56.0437 1756 splitter - ok
20:20:56.0484 1756 Spooler (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe
20:20:56.0562 1756 Spooler - ok
20:20:56.0593 1756 sr (94610c8653635e4459316a0050d55ce7) C:\WINDOWS\system32\DRIVERS\sr.sys
20:20:56.0812 1756 sr - ok
20:20:56.0890 1756 srservice (35b91147124f64ac8081a2edb9ea4dee) C:\WINDOWS\system32\srsvc.dll
20:20:57.0140 1756 srservice - ok
20:20:57.0281 1756 SRTSP (522651a0e7dc6415e083317370b609cc) C:\WINDOWS\system32\Drivers\SRTSP.SYS
20:20:57.0406 1756 SRTSP - ok
20:20:57.0562 1756 SRTSPL (34e823b8d730099d032608fcccbc6a25) C:\WINDOWS\system32\Drivers\SRTSPL.SYS
20:20:57.0781 1756 SRTSPL - ok
20:20:57.0828 1756 SRTSPX (469006e15f5b0fe8ae94184a18a81586) C:\WINDOWS\system32\Drivers\SRTSPX.SYS
20:20:57.0859 1756 SRTSPX - ok
20:20:58.0000 1756 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
20:20:58.0234 1756 Srv - ok
20:20:58.0296 1756 SSDPSRV (becd5271dc4e3b7c3d035f790fcbc1e5) C:\WINDOWS\System32\ssdpsrv.dll
20:20:58.0515 1756 SSDPSRV - ok
20:20:58.0656 1756 stisvc (c1cdd9275f6a115bb0ae1d55d8d27ba6) C:\WINDOWS\system32\wiaservc.dll
20:20:59.0046 1756 stisvc - ok
20:20:59.0078 1756 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
20:20:59.0296 1756 swenum - ok
20:20:59.0343 1756 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
20:20:59.0562 1756 swmidi - ok
20:20:59.0578 1756 SwPrv - ok
20:21:00.0437 1756 Symantec AntiVirus (dd10cb8aa990f89091bc267370fd0843) C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
20:21:01.0187 1756 Symantec AntiVirus - ok
20:21:01.0453 1756 symc810 - ok
20:21:01.0453 1756 symc8xx - ok
20:21:01.0531 1756 SymEvent (e03ee3ef1037099554d17bed99545a5e) C:\WINDOWS\system32\Drivers\SYMEVENT.SYS
20:21:01.0593 1756 SymEvent - ok
20:21:01.0625 1756 SYMREDRV (be3c117150c055e50a4caf23e548c856) C:\WINDOWS\System32\Drivers\SYMREDRV.SYS
20:21:01.0671 1756 SYMREDRV - ok
20:21:01.0750 1756 SYMTDI (7b0af4e22b32f8c5bfba5a5d53522160) C:\WINDOWS\System32\Drivers\SYMTDI.SYS
20:21:01.0843 1756 SYMTDI - ok
20:21:01.0859 1756 sym_hi - ok
20:21:01.0859 1756 sym_u3 - ok
20:21:01.0906 1756 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
20:21:02.0140 1756 sysaudio - ok
20:21:02.0218 1756 SysmonLog (ce06f01b88ace199a1bf460cac29c110) C:\WINDOWS\system32\smlogsvc.exe
20:21:02.0453 1756 SysmonLog - ok
20:21:02.0515 1756 SysPlant (5383efa1351463f2f036a3e1b5f87d0c) C:\WINDOWS\SYSTEM32\Drivers\SysPlant.sys
20:21:02.0562 1756 SysPlant - ok
20:21:02.0671 1756 TapiSrv (c2546cd7a398476f9df5614b2ae160e8) C:\WINDOWS\System32\tapisrv.dll
20:21:02.0953 1756 TapiSrv - ok
20:21:03.0078 1756 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
20:21:03.0328 1756 Tcpip - ok
20:21:03.0359 1756 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
20:21:03.0562 1756 TDPIPE - ok
20:21:03.0593 1756 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
20:21:03.0796 1756 TDTCP - ok
20:21:03.0843 1756 Teefer2 (0dc098cc18a974e7c1e96e6846bd06e4) C:\WINDOWS\system32\DRIVERS\teefer2.sys
20:21:03.0890 1756 Teefer2 - ok
20:21:03.0921 1756 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
20:21:04.0140 1756 TermDD - ok
20:21:04.0359 1756 TermService (a75dd6fc3dbee4fff5ebc9f2c28bb66e) C:\WINDOWS\System32\termsrv.dll
20:21:04.0656 1756 TermService - ok
20:21:04.0734 1756 Themes (ee9a2b9ea968a792a053c9d1a86bf870) C:\WINDOWS\System32\shsvcs.dll
20:21:04.0765 1756 Themes - ok
20:21:04.0828 1756 TlntSvr (cd0cc7b167d78043a41c98d4921efb54) C:\WINDOWS\system32\tlntsvr.exe
20:21:05.0062 1756 TlntSvr - ok
20:21:05.0062 1756 TosIde - ok
20:21:05.0125 1756 TrkWks (38853304ccb938d30e0c4cde8d2c2a8a) C:\WINDOWS\system32\trkwks.dll
20:21:05.0375 1756 TrkWks - ok
20:21:05.0421 1756 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
20:21:05.0640 1756 Udfs - ok
20:21:05.0656 1756 ultra - ok
20:21:05.0812 1756 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
20:21:06.0234 1756 Update - ok
20:21:06.0328 1756 upnphost (651bd90dcee5b7bdc74a2eb7c9266f9e) C:\WINDOWS\System32\upnphost.dll
20:21:06.0593 1756 upnphost - ok
20:21:06.0625 1756 UPS (20a0f6a11959e92908717d09e87d670d) C:\WINDOWS\System32\ups.exe
20:21:06.0843 1756 UPS - ok
20:21:06.0890 1756 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
20:21:07.0109 1756 usbaudio - ok
20:21:07.0140 1756 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
20:21:07.0390 1756 usbccgp - ok
20:21:07.0437 1756 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
20:21:07.0656 1756 usbehci - ok
20:21:07.0703 1756 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
20:21:07.0921 1756 usbhub - ok
20:21:07.0968 1756 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
20:21:08.0187 1756 USBSTOR - ok
20:21:08.0234 1756 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
20:21:08.0437 1756 usbuhci - ok
20:21:08.0453 1756 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
20:21:08.0671 1756 VgaSave - ok
20:21:08.0671 1756 ViaIde - ok
20:21:08.0718 1756 VolSnap (28a4b296b47782173c346e376cb374d1) C:\WINDOWS\system32\drivers\VolSnap.sys
20:21:08.0937 1756 VolSnap - ok
20:21:09.0062 1756 VSS (d6ba1a63d9e00933f1cd2a885573afb2) C:\WINDOWS\System32\vssvc.exe
20:21:09.0359 1756 VSS - ok
20:21:09.0515 1756 W32Time (fa4e1cdba256787f2149f4aad07bc91f) C:\WINDOWS\system32\w32time.dll
20:21:09.0859 1756 W32Time - ok
20:21:09.0906 1756 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
20:21:10.0109 1756 Wanarp - ok
20:21:10.0125 1756 WDICA - ok
20:21:10.0203 1756 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
20:21:10.0453 1756 wdmaud - ok
20:21:10.0515 1756 WebClient (47ae51048a82dfa1cd6b51d369f7e169) C:\WINDOWS\System32\webclnt.dll
20:21:10.0859 1756 WebClient - ok
20:21:10.0984 1756 winmgmt (e488332126e3b1182d2b8a0c35408ec6) C:\WINDOWS\system32\wbem\WMIsvc.dll
20:21:11.0265 1756 winmgmt - ok
20:21:11.0343 1756 WmdmPmSN (c51b4a5c05a5475708e3c81c7765b71d) C:\WINDOWS\system32\MsPMSNSv.dll
20:21:11.0453 1756 WmdmPmSN - ok
20:21:11.0828 1756 Wmi (0171cff34bba8c5977f18c48d8aef8c6) C:\WINDOWS\System32\advapi32.dll
20:21:12.0218 1756 Wmi - ok
20:21:12.0296 1756 WmiApSrv (23f6f03272f7e5679f1f050aed5acee6) C:\WINDOWS\system32\wbem\wmiapsrv.exe
20:21:12.0562 1756 WmiApSrv - ok
20:21:13.0046 1756 WMPNetworkSvc (3739866d20abd42f26a7b85f9e2560af) C:\Program Files\Windows Media Player\WMPNetwk.exe
20:21:13.0656 1756 WMPNetworkSvc - ok
20:21:13.0781 1756 WPS (28d229ba1182591e43aca9d58f539dce) C:\WINDOWS\system32\drivers\wpsdrvnt.sys
20:21:13.0812 1756 WPS - ok
20:21:13.0890 1756 WpsHelper (ff983a25ae6f7d3f87f26bf51f02a201) C:\WINDOWS\system32\drivers\WpsHelper.sys
20:21:13.0968 1756 WpsHelper - ok
20:21:14.0015 1756 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
20:21:14.0250 1756 WS2IFSL - ok
20:21:14.0312 1756 wscsvc (4c86d5faf78194995af9cc1075f65dd3) C:\WINDOWS\system32\wscsvc.dll
20:21:14.0546 1756 wscsvc - ok
20:21:14.0562 1756 WSearch - ok
20:21:14.0625 1756 wuauserv (c1364564800ee9784192145324a23308) C:\WINDOWS\system32\wuauserv.dll
20:21:14.0843 1756 wuauserv - ok
20:21:14.0906 1756 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
20:21:14.0984 1756 WudfPf - ok
20:21:15.0031 1756 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
20:21:15.0093 1756 WudfRd - ok
20:21:15.0156 1756 WudfSvc (05231c04253c5bc30b26cbaae680ed89) C:\WINDOWS\System32\WUDFSvc.dll
20:21:15.0250 1756 WudfSvc - ok
20:21:15.0531 1756 WZCSVC (a27d4ba7264c0bf52f32d10405bea1d4) C:\WINDOWS\System32\wzcsvc.dll
20:21:15.0953 1756 WZCSVC - ok
20:21:16.0031 1756 xmlprov (eaa4bb9edb3fb10cf8979fe65e63658f) C:\WINDOWS\System32\xmlprov.dll
20:21:16.0296 1756 xmlprov - ok
20:21:16.0359 1756 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0
20:21:17.0218 1756 \Device\Harddisk0\DR0 - ok
20:21:17.0234 1756 MBR (0x1B8) (739b36f7a373fc81121d831231b6d311) \Device\Harddisk1\DR3
20:21:20.0484 1756 \Device\Harddisk1\DR3 - ok
20:21:20.0515 1756 Boot (0x1200) (54d0933f45220ffe4fdc8eac6baa9a11) \Device\Harddisk0\DR0\Partition0
20:21:20.0515 1756 \Device\Harddisk0\DR0\Partition0 - ok
20:21:20.0531 1756 Boot (0x1200) (cae5f6c8b0a06eac47d60060bef5f1ca) \Device\Harddisk1\DR3\Partition0
20:21:20.0531 1756 \Device\Harddisk1\DR3\Partition0 - ok
20:21:20.0546 1756 ============================================================
20:21:20.0546 1756 Scan finished
20:21:20.0546 1756 ============================================================
20:21:20.0687 1748 Detected object count: 3
20:21:20.0687 1748 Actual detected object count: 3
20:21:38.0375 1748 ALCXSENS ( UnsignedFile.Multi.Generic ) - skipped by user
20:21:38.0375 1748 ALCXSENS ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:21:38.0375 1748 ALCXWDM ( UnsignedFile.Multi.Generic ) - skipped by user
20:21:38.0375 1748 ALCXWDM ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:21:38.0375 1748 SoundMAX Agent Service (default) ( UnsignedFile.Multi.Generic ) - skipped by user
20:21:38.0375 1748 SoundMAX Agent Service (default) ( UnsignedFile.Multi.Generic ) - User select action: Skip

========= konec vypisu TDSSKiller.2.7.36.0_10.06.2012_20.19.11_log.txt ===============

=========== zacatek Extras.Txt ==========================

OTL Extras logfile created on: 10.6.2012 20:27:42 - Run 1
OTL by OldTimer - Version 3.2.48.0 Folder = C:\Documents and Settings\Administrator\Plocha
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000405 | Country: Česká republika | Language: CSY | Date Format: d.M.yyyy

478,73 Mb Total Physical Memory | 305,91 Mb Available Physical Memory | 63,90% Memory free
1,10 Gb Paging File | 1,02 Gb Available in Paging File | 93,54% Paging File free
Paging file location(s): C:\pagefile.sys 720 1440 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 28,17 Gb Total Space | 15,42 Gb Free Space | 54,73% Space Free | Partition Type: NTFS
Drive E: | 3,73 Gb Total Space | 0,76 Gb Free Space | 20,33% Space Free | Partition Type: FAT32

Computer Name: WX2400885 | User Name: Administrator | Logged in as Administrator.
Boot Mode: SafeMode | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe" = C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe:*:Enabled:SMC Service -- (Symantec Corporation)
"C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE" = C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE:*:Enabled:SNAC Service -- (Symantec Corporation)
"C:\Program Files\Common Files\Symantec Shared\ccApp.exe" = C:\Program Files\Common Files\Symantec Shared\ccApp.exe:*:Enabled:Symantec Email -- (Symantec Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{350C9405-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{546C143E-68DC-314D-97BC-1E454E3BA429}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - CSY
"{56C081B6-5FB8-407F-AB4C-41D243BCEE26}" = NIQES - testování
"{58BAA8D0-404E-4585-9FD3-ED1BB72AC2EE}" = Adobe Flash Player 9 ActiveX
"{5E65E94D-69F2-4850-9E93-6459C53A0F50}" = Microsoft .NET Framework 1.1 Czech Language Pack
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel(R) Extreme Graphics 2 Driver
"{90120000-0010-0405-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (Czech) 12
"{90120000-0015-0405-0000-0000000FF1CE}" = Microsoft Office Access MUI (Czech) 2007
"{90120000-0016-0405-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Czech) 2007
"{90120000-0018-0405-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Czech) 2007
"{90120000-0019-0405-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Czech) 2007
"{90120000-001A-0405-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Czech) 2007
"{90120000-001B-0405-0000-0000000FF1CE}" = Microsoft Office Word MUI (Czech) 2007
"{90120000-001F-0405-0000-0000000FF1CE}" = Microsoft Office Proof (Czech) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-041B-0000-0000000FF1CE}" = Microsoft Office Proof (Slovak) 2007
"{90120000-002C-0405-0000-0000000FF1CE}" = Microsoft Office Proofing (Czech) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0044-0405-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (Czech) 2007
"{90120000-006E-0405-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Czech) 2007
"{90120000-00A1-0405-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (Czech) 2007
"{90120000-00BA-0405-0000-0000000FF1CE}" = Microsoft Office Groove MUI (Czech) 2007
"{A2C9CD1B-2551-3AED-B244-6698FB929FA6}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - CSY
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C1B0BDC8-0624-4036-90D1-F7DF0EE8C96D}" = Symantec Endpoint Protection
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{DD73CA82-EA82-38AA-863D-9A24A018DC96}" = Microsoft .NET Framework 3.5 Language Pack SP1 - csy
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"ENTERPRISE" = Microsoft Office Enterprise 2007
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"LiveUpdate" = LiveUpdate 3.3 (Symantec Corporation)
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - csy" = Microsoft .NET Framework 3.5 SP1 – jazyková sada – CSY
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"PROSet" = Intel(R) PRO Network Adapters and Drivers
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 10.6.2012 14:20:10 | Computer Name = WX2400885 | Source = crypt32 | ID = 131080
Description = Načtení automatické aktualizace pořadového čísla kořenového seznamu
jiného výrobce z: <http://www.download.windowsupdate.com/m ... ootseq.txt>
se nezdařilo. Chyba: The server name or address could not be resolved

Error - 10.6.2012 14:20:10 | Computer Name = WX2400885 | Source = crypt32 | ID = 131080
Description = Načtení automatické aktualizace pořadového čísla kořenového seznamu
jiného výrobce z: <http://www.download.windowsupdate.com/m ... ootseq.txt>
se nezdařilo. Chyba: Takové síťové připojení neexistuje.

Error - 10.6.2012 14:20:31 | Computer Name = WX2400885 | Source = crypt32 | ID = 131080
Description = Načtení automatické aktualizace pořadového čísla kořenového seznamu
jiného výrobce z: <http://www.download.windowsupdate.com/m ... ootseq.txt>
se nezdařilo. Chyba: The server name or address could not be resolved

Error - 10.6.2012 14:20:32 | Computer Name = WX2400885 | Source = crypt32 | ID = 131080
Description = Načtení automatické aktualizace pořadového čísla kořenového seznamu
jiného výrobce z: <http://www.download.windowsupdate.com/m ... ootseq.txt>
se nezdařilo. Chyba: Takové síťové připojení neexistuje.

Error - 10.6.2012 14:20:56 | Computer Name = WX2400885 | Source = crypt32 | ID = 131080
Description = Načtení automatické aktualizace pořadového čísla kořenového seznamu
jiného výrobce z: <http://www.download.windowsupdate.com/m ... ootseq.txt>
se nezdařilo. Chyba: The server name or address could not be resolved

Error - 10.6.2012 14:20:57 | Computer Name = WX2400885 | Source = crypt32 | ID = 131080
Description = Načtení automatické aktualizace pořadového čísla kořenového seznamu
jiného výrobce z: <http://www.download.windowsupdate.com/m ... ootseq.txt>
se nezdařilo. Chyba: Takové síťové připojení neexistuje.

Error - 10.6.2012 14:20:57 | Computer Name = WX2400885 | Source = crypt32 | ID = 131080
Description = Načtení automatické aktualizace pořadového čísla kořenového seznamu
jiného výrobce z: <http://www.download.windowsupdate.com/m ... ootseq.txt>
se nezdařilo. Chyba: Takové síťové připojení neexistuje.

Error - 10.6.2012 14:20:57 | Computer Name = WX2400885 | Source = crypt32 | ID = 131080
Description = Načtení automatické aktualizace pořadového čísla kořenového seznamu
jiného výrobce z: <http://www.download.windowsupdate.com/m ... ootseq.txt>
se nezdařilo. Chyba: Takové síťové připojení neexistuje.

Error - 10.6.2012 14:21:01 | Computer Name = WX2400885 | Source = crypt32 | ID = 131080
Description = Načtení automatické aktualizace pořadového čísla kořenového seznamu
jiného výrobce z: <http://www.download.windowsupdate.com/m ... ootseq.txt>
se nezdařilo. Chyba: Takové síťové připojení neexistuje.

Error - 10.6.2012 14:21:01 | Computer Name = WX2400885 | Source = crypt32 | ID = 131080
Description = Načtení automatické aktualizace pořadového čísla kořenového seznamu
jiného výrobce z: <http://www.download.windowsupdate.com/m ... ootseq.txt>
se nezdařilo. Chyba: Takové síťové připojení neexistuje.

[ System Events ]
Error - 4.6.2012 4:32:12 | Computer Name = WX2400885 | Source = Service Control Manager | ID = 7000
Description = Služba Aplikace Symantec Management Client neuspěla při spuštění v
důsledku následující chyby: %%1053

Error - 4.6.2012 5:35:24 | Computer Name = WX2400885 | Source = Service Control Manager | ID = 7009
Description = Vypršel časový limit (30000 milisekund) čekání na připojení služby
Symantec Settings Manager.

Error - 4.6.2012 7:36:35 | Computer Name = WX2400885 | Source = Service Control Manager | ID = 7009
Description = Vypršel časový limit (30000 milisekund) čekání na připojení služby
Aplikace Symantec Management Client.

Error - 4.6.2012 7:36:35 | Computer Name = WX2400885 | Source = Service Control Manager | ID = 7000
Description = Služba Aplikace Symantec Management Client neuspěla při spuštění v
důsledku následující chyby: %%1053

Error - 4.6.2012 8:05:22 | Computer Name = WX2400885 | Source = NETLOGON | ID = 5719
Description = V doméně D24008 není k dispozici žádný řadič domény z důvodu: %%1722.

Přesvědčte
se, zda je počítač připojen k síti a akci opakujte. Pokud budou potíže trvat, obraťte
se na správce domény.

Error - 4.6.2012 8:05:22 | Computer Name = WX2400885 | Source = W32Time | ID = 39452701
Description = Klient NTP zprostředkovatele časových údajů je konfigurován pro získávání
časových údajů z jednoho nebo více zdrojů času. Žádný z těchto zdrojů však není
aktuálně k dispozici. Po dobu 14 minut nebude proveden žádný pokus o kontaktování
zdroje. Klient NTP nemá k dispozici žádný zdroj času.

Error - 4.6.2012 8:05:40 | Computer Name = WX2400885 | Source = W32Time | ID = 39452701
Description = Klient NTP zprostředkovatele časových údajů je konfigurován pro získávání
časových údajů z jednoho nebo více zdrojů času. Žádný z těchto zdrojů však není
aktuálně k dispozici. Po dobu 14 minut nebude proveden žádný pokus o kontaktování
zdroje. Klient NTP nemá k dispozici žádný zdroj času.

Error - 4.6.2012 8:10:32 | Computer Name = WX2400885 | Source = NETLOGON | ID = 5719
Description = V doméně D24008 není k dispozici žádný řadič domény z důvodu: %%1311.

Přesvědčte
se, zda je počítač připojen k síti a akci opakujte. Pokud budou potíže trvat, obraťte
se na správce domény.

Error - 5.6.2012 6:15:47 | Computer Name = WX2400885 | Source = Service Control Manager | ID = 7009
Description = Vypršel časový limit (30000 milisekund) čekání na připojení služby
Aplikace Symantec Management Client.

Error - 5.6.2012 6:15:47 | Computer Name = WX2400885 | Source = Service Control Manager | ID = 7000
Description = Služba Aplikace Symantec Management Client neuspěla při spuštění v
důsledku následující chyby: %%1053


< End of report >

=========== konec Extras.Txt ==========================



============= zacatek OTL.Txt =========================

OTL logfile created on: 10.6.2012 20:27:42 - Run 1
OTL by OldTimer - Version 3.2.48.0 Folder = C:\Documents and Settings\Administrator\Plocha
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000405 | Country: Česká republika | Language: CSY | Date Format: d.M.yyyy

478,73 Mb Total Physical Memory | 305,91 Mb Available Physical Memory | 63,90% Memory free
1,10 Gb Paging File | 1,02 Gb Available in Paging File | 93,54% Paging File free
Paging file location(s): C:\pagefile.sys 720 1440 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 28,17 Gb Total Space | 15,42 Gb Free Space | 54,73% Space Free | Partition Type: NTFS
Drive E: | 3,73 Gb Total Space | 0,76 Gb Free Space | 20,33% Space Free | Partition Type: FAT32

Computer Name: WX2400885 | User Name: Administrator | Logged in as Administrator.
Boot Mode: SafeMode | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012.06.10 20:04:24 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Plocha\OTL.exe
PRC - [2009.02.01 23:36:00 | 002,440,120 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
PRC - [2008.12.18 16:46:28 | 000,108,392 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
PRC - [2008.04.14 05:22:22 | 001,034,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe


========== Modules (No Company Name) ==========


========== Win32 Services (SafeList) ==========

SRV - [2009.02.26 15:07:00 | 001,799,496 | ---- | M] (Symantec Corporation) [Auto | Stopped] -- C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe -- (SmcService)
SRV - [2009.02.11 17:00:53 | 003,093,880 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_3.EXE -- (LiveUpdate)
SRV - [2009.02.01 23:36:00 | 002,440,120 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe -- (Symantec AntiVirus)
SRV - [2009.02.01 21:43:00 | 000,320,840 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE -- (SNAC)
SRV - [2008.12.18 16:46:28 | 000,108,392 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (ccSetMgr)
SRV - [2008.12.18 16:46:28 | 000,108,392 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (ccEvtMgr)
SRV - [2002.09.20 15:50:10 | 000,045,056 | ---- | M] (Analog Devices, Inc.) [Auto | Stopped] -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe -- (SoundMAX Agent Service (default))


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\activmouse.sys -- (prmvmouse)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] -- D:\INSTALL\GMSIPCI.SYS -- (GMSIPCI)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\activhidsermini.sys -- (ActivHidSerMini)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ACTIVhidmini.sys -- (ACTIVhidmini)
DRV - [2012.06.03 10:00:00 | 000,376,480 | ---- | M] (Symantec Corporation) [Kernel | System | Stopped] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2012.06.03 10:00:00 | 000,106,656 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2012.05.25 15:16:52 | 000,123,952 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SYMEVENT.SYS -- (SymEvent)
DRV - [2012.05.16 13:18:14 | 001,589,752 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20120604.002\NAVEX15.SYS -- (NAVEX15)
DRV - [2012.05.16 13:18:14 | 000,087,928 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20120604.002\NAVENG.SYS -- (NAVENG)
DRV - [2010.09.10 22:32:20 | 000,167,936 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WpsHelper.sys -- (WpsHelper)
DRV - [2009.02.26 15:10:00 | 000,091,976 | ---- | M] (Symantec Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\SysPlant.sys -- (SysPlant)
DRV - [2009.02.26 15:08:00 | 000,042,312 | ---- | M] (Symantec Corporation) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\WPSDRVnt.sys -- (WPS)
DRV - [2008.12.19 15:08:12 | 000,319,792 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\srtspl.sys -- (SRTSPL)
DRV - [2008.12.19 15:08:12 | 000,280,112 | ---- | M] (Symantec Corporation) [File_System | System | Stopped] -- C:\WINDOWS\system32\drivers\srtsp.sys -- (SRTSP)
DRV - [2008.12.19 15:08:12 | 000,043,824 | ---- | M] (Symantec Corporation) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\srtspx.sys -- (SRTSPX)
DRV - [2008.11.18 18:17:08 | 000,023,888 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\COH_Mon.sys -- (COH_Mon)
DRV - [2008.10.14 11:24:00 | 000,049,536 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Teefer2.sys -- (Teefer2)
DRV - [2008.09.09 14:54:42 | 000,421,424 | ---- | M] (Symantec Corporation) [Kernel | System | Stopped] -- C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys -- (SPBBCDrv)
DRV - [2008.08.21 11:13:56 | 000,191,536 | ---- | M] (Symantec Corporation) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\symtdi.sys -- (SYMTDI)
DRV - [2008.08.21 11:13:56 | 000,027,696 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\symredrv.sys -- (SYMREDRV)
DRV - [2004.01.10 09:17:02 | 000,601,100 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)
DRV - [2003.12.12 09:54:14 | 000,391,424 | R--- | M] (Sensaura Ltd) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ALCXSENS.SYS -- (ALCXSENS)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={ ... rer:source?}


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


IE - HKU\S-1-5-21-1957994488-1078081533-682003330-500\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-1957994488-1078081533-682003330-500\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={ ... rer:source?}
IE - HKU\S-1-5-21-1957994488-1078081533-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)



O1 HOSTS File: ([2001.10.25 16:00:00 | 000,000,737 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O4 - HKLM..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found
O4 - HKLM..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1957994488-1078081533-682003330-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 File not found
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/windows ... 0285862049 (WUWebControl Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.96.33.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = d24008.idva.cz
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7291CFAB-5604-48FD-AC32-3DE4C3E9A2CC}: DhcpNameServer = 10.96.33.254
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - (igfxsrvc.dll) - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop Components:0 (Aktuální domovská stránka) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Nebe.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Nebe.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2002.05.16 05:14:00 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: MIDI2 - C:\WINDOWS\System32\Syncor11.dll (SoundMAX)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.tscc - C:\WINDOWS\System32\tsccvid.dll (TechSmith Corporation)
PhysicalDisk0 MBR saved to C:\PhysicalMBR.bin

========== Files/Folders - Created Within 30 Days ==========

[2012.06.10 20:10:01 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2012.06.10 20:10:01 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2012.06.10 20:10:01 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2012.06.10 20:10:01 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2012.06.10 20:09:51 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2012.06.10 20:09:50 | 000,000,000 | --SD | C] -- C:\ComboFix
[2012.06.10 20:09:44 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012.06.10 20:09:38 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\Nabídka Start\Programy\Nástroje pro správu
[2012.06.10 20:09:38 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\Dokumenty\Filmy
[2012.06.10 20:09:12 | 004,537,562 | R--- | C] (Swearware) -- C:\Documents and Settings\Administrator\Plocha\ComboFix.exe
[2012.06.10 20:09:12 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Plocha\OTL.exe
[2012.06.10 20:09:12 | 000,147,456 | ---- | C] (Eric_71) -- C:\Documents and Settings\Administrator\Plocha\MbrScan.exe
[2012.06.10 20:09:11 | 002,127,960 | ---- | C] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Administrator\Plocha\tdsskiller.exe
[2012.06.05 16:44:25 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Administrator\IETldCache
[2012.05.30 09:01:51 | 000,000,000 | ---D | C] -- C:\WINDOWS\Minidump
[2012.05.25 15:18:07 | 000,091,976 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\SysPlant.sys
[2012.05.25 15:16:08 | 000,123,952 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\SYMEVENT.SYS
[2012.05.25 15:16:08 | 000,060,800 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\S32EVNT1.DLL
[2012.05.25 15:09:02 | 000,511,328 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\capicom.dll
[2012.05.25 15:09:00 | 001,060,864 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MFC71.DLL
[2012.05.25 15:08:23 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Symantec Shared
[2012.05.25 15:08:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Nabídka Start\Programy\Symantec Endpoint Protection
[2012.05.25 15:08:23 | 000,000,000 | ---D | C] -- C:\Program Files\Symantec
[2012.05.25 15:08:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Data aplikací\Symantec
[2012.05.15 18:04:09 | 000,003,744 | ---- | C] (Analog Devices, Inc.) -- C:\WINDOWS\System32\drivers\smsens.sys
[2012.05.15 18:04:08 | 000,030,208 | ---- | C] (Analog Devices Inc.) -- C:\WINDOWS\System32\wdmioctl.dll
[2012.05.15 18:04:07 | 001,285,632 | ---- | C] (Analog Devices) -- C:\WINDOWS\System32\SMMedia.dll
[2012.05.15 18:04:05 | 000,974,848 | ---- | C] (Analog Devices, Inc.) -- C:\WINDOWS\SynthCoreA.Dll
[2012.05.15 18:04:05 | 000,380,928 | ---- | C] (Analog Devices, Inc.) -- C:\WINDOWS\SynCor.exe
[2012.05.15 18:04:04 | 000,049,152 | ---- | C] (SoundMAX) -- C:\WINDOWS\System32\S11thk32.dll
[2012.05.15 18:04:04 | 000,045,056 | ---- | C] (Analog Devices, Inc.) -- C:\WINDOWS\System32\SynthCore11Resources.dll
[2012.05.15 18:04:04 | 000,040,820 | ---- | C] (SoundMAX) -- C:\WINDOWS\System32\Syncor11.dll
[2012.05.15 18:04:04 | 000,000,000 | ---D | C] -- C:\WINDOWS\VirtualEar
[2012.05.15 18:04:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Nabídka Start\Programy\SoundMAX
[2012.05.15 18:04:03 | 000,991,232 | ---- | C] (Sensaura) -- C:\WINDOWS\System32\virtear.dll
[2012.05.15 18:04:03 | 000,045,056 | ---- | C] (adi) -- C:\WINDOWS\System32\CleanUp.exe
[2012.05.15 18:04:03 | 000,036,864 | ---- | C] (Analog Devices Inc.) -- C:\WINDOWS\System32\DSndUp.exe
[2012.05.15 18:04:03 | 000,000,000 | -H-D | C] -- C:\Program Files\InstallShield Installation Information
[2012.05.15 18:04:03 | 000,000,000 | ---D | C] -- C:\Program Files\Analog Devices
[2012.05.15 18:03:47 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\InstallShield
[53 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012.06.10 20:28:42 | 000,000,512 | ---- | M] () -- C:\PhysicalMBR.bin
[2012.06.10 20:17:13 | 000,000,512 | ---- | M] () -- C:\Documents and Settings\Administrator\Plocha\Dump_Hdd1_DR3.mbr
[2012.06.10 20:17:13 | 000,000,512 | ---- | M] () -- C:\Documents and Settings\Administrator\Plocha\Dump_Hdd0_DR0.mbr
[2012.06.10 20:14:14 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.06.10 20:13:34 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.06.10 20:04:24 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Plocha\OTL.exe
[2012.06.06 12:26:38 | 002,127,960 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Administrator\Plocha\tdsskiller.exe
[2012.06.06 12:26:28 | 000,147,456 | ---- | M] (Eric_71) -- C:\Documents and Settings\Administrator\Plocha\MbrScan.exe
[2012.06.06 12:03:54 | 004,537,562 | R--- | M] (Swearware) -- C:\Documents and Settings\Administrator\Plocha\ComboFix.exe
[2012.06.05 16:36:25 | 000,000,468 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{F1D90474-D39C-424F-93A1-B5B5787F4903}.job
[2012.06.05 16:30:00 | 000,000,438 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{F31FBF20-9D03-4D41-AE11-8318B672782C}.job
[2012.06.05 16:30:00 | 000,000,438 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{595F31AD-859B-48E1-B9A6-DDC9DD460033}.job
[2012.06.05 12:03:00 | 000,000,996 | ---- | M] () -- C:\WINDOWS\tasks\RockMeltUpdateTaskUserS-1-5-21-2232089752-3415930558-630994948-2360UA.job
[2012.06.05 09:03:00 | 000,000,944 | ---- | M] () -- C:\WINDOWS\tasks\RockMeltUpdateTaskUserS-1-5-21-2232089752-3415930558-630994948-2360Core.job
[2012.05.31 15:22:06 | 000,602,112 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\crypt32.dll
[2012.05.30 05:36:15 | 000,002,994 | RHS- | M] () -- C:\Documents and Settings\All Users\ntuser.pol
[2012.05.25 15:16:52 | 000,123,952 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\SYMEVENT.SYS
[2012.05.25 15:16:52 | 000,060,800 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\System32\S32EVNT1.DLL
[2012.05.25 15:16:52 | 000,010,563 | ---- | M] () -- C:\WINDOWS\System32\drivers\SYMEVENT.CAT
[2012.05.25 15:16:52 | 000,000,805 | ---- | M] () -- C:\WINDOWS\System32\drivers\SYMEVENT.INF
[2012.05.25 14:45:26 | 000,002,201 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\NIQES - testování.lnk
[2012.05.15 18:04:02 | 000,000,044 | ---- | M] () -- C:\WINDOWS\System32\msssc.dll
[53 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012.06.10 20:28:42 | 000,000,512 | ---- | C] () -- C:\PhysicalMBR.bin
[2012.06.10 20:17:05 | 000,000,512 | ---- | C] () -- C:\Documents and Settings\Administrator\Plocha\Dump_Hdd1_DR3.mbr
[2012.06.10 20:17:04 | 000,000,512 | ---- | C] () -- C:\Documents and Settings\Administrator\Plocha\Dump_Hdd0_DR0.mbr
[2012.06.10 20:10:01 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2012.06.10 20:10:01 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2012.06.10 20:10:01 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2012.06.10 20:10:01 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2012.06.10 20:10:01 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2012.05.25 15:16:08 | 000,010,563 | ---- | C] () -- C:\WINDOWS\System32\drivers\SYMEVENT.CAT
[2012.05.25 15:16:08 | 000,000,805 | ---- | C] () -- C:\WINDOWS\System32\drivers\SYMEVENT.INF
[2012.05.15 18:11:03 | 000,000,438 | -H-- | C] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{595F31AD-859B-48E1-B9A6-DDC9DD460033}.job
[2012.05.15 18:04:02 | 000,000,044 | ---- | C] () -- C:\WINDOWS\System32\msssc.dll
[2012.02.20 08:59:09 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll

========== LOP Check ==========

[2010.07.01 12:32:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\admin1\Data aplikací\ACTIV Software
[2009.03.31 13:12:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\admin1\Data aplikací\AVG7
[2009.05.28 13:34:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\admin1\Data aplikací\AVGTOOLBAR
[2009.11.26 12:57:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\admin1\Data aplikací\CSAS
[2010.11.29 12:48:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\admin1\Data aplikací\ESRI
[2011.04.14 12:47:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\admin1\Data aplikací\Gordic
[2008.11.06 12:49:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\admin1\Data aplikací\ICQ Toolbar
[2009.11.11 16:49:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\admin1\Data aplikací\Nokia
[2012.05.16 08:56:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\admin1\Data aplikací\Oracle
[2009.11.11 16:49:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\admin1\Data aplikací\PC Suite
[2010.10.25 23:01:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\admin1\Data aplikací\pdfforge
[2010.03.09 12:38:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\admin1\Data aplikací\Promethean
[2012.05.09 09:08:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\admin1\Data aplikací\Search Settings
[2012.05.21 16:03:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\admin1\Data aplikací\Windows Desktop Search
[2010.04.20 12:53:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\admin1\Data aplikací\Windows Search
[2011.01.24 16:33:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\admin1\Data aplikací\Zoner
[2012.05.10 09:43:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\admin2\Data aplikací\ACTIV Software
[2009.02.02 15:53:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\admin2\Data aplikací\AVG7
[2012.05.10 09:46:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\admin2\Data aplikací\Promethean
[2012.05.21 16:02:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\admin2\Data aplikací\Windows Desktop Search
[2012.05.25 14:59:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\Activ Software
[2011.01.31 17:43:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\Promethean
[2010.11.15 09:08:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\charpe\Data aplikací\Windows Desktop Search
[2012.02.20 08:57:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\fuksvo\Data aplikací\ACTIV Software
[2012.02.20 09:44:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\fuksvo\Data aplikací\Promethean
[2010.02.24 13:53:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\fuksvo\Data aplikací\Windows Desktop Search
[2010.04.29 10:10:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\fuksvo\Data aplikací\Windows Search
[2012.02.21 14:44:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\grmezu\Data aplikací\ACTIV Software
[2012.02.21 16:17:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\grmezu\Data aplikací\Promethean
[2010.02.23 09:21:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\grmezu\Data aplikací\Windows Desktop Search
[2012.02.29 09:51:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\jirkve\Data aplikací\ACTIV Software
[2012.02.29 10:38:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\jirkve\Data aplikací\Promethean
[2010.11.30 13:09:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\jirkve\Data aplikací\Windows Desktop Search
[2012.02.28 11:04:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\kudrmi\Data aplikací\ACTIV Software
[2011.12.05 13:58:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\kudrmi\Data aplikací\avidemux
[2012.02.28 11:44:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\kudrmi\Data aplikací\Promethean
[2011.05.19 13:20:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\kudrmi\Data aplikací\Windows Desktop Search
[2011.09.05 12:31:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\kudrmi\Data aplikací\Windows Search
[2012.01.06 10:23:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\martto\Data aplikací\Windows Desktop Search
[2012.02.24 10:34:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\martto\Data aplikací\Windows Search
[2012.03.13 11:15:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mathsa\Data aplikací\ACTIV Software
[2012.03.13 11:44:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mathsa\Data aplikací\Promethean
[2011.09.20 10:14:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mathsa\Data aplikací\Windows Desktop Search
[2010.02.26 12:52:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\panson\Data aplikací\Windows Desktop Search
[2011.01.05 12:18:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\panson\Data aplikací\Windows Search
[2012.04.10 11:57:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\pantad\Data aplikací\Windows Desktop Search
[2012.04.20 07:59:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\rezaja\Data aplikací\ACTIV Software
[2012.04.20 08:41:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\rezaja\Data aplikací\Promethean
[2010.10.11 13:07:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\rezaja\Data aplikací\Windows Desktop Search
[2012.04.10 11:58:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skucel\Data aplikací\Windows Desktop Search
[2012.02.22 12:53:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\steflu\Data aplikací\ACTIV Software
[2012.02.22 13:33:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\steflu\Data aplikací\Promethean
[2010.10.11 13:15:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\steflu\Data aplikací\Windows Desktop Search
[2012.05.23 12:43:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\steflu\Data aplikací\Windows Search
[2012.06.05 09:03:00 | 000,000,944 | ---- | M] () -- C:\WINDOWS\Tasks\RockMeltUpdateTaskUserS-1-5-21-2232089752-3415930558-630994948-2360Core.job
[2012.06.05 12:03:00 | 000,000,996 | ---- | M] () -- C:\WINDOWS\Tasks\RockMeltUpdateTaskUserS-1-5-21-2232089752-3415930558-630994948-2360UA.job
[2012.06.05 16:30:00 | 000,000,438 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{595F31AD-859B-48E1-B9A6-DDC9DD460033}.job
[2012.06.05 16:36:25 | 000,000,468 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{F1D90474-D39C-424F-93A1-B5B5787F4903}.job
[2012.06.05 16:30:00 | 000,000,438 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{F31FBF20-9D03-4D41-AE11-8318B672782C}.job

========== Purity Check ==========



========== Custom Scans ==========

< HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s >
"CTFMON.EXE" = C:\WINDOWS\system32\ctfmon.exe -- [2008.04.14 05:22:17 | 000,015,360 | ---- | M] (Microsoft Corporation)

< %systemroot%\system32\drivers\*.sys /5 >

< %systemroot%\system32\drivers\*.sys /X >
[2008.04.14 05:21:36 | 000,004,255 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\adv01nt5.dll
[2008.04.14 05:21:36 | 000,003,967 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\adv02nt5.dll
[2008.04.14 05:21:36 | 000,003,615 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\adv05nt5.dll
[2008.04.14 05:21:36 | 000,003,647 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\adv07nt5.dll
[2008.04.14 05:21:36 | 000,003,135 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\adv08nt5.dll
[2008.04.14 05:21:36 | 000,003,711 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\adv09nt5.dll
[2008.04.14 05:21:36 | 000,003,775 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\adv11nt5.dll
[2004.07.17 12:36:24 | 000,064,352 | ---- | M] () -- C:\WINDOWS\system32\drivers\ativmc20.cod
[2008.04.14 05:21:37 | 000,021,183 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\atv01nt5.dll
[2008.04.14 05:21:37 | 000,011,359 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\atv02nt5.dll
[2008.04.14 05:21:37 | 000,025,471 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\atv04nt5.dll
[2008.04.14 05:21:37 | 000,014,143 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\atv06nt5.dll
[2008.04.14 05:21:37 | 000,017,279 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\atv10nt5.dll
[2008.04.14 05:21:38 | 000,015,423 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\ch7xxnt5.dll
[2008.11.18 18:01:38 | 000,010,537 | ---- | M] () -- C:\WINDOWS\system32\drivers\coh_mon.cat
[2008.11.18 18:01:38 | 000,000,706 | ---- | M] () -- C:\WINDOWS\system32\drivers\COH_Mon.inf
[2004.07.17 23:55:24 | 000,129,045 | ---- | M] () -- C:\WINDOWS\system32\drivers\cxthsfs2.cty
[2001.10.25 16:00:00 | 003,440,660 | ---- | M] () -- C:\WINDOWS\system32\drivers\gm.dls
[2001.10.25 16:00:00 | 000,000,646 | ---- | M] () -- C:\WINDOWS\system32\drivers\gmreadme.txt
[2004.07.17 12:35:00 | 000,067,866 | ---- | M] () -- C:\WINDOWS\system32\drivers\netwlan5.img
[2008.04.14 05:21:55 | 000,003,901 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\siint5.dll
[2008.12.19 15:09:02 | 000,008,386 | ---- | M] () -- C:\WINDOWS\system32\drivers\srtsp.cat
[2008.12.19 15:09:02 | 000,001,415 | ---- | M] () -- C:\WINDOWS\system32\drivers\srtsp.inf
[2008.12.19 15:09:02 | 000,008,390 | ---- | M] () -- C:\WINDOWS\system32\drivers\srtspl.cat
[2008.12.19 15:09:02 | 000,001,430 | ---- | M] () -- C:\WINDOWS\system32\drivers\srtspl.inf
[2008.12.19 15:09:02 | 000,008,390 | ---- | M] () -- C:\WINDOWS\system32\drivers\srtspx.cat
[2008.12.19 15:09:02 | 000,001,421 | ---- | M] () -- C:\WINDOWS\system32\drivers\srtspx.inf
[2012.05.25 15:16:52 | 000,010,563 | ---- | M] () -- C:\WINDOWS\system32\drivers\SYMEVENT.CAT
[2012.05.25 15:16:52 | 000,000,805 | ---- | M] () -- C:\WINDOWS\system32\drivers\SYMEVENT.INF
[2008.08.21 11:14:08 | 000,013,035 | ---- | M] () -- C:\WINDOWS\system32\drivers\SymRedir.cat
[2008.08.21 11:14:08 | 000,001,358 | ---- | M] () -- C:\WINDOWS\system32\drivers\SymRedir.inf
[2008.04.14 05:22:04 | 000,011,325 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\vchnt5.dll

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\system32\*.* /5 >
[2012.06.10 20:14:14 | 000,002,206 | ---- | M] () -- C:\WINDOWS\system32\wpa.dbl
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\system32\*.dll /lockedfiles >
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %ALLUSERSPROFILE%\Dáta aplikácií\*.* >

< %ALLUSERSPROFILE%\Dáta aplikácií\*.exe /s >

< %APPDATA%\*. >
[2002.05.16 05:18:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\Identities
[2012.06.10 20:15:34 | 000,000,000 | --SD | M] -- C:\Documents and Settings\Administrator\Data aplikací\Microsoft

< %APPDATA%\*.* >
[2002.05.16 06:46:56 | 000,000,062 | -HS- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\desktop.ini

< %APPDATA%\*.exe /s >

< %SYSTEMDRIVE%\*.exe >
[2009.12.08 15:32:03 | 017,013,088 | ---- | M] (Microsoft Corporation) -- C:\IE8-WindowsXP-x86-CSY.exe

< End of report >


============= kionec OTL.Txt =========================

Halooo, prosim o pomoc.
Nerikejte, ze tohle moje tema uz zapadlo do propadliste dejin

Dekuju
PŘ

Ano, kolega na teba zabudol,,,
No problem je v tom, ze napises nieco a stratis sa.

Logy z tohto pocitaca som prestudoval, ale okrem nejakych podrobnosti,,,Temp,,ja tam nevidim nic.
Preto doporucujem postihnute pocitace pre instalovat a

obnovil bych profily vsem uzivatelum a smazal vsechny profily lokalne ulozene na stanicich.

A potom uvidis.

Mno myslel jsem si, že to tak dopadne. holt se bude reinstalovat. A pak se budu bat, kdy se to objevi znova.

Vazne myslite, ze existuje malware, ktery se proste neda najit? Existujou nejaky rady, jak se ncemu takovemu branit, mimo samozrejmeho patchovani OS, antiviru, antispamu, firewallu samozrejme vcetne aktualizovani?

Byl to na skole vzhledem k testovani celkem prusvih, tak premyslim, co udelat lip, aby se neco takove uz neopakovalo. Diky za kazdej napad

PŘ

kedze som 17 rokov robil v skolstve viem, co znamena pojem "pocitacova ucebna"
1. najlepsie by bolo prist veci na koren - kedze sa blizia prazdniny doporucujem si jeden restartujuci PC alebo aspon disk odlozit na skumanie, hladanie, pitvanie
2. u mna vzdy na prvom mieste bola funkcnost t.j. mat poruke image, z ktoreho mozes do hodiny-dvoch zfunkcnit ucebnu - na skumanie sa cas najde neskor ,,,
3. stale narabas s myslienkou zavirenia ucebne ,,, no vsetko moze byt inac staci "mily" script z internetu, zmazanie nejakeho nie dostatocne chraneneho systemoveho suboru, nahranie podivneho ovladaca >> to vsetko moze viest k restartom
4. dobre je mat "nudzove" konto s obmedzenim bez prihlasovania sa do domeny

odomna vsetko

Jojo, díky za povzbudivá slova, učebnám ve školství zdar .
Image samozřejmě mám, nejspíš si je po téhle zkušenosti udělám i lokálně do nějaké skryte partition s obnovou ze spouštěcího CD.

Ještě mě napadlo, zda byste někdo byl tak hodný a omrknul log z jednoho z těch cca 5 počítačů, které z nějakého zázračného důvodu přežily zdá se bez úhony. Sice asi při reinstalaci učebny dojde i k jejich přeinstalování z čistě preventivních důvodů, nicmén mám pocit, jako by byli vel,mi zpomalené, proti stavu před tím, než se projevily problémy. Třeba by to mohlo pomoct objevit, co a kde se v učebně může dít. Pokud se někdo takový najde, dejte pls pokyny co a jaké logy by byly potřeba. Dělal jsem tolik pokusů se všema možnejma programama, že už fakt nevím. Případně mám jet podle nějakého návodu tady na fóru.

Děkuju už dopředu za případné zkontrolování, ale hlavně
DĚKUJU ZA VŠECHEN ČAS A PRÁCI STRÁVENOU NA MÝM PROBLÉMEM.

Vší počítačové havěti ZMAR
PŘ

JaRon píše:kedze som 17 rokov robil v skolstve viem, co znamena pojem "pocitacova ucebna"

LOL ja som mal na starosti ucebne v dvoch CVC v BB
Masaker

Vazne myslite, ze existuje malware, ktery se proste neda najit?

Bohuzial uz existuju,Duqu, Stuxnet,Vírus Flame, Sila vírusu je taká, že vedúci spoločnosti Kaspersky Lab Jevgenij Kaspersky upozornil na blížiacu sa kyberepidémiu.Posledný objav Kaspersky Lab je ďalším druhom hromadnej bojovej efektívnej kybernetickej zbrane.