VIRY.CZ

Kód: Vybrat vše

<pre>
c:\program files\AVG\AVG8\avgtray .exe
c:\program files\Common Files\Ahead\Lib\nerocheck .exe
c:\program files\Common Files\Ahead\Lib\nmbgmonitor .exe
c:\program files\Common Files\Sonic\Update Manager\sgtray .exe
c:\program files\ESET\ESET Smart Security\egui .exe
c:\program files\Skype\Phone\skype .exe
c:\program files\Synaptics\SynTP\syntpenh .exe
c:\program files\Synaptics\SynTP\syntplpr .exe
c:\windows\system32\dla\tfswctrl .exe
</pre>

Kód: Vybrat vše

Windows XP SP 3 (build 2600)
Boot Mode: Normal
Ověření souborů Microsoftu: Ano
Whitelist: Ano
Internet Explorer v6.00.2900.5512 (xpsp.080413-2105)
Log vygenerován: 16.4.2010 20:39:49
================================================================

SmallARK
================================================================
[?]NtAssignProcessToJobObject       -> 
[?]NtDebugActiveProcess             -> 
[?]NtDuplicateObject                -> 
[?]NtOpenProcess                    -> 
[?]NtOpenThread                     -> 
[?]NtProtectVirtualMemory           -> 
[?]NtSetContextThread               -> 
[?]NtSetInformationThread           -> 
[?]NtSetSecurityObject              -> 
[?]NtSuspendProcess                 -> 
[?]NtSuspendThread                  -> 
[?]NtTerminateProcess               -> 
[?]NtTerminateThread                -> 
[?]NtWriteVirtualMemory             -> 



Běžící procesy
================================================================

C:\PROGRAM FILES\ESET\ESET NOD32 ANTIVIRUS\EKRN.EXE
 |_ MD5: 8791F03854611DEAC8D2967C1C958A7E
 |_Výrobce:  ESET

C:\WINDOWS\SYSTEM32\NVSVC32.EXE
 |_ MD5: 75DDC4B2709837876286A902C1BB34B4
 |_Výrobce:  NVIDIA Corporation

C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPENH.EXE
 |_ MD5: 634DC62870B9E0C6C6AE25A75AC9895A
 |_Výrobce:  Synaptics, Inc.

C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPLPR.EXE
 |_ MD5: B437E814DC6AA842C482F64D9D2AFA1C
 |_Výrobce:  Synaptics, Inc.

C:\PROGRAM FILES\ESET\ESET NOD32 ANTIVIRUS\EGUI.EXE
 |_ MD5: 9B0E0ED9171AF258ED60CD957EECA344
 |_Výrobce:  ESET

C:\PROGRAM FILES\SKYPE\PHONE\SKYPE.EXE
 |_ MD5: 5462433623FE02C774C8B9A3C4707432
 |_Výrobce:  Skype Technologies S.A.

C:\PROGRAM FILES\MICROSTAR\WLANUTILITY\WLANUTILITY.EXE
 |_ MD5: 00170BF8FABD2FBAAA4C0C2B173DB4FF
 |_Výrobce:  

C:\PROGRAM FILES\MICROSTAR\WLANUTILITY\WLAN_SERVICE.EXE
 |_ MD5: 424161D5266DF2A83CFC0CD7F4FFF520
 |_Výrobce:  


Scanner
================================================================
[?] ekrn.exe                                          
Soubor                        7%
                        
[?] nvsvc32.exe                                       
Non Microsoft v System32:                             
                        
[?] SynTPEnh.exe                                      
Spouští se po startu          HKLM Run [SynTPEnh]
                        
[S] ctfmon.exe                                        
Spouští se po startu          HKU Run [CTFMON.EXE]
                        
[?] SynTPLpr.exe                                      
Spouští se po startu          HKLM Run [SynTPLpr]
                        
[?] egui.exe                                          
Spouští se po startu          HKLM Run [egui]
Soubor                        7%
                        
[?] Skype.exe                                         
Spouští se po startu          HKCU Run [Skype]
EntryPoint v sekci:           CODE
|_ Celkový počet sekcí:       8
Soubor                        70%
                        
[?] WlanUtility.exe                                   
Spouští se po startu          Po spuštění []
EntryPoint v sekci:           UPX1
|_ Celkový počet sekcí:       3
Soubor                        63%
                        
[?] WLAN_Service.exe                                  
EntryPoint v sekci:           UPX1
|_ Celkový počet sekcí:       3
Nemá okno                                             
Soubor                        63%
                        
[S] wmiprvse.exe                                      
Proces se nepodařilo otevřít                          
ROOTKIT?                      Skrytá cesta
Spouští se po startu          HKCU Run [userini]
Nelze otevřít                                         
                        
[S] explorer.exe                                      
Spouští se po startu          HKCU Run [userini]
                        

Po spuštění
================================================================

HKCU Run
 |_ [X][Sonic RecordNow!]  (Soubor nenalezen)
 |_ [S][userini]                     C:\WINDOWS\explorer.exe :userini.exe
 |  |_ MD5: 12896823FB95BFB3DC9B46BCAEDC9923
 |  |_ Výrobce:  Microsoft Corporation
 |
 |_ [!][Skype]                       C:\Program Files\Skype\Phone\Skype.exe /nosplash /minimized
    |_ MD5: 5462433623FE02C774C8B9A3C4707432
    |_ Výrobce:  Skype Technologies S.A.


HKLM Run
 |_ [?][SynTPEnh]                    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
 |  |_ MD5: 634DC62870B9E0C6C6AE25A75AC9895A
 |  |_ Výrobce:  Synaptics, Inc.
 |
 |_ [?][NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll ,NvStartup
 |  |_ MD5: 7C7D7509B5694A2C9D3ABA1E347F11B5
 |  |_ Výrobce:  NVIDIA Corporation
 |
 |_ [S][userini]                     C:\WINDOWS\explorer.exe :userini.exe
 |  |_ MD5: 12896823FB95BFB3DC9B46BCAEDC9923
 |  |_ Výrobce:  Microsoft Corporation
 |
 |_ [?][SynTPLpr]                    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
 |  |_ MD5: B437E814DC6AA842C482F64D9D2AFA1C
 |  |_ Výrobce:  Synaptics, Inc.
 |
 |_ [?][egui]                        C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe /hide /waitservice
 |  |_ MD5: 9B0E0ED9171AF258ED60CD957EECA344
 |  |_ Výrobce:  ESET
 |
 |_ [X][Adobe_Reader] c:\program files\internet explorer\wmpscfgs.exe (Soubor nenalezen)

HKLM Explorer\Run
 |_ [S][userini]                     C:\WINDOWS\explorer.exe :userini.exe
    |_ MD5: 12896823FB95BFB3DC9B46BCAEDC9923
    |_ Výrobce:  Microsoft Corporation


HKLM IC
 |_ [X][>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP (Soubor nenalezen)
 |_ [?][{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] C:\WINDOWS\INF\msnetmtg.inf ,NetMtg.Install.PerUser.NT
 |  |_ MD5: ED4041A9EE05C427D25A59D82BC3712E
 |  |_ Výrobce:  
 |
 |_ [?][{5945c046-1e7d-11d1-bc44-00c04fd912be}] C:\WINDOWS\INF\msmsgs.inf ,BLC.QuietInstall.PerUser
 |  |_ MD5: EF5175CE56D762931C468699B935B8ED
 |  |_ Výrobce:  
 |
 |_ [?][{6BF52A52-394A-11d3-B153-00C04F79FAA6}] C:\WINDOWS\INF\wmp.inf ,PerUserStub
 |  |_ MD5: 4821E93A91F7C3D9AA7E3332C0ED9B58
 |  |_ Výrobce:  
 |
 |_ [?][{89820200-ECBD-11cf-8B85-00AA005B4340}] regsvr32.exe /s /n /i:U shell32.dll
    |_ MD5: 
    |_ Výrobce:  Microsoft Corporation


Po spuštění
 |_ C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
 |  |_ MD5: 43362B96870CE8649F4F2EC893DA93F0
 |  |_ Výrobce:  Adobe Systems Incorporated
 |
 |_ C:\Program Files\MicroStar\WLANUtility\WlanUtility.exe
    |_ MD5: 00170BF8FABD2FBAAA4C0C2B173DB4FF
    |_ Výrobce:  



HKLM BHO
 |_ [?][{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
 |  |_ MD5: F17B2B264072B921FC66A0BE16626BAB
 |  |_ Výrobce:  Adobe Systems Incorporated
 |
 |_ [?][{5CA3D70E-1895-11CF-8E15-001234567890}] C:\WINDOWS\system32\dla\tfswshx.dll
    |_ MD5: 15F6F27916A2D2AF3ABF029F6CF3037B
    |_ Výrobce:  Sonic Solutions


HKCU IE WebBrowser Toolbar
 |_ [X][{EF99BD32-C1FB-11D2-892F-0090271D4F88}]  (Soubor nenalezen)

HKLM IE Toolbar
 |_ [X][{EF99BD32-C1FB-11D2-892F-0090271D4F88}]  (Soubor nenalezen)

Služby (Zobraz běžící: True, Zobraz zastavené: False, Zobraz i bezpečné služby: False)
================================================================
[?] ESET Service
 |_ Cesta: C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
 |   |_ Výrobce:  ESET
 |   |_ Popis: ESET Service
 |   |_ MD5: 8791F03854611DEAC8D2967C1C958A7E
 |   
 |_ Jméno:  ekrn
 |_ StartName: LocalSystem
 |_ Typ spouštění:  Auto Start
 |_ Status: Spuštěno
 |_ Typ:  
 |_ Dependency: 

[?] NVIDIA Driver Helper Service
 |_ Cesta: C:\WINDOWS\System32\nvsvc32.exe
 |   |_ Výrobce:  NVIDIA Corporation
 |   |_ Popis: NVIDIA Driver Helper Service, Version 44.85
 |   |_ MD5: 75DDC4B2709837876286A902C1BB34B4
 |   
 |_ Jméno:  NVSvc
 |_ StartName: LocalSystem
 |_ Typ spouštění:  Auto Start
 |_ Status: Spuštěno
 |_ Typ:  Win32 Own Process
 |_ Dependency: 


Ovladače (Zobraz běžící: True, Zobraz zastavené: False, Zobraz i bezpečné služby: False)
================================================================
[?] Broadcom 440x 10/100 Integrated Controller XP Driver
 |_ Cesta: C:\WINDOWS\System32\DRIVERS\bcm4sbxp.sys
 |   |_ Výrobce:  Broadcom Corporation
 |   |_ Popis: Broadcom Corporation NDIS 5.1 ethernet driver
 |   |_ MD5: 068523D2CD260069B19AD68ADEA0D739
 |   
 |_ Jméno:  bcm4sbxp
 |_ StartName: 
 |_ Typ spouštění:  Ruční spuštění
 |_ Status: Spuštěno
 |_ Typ:  Kernel Driver
 |_ Dependency: 

[?] drvmcdb
 |_ Cesta: C:\WINDOWS\system32\drivers\drvmcdb.sys
 |   |_ Výrobce:  Sonic Solutions
 |   |_ Popis: Device Driver
 |   |_ MD5: 7F056A52BCBA3102D2D37A4A2646C807
 |   
 |_ Jméno:  drvmcdb
 |_ StartName: 
 |_ Typ spouštění:  Boot Start
 |_ Status: Spuštěno
 |_ Typ:  Kernel Driver
 |_ Dependency: 

[?] drvnddm
 |_ Cesta: C:\WINDOWS\system32\drivers\drvnddm.sys
 |   |_ Výrobce:  Sonic Solutions
 |   |_ Popis: Device Driver Manager
 |   |_ MD5: D3C1E501ED42E77574B3095309DD4075
 |   
 |_ Jméno:  drvnddm
 |_ StartName: 
 |_ Typ spouštění:  Auto Start
 |_ Status: Spuštěno
 |_ Typ:  File System Driver
 |_ Dependency: 

[?] eamon
 |_ Cesta: C:\WINDOWS\system32\DRIVERS\eamon.sys
 |   |_ Výrobce:  ESET
 |   |_ Popis: Amon monitor
 |   |_ MD5: 3B2E8F97B6869C29DA023EE75BF585D5
 |   
 |_ Jméno:  eamon
 |_ StartName: 
 |_ Typ spouštění:  Auto Start
 |_ Status: Spuštěno
 |_ Typ:  File System Driver
 |_ Dependency: 

[?] ehdrv
 |_ Cesta: C:\WINDOWS\system32\DRIVERS\ehdrv.sys
 |   |_ Výrobce:  ESET
 |   |_ Popis: ESET Helper driver
 |   |_ MD5: 4FAD054CBCAA296BE7BD2CB77DA9D9B4
 |   
 |_ Jméno:  ehdrv
 |_ StartName: 
 |_ Typ spouštění:  System Start
 |_ Status: Spuštěno
 |_ Typ:  Kernel Driver
 |_ Dependency: 

[?] epfwtdir
 |_ Cesta: C:\WINDOWS\system32\DRIVERS\epfwtdir.sys
 |   |_ Výrobce:  ESET
 |   |_ Popis: ESET Antivirus Network Redirector
 |   |_ MD5: D2A915B725845C3EDA5A68ED2DA74700
 |   
 |_ Jméno:  epfwtdir
 |_ StartName: 
 |_ Typ spouštění:  System Start
 |_ Status: Spuštěno
 |_ Typ:  Kernel Driver
 |_ Dependency: 

[?] HSFHWICH
 |_ Cesta: C:\WINDOWS\System32\DRIVERS\HSFHWICH.sys
 |   |_ Výrobce:  Conexant Systems, Inc.
 |   |_ Popis: HSFHWICH WDM driver
 |   |_ MD5: DD33C6B441CA381F8FC82B06BE2E2CAC
 |   
 |_ Jméno:  HSFHWICH
 |_ StartName: 
 |_ Typ spouštění:  Ruční spuštění
 |_ Status: Spuštěno
 |_ Typ:  Kernel Driver
 |_ Dependency: 

[?] HSF_DP
 |_ Cesta: C:\WINDOWS\System32\DRIVERS\HSF_DP.sys
 |   |_ Výrobce:  Conexant Systems, Inc.
 |   |_ Popis: HSF_DP driver
 |   |_ MD5: 272914D8E356BBBFFBE7E88871A188EF
 |   
 |_ Jméno:  HSF_DP
 |_ StartName: 
 |_ Typ spouštění:  Ruční spuštění
 |_ Status: Spuštěno
 |_ Typ:  Kernel Driver
 |_ Dependency: 

[?] mdmxsdk
 |_ Cesta: C:\WINDOWS\System32\DRIVERS\mdmxsdk.sys
 |   |_ Výrobce:  Conexant
 |   |_ Popis: Diagnostic Interface DRIVER
 |   |_ MD5: EEAEA6514BA7C9D273B5E87C4E1AAB30
 |   
 |_ Jméno:  mdmxsdk
 |_ StartName: 
 |_ Typ spouštění:  Auto Start
 |_ Status: Spuštěno
 |_ Typ:  Kernel Driver
 |_ Dependency: 

[?] nv
 |_ Cesta: C:\WINDOWS\System32\DRIVERS\nv4_mini.sys
 |   |_ Výrobce:  NVIDIA Corporation
 |   |_ Popis: NVIDIA Compatible Windows 2000 Miniport Driver, Version 44.85 
 |   |_ MD5: D8C0BD7A57F5A3DF965EAE2849B2C5B8
 |   
 |_ Jméno:  nv
 |_ StartName: 
 |_ Typ spouštění:  Ruční spuštění
 |_ Status: Spuštěno
 |_ Typ:  Kernel Driver
 |_ Dependency: 

[X] nzyhtuul
 |_ Cesta: C:\WINDOWS\System32\Drivers\nzyhtuul.sys
 |   |_ Výrobce:  
 |   |_ Popis: 
 |   |_ MD5: 
 |   
 |_ Jméno:  nzyhtuul
 |_ StartName: 
 |_ Typ spouštění:  Boot Start
 |_ Status: Zastaveno
 |_ Typ:  Kernel Driver
 |_ Dependency: 

[?] OMCI WDM Device Driver
 |_ Cesta: C:\WINDOWS\System32\DRIVERS\omci.sys
 |   |_ Výrobce:  Dell Computer Corporation
 |   |_ Popis: OMCI Device Driver
 |   |_ MD5: 1D98907D80461371437A7C898C58C8AE
 |   
 |_ Jméno:  OMCI
 |_ StartName: 
 |_ Typ spouštění:  System Start
 |_ Status: Spuštěno
 |_ Typ:  Kernel Driver
 |_ Dependency: 

[?] PCANDIS5 NDIS Protocol Driver
 |_ Cesta: C:\WINDOWS\System32\PCANDIS5.SYS
 |   |_ Výrobce:  Printing Communications Assoc., Inc. (PCAUSA)
 |   |_ Popis: PCAUSA NDIS 5.0 Protocol Driver
 |   |_ MD5: CEEF86CB35ABE95C40A88784F5B631AD
 |   
 |_ Jméno:  PCANDIS5
 |_ StartName: 
 |_ Typ spouštění:  Ruční spuštění
 |_ Status: Spuštěno
 |_ Typ:  Kernel Driver
 |_ Dependency: 

[?] PxHelp20
 |_ Cesta: C:\WINDOWS\System32\DRIVERS\PxHelp20.sys
 |   |_ Výrobce:  Sonic Solutions
 |   |_ Popis: Px Engine Device Driver for Windows 2000/XP
 |   |_ MD5: 49452BFCEC22F36A7A9B9C2181BC3042
 |   
 |_ Jméno:  PxHelp20
 |_ StartName: 
 |_ Typ spouštění:  Boot Start
 |_ Status: Spuštěno
 |_ Typ:  Kernel Driver
 |_ Dependency: 

[?] sscdbhk5
 |_ Cesta: C:\WINDOWS\system32\drivers\sscdbhk5.sys
 |   |_ Výrobce:  Sonic Solutions
 |   |_ Popis: Shared Driver Component
 |   |_ MD5: 328E8BB94EC58480F60458FB4B8437A7
 |   
 |_ Jméno:  sscdbhk5
 |_ StartName: 
 |_ Typ spouštění:  System Start
 |_ Status: Spuštěno
 |_ Typ:  File System Driver
 |_ Dependency: 

[?] ssrtln
 |_ Cesta: C:\WINDOWS\system32\drivers\ssrtln.sys
 |   |_ Výrobce:  Sonic Solutions
 |   |_ Popis: Shared Driver Component
 |   |_ MD5: 7EC8B427CEE5C0CDAC066320B93F1355
 |   
 |_ Jméno:  ssrtln
 |_ StartName: 
 |_ Typ spouštění:  System Start
 |_ Status: Spuštěno
 |_ Typ:  File System Driver
 |_ Dependency: 

[?] Audio Driver (WDM) - SigmaTel CODEC
 |_ Cesta: C:\WINDOWS\system32\drivers\STAC97.sys
 |   |_ Výrobce:  SigmaTel, Inc.
 |   |_ Popis: SigmaTel Audio Driver (WDM)
 |   |_ MD5: EEF5877A1BFC9684D7E2435FDD3C5853
 |   
 |_ Jméno:  STAC97
 |_ StartName: 
 |_ Typ spouštění:  Ruční spuštění
 |_ Status: Spuštěno
 |_ Typ:  Kernel Driver
 |_ Dependency: 

[?] Synaptics TouchPad Driver
 |_ Cesta: C:\WINDOWS\System32\DRIVERS\SynTP.sys
 |   |_ Výrobce:  Synaptics, Inc.
 |   |_ Popis: Synaptics Touchpad Driver
 |   |_ MD5: 7987C01D1BD0C413B12B3D3ED743D7F5
 |   
 |_ Jméno:  SynTP
 |_ StartName: 
 |_ Typ spouštění:  Ruční spuštění
 |_ Status: Spuštěno
 |_ Typ:  Kernel Driver
 |_ Dependency: 

[?] tfsnboio
 |_ Cesta: C:\WINDOWS\system32\dla\tfsnboio.sys
 |   |_ Výrobce:  Sonic Solutions
 |   |_ Popis: Drive Letter Access Component
 |   |_ MD5: C229BF90443BE8D3BD2B65D7F3AC0F35
 |   
 |_ Jméno:  tfsnboio
 |_ StartName: 
 |_ Typ spouštění:  Auto Start
 |_ Status: Spuštěno
 |_ Typ:  File System Driver
 |_ Dependency: 

[?] tfsncofs
 |_ Cesta: C:\WINDOWS\system32\dla\tfsncofs.sys
 |   |_ Výrobce:  Sonic Solutions
 |   |_ Popis: Drive Letter Access Component
 |   |_ MD5: 79EE9FCD7728E54AB8FBC30962F0416F
 |   
 |_ Jméno:  tfsncofs
 |_ StartName: 
 |_ Typ spouštění:  Auto Start
 |_ Status: Spuštěno
 |_ Typ:  File System Driver
 |_ Dependency: 

[?] tfsndrct
 |_ Cesta: C:\WINDOWS\system32\dla\tfsndrct.sys
 |   |_ Výrobce:  Sonic Solutions
 |   |_ Popis: Drive Letter Access Component
 |   |_ MD5: 9EFB37E7DE17D783A059B653F7E8AFAD
 |   
 |_ Jméno:  tfsndrct
 |_ StartName: 
 |_ Typ spouštění:  Auto Start
 |_ Status: Spuštěno
 |_ Typ:  File System Driver
 |_ Dependency: 

[?] tfsndres
 |_ Cesta: C:\WINDOWS\system32\dla\tfsndres.sys
 |   |_ Výrobce:  Sonic Solutions
 |   |_ Popis: Drive Letter Access Component
 |   |_ MD5: 130254995EBEDCB34D62E8D78EC9DBD0
 |   
 |_ Jméno:  tfsndres
 |_ StartName: 
 |_ Typ spouštění:  Auto Start
 |_ Status: Spuštěno
 |_ Typ:  File System Driver
 |_ Dependency: 

[?] tfsnifs
 |_ Cesta: C:\WINDOWS\system32\dla\tfsnifs.sys
 |   |_ Výrobce:  Sonic Solutions
 |   |_ Popis: Drive Letter Access Component
 |   |_ MD5: 9B40E1E4AEED849812A2E43A388A7E77
 |   
 |_ Jméno:  tfsnifs
 |_ StartName: 
 |_ Typ spouštění:  Auto Start
 |_ Status: Spuštěno
 |_ Typ:  File System Driver
 |_ Dependency: 

[?] tfsnopio
 |_ Cesta: C:\WINDOWS\system32\dla\tfsnopio.sys
 |   |_ Výrobce:  Sonic Solutions
 |   |_ Popis: Drive Letter Access Component
 |   |_ MD5: 818047AD850B312705AA17CA96B9427D
 |   
 |_ Jméno:  tfsnopio
 |_ StartName: 
 |_ Typ spouštění:  Auto Start
 |_ Status: Spuštěno
 |_ Typ:  File System Driver
 |_ Dependency: 

[?] tfsnpool
 |_ Cesta: C:\WINDOWS\system32\dla\tfsnpool.sys
 |   |_ Výrobce:  Sonic Solutions
 |   |_ Popis: Drive Letter Access Component
 |   |_ MD5: 4603E813BCC6DD465CD8D2AFD37FA90D
 |   
 |_ Jméno:  tfsnpool
 |_ StartName: 
 |_ Typ spouštění:  Auto Start
 |_ Status: Spuštěno
 |_ Typ:  File System Driver
 |_ Dependency: 

[?] tfsnudf
 |_ Cesta: C:\WINDOWS\system32\dla\tfsnudf.sys
 |   |_ Výrobce:  Sonic Solutions
 |   |_ Popis: Drive Letter Access Component
 |   |_ MD5: 6FC2CD904A9A55ACFDFC780A611A75ED
 |   
 |_ Jméno:  tfsnudf
 |_ StartName: 
 |_ Typ spouštění:  Auto Start
 |_ Status: Spuštěno
 |_ Typ:  File System Driver
 |_ Dependency: 

[?] tfsnudfa
 |_ Cesta: C:\WINDOWS\system32\dla\tfsnudfa.sys
 |   |_ Výrobce:  Sonic Solutions
 |   |_ Popis: Drive Letter Access Component
 |   |_ MD5: D4AFA4D00F8DB3FD1C15B3FE49C3A96C
 |   
 |_ Jméno:  tfsnudfa
 |_ StartName: 
 |_ Typ spouštění:  Auto Start
 |_ Status: Spuštěno
 |_ Typ:  File System Driver
 |_ Dependency: 

[?] winachsf
 |_ Cesta: C:\WINDOWS\System32\DRIVERS\HSF_CNXT.sys
 |   |_ Výrobce:  Conexant Systems, Inc.
 |   |_ Popis: HSF_CNXT driver
 |   |_ MD5: 8D4F833289E769DCA80C0067CC2E40D8
 |   
 |_ Jméno:  winachsf
 |_ StartName: 
 |_ Typ spouštění:  Ruční spuštění
 |_ Status: Spuštěno
 |_ Typ:  Kernel Driver
 |_ Dependency: 


lNetStat
================================================================
Typ:  PID       Proces              Local <-> Remote                             Status
-----------------------------------------------------------------------------------------
TCP (984)     svchost.exe         0.0.0.0:135                                  LISTENING
TCP (4)       Systém              0.0.0.0:445                                  LISTENING
TCP (632)     alg.exe             127.0.0.1:1029                               LISTENING
UDP (4)       Systém              0.0.0.0:445                                  LISTENING
UDP (740)     lsass.exe           0.0.0.0:500                                  
UDP (740)     lsass.exe           0.0.0.0:4500                                 
UDP (1020)    svchost.exe         127.0.0.1:123                                
UDP (204)     Skype.exe           127.0.0.1:1031                               
UDP (1128)    svchost.exe         127.0.0.1:1900                               

Moduly (Zobraz i bezpečné DLL: False, Jen bez výrobce: True, Zobraz registrované: False)
================================================================
[?] ekrnemon.dll
 |_ Cesta: C:\Program Files\ESET\ESET NOD32 Antivirus\ekrnEmon.dll
 |_ MD5: 7C95F91417030A3AF8B4D5CDAE98ACDF
 |_ Výrobce:  ESET
 |_ Procesy
     |_ ekrn.exe (1576)

[?] ekrndmon.dll
 |_ Cesta: C:\Program Files\ESET\ESET NOD32 Antivirus\ekrnDmon.dll
 |_ MD5: A59CB5E41E57FCBA45F4F00F5F4D9E6D
 |_ Výrobce:  ESET
 |_ Procesy
     |_ ekrn.exe (1576)

[?] ekrnepfw.dll
 |_ Cesta: C:\Program Files\ESET\ESET NOD32 Antivirus\ekrnEpfw.dll
 |_ MD5: 4223E712DF492A167EE2968E0DEF0296
 |_ Výrobce:  ESET
 |_ Procesy
     |_ ekrn.exe (1576)

[?] updater.dll
 |_ Cesta: C:\Program Files\ESET\ESET NOD32 Antivirus\updater.dll
 |_ MD5: C020DB9211FABB8FD7F076328D39E0BF
 |_ Výrobce:  ESET
 |_ Procesy
     |_ ekrn.exe (1576)

[?] ekrnupdate.dll
 |_ Cesta: C:\Program Files\ESET\ESET NOD32 Antivirus\ekrnUpdate.dll
 |_ MD5: 1C77282826A1150C2A0A9DFBD1F03921
 |_ Výrobce:  ESET
 |_ Procesy
     |_ ekrn.exe (1576)

[?] ekrnamon.dll
 |_ Cesta: C:\Program Files\ESET\ESET NOD32 Antivirus\ekrnAmon.dll
 |_ MD5: A122303825C62A944A5583A6781C4432
 |_ Výrobce:  ESET
 |_ Procesy
     |_ ekrn.exe (1576)

[?] ekrnscan.dll
 |_ Cesta: C:\Program Files\ESET\ESET NOD32 Antivirus\ekrnScan.dll
 |_ MD5: 1B8BDC69A77B4674E522EE246ECA22B8
 |_ Výrobce:  ESET
 |_ Procesy
     |_ ekrn.exe (1576)

[?] ekrnmailplugins.dll
 |_ Cesta: C:\Program Files\ESET\ESET NOD32 Antivirus\ekrnMailPlugins.dll
 |_ MD5: 491F9236EA89FA755F9892427703B7B1
 |_ Výrobce:  ESET
 |_ Procesy
     |_ ekrn.exe (1576)

[?] eguiepfw.dll
 |_ Cesta: C:\Program Files\ESET\ESET NOD32 Antivirus\eguiEpfw.dll
 |_ MD5: 6249EF439B23C65CD54BD85361F515FE
 |_ Výrobce:  ESET
 |_ Procesy
     |_ egui.exe (2004)

[?] eguiupdate.dll
 |_ Cesta: C:\Program Files\ESET\ESET NOD32 Antivirus\eguiUpdate.dll
 |_ MD5: E8D602A3F2464A695BF9A1C55A808679
 |_ Výrobce:  ESET
 |_ Procesy
     |_ egui.exe (2004)

[?] eguiamon.dll
 |_ Cesta: C:\Program Files\ESET\ESET NOD32 Antivirus\eguiAmon.dll
 |_ MD5: BBDC6FAB2802B43B39A6DFE328467D24
 |_ Výrobce:  ESET
 |_ Procesy
     |_ egui.exe (2004)

[?] eguiemon.dll
 |_ Cesta: C:\Program Files\ESET\ESET NOD32 Antivirus\eguiEmon.dll
 |_ MD5: 50BDD76AAD187648EDE823788B26B5CC
 |_ Výrobce:  ESET
 |_ Procesy
     |_ egui.exe (2004)

[?] eguiscan.dll
 |_ Cesta: C:\Program Files\ESET\ESET NOD32 Antivirus\eguiScan.dll
 |_ MD5: C19C3FF29F4BAC038628370072847EE6
 |_ Výrobce:  ESET
 |_ Procesy
     |_ egui.exe (2004)

[?] eguimailplugins.dll
 |_ Cesta: C:\Program Files\ESET\ESET NOD32 Antivirus\eguiMailPlugins.dll
 |_ MD5: 617BDDB6429AEBC52A6F08BBE7415F2D
 |_ Výrobce:  ESET
 |_ Procesy
     |_ egui.exe (2004)

[?] eguidmon.dll
 |_ Cesta: C:\Program Files\ESET\ESET NOD32 Antivirus\eguiDmon.dll
 |_ MD5: FB4864672CDD1C06DA5E43ABCFF6ED71
 |_ Výrobce:  ESET
 |_ Procesy
     |_ egui.exe (2004)

[?] w32n50.dll
 |_ Cesta: C:\WINDOWS\system32\W32N50.DLL
 |_ MD5: CF7F176E5DC77FA95AF30FE913957611
 |_ Výrobce:  Printing Communications Assoc., Inc. (PCAUSA)
 |_ Procesy
     |_ WlanUtility.exe (276)
     |_ WLAN_Service.exe (568)

[?] prismapi.dll
 |_ Cesta: C:\WINDOWS\system32\PRISMAPI.dll
 |_ MD5: 3B3A07D332FE8D5211A4F2902E28BE59
 |_ Výrobce:  GlobespanVirata, Inc.
 |_ Procesy
     |_ WlanUtility.exe (276)

[?] nbshell.dll
 |_ Cesta: C:\Program Files\Nero\Nero 7\Nero BackItUp\NBShell.dll
 |_ MD5: C44757F39EF1B1FB10D89181928694E0
 |_ Výrobce:  Nero AG
 |_ Procesy
     |_ explorer.exe (1288)

[?] pdfshell.dll
 |_ Cesta: C:\Program Files\Adobe\Acrobat 7.0\ActiveX\pdfshell.dll
 |_ MD5: 4B0991CD076B617A2231B19A6663C1C9
 |_ Výrobce:  Adobe Systems, Inc.
 |_ Procesy
     |_ explorer.exe (1288)

[?] mscomctl.ocx
 |_ Cesta: C:\WINDOWS\system32\MSCOMCTL.OCX
 |_ MD5: F7BBB7D79ADB9E3ADC13F3B3C33D3D4D
 |_ Výrobce:  Microsoft Corporation
 |_ Procesy
     |_ UPM.exe (1680)


Výpis souborů
================================================================
\System32:
[?] clspack.exe                             12     ncmpny,      {515E5C8A}
[?] COMCT332.OCX                            12     ncmpny,      {EFE11655}
[?] comsdupd.exe                            12     ncmpny,      {EF66F5F7}
[?] d3dx9_24.dll                            12     ncmpny,      {603BDCA5}
[?] d3dx9_25.dll                            12     ncmpny,      {B54E8808}
[?] d3dx9_26.dll                            12     ncmpny,      {9E0104EE}
[?] d3dx9_27.dll                            12     ncmpny,      {A4CBCFB8}
[?] d3dx9_28.dll                            12     ncmpny,      {CB42899A}
[?] d3dx9_29.dll                            12     ncmpny,      {309E4072}
[?] d3dx9_30.dll                            12     ncmpny,      {F659E555}
[?] dbmsadsn.dll                            12     ncmpny,      {1EB59DC8}
[?] dbmsvinn.dLL                            12     ncmpny,      {3A1B9CCF}
[?] DellSys.dll                             7      no vrfy,     {628F7594}
[?] dx3j.dll                                25     ncmpny,      {EC77F7B3}
[?] faxpatch.exe                            12     ncmpny,      {FE0002E2}
[?] FM20.DLL                                12     ncmpny,      {FC33A833}
[?] GPhotos.scr                             14     no vrfy,     {F167C815}
[?] imagXpr7.dll                            7      no vrfy,     {0AA82F1E}
[?] javacypt.dll                            25     ncmpny,      {16C5F6CD}
[?] javaprxy.dll                            12     ncmpny,      {0F05A212}
[?] javart.dll                              12     ncmpny,      {5500A968}
[?] jdbgmgr.exe                             12     ncmpny,      {3EBE1781}
[?] jit.dll                                 12     ncmpny,      {7810B255}
[?] jview.exe                               25     ncmpny,      {C93059F4}
[?] mindex.dll                              12     ncmpny,      {31BBFF27}
[?] msawt.dll                               12     ncmpny,      {1055206B}
[?] MSCOMCT2.OCX                            12     ncmpny,      {DE9FE971}
[?] MSCOMCTL.OCX                            12     ncmpny,      {49BE9D83}
[?] msisam11.dll                            12     ncmpny,      {5F7FC8CE}
[?] msjava.dll                              12     ncmpny,      {DFDB166E}
[?] msjdbc10.dll                            12     ncmpny,      {F2FABFA1}
[?] MSSTDFMT.DLL                            12     ncmpny,      {67AC6AAA}
[?] msuni11.dll                             12     ncmpny,      {77084EF1}
[?] Papapi2.dll                             7      no vrfy,     {7F0F6EF9}
[?] PCANDIS5.SYS                            7      no vrfy,     {AB3AE5EF}
[?] PCTIN50.DLL                             7      no vrfy,     {26D66005}
[?] PCTINDIS5.sys          PCTIND~1.SYS     7      no vrfy,     {BA318B2D}
[?] PRISMAPI.dll                            7      no vrfy,     {6E9DB615}
[?] ptpusd.dll                              12     ncmpny,      {0E8EFA56}
[?] px.dll                                  7      no vrfy,     {0239629F}
[?] pxdrv.dll                               7      no vrfy,     {F147397E}
[?] pxhpinst.exe                            7      no vrfy,     {7A373C9B}
[?] pxmas.dll                               7      no vrfy,     {D6CEDF19}
[?] pxwave.dll                              7      no vrfy,     {80DB984B}
[?] RcdScan.dll                             7      no vrfy,     {1B91C256}
[?] SCP32.DLL                               12     ncmpny,      {505ABB76}
[?] slrundll.exe                            7      no vrfy,     {26BDFBE7}
[?] spdwnwxp.exe                            12     ncmpny,      {0F890C03}
[?] spupdsvc.exe                            12     ncmpny,      {DD15C2BE}
[?] spupdwxp.exe                            12     ncmpny,      {5DC54D38}
[?] ssa3d30.ocx                             7      no vrfy,     {14B12022}
[?] tfswapi.dll                             7      no vrfy,     {7C170AB0}
[?] tscupgrd.exe                            12     ncmpny,      {0772E646}
[?] umloader.dll                            7      no vrfy,     {B35D10B6}
[?] unrar.dll                               12     ncmpny,      {528D4CC3}
[?] VBAME.DLL                               12     ncmpny,      {8E415C62}
[?] vmhelper.dll                            25     ncmpny,      {FC71FF01}
[?] VXBLOCK.dll                             7      no vrfy,     {A9E9A269}
[?] vxdmdbtn.ocx                            7      no vrfy,     {0ACDFA6E}
[?] W32N50.DLL                              7      no vrfy,     {600923C6}
[?] wjview.exe                              25     ncmpny,      {A64B4003}
[?] WlanInstallDll.dll     WLANIN~1.DLL     7      no vrfy,     {3D1B2521}
[?] wma9dmod.dll                            12     ncmpny,      {A0558821}
[?] wmidx.ocx                               12     ncmpny,      {772E153C}
[?] wmpstub.exe                             25     ncmpny,      {94B9ED87}
[?] wmv8dmod.dll                            12     ncmpny,      {4E46DF1B}
[?] wmv9dmod.dll                            12     ncmpny,      {38C00B3C}
[?] wmvcore2.dll                            12     ncmpny,      {47D3B589}
[?] wmvdmoe.dll                             12     ncmpny,      {69F6CA29}
[?] wvc1dmod.dll                            12     ncmpny,      {4D76710B}
[?] x3daudio1_0.dll        X3DAUD~1.DLL     12     ncmpny,      {A1FF49EB}
[?] xactengine2_0.dll      XACTEN~1.DLL     12     ncmpny,      {FD2EF32B}
[?] xactengine2_1.dll      XACTEN~2.DLL     12     ncmpny,      {59F74897}
[?] xactengine2_2.dll      XACTEN~3.DLL     12     ncmpny,      {8AA83E8C}
[?] xinput1_1.dll          XINPUT~2.DLL     12     ncmpny,      {2446350D}
[?] xinput9_1_0.dll        XINPUT~1.DLL     12     ncmpny,      {8406BB6D}
[?] ZD12APP.dll                             7      no vrfy,     {CF27804D}

\Drivers:
[?] cdr4_xp.sys                            14     no vrfy,      {8BC442DA}
[?] cdralw2k.sys                           14     no vrfy,      {5AC586A4}
[?] drvmcdb.sys                            7      no vrfy,      {1B93FD21}
[?] drvnddm.sys                            7      no vrfy,      {9D5BFBE4}
[?] eamon.sys                              14     no vrfy,      {85C48BAD}
[?] ehdrv.sys                              14     no vrfy,      {EB228638}
[?] epfwtdir.sys                           14     no vrfy,      {7F8B655F}
[?] M2571ap.sys                            7      no vrfy,      {56031386}
[?] mbam.sys                               14     no vrfy,      {A4D33752}
[?] mbamswissarmy.sys     MBAMSW~1.SYS     14     no vrfy,      {FE9A25AC}
[?] MS25kap.sys                            7      no vrfy,      {2CFBE2D6}
[?] ms6823ap.SYS                           14     no vrfy,      {E7DFAEE0}
[?] ms6826ap.SYS                           7      no vrfy,      {CD9FA9C8}
[?] msi505x.sys                            7      no vrfy,      {506F3B3A}
[?] MSI68ICB.sys                           7      no vrfy,      {13A7CFB1}
[?] msiralap.sys                           7      no vrfy,      {5E4B8E8A}
[?] omci.sys                               14     no vrfy,      {8633A701}
[?] pxhelp20.sys                           7      no vrfy,      {8BDDDF31}
[?] sscdbhk5.sys                           7      no vrfy,      {90B79945}
[?] ssrtln.sys                             7      no vrfy,      {69C02CBF}

Access violations - HKCU
================================================================


================================================================
Ultimate Process Manager v4.1.3 - [ Lodus Software ]

Kód: Vybrat vše

RenV::
c:\program files\AVG\AVG8\avgtray .exe
c:\program files\Common Files\Ahead\Lib\nerocheck .exe
c:\program files\Common Files\Ahead\Lib\nmbgmonitor .exe
c:\program files\Common Files\Sonic\Update Manager\sgtray .exe
c:\program files\ESET\ESET Smart Security\egui .exe
c:\program files\Skype\Phone\skype .exe
c:\program files\Synaptics\SynTP\syntpenh .exe
c:\program files\Synaptics\SynTP\syntplpr .exe
c:\windows\system32\dla\tfswctrl .exe

File::
c:\program files\1736921.dat
c:\windows\nod32fixtemdono.reg
c:\documents and settings\AmunRa\Application Data\fmucsu.exe
c:\documents and settings\AmunRa\Application Data\szywo.exe
c:\windows\system32\Drivers\nzyhtuul.sys

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sonic RecordNow!"=-
"userini"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"userini"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
"userini"=-

Driver::
nzyhtuul

ADS::
c:\windows\explorer.exe:userini.exe