VIRY.CZ

Pomáháme v boji s počítačovou havěti!
https://forum.viry.cz:443/

W32/Malware!Gemini

https://forum.viry.cz:443/viewtopic.php?t=100629

Stránka 1 z 2

W32/Malware!Gemini

Napsal: 01 kvě 2010 11:19
od -Next-
Zdravím, dnes mi našel F-Secure Internet Security 2010 vir W32/Malware!Gemini. Bohužel ho nejde odstranit, ani vymazat, ani uložit do karantény. Poraďte prosím, děkuji předem

Logfile of random's system information tool 1.06 (written by random/random)
Run by Adam at 2010-05-01 12:21:14
Microsoft Windows 7 Home Premium Service Pack 3
System drive C: has 82 GB (82%) free of 100 GB
Total RAM: 2047 MB (62% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:21:16, on 1.5.2010
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\Windows Media Player\wmplayer.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\F-Secure\Common\FSM32.EXE
C:\Program Files\Logitech\GamePanel Software\Applets\LCDMedia.exe
C:\Program Files (x86)\F-Secure\FSGUI\fscuif.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Adam\Desktop\RSIT.exe
C:\Program Files (x86)\trend micro\Adam.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: LitmusBHO - {C6867EB7-8350-4856-877F-93CF8AE3DC9C} - C:\Program Files (x86)\F-Secure\NRS\iescript\baselitmus.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\bin\jp2ssv.dll
O3 - Toolbar: Browsing Protection Toolbar - {265EEE8E-3228-44D3-AEA5-F7FDF5860049} - C:\Program Files (x86)\F-Secure\NRS\iescript\baselitmus.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files (x86)\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files (x86)\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files (x86)\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files (x86)\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files (x86)\F-Secure\Common\FSMA32.EXE
O23 - Service: F-Secure ORSP Client (FSORSPClient) - F-Secure Corporation - C:\Program Files (x86)\F-Secure\ORSP Client\fsorsp.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 7136 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Scheduled scanning task.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-12-21 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C6867EB7-8350-4856-877F-93CF8AE3DC9C}]
Browsing Protection Class - C:\Program Files (x86)\F-Secure\NRS\iescript\baselitmus.dll [2010-05-01 535288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\bin\jp2ssv.dll [2010-04-19 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{265EEE8E-3228-44D3-AEA5-F7FDF5860049} - Browsing Protection Toolbar - C:\Program Files (x86)\F-Secure\NRS\iescript\baselitmus.dll [2010-05-01 535288]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2010-03-02 98304]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2010-02-18 248040]
"F-Secure Manager"=C:\Program Files (x86)\F-Secure\Common\FSM32.EXE [2009-07-09 199264]
"F-Secure TNB"=C:\Program Files (x86)\F-Secure\FSGUI\TNBUtil.exe [2009-07-09 2349664]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Skype"=C:\Program Files (x86)\Skype\Phone\Skype.exe [2010-04-06 26102056]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\EFS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Power]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\RpcEptMapper]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vmms]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AppInfo]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\BFE]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\bowser]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\dfsc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Dot3Svc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Eaphost]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\EFS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\IKEEXT]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\KeyIso]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MPSDrv]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MPSSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mrxsmb]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mrxsmb10]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mrxsmb20]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NativeWifiP]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\ndiscap]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\netprofm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NlaSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Nsi]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nsiproxy.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NTDS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PolicyAgent]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Power]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\ProfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\rdbss]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\rdpencdd.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\RpcEptMapper]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sacsvr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SCardSvr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SWPRV]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TabletInputService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TBS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TrustedInstaller]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\VaultSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\VDS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vmms]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\volmgr.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\volmgrx.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wlansvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{50DD5230-BA8A-11D1-BF5D-0000F805F530}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=
"NoActiveDesktopChanges"=
"ForceActiveDesktopOn"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b393d9e0-4be1-11df-a3d2-806e6f6e6963}]
shell\AutoRun\command - E:\startdvd.exe
shell\readme\command - notepad cti_mne.txt


======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-05-01 09:12:07 ----D---- C:\Program Files (x86)\trend micro
2010-05-01 09:12:06 ----D---- C:\rsit
2010-05-01 08:20:21 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-05-01 08:19:58 ----D---- C:\Program Files (x86)\F-Secure
2010-05-01 08:19:29 ----D---- C:\ProgramData\fssg
2010-05-01 08:14:52 ----D---- C:\ProgramData\f-secure
2010-04-28 15:08:15 ----A---- C:\Windows\system32\shell32.dll
2010-04-28 15:08:14 ----A---- C:\Windows\system32\sspicli.dll
2010-04-28 15:08:14 ----A---- C:\Windows\system32\secur32.dll
2010-04-26 19:19:05 ----D---- C:\ProgramData\Alwil Software
2010-04-24 16:17:15 ----D---- C:\Users\Adam\AppData\Roaming\Canon
2010-04-24 15:58:04 ----D---- C:\Program Files (x86)\QS
2010-04-23 13:49:21 ----D---- C:\Program Files (x86)\ScreenShots
2010-04-23 13:45:56 ----D---- C:\Users\Adam\AppData\Roaming\DonationCoder
2010-04-23 13:45:35 ----D---- C:\Program Files (x86)\ScreenshotCaptor
2010-04-22 16:51:39 ----D---- C:\Users\Adam\AppData\Roaming\Ubisoft
2010-04-22 16:51:39 ----D---- C:\ProgramData\Ubisoft
2010-04-22 15:23:16 ----D---- C:\Program Files (x86)\Ubisoft
2010-04-22 15:22:39 ----A---- C:\Windows\system32\XAudio2_5.dll
2010-04-22 15:22:38 ----A---- C:\Windows\system32\xactengine3_5.dll
2010-04-22 15:22:37 ----A---- C:\Windows\system32\d3dcsx_42.dll
2010-04-22 15:22:37 ----A---- C:\Windows\system32\D3DCompiler_42.dll
2010-04-22 15:22:36 ----A---- C:\Windows\system32\d3dx11_42.dll
2010-04-22 15:22:34 ----A---- C:\Windows\system32\d3dx10_41.dll
2010-04-22 15:22:34 ----A---- C:\Windows\system32\D3DCompiler_41.dll
2010-04-22 15:22:33 ----A---- C:\Windows\system32\D3DX9_41.dll
2010-04-22 15:22:32 ----A---- C:\Windows\system32\XAudio2_4.dll
2010-04-22 15:22:32 ----A---- C:\Windows\system32\XAPOFX1_3.dll
2010-04-22 15:22:31 ----A---- C:\Windows\system32\xactengine3_4.dll
2010-04-22 15:22:31 ----A---- C:\Windows\system32\X3DAudio1_6.dll
2010-04-22 15:22:30 ----A---- C:\Windows\system32\d3dx10_40.dll
2010-04-22 15:22:30 ----A---- C:\Windows\system32\D3DCompiler_40.dll
2010-04-22 15:22:29 ----A---- C:\Windows\system32\D3DX9_40.dll
2010-04-22 15:22:28 ----A---- C:\Windows\system32\XAudio2_3.dll
2010-04-22 15:22:28 ----A---- C:\Windows\system32\XAPOFX1_2.dll
2010-04-22 15:22:28 ----A---- C:\Windows\system32\xactengine3_3.dll
2010-04-22 15:22:27 ----A---- C:\Windows\system32\X3DAudio1_5.dll
2010-04-22 15:22:25 ----A---- C:\Windows\system32\XAudio2_2.dll
2010-04-22 15:22:25 ----A---- C:\Windows\system32\XAPOFX1_1.dll
2010-04-22 15:22:24 ----A---- C:\Windows\system32\xactengine3_2.dll
2010-04-22 15:22:24 ----A---- C:\Windows\system32\d3dx10_39.dll
2010-04-22 15:22:24 ----A---- C:\Windows\system32\D3DCompiler_39.dll
2010-04-22 15:22:21 ----A---- C:\Windows\system32\D3DX9_39.dll
2010-04-22 15:22:20 ----A---- C:\Windows\system32\XAudio2_1.dll
2010-04-22 15:22:20 ----A---- C:\Windows\system32\XAPOFX1_0.dll
2010-04-22 15:22:20 ----A---- C:\Windows\system32\xactengine3_1.dll
2010-04-22 15:22:20 ----A---- C:\Windows\system32\X3DAudio1_4.dll
2010-04-22 15:22:19 ----A---- C:\Windows\system32\d3dx10_38.dll
2010-04-22 15:22:19 ----A---- C:\Windows\system32\D3DCompiler_38.dll
2010-04-22 15:22:18 ----A---- C:\Windows\system32\D3DX9_38.dll
2010-04-22 15:22:17 ----A---- C:\Windows\system32\XAudio2_0.dll
2010-04-22 15:22:17 ----A---- C:\Windows\system32\xactengine3_0.dll
2010-04-22 15:22:16 ----A---- C:\Windows\system32\X3DAudio1_3.dll
2010-04-22 15:22:16 ----A---- C:\Windows\system32\d3dx10_37.dll
2010-04-22 15:22:16 ----A---- C:\Windows\system32\D3DCompiler_37.dll
2010-04-22 15:22:15 ----A---- C:\Windows\system32\D3DX9_37.dll
2010-04-22 15:22:14 ----A---- C:\Windows\system32\xactengine2_10.dll
2010-04-22 15:22:13 ----A---- C:\Windows\system32\d3dx10_36.dll
2010-04-22 15:22:13 ----A---- C:\Windows\system32\D3DCompiler_36.dll
2010-04-22 15:22:12 ----A---- C:\Windows\system32\d3dx9_36.dll
2010-04-22 15:22:11 ----A---- C:\Windows\system32\xactengine2_9.dll
2010-04-22 15:22:10 ----A---- C:\Windows\system32\d3dx9_35.dll
2010-04-22 15:22:10 ----A---- C:\Windows\system32\d3dx10_35.dll
2010-04-22 15:22:10 ----A---- C:\Windows\system32\D3DCompiler_35.dll
2010-04-22 15:22:09 ----A---- C:\Windows\system32\xactengine2_8.dll
2010-04-22 15:22:09 ----A---- C:\Windows\system32\X3DAudio1_2.dll
2010-04-22 15:22:08 ----A---- C:\Windows\system32\d3dx9_34.dll
2010-04-22 15:22:08 ----A---- C:\Windows\system32\d3dx10_34.dll
2010-04-22 15:22:08 ----A---- C:\Windows\system32\D3DCompiler_34.dll
2010-04-22 15:22:07 ----A---- C:\Windows\system32\xactengine2_7.dll
2010-04-22 15:22:06 ----A---- C:\Windows\system32\d3dx9_33.dll
2010-04-22 15:22:06 ----A---- C:\Windows\system32\d3dx10_33.dll
2010-04-22 15:22:06 ----A---- C:\Windows\system32\D3DCompiler_33.dll
2010-04-22 15:22:05 ----A---- C:\Windows\system32\xactengine2_6.dll
2010-04-22 15:22:04 ----A---- C:\Windows\system32\xactengine2_5.dll
2010-04-22 15:22:04 ----A---- C:\Windows\system32\d3dx10.dll
2010-04-22 15:22:03 ----A---- C:\Windows\system32\xactengine2_4.dll
2010-04-22 15:22:03 ----A---- C:\Windows\system32\x3daudio1_1.dll
2010-04-22 15:22:03 ----A---- C:\Windows\system32\d3dx9_32.dll
2010-04-22 15:22:01 ----A---- C:\Windows\system32\xinput1_2.dll
2010-04-22 15:22:01 ----A---- C:\Windows\system32\xactengine2_3.dll
2010-04-22 15:22:00 ----A---- C:\Windows\system32\xinput1_1.dll
2010-04-22 15:22:00 ----A---- C:\Windows\system32\xactengine2_2.dll
2010-04-22 15:21:59 ----A---- C:\Windows\system32\xactengine2_1.dll
2010-04-22 15:21:55 ----A---- C:\Windows\system32\d3dx9_30.dll
2010-04-22 15:21:53 ----A---- C:\Windows\system32\xactengine2_0.dll
2010-04-22 15:21:53 ----A---- C:\Windows\system32\x3daudio1_0.dll
2010-04-22 15:21:53 ----A---- C:\Windows\system32\d3dx9_29.dll
2010-04-22 15:21:52 ----A---- C:\Windows\system32\d3dx9_28.dll
2010-04-22 15:21:52 ----A---- C:\Windows\system32\d3dx9_27.dll
2010-04-22 15:21:51 ----A---- C:\Windows\system32\d3dx9_26.dll
2010-04-22 15:21:51 ----A---- C:\Windows\system32\d3dx9_25.dll
2010-04-22 15:21:50 ----A---- C:\Windows\system32\d3dx9_24.dll
2010-04-20 21:11:12 ----D---- C:\Windows\Sun
2010-04-20 17:27:42 ----D---- C:\Users\Adam\AppData\Roaming\Hamachi
2010-04-20 17:27:26 ----D---- C:\Program Files (x86)\Hamachi
2010-04-20 16:53:12 ----SHD---- C:\ProgramData\SecuROM
2010-04-20 16:50:52 ----A---- C:\Windows\system32\d3dx9_31.dll
2010-04-20 07:09:19 ----A---- C:\Windows\system32\msv1_0.dll
2010-04-20 06:59:53 ----A---- C:\Windows\system32\vbscript.dll
2010-04-20 06:59:47 ----A---- C:\Windows\system32\wmp.dll
2010-04-20 06:59:45 ----A---- C:\Windows\system32\CertEnroll.dll
2010-04-20 06:59:43 ----A---- C:\Windows\system32\wmploc.DLL
2010-04-20 06:59:36 ----A---- C:\Windows\system32\secproc_isv.dll
2010-04-20 06:59:36 ----A---- C:\Windows\system32\secproc.dll
2010-04-20 06:59:36 ----A---- C:\Windows\system32\RMActivate_isv.exe
2010-04-20 06:59:36 ----A---- C:\Windows\system32\RMActivate.exe
2010-04-20 06:59:35 ----A---- C:\Windows\system32\secproc_ssp_isv.dll
2010-04-20 06:59:35 ----A---- C:\Windows\system32\secproc_ssp.dll
2010-04-20 06:59:35 ----A---- C:\Windows\system32\RMActivate_ssp_isv.exe
2010-04-20 06:59:35 ----A---- C:\Windows\system32\RMActivate_ssp.exe
2010-04-20 06:59:31 ----A---- C:\Windows\system32\t2embed.dll
2010-04-20 06:59:31 ----A---- C:\Windows\system32\fontsub.dll
2010-04-20 06:59:31 ----A---- C:\Windows\system32\atmfd.dll
2010-04-20 06:59:28 ----A---- C:\Windows\explorer.exe
2010-04-20 06:59:27 ----A---- C:\Windows\system32\explorer.exe
2010-04-20 06:59:23 ----A---- C:\Windows\system32\wow32.dll
2010-04-20 06:59:23 ----A---- C:\Windows\system32\setup16.exe
2010-04-20 06:59:23 ----A---- C:\Windows\system32\ntvdm64.dll
2010-04-20 06:59:22 ----A---- C:\Windows\system32\user.exe
2010-04-20 06:59:22 ----A---- C:\Windows\system32\instnm.exe
2010-04-20 06:59:13 ----A---- C:\Windows\system32\mshtml.dll
2010-04-20 06:59:12 ----A---- C:\Windows\system32\ieframe.dll
2010-04-20 06:59:10 ----A---- C:\Windows\system32\mstime.dll
2010-04-20 06:59:09 ----A---- C:\Windows\system32\wininet.dll
2010-04-20 06:59:09 ----A---- C:\Windows\system32\urlmon.dll
2010-04-20 06:59:09 ----A---- C:\Windows\system32\msfeedsbs.dll
2010-04-20 06:59:09 ----A---- C:\Windows\system32\iedkcs32.dll
2010-04-20 06:58:51 ----A---- C:\Windows\system32\tzres.dll
2010-04-20 06:58:27 ----A---- C:\Windows\system32\quartz.dll
2010-04-20 06:58:26 ----A---- C:\Windows\system32\tsbyuv.dll
2010-04-20 06:58:26 ----A---- C:\Windows\system32\msyuv.dll
2010-04-20 06:58:26 ----A---- C:\Windows\system32\msvidc32.dll
2010-04-20 06:58:26 ----A---- C:\Windows\system32\msrle32.dll
2010-04-20 06:58:26 ----A---- C:\Windows\system32\mciavi32.dll
2010-04-20 06:58:26 ----A---- C:\Windows\system32\iyuv_32.dll
2010-04-20 06:58:26 ----A---- C:\Windows\system32\avifil32.dll
2010-04-20 06:58:23 ----A---- C:\Windows\system32\ntoskrnl.exe
2010-04-20 06:58:22 ----A---- C:\Windows\system32\ntkrnlpa.exe
2010-04-20 06:58:18 ----A---- C:\Windows\system32\jscript.dll
2010-04-20 06:58:15 ----A---- C:\Windows\system32\CPFilters.dll
2010-04-20 06:58:14 ----A---- C:\Windows\system32\psisdecd.dll
2010-04-20 06:58:11 ----A---- C:\Windows\system32\msasn1.dll
2010-04-19 23:03:28 ----D---- C:\Users\Adam\AppData\Roaming\VitySoft
2010-04-19 22:47:16 ----D---- C:\Users\Adam\AppData\Roaming\Download Manager
2010-04-19 22:38:41 ----D---- C:\Program Files (x86)\Canon
2010-04-19 22:34:13 ----A---- C:\Windows\AS_Debug.txt
2010-04-19 22:30:03 ----D---- C:\Program Files (x86)\SEC
2010-04-19 22:29:34 ----D---- C:\Program Files (x86)\Common Files\InstallShield
2010-04-19 22:27:22 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2010-04-19 22:27:22 ----D---- C:\Program Files (x86)\MagicTune Premium
2010-04-19 22:27:11 ----D---- C:\Users\Adam\AppData\Roaming\InstallShield
2010-04-19 22:07:39 ----D---- C:\ProgramData\Logitech
2010-04-19 22:07:39 ----D---- C:\Program Files (x86)\Logitech
2010-04-19 22:05:03 ----D---- C:\Program Files (x86)\Microsoft Works
2010-04-19 22:04:50 ----D---- C:\Program Files (x86)\Common Files\DESIGNER
2010-04-19 22:04:41 ----D---- C:\Windows\PCHEALTH
2010-04-19 22:04:41 ----D---- C:\Program Files (x86)\Microsoft.NET
2010-04-19 22:02:29 ----D---- C:\ProgramData\Microsoft Help
2010-04-19 22:02:29 ----D---- C:\Program Files (x86)\Microsoft Office
2010-04-19 21:58:54 ----RHD---- C:\MSOCache
2010-04-19 21:49:45 ----D---- C:\Users\Adam\AppData\Roaming\WinRAR
2010-04-19 21:44:33 ----D---- C:\Program Files (x86)\DAEMON Tools Lite
2010-04-19 21:44:00 ----D---- C:\Users\Adam\AppData\Roaming\DAEMON Tools Lite
2010-04-19 21:42:44 ----HD---- C:\ProgramData\CanonBJ
2010-04-19 21:38:00 ----A---- C:\Windows\system32\d3dx10_42.dll
2010-04-19 21:37:59 ----A---- C:\Windows\system32\xinput1_3.dll
2010-04-19 21:37:59 ----A---- C:\Windows\system32\D3DX9_42.dll
2010-04-19 21:37:28 ----D---- C:\Windows\system32\xlive
2010-04-19 21:37:28 ----D---- C:\Program Files (x86)\Microsoft Games for Windows - LIVE
2010-04-19 21:36:14 ----A---- C:\Windows\system32\unrar.dll
2010-04-19 21:36:14 ----A---- C:\Windows\system32\rmoc3260.dll
2010-04-19 21:36:14 ----A---- C:\Windows\system32\pndx5032.dll
2010-04-19 21:36:14 ----A---- C:\Windows\system32\pndx5016.dll
2010-04-19 21:36:14 ----A---- C:\Windows\system32\pncrt.dll
2010-04-19 21:36:13 ----A---- C:\Windows\avisplitter.ini
2010-04-19 21:36:12 ----A---- C:\Windows\system32\yv12vfw.dll
2010-04-19 21:36:12 ----A---- C:\Windows\system32\xvidvfw.dll
2010-04-19 21:36:12 ----A---- C:\Windows\system32\xvidcore.dll
2010-04-19 21:36:12 ----A---- C:\Windows\system32\qt-dx331.dll
2010-04-19 21:36:12 ----A---- C:\Windows\system32\dpl100.dll
2010-04-19 21:36:10 ----A---- C:\Windows\system32\ff_vfw.dll.manifest
2010-04-19 21:36:10 ----A---- C:\Windows\system32\ff_vfw.dll
2010-04-19 21:36:10 ----A---- C:\Windows\system32\divx.dll
2010-04-19 21:36:09 ----A---- C:\Windows\system32\msvcr71.dll
2010-04-19 21:36:09 ----A---- C:\Windows\system32\msvcp71.dll
2010-04-19 21:31:06 ----D---- C:\ProgramData\Sun
2010-04-19 21:31:05 ----D---- C:\Program Files (x86)\Common Files\Java
2010-04-19 21:30:52 ----A---- C:\Windows\system32\javaws.exe
2010-04-19 21:30:52 ----A---- C:\Windows\system32\javaw.exe
2010-04-19 21:30:52 ----A---- C:\Windows\system32\java.exe
2010-04-19 21:30:52 ----A---- C:\Windows\system32\deployJava1.dll
2010-04-19 21:30:43 ----D---- C:\Program Files (x86)\Java
2010-04-19 21:30:18 ----D---- C:\Windows\Panther
2010-04-19 21:27:30 ----D---- C:\Users\Adam\AppData\Roaming\Skype
2010-04-19 21:27:24 ----RD---- C:\Program Files (x86)\Skype
2010-04-19 21:27:23 ----D---- C:\ProgramData\Skype
2010-04-19 21:24:53 ----D---- C:\Users\Adam\AppData\Roaming\Leadertech
2010-04-19 21:24:52 ----D---- C:\Program Files (x86)\Common Files\LogiShrd
2010-04-19 21:23:33 ----D---- C:\ProgramData\Logishrd
2010-04-19 21:23:26 ----D---- C:\Users\Adam\AppData\Roaming\Ashampoo
2010-04-19 21:22:47 ----D---- C:\Users\Adam\AppData\Roaming\Logitech
2010-04-19 21:22:47 ----D---- C:\Users\Adam\AppData\Roaming\Logishrd
2010-04-19 21:16:36 ----D---- C:\Users\Adam\AppData\Roaming\ATI
2010-04-19 21:16:36 ----D---- C:\ProgramData\ATI
2010-04-19 21:16:22 ----D---- C:\Users\Adam\AppData\Roaming\Macromedia
2010-04-19 21:16:22 ----D---- C:\Users\Adam\AppData\Roaming\Adobe
2010-04-19 21:15:43 ----D---- C:\Program Files (x86)\ATI Technologies
2010-04-19 21:13:07 ----D---- C:\ProgramData\ashampoo
2010-04-19 21:11:48 ----D---- C:\Program Files (x86)\Mozilla Firefox
2010-04-19 21:11:44 ----D---- C:\ProgramData\Adobe
2010-04-19 21:11:43 ----D---- C:\Program Files (x86)\Common Files\Adobe
2010-04-19 21:11:43 ----D---- C:\Program Files (x86)\Adobe
2010-04-19 21:11:01 ----D---- C:\ProgramData\DAEMON Tools Lite
2010-04-19 21:10:21 ----D---- C:\Windows\system32\Macromed
2010-04-19 21:00:24 ----D---- C:\ProgramData\Kaspersky Lab
2010-04-19 20:59:49 ----D---- C:\Users\Adam\AppData\Roaming\Mozilla
2010-04-19 20:51:30 ----SHD---- C:\Windows\Installer
2010-04-19 20:40:53 ----A---- C:\Windows\system32\wintrust.dll
2010-04-19 20:40:53 ----A---- C:\Windows\system32\cabview.dll
2010-04-19 20:39:36 ----D---- C:\Users\Adam\AppData\Roaming\Identities
2010-04-19 20:39:19 ----SD---- C:\Users\Adam\AppData\Roaming\Microsoft
2010-04-19 20:39:19 ----D---- C:\Users\Adam\AppData\Roaming\Media Center Programs
2010-04-19 20:39:06 ----SHD---- C:\Recovery
2010-04-19 20:39:06 ----SHD---- C:\ProgramData\Šablony
2010-04-19 20:39:06 ----SHD---- C:\ProgramData\Plocha
2010-04-19 20:39:06 ----SHD---- C:\ProgramData\Oblíbené položky
2010-04-19 20:39:06 ----SHD---- C:\ProgramData\Nabídka Start
2010-04-19 20:39:06 ----SHD---- C:\ProgramData\Dokumenty
2010-04-19 20:39:06 ----SHD---- C:\ProgramData\Data aplikací
2010-04-19 20:34:02 ----D---- C:\Windows\SoftwareDistribution
2010-04-19 20:31:33 ----D---- C:\Windows\Prefetch
2010-04-19 20:31:14 ----SHD---- C:\System Volume Information

======List of files/folders modified in the last 1 months======

2010-05-01 12:21:16 ----D---- C:\Windows\Temp
2010-05-01 09:12:07 ----RD---- C:\Program Files (x86)
2010-05-01 08:31:07 ----D---- C:\Windows
2010-05-01 08:30:38 ----D---- C:\Windows\Tasks
2010-05-01 08:20:56 ----D---- C:\Windows\system32\drivers
2010-05-01 08:20:35 ----D---- C:\Windows\SysWOW64
2010-05-01 08:20:34 ----D---- C:\Windows\inf
2010-05-01 08:19:29 ----HD---- C:\ProgramData
2010-04-30 21:51:50 ----D---- C:\Windows\System32
2010-04-30 18:53:15 ----D---- C:\Windows\Logs
2010-04-28 15:17:44 ----D---- C:\Windows\winsxs
2010-04-26 19:19:05 ----RD---- C:\Program Files
2010-04-22 16:02:24 ----D---- C:\Windows\rescache
2010-04-22 15:21:59 ----RSD---- C:\Windows\assembly
2010-04-22 15:21:56 ----D---- C:\Windows\Microsoft.NET
2010-04-20 16:52:16 ----SD---- C:\ProgramData\Microsoft
2010-04-20 16:51:30 ----D---- C:\Program Files (x86)\Common Files\microsoft shared
2010-04-20 07:29:14 ----D---- C:\Program Files (x86)\Windows Media Player
2010-04-20 07:29:14 ----D---- C:\Program Files (x86)\Internet Explorer
2010-04-20 07:29:13 ----D---- C:\Windows\system32\cs-CZ
2010-04-20 07:29:13 ----D---- C:\Windows\AppPatch
2010-04-20 07:29:11 ----D---- C:\Windows\ehome
2010-04-20 07:21:22 ----D---- C:\Windows\debug
2010-04-19 22:42:29 ----RSD---- C:\Windows\Media
2010-04-19 22:29:34 ----D---- C:\Program Files (x86)\Common Files
2010-04-19 22:04:43 ----RSD---- C:\Windows\Fonts
2010-04-19 22:02:52 ----D---- C:\Windows\ShellNew
2010-04-19 21:42:37 ----D---- C:\Windows\twain_32
2010-04-19 20:39:31 ----SHD---- C:\$Recycle.Bin
2010-04-19 20:39:16 ----RD---- C:\Users

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 blbdrive;blbdrive; C:\Windows\system32\DRIVERS\blbdrive.sys []
R1 DfsC;@%systemroot%\system32\drivers\dfsc.sys,-101; C:\Windows\System32\Drivers\dfsc.sys []
R1 discache;@%systemroot%\system32\drivers\discache.sys,-102; C:\Windows\System32\drivers\discache.sys []
R1 F-Secure HIPS;F-Secure HIPS Driver; \??\C:\Program Files (x86)\F-Secure\HIPS\drivers\fshs.sys [2009-07-09 57920]
R1 FSES;F-Secure Email Scanning Driver; C:\Windows\System32\drivers\fses.sys []
R1 FSFW;F-Secure Firewall Driver; C:\Windows\System32\drivers\fsdfw.sys []
R1 fsvista;F-Secure Vista Support Driver; \??\C:\Program Files (x86)\F-Secure\Anti-Virus\minifilter\fsvista.sys [2009-07-09 14904]
R1 NCPro;NCPro; C:\Windows\system32\drivers\MTictwl.sys [2006-08-28 13312]
R1 nsiproxy;@%SystemRoot%\system32\drivers\nsiproxy.sys,-2; C:\Windows\system32\drivers\nsiproxy.sys []
R1 RDPENCDD;@%systemroot%\system32\drivers\RDPENCDD.sys,-101; C:\Windows\system32\drivers\rdpencdd.sys []
R1 RDPREFMP;@%systemroot%\system32\drivers\RdpRefMp.sys,-101; C:\Windows\system32\drivers\rdprefmp.sys []
R1 tdx;@%SystemRoot%\system32\tcpipcfg.dll,-50004; C:\Windows\system32\DRIVERS\tdx.sys []
R1 Wanarpv6;@%systemroot%\system32\rascfg.dll,-32012; C:\Windows\system32\DRIVERS\wanarp.sys []
R1 WfpLwf;WFP Lightweight Filter; C:\Windows\system32\DRIVERS\wfplwf.sys []
R2 lltdio;Link-Layer Topology Discovery Mapper I/O Driver; C:\Windows\system32\DRIVERS\lltdio.sys []
R2 luafv;@%systemroot%\system32\drivers\luafv.sys,-100; C:\Windows\system32\drivers\luafv.sys []
R2 PEAUTH;PEAUTH; C:\Windows\system32\drivers\peauth.sys []
R2 rspndr;Link-Layer Topology Discovery Responder; C:\Windows\system32\DRIVERS\rspndr.sys []
R2 tcpipreg;TCP/IP Registry Compatibility; C:\Windows\System32\drivers\tcpipreg.sys []
R3 1394ohci;Hostitelský řadič pro rozhraní OHCI standardu 1394; C:\Windows\system32\DRIVERS\1394ohci.sys []
R3 AmdK8;Ovladač procesoru AMD K8; C:\Windows\system32\DRIVERS\amdk8.sys []
R3 AtiHdmiService;ATI Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\AtiHdmi.sys []
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys []
R3 bowser;@%systemroot%\system32\browser.dll,-102; C:\Windows\system32\DRIVERS\bowser.sys []
R3 CompositeBus;Ovladač rozpoznávacího modulu složené sběrnice; C:\Windows\system32\DRIVERS\CompositeBus.sys []
R3 DXGKrnl;LDDM Graphics Subsystem; C:\Windows\System32\drivers\dxgkrnl.sys []
R3 F-Secure Gatekeeper;F-Secure Gatekeeper; \??\C:\Program Files (x86)\F-Secure\Anti-Virus\minifilter\fsgk.sys [2010-05-01 167104]
R3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys []
R3 HdAudAddService;Ovladač funkce Microsoft 1.1 UAA pro službu zvuku High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys []
R3 HDAudBus;Ovladač sběrnice Microsoft UAA pro zvuk High Definition Audio; C:\Windows\system32\DRIVERS\HDAudBus.sys []
R3 HidUsb;Ovladač třídy standardu HID Microsoft; C:\Windows\system32\DRIVERS\hidusb.sys []
R3 kbdhid;Ovladač klávesnice standardu HID; C:\Windows\system32\DRIVERS\kbdhid.sys []
R3 ksthunk;Kernel Streaming Thunks; C:\Windows\system32\drivers\ksthunk.sys []
R3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver; C:\Windows\system32\drivers\LGBusEnum.sys []
R3 LHidFilt;Logitech SetPoint KMDF HID Filter Driver; C:\Windows\system32\DRIVERS\LHidFilt.Sys []
R3 LMouFilt;Logitech SetPoint KMDF Mouse Filter Driver; C:\Windows\system32\DRIVERS\LMouFilt.Sys []
R3 LUsbFilt;Logitech SetPoint KMDF USB Filter; C:\Windows\System32\Drivers\LUsbFilt.Sys []
R3 monitor;Služba ovladače funkce třídy monitorů Microsoft; C:\Windows\system32\DRIVERS\monitor.sys []
R3 mouhid;Ovladač myši standardu HID; C:\Windows\system32\DRIVERS\mouhid.sys []
R3 mpsdrv;@%SystemRoot%\system32\FirewallAPI.dll,-23092; C:\Windows\System32\drivers\mpsdrv.sys []
R3 mrxsmb10;@%systemroot%\system32\wkssvc.dll,-1004; C:\Windows\system32\DRIVERS\mrxsmb10.sys []
R3 mrxsmb20;@%systemroot%\system32\wkssvc.dll,-1006; C:\Windows\system32\DRIVERS\mrxsmb20.sys []
R3 MTsensor;ATK0110 ACPI UTILITY; C:\Windows\system32\DRIVERS\ASACPI.sys []
R3 RasAgileVpn;WAN Miniport (IKEv2); C:\Windows\system32\DRIVERS\AgileVpn.sys []
R3 RasSstp;@%systemroot%\system32\sstpsvc.dll,-202; C:\Windows\system32\DRIVERS\rassstp.sys []
R3 srv2;@%systemroot%\system32\srvsvc.dll,-104; C:\Windows\System32\DRIVERS\srv2.sys []
R3 srvnet;srvnet; C:\Windows\System32\DRIVERS\srvnet.sys []
R3 tunnel;Microsoft Tunnel Miniport Adapter Driver; C:\Windows\system32\DRIVERS\tunnel.sys []
R3 umbus;Ovladač sběrnice UMBus Enumerator; C:\Windows\system32\DRIVERS\umbus.sys []
R3 usbaudio;Ovladač zvuků USB (WDM); C:\Windows\system32\drivers\usbaudio.sys []
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\Windows\system32\DRIVERS\usbccgp.sys []
R3 usbehci;Ovladač miniportu vylepšeného hostitelského řadiče Microsoft USB 2.0; C:\Windows\system32\DRIVERS\usbehci.sys []
R3 usbhub;Ovladač standardního rozbočovače USB; C:\Windows\system32\DRIVERS\usbhub.sys []
R3 usbohci;Ovladač miniportu otevřeného hostitelského řadiče Microsoft USB; C:\Windows\system32\DRIVERS\usbohci.sys []
R3 WudfPf;User Mode Driver Frameworks Platform Driver; C:\Windows\system32\drivers\WudfPf.sys []
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys []
R3 yukonw7;Ovladač NDIS6.2 Miniport pro řadič Marvell Yukon Ethernet Controller; C:\Windows\system32\DRIVERS\yk62x64.sys []
S3 AcpiPmi;ACPI Power Meter Driver; C:\Windows\system32\DRIVERS\acpipmi.sys []
S3 adp94xx;adp94xx; C:\Windows\system32\DRIVERS\adp94xx.sys []
S3 adpahci;adpahci; C:\Windows\system32\DRIVERS\adpahci.sys []
S3 adpu320;adpu320; C:\Windows\system32\DRIVERS\adpu320.sys []
S3 agp440;Intel AGP Bus Filter; C:\Windows\system32\DRIVERS\agp440.sys []
S3 amdide;amdide; C:\Windows\system32\DRIVERS\amdide.sys []
S3 AmdPPM;AMD Processor Driver; C:\Windows\system32\DRIVERS\amdppm.sys []
S3 amdsata;amdsata; C:\Windows\system32\DRIVERS\amdsata.sys []
S3 amdsbs;amdsbs; C:\Windows\system32\DRIVERS\amdsbs.sys []
S3 anqqk6d8;anqqk6d8; C:\Windows\system32\drivers\anqqk6d8.sys []
S3 AppID;@%systemroot%\system32\appidsvc.dll,-102; C:\Windows\system32\drivers\appid.sys []
S3 arc;arc; C:\Windows\system32\DRIVERS\arc.sys []
S3 arcsas;arcsas; C:\Windows\system32\DRIVERS\arcsas.sys []
S3 b06bdrv;Broadcom NetXtreme II VBD; C:\Windows\system32\DRIVERS\bxvbda.sys []
S3 b57nd60a;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60a.sys []
S3 BrFiltLo;Brother USB Mass-Storage Lower Filter Driver; C:\Windows\system32\DRIVERS\BrFiltLo.sys []
S3 BrFiltUp;Brother USB Mass-Storage Upper Filter Driver; C:\Windows\system32\DRIVERS\BrFiltUp.sys []
S3 Brserid;Brother MFC Serial Port Interface Driver (WDM); C:\Windows\System32\Drivers\Brserid.sys []
S3 BrSerWdm;Brother WDM Serial driver; C:\Windows\System32\Drivers\BrSerWdm.sys []
S3 BrUsbMdm;Brother MFC USB Fax Only Modem; C:\Windows\System32\Drivers\BrUsbMdm.sys []
S3 BrUsbSer;Brother MFC USB Serial WDM Driver; C:\Windows\System32\Drivers\BrUsbSer.sys []
S3 BTHMODEM;Bluetooth Serial Communications Driver; C:\Windows\system32\DRIVERS\bthmodem.sys []
S3 circlass;Consumer IR Devices; C:\Windows\system32\DRIVERS\circlass.sys []
S3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\Windows\system32\DRIVERS\CmBatt.sys []
S3 Compbatt;Compbatt; C:\Windows\system32\DRIVERS\compbatt.sys []
S3 ebdrv;Broadcom NetXtreme II 10 GigE VBD; C:\Windows\system32\DRIVERS\evbda.sys []
S3 elxstor;elxstor; C:\Windows\system32\DRIVERS\elxstor.sys []
S3 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\DRIVERS\errdev.sys []
S3 exfat;exFAT File System Driver; C:\Windows\system32\drivers\exfat.sys []
S3 Filetrace;@%SystemRoot%\system32\drivers\filetrace.sys,-10001; C:\Windows\system32\drivers\filetrace.sys []
S3 FsDepends;@%SystemRoot%\system32\drivers\fsdepends.sys,-10001; C:\Windows\System32\drivers\FsDepends.sys []
S3 gagp30kx;Microsoft Generic AGPv3.0 Filter for K8 Processor Platforms; C:\Windows\system32\DRIVERS\gagp30kx.sys []
S3 hcw85cir;Hauppauge Consumer Infrared Receiver; C:\Windows\system32\drivers\hcw85cir.sys []
S3 HidBatt;HID UPS Battery Driver; C:\Windows\system32\DRIVERS\HidBatt.sys []
S3 HidBth;Microsoft Bluetooth HID Miniport; C:\Windows\system32\DRIVERS\hidbth.sys []
S3 HidIr;Microsoft Infrared HID Driver; C:\Windows\system32\DRIVERS\hidir.sys []
S3 HpSAMD;HpSAMD; C:\Windows\system32\DRIVERS\HpSAMD.sys []
S3 iaStorV;iaStorV; C:\Windows\system32\DRIVERS\iaStorV.sys []
S3 iirsp;iirsp; C:\Windows\system32\DRIVERS\iirsp.sys []
S3 intelide;intelide; C:\Windows\system32\DRIVERS\intelide.sys []
S3 intelppm;Intel Processor Driver; C:\Windows\system32\DRIVERS\intelppm.sys []
S3 IPMIDRV;IPMIDRV; C:\Windows\system32\DRIVERS\IPMIDrv.sys []
S3 isapnp;isapnp; C:\Windows\system32\DRIVERS\isapnp.sys []
S3 iScsiPrt;iScsiPort Driver; C:\Windows\system32\DRIVERS\msiscsi.sys []
S3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver; C:\Windows\system32\drivers\LGVirHid.sys []
S3 LSI_FC;LSI_FC; C:\Windows\system32\DRIVERS\lsi_fc.sys []
S3 LSI_SAS;LSI_SAS; C:\Windows\system32\DRIVERS\lsi_sas.sys []
S3 LSI_SAS2;LSI_SAS2; C:\Windows\system32\DRIVERS\lsi_sas2.sys []
S3 LSI_SCSI;LSI_SCSI; C:\Windows\system32\DRIVERS\lsi_scsi.sys []
S3 MagicTune;MagicTune; C:\Windows\system32\drivers\MTiCtwl.sys [2006-08-28 13312]
S3 megasas;megasas; C:\Windows\system32\DRIVERS\megasas.sys []
S3 MegaSR;MegaSR; C:\Windows\system32\DRIVERS\MegaSR.sys []
S3 mpio;mpio; C:\Windows\system32\DRIVERS\mpio.sys []
S3 msahci;msahci; C:\Windows\system32\DRIVERS\msahci.sys []
S3 msdsm;msdsm; C:\Windows\system32\DRIVERS\msdsm.sys []
S3 mshidkmdf;@%SystemRoot%\system32\drivers\mshidkmdf.sys,-100; C:\Windows\System32\drivers\mshidkmdf.sys []
S3 MsRPC;MsRPC; C:\Windows\system32\drivers\MsRPC.sys []
S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; C:\Windows\system32\drivers\MSTEE.sys []
S3 MTConfig;Microsoft Input Configuration Driver; C:\Windows\system32\DRIVERS\MTConfig.sys []
S3 NativeWifiP;NativeWiFi Filter; C:\Windows\system32\DRIVERS\nwifi.sys []
S3 NdisCap;NDIS Capture LightWeight Filter; C:\Windows\system32\DRIVERS\ndiscap.sys []
S3 nfrd960;nfrd960; C:\Windows\system32\DRIVERS\nfrd960.sys []
S3 nv_agp;NVIDIA nForce AGP Bus Filter; C:\Windows\system32\DRIVERS\nv_agp.sys []
S3 nvraid;nvraid; C:\Windows\system32\DRIVERS\nvraid.sys []
S3 nvstor;nvstor; C:\Windows\system32\DRIVERS\nvstor.sys []
S3 ohci1394;1394 OHCI Compliant Host Controller (Legacy); C:\Windows\system32\DRIVERS\ohci1394.sys []
S3 ql2300;ql2300; C:\Windows\system32\DRIVERS\ql2300.sys []
S3 ql40xx;ql40xx; C:\Windows\system32\DRIVERS\ql40xx.sys []
S3 QWAVEdrv;@%SystemRoot%\system32\drivers\qwavedrv.sys,-1; C:\Windows\system32\drivers\qwavedrv.sys []
S3 rdpbus;Remote Desktop Device Redirector Bus Driver; C:\Windows\system32\DRIVERS\rdpbus.sys []
S3 sbp2port;sbp2port; C:\Windows\system32\DRIVERS\sbp2port.sys []
S3 scfilter;@%SystemRoot%\System32\drivers\scfilter.sys,-11; C:\Windows\System32\DRIVERS\scfilter.sys []
S3 sermouse;Serial Mouse Driver; C:\Windows\system32\DRIVERS\sermouse.sys []
S3 sffdisk;SFF Storage Class Driver; C:\Windows\system32\DRIVERS\sffdisk.sys []
S3 sffp_mmc;SFF Storage Protocol Driver for MMC; C:\Windows\system32\DRIVERS\sffp_mmc.sys []
S3 sffp_sd;SFF Storage Protocol Driver for SDBus; C:\Windows\system32\DRIVERS\sffp_sd.sys []
S3 SiSRaid2;SiSRaid2; C:\Windows\system32\DRIVERS\SiSRaid2.sys []
S3 SiSRaid4;SiSRaid4; C:\Windows\system32\DRIVERS\sisraid4.sys []
S3 Smb;@%SystemRoot%\system32\tcpipcfg.dll,-50005; C:\Windows\system32\DRIVERS\smb.sys []
S3 stexstor;stexstor; C:\Windows\system32\DRIVERS\stexstor.sys []
S3 TCPIP6;Microsoft IPv6 Protocol Driver; C:\Windows\system32\DRIVERS\tcpip.sys []
S3 tssecsrv;@%SystemRoot%\System32\DRIVERS\tssecsrv.sys,-101; C:\Windows\System32\DRIVERS\tssecsrv.sys []
S3 uagp35;Microsoft AGPv3.5 Filter; C:\Windows\system32\DRIVERS\uagp35.sys []
S3 uliagpkx;Uli AGP Bus Filter; C:\Windows\system32\DRIVERS\uliagpkx.sys []
S3 UmPass;Microsoft UMPass Driver; C:\Windows\system32\DRIVERS\umpass.sys []
S3 usbcir;eHome Infrared Receiver (USBCIR); C:\Windows\system32\DRIVERS\usbcir.sys []
S3 usbprint;Třída USB Printer; C:\Windows\system32\DRIVERS\usbprint.sys []
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys []
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\Windows\system32\DRIVERS\USBSTOR.SYS []
S3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\Windows\system32\DRIVERS\usbuhci.sys []
S3 vga;vga; C:\Windows\system32\DRIVERS\vgapnp.sys []
S3 vhdmp;vhdmp; C:\Windows\system32\DRIVERS\vhdmp.sys []
S3 vsmraid;vsmraid; C:\Windows\system32\DRIVERS\vsmraid.sys []
S3 vwifibus;@%SystemRoot%\System32\drivers\vwifibus.sys,-257; C:\Windows\System32\drivers\vwifibus.sys []
S3 WacomPen;Wacom Serial Pen HID Driver; C:\Windows\system32\DRIVERS\wacompen.sys []
S3 Wd;Wd; C:\Windows\system32\DRIVERS\wd.sys []
S3 WIMMount;WIMMount; C:\Windows\system32\drivers\wimmount.sys [2009-07-14 19008]
S3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\DRIVERS\wmiacpi.sys []
S4 crcdisk;Crcdisk Filter Driver; C:\Windows\system32\DRIVERS\crcdisk.sys []
S4 F-Secure Filter;F-Secure File System Filter; \??\C:\Program Files (x86)\F-Secure\Anti-Virus\Win2K\FSfilter.sys [2009-07-09 39776]
S4 F-Secure Recognizer;F-Secure File System Recognizer; \??\C:\Program Files (x86)\F-Secure\Anti-Virus\Win2K\FSrec.sys [2009-07-09 25184]
S4 ws2ifsl;@%systemroot%\System32\drivers\ws2ifsl.sys,-1000; C:\Windows\system32\drivers\ws2ifsl.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe []
R2 AudioEndpointBuilder;@%SystemRoot%\system32\audiosrv.dll,-204; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 BFE;@%SystemRoot%\system32\bfe.dll,-1001; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 DPS;@%systemroot%\system32\dps.dll,-500; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 FDResPub;@%systemroot%\system32\fdrespub.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 F-Secure Gatekeeper Handler Starter;FSGKHS; C:\Program Files (x86)\F-Secure\Anti-Virus\fsgk32st.exe [2009-07-09 215648]
R2 FSMA;F-Secure Management Agent; C:\Program Files (x86)\F-Secure\Common\FSMA32.EXE [2009-07-09 186976]
R2 gpsvc;@gpapi.dll,-112; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 IKEEXT;@%SystemRoot%\system32\ikeext.dll,-501; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 iphlpsvc;@%SystemRoot%\system32\iphlpsvc.dll,-500; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 MMCSS;@%systemroot%\system32\mmcss.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 MpsSvc;@%SystemRoot%\system32\FirewallAPI.dll,-23090; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 NlaSvc;@%SystemRoot%\System32\nlasvc.dll,-1; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 nsi;@%SystemRoot%\system32\nsisvc.dll,-200; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 PcaSvc;@%SystemRoot%\system32\pcasvc.dll,-1; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 Power;@%SystemRoot%\system32\umpo.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 ProfSvc;@%systemroot%\system32\profsvc.dll,-300; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 RpcEptMapper;@%windir%\system32\RpcEpMap.dll,-1001; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 SysMain;@%SystemRoot%\system32\sysmain.dll,-1000; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 UxSms;@%SystemRoot%\system32\dwm.exe,-2000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 WinDefend;@%ProgramFiles%\Windows Defender\MsMpRes.dll,-103; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 WMPNetworkSvc;@%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101; C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe []
R2 WSearch;@%systemroot%\system32\SearchIndexer.exe,-103; C:\Windows\system32\SearchIndexer.exe [2009-07-14 428032]
R2 wudfsvc;@%SystemRoot%\system32\wudfsvc.dll,-1000; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R3 AeLookupSvc;@%SystemRoot%\system32\aelupsvc.dll,-1; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R3 fdPHost;@%systemroot%\system32\fdPHost.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R3 FSDFWD;F-Secure Anti-Virus Firewall Daemon; C:\Program Files (x86)\F-Secure\FWES\Program\fsdfwd.exe [2010-05-01 844384]
R3 FSORSPClient;F-Secure ORSP Client; C:\Program Files (x86)\F-Secure\ORSP Client\fsorsp.exe [2010-05-01 55992]
R3 HomeGroupListener;@%SystemRoot%\System32\ListSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R3 HomeGroupProvider;@%SystemRoot%\System32\provsvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R3 KeyIso;@keyiso.dll,-100; C:\Windows\system32\lsass.exe []
R3 netprofm;@%SystemRoot%\system32\netprofm.dll,-202; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R3 p2pimsvc;@%SystemRoot%\system32\pnrpsvc.dll,-8004; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R3 p2psvc;@%SystemRoot%\system32\p2psvc.dll,-8006; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R3 PNRPsvc;@%SystemRoot%\system32\pnrpsvc.dll,-8000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R3 TrustedInstaller;@%SystemRoot%\servicing\TrustedInstaller.exe,-100; C:\Windows\servicing\TrustedInstaller.exe [2009-07-14 194048]
R3 WdiServiceHost;@%systemroot%\system32\wdi.dll,-502; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R3 WinHttpAutoProxySvc;@%SystemRoot%\system32\winhttp.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S2 sppsvc;@%SystemRoot%\system32\sppsvc.exe,-101; C:\Windows\system32\sppsvc.exe []
S3 AppIDSvc;@%systemroot%\system32\appidsvc.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 Appinfo;@%systemroot%\system32\appinfo.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 AxInstSV;@%SystemRoot%\system32\AxInstSV.dll,-103; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 BDESVC;@%SystemRoot%\system32\bdesvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 bthserv;@%SystemRoot%\System32\bthserv.dll,-101; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 CertPropSvc;@%SystemRoot%\System32\certprop.dll,-11; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 clr_optimization_v2.0.50727_32;Microsoft .NET Framework NGEN v2.0.50727_X86; C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2009-06-10 66384]
S3 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64; C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [2009-06-10 89920]
S3 defragsvc;@%SystemRoot%\system32\defragsvc.dll,-101; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 EFS;@%SystemRoot%\system32\efssvc.dll,-100; C:\Windows\System32\lsass.exe []
S3 ehRecvr;@%SystemRoot%\ehome\ehrecvr.exe,-101; C:\Windows\ehome\ehRecvr.exe [2009-07-14 696832]
S3 ehSched;@%SystemRoot%\ehome\ehsched.exe,-101; C:\Windows\ehome\ehsched.exe [2009-07-14 127488]
S3 Fax;@%systemroot%\system32\fxsresm.dll,-118; C:\Windows\system32\fxssvc.exe []
S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 FontCache3.0.0.0;@%SystemRoot%\system32\PresentationHost.exe,-3309; C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [2009-06-10 42840]
S3 idsvc;@%systemroot%\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelInstallRC.dll,-8193; C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe [2009-06-10 856384]
S3 IPBusEnum;@%systemroot%\system32\IPBusEnum.dll,-102; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 KtmRm;@comres.dll,-2946; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 LBTServ;Logitech Bluetooth Service; C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe [2010-01-29 357456]
S3 lltdsvc;@%SystemRoot%\system32\lltdres.dll,-1; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 MSiSCSI;@%SystemRoot%\system32\iscsidsc.dll,-5000; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PerfHost;@%systemroot%\sysWow64\perfhost.exe,-2; C:\Windows\SysWow64\perfhost.exe [2009-07-14 20992]
S3 pla;@%systemroot%\system32\pla.dll,-500; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 PNRPAutoReg;@%SystemRoot%\system32\pnrpauto.dll,-8002; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 QWAVE;@%SystemRoot%\system32\qwave.dll,-1; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 SCPolicySvc;@%SystemRoot%\System32\certprop.dll,-13; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 SDRSVC;@%SystemRoot%\system32\sdrsvc.dll,-107; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 SensrSvc;@%SystemRoot%\System32\sensrsvc.dll,-1000; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 SessionEnv;@%SystemRoot%\System32\SessEnv.dll,-1026; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 SNMPTRAP;@%SystemRoot%\system32\snmptrap.exe,-3; C:\Windows\System32\snmptrap.exe []
S3 sppuinotify;@%SystemRoot%\system32\sppuinotify.dll,-103; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 SstpSvc;@%SystemRoot%\system32\sstpsvc.dll,-200; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 TabletInputService;@%SystemRoot%\system32\TabSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 TBS;@%SystemRoot%\system32\tbssvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 THREADORDER;@%systemroot%\system32\mmcss.dll,-102; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 UI0Detect;@%SystemRoot%\system32\ui0detect.exe,-101; C:\Windows\system32\UI0Detect.exe []
S3 VaultSvc;@%SystemRoot%\system32\vaultsvc.dll,-1003; C:\Windows\system32\lsass.exe []
S3 vds;@%SystemRoot%\system32\vds.exe,-100; C:\Windows\System32\vds.exe []
S3 wbengine;@%systemroot%\system32\wbengine.exe,-104; C:\Windows\system32\wbengine.exe []
S3 WbioSrvc;@%systemroot%\system32\wbiosrvc.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 wcncsvc;@%SystemRoot%\system32\wcncsvc.dll,-3; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WcsPlugInService;@%SystemRoot%\system32\WcsPlugInService.dll,-200; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 WdiSystemHost;@%systemroot%\system32\wdi.dll,-500; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 Wecsvc;@%SystemRoot%\system32\wecsvc.dll,-200; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 wercplsupport;@%SystemRoot%\System32\wercplsupport.dll,-101; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WerSvc;@%SystemRoot%\System32\wersvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WinRM;@%Systemroot%\system32\wsmsvc.dll,-101; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 Wlansvc;@%SystemRoot%\System32\wlansvc.dll,-257; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 WPCSvc;@%SystemRoot%\system32\wpcsvc.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 WPDBusEnum;@%SystemRoot%\system32\wpdbusenum.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 WwanSvc;@%SystemRoot%\System32\wwansvc.dll,-257; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S4 Mcx2Svc;@%SystemRoot%\ehome\ehres.dll,-15501; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S4 NetTcpPortSharing;@%systemroot%\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelInstallRC.dll,-8201; C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe [2009-06-10 116560]

-----------------EOF-----------------

Re: W32/Malware!Gemini

Napsal: 01 kvě 2010 11:36
od Rudy
Proveďte kompletní sken MBAM: http://www.malwarebytes.org/mbam.php a dejte log. Předem nic nemažte.

Re: W32/Malware!Gemini

Napsal: 01 kvě 2010 12:46
od -Next-
Log z MBAM

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verze databáze: 4056

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

1.5.2010 13:45:29
mbam-log-2010-05-01 (13-45-29).txt

Typ skenu: Úplný sken (C:\|D:\|)
Skenované objekty: 196396
Uplynulý čas: 20 minuta(y), 12 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované složky: 0
Infikované soubory: 1

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\ubiorbitapi_r2.dll (Trojan.Agent.CK) -> No action taken.

Re: W32/Malware!Gemini

Napsal: 01 kvě 2010 18:05
od Rudy
Soubor C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\ubiorbitapi_r2.dll nejdřív otestujte na www.virustotal.com . Výsledek oznamte.

Re: W32/Malware!Gemini

Napsal: 01 kvě 2010 18:19
od -Next-
Výsledek testu z VirusTotalu

http://www.virustotal.com/cs/analisis/b ... 1272734203

Re: W32/Malware!Gemini

Napsal: 01 kvě 2010 18:38
od Rudy
OK. Soubor smažte.

Re: W32/Malware!Gemini

Napsal: 01 kvě 2010 19:09
od -Next-
Hotovo. Přikládám log a jdu na restart počítače.

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verze databáze: 4056

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

1.5.2010 20:08:53
mbam-log-2010-05-01 (20-08-53).txt

Typ skenu: Úplný sken (C:\|)
Skenované objekty: 191624
Uplynulý čas: 22 minuta(y), 55 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované složky: 0
Infikované soubory: 1

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\ubiorbitapi_r2.dll (Trojan.Agent.CK) -> Quarantined and deleted successfully.

Re: W32/Malware!Gemini

Napsal: 01 kvě 2010 19:17
od -Next-
Vše v pořádku, můžeme případně pokračovat

Re: W32/Malware!Gemini

Napsal: 01 kvě 2010 20:10
od Rudy
Soubor byl smazán. Nastala nějaká změna?

Re: W32/Malware!Gemini

Napsal: 01 kvě 2010 20:25
od -Next-
Přestala mi fungovat hra Assassins Creed II, píše mi to, že nebyl nalezen ubisoft launcher. Předpokládám ten soubor, co byl smazán.

Re: W32/Malware!Gemini

Napsal: 01 kvě 2010 21:50
od Rudy
Předpokládám, že ano. Podle virustotal to byl ale vir. Ve kterém souboru našel F-Secure malware?

Re: W32/Malware!Gemini

Napsal: 01 kvě 2010 22:22
od -Next-
V programu nircmd.exe

Re: W32/Malware!Gemini

Napsal: 01 kvě 2010 22:53
od Rudy
Otestujte soubor online na www.virustotal.com.

Re: W32/Malware!Gemini

Napsal: 02 kvě 2010 06:21
od -Next-
Výsledek testu z VirusTotalu

http://www.virustotal.com/cs/analisis/4 ... 1272777478

Re: W32/Malware!Gemini

Napsal: 02 kvě 2010 10:10
od Rudy
Ano, byl to on. Máte na vybranou: buď budete hrát Assassins Creed II a budete mít zaplevelené PC, nebo tu hru hrát nebudete a vaše PC bude čisté. Nebyl to náhodou crack?
Všechny časy jsou v UTC+01:00
Stránka 1 z 2

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz