Win32/Mebroot.K trojský kůň

[davem]

Zdravim,

NOD 32 mi začal hlásit: MBR sektor 1. fyzického disku - Win32/Mebroot.K trojský kůň. Prosím o pomoc

Log:


Logfile of random's system information tool 1.08 (written by random/random)
Run by Jan at 2010-08-16 18:00:48
Microsoft® Windows Vista™ Ultimate Service Pack 1
System drive C: has 24 GB (26%) free of 90 GB
Total RAM: 3582 MB (43% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:01, on 2010-08-16
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\epson\Creativity Suite\Event Manager\EEventManager.exe
C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
C:\Program Files\CyberLink\Shared Files\brs.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Java\jre6\launch4j-tmp\frd.exe
C:\Program Files\epson\Creativity Suite\Copy Utility\ECOPY.EXE
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Jan\Desktop\RSIT.exe
C:\Program Files\trend micro\Jan.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [EEventManager] C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [RemoteControl8] "C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe"
O4 - HKLM\..\Run: [PDVD8LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe"
O4 - HKLM\..\Run: [BDRegion] C:\Program Files\Cyberlink\Shared Files\brs.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe"
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: FreeRapid 0.83u1.lnk = C:\Users\Jan\Desktop\FreeRapid-0.83u1\frd.exe
O8 - Extra context menu item: &Stáhnout FlashGetem - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Stáhnout všechny FlashGetem - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O16 - DPF: {A3E21079-7F41-4125-9EBB-FD44CFCC0AC1} (WLCTSCControl Class) - https://www.mesh.com/0.9.4014.28/TSWeb.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe
O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe

--
End of file - 8113 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Ad-Aware Update (Weekly).job
C:\Windows\tasks\User_Feed_Synchronization-{13C540E2-2E69-4923-A003-E4D3D7B77E21}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Podpora odkazu pro Adobe PDF Reader - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2F364306-AA45-47B5-9F9D-39A8B94E7EF7}]
FGCatchUrl - C:\Program Files\FlashGet\jccatch.dll [2007-08-06 94308]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2008-09-13 308856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-07-13 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F156768E-81EF-470C-9057-481BA8380DBA}]
FlashGet GetFlash Class - C:\Program Files\FlashGet\getflash.dll [2007-05-18 163840]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvSvc"=C:\Windows\system32\nvsvc.dll [2007-12-11 86016]
"NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2007-12-11 8530464]
"NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2007-12-11 81920]
"NBKeyScan"=C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [2008-06-08 2221352]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2008-02-13 4915200]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]
"EEventManager"=C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe [2006-10-12 102400]
"Ad-Watch"=C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe [2010-03-07 524632]
"RemoteControl8"=C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe [2008-10-17 91432]
"PDVD8LanguageShortcut"=C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe [2007-12-14 50472]
"BDRegion"=C:\Program Files\Cyberlink\Shared Files\brs.exe [2009-01-20 75048]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-02-18 248040]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2010-07-02 2202704]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2008-05-21 1233920]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe [2008-06-24 1840424]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\daemon.exe [2008-12-10 216520]
"TomTomHOME.exe"=C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe [2010-06-24 247144]
"LightScribe Control Panel"=C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2009-04-13 2387968]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flashget]
C:\Program Files\FlashGet\flashget.exe [2007-09-25 2007088]

C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
FreeRapid 0.83u1.lnk - C:\Users\Jan\Desktop\FreeRapid-0.83u1\frd.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSEXESVC]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PSEXESVC]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLUA"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======List of files/folders created in the last 1 months======

2010-08-16 18:00:48 ----D---- C:\rsit
2010-08-16 18:00:48 ----D---- C:\Program Files\trend micro

======List of files/folders modified in the last 1 months======

2010-08-16 18:01:00 ----D---- C:\Windows\Prefetch
2010-08-16 18:00:51 ----D---- C:\Windows\temp
2010-08-16 18:00:48 ----RD---- C:\Program Files
2010-08-16 17:40:27 ----D---- C:\Downloads
2010-08-16 17:21:47 ----D---- C:\ProgramData\DVD Shrink
2010-08-16 16:48:45 ----SHD---- C:\System Volume Information
2010-08-16 13:41:08 ----A---- C:\Windows\NeroDigital.ini
2010-08-16 09:49:47 ----D---- C:\Windows\System32
2010-08-16 09:49:46 ----D---- C:\Windows\inf
2010-08-16 09:49:46 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-08-11 13:00:15 ----SHD---- C:\Windows\Installer
2010-08-11 13:00:04 ----D---- C:\Windows\system32\drivers
2010-08-06 13:13:17 ----D---- C:\Windows\system32\FxsTmp
2010-08-05 21:26:38 ----D---- C:\Windows\system32\catroot2
2010-08-02 06:41:37 ----D---- C:\Program Files\AIMP2
2010-07-25 08:42:06 ----D---- C:\Program Files\Mozilla Firefox

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 fvevol;BitLocker Drive Encryption Filter Driver; C:\Windows\System32\DRIVERS\fvevol.sys [2008-05-21 145464]
R0 Lbd;Lbd; C:\Windows\system32\DRIVERS\Lbd.sys [2009-05-04 64160]
R0 Pnp680r;Silicon Image SiI 0680 Medley Raid Controller; C:\Windows\system32\DRIVERS\pnp680r.sys [2007-07-19 110120]
R0 PxHelp20;PxHelp20; C:\Windows\system32\DRIVERS\PxHelp20.sys [2008-09-06 20016]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2009-01-01 717296]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2010-04-28 114984]
R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};Power Control [2009/04/25 13:23:15]; \??\C:\Program Files\CyberLink\PowerDVD8\000.fcl [2009-01-20 87536]
R2 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2010-06-24 136120]
R2 epfwwfpr;epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys [2010-04-28 96896]
R3 Afc;PPdus ASPI Shell; C:\Windows\system32\drivers\Afc.sys [2005-02-23 11776]
R3 BENDER;Pinnacle AV/DV2 Capture; C:\Windows\system32\drivers\bender.sys [2006-12-04 203264]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2008-02-14 2061528]
R3 MarvinBus;Pinnacle Marvin Bus; C:\Windows\system32\DRIVERS\MarvinBus.sys [2005-09-23 171520]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2007-12-11 8238688]
R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2008-01-25 106496]
R3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2008-05-21 35328]
S3 61883;61883 Unit Device; C:\Windows\system32\DRIVERS\61883.sys [2008-05-21 45696]
S3 a2vytu1q;a2vytu1q; C:\Windows\system32\drivers\a2vytu1q.sys []
S3 Avc;Zařízení AVC; C:\Windows\system32\DRIVERS\avc.sys [2008-05-21 40448]
S3 CrystalSysInfo;CrystalSysInfo; \??\C:\Program Files\MediaCoder\SysInfo.sys [2007-09-25 15152]
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\Windows\system32\drivers\drmkaud.sys [2008-05-21 5632]
S3 gdrv;gdrv; \??\C:\Windows\gdrv.sys [2009-06-10 16608]
S3 HdAudAddService;Ovladač funkce Microsoft 1.1 UAA pro službu zvuku High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 mbr;mbr; \??\C:\Users\Jan\AppData\Local\Temp\mbr.sys []
S3 MSDV;Microsoft DV Camera and VCR; C:\Windows\system32\DRIVERS\msdv.sys [2008-05-21 52608]
S3 MSKSSRV;Server proxy služby datových proudů Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-05-21 8192]
S3 MSPCLOCK;Server proxy hodin datových proudů Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-05-21 5888]
S3 MSPQM;Server proxy správce kvality datových proudů Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-05-21 5504]
S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-05-21 6016]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2008-05-21 39936]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-05-21 83328]
S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-05-21 6656]
S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-05-21 386616]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:\Program Files\Bonjour\mDNSResponder.exe [2006-02-28 229376]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2010-07-02 810144]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe [2010-03-07 1029456]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2009-04-13 73728]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [2006-10-26 335872]
R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe [2008-06-08 877864]
R2 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; C:\Windows\system32\IoctlSvc.exe [2006-12-19 81920]
R2 TomTomHOMEService;TomTomHOMEService; C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe [2010-06-24 92008]
R3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe [2008-06-24 537896]
S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2008-09-06 72704]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2010-07-02 33584]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2008-08-24 654848]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]

-----------------EOF-----------------

[Caroprd111]

Zdravím


Stáhněte a uložte http://download.bleepingcomputer.com/sUBs/ComboFix.exe na plochu.

• Vypněte všechny rezidentní bezpečnostní programy - firewally, antiviry, antispywary
• Vložte do PC všechny flash disky, které používáte.
• Spusťte aplikaci pod účtem s oprávněním Administrátora (Správce), ihned po startu se zobrazí stránka s licenčními podmínkami, pokračujte stisknutím tlačítka "Ano".
• Dále postupujte dle pokynů, během scanu nespouštějte jiné aplikace a neklikejte do zobrazujícího se okna
• Scan by měl trvat okolo 5 - 10 minut, po dokončení Combofix zobrazí log C:\ComboFix.txt , který sem vložte.
• Během skenování může být počítač restartován.

[davem]

diky za odpoved...

zde je log:


ComboFix 10-08-15.04 - Jan 2010-08-16 19:59:54.3.4 - x86
Microsoft® Windows Vista™ Ultimate 6.0.6001.1.1250.1.1029.18.3582.2137 [GMT 2:00]
Spuštěný z: c:\users\Jan\Desktop\ComboFix.exe
SP: Lavasoft Ad-Watch Live! *disabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Rezidentní štít AV je zapnutý

.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system\Color

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-07-16 do 2010-08-16 )))))))))))))))))))))))))))))))
.

2010-08-16 18:05 . 2010-08-16 18:07 -------- d-----w- c:\users\Jan\AppData\Local\temp
2010-08-16 18:05 . 2010-08-16 18:05 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-08-16 16:00 . 2010-08-16 16:01 -------- d-----w- C:\rsit
2010-08-16 16:00 . 2010-08-16 16:01 -------- d-----w- c:\program files\trend micro

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-16 18:03 . 2007-01-08 21:15 598652 ----a-w- c:\windows\system32\perfh005.dat
2010-08-16 18:03 . 2007-01-08 21:15 114808 ----a-w- c:\windows\system32\perfc005.dat
2010-08-16 16:27 . 2008-09-11 17:20 -------- d-----w- c:\program files\AIMP2
2010-08-16 15:21 . 2008-08-24 11:56 -------- d-----w- c:\programdata\DVD Shrink
2010-07-13 16:53 . 2010-07-13 16:53 -------- d-----w- c:\users\Jan\AppData\Roaming\VitySoft
2010-07-13 16:52 . 2010-07-13 16:52 -------- d-----w- c:\program files\Common Files\Java
2010-07-13 16:51 . 2010-07-13 16:52 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-07-13 16:51 . 2010-07-13 16:51 -------- d-----w- c:\program files\Java
2010-07-13 15:51 . 2008-08-24 11:57 -------- d-----w- c:\users\Jan\AppData\Roaming\Vso
2010-06-24 07:04 . 2010-06-24 07:04 136120 ----a-w- c:\windows\system32\drivers\eamonm.sys
2008-05-21 08:47 . 2008-05-21 08:17 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-05-21 1233920]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-06-24 1840424]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-10 216520]
"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2010-06-24 247144]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2009-04-13 2387968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-12-11 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-11 8530464]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-11 81920]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-08 2221352]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"RtHDVCpl"="RtHDVCpl.exe" [2008-02-13 4915200]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"EEventManager"="c:\program files\EPSON\Creativity Suite\Event Manager\EEventManager.exe" [2006-10-12 102400]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2010-03-07 524632]
"RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2008-10-17 91432]
"PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2007-12-14 50472]
"BDRegion"="c:\program files\Cyberlink\Shared Files\brs.exe" [2009-01-20 75048]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-07-02 2202704]

c:\users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
FreeRapid 0.83u1.lnk - c:\users\Jan\Desktop\FreeRapid-0.83u1\frd.exe [2010-7-13 35840]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"wave3"=audpci40.dll
"midi3"=audpci40.dll
"mixer3"=audpci40.dll
"aux3"=audpci40.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flashget]
2007-09-25 08:10 2007088 ----a-w- c:\program files\FlashGet\flashget.exe

R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2009-01-01 717296]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2009-05-04 64160]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2010-04-28 114984]
S2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};Power Control [2009/04/25 13:23];c:\program files\CyberLink\PowerDVD8\000.fcl [2009-01-20 17:56 87536]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2010-06-24 136120]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2010-07-02 810144]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [2010-04-28 96896]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2010-03-07 1029456]
S2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [2010-06-24 92008]
S3 BENDER;Pinnacle AV/DV2 Capture;c:\windows\system32\drivers\bender.sys [2006-12-04 203264]


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-04-13 14:08 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Obsah adresáře 'Naplánované úlohy'

2010-08-16 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 09:32]

2010-08-16 c:\windows\Tasks\User_Feed_Synchronization-{13C540E2-2E69-4923-A003-E4D3D7B77E21}.job
- c:\windows\system32\msfeedssync.exe [2008-05-21 08:41]
.
.
------- Doplňkový sken -------
.
uInternet Settings,ProxyOverride = *.local
IE: &Stáhnout FlashGetem - c:\program files\FlashGet\jc_link.htm
IE: &Stáhnout všechny FlashGetem - c:\program files\FlashGet\jc_all.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
DPF: {A3E21079-7F41-4125-9EBB-FD44CFCC0AC1} - hxxps://www.mesh.com/0.9.4014.28/TSWeb.cab
FF - ProfilePath - c:\users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\mg9yarla.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - plugin: c:\adobe\QuickTime\Plugins\npqtplugin.dll
FF - plugin: c:\adobe\QuickTime\Plugins\npqtplugin2.dll
FF - plugin: c:\adobe\QuickTime\Plugins\npqtplugin3.dll
FF - plugin: c:\adobe\QuickTime\Plugins\npqtplugin4.dll
FF - plugin: c:\adobe\QuickTime\Plugins\npqtplugin5.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-16 20:08
Windows 6.0.6001 Service Pack 1 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD8\000.fcl"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BEB3C0C7-B648-4257-96D9-B5D024816E27}\Version*Version]
"Version"=hex:41,11,bf,76,f2,6a,a9,2d,5c,87,78,84,dc,7f,bc,e9,70,b6,1a,f6,ff,
56,4f,63,8d,16,48,5c,54,1d,93,47,1b,30,1a,bd,03,2f,a4,09,19,11,2b,ed,c9,ee,\
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'Explorer.exe'(3296)
c:\program files\ArcSoft\PhotoImpression 5\share\pihook.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\windows\system32\IoctlSvc.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\conime.exe
c:\windows\System32\rundll32.exe
c:\windows\System32\rundll32.exe
c:\windows\RtHDVCpl.exe
c:\program files\Java\jre6\launch4j-tmp\frd.exe
c:\program files\Common Files\Nero\Lib\NMIndexingService.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Celkový čas: 2010-08-16 20:13:31 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-08-16 18:13

Před spuštěním: Volných bajtů: 25.601.712.128
Po spuštění: Volných bajtů: 26.127.618.048

- - End Of File - - E5D0E70245EE9CE96A9E94EC619CFA01

[Caroprd111]

Doporučuji odinstalovat Ad-Aware.


Odinstalujte všechny emulátory virtuálních mechanik.

Stáhněte SPTD http://www.duplexsecure.com/en/downloads

• Vyberte verzi podle svého operačního systému (64 & 32b). Uložte na plochu a spusťte.
• zvolte možnost Uninstall a restartujte PC.

Stáhněte a spusťte http://www.jpshortstuff.247fixes.com/Defogger.exe

• Klikněte na "Disable" a restartujte PC.

Stáhněte MBR na plochu http://www2.gmer.net/mbr/mbr.exe

Start > Spustit (Win + R)

• Vyskočí okénko, zkopírujte do něj:

Kód: Vybrat vše

"%userprofile%\plocha\mbr" -t

• Klikněte na OK

• Vytvoří se log s názvem mbr.log, vložte ho sem.

Dejte log z Gmer http://www.viry.cz/forum/viewtopic.php?f=29&t=62878

[davem]

Daemona jsem odinstaloval

v SPTD jsem nemel osvicenu volbu Uninstall, takze to vypada ze tam neni

Defogger probehl.

MBR:


Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll ataport.SYS pciide.sys PCIIDEX.SYS atapi.sys
kernel: MBR read successfully
user & kernel MBR OK

[davem]

gmer maly:


GMER 1.0.15.15281 - http://www.gmer.net
Rootkit quick scan 2010-08-16 21:25:37
Windows 6.0.6001 Service Pack 1
Running: gmer.exe; Driver: C:\Users\Jan\AppData\Local\Temp\uwldypog.sys


---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Společnost Microsoft)

---- EOF - GMER 1.0.15 ----

Pripada me moc maly

Velky:


GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-08-16 21:39:51
Windows 6.0.6001 Service Pack 1
Running: gmer.exe; Driver: C:\Users\Jan\AppData\Local\Temp\uwldypog.sys


---- System - GMER 1.0.15 ----

INT 0x01 \??\C:\Users\Jan\AppData\Local\Temp\mbr.sys A04522A4

---- Kernel code sections - GMER 1.0.15 ----

.text C:\Windows\system32\DRIVERS\nvlddmkm.sys section is writeable [0x8F20A340, 0x39DB57, 0xE8000020]
.text C:\Program Files\CyberLink\PowerDVD8\000.fcl section is writeable [0xA0410000, 0x2892, 0xE8000020]
.vmp2 C:\Program Files\CyberLink\PowerDVD8\000.fcl entry point in ".vmp2" section [0xA0433050]
? C:\Users\Jan\AppData\Local\Temp\mbr.sys Systém nemůže nalézt uvedený soubor. !

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1620] kernel32.dll!SetUnhandledExceptionFilter 76656E2D 4 Bytes [C2, 04, 00, 00]

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Windows\system32\SearchProtocolHost.exe[3816] @ C:\Windows\system32\ole32.dll [USER32.dll!DialogBoxParamW] [6D4BDB6B] C:\Windows\AppPatch\AcSpecfc.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Windows\system32\SearchProtocolHost.exe[3816] @ C:\Windows\system32\SHLWAPI.dll [USER32.dll!DialogBoxParamW] [6D4BDB6B] C:\Windows\AppPatch\AcSpecfc.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Windows\system32\SearchProtocolHost.exe[3816] @ C:\Windows\system32\SHELL32.dll [USER32.dll!DialogBoxParamW] [6D4BDB6B] C:\Windows\AppPatch\AcSpecfc.DLL (Windows Compatibility DLL/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume4 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume5 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume6 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Společnost Microsoft)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x33 0x7E 0x03 0x25 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xA0 0x1F 0x78 0x0B ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x6F 0x4B 0xE5 0xFC ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x33 0x7E 0x03 0x25 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xA0 0x1F 0x78 0x0B ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x6F 0x4B 0xE5 0xFC ...
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@cd042efbbd7f7af1647644e76e06692b 0x2E 0xE8 0xE1 0x00 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@bca643cdc5c2726b20d2ecedcc62c59b 0x6A 0x9C 0xD6 0x61 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@2c81e34222e8052573023a60d06dd016 0xFF 0x7C 0x85 0xE0 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@2582ae41fb52324423be06337561aa48 0x3E 0x1E 0x9E 0xE0 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@caaeda5fd7a9ed7697d9686d4b818472 0xF5 0x1D 0x4D 0x73 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@a4a1bcf2cc2b8bc3716b74b2b4522f5d 0xB0 0x18 0xED 0xA7 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@4d370831d2c43cd13623e232fed27b7b 0xFB 0xA7 0x78 0xE6 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{BEB3C0C7-B648-4257-96D9-B5D024816E27}\Version
Reg HKLM\SOFTWARE\Classes\CLSID\{BEB3C0C7-B648-4257-96D9-B5D024816E27}\Version@Version 0x41 0x11 0xBF 0x76 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@1d68fe701cdea33e477eb204b76f993d 0x01 0x3A 0x48 0xFC ...
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@1fac81b91d8e3c5aa4b0a51804d844a3 0xF6 0x0F 0x4E 0x58 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@f5f62a6129303efb32fbe080bb27835b 0x3D 0xCE 0xEA 0x26 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@fd4e2e1a3940b94dceb5a6a021f2e3c6 0xE3 0x0E 0x66 0xD5 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@8a8aec57dd6508a385616fbc86791ec2 0x05 0x73 0x21 0xDD ...

---- EOF - GMER 1.0.15 ----

[Caroprd111]

Jak se chová PC

[davem]

nod stale po startu pc hlasi stejnou hlasku ohledne Win32/Mebroot.K trojský kůň.. nemuze to delat i jiny disk? nemam v GMERu zkontrolovat pro jistotu vsechny? ted sem nechaval pouze C.

[Caroprd111]

Použijte http://www.eset.eu/download/emebremover

[davem]

Uz to vypada OK

[Caroprd111]

Doporučuji odinstalovat Ad-Aware.


Odinstalujte ComboFix přes:
Start >> Spustit, zkopírujte do okénka:

ComboFix /Uninstall

stiskněte Enter



Stáhněte T-Cleaner http://sweb.cz/Marinus/T-Cleaner.exe

• Spusťte, pro potvrzení volby mačkejte klávesu A, Enter
• Po použití program vymažte. Pozor, antiviry ho mohou falešně označit za vir.

Stáhněte TFC http://oldtimer.geekstogo.com/TFC.exe

• Spusťte.
• Klikněte na "Start". Potvrďte hlášku kliknutím na "Ok" (Bude následovat restart)

Stáhněte OTC http://oldtimer.geekstogo.com/OTC.exe

• Spusťte.
• Klikněte na "CleanUp!". Potvrďte hlášky kliknutím na "Yes" (Bude následovat restart)

Stáhněte Ccleaner http://viry.cz/forum/viewtopic.php?t=7478

• Nainstalujte a v průběhu instalace odškrtněte, že chcete instalovat yahoo toolbar.
  
  Záložka Čistič
• Dejte analyzovat, po dokončení dejte Spustit Ccleaner.
  
  Záložka Registry
• Klikněte na Hledej problémy, po dokončení klikněte na Opravit problémy, zálohu dělat nemusíte, potom dejte Opravit všechny problémy.
  OK Zavřít

Doinstalujte SP2 http://www.viry.cz/forum/viewtopic.php?f=46&t=86100


V logu nevidím firewall, doinstalujte Přehled: http://www.viry.cz/forum/viewtopic.php?f=41&t=6523


Dejte nový log z RSIT.

[davem]

Vse hotovo, zde je log:

Logfile of random's system information tool 1.08 (written by random/random)
Run by Jan at 2010-08-18 20:55:50
Microsoft® Windows Vista™ Ultimate Service Pack 2
System drive C: has 25 GB (28%) free of 90 GB
Total RAM: 3582 MB (73% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:56:01, on 18.8.2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v7.00 (7.00.6002.18005)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Program Files\epson\Creativity Suite\Event Manager\EEventManager.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
C:\Program Files\CyberLink\Shared Files\brs.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Jan\Desktop\RSIT.exe
C:\Program Files\trend micro\Jan.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [EEventManager] C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
O4 - HKLM\..\Run: [RemoteControl8] "C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe"
O4 - HKLM\..\Run: [PDVD8LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe"
O4 - HKLM\..\Run: [BDRegion] C:\Program Files\Cyberlink\Shared Files\brs.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe"
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: FreeRapid 0.83u1.lnk = C:\Users\Jan\Desktop\FreeRapid-0.83u1\frd.exe
O8 - Extra context menu item: &Stáhnout FlashGetem - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Stáhnout všechny FlashGetem - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O16 - DPF: {A3E21079-7F41-4125-9EBB-FD44CFCC0AC1} (WLCTSCControl Class) - https://www.mesh.com/0.9.4014.28/TSWeb.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe
O23 - Service: SbPF.Launcher - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe
O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe

--
End of file - 7852 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Ad-Aware Update (Weekly).job
C:\Windows\tasks\User_Feed_Synchronization-{13C540E2-2E69-4923-A003-E4D3D7B77E21}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Podpora odkazu pro Adobe PDF Reader - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2F364306-AA45-47B5-9F9D-39A8B94E7EF7}]
FGCatchUrl - C:\Program Files\FlashGet\jccatch.dll [2007-08-06 94308]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2008-09-13 308856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-07-13 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F156768E-81EF-470C-9057-481BA8380DBA}]
FlashGet GetFlash Class - C:\Program Files\FlashGet\getflash.dll [2007-05-18 163840]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvSvc"=C:\Windows\system32\nvsvc.dll [2007-12-11 86016]
"NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2007-12-11 8530464]
"NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2007-12-11 81920]
"NBKeyScan"=C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [2008-06-08 2221352]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2008-02-13 4915200]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]
"EEventManager"=C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe [2006-10-12 102400]
"RemoteControl8"=C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe [2008-10-17 91432]
"PDVD8LanguageShortcut"=C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe [2007-12-14 50472]
"BDRegion"=C:\Program Files\Cyberlink\Shared Files\brs.exe [2009-01-20 75048]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-02-18 248040]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2010-07-02 2202704]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-04-10 1233920]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe [2008-06-24 1840424]
"TomTomHOME.exe"=C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe [2010-06-24 247144]
"LightScribe Control Panel"=C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2009-04-13 2387968]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flashget]
C:\Program Files\FlashGet\flashget.exe [2007-09-25 2007088]

C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
FreeRapid 0.83u1.lnk - C:\Users\Jan\Desktop\FreeRapid-0.83u1\frd.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"= []

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vsmon]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLUA"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0
"BindDirectlyToPropertySetStorage"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======List of files/folders created in the last 1 months======

2010-08-18 20:50:16 ----A---- C:\Windows\system32\drivers\SbFwIm.sys
2010-08-18 20:50:01 ----D---- C:\Program Files\Sunbelt Software
2010-08-18 20:48:39 ----D---- C:\Windows\Internet Logs
2010-08-18 20:40:53 ----D---- C:\rsit
2010-08-18 20:32:18 ----A---- C:\Windows\system32\drivers\tcpipreg.sys
2010-08-18 20:32:18 ----A---- C:\Windows\system32\drivers\tcpip.sys
2010-08-18 20:32:18 ----A---- C:\Windows\system32\drivers\netio.sys
2010-08-18 20:31:25 ----D---- C:\ProgramData\CheckPoint
2010-08-18 20:23:34 ----ASH---- C:\hiberfil.sys
2010-08-18 20:20:12 ----D---- C:\Windows\system32\eu-ES
2010-08-18 20:20:12 ----D---- C:\Windows\system32\ca-ES
2010-08-18 20:20:09 ----D---- C:\Windows\system32\vi-VN
2010-08-18 20:19:14 ----A---- C:\Windows\ntbtlog.txt
2010-08-18 19:53:14 ----D---- C:\Windows\system32\SPReview
2010-08-18 19:41:45 ----A---- C:\Windows\system32\scavenge.dll
2010-08-18 19:41:38 ----A---- C:\Windows\system32\compcln.exe
2010-08-18 19:36:37 ----A---- C:\Windows\system32\secur32.dll
2010-08-18 19:36:37 ----A---- C:\Windows\system32\secproc_ssp_isv.dll
2010-08-18 19:36:37 ----A---- C:\Windows\system32\secproc_ssp.dll
2010-08-18 19:36:37 ----A---- C:\Windows\system32\secproc_isv.dll
2010-08-18 19:36:37 ----A---- C:\Windows\system32\secproc.dll
2010-08-18 19:36:37 ----A---- C:\Windows\system32\SearchProtocolHost.exe
2010-08-18 19:36:37 ----A---- C:\Windows\system32\SearchIndexer.exe
2010-08-18 19:36:37 ----A---- C:\Windows\system32\SearchFilterHost.exe
2010-08-18 19:36:37 ----A---- C:\Windows\system32\sdohlp.dll
2010-08-18 19:36:37 ----A---- C:\Windows\system32\sdclt.exe
2010-08-18 19:36:36 ----A---- C:\Windows\system32\scrrun.dll
2010-08-18 19:36:36 ----A---- C:\Windows\system32\samlib.dll
2010-08-18 19:36:36 ----A---- C:\Windows\system32\rwinsta.exe
2010-08-18 19:36:36 ----A---- C:\Windows\system32\rtutils.dll
2010-08-18 19:36:36 ----A---- C:\Windows\system32\rtffilt.dll
2010-08-18 19:36:36 ----A---- C:\Windows\system32\rsaenh.dll
2010-08-18 19:36:36 ----A---- C:\Windows\system32\rrinstaller.exe
2010-08-18 19:36:36 ----A---- C:\Windows\system32\rpchttp.dll
2010-08-18 19:36:36 ----A---- C:\Windows\system32\rpcss.dll
2010-08-18 19:36:36 ----A---- C:\Windows\system32\rpcrt4.dll
2010-08-18 19:36:36 ----A---- C:\Windows\system32\RMActivate_ssp_isv.exe
2010-08-18 19:36:36 ----A---- C:\Windows\system32\RMActivate_ssp.exe
2010-08-18 19:36:36 ----A---- C:\Windows\system32\RMActivate_isv.exe
2010-08-18 19:36:36 ----A---- C:\Windows\system32\RMActivate.exe
2010-08-18 19:36:36 ----A---- C:\Windows\system32\riched20.dll
2010-08-18 19:36:36 ----A---- C:\Windows\system32\drivers\RNDISMP.sys
2010-08-18 19:36:36 ----A---- C:\Windows\system32\drivers\rmcast.sys
2010-08-18 19:36:35 ----A---- C:\Windows\system32\SCardSvr.dll
2010-08-18 19:36:35 ----A---- C:\Windows\system32\scansetting.dll
2010-08-18 19:36:35 ----A---- C:\Windows\system32\samsrv.dll
2010-08-18 19:36:34 ----A---- C:\Windows\system32\schedsvc.dll
2010-08-18 19:36:34 ----A---- C:\Windows\system32\schannel.dll
2010-08-18 19:36:34 ----A---- C:\Windows\system32\scrptadm.dll
2010-08-18 19:36:34 ----A---- C:\Windows\system32\scrobj.dll
2010-08-18 19:36:34 ----A---- C:\Windows\system32\scksp.dll
2010-08-18 19:36:34 ----A---- C:\Windows\system32\scesrv.dll
2010-08-18 19:36:34 ----A---- C:\Windows\system32\scecli.dll
2010-08-18 19:36:32 ----A---- C:\Windows\system32\PnPutil.exe
2010-08-18 19:36:32 ----A---- C:\Windows\system32\perfdisk.dll
2010-08-18 19:36:32 ----A---- C:\Windows\system32\PerfCenterCPL.dll
2010-08-18 19:36:32 ----A---- C:\Windows\system32\pdh.dll
2010-08-18 19:36:32 ----A---- C:\Windows\system32\pcaui.dll
2010-08-18 19:36:32 ----A---- C:\Windows\system32\p2psvc.dll
2010-08-18 19:36:32 ----A---- C:\Windows\system32\P2PGraph.dll
2010-08-18 19:36:32 ----A---- C:\Windows\system32\drivers\pciidex.sys
2010-08-18 19:36:32 ----A---- C:\Windows\system32\drivers\pciide.sys
2010-08-18 19:36:32 ----A---- C:\Windows\system32\drivers\pci.sys
2010-08-18 19:36:32 ----A---- C:\Windows\system32\drivers\partmgr.sys
2010-08-18 19:36:32 ----A---- C:\Windows\system32\drivers\pacer.sys
2010-08-18 19:36:31 ----A---- C:\Windows\system32\powercpl.dll
2010-08-18 19:36:31 ----A---- C:\Windows\system32\PortableDeviceTypes.dll
2010-08-18 19:36:31 ----A---- C:\Windows\system32\PortableDeviceClassExtension.dll
2010-08-18 19:36:31 ----A---- C:\Windows\system32\PortableDeviceApi.dll
2010-08-18 19:36:31 ----A---- C:\Windows\system32\PNPXAssoc.dll
2010-08-18 19:36:31 ----A---- C:\Windows\system32\PnPUnattend.exe
2010-08-18 19:36:31 ----A---- C:\Windows\system32\pnpui.dll
2010-08-18 19:36:31 ----A---- C:\Windows\system32\pnpsetup.dll
2010-08-18 19:36:31 ----A---- C:\Windows\system32\pnidui.dll
2010-08-18 19:36:31 ----A---- C:\Windows\system32\pmcsnap.dll
2010-08-18 19:36:31 ----A---- C:\Windows\system32\PkgMgr.exe
2010-08-18 19:36:31 ----A---- C:\Windows\system32\pidgenx.dll
2010-08-18 19:36:31 ----A---- C:\Windows\system32\photowiz.dll
2010-08-18 19:36:31 ----A---- C:\Windows\system32\PhotoMetadataHandler.dll
2010-08-18 19:36:31 ----A---- C:\Windows\system32\nslookup.exe
2010-08-18 19:36:31 ----A---- C:\Windows\system32\drivers\portcls.sys
2010-08-18 19:36:31 ----A---- C:\Windows\system32\drivers\npfs.sys
2010-08-18 19:36:30 ----A---- C:\Windows\system32\ntkrnlpa.exe
2010-08-18 19:36:30 ----A---- C:\Windows\system32\ntdll.dll
2010-08-18 19:36:30 ----A---- C:\Windows\system32\NlsLexicons0009.dll
2010-08-18 19:36:30 ----A---- C:\Windows\system32\drivers\ntfs.sys
2010-08-18 19:36:29 ----A---- C:\Windows\system32\osk.exe
2010-08-18 19:36:29 ----A---- C:\Windows\system32\oobefldr.dll
2010-08-18 19:36:29 ----A---- C:\Windows\system32\onex.dll
2010-08-18 19:36:29 ----A---- C:\Windows\system32\olepro32.dll
2010-08-18 19:36:29 ----A---- C:\Windows\system32\oleprn.dll
2010-08-18 19:36:29 ----A---- C:\Windows\system32\oleaut32.dll
2010-08-18 19:36:29 ----A---- C:\Windows\system32\ole32.dll
2010-08-18 19:36:29 ----A---- C:\Windows\system32\offfilt.dll
2010-08-18 19:36:29 ----A---- C:\Windows\system32\odbccp32.dll
2010-08-18 19:36:29 ----A---- C:\Windows\system32\odbcconf.dll
2010-08-18 19:36:29 ----A---- C:\Windows\system32\odbc32.dll
2010-08-18 19:36:29 ----A---- C:\Windows\system32\ocsetup.exe
2010-08-18 19:36:29 ----A---- C:\Windows\system32\occache.dll
2010-08-18 19:36:29 ----A---- C:\Windows\system32\ntprint.dll
2010-08-18 19:36:29 ----A---- C:\Windows\system32\ntoskrnl.exe
2010-08-18 19:36:29 ----A---- C:\Windows\system32\ntmarta.dll
2010-08-18 19:36:29 ----A---- C:\Windows\system32\NlsLexicons0007.dll
2010-08-18 19:36:29 ----A---- C:\Windows\system32\nlhtml.dll
2010-08-18 19:36:29 ----A---- C:\Windows\system32\drivers\ohci1394.sys
2010-08-18 19:36:29 ----A---- C:\Windows\system32\drivers\nwifi.sys
2010-08-18 19:36:28 ----A---- C:\Windows\system32\reset.exe
2010-08-18 19:36:28 ----A---- C:\Windows\system32\RelMon.dll
2010-08-18 19:36:28 ----A---- C:\Windows\system32\rekeywiz.exe
2010-08-18 19:36:28 ----A---- C:\Windows\system32\regsvc.dll
2010-08-18 19:36:28 ----A---- C:\Windows\system32\rastls.dll
2010-08-18 19:36:28 ----A---- C:\Windows\system32\rastapi.dll
2010-08-18 19:36:28 ----A---- C:\Windows\system32\rasppp.dll
2010-08-18 19:36:28 ----A---- C:\Windows\system32\rasplap.dll
2010-08-18 19:36:28 ----A---- C:\Windows\system32\rasmontr.dll
2010-08-18 19:36:28 ----A---- C:\Windows\system32\rasmans.dll
2010-08-18 19:36:28 ----A---- C:\Windows\system32\raschap.dll
2010-08-18 19:36:28 ----A---- C:\Windows\system32\rasgcw.dll
2010-08-18 19:36:28 ----A---- C:\Windows\system32\rasdlg.dll
2010-08-18 19:36:28 ----A---- C:\Windows\system32\rasdial.exe
2010-08-18 19:36:28 ----A---- C:\Windows\system32\rasdiag.dll
2010-08-18 19:36:28 ----A---- C:\Windows\system32\rasapi32.dll
2010-08-18 19:36:28 ----A---- C:\Windows\system32\RacEngn.dll
2010-08-18 19:36:28 ----A---- C:\Windows\system32\query.exe
2010-08-18 19:36:28 ----A---- C:\Windows\system32\Query.dll
2010-08-18 19:36:28 ----A---- C:\Windows\system32\quartz.dll
2010-08-18 19:36:28 ----A---- C:\Windows\system32\qprocess.exe
2010-08-18 19:36:28 ----A---- C:\Windows\system32\qmgr.dll
2010-08-18 19:36:28 ----A---- C:\Windows\system32\qedit.dll
2010-08-18 19:36:28 ----A---- C:\Windows\system32\drivers\rassstp.sys
2010-08-18 19:36:28 ----A---- C:\Windows\system32\drivers\raspppoe.sys
2010-08-18 19:36:27 ----A---- C:\Windows\system32\regapi.dll
2010-08-18 19:36:27 ----A---- C:\Windows\system32\reg.exe
2010-08-18 19:36:27 ----A---- C:\Windows\system32\rdpwsx.dll
2010-08-18 19:36:27 ----A---- C:\Windows\system32\rdpendp.dll
2010-08-18 19:36:27 ----A---- C:\Windows\system32\rdpencom.dll
2010-08-18 19:36:27 ----A---- C:\Windows\system32\rdpclip.exe
2010-08-18 19:36:27 ----A---- C:\Windows\system32\prnntfy.dll
2010-08-18 19:36:27 ----A---- C:\Windows\system32\printui.dll
2010-08-18 19:36:27 ----A---- C:\Windows\system32\printfilterpipelinesvc.exe
2010-08-18 19:36:27 ----A---- C:\Windows\system32\printfilterpipelineprxy.dll
2010-08-18 19:36:27 ----A---- C:\Windows\system32\PrintBrmUi.exe
2010-08-18 19:36:27 ----A---- C:\Windows\system32\PresentationSettings.exe
2010-08-18 19:36:27 ----A---- C:\Windows\system32\PresentationNative_v0300.dll
2010-08-18 19:36:27 ----A---- C:\Windows\system32\PresentationHostProxy.dll
2010-08-18 19:36:27 ----A---- C:\Windows\system32\PresentationHost.exe
2010-08-18 19:36:27 ----A---- C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2010-08-18 19:36:27 ----A---- C:\Windows\system32\powrprof.dll
2010-08-18 19:36:27 ----A---- C:\Windows\system32\drivers\rdpwd.sys
2010-08-18 19:36:27 ----A---- C:\Windows\system32\drivers\rdpdr.sys
2010-08-18 19:36:27 ----A---- C:\Windows\system32\drivers\rdbss.sys
2010-08-18 19:36:24 ----A---- C:\Windows\system32\puiapi.dll
2010-08-18 19:36:23 ----A---- C:\Windows\system32\qdvd.dll
2010-08-18 19:36:23 ----A---- C:\Windows\system32\qappsrv.exe
2010-08-18 19:36:23 ----A---- C:\Windows\system32\QAGENTRT.DLL
2010-08-18 19:36:23 ----A---- C:\Windows\system32\propsys.dll
2010-08-18 19:36:23 ----A---- C:\Windows\system32\propdefs.dll
2010-08-18 19:36:23 ----A---- C:\Windows\system32\profsvc.dll
2010-08-18 19:36:22 ----A---- C:\Windows\system32\psisdecd.dll
2010-08-18 19:36:22 ----A---- C:\Windows\system32\PSHED.DLL
2010-08-18 19:36:15 ----A---- C:\Windows\system32\sendmail.dll
2010-08-18 19:36:13 ----A---- C:\Windows\system32\shlwapi.dll
2010-08-18 19:36:13 ----A---- C:\Windows\system32\shell32.dll
2010-08-18 19:36:13 ----A---- C:\Windows\system32\shdocvw.dll
2010-08-18 19:36:13 ----A---- C:\Windows\system32\shadow.exe
2010-08-18 19:36:13 ----A---- C:\Windows\system32\setupapi.dll
2010-08-18 19:36:13 ----A---- C:\Windows\system32\sethc.exe
2010-08-18 19:36:13 ----A---- C:\Windows\system32\services.exe
2010-08-18 19:36:01 ----A---- C:\Windows\system32\EhStorAPI.dll
2010-08-18 19:36:01 ----A---- C:\Windows\system32\eapphost.dll
2010-08-18 19:36:01 ----A---- C:\Windows\system32\eappgnui.dll
2010-08-18 19:36:01 ----A---- C:\Windows\system32\eappcfg.dll
2010-08-18 19:36:01 ----A---- C:\Windows\system32\eapp3hst.dll
2010-08-18 19:36:01 ----A---- C:\Windows\system32\drivers\ecache.sys
2010-08-18 19:36:01 ----A---- C:\Windows\system32\drivers\Dumpata.sys
2010-08-18 19:36:00 ----A---- C:\Windows\system32\f3ahvoas.dll
2010-08-18 19:36:00 ----A---- C:\Windows\system32\extmgr.dll
2010-08-18 19:36:00 ----A---- C:\Windows\system32\ExplorerFrame.dll
2010-08-18 19:36:00 ----A---- C:\Windows\system32\evr.dll
2010-08-18 19:36:00 ----A---- C:\Windows\system32\eudcedit.exe
2010-08-18 19:36:00 ----A---- C:\Windows\system32\esent.dll
2010-08-18 19:36:00 ----A---- C:\Windows\system32\es.dll
2010-08-18 19:36:00 ----A---- C:\Windows\system32\EncDec.dll
2010-08-18 19:36:00 ----A---- C:\Windows\system32\emdmgmt.dll
2010-08-18 19:36:00 ----A---- C:\Windows\system32\EhStorShell.dll
2010-08-18 19:36:00 ----A---- C:\Windows\system32\EhStorPwdMgr.dll
2010-08-18 19:36:00 ----A---- C:\Windows\system32\EhStorAuthn.dll
2010-08-18 19:36:00 ----A---- C:\Windows\system32\dxmasf.dll
2010-08-18 19:36:00 ----A---- C:\Windows\system32\dwm.exe
2010-08-18 19:36:00 ----A---- C:\Windows\system32\dsprop.dll
2010-08-18 19:36:00 ----A---- C:\Windows\system32\dsound.dll
2010-08-18 19:36:00 ----A---- C:\Windows\system32\drivers\exfat.sys
2010-08-18 19:36:00 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2010-08-18 19:36:00 ----A---- C:\Windows\system32\drivers\dxg.sys
2010-08-18 19:36:00 ----A---- C:\Windows\explorer.exe
2010-08-18 19:35:59 ----A---- C:\Windows\system32\drivers\Diskdump.sys
2010-08-18 19:35:59 ----A---- C:\Windows\system32\drivers\disk.sys
2010-08-18 19:35:59 ----A---- C:\Windows\system32\drivers\dfsc.sys
2010-08-18 19:35:59 ----A---- C:\Windows\system32\diskraid.exe
2010-08-18 19:35:59 ----A---- C:\Windows\system32\diskpart.exe
2010-08-18 19:35:59 ----A---- C:\Windows\system32\dimsroam.dll
2010-08-18 19:35:59 ----A---- C:\Windows\system32\diagperf.dll
2010-08-18 19:35:59 ----A---- C:\Windows\system32\dhcpcsvc6.dll
2010-08-18 19:35:59 ----A---- C:\Windows\system32\dfsr.exe
2010-08-18 19:35:59 ----A---- C:\Windows\system32\dfshim.dll
2010-08-18 19:35:59 ----A---- C:\Windows\system32\devmgr.dll
2010-08-18 19:35:58 ----A---- C:\Windows\system32\drvstore.dll
2010-08-18 19:35:58 ----A---- C:\Windows\system32\drvinst.exe
2010-08-18 19:35:58 ----A---- C:\Windows\system32\drmv2clt.dll
2010-08-18 19:35:58 ----A---- C:\Windows\system32\drmmgrtn.dll
2010-08-18 19:35:58 ----A---- C:\Windows\system32\dpapimig.exe
2010-08-18 19:35:58 ----A---- C:\Windows\system32\dot3svc.dll
2010-08-18 19:35:58 ----A---- C:\Windows\system32\dot3msm.dll
2010-08-18 19:35:58 ----A---- C:\Windows\system32\dot3cfg.dll
2010-08-18 19:35:58 ----A---- C:\Windows\system32\dnsapi.dll
2010-08-18 19:35:58 ----A---- C:\Windows\system32\dmusic.dll
2010-08-18 19:35:58 ----A---- C:\Windows\system32\dmsynth.dll
2010-08-18 19:35:58 ----A---- C:\Windows\system32\dhcpcsvc.dll
2010-08-18 19:35:57 ----A---- C:\Windows\system32\iasdatastore.dll
2010-08-18 19:35:57 ----A---- C:\Windows\system32\iasads.dll
2010-08-18 19:35:57 ----A---- C:\Windows\system32\iasacct.dll
2010-08-18 19:35:57 ----A---- C:\Windows\system32\hbaapi.dll
2010-08-18 19:35:57 ----A---- C:\Windows\system32\gpupdate.exe
2010-08-18 19:35:57 ----A---- C:\Windows\system32\gpsvc.dll
2010-08-18 19:35:57 ----A---- C:\Windows\system32\gpscript.exe
2010-08-18 19:35:57 ----A---- C:\Windows\system32\gpscript.dll
2010-08-18 19:35:57 ----A---- C:\Windows\system32\gpresult.exe
2010-08-18 19:35:57 ----A---- C:\Windows\system32\gpprnext.dll
2010-08-18 19:35:57 ----A---- C:\Windows\system32\drivers\hdaudbus.sys
2010-08-18 19:35:57 ----A---- C:\Windows\system32\dnsrslvr.dll
2010-08-18 19:35:56 ----A---- C:\Windows\system32\iasnap.dll
2010-08-18 19:35:56 ----A---- C:\Windows\system32\IasMigReader.exe
2010-08-18 19:35:56 ----A---- C:\Windows\system32\IasMigPlugin.dll
2010-08-18 19:35:56 ----A---- C:\Windows\system32\iashlpr.dll
2010-08-18 19:35:56 ----A---- C:\Windows\system32\hidserv.dll
2010-08-18 19:35:56 ----A---- C:\Windows\system32\hdwwiz.exe
2010-08-18 19:35:56 ----A---- C:\Windows\system32\drivers\http.sys
2010-08-18 19:35:56 ----A---- C:\Windows\system32\drivers\hidusb.sys
2010-08-18 19:35:56 ----A---- C:\Windows\system32\drivers\hidclass.sys
2010-08-18 19:35:55 ----A---- C:\Windows\system32\gpedit.dll
2010-08-18 19:35:55 ----A---- C:\Windows\system32\gpapi.dll
2010-08-18 19:35:55 ----A---- C:\Windows\system32\gdi32.dll
2010-08-18 19:35:55 ----A---- C:\Windows\system32\fundisc.dll
2010-08-18 19:35:55 ----A---- C:\Windows\system32\fontext.dll
2010-08-18 19:35:55 ----A---- C:\Windows\system32\findstr.exe
2010-08-18 19:35:55 ----A---- C:\Windows\system32\feclient.dll
2010-08-18 19:35:55 ----A---- C:\Windows\system32\fdWSD.dll
2010-08-18 19:35:55 ----A---- C:\Windows\system32\fdWCN.dll
2010-08-18 19:35:55 ----A---- C:\Windows\system32\fdSSDP.dll
2010-08-18 19:35:55 ----A---- C:\Windows\system32\fdProxy.dll
2010-08-18 19:35:55 ----A---- C:\Windows\system32\fdeploy.dll
2010-08-18 19:35:55 ----A---- C:\Windows\system32\fdBthProxy.dll
2010-08-18 19:35:55 ----A---- C:\Windows\system32\fdBth.dll
2010-08-18 19:35:55 ----A---- C:\Windows\system32\fc.exe
2010-08-18 19:35:55 ----A---- C:\Windows\system32\Faultrep.dll
2010-08-18 19:35:55 ----A---- C:\Windows\system32\drivers\fltMgr.sys
2010-08-18 19:35:55 ----A---- C:\Windows\system32\drivers\fastfat.sys
2010-08-18 19:35:54 ----A---- C:\Windows\system32\gameux.dll
2010-08-18 19:35:54 ----A---- C:\Windows\system32\FwRemoteSvr.dll
2010-08-18 19:35:54 ----A---- C:\Windows\system32\FWPUCLNT.DLL
2010-08-18 19:35:54 ----A---- C:\Windows\system32\fveui.dll
2010-08-18 19:35:54 ----A---- C:\Windows\system32\fvecpl.dll
2010-08-18 19:35:54 ----A---- C:\Windows\system32\fveapi.dll
2010-08-18 19:35:54 ----A---- C:\Windows\system32\FunctionDiscoveryFolder.dll
2010-08-18 19:35:54 ----A---- C:\Windows\system32\ftp.exe
2010-08-18 19:35:54 ----A---- C:\Windows\system32\drivers\FWPKCLNT.SYS
2010-08-18 19:35:54 ----A---- C:\Windows\system32\drivers\fvevol.sys
2010-08-18 19:35:54 ----A---- C:\Windows\system32\drivers\ataport.sys
2010-08-18 19:35:54 ----A---- C:\Windows\system32\AuxiliaryDisplayServices.dll
2010-08-18 19:35:54 ----A---- C:\Windows\system32\AuxiliaryDisplayDriverLib.dll
2010-08-18 19:35:54 ----A---- C:\Windows\system32\AuxiliaryDisplayCpl.dll
2010-08-18 19:35:54 ----A---- C:\Windows\system32\autoplay.dll
2010-08-18 19:35:54 ----A---- C:\Windows\system32\autochk.exe
2010-08-18 19:35:54 ----A---- C:\Windows\system32\autofmt.exe
2010-08-18 19:35:54 ----A---- C:\Windows\system32\autoconv.exe
2010-08-18 19:35:54 ----A---- C:\Windows\system32\authz.dll
2010-08-18 19:35:54 ----A---- C:\Windows\system32\authui.dll
2010-08-18 19:35:54 ----A---- C:\Windows\system32\audiosrv.dll
2010-08-18 19:35:54 ----A---- C:\Windows\system32\AudioSes.dll
2010-08-18 19:35:54 ----A---- C:\Windows\system32\audiodg.exe
2010-08-18 19:35:54 ----A---- C:\Windows\system32\atmlib.dll
2010-08-18 19:35:54 ----A---- C:\Windows\system32\atmfd.dll
2010-08-18 19:35:53 ----A---- C:\Windows\system32\drivers\bridge.sys
2010-08-18 19:35:53 ----A---- C:\Windows\system32\drivers\atapi.sys
2010-08-18 19:35:53 ----A---- C:\Windows\system32\drivers\acpi.sys
2010-08-18 19:35:53 ----A---- C:\Windows\system32\bthci.dll
2010-08-18 19:35:53 ----A---- C:\Windows\system32\browseui.dll
2010-08-18 19:35:53 ----A---- C:\Windows\system32\brcplsiw.dll
2010-08-18 19:35:53 ----A---- C:\Windows\system32\brcpl.dll
2010-08-18 19:35:53 ----A---- C:\Windows\system32\blackbox.dll
2010-08-18 19:35:53 ----A---- C:\Windows\system32\bitsigd.dll
2010-08-18 19:35:53 ----A---- C:\Windows\system32\BFE.DLL
2010-08-18 19:35:53 ----A---- C:\Windows\system32\bcrypt.dll
2010-08-18 19:35:53 ----A---- C:\Windows\system32\basecsp.dll
2010-08-18 19:35:53 ----A---- C:\Windows\system32\azroles.dll
2010-08-18 19:35:52 ----A---- C:\Windows\system32\Apphlpdm.dll
2010-08-18 19:35:52 ----A---- C:\Windows\system32\apphelp.dll
2010-08-18 19:35:52 ----A---- C:\Windows\system32\accessibilitycpl.dll
2010-08-18 19:35:52 ----A---- C:\Windows\system32\aaclient.dll
2010-08-18 19:35:51 ----A---- C:\Windows\system32\drivers\crashdmp.sys
2010-08-18 19:35:51 ----A---- C:\Windows\system32\drivers\afd.sys
2010-08-18 19:35:51 ----A---- C:\Windows\system32\crypt32.dll
2010-08-18 19:35:51 ----A---- C:\Windows\system32\credui.dll
2010-08-18 19:35:51 ----A---- C:\Windows\system32\connect.dll
2010-08-18 19:35:51 ----A---- C:\Windows\system32\conime.exe
2010-08-18 19:35:51 ----A---- C:\Windows\system32\comuid.dll
2010-08-18 19:35:51 ----A---- C:\Windows\system32\comsvcs.dll
2010-08-18 19:35:51 ----A---- C:\Windows\system32\appmgmts.dll
2010-08-18 19:35:51 ----A---- C:\Windows\system32\apds.dll
2010-08-18 19:35:51 ----A---- C:\Windows\system32\advapi32.dll
2010-08-18 19:35:51 ----A---- C:\Windows\system32\adtschema.dll
2010-08-18 19:35:51 ----A---- C:\Windows\system32\adsmsext.dll
2010-08-18 19:35:51 ----A---- C:\Windows\system32\adsldpc.dll
2010-08-18 19:35:50 ----A---- C:\Windows\system32\dbgeng.dll
2010-08-18 19:35:50 ----A---- C:\Windows\system32\davclnt.dll
2010-08-18 19:35:50 ----A---- C:\Windows\system32\d3d9.dll
2010-08-18 19:35:50 ----A---- C:\Windows\system32\comdlg32.dll
2010-08-18 19:35:50 ----A---- C:\Windows\system32\cmmon32.exe
2010-08-18 19:35:50 ----A---- C:\Windows\system32\cmdial32.dll
2010-08-18 19:35:49 ----A---- C:\Windows\system32\drivers\csc.sys
2010-08-18 19:35:49 ----A---- C:\Windows\system32\drivers\cdrom.sys
2010-08-18 19:35:49 ----A---- C:\Windows\system32\DevicePairingWizard.exe
2010-08-18 19:35:49 ----A---- C:\Windows\system32\DevicePairingProxy.dll
2010-08-18 19:35:49 ----A---- C:\Windows\system32\DevicePairing.dll
2010-08-18 19:35:49 ----A---- C:\Windows\system32\DeviceEject.exe
2010-08-18 19:35:49 ----A---- C:\Windows\system32\dataclen.dll
2010-08-18 19:35:49 ----A---- C:\Windows\system32\csrstub.exe
2010-08-18 19:35:49 ----A---- C:\Windows\system32\cscui.dll
2010-08-18 19:35:49 ----A---- C:\Windows\system32\cscsvc.dll
2010-08-18 19:35:49 ----A---- C:\Windows\system32\cscript.exe
2010-08-18 19:35:49 ----A---- C:\Windows\system32\cscobj.dll
2010-08-18 19:35:49 ----A---- C:\Windows\system32\CscMig.dll
2010-08-18 19:35:49 ----A---- C:\Windows\system32\cscdll.dll
2010-08-18 19:35:49 ----A---- C:\Windows\system32\cscapi.dll
2010-08-18 19:35:49 ----A---- C:\Windows\system32\cryptui.dll
2010-08-18 19:35:49 ----A---- C:\Windows\system32\cryptsvc.dll
2010-08-18 19:35:49 ----A---- C:\Windows\system32\certmgr.dll
2010-08-18 19:35:49 ----A---- C:\Windows\system32\CertEnrollUI.dll
2010-08-18 19:35:49 ----A---- C:\Windows\system32\CertEnroll.dll
2010-08-18 19:35:49 ----A---- C:\Windows\system32\certcli.dll
2010-08-18 19:35:49 ----A---- C:\Windows\system32\cdd.dll
2010-08-18 19:35:48 ----A---- C:\Windows\system32\CHxReadingStringIME.dll
2010-08-18 19:35:48 ----A---- C:\Windows\system32\chtbrkr.dll
2010-08-18 19:35:48 ----A---- C:\Windows\system32\chsbrkr.dll
2010-08-18 19:35:48 ----A---- C:\Windows\system32\chglogon.exe
2010-08-18 19:35:48 ----A---- C:\Windows\system32\drivers\Classpnp.sys
2010-08-18 19:35:48 ----A---- C:\Windows\system32\clfs.sys
2010-08-18 19:35:48 ----A---- C:\Windows\system32\cipher.exe
2010-08-18 19:35:48 ----A---- C:\Windows\system32\ci.dll
2010-08-18 19:35:48 ----A---- C:\Windows\system32\certreq.exe
2010-08-18 19:35:48 ----A---- C:\Windows\system32\certprop.dll
2010-08-18 19:35:48 ----A---- C:\Windows\system32\cbsra.exe
2010-08-18 19:35:48 ----A---- C:\Windows\system32\bthudtask.exe
2010-08-18 19:35:48 ----A---- C:\Windows\system32\bthserv.dll
2010-08-18 19:35:47 ----A---- C:\Windows\system32\msihnd.dll
2010-08-18 19:35:47 ----A---- C:\Windows\system32\msiexec.exe
2010-08-18 19:35:47 ----A---- C:\Windows\system32\msi.dll
2010-08-18 19:35:47 ----A---- C:\Windows\system32\mshtmled.dll
2010-08-18 19:35:47 ----A---- C:\Windows\system32\mshtml.dll
2010-08-18 19:35:47 ----A---- C:\Windows\system32\msftedit.dll
2010-08-18 19:35:47 ----A---- C:\Windows\system32\msfeedsbs.dll
2010-08-18 19:35:47 ----A---- C:\Windows\system32\msfeeds.dll
2010-08-18 19:35:47 ----A---- C:\Windows\system32\msexch40.dll
2010-08-18 19:35:47 ----A---- C:\Windows\system32\msexcl40.dll
2010-08-18 19:35:47 ----A---- C:\Windows\system32\msdtctm.dll
2010-08-18 19:35:47 ----A---- C:\Windows\system32\msdtcprx.dll
2010-08-18 19:35:47 ----A---- C:\Windows\system32\msdrm.dll
2010-08-18 19:35:47 ----A---- C:\Windows\system32\msctfui.dll
2010-08-18 19:35:47 ----A---- C:\Windows\system32\msctfp.dll
2010-08-18 19:35:47 ----A---- C:\Windows\system32\MsCtfMonitor.dll
2010-08-18 19:35:47 ----A---- C:\Windows\system32\msctf.dll
2010-08-18 19:35:47 ----A---- C:\Windows\system32\chgusr.exe
2010-08-18 19:35:47 ----A---- C:\Windows\system32\chgport.exe
2010-08-18 19:35:47 ----A---- C:\Windows\system32\change.exe
2010-08-18 19:35:47 ----A---- C:\Windows\system32\certutil.exe
2010-08-18 19:35:46 ----A---- C:\Windows\system32\msimsg.dll
2010-08-18 19:35:46 ----A---- C:\Windows\system32\MPSSVC.dll
2010-08-18 19:35:46 ----A---- C:\Windows\system32\mprapi.dll
2010-08-18 19:35:46 ----A---- C:\Windows\system32\mpr.dll
2010-08-18 19:35:45 ----A---- C:\Windows\system32\mscories.dll
2010-08-18 19:35:45 ----A---- C:\Windows\system32\mscorier.dll
2010-08-18 19:35:45 ----A---- C:\Windows\system32\mscoree.dll
2010-08-18 19:35:45 ----A---- C:\Windows\system32\mscms.dll
2010-08-18 19:35:45 ----A---- C:\Windows\system32\mscandui.dll
2010-08-18 19:35:45 ----A---- C:\Windows\system32\modemui.dll
2010-08-18 19:35:45 ----A---- C:\Windows\system32\MMDevAPI.dll
2010-08-18 19:35:45 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2010-08-18 19:35:45 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2010-08-18 19:35:45 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2010-08-18 19:35:44 ----A---- C:\Windows\system32\drivers\mrxdav.sys
2010-08-18 19:35:41 ----A---- C:\Windows\system32\NetProjW.dll
2010-08-18 19:35:41 ----A---- C:\Windows\system32\netplwiz.dll
2010-08-18 19:35:41 ----A---- C:\Windows\system32\netlogon.dll
2010-08-18 19:35:41 ----A---- C:\Windows\system32\netiohlp.dll
2010-08-18 19:35:41 ----A---- C:\Windows\system32\netcenter.dll
2010-08-18 19:35:41 ----A---- C:\Windows\system32\netapi32.dll
2010-08-18 19:35:41 ----A---- C:\Windows\system32\ncryptui.dll
2010-08-18 19:35:41 ----A---- C:\Windows\system32\ncrypt.dll
2010-08-18 19:35:41 ----A---- C:\Windows\system32\mtxclu.dll
2010-08-18 19:35:41 ----A---- C:\Windows\system32\drivers\netbt.sys
2010-08-18 19:35:41 ----A---- C:\Windows\system32\drivers\ndiswan.sys
2010-08-18 19:35:41 ----A---- C:\Windows\system32\drivers\ndis.sys
2010-08-18 19:35:41 ----A---- C:\Windows\system32\drivers\mup.sys
2010-08-18 19:35:40 ----A---- C:\Windows\system32\NcdProp.dll
2010-08-18 19:35:40 ----A---- C:\Windows\system32\NaturalLanguage6.dll
2010-08-18 19:35:40 ----A---- C:\Windows\system32\msxml6.dll
2010-08-18 19:35:40 ----A---- C:\Windows\system32\msxml3.dll
2010-08-18 19:35:39 ----A---- C:\Windows\system32\newdev.exe
2010-08-18 19:35:39 ----A---- C:\Windows\system32\newdev.dll
2010-08-18 19:35:39 ----A---- C:\Windows\system32\networkmap.dll
2010-08-18 19:35:39 ----A---- C:\Windows\system32\networkexplorer.dll
2010-08-18 19:35:39 ----A---- C:\Windows\system32\netshell.dll
2010-08-18 19:35:38 ----A---- C:\Windows\system32\networkitemfactory.dll
2010-08-18 19:35:38 ----A---- C:\Windows\system32\msscntrs.dll
2010-08-18 19:35:38 ----A---- C:\Windows\system32\msscb.dll
2010-08-18 19:35:38 ----A---- C:\Windows\system32\msrepl40.dll
2010-08-18 19:35:38 ----A---- C:\Windows\system32\msrd3x40.dll
2010-08-18 19:35:38 ----A---- C:\Windows\system32\msrd2x40.dll
2010-08-18 19:35:38 ----A---- C:\Windows\system32\msrating.dll
2010-08-18 19:35:38 ----A---- C:\Windows\system32\mspbde40.dll
2010-08-18 19:35:38 ----A---- C:\Windows\system32\msnetobj.dll
2010-08-18 19:35:38 ----A---- C:\Windows\system32\MSMPEG2VDEC.DLL
2010-08-18 19:35:38 ----A---- C:\Windows\system32\msltus40.dll
2010-08-18 19:35:38 ----A---- C:\Windows\system32\msjtes40.dll
2010-08-18 19:35:38 ----A---- C:\Windows\system32\msjter40.dll
2010-08-18 19:35:38 ----A---- C:\Windows\system32\msjint40.dll
2010-08-18 19:35:38 ----A---- C:\Windows\system32\msjetoledb40.dll
2010-08-18 19:35:38 ----A---- C:\Windows\system32\msinfo32.exe
2010-08-18 19:35:38 ----A---- C:\Windows\system32\msimtf.dll
2010-08-18 19:35:38 ----A---- C:\Windows\system32\drivers\msrpc.sys
2010-08-18 19:35:38 ----A---- C:\Windows\system32\drivers\msiscsi.sys
2010-08-18 19:35:37 ----A---- C:\Windows\system32\msxbde40.dll
2010-08-18 19:35:37 ----A---- C:\Windows\system32\mswstr10.dll
2010-08-18 19:35:37 ----A---- C:\Windows\system32\mswsock.dll
2010-08-18 19:35:37 ----A---- C:\Windows\system32\mswdat10.dll
2010-08-18 19:35:37 ----A---- C:\Windows\system32\MSVidCtl.dll
2010-08-18 19:35:37 ----A---- C:\Windows\system32\msvcrt.dll
2010-08-18 19:35:37 ----A---- C:\Windows\system32\msvcp60.dll
2010-08-18 19:35:37 ----A---- C:\Windows\system32\msv1_0.dll
2010-08-18 19:35:37 ----A---- C:\Windows\system32\msutb.dll
2010-08-18 19:35:37 ----A---- C:\Windows\system32\mstscax.dll
2010-08-18 19:35:37 ----A---- C:\Windows\system32\mstsc.exe
2010-08-18 19:35:37 ----A---- C:\Windows\system32\mstlsapi.dll
2010-08-18 19:35:37 ----A---- C:\Windows\system32\mstime.dll
2010-08-18 19:35:37 ----A---- C:\Windows\system32\mstext40.dll
2010-08-18 19:35:37 ----A---- C:\Windows\system32\mssvp.dll
2010-08-18 19:35:37 ----A---- C:\Windows\system32\msstrc.dll
2010-08-18 19:35:37 ----A---- C:\Windows\system32\mssrch.dll
2010-08-18 19:35:37 ----A---- C:\Windows\system32\mssprxy.dll
2010-08-18 19:35:37 ----A---- C:\Windows\system32\mssphtb.dll
2010-08-18 19:35:37 ----A---- C:\Windows\system32\mssph.dll
2010-08-18 19:35:37 ----A---- C:\Windows\system32\mssitlb.dll
2010-08-18 19:35:37 ----A---- C:\Windows\system32\msshsq.dll
2010-08-18 19:35:37 ----A---- C:\Windows\system32\msshooks.dll
2010-08-18 19:35:37 ----A---- C:\Windows\system32\msscp.dll
2010-08-18 19:35:37 ----A---- C:\Windows\system32\msjet40.dll
2010-08-18 19:35:37 ----A---- C:\Windows\system32\msisip.dll
2010-08-18 19:35:37 ----A---- C:\Windows\system32\InkEd.dll
2010-08-18 19:35:37 ----A---- C:\Windows\system32\inetcomm.dll
2010-08-18 19:35:36 ----A---- C:\Windows\system32\infocardapi.dll
2010-08-18 19:35:36 ----A---- C:\Windows\system32\inetppui.dll
2010-08-18 19:35:36 ----A---- C:\Windows\system32\inetpp.dll
2010-08-18 19:35:36 ----A---- C:\Windows\system32\imm32.dll
2010-08-18 19:35:35 ----A---- C:\Windows\system32\jsproxy.dll
2010-08-18 19:35:35 ----A---- C:\Windows\system32\jscript.dll
2010-08-18 19:35:35 ----A---- C:\Windows\system32\iscsilog.dll
2010-08-18 19:35:35 ----A---- C:\Windows\system32\ipsmsnap.dll
2010-08-18 19:35:35 ----A---- C:\Windows\system32\IPSECSVC.DLL
2010-08-18 19:35:35 ----A---- C:\Windows\system32\ipsecsnp.dll
2010-08-18 19:35:35 ----A---- C:\Windows\system32\iphlpsvc.dll
2010-08-18 19:35:35 ----A---- C:\Windows\system32\IPHLPAPI.DLL
2010-08-18 19:35:35 ----A---- C:\Windows\system32\ipconfig.exe
2010-08-18 19:35:35 ----A---- C:\Windows\system32\input.dll
2010-08-18 19:35:34 ----A---- C:\Windows\system32\IMJP10K.DLL
2010-08-18 19:35:34 ----A---- C:\Windows\system32\imapi2fs.dll
2010-08-18 19:35:34 ----A---- C:\Windows\system32\imapi2.dll
2010-08-18 19:35:34 ----A---- C:\Windows\system32\imapi.dll
2010-08-18 19:35:34 ----A---- C:\Windows\system32\IKEEXT.DLL
2010-08-18 19:35:34 ----A---- C:\Windows\system32\ifmon.dll
2010-08-18 19:35:34 ----A---- C:\Windows\system32\iertutil.dll
2010-08-18 19:35:34 ----A---- C:\Windows\system32\iepeers.dll
2010-08-18 19:35:34 ----A---- C:\Windows\system32\ieframe.dll
2010-08-18 19:35:34 ----A---- C:\Windows\system32\iedkcs32.dll
2010-08-18 19:35:34 ----A---- C:\Windows\system32\ieapfltr.dll
2010-08-18 19:35:34 ----A---- C:\Windows\system32\ieaksie.dll
2010-08-18 19:35:34 ----A---- C:\Windows\system32\icardres.dll
2010-08-18 19:35:34 ----A---- C:\Windows\system32\icardagt.exe
2010-08-18 19:35:34 ----A---- C:\Windows\system32\iassvcs.dll
2010-08-18 19:35:34 ----A---- C:\Windows\system32\iassdo.dll
2010-08-18 19:35:34 ----A---- C:\Windows\system32\iassam.dll
2010-08-18 19:35:34 ----A---- C:\Windows\system32\iasrecst.dll
2010-08-18 19:35:34 ----A---- C:\Windows\system32\iasrad.dll
2010-08-18 19:35:34 ----A---- C:\Windows\system32\iaspolcy.dll
2010-08-18 19:35:33 ----A---- C:\Windows\system32\mfps.dll
2010-08-18 19:35:33 ----A---- C:\Windows\system32\mfpmp.exe
2010-08-18 19:35:33 ----A---- C:\Windows\system32\mfplat.dll
2010-08-18 19:35:33 ----A---- C:\Windows\system32\mferror.dll
2010-08-18 19:35:33 ----A---- C:\Windows\system32\mfc42u.dll
2010-08-18 19:35:33 ----A---- C:\Windows\system32\mfc42.dll
2010-08-18 19:35:33 ----A---- C:\Windows\system32\mf.dll
2010-08-18 19:35:32 ----A---- C:\Windows\system32\mimefilt.dll
2010-08-18 19:35:32 ----A---- C:\Windows\system32\milcore.dll
2010-08-18 19:35:31 ----A---- C:\Windows\system32\mmcndmgr.dll
2010-08-18 19:35:31 ----A---- C:\Windows\system32\mmcico.dll
2010-08-18 19:35:31 ----A---- C:\Windows\system32\mmci.dll
2010-08-18 19:35:31 ----A---- C:\Windows\system32\mmc.exe
2010-08-18 19:35:31 ----A---- C:\Windows\system32\midimap.dll
2010-08-18 19:35:31 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2010-08-18 19:35:31 ----A---- C:\Windows\system32\drivers\ks.sys
2010-08-18 19:35:30 ----A---- C:\Windows\system32\mcupdate_GenuineIntel.dll
2010-08-18 19:35:30 ----A---- C:\Windows\system32\mblctr.exe
2010-08-18 19:35:30 ----A---- C:\Windows\system32\l2nacp.dll
2010-08-18 19:35:30 ----A---- C:\Windows\system32\korwbrkr.dll
2010-08-18 19:35:30 ----A---- C:\Windows\system32\kernel32.dll
2010-08-18 19:35:30 ----A---- C:\Windows\system32\kerberos.dll
2010-08-18 19:35:30 ----A---- C:\Windows\system32\kdusb.dll
2010-08-18 19:35:30 ----A---- C:\Windows\system32\kdcom.dll
2010-08-18 19:35:30 ----A---- C:\Windows\system32\kd1394.dll
2010-08-18 19:35:30 ----A---- C:\Windows\system32\drivers\kbdhid.sys
2010-08-18 19:35:29 ----A---- C:\Windows\system32\shsetup.dll
2010-08-18 19:35:29 ----A---- C:\Windows\system32\MediaMetadataHandler.dll
2010-08-18 19:35:29 ----A---- C:\Windows\system32\mcmde.dll
2010-08-18 19:35:29 ----A---- C:\Windows\system32\Magnify.exe
2010-08-18 19:35:29 ----A---- C:\Windows\system32\lsasrv.dll
2010-08-18 19:35:29 ----A---- C:\Windows\system32\logoff.exe
2010-08-18 19:35:29 ----A---- C:\Windows\system32\logman.exe
2010-08-18 19:35:29 ----A---- C:\Windows\system32\logagent.exe
2010-08-18 19:35:29 ----A---- C:\Windows\system32\localspl.dll
2010-08-18 19:35:28 ----A---- C:\Windows\system32\WindowsCodecs.dll
2010-08-18 19:35:28 ----A---- C:\Windows\system32\wercon.exe
2010-08-18 19:35:28 ----A---- C:\Windows\system32\wer.dll
2010-08-18 19:35:28 ----A---- C:\Windows\system32\webcheck.dll
2010-08-18 19:35:28 ----A---- C:\Windows\system32\WebClnt.dll
2010-08-18 19:35:28 ----A---- C:\Windows\system32\wdscore.dll
2010-08-18 19:35:28 ----A---- C:\Windows\system32\wdc.dll
2010-08-18 19:35:27 ----A---- C:\Windows\system32\wininet.dll
2010-08-18 19:35:27 ----A---- C:\Windows\system32\winhttp.dll
2010-08-18 19:35:27 ----A---- C:\Windows\system32\WindowsUltimateExtrasCPL.dll
2010-08-18 19:35:27 ----A---- C:\Windows\system32\WindowsCodecsExt.dll
2010-08-18 19:35:27 ----A---- C:\Windows\system32\win32spl.dll
2010-08-18 19:35:27 ----A---- C:\Windows\system32\win32k.sys
2010-08-18 19:35:27 ----A---- C:\Windows\system32\wiaservc.dll
2010-08-18 19:35:27 ----A---- C:\Windows\system32\wiaaut.dll
2010-08-18 19:35:27 ----A---- C:\Windows\system32\whealogr.dll
2010-08-18 19:35:27 ----A---- C:\Windows\system32\WFS.exe
2010-08-18 19:35:27 ----A---- C:\Windows\system32\wevtutil.exe
2010-08-18 19:35:27 ----A---- C:\Windows\system32\wevtsvc.dll
2010-08-18 19:35:27 ----A---- C:\Windows\system32\wevtapi.dll
2010-08-18 19:35:27 ----A---- C:\Windows\system32\wersvc.dll
2010-08-18 19:35:27 ----A---- C:\Windows\system32\WerFaultSecure.exe
2010-08-18 19:35:27 ----A---- C:\Windows\system32\WerFault.exe
2010-08-18 19:35:27 ----A---- C:\Windows\system32\version.dll
2010-08-18 19:35:27 ----A---- C:\Windows\system32\vdsutil.dll
2010-08-18 19:35:27 ----A---- C:\Windows\system32\vdsdyn.dll
2010-08-18 19:35:27 ----A---- C:\Windows\system32\vds.exe
2010-08-18 19:35:27 ----A---- C:\Windows\system32\vdmdbg.dll
2010-08-18 19:35:27 ----A---- C:\Windows\system32\vbscript.dll
2010-08-18 19:35:27 ----A---- C:\Windows\system32\user32.dll
2010-08-18 19:35:27 ----A---- C:\Windows\system32\drivers\USBSTOR.SYS
2010-08-18 19:35:26 ----A---- C:\Windows\system32\wcnwiz2.dll
2010-08-18 19:35:26 ----A---- C:\Windows\system32\wcnwiz.dll
2010-08-18 19:35:26 ----A---- C:\Windows\system32\WcnNetsh.dll
2010-08-18 19:35:26 ----A---- C:\Windows\system32\wcncsvc.dll
2010-08-18 19:35:26 ----A---- C:\Windows\system32\wbengine.exe
2010-08-18 19:35:26 ----A---- C:\Windows\system32\uxsms.dll
2010-08-18 19:35:26 ----A---- C:\Windows\system32\Utilman.exe
2010-08-18 19:35:26 ----A---- C:\Windows\system32\usp10.dll
2010-08-18 19:35:26 ----A---- C:\Windows\system32\userenv.dll
2010-08-18 19:35:26 ----A---- C:\Windows\system32\usercpl.dll
2010-08-18 19:35:26 ----A---- C:\Windows\system32\drivers\watchdog.sys
2010-08-18 19:35:26 ----A---- C:\Windows\system32\drivers\usbport.sys
2010-08-18 19:35:25 ----A---- C:\Windows\system32\w32time.dll
2010-08-18 19:35:25 ----A---- C:\Windows\system32\VSSVC.exe
2010-08-18 19:35:25 ----A---- C:\Windows\system32\drivers\volsnap.sys
2010-08-18 19:35:25 ----A---- C:\Windows\system32\drivers\volmgrx.sys
2010-08-18 19:35:24 ----A---- C:\Windows\system32\wscisvif.dll
2010-08-18 19:35:24 ----A---- C:\Windows\system32\WscEapPr.dll
2010-08-18 19:35:24 ----A---- C:\Windows\system32\wscapi.dll
2010-08-18 19:35:24 ----A---- C:\Windows\system32\vssapi.dll
2010-08-18 19:35:23 ----A---- C:\Windows\system32\wsdchngr.dll
2010-08-18 19:35:22 ----A---- C:\Windows\system32\WSDMon.dll
2010-08-18 19:35:22 ----A---- C:\Windows\system32\WSDApi.dll
2010-08-18 19:35:22 ----A---- C:\Windows\system32\wscript.exe
2010-08-18 19:35:22 ----A---- C:\Windows\system32\wscntfy.dll
2010-08-18 19:35:20 ----A---- C:\Windows\system32\wscsvc.dll
2010-08-18 19:35:20 ----A---- C:\Windows\system32\WMVXENCD.DLL
2010-08-18 19:35:20 ----A---- C:\Windows\system32\WMVSDECD.DLL
2010-08-18 19:35:19 ----A---- C:\Windows\system32\wow32.dll
2010-08-18 19:35:19 ----A---- C:\Windows\system32\WMVENCOD.DLL
2010-08-18 19:35:18 ----A---- C:\Windows\system32\WMVCORE.DLL
2010-08-18 19:35:17 ----A---- C:\Windows\system32\wpccpl.dll
2010-08-18 19:35:16 ----A---- C:\Windows\system32\wusa.exe
2010-08-18 19:35:16 ----A---- C:\Windows\system32\wpcsvc.dll
2010-08-18 19:35:16 ----A---- C:\Windows\system32\wpcao.dll
2010-08-18 19:35:14 ----A---- C:\Windows\system32\xmlfilter.dll
2010-08-18 19:35:13 ----A---- C:\Windows\system32\wshext.dll
2010-08-18 19:35:13 ----A---- C:\Windows\system32\wshbth.dll
2010-08-18 19:35:13 ----A---- C:\Windows\system32\wsepno.dll
2010-08-18 19:35:09 ----A---- C:\Windows\system32\wsnmp32.dll
2010-08-18 19:35:09 ----A---- C:\Windows\system32\WsmSvc.dll
2010-08-18 19:35:09 ----A---- C:\Windows\system32\wlanpref.dll
2010-08-18 19:35:09 ----A---- C:\Windows\system32\wlanmsm.dll
2010-08-18 19:35:08 ----A---- C:\Windows\system32\wlanui.dll
2010-08-18 19:35:08 ----A---- C:\Windows\system32\wlansvc.dll
2010-08-18 19:35:08 ----A---- C:\Windows\system32\wlanhlp.dll
2010-08-18 19:35:08 ----A---- C:\Windows\system32\wlangpui.dll
2010-08-18 19:35:08 ----A---- C:\Windows\system32\wisptis.exe
2010-08-18 19:35:07 ----A---- C:\Windows\system32\wlgpclnt.dll
2010-08-18 19:35:07 ----A---- C:\Windows\system32\Wldap32.dll
2010-08-18 19:35:05 ----A---- C:\Windows\system32\winrnr.dll
2010-08-18 19:35:05 ----A---- C:\Windows\system32\winresume.exe
2010-08-18 19:35:04 ----A---- C:\Windows\system32\WinSCard.dll
2010-08-18 19:35:00 ----A---- C:\Windows\system32\WinSAT.exe
2010-08-18 19:34:57 ----A---- C:\Windows\system32\wmpmde.dll
2010-08-18 19:34:57 ----A---- C:\Windows\system32\WMPhoto.dll
2010-08-18 19:34:57 ----A---- C:\Windows\system32\wmpeffects.dll
2010-08-18 19:34:57 ----A---- C:\Windows\system32\WMNetMgr.dll
2010-08-18 19:34:57 ----A---- C:\Windows\system32\winsrv.dll
2010-08-18 19:34:57 ----A---- C:\Windows\system32\winmm.dll
2010-08-18 19:34:57 ----A---- C:\Windows\system32\winlogon.exe
2010-08-18 19:34:57 ----A---- C:\Windows\system32\winload.exe
2010-08-18 19:34:56 ----A---- C:\Windows\system32\wmploc.DLL
2010-08-18 19:34:56 ----A---- C:\Windows\system32\wmp.dll
2010-08-18 19:34:55 ----A---- C:\Windows\system32\wmicmiplugin.dll
2010-08-18 19:34:55 ----A---- C:\Windows\system32\wmdrmsdk.dll
2010-08-18 19:34:55 ----A---- C:\Windows\system32\sud.dll
2010-08-18 19:34:55 ----A---- C:\Windows\system32\Storprop.dll
2010-08-18 19:34:55 ----A---- C:\Windows\system32\stobject.dll
2010-08-18 19:34:55 ----A---- C:\Windows\system32\drivers\stream.sys
2010-08-18 19:34:55 ----A---- C:\Windows\system32\drivers\Storport.sys
2010-08-18 19:34:53 ----A---- C:\Windows\system32\srvsvc.dll
2010-08-18 19:34:53 ----A---- C:\Windows\system32\srchadmin.dll
2010-08-18 19:34:53 ----A---- C:\Windows\system32\srcore.dll
2010-08-18 19:34:53 ----A---- C:\Windows\system32\drivers\srvnet.sys
2010-08-18 19:34:53 ----A---- C:\Windows\system32\drivers\srv2.sys
2010-08-18 19:34:53 ----A---- C:\Windows\system32\drivers\srv.sys
2010-08-18 19:34:52 ----A---- C:\Windows\system32\sysmain.dll
2010-08-18 19:34:52 ----A---- C:\Windows\system32\sysclass.dll
2010-08-18 19:34:52 ----A---- C:\Windows\system32\SyncCenter.dll
2010-08-18 19:34:52 ----A---- C:\Windows\system32\swprv.dll
2010-08-18 19:34:52 ----A---- C:\Windows\system32\smss.exe
2010-08-18 19:34:52 ----A---- C:\Windows\system32\SmiEngine.dll
2010-08-18 19:34:52 ----A---- C:\Windows\system32\SMBHelperClass.dll
2010-08-18 19:34:52 ----A---- C:\Windows\system32\SmartcardCredentialProvider.dll
2010-08-18 19:34:52 ----A---- C:\Windows\system32\slwmi.dll
2010-08-18 19:34:52 ----A---- C:\Windows\system32\slcc.dll
2010-08-18 19:34:52 ----A---- C:\Windows\system32\SLC.dll
2010-08-18 19:34:52 ----A---- C:\Windows\system32\shwebsvc.dll
2010-08-18 19:34:52 ----A---- C:\Windows\system32\shsvcs.dll
2010-08-18 19:34:52 ----A---- C:\Windows\system32\drivers\smb.sys
2010-08-18 19:34:51 ----A---- C:\Windows\system32\sqlsrv32.dll
2010-08-18 19:34:51 ----A---- C:\Windows\system32\spwmp.dll
2010-08-18 19:34:51 ----A---- C:\Windows\system32\spwizui.dll
2010-08-18 19:34:51 ----A---- C:\Windows\system32\spwinsat.dll
2010-08-18 19:34:51 ----A---- C:\Windows\system32\spreview.exe
2010-08-18 19:34:51 ----A---- C:\Windows\system32\spp.dll
2010-08-18 19:34:51 ----A---- C:\Windows\system32\spoolsv.exe
2010-08-18 19:34:51 ----A---- C:\Windows\system32\spoolss.dll
2010-08-18 19:34:51 ----A---- C:\Windows\system32\spinstall.exe
2010-08-18 19:34:51 ----A---- C:\Windows\system32\sperror.dll
2010-08-18 19:34:51 ----A---- C:\Windows\system32\spcmsg.dll
2010-08-18 19:34:51 ----A---- C:\Windows\system32\softkbd.dll
2010-08-18 19:34:51 ----A---- C:\Windows\system32\SnippingTool.exe
2010-08-18 19:34:51 ----A---- C:\Windows\system32\SndVol.exe
2010-08-18 19:34:51 ----A---- C:\Windows\system32\slwga.dll
2010-08-18 19:34:51 ----A---- C:\Windows\system32\SLUINotify.dll
2010-08-18 19:34:51 ----A---- C:\Windows\system32\SLUI.exe
2010-08-18 19:34:51 ----A---- C:\Windows\system32\SLsvc.exe
2010-08-18 19:34:51 ----A---- C:\Windows\system32\slmgr.vbs
2010-08-18 19:34:51 ----A---- C:\Windows\system32\SLLUA.exe
2010-08-18 19:34:51 ----A---- C:\Windows\system32\SLCommDlg.dll
2010-08-18 19:34:51 ----A---- C:\Windows\system32\slcinst.dll
2010-08-18 19:34:51 ----A---- C:\Windows\system32\SLCExt.dll
2010-08-18 19:34:51 ----A---- C:\Windows\system32\drivers\spsys.sys
2010-08-18 19:34:50 ----A---- C:\Windows\system32\zipfldr.dll
2010-08-18 19:34:50 ----A---- C:\Windows\system32\urlmon.dll
2010-08-18 19:34:50 ----A---- C:\Windows\system32\untfs.dll
2010-08-18 19:34:50 ----A---- C:\Windows\system32\TsWpfWrp.exe
2010-08-18 19:34:50 ----A---- C:\Windows\system32\TSTheme.exe
2010-08-18 19:34:50 ----A---- C:\Windows\system32\tskill.exe
2010-08-18 19:34:50 ----A---- C:\Windows\system32\tsgqec.dll
2010-08-18 19:34:50 ----A---- C:\Windows\system32\tsdiscon.exe
2010-08-18 19:34:50 ----A---- C:\Windows\system32\tscupgrd.exe
2010-08-18 19:34:50 ----A---- C:\Windows\system32\drivers\usbhub.sys
2010-08-18 19:34:50 ----A---- C:\Windows\system32\drivers\usbehci.sys
2010-08-18 19:34:50 ----A---- C:\Windows\system32\drivers\USBCAMD2.sys
2010-08-18 19:34:50 ----A---- C:\Windows\system32\drivers\USBCAMD.sys
2010-08-18 19:34:50 ----A---- C:\Windows\system32\drivers\usb8023.sys
2010-08-18 19:34:50 ----A---- C:\Windows\system32\drivers\udfs.sys
2010-08-18 19:34:49 ----A---- C:\Windows\system32\umrdp.dll
2010-08-18 19:34:49 ----A---- C:\Windows\system32\umpnpmgr.dll
2010-08-18 19:34:49 ----A---- C:\Windows\system32\ulib.dll
2010-08-18 19:34:49 ----A---- C:\Windows\system32\uDWM.dll
2010-08-18 19:34:49 ----A---- C:\Windows\system32\systemcpl.dll
2010-08-18 19:34:48 ----A---- C:\Windows\system32\tscon.exe
2010-08-18 19:34:48 ----A---- C:\Windows\system32\tscfgwmi.dll
2010-08-18 19:34:48 ----A---- C:\Windows\system32\tsbyuv.dll
2010-08-18 19:34:48 ----A---- C:\Windows\system32\tquery.dll
2010-08-18 19:34:48 ----A---- C:\Windows\system32\themeui.dll
2010-08-18 19:34:48 ----A---- C:\Windows\system32\themecpl.dll
2010-08-18 19:34:48 ----A---- C:\Windows\system32\thawbrkr.dll
2010-08-18 19:34:48 ----A---- C:\Windows\system32\termsrv.dll
2010-08-18 19:34:48 ----A---- C:\Windows\system32\tcpmon.dll
2010-08-18 19:34:48 ----A---- C:\Windows\system32\tcpipcfg.dll
2010-08-18 19:34:48 ----A---- C:\Windows\system32\taskeng.exe
2010-08-18 19:34:48 ----A---- C:\Windows\system32\taskcomp.dll
2010-08-18 19:34:48 ----A---- C:\Windows\system32\tapisrv.dll
2010-08-18 19:34:48 ----A---- C:\Windows\system32\drivers\termdd.sys
2010-08-18 19:34:48 ----A---- C:\Windows\system32\drivers\tdx.sys
2010-08-18 19:29:27 ----D---- C:\Windows\system32\EventProviders
2010-08-18 19:29:24 ----D---- C:\39158658e89b5e6e0173
2010-08-18 18:57:51 ----D---- C:\Program Files\CCleaner
2010-08-16 20:13:33 ----D---- C:\Windows\temp
2010-08-16 20:07:20 ----D---- C:\$RECYCLE.BIN
2010-08-16 18:00:48 ----D---- C:\Program Files\trend micro

[davem]

======List of files/folders modified in the last 1 months======

2010-08-18 20:54:28 ----D---- C:\Windows\Prefetch
2010-08-18 20:53:42 ----D---- C:\Windows
2010-08-18 20:50:46 ----SHD---- C:\Windows\Installer
2010-08-18 20:50:23 ----D---- C:\Windows\system32\catroot2
2010-08-18 20:50:23 ----D---- C:\Windows\system32\catroot
2010-08-18 20:50:22 ----D---- C:\Windows\inf
2010-08-18 20:50:16 ----D---- C:\Windows\system32\drivers
2010-08-18 20:50:15 ----D---- C:\Windows\System32
2010-08-18 20:50:01 ----RD---- C:\Program Files
2010-08-18 20:49:53 ----SHD---- C:\System Volume Information
2010-08-18 20:48:48 ----D---- C:\ProgramData
2010-08-18 20:42:52 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-08-18 20:32:30 ----D---- C:\Windows\winsxs
2010-08-18 20:32:13 ----D---- C:\Windows\SoftwareDistribution
2010-08-18 20:30:50 ----RSD---- C:\Windows\assembly
2010-08-18 20:30:50 ----D---- C:\Windows\Microsoft.NET
2010-08-18 20:27:48 ----SHD---- C:\Boot
2010-08-18 20:21:20 ----D---- C:\Program Files\Windows Mail
2010-08-18 20:21:20 ----D---- C:\Program Files\Windows Calendar
2010-08-18 20:21:20 ----D---- C:\Program Files\Movie Maker
2010-08-18 20:21:19 ----D---- C:\Program Files\Windows Sidebar
2010-08-18 20:21:19 ----D---- C:\Program Files\Windows Media Player
2010-08-18 20:21:19 ----D---- C:\Program Files\Internet Explorer
2010-08-18 20:21:18 ----D---- C:\Program Files\Windows Journal
2010-08-18 20:21:18 ----D---- C:\Program Files\Windows Collaboration
2010-08-18 20:21:17 ----D---- C:\Program Files\Windows Photo Gallery
2010-08-18 20:21:17 ----D---- C:\Program Files\Common Files\System
2010-08-18 20:21:15 ----D---- C:\Windows\servicing
2010-08-18 20:21:15 ----D---- C:\Windows\ehome
2010-08-18 20:21:15 ----D---- C:\Program Files\Windows Defender
2010-08-18 20:21:06 ----D---- C:\Windows\IME
2010-08-18 20:21:05 ----D---- C:\Windows\system32\lv-LV
2010-08-18 20:21:05 ----D---- C:\Windows\PolicyDefinitions
2010-08-18 20:21:04 ----D---- C:\Windows\system32\XPSViewer
2010-08-18 20:21:04 ----D---- C:\Windows\system32\sk-SK
2010-08-18 20:21:04 ----D---- C:\Windows\system32\ko-KR
2010-08-18 20:21:04 ----D---- C:\Windows\system32\it-IT
2010-08-18 20:21:04 ----D---- C:\Windows\system32\hr-HR
2010-08-18 20:21:04 ----D---- C:\Windows\system32\et-EE
2010-08-18 20:21:04 ----D---- C:\Windows\system32\en-US
2010-08-18 20:21:04 ----D---- C:\Windows\system32\el-GR
2010-08-18 20:21:04 ----D---- C:\Windows\system32\de-DE
2010-08-18 20:21:04 ----D---- C:\Windows\system32\da-DK
2010-08-18 20:21:03 ----D---- C:\Windows\system32\oobe
2010-08-18 20:21:03 ----D---- C:\Windows\system32\migration
2010-08-18 20:21:02 ----D---- C:\Windows\system32\AdvancedInstallers
2010-08-18 20:21:01 ----D---- C:\Windows\system32\sv-SE
2010-08-18 20:21:01 ----D---- C:\Windows\system32\setup
2010-08-18 20:21:01 ----D---- C:\Windows\system32\ru-RU
2010-08-18 20:21:01 ----D---- C:\Windows\system32\he-IL
2010-08-18 20:21:01 ----D---- C:\Windows\system32\fr-FR
2010-08-18 20:21:01 ----D---- C:\Windows\system32\fi-FI
2010-08-18 20:21:01 ----D---- C:\Windows\system32\cs
2010-08-18 20:21:00 ----D---- C:\Windows\system32\cs-CZ
2010-08-18 20:20:58 ----D---- C:\Windows\system32\SLUI
2010-08-18 20:20:58 ----D---- C:\Windows\system32\pt-PT
2010-08-18 20:20:58 ----D---- C:\Windows\system32\hu-HU
2010-08-18 20:20:57 ----D---- C:\Windows\system32\zh-TW
2010-08-18 20:20:57 ----D---- C:\Windows\system32\zh-CN
2010-08-18 20:20:57 ----D---- C:\Windows\system32\uk-UA
2010-08-18 20:20:57 ----D---- C:\Windows\system32\sr-Latn-CS
2010-08-18 20:20:57 ----D---- C:\Windows\system32\sl-SI
2010-08-18 20:20:57 ----D---- C:\Windows\system32\pl-PL
2010-08-18 20:20:57 ----D---- C:\Windows\system32\manifeststore
2010-08-18 20:20:57 ----D---- C:\Windows\system32\ja-JP
2010-08-18 20:20:57 ----D---- C:\Windows\system32\es-ES
2010-08-18 20:20:56 ----D---- C:\Windows\system32\th-TH
2010-08-18 20:20:56 ----D---- C:\Windows\system32\ro-RO
2010-08-18 20:20:56 ----D---- C:\Windows\system32\drivers\UMDF
2010-08-18 20:20:56 ----D---- C:\Windows\system32\drivers\cs-CZ
2010-08-18 20:20:56 ----D---- C:\Windows\system32\bg-BG
2010-08-18 20:20:55 ----D---- C:\Windows\system32\tr-TR
2010-08-18 20:20:54 ----D---- C:\Windows\system32\wbem
2010-08-18 20:20:54 ----D---- C:\Windows\system32\nl-NL
2010-08-18 20:20:54 ----D---- C:\Windows\system32\nb-NO
2010-08-18 20:20:53 ----D---- C:\Windows\system32\pt-BR
2010-08-18 20:20:53 ----D---- C:\Windows\system32\migwiz
2010-08-18 20:20:53 ----D---- C:\Windows\system32\lt-LT
2010-08-18 20:20:53 ----D---- C:\Windows\system32\ar-SA
2010-08-18 20:20:18 ----RSD---- C:\Windows\Fonts
2010-08-18 20:20:17 ----D---- C:\Windows\AppPatch
2010-08-18 20:20:09 ----D---- C:\Windows\system32\Boot
2010-08-18 20:19:42 ----D---- C:\Windows\Minidump
2010-08-18 19:58:08 ----D---- C:\Windows\system32\RTCOM
2010-08-18 19:50:26 ----A---- C:\Windows\fonts\GlobalUserInterface.CompositeFont
2010-08-18 18:58:32 ----D---- C:\Windows\Debug
2010-08-17 20:32:32 ----D---- C:\Downloads
2010-08-17 19:04:53 ----A---- C:\Windows\NeroDigital.ini
2010-08-16 21:09:19 ----D---- C:\ProgramData\Lavasoft
2010-08-16 21:09:19 ----D---- C:\Program Files\Lavasoft
2010-08-16 21:09:06 ----DC---- C:\Windows\system32\DRVSTORE
2010-08-16 20:07:27 ----A---- C:\Windows\system.ini
2010-08-16 20:07:15 ----D---- C:\Windows\system32\drivers\etc
2010-08-16 20:05:04 ----D---- C:\Windows\system
2010-08-16 20:02:50 ----D---- C:\Program Files\Common Files
2010-08-16 18:27:18 ----D---- C:\Program Files\AIMP2
2010-08-16 17:21:47 ----D---- C:\ProgramData\DVD Shrink
2010-08-06 13:13:17 ----D---- C:\Windows\system32\FxsTmp
2010-07-25 08:42:06 ----D---- C:\Program Files\Mozilla Firefox

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 fvevol;BitLocker Drive Encryption Filter Driver; C:\Windows\System32\DRIVERS\fvevol.sys [2009-04-10 143848]
R0 Pnp680r;Silicon Image SiI 0680 Medley Raid Controller; C:\Windows\system32\DRIVERS\pnp680r.sys [2007-07-19 110120]
R0 PxHelp20;PxHelp20; C:\Windows\system32\DRIVERS\PxHelp20.sys [2008-09-06 20016]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2009-01-01 717296]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2010-04-28 114984]
R1 SbFw;SbFw; C:\Windows\system32\drivers\SbFw.sys [2008-10-31 270888]
R1 sbhips;Sunbelt HIPS Driver; C:\Windows\system32\drivers\sbhips.sys [2008-06-21 66600]
R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};Power Control [2009/04/25 13:23:15]; \??\C:\Program Files\CyberLink\PowerDVD8\000.fcl [2009-01-20 87536]
R2 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2010-06-24 136120]
R2 epfwwfpr;epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys [2010-04-28 96896]
R3 Afc;PPdus ASPI Shell; C:\Windows\system32\drivers\Afc.sys [2005-02-23 11776]
R3 BENDER;Pinnacle AV/DV2 Capture; C:\Windows\system32\drivers\bender.sys [2006-12-04 203264]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2008-02-14 2061528]
R3 MarvinBus;Pinnacle Marvin Bus; C:\Windows\system32\DRIVERS\MarvinBus.sys [2005-09-23 171520]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2007-12-11 8238688]
R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2008-01-25 106496]
R3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Miniport; C:\Windows\system32\DRIVERS\sbfwim.sys [2008-06-21 65576]
S0 Lbd;Lbd; C:\Windows\system32\DRIVERS\Lbd.sys []
S3 61883;61883 Unit Device; C:\Windows\system32\DRIVERS\61883.sys [2008-05-21 45696]
S3 Avc;Zařízení AVC; C:\Windows\system32\DRIVERS\avc.sys [2008-05-21 40448]
S3 azpvcygo;azpvcygo; C:\Windows\system32\drivers\azpvcygo.sys []
S3 CrystalSysInfo;CrystalSysInfo; \??\C:\Program Files\MediaCoder\SysInfo.sys [2007-09-25 15152]
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\Windows\system32\drivers\drmkaud.sys [2008-05-21 5632]
S3 gdrv;gdrv; \??\C:\Windows\gdrv.sys [2009-06-10 16608]
S3 HdAudAddService;Ovladač funkce Microsoft 1.1 UAA pro službu zvuku High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 MSDV;Microsoft DV Camera and VCR; C:\Windows\system32\DRIVERS\msdv.sys [2008-05-21 52608]
S3 MSKSSRV;Server proxy služby datových proudů Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-05-21 8192]
S3 MSPCLOCK;Server proxy hodin datových proudů Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-05-21 5888]
S3 MSPQM;Server proxy správce kvality datových proudů Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-05-21 5504]
S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-05-21 6016]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2008-05-21 35328]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2008-05-21 39936]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-05-21 83328]
S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-05-21 6656]
S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-05-21 386616]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:\Program Files\Bonjour\mDNSResponder.exe [2006-02-28 229376]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2010-07-02 810144]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2009-04-13 73728]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [2006-10-26 335872]
R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe [2008-06-08 877864]
R2 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; C:\Windows\system32\IoctlSvc.exe [2006-12-19 81920]
R2 SbPF.Launcher;SbPF.Launcher; C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe [2008-10-31 95528]
R2 SPF4;Sunbelt Personal Firewall 4; C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe [2008-10-31 1365288]
R2 TomTomHOMEService;TomTomHOMEService; C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe [2010-06-24 92008]
R3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe [2008-06-24 537896]
S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2008-09-06 72704]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2010-07-02 33584]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2008-08-24 654848]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]

-----------------EOF-----------------

[Caroprd111]

Doporučuji aktualizovat Adobe Reader http://www.stahuj.centrum.cz/podnikani_ ... batreader/


Jinak je log v pořádku.

[davem]

Mnohokrate dekuji:) omlouvam se za zpozdenou reakci...trutnov fest no Jeste jednou dekuji.