VIRY.CZ

Pomáháme v boji s počítačovou havěti!
https://forum.viry.cz:443/

Problém zo security center vo Win 7

https://forum.viry.cz:443/viewtopic.php?t=107895

Stránka 1 z 1

Problém zo security center vo Win 7

Napsal: 27 pro 2010 12:49
od gh0st
Pred pár dňami som mal nejaký malware ktorý som pomocou malwarebytes antimalware odstránil ale prestal mi fungovať security center service. Aj keď ho ručne spustím za pár sekúnd sa sám vypne.

RSIT:

Kód: Vybrat vše

Logfile of random's system information tool 1.08 (written by random/random)
Run by ghost at 2010-12-27 12:43:51
Microsoft Windows 7 Home Premium  Service Pack 3
System drive C: has 89 GB (37%) free of 240 GB
Total RAM: 2814 MB (48% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:43:54, on 27. 12. 2010
Platform: Windows 7  (WinNT 6.00.3504)
MSIE: Internet Explorer v9.00 (9.00.7930.16406)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Apoint2K\HidFind.exe
C:\Windows\system32\conhost.exe
C:\Users\ghost\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\ghost\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\ghost\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\ghost\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\ghost\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\ghost\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\ghost\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\ghost\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\ghost\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\ghost\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\ghost\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\ghost\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\ghost\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\ghost\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\ghost\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\ghost\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\ghost\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\ghost\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\ghost\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\ghost\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\ghost\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\ghost\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\mmc.exe
C:\Windows\system32\taskmgr.exe
C:\Users\ghost\Downloads\RSIT.exe
C:\Users\ghost\Downloads\ghost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost; 127.0.0.1; <local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Odeslat obrázek do zařízení &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Odeslat stránku do zařízení &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O17 - HKLM\System\CCS\Services\Tcpip\..\{A9766CBD-E990-4156-B51C-29E4580AB4CA}: NameServer = 208.67.220.220,208.67.222.222
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Event Log Watch (LogWatch) - CA - C:\CA_LIC\LogWatNT.exe
O23 - Service: O2FLASH - O2Micro International - C:\Windows\system32\DRIVERS\o2flash.exe
O23 - Service: Oracle DOMA VSS Writer Service (OracleVssWriterDOMA) - Unknown owner - c:\oracle\product\11.2.0\dbhome_1\bin\OraVSSW.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

--
End of file - 7177 bytes

======Scheduled tasks folder======

C:\Windows\tasks\TYRSZTW.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21 439168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-12-09 41760]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IntelliPoint"=C:\Program Files\Microsoft IntelliPoint\ipoint.exe [2009-11-11 1468256]
"Apoint"=C:\Program Files\Apoint2K\Apoint.exe [2010-03-01 225280]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2010-11-03 281768]
"AdobeAAMUpdater-1.0"=C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2010-02-22 500208]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [2010-03-01 7703072]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"AdobeBridge"= []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager]
C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe [2008-08-14 611712]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
C:\Users\ghost\AppData\Local\Google\Update\GoogleUpdate.exe [2010-03-01 135664]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\JP595IR86O]
C:\Users\ghost\AppData\Local\Temp\Nsp.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pando Media Booster]
C:\Program Files\Pando Networks\Media Booster\PMB.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-07-29 98304]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
C:\Program Files\Steam\Steam.exe [2010-11-17 1242448]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-05-14 248552]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\EFS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Power]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\RpcEptMapper]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vmms]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AppInfo]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\BFE]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\bowser]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\dfsc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Dot3Svc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Eaphost]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\EFS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\hitmanpro35]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\hitmanpro35.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\IKEEXT]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\KeyIso]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MPSDrv]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MPSSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mrxsmb]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mrxsmb10]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mrxsmb20]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NativeWifiP]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\ndiscap]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\netprofm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NlaSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Nsi]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nsiproxy.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NTDS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PolicyAgent]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Power]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\ProfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\rdbss]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\rdpencdd.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\RpcEptMapper]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sacsvr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SCardSvr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SWPRV]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TabletInputService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TBS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TrustedInstaller]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\VaultSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\VDS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vmms]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\volmgr.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\volmgrx.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wlansvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{50DD5230-BA8A-11D1-BF5D-0000F805F530}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\xchat\xchat.exe"="C:\Program Files\xchat\xchat.exe:*:Enabled:XChat IRC Client"
"C:\Windows\system32\winver.exe"="C:\Windows\system32\winver.exe:*:Enabled:winver"
"C:\Nexon\NEXON_EU_Downloader\NEXON_EU_Downloader_Engine.exe"="C:\Nexon\NEXON_EU_Downloader\NEXON_EU_Downloader_Engine.exe:*:Enabled:NEXON_EU_Downloader_Engine.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - 
.js - open - 
.txt - open - 

======List of files/folders created in the last 1 months======

2010-12-27 12:40:20 ----D---- C:\rsit
2010-12-24 16:39:54 ----A---- C:\Windows\system32\oleaut32.dll
2010-12-24 15:27:22 ----D---- C:\ProgramData\SUPERAntiSpyware.com
2010-12-24 15:09:02 ----A---- C:\Windows\system32\drivers\hitmanpro35.sys
2010-12-24 15:08:40 ----D---- C:\ProgramData\Hitman Pro
2010-12-24 12:02:53 ----D---- C:\Users\ghost\AppData\Roaming\Notepad++
2010-12-24 12:02:53 ----D---- C:\Program Files\Notepad++
2010-12-24 11:50:17 ----RASH---- C:\Windows\system32\desktopo.dll
2010-12-23 23:34:27 ----D---- C:\Users\ghost\AppData\Roaming\Sublime Text
2010-12-23 23:33:58 ----D---- C:\Program Files\Sublime Text
2010-12-23 20:49:43 ----D---- C:\Program Files\Mozilla Firefox 4.0 Beta 8
2010-12-22 23:19:57 ----D---- C:\ProgramData\ATI
2010-12-22 23:14:03 ----D---- C:\Program Files\ATI Technologies
2010-12-21 14:48:10 ----D---- C:\ProgramData\Trymedia
2010-12-21 14:42:03 ----D---- C:\Program Files\Sierra
2010-12-18 17:55:55 ----D---- C:\Users\ghost\AppData\Roaming\Hothead Games
2010-12-18 17:10:25 ----D---- C:\Program Files\EA
2010-12-17 12:45:35 ----D---- C:\AMD
2010-12-16 17:27:34 ----D---- C:\Program Files\MSXML 4.0
2010-12-16 17:24:45 ----A---- C:\Windows\system32\tzres.dll
2010-12-16 17:24:43 ----A---- C:\Windows\system32\consent.exe
2010-12-16 17:24:41 ----A---- C:\Windows\system32\wmicmiplugin.dll
2010-12-16 17:24:41 ----A---- C:\Windows\system32\taskschd.dll
2010-12-16 17:24:41 ----A---- C:\Windows\system32\schedsvc.dll
2010-12-16 17:24:40 ----A---- C:\Windows\system32\taskeng.exe
2010-12-16 17:24:40 ----A---- C:\Windows\system32\taskcomp.dll
2010-12-16 17:24:40 ----A---- C:\Windows\system32\schtasks.exe
2010-12-16 17:24:38 ----A---- C:\Windows\system32\win32k.sys
2010-12-16 17:24:36 ----A---- C:\Windows\system32\atmlib.dll
2010-12-16 17:24:36 ----A---- C:\Windows\system32\atmfd.dll
2010-12-16 17:24:35 ----A---- C:\Windows\system32\webio.dll
2010-12-16 10:41:52 ----A---- C:\Humpora.txt
2010-12-15 16:53:10 ----A---- C:\delete.txt
2010-12-13 18:09:17 ----D---- C:\Users\ghost\AppData\Roaming\CrypTool
2010-12-13 17:47:57 ----D---- C:\Windows\Sun
2010-12-12 18:25:53 ----A---- C:\Windows\Kryptos.INI
2010-12-10 19:43:20 ----D---- C:\Program Files\Speccy
2010-12-10 16:11:53 ----D---- C:\Users\ghost\AppData\Roaming\leafChat
2010-12-10 16:10:44 ----D---- C:\Program Files\leafChat 2
2010-12-09 17:37:35 ----D---- C:\Program Files\NetBeans 6.9.1
2010-12-09 17:36:33 ----D---- C:\ProgramData\Sun
2010-12-09 17:36:32 ----D---- C:\Program Files\Common Files\Java
2010-12-09 17:36:16 ----A---- C:\Windows\system32\javaws.exe
2010-12-09 17:36:16 ----A---- C:\Windows\system32\javaw.exe
2010-12-09 17:36:16 ----A---- C:\Windows\system32\java.exe
2010-12-09 17:36:16 ----A---- C:\Windows\system32\deployJava1.dll
2010-12-09 17:36:05 ----D---- C:\Program Files\Java
2010-12-08 21:24:11 ----A---- C:\Windows\ODBCINST.INI
2010-12-08 21:22:52 ----D---- C:\Program Files\Common Files\CA
2010-12-08 21:22:51 ----D---- C:\Program Files\Common Files\Crystal Decisions
2010-12-08 21:22:30 ----D---- C:\Users\ghost\AppData\Roaming\CA
2010-12-08 21:22:30 ----D---- C:\ProgramData\CA
2010-12-01 18:02:24 ----D---- C:\Program Files\OpenTTD
2010-12-01 17:49:50 ----RSH---- C:\ProgramData\FA4576EFF9.sys
2010-12-01 15:03:56 ----HD---- C:\Windows\PIF
2010-12-01 15:02:15 ----A---- C:\Windows\IsUninst.exe
2010-11-30 17:36:26 ----D---- C:\Program Files\Lightworks
2010-11-28 12:38:48 ----A---- C:\Windows\system32\msxml.dll
2010-11-28 12:38:44 ----A---- C:\Windows\system32\xmltok.dll
2010-11-28 12:38:44 ----A---- C:\Windows\system32\xmlparse.dll
2010-11-28 12:38:44 ----A---- C:\Windows\system32\xmlinst.exe
2010-11-28 12:38:44 ----A---- C:\Windows\system32\VB5DB.DLL
2010-11-28 12:38:44 ----A---- C:\Windows\system32\msxmlr.dll
2010-11-28 12:38:44 ----A---- C:\Windows\system32\msxml3a.dll
2010-11-28 12:32:33 ----D---- C:\Program Files\UBISOFT

======List of files/folders modified in the last 1 months======

2010-12-27 12:25:19 ----D---- C:\Program Files\Steam
2010-12-27 12:03:08 ----D---- C:\Windows\Temp
2010-12-27 11:52:01 ----D---- C:\Windows\Microsoft.NET
2010-12-27 11:51:59 ----RSD---- C:\Windows\assembly
2010-12-24 18:44:00 ----D---- C:\Windows\System32
2010-12-24 18:44:00 ----D---- C:\Windows\inf
2010-12-24 18:44:00 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-12-24 18:39:35 ----D---- C:\Windows\winsxs
2010-12-24 18:39:25 ----D---- C:\Windows\system32\config
2010-12-24 16:40:53 ----SHD---- C:\Windows\Installer
2010-12-24 16:40:23 ----D---- C:\ProgramData\Microsoft Help
2010-12-24 16:39:19 ----D---- C:\Windows\system32\catroot
2010-12-24 16:17:04 ----D---- C:\Windows
2010-12-24 15:51:40 ----D---- C:\Program Files
2010-12-24 15:27:22 ----HD---- C:\ProgramData
2010-12-24 15:25:36 ----D---- C:\Windows\debug
2010-12-24 15:09:02 ----D---- C:\Windows\system32\drivers
2010-12-24 14:38:34 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-12-24 14:38:32 ----D---- C:\Windows\Vss
2010-12-24 13:50:57 ----D---- C:\Windows\cs
2010-12-24 13:49:48 ----D---- C:\Windows\system32\Tasks
2010-12-24 13:49:47 ----D---- C:\Windows\Tasks
2010-12-23 18:38:54 ----D---- C:\Program Files\Common Files\microsoft shared
2010-12-23 18:38:30 ----D---- C:\Program Files\Microsoft Visual Studio 10.0
2010-12-23 18:37:55 ----D---- C:\Program Files\Microsoft SDKs
2010-12-23 18:32:31 ----D---- C:\Program Files\MSBuild
2010-12-23 18:30:01 ----SD---- C:\ProgramData\Microsoft
2010-12-23 18:29:55 ----D---- C:\Program Files\Common Files\Merge Modules
2010-12-23 16:47:25 ----D---- C:\Windows\Prefetch
2010-12-23 15:05:02 ----D---- C:\Users\ghost\AppData\Roaming\FileZilla
2010-12-22 23:35:40 ----D---- C:\Users\ghost\AppData\Roaming\Media Player Classic
2010-12-22 23:30:05 ----D---- C:\Windows\pss
2010-12-22 23:15:02 ----D---- C:\Windows\system32\catroot2
2010-12-22 23:10:41 ----D---- C:\Program Files\Common Files
2010-12-22 23:09:40 ----D---- C:\Windows\system32\DriverStore
2010-12-22 19:36:19 ----D---- C:\Users\ghost\AppData\Roaming\BitTorrent
2010-12-21 14:42:02 ----HD---- C:\Program Files\InstallShield Installation Information
2010-12-18 15:17:59 ----D---- C:\Program Files\Mozilla Firefox 4.0 Beta 2
2010-12-17 18:06:41 ----D---- C:\Windows\rescache
2010-12-17 15:42:53 ----D---- C:\Program Files\Defraggler
2010-12-16 21:23:57 ----D---- C:\Program Files\Winamp
2010-12-16 17:31:29 ----D---- C:\Program Files\Windows Mail
2010-12-16 17:31:28 ----D---- C:\Windows\system32\cs-CZ
2010-12-16 17:14:57 ----D---- C:\Program Files\MPC HomeCinema
2010-12-16 16:40:22 ----D---- C:\Program Files\Oracle
2010-12-16 16:26:37 ----HD---- C:\ProgramData\~0
2010-12-16 12:40:03 ----D---- C:\Windows\hsperfdata_SYSTEM
2010-12-16 12:40:03 ----D---- C:\TEMP
2010-12-16 10:24:52 ----D---- C:\Program Files\Opera
2010-12-15 18:59:23 ----A---- C:\Windows\erwin.ini
2010-12-15 18:07:51 ----A---- C:\test.txt
2010-12-14 19:15:46 ----SD---- C:\Users\ghost\AppData\Roaming\Microsoft
2010-12-14 19:13:44 ----D---- C:\Program Files\Common Files\Borland Shared
2010-12-14 17:15:09 ----D---- C:\Program Files\Mozilla Firefox
2010-12-09 21:38:37 ----D---- C:\ProgramData\CodeGear
2010-12-09 21:31:29 ----D---- C:\Users\ghost\AppData\Roaming\Corel
2010-12-09 21:30:16 ----RSD---- C:\Windows\Fonts
2010-12-09 21:22:33 ----AD---- C:\xampp
2010-12-08 21:34:08 ----A---- C:\Windows\system32\MRT.exe
2010-12-08 21:27:21 ----D---- C:\CA_LIC
2010-12-08 21:24:11 ----A---- C:\Windows\ODBC.INI
2010-12-08 21:22:24 ----D---- C:\Program Files\CA
2010-12-08 15:57:46 ----D---- C:\Oracle

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 amdxata;amdxata; C:\Windows\system32\DRIVERS\amdxata.sys [2009-07-14 23616]
R0 AtiPcie;AMD PCI Express (3GIO) Filter; C:\Windows\system32\DRIVERS\AtiPcie.sys [2010-03-01 14392]
R0 CLFS;@%SystemRoot%\system32\clfs.sys,-100; C:\Windows\System32\CLFS.sys [2009-07-14 249408]
R0 CNG;CNG; C:\Windows\System32\Drivers\cng.sys [2009-07-14 369568]
R0 FileInfo;@%SystemRoot%\system32\drivers\fileinfo.sys,-100; C:\Windows\system32\drivers\fileinfo.sys [2009-07-14 58448]
R0 fvevol;@%SystemRoot%\system32\drivers\fvevol.sys,-100; C:\Windows\System32\DRIVERS\fvevol.sys [2009-07-14 194488]
R0 hwpolicy;@%systemroot%\system32\drivers\hwpolicy.sys,-101; C:\Windows\System32\drivers\hwpolicy.sys [2009-07-14 13904]
R0 KSecPkg;KSecPkg; C:\Windows\System32\Drivers\ksecpkg.sys [2009-12-11 133720]
R0 msahci;msahci; C:\Windows\system32\DRIVERS\msahci.sys [2009-07-14 27712]
R0 msisadrv;msisadrv; C:\Windows\system32\DRIVERS\msisadrv.sys [2009-07-14 13888]
R0 pcw;Performance Counters for Windows Driver; C:\Windows\System32\drivers\pcw.sys [2009-07-14 43088]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R0 sfhlp02;StarForce Protection Helper Driver (version 2.x); C:\Windows\System32\drivers\sfhlp02.sys [2005-05-16 6656]
R0 spldr;Security Processor Loader Driver; C:\Windows\system32\drivers\spldr.sys [2009-07-14 17472]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-07-04 697328]
R0 vdrvroot;Ovladač rozpoznávacího modulu virtuální jednotky společnosti Microsoft; C:\Windows\system32\DRIVERS\vdrvroot.sys [2009-07-14 32832]
R0 volmgr;Ovladač správce svazků; C:\Windows\system32\DRIVERS\volmgr.sys [2009-07-14 53312]
R0 volmgrx;@%SystemRoot%\system32\drivers\volmgrx.sys,-100; C:\Windows\System32\drivers\volmgrx.sys [2009-07-14 297040]
R0 Wdf01000;Kernel Mode Driver Frameworks service; C:\Windows\system32\drivers\Wdf01000.sys [2009-07-14 445008]
R1 avipbb;avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [2010-12-20 135096]
R1 blbdrive;blbdrive; C:\Windows\system32\DRIVERS\blbdrive.sys [2009-07-14 35328]
R1 DfsC;@%systemroot%\system32\drivers\dfsc.sys,-101; C:\Windows\System32\Drivers\dfsc.sys [2009-07-14 78336]
R1 discache;@%systemroot%\system32\drivers\discache.sys,-102; C:\Windows\System32\drivers\discache.sys [2009-07-14 32256]
R1 nsiproxy;@%SystemRoot%\system32\drivers\nsiproxy.sys,-2; C:\Windows\system32\drivers\nsiproxy.sys [2009-07-14 16896]
R1 RDPENCDD;@%systemroot%\system32\drivers\RDPENCDD.sys,-101; C:\Windows\system32\drivers\rdpencdd.sys [2009-07-14 6656]
R1 RDPREFMP;@%systemroot%\system32\drivers\RdpRefMp.sys,-101; C:\Windows\system32\drivers\rdprefmp.sys [2009-07-14 7168]
R1 ssmdrv;ssmdrv; C:\Windows\system32\DRIVERS\ssmdrv.sys [2009-05-11 28520]
R1 tdx;@%SystemRoot%\system32\tcpipcfg.dll,-50004; C:\Windows\system32\DRIVERS\tdx.sys [2009-07-14 74240]
R1 VBoxDrv;VirtualBox Service; C:\Windows\system32\DRIVERS\VBoxDrv.sys [2010-10-08 143184]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver; C:\Windows\system32\DRIVERS\VBoxUSBMon.sys [2010-10-08 41936]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R1 Wanarpv6;@%systemroot%\system32\rascfg.dll,-32012; C:\Windows\system32\DRIVERS\wanarp.sys [2009-07-14 63488]
R1 WfpLwf;WFP Lightweight Filter; C:\Windows\system32\DRIVERS\wfplwf.sys [2009-07-14 9728]
R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys [2010-11-24 61960]
R2 lltdio;Link-Layer Topology Discovery Mapper I/O Driver; C:\Windows\system32\DRIVERS\lltdio.sys [2009-07-14 48128]
R2 luafv;@%systemroot%\system32\drivers\luafv.sys,-100; C:\Windows\system32\drivers\luafv.sys [2009-07-14 86528]
R2 PEAUTH;PEAUTH; C:\Windows\system32\drivers\peauth.sys [2009-07-14 586752]
R2 rspndr;Link-Layer Topology Discovery Responder; C:\Windows\system32\DRIVERS\rspndr.sys [2009-07-14 60928]
R2 tcpipreg;TCP/IP Registry Compatibility; C:\Windows\System32\drivers\tcpipreg.sys [2009-07-14 34816]
R3 AmdPPM;Ovladač procesoru AMD; C:\Windows\system32\DRIVERS\amdppm.sys [2009-07-14 52736]
R3 ApfiltrService;Alps Pointing-device Filter Driver; C:\Windows\system32\DRIVERS\Apfiltr.sys [2010-03-01 211504]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athr.sys [2009-10-05 1221632]
R3 AtiHdmiService;ATI Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\AtiHdmi.sys [2010-05-06 108560]
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2010-03-01 4994560]
R3 bowser;@%systemroot%\system32\browser.dll,-102; C:\Windows\system32\DRIVERS\bowser.sys [2009-07-14 69632]
R3 CompositeBus;Ovladač rozpoznávacího modulu složené sběrnice; C:\Windows\system32\DRIVERS\CompositeBus.sys [2009-07-14 31232]
R3 DXGKrnl;LDDM Graphics Subsystem; C:\Windows\System32\drivers\dxgkrnl.sys [2009-10-02 728648]
R3 HDAudBus;Ovladač sběrnice Microsoft UAA pro zvuk High Definition Audio; C:\Windows\system32\DRIVERS\HDAudBus.sys [2009-07-14 108544]
R3 HidUsb;Ovladač třídy standardu HID Microsoft; C:\Windows\system32\DRIVERS\hidusb.sys [2009-07-14 24064]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2010-03-01 2745760]
R3 monitor;Služba ovladače funkce třídy monitorů Microsoft; C:\Windows\system32\DRIVERS\monitor.sys [2009-07-14 23552]
R3 mouhid;Ovladač myši standardu HID; C:\Windows\system32\DRIVERS\mouhid.sys [2009-07-14 26112]
R3 mpsdrv;@%SystemRoot%\system32\FirewallAPI.dll,-23092; C:\Windows\System32\drivers\mpsdrv.sys [2009-07-14 60416]
R3 mrxsmb10;@%systemroot%\system32\wkssvc.dll,-1004; C:\Windows\system32\DRIVERS\mrxsmb10.sys [2010-02-27 221696]
R3 mrxsmb20;@%systemroot%\system32\wkssvc.dll,-1006; C:\Windows\system32\DRIVERS\mrxsmb20.sys [2010-02-27 95744]
R3 NativeWifiP;NativeWiFi Filter; C:\Windows\system32\DRIVERS\nwifi.sys [2009-07-14 267264]
R3 O2MDRDR;O2MDRDR; C:\Windows\system32\DRIVERS\o2media.sys [2010-03-01 52128]
R3 O2SDRDR;O2SDRDR; C:\Windows\system32\DRIVERS\o2sd.sys [2010-03-01 42144]
R3 Point32;Microsoft IntelliPoint Filter Driver; C:\Windows\system32\DRIVERS\point32k.sys [2009-11-11 30576]
R3 RasAgileVpn;WAN Miniport (IKEv2); C:\Windows\system32\DRIVERS\AgileVpn.sys [2009-07-14 49152]
R3 RasSstp;@%systemroot%\system32\sstpsvc.dll,-202; C:\Windows\system32\DRIVERS\rassstp.sys [2009-07-14 75264]
R3 srv2;@%systemroot%\system32\srvsvc.dll,-104; C:\Windows\System32\DRIVERS\srv2.sys [2010-08-27 308736]
R3 SrvHsfHDA;SrvHsfHDA; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
R3 SrvHsfV92;SrvHsfV92; C:\Windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
R3 SrvHsfWinac;SrvHsfWinac; C:\Windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
R3 srvnet;srvnet; C:\Windows\System32\DRIVERS\srvnet.sys [2010-08-27 113664]
R3 tunnel;Microsoft Tunnel Miniport Adapter Driver; C:\Windows\system32\DRIVERS\tunnel.sys [2009-07-14 108544]
R3 umbus;Ovladač sběrnice UMBus Enumerator; C:\Windows\system32\DRIVERS\umbus.sys [2009-07-14 39936]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\Windows\system32\DRIVERS\usbccgp.sys [2009-07-14 75264]
R3 usbfilter;AMD USB Filter Driver; C:\Windows\system32\DRIVERS\usbfilter.sys [2009-04-03 27320]
R3 VBoxNetFlt;VBoxNetFlt Service; C:\Windows\system32\DRIVERS\VBoxNetFlt.sys [2010-10-08 111568]
R3 vwifibus;Ovladač sběrnice Virtual WiFi; C:\Windows\system32\DRIVERS\vwifibus.sys [2009-07-14 19968]
R3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\DRIVERS\wmiacpi.sys [2009-07-14 11264]
R3 WudfPf;User Mode Driver Frameworks Platform Driver; C:\Windows\system32\drivers\WudfPf.sys [2009-07-14 92672]
S0 sfdrv01;StarForce Protection Environment Driver (version 1.x); C:\Windows\System32\drivers\sfdrv01.sys [2005-08-10 50688]
S0 sfsync03;StarForce Protection Synchronization Driver (version 3.x); C:\Windows\System32\drivers\sfsync03.sys [2005-12-06 35328]
S3 1394ohci;1394 OHCI Compliant Host Controller; C:\Windows\system32\DRIVERS\1394ohci.sys [2009-07-14 163328]
S3 AcpiPmi;ACPI Power Meter Driver; C:\Windows\system32\DRIVERS\acpipmi.sys [2009-07-14 9728]
S3 adp94xx;adp94xx; C:\Windows\system32\DRIVERS\adp94xx.sys [2009-07-14 422976]
S3 adpahci;adpahci; C:\Windows\system32\DRIVERS\adpahci.sys [2009-07-14 297552]
S3 adpu320;adpu320; C:\Windows\system32\DRIVERS\adpu320.sys [2009-07-14 146512]
S3 agp440;Intel AGP Bus Filter; C:\Windows\system32\DRIVERS\agp440.sys [2009-07-14 53312]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 amdide;amdide; C:\Windows\system32\DRIVERS\amdide.sys [2009-07-14 14912]
S3 AmdK8;AMD K8 Processor Driver; C:\Windows\system32\DRIVERS\amdk8.sys [2009-07-14 55296]
S3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2010-03-01 4994560]
S3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2010-03-01 106496]
S3 amdsata;amdsata; C:\Windows\system32\DRIVERS\amdsata.sys [2009-07-14 79952]
S3 amdsbs;amdsbs; C:\Windows\system32\DRIVERS\amdsbs.sys [2009-07-14 159312]
S3 AppID;@%systemroot%\system32\appidsvc.dll,-102; C:\Windows\system32\drivers\appid.sys [2009-07-14 50176]
S3 arc;arc; C:\Windows\system32\DRIVERS\arc.sys [2009-07-14 76368]
S3 arcsas;arcsas; C:\Windows\system32\DRIVERS\arcsas.sys [2009-07-14 86608]
S3 arq6ntc2;arq6ntc2; C:\Windows\system32\drivers\arq6ntc2.sys []
S3 b06bdrv;Broadcom NetXtreme II VBD; C:\Windows\system32\DRIVERS\bxvbdx.sys [2009-07-13 430080]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 BrFiltLo;Brother USB Mass-Storage Lower Filter Driver; C:\Windows\system32\DRIVERS\BrFiltLo.sys [2009-07-13 13568]
S3 BrFiltUp;Brother USB Mass-Storage Upper Filter Driver; C:\Windows\system32\DRIVERS\BrFiltUp.sys [2009-07-13 5248]
S3 Bridge;@%SystemRoot%\system32\bridgeres.dll,-3; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 78336]
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 78336]
S3 Brserid;Brother MFC Serial Port Interface Driver (WDM); C:\Windows\System32\Drivers\Brserid.sys [2009-07-14 272128]
S3 BrSerWdm;Brother WDM Serial driver; C:\Windows\System32\Drivers\BrSerWdm.sys [2009-07-13 62336]
S3 BrUsbMdm;Brother MFC USB Fax Only Modem; C:\Windows\System32\Drivers\BrUsbMdm.sys [2009-07-13 12160]
S3 BrUsbSer;Brother MFC USB Serial WDM Driver; C:\Windows\System32\Drivers\BrUsbSer.sys [2009-07-13 11904]
S3 BthEnum;Služba Bluetooth Enumerator; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 34816]
S3 BTHMODEM;Ovladač pro komunikaci pomocí modemu Bluetooth; C:\Windows\system32\DRIVERS\bthmodem.sys [2009-07-14 56320]
S3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 93696]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2009-07-14 392704]
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2009-07-14 58880]
S3 btwaudio;Bluetooth Audio Device Service; C:\Windows\system32\drivers\btwaudio.sys [2010-03-01 86056]
S3 btwavdt;Bluetooth AVDT Service; C:\Windows\system32\drivers\btwavdt.sys [2010-03-01 108072]
S3 btwl2cap;Bluetooth L2CAP Service; C:\Windows\system32\DRIVERS\btwl2cap.sys [2010-03-01 29472]
S3 btwrchid;btwrchid; C:\Windows\system32\DRIVERS\btwrchid.sys [2010-03-01 18344]
S3 circlass;Consumer IR Devices; C:\Windows\system32\DRIVERS\circlass.sys [2009-07-14 37888]
S3 EagleNT;EagleNT; \??\C:\Windows\system32\drivers\EagleNT.sys []
S3 ebdrv;Broadcom NetXtreme II 10 GigE VBD; C:\Windows\system32\DRIVERS\evbdx.sys [2009-07-13 3100160]
S3 elxstor;elxstor; C:\Windows\system32\DRIVERS\elxstor.sys [2009-07-14 453712]
S3 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\DRIVERS\errdev.sys [2009-07-14 7168]
S3 exfat;exFAT File System Driver; C:\Windows\system32\drivers\exfat.sys [2009-07-14 142336]
S3 Filetrace;@%SystemRoot%\system32\drivers\filetrace.sys,-10001; C:\Windows\system32\drivers\filetrace.sys [2009-07-14 28160]
S3 FsDepends;@%SystemRoot%\system32\drivers\fsdepends.sys,-10001; C:\Windows\System32\drivers\FsDepends.sys [2009-07-14 46160]
S3 gagp30kx;Microsoft Generic AGPv3.0 Filter for K8 Processor Platforms; C:\Windows\system32\DRIVERS\gagp30kx.sys [2009-07-14 57936]
S3 hcw85cir;Hauppauge Consumer Infrared Receiver; C:\Windows\system32\drivers\hcw85cir.sys [2009-07-13 26624]
S3 HdAudAddService;Ovladač funkce Microsoft 1.1 UAA pro službu zvuku High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2009-07-14 304128]
S3 HidBatt;HID UPS Battery Driver; C:\Windows\system32\DRIVERS\HidBatt.sys [2009-07-14 21504]
S3 HidBth;Microsoft Bluetooth HID Miniport; C:\Windows\system32\DRIVERS\hidbth.sys [2009-07-14 91136]
S3 HidIr;Microsoft Infrared HID Driver; C:\Windows\system32\DRIVERS\hidir.sys [2009-07-14 37888]
S3 HpSAMD;HpSAMD; C:\Windows\system32\DRIVERS\HpSAMD.sys [2009-07-14 67152]
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\Windows\system32\DRIVERS\ewusbmdm.sys [2009-09-10 102912]
S3 hwusbdev;Huawei DataCard USB PNP Device; C:\Windows\system32\DRIVERS\ewusbdev.sys [2009-07-24 101248]
S3 iaStorV;iaStorV; C:\Windows\system32\DRIVERS\iaStorV.sys [2009-07-14 332352]
S3 iirsp;iirsp; C:\Windows\system32\DRIVERS\iirsp.sys [2009-07-14 41040]
S3 intelppm;Intel Processor Driver; C:\Windows\system32\DRIVERS\intelppm.sys [2009-07-14 53760]
S3 IPMIDRV;IPMIDRV; C:\Windows\system32\DRIVERS\IPMIDrv.sys [2009-07-14 65536]
S3 iScsiPrt;iScsiPort Driver; C:\Windows\system32\DRIVERS\msiscsi.sys [2009-07-14 186960]
S3 kbdhid;Keyboard HID Driver; C:\Windows\system32\DRIVERS\kbdhid.sys [2009-07-14 28160]
S3 LSI_FC;LSI_FC; C:\Windows\system32\DRIVERS\lsi_fc.sys [2009-07-14 95824]
S3 LSI_SAS;LSI_SAS; C:\Windows\system32\DRIVERS\lsi_sas.sys [2009-07-14 89168]
S3 LSI_SAS2;LSI_SAS2; C:\Windows\system32\DRIVERS\lsi_sas2.sys [2009-07-14 54864]
S3 LSI_SCSI;LSI_SCSI; C:\Windows\system32\DRIVERS\lsi_scsi.sys [2009-07-14 96848]
S3 megasas;megasas; C:\Windows\system32\DRIVERS\megasas.sys [2009-07-14 30800]
S3 MegaSR;MegaSR; C:\Windows\system32\DRIVERS\MegaSR.sys [2009-07-14 235584]
S3 mpio;mpio; C:\Windows\system32\DRIVERS\mpio.sys [2009-07-14 130624]
S3 msdsm;msdsm; C:\Windows\system32\DRIVERS\msdsm.sys [2009-07-14 115792]
S3 mshidkmdf;@%SystemRoot%\system32\drivers\mshidkmdf.sys,-100; C:\Windows\System32\drivers\mshidkmdf.sys [2009-07-14 4096]
S3 msloop;Microsoft Loopback Adapter Driver; C:\Windows\system32\DRIVERS\loop.sys [2009-07-14 5632]
S3 MsRPC;MsRPC; C:\Windows\system32\drivers\MsRPC.sys [2009-07-14 162896]
S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2009-07-14 6144]
S3 MTConfig;Microsoft Input Configuration Driver; C:\Windows\system32\DRIVERS\MTConfig.sys [2009-07-14 12288]
S3 NdisCap;NDIS Capture LightWeight Filter; C:\Windows\system32\DRIVERS\ndiscap.sys [2009-07-14 27136]
S3 nfrd960;nfrd960; C:\Windows\system32\DRIVERS\nfrd960.sys [2009-07-14 44624]
S3 nv_agp;NVIDIA nForce AGP Bus Filter; C:\Windows\system32\DRIVERS\nv_agp.sys [2009-07-14 105024]
S3 nvraid;nvraid; C:\Windows\system32\DRIVERS\nvraid.sys [2009-07-14 117312]
S3 nvstor;nvstor; C:\Windows\system32\DRIVERS\nvstor.sys [2009-07-14 142416]
S3 ohci1394;1394 OHCI Compliant Host Controller (Legacy); C:\Windows\system32\DRIVERS\ohci1394.sys [2009-07-14 62464]
S3 ql2300;ql2300; C:\Windows\system32\DRIVERS\ql2300.sys [2009-07-14 1383488]
S3 ql40xx;ql40xx; C:\Windows\system32\DRIVERS\ql40xx.sys [2009-07-14 106064]
S3 QWAVEdrv;@%SystemRoot%\system32\drivers\qwavedrv.sys,-1; C:\Windows\system32\drivers\qwavedrv.sys [2009-07-14 31744]
S3 rdpbus;Remote Desktop Device Redirector Bus Driver; C:\Windows\system32\DRIVERS\rdpbus.sys [2009-07-14 18944]
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 129536]
S3 sbp2port;sbp2port; C:\Windows\system32\DRIVERS\sbp2port.sys [2009-07-14 85568]
S3 scfilter;@%SystemRoot%\System32\drivers\scfilter.sys,-11; C:\Windows\System32\DRIVERS\scfilter.sys [2009-07-14 26624]
S3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2009-07-14 84992]
S3 sermouse;Serial Mouse Driver; C:\Windows\system32\DRIVERS\sermouse.sys [2009-07-14 19968]
S3 sffdisk;SFF Storage Class Driver; C:\Windows\system32\DRIVERS\sffdisk.sys [2009-07-14 11264]
S3 sffp_mmc;SFF Storage Protocol Driver for MMC; C:\Windows\system32\DRIVERS\sffp_mmc.sys [2009-07-14 12288]
S3 sffp_sd;SFF Storage Protocol Driver for SDBus; C:\Windows\system32\DRIVERS\sffp_sd.sys [2009-07-14 12800]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 SiSRaid2;SiSRaid2; C:\Windows\system32\DRIVERS\SiSRaid2.sys [2009-07-14 40016]
S3 SiSRaid4;SiSRaid4; C:\Windows\system32\DRIVERS\sisraid4.sys [2009-07-14 77888]
S3 Smb;@%SystemRoot%\system32\tcpipcfg.dll,-50005; C:\Windows\system32\DRIVERS\smb.sys [2009-07-14 71168]
S3 stexstor;stexstor; C:\Windows\system32\DRIVERS\stexstor.sys [2009-07-14 21072]
S3 TCPIP6;Microsoft IPv6 Protocol Driver; C:\Windows\system32\DRIVERS\tcpip.sys [2010-06-14 1286016]
S3 tssecsrv;@%SystemRoot%\System32\DRIVERS\tssecsrv.sys,-101; C:\Windows\System32\DRIVERS\tssecsrv.sys [2009-07-14 30208]
S3 uagp35;Microsoft AGPv3.5 Filter; C:\Windows\system32\DRIVERS\uagp35.sys [2009-07-14 55888]
S3 uliagpkx;Uli AGP Bus Filter; C:\Windows\system32\DRIVERS\uliagpkx.sys [2009-07-14 57424]
S3 UmPass;Microsoft UMPass Driver; C:\Windows\system32\DRIVERS\umpass.sys [2009-07-14 8192]
S3 usbcir;eHome Infrared Receiver (USBCIR); C:\Windows\system32\DRIVERS\usbcir.sys [2009-07-14 86016]
S3 usbprint;Třída USB Printer; C:\Windows\system32\DRIVERS\usbprint.sys [2009-07-14 19968]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 35840]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\Windows\system32\DRIVERS\USBSTOR.SYS [2009-07-14 74752]
S3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\Windows\system32\DRIVERS\usbuhci.sys [2009-07-14 24064]
S3 usbvideo;Zobrazovací zařízení USB (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2009-07-14 146176]
S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter; C:\Windows\system32\DRIVERS\VBoxNetAdp.sys [2010-10-08 100560]
S3 vga;vga; C:\Windows\system32\DRIVERS\vgapnp.sys [2009-07-14 26112]
S3 vhdmp;vhdmp; C:\Windows\system32\DRIVERS\vhdmp.sys [2009-07-14 159824]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vsmraid;vsmraid; C:\Windows\system32\DRIVERS\vsmraid.sys [2009-07-14 141904]
S3 WacomPen;Wacom Serial Pen HID Driver; C:\Windows\system32\DRIVERS\wacompen.sys [2009-07-14 21632]
S3 Wd;Wd; C:\Windows\system32\DRIVERS\wd.sys [2009-07-14 19024]
S3 WIMMount;WIMMount; C:\Windows\system32\drivers\wimmount.sys [2009-07-14 19008]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2009-07-14 132224]
S4 crcdisk;Crcdisk Filter Driver; C:\Windows\system32\DRIVERS\crcdisk.sys [2009-07-14 22096]
S4 ws2ifsl;@%systemroot%\System32\drivers\ws2ifsl.sys,-1000; C:\Windows\system32\drivers\ws2ifsl.sys [2009-07-14 16384]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2010-03-01 176128]
R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2010-12-10 267944]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2010-11-03 135336]
R2 AudioEndpointBuilder;@%SystemRoot%\system32\audiosrv.dll,-204; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 BFE;@%SystemRoot%\system32\bfe.dll,-1001; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 btwdins;Bluetooth Service; C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe [2009-07-17 582944]
R2 EFS;@%SystemRoot%\system32\efssvc.dll,-100; C:\Windows\System32\lsass.exe [2009-07-14 22528]
R2 gpsvc;@gpapi.dll,-112; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 IKEEXT;@%SystemRoot%\system32\ikeext.dll,-501; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 LogWatch;Event Log Watch; C:\CA_LIC\LogWatNT.exe [2008-05-20 75016]
R2 MMCSS;@%systemroot%\system32\mmcss.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 MpsSvc;@%SystemRoot%\system32\FirewallAPI.dll,-23090; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 NlaSvc;@%SystemRoot%\System32\nlasvc.dll,-1; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 nsi;@%SystemRoot%\system32\nsisvc.dll,-200; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 O2FLASH;O2FLASH; C:\Windows\system32\DRIVERS\o2flash.exe [2010-03-01 65536]
R2 Power;@%SystemRoot%\system32\umpo.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 ProfSvc;@%systemroot%\system32\profsvc.dll,-300; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 RpcEptMapper;@%windir%\system32\RpcEpMap.dll,-1001; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 SysMain;@%SystemRoot%\system32\sysmain.dll,-1000; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 UxSms;@%SystemRoot%\system32\dwm.exe,-2000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 Wlansvc;@%SystemRoot%\System32\wlansvc.dll,-257; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2010-09-21 1710464]
R2 WMPNetworkSvc;@%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101; C:\Program Files\Windows Media Player\wmpnetwk.exe [2009-07-14 1121280]
R2 wudfsvc;@%SystemRoot%\system32\wudfsvc.dll,-1000; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R3 AeLookupSvc;@%SystemRoot%\system32\aelupsvc.dll,-1; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R3 fdPHost;@%systemroot%\system32\fdPHost.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R3 FDResPub;@%systemroot%\system32\fdrespub.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R3 HomeGroupListener;@%SystemRoot%\System32\ListSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R3 HomeGroupProvider;@%SystemRoot%\System32\provsvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R3 KeyIso;@keyiso.dll,-100; C:\Windows\system32\lsass.exe [2009-07-14 22528]
R3 netprofm;@%SystemRoot%\system32\netprofm.dll,-202; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R3 p2pimsvc;@%SystemRoot%\system32\pnrpsvc.dll,-8004; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R3 p2psvc;@%SystemRoot%\system32\p2psvc.dll,-8006; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R3 PcaSvc;@%SystemRoot%\system32\pcasvc.dll,-1; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R3 PNRPsvc;@%SystemRoot%\system32\pnrpsvc.dll,-8000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R3 SstpSvc;@%SystemRoot%\system32\sstpsvc.dll,-200; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 sppsvc;@%SystemRoot%\system32\sppsvc.exe,-101; C:\Windows\system32\sppsvc.exe [2009-07-14 3179520]
S3 AppIDSvc;@%systemroot%\system32\appidsvc.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 Appinfo;@%systemroot%\system32\appinfo.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2010-03-18 35160]
S3 AxInstSV;@%SystemRoot%\system32\AxInstSV.dll,-103; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 bthserv;@%SystemRoot%\System32\bthserv.dll,-101; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 CertPropSvc;@%SystemRoot%\System32\certprop.dll,-11; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 defragsvc;@%SystemRoot%\system32\defragsvc.dll,-101; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 ehRecvr;@%SystemRoot%\ehome\ehrecvr.exe,-101; C:\Windows\ehome\ehRecvr.exe [2009-07-14 557056]
S3 ehSched;@%SystemRoot%\ehome\ehsched.exe,-101; C:\Windows\ehome\ehsched.exe [2009-07-14 94720]
S3 Fax;@%systemroot%\system32\fxsresm.dll,-118; C:\Windows\system32\fxssvc.exe [2009-07-14 522752]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2010-03-04 655624]
S3 FontCache3.0.0.0;@%SystemRoot%\system32\PresentationHost.exe,-3309; C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2009-06-10 42856]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 idsvc;@%systemroot%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelInstallRC.dll,-8193; C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2009-06-10 878416]
S3 IPBusEnum;@%systemroot%\system32\IPBusEnum.dll,-102; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 KtmRm;@comres.dll,-2946; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 lltdsvc;@%SystemRoot%\system32\lltdres.dll,-1; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 MSiSCSI;@%SystemRoot%\system32\iscsidsc.dll,-5000; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 OracleVssWriterDOMA;Oracle DOMA VSS Writer Service; c:\oracle\product\11.2.0\dbhome_1\bin\OraVSSW.exe DOMA []
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 pla;@%systemroot%\system32\pla.dll,-500; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 PNRPAutoReg;@%SystemRoot%\system32\pnrpauto.dll,-8002; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 QWAVE;@%SystemRoot%\system32\qwave.dll,-1; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 SCPolicySvc;@%SystemRoot%\System32\certprop.dll,-13; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 SensrSvc;@%SystemRoot%\System32\sensrsvc.dll,-1000; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 SessionEnv;@%SystemRoot%\System32\SessEnv.dll,-1026; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 SNMPTRAP;@%SystemRoot%\system32\snmptrap.exe,-3; C:\Windows\System32\snmptrap.exe [2009-07-14 12800]
S3 sppuinotify;@%SystemRoot%\system32\sppuinotify.dll,-103; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 Steam Client Service;Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe [2009-07-16 316664]
S3 TabletInputService;@%SystemRoot%\system32\TabSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 TBS;@%SystemRoot%\system32\tbssvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 THREADORDER;@%systemroot%\system32\mmcss.dll,-102; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 TrustedInstaller;@%SystemRoot%\servicing\TrustedInstaller.exe,-100; C:\Windows\servicing\TrustedInstaller.exe [2009-07-14 204800]
S3 UI0Detect;@%SystemRoot%\system32\ui0detect.exe,-101; C:\Windows\system32\UI0Detect.exe [2009-07-14 35840]
S3 VaultSvc;@%SystemRoot%\system32\vaultsvc.dll,-1003; C:\Windows\system32\lsass.exe [2009-07-14 22528]
S3 vds;@%SystemRoot%\system32\vds.exe,-100; C:\Windows\System32\vds.exe [2009-07-14 452608]
S3 wbengine;@%systemroot%\system32\wbengine.exe,-104; C:\Windows\system32\wbengine.exe [2009-07-14 1202688]
S3 WbioSrvc;@%systemroot%\system32\wbiosrvc.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 wcncsvc;@%SystemRoot%\system32\wcncsvc.dll,-3; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WcsPlugInService;@%SystemRoot%\system32\WcsPlugInService.dll,-200; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 WdiServiceHost;@%systemroot%\system32\wdi.dll,-502; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WdiSystemHost;@%systemroot%\system32\wdi.dll,-500; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 Wecsvc;@%SystemRoot%\system32\wecsvc.dll,-200; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 wercplsupport;@%SystemRoot%\System32\wercplsupport.dll,-101; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WerSvc;@%SystemRoot%\System32\wersvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WinHttpAutoProxySvc;@%SystemRoot%\system32\winhttp.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 WinRM;@%Systemroot%\system32\wsmsvc.dll,-101; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WPCSvc;@%SystemRoot%\system32\wpcsvc.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 WPDBusEnum;@%SystemRoot%\system32\wpdbusenum.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 WwanSvc;@%SystemRoot%\System32\wwansvc.dll,-257; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S4 BDESVC;@%SystemRoot%\system32\bdesvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S4 clr_optimization_v2.0.50727_32;Microsoft .NET Framework NGEN v2.0.50727_X86; C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2009-06-10 66384]
S4 DPS;Služba DPS (Diagnostic Policy Service); C:\Windows\System32\svchost.exe [2009-07-14 20992]
S4 iphlpsvc;Pomocná služba protokolu IP; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S4 KJHVBICHK;KJHVBICHK; C:\Users\ghost\AppData\Local\Temp\KJHVBICHK.exe []
S4 Mcx2Svc;@%SystemRoot%\ehome\ehres.dll,-15501; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S4 msvsmon90;Visual Studio 2008 Remote Debugger; C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x86\msvsmon.exe [2007-11-07 3004416]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpPortSharing;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8201; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 npggsvc;nProtect GameGuard Service; C:\Windows\system32\GameMon.des [2010-01-19 3595660]
S4 OracleJobSchedulerDOMA;OracleJobSchedulerDOMA; c:\oracle\product\11.2.0\dbhome_1\Bin\extjob.exe DOMA []
S4 OracleOraDb11g_home2TNSListener;OracleOraDb11g_home2TNSListener; C:\Oracle\product\11.2.0\dbhome_1\BIN\TNSLSNR  []
S4 OracleServiceDOMA;OracleServiceDOMA; c:\oracle\product\11.2.0\dbhome_1\bin\ORACLE.EXE [2010-04-02 106487808]
S4 SDRSVC;@%SystemRoot%\system32\sdrsvc.dll,-107; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S4 WinDefend;Windows Defender; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S4 WSearch;@%systemroot%\system32\SearchIndexer.exe,-103; C:\Windows\system32\SearchIndexer.exe [2009-07-14 428032]

-----------------EOF-----------------

Re: Problém zo security center vo Win 7

Napsal: 27 pro 2010 20:04
od Rudy
Dejte log z ComboFix.
Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode, pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k nezadoucim kolizim s rezidentem antispyware

Re: Problém zo security center vo Win 7

Napsal: 27 pro 2010 21:02
od gh0st
Po spustení mi vypíše toto: Obrázek

pouzivam Aviru a guard som vypol

Re: Problém zo security center vo Win 7

Napsal: 27 pro 2010 21:27
od Rudy
Zastavte tuto službu:
O23 - Service: Event Log Watch (LogWatch) - CA - C:\CA_LIC\LogWatNT.exe
Otevřte startmenu a do řáku vložte
services.msc
Odentrujte, najděte zmíněnou službu a zastavte ji. Pak spusťte znovu CF. Pokud by se znvu ta hloáška objevila, můžete ji ignorovat.

Re: Problém zo security center vo Win 7

Napsal: 27 pro 2010 21:59
od gh0st

Kód: Vybrat vše

ComboFix 10-12-26.01 - ghost . 12. 2010  21:48:17.1.2 - x86
Microsoft Windows 7 Home Premium   6.1.7600.0.1250.421.1029.18.2814.1850 [GMT 1:00]
Running from: c:\users\ghost\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\programdata\KGyGaAvL.sys
C:\test.txt
c:\windows\system32\images
c:\windows\system32\images\toolbar\calendar.gif
c:\windows\system32\images\toolbar\crlogo.gif
c:\windows\system32\images\toolbar\export.gif
c:\windows\system32\images\toolbar\export_over.gif
c:\windows\system32\images\toolbar\exportd.gif
c:\windows\system32\images\toolbar\First.gif
c:\windows\system32\images\toolbar\first_over.gif
c:\windows\system32\images\toolbar\Firstd.gif
c:\windows\system32\images\toolbar\gotopage.gif
c:\windows\system32\images\toolbar\gotopage_over.gif
c:\windows\system32\images\toolbar\gotopaged.gif
c:\windows\system32\images\toolbar\grouptree.gif
c:\windows\system32\images\toolbar\grouptree_over.gif
c:\windows\system32\images\toolbar\grouptreed.gif
c:\windows\system32\images\toolbar\grouptreepressed.gif
c:\windows\system32\images\toolbar\Last.gif
c:\windows\system32\images\toolbar\last_over.gif
c:\windows\system32\images\toolbar\Lastd.gif
c:\windows\system32\images\toolbar\Next.gif
c:\windows\system32\images\toolbar\next_over.gif
c:\windows\system32\images\toolbar\Nextd.gif
c:\windows\system32\images\toolbar\Prev.gif
c:\windows\system32\images\toolbar\prev_over.gif
c:\windows\system32\images\toolbar\Prevd.gif
c:\windows\system32\images\toolbar\print.gif
c:\windows\system32\images\toolbar\print_over.gif
c:\windows\system32\images\toolbar\printd.gif
c:\windows\system32\images\toolbar\Refresh.gif
c:\windows\system32\images\toolbar\refresh_over.gif
c:\windows\system32\images\toolbar\refreshd.gif
c:\windows\system32\images\toolbar\Search.gif
c:\windows\system32\images\toolbar\search_over.gif
c:\windows\system32\images\toolbar\searchd.gif
c:\windows\system32\images\toolbar\up.gif
c:\windows\system32\images\toolbar\up_over.gif
c:\windows\system32\images\toolbar\upd.gif
c:\windows\system32\images\tree\begindots.gif
c:\windows\system32\images\tree\beginminus.gif
c:\windows\system32\images\tree\beginplus.gif
c:\windows\system32\images\tree\blank.gif
c:\windows\system32\images\tree\blankdots.gif
c:\windows\system32\images\tree\dots.gif
c:\windows\system32\images\tree\lastdots.gif
c:\windows\system32\images\tree\lastminus.gif
c:\windows\system32\images\tree\lastplus.gif
c:\windows\system32\images\tree\Magnify.gif
c:\windows\system32\images\tree\minus.gif
c:\windows\system32\images\tree\minusbox.gif
c:\windows\system32\images\tree\plus.gif
c:\windows\system32\images\tree\plusbox.gif
c:\windows\system32\images\tree\singleminus.gif
c:\windows\system32\images\tree\singleplus.gif

.
(((((((((((((((((((((((((   Files Created from 2010-11-27 to 2010-12-27  )))))))))))))))))))))))))))))))
.

2010-12-27 20:56 . 2010-12-27 20:57	--------	d-----w-	c:\users\ghost\AppData\Local\temp
2010-12-27 20:56 . 2010-12-27 20:56	--------	d-----w-	c:\users\Default\AppData\Local\temp
2010-12-27 11:40 . 2010-12-27 11:40	--------	d-----w-	C:\rsit
2010-12-24 15:39 . 2010-04-07 07:10	571904	----a-w-	c:\windows\system32\oleaut32.dll
2010-12-24 14:27 . 2010-12-24 14:27	--------	d-----w-	c:\programdata\SUPERAntiSpyware.com
2010-12-24 14:09 . 2010-12-24 14:09	16968	----a-w-	c:\windows\system32\drivers\hitmanpro35.sys
2010-12-24 14:08 . 2010-12-24 14:08	--------	d-----w-	c:\programdata\Hitman Pro
2010-12-24 11:02 . 2010-12-24 11:12	--------	d-----w-	c:\users\ghost\AppData\Roaming\Notepad++
2010-12-24 11:02 . 2010-12-24 11:12	--------	d-----w-	c:\program files\Notepad++
2010-12-24 10:50 . 2010-12-24 10:50	108032	--sha-r-	c:\windows\system32\desktopo.dll
2010-12-23 22:34 . 2010-12-24 10:41	--------	d-----w-	c:\users\ghost\AppData\Roaming\Sublime Text
2010-12-23 22:33 . 2010-12-24 11:13	--------	d-----w-	c:\program files\Sublime Text
2010-12-23 19:49 . 2010-12-23 19:49	--------	d-----w-	c:\program files\Mozilla Firefox 4.0 Beta 8
2010-12-22 22:19 . 2010-12-22 22:19	--------	d-----w-	c:\programdata\ATI
2010-12-22 22:14 . 2010-12-22 22:16	--------	d-----w-	c:\program files\ATI Technologies
2010-12-21 13:48 . 2010-12-21 13:48	--------	d-----w-	c:\programdata\Trymedia
2010-12-21 13:42 . 2010-12-21 13:42	--------	d-----w-	c:\program files\Sierra
2010-12-18 16:55 . 2010-12-18 16:55	--------	d-----w-	c:\users\ghost\AppData\Roaming\Hothead Games
2010-12-18 16:10 . 2010-12-18 16:10	--------	d-----w-	c:\program files\EA
2010-12-17 11:45 . 2010-12-17 11:45	--------	d-----w-	C:\AMD
2010-12-16 16:28 . 2010-11-16 11:01	6273872	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{DEA4C2C0-A6F7-4685-9478-4801AA10548E}\mpengine.dll
2010-12-16 16:27 . 2010-12-16 16:27	--------	d-----w-	c:\program files\MSXML 4.0
2010-12-13 17:09 . 2010-12-13 17:09	--------	d-----w-	c:\users\ghost\AppData\Roaming\CrypTool
2010-12-13 16:47 . 2010-12-13 16:47	--------	d-----w-	c:\windows\Sun
2010-12-10 18:43 . 2010-12-10 18:43	--------	d-----w-	c:\program files\Speccy
2010-12-10 15:11 . 2010-12-23 17:20	--------	d-----w-	c:\users\ghost\AppData\Roaming\leafChat
2010-12-10 15:10 . 2010-12-10 15:10	--------	d-----w-	c:\program files\leafChat 2
2010-12-09 16:39 . 2010-12-09 16:40	--------	d-----w-	c:\users\ghost\.netbeans
2010-12-09 16:39 . 2010-12-09 16:39	--------	d-----w-	c:\users\ghost\.netbeans-registration
2010-12-09 16:37 . 2010-12-14 18:16	--------	d-----w-	c:\program files\NetBeans 6.9.1
2010-12-09 16:37 . 2010-12-09 16:40	--------	d-----w-	c:\users\ghost\.nbi
2010-12-09 16:36 . 2010-12-09 16:36	--------	d-----w-	c:\program files\Common Files\Java
2010-12-09 16:36 . 2010-12-09 16:36	472808	----a-w-	c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
2010-12-09 16:36 . 2010-12-09 16:36	472808	----a-w-	c:\windows\system32\deployJava1.dll
2010-12-09 16:36 . 2010-12-09 16:36	--------	d-----w-	c:\program files\Java
2010-12-08 20:22 . 2010-12-08 20:22	--------	d-----w-	c:\users\ghost\AppData\Roaming\CA
2010-12-08 20:21 . 2010-12-08 20:21	--------	d-----w-	c:\users\ghost\AppData\Local\Downloaded Installations
2010-12-01 17:02 . 2010-12-01 17:03	--------	d-----w-	c:\program files\OpenTTD
2010-12-01 16:49 . 2010-12-01 16:49	8	--sh--r-	c:\programdata\FA4576EFF9.sys
2010-12-01 14:11 . 2010-12-01 14:15	--------	d-----w-	c:\users\ghost\AppData\Local\DOSBox
2010-12-01 14:03 . 2010-12-01 14:03	--------	d--h--w-	c:\windows\PIF
2010-12-01 14:02 . 1997-12-17 17:33	304128	----a-w-	c:\windows\IsUninst.exe
2010-11-30 20:59 . 2010-11-30 20:59	--------	d-----w-	c:\users\ghost\AppData\Local\SKIDROW
2010-11-30 16:36 . 2010-11-30 16:36	--------	d-----w-	c:\program files\Lightworks
2010-11-28 11:38 . 2003-10-27 13:06	505104	----a-w-	c:\windows\system32\msxml.dll
2010-11-28 11:38 . 2003-10-27 13:06	115016	----a-w-	c:\windows\system32\MSINET.OCX
2010-11-28 11:38 . 2003-10-27 13:06	89360	----a-w-	c:\windows\system32\VB5DB.DLL
2010-11-28 11:38 . 2003-10-27 13:06	69632	----a-w-	c:\windows\system32\xmltok.dll
2010-11-28 11:38 . 2003-10-27 13:06	36864	----a-w-	c:\windows\system32\xmlparse.dll
2010-11-28 11:38 . 2003-10-27 13:06	28432	----a-w-	c:\windows\system32\msxmlr.dll
2010-11-28 11:38 . 2003-10-27 13:06	26096	----a-w-	c:\windows\system32\xmlinst.exe
2010-11-28 11:38 . 2003-10-27 13:06	35840	----a-w-	c:\windows\system32\comdlg32.oca
2010-11-28 11:38 . 2003-10-27 13:06	29184	----a-w-	c:\windows\system32\MSINET.oca
2010-11-28 11:38 . 2003-10-27 13:06	24576	----a-w-	c:\windows\system32\msxml3a.dll
2010-11-28 11:38 . 2003-10-27 13:06	140488	----a-w-	c:\windows\system32\comdlg32.ocx
2010-11-28 11:32 . 2010-12-18 14:18	--------	d-----w-	c:\program files\UBISOFT

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-20 17:09 . 2010-06-24 11:00	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-20 17:08 . 2010-06-24 11:00	20952	----a-w-	c:\windows\system32\drivers\mbam.sys
2010-12-20 10:16 . 2010-07-04 15:23	135096	----a-w-	c:\windows\system32\drivers\avipbb.sys
2010-11-26 02:58 . 2010-11-26 02:58	143360	----a-w-	c:\windows\system32\atiapfxx.exe
2010-11-26 02:58 . 2010-11-26 02:58	550400	----a-w-	c:\windows\system32\aticfx32.dll
2010-11-26 02:52 . 2010-11-26 02:52	278528	----a-w-	c:\windows\system32\Oemdspif.dll
2010-11-24 09:37 . 2010-07-04 15:23	61960	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2010-11-21 13:09 . 2010-11-21 13:09	796672	----a-w-	c:\windows\GPInstall.exe
2010-10-19 09:41 . 2010-03-01 17:10	222080	------w-	c:\windows\system32\MpSigStub.exe
2010-10-17 16:06 . 2010-10-17 16:11	100352	----a-w-	c:\windows\system32\Ribbon.dll
2010-10-16 14:33 . 2010-10-16 14:26	1781824	----a-w-	c:\programdata\Microsoft\VisualStudio\10.0\1033\ResourceCache.dll
2010-10-08 13:57 . 2010-10-30 17:08	143184	----a-w-	c:\windows\system32\drivers\VBoxDrv.sys
2010-10-08 13:57 . 2010-10-30 17:08	41936	----a-w-	c:\windows\system32\drivers\VBoxUSBMon.sys
2010-10-08 13:57 . 2010-10-08 13:57	111568	----a-w-	c:\windows\system32\drivers\VBoxNetFlt.sys
2010-10-08 13:57 . 2010-10-08 13:57	100560	----a-w-	c:\windows\system32\drivers\VBoxNetAdp.sys
2010-10-08 13:57 . 2010-10-08 13:57	133648	----a-w-	c:\windows\system32\VBoxNetFltNotify.dll
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2009-11-11 1468256]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2010-03-01 225280]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-03 281768]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-02-22 500208]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-03-01 7703072]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-7-17 795936]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages	REG_MULTI_SZ   	kerberos msv1_0 schannel wdigest tspkg pku2u livessp

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager]
2008-08-14 06:58	611712	----a-w-	c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2010-03-01 17:02	135664	----atw-	c:\users\ghost\AppData\Local\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2009-07-29 21:20	98304	----a-w-	c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2010-11-17 15:06	1242448	----a-w-	c:\program files\Steam\Steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 10:44	248552	----a-w-	c:\program files\Common Files\Java\Java Update\jusched.exe

R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);c:\windows\System32\drivers\sfsync03.sys [2005-12-06 35328]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2010-03-01 4994560]
R3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-03-01 106496]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2010-03-01 29472]
R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys [2009-07-24 101248]
R3 LogWatch;Event Log Watch;c:\ca_lic\LogWatNT.exe [2008-05-20 75016]
R3 OracleVssWriterDOMA;Oracle DOMA VSS Writer Service;c:\oracle\product\11.2.0\dbhome_1\bin\OraVSSW.exe DOMA [x]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2010-10-08 100560]
R4 KJHVBICHK;KJHVBICHK;c:\users\ghost\AppData\Local\Temp\KJHVBICHK.exe [x]
R4 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [2010-01-19 3595660]
R4 OracleJobSchedulerDOMA;OracleJobSchedulerDOMA;c:\oracle\product\11.2.0\dbhome_1\Bin\extjob.exe DOMA [x]
R4 OracleOraDb11g_home2TNSListener;OracleOraDb11g_home2TNSListener;c:\oracle\product\11.2.0\dbhome_1\BIN\TNSLSNR  [x]
R4 OracleServiceDOMA;OracleServiceDOMA;c:\oracle\product\11.2.0\dbhome_1\bin\ORACLE.EXE DOMA [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-07-04 697328]
S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys [2010-10-08 143184]
S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys [2010-10-08 41936]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-03-01 176128]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2010-11-03 135336]
S3 O2MDRDR;O2MDRDR;c:\windows\system32\DRIVERS\o2media.sys [2010-03-01 52128]
S3 O2SDRDR;O2SDRDR;c:\windows\system32\DRIVERS\o2sd.sys [2010-03-01 42144]
S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2009-04-03 27320]
S3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [2010-10-08 111568]

.
Contents of the 'Scheduled Tasks' folder
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.bing.com/
uInternet Settings,ProxyOverride = localhost; 127.0.0.1; <local>
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
IE: Odeslat obrázek do zařízení &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Odeslat stránku do zařízení &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: {A9766CBD-E990-4156-B51C-29E4580AB4CA} = 208.67.220.220,208.67.222.222
FF - ProfilePath - c:\users\ghost\AppData\Roaming\Mozilla\Firefox\Profiles\lkqau6gy.doma\
FF - prefs.js: network.proxy.ftp - 192.168.20.1
FF - prefs.js: network.proxy.ftp_port - 3128
FF - prefs.js: network.proxy.gopher - 192.168.20.1
FF - prefs.js: network.proxy.gopher_port - 3128
FF - prefs.js: network.proxy.http - 192.168.20.1
FF - prefs.js: network.proxy.http_port - 3128
FF - prefs.js: network.proxy.socks - 192.168.20.1
FF - prefs.js: network.proxy.socks_port - 3128
FF - prefs.js: network.proxy.ssl - 192.168.20.1
FF - prefs.js: network.proxy.ssl_port - 3128
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox 4.0 Beta 8\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Firebug: firebug@software.joehewitt.com - %profile%\extensions\firebug@software.joehewitt.com
.
.
------- File Associations -------
.
vbefile\shell\open2\command="%SystemRoot%\System32\CScript.exe" "%1" %*
vbsfile\shell\open2\command="%SystemRoot%\System32\CScript.exe" "%1" %*
jsefile\shell\open2\command=c:\windows\System32\CScript.exe "%1" %*
.txt=
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-AdobeBridge - (no file)
MSConfigStartUp-JP595IR86O - c:\users\ghost\AppData\Local\Temp\Nsp.exe
MSConfigStartUp-Pando Media Booster - c:\program files\Pando Networks\Media Booster\PMB.exe
AddRemove-Serious Sam - The Second Encounter - c:\program files\Croteam\Serious Sam - The Second Encounter\uninstall.exe



[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\OracleOraDb11g_home2TNSListener]
"ImagePath"="c:\oracle\product\11.2.0\dbhome_1\BIN\TNSLSNR "
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-836658686-317755832-3362451444-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{817AFF97-64B5-697E-1225-AF429D425F42}*]
"mafjnbglbeeimdlhihbdbjefnk"=hex:6a,61,63,6e,70,6d,70,6e,62,70,6f,69,67,64,66,
   64,64,63,65,69,00,00
"naljhcpilnjbfmglkpclpidmokea"=hex:6a,61,63,6e,70,6d,70,6e,62,70,6f,69,67,64,
   66,64,64,63,65,69,00,00

[HKEY_USERS\S-1-5-21-836658686-317755832-3362451444-1000\Software\SecuROM\License information*]
"datasecu"=hex:8f,d5,99,98,60,56,ef,cf,48,ab,09,64,06,f9,7f,4b,e5,5d,e6,ed,04,
   18,44,b0,ce,25,e6,a1,29,29,02,65,ea,00,5d,68,d2,11,7b,da,26,d4,f4,60,41,38,\
"rkeysecu"=hex:0e,d1,a7,f4,0c,79,01,2b,da,f9,07,cc,23,dc,66,de

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2010-12-27  21:59:14
ComboFix-quarantined-files.txt  2010-12-27 20:59

Pre-Run: Volných bajtů: 94 619 529 216
Post-Run: Volných bajtů: 95 033 626 624

- - End Of File - - 2586ABEC923221DB3C6D88E648D67C01

Re: Problém zo security center vo Win 7

Napsal: 27 pro 2010 22:40
od Rudy
Ještě dočistíme. Otevřte poznámkový blok a zkopírujte do něj:
KillAll::

Collect::
c:\programdata\FA4576EFF9.sys
c:\users\ghost\AppData\Local\Temp\KJHVBICHK.exe

Driver::
KJHVBICHK

Regnull::
[HKEY_USERS\S-1-5-21-836658686-317755832-3362451444-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{817AFF97-64B5-697E-1225-AF429D425F42}*]
Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

Obrázek

Re: Problém zo security center vo Win 7

Napsal: 27 pro 2010 23:08
od gh0st
Vyzera to ze Security Center uz funguje ako ma :)

Kód: Vybrat vše

ComboFix 10-12-26.01 - ghost . 12. 2010  22:47:50.2.2 - x86
Microsoft Windows 7 Home Premium   6.1.7600.0.1250.421.1029.18.2814.1963 [GMT 1:00]
Running from: c:\users\ghost\Desktop\ComboFix.exe
Command switches used :: c:\users\ghost\Desktop\CFScript.txt
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Created a new restore point

file zipped: c:\programdata\FA4576EFF9.sys
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\programdata\FA4576EFF9.sys

.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_KJHVBICHK


(((((((((((((((((((((((((   Files Created from 2010-11-27 to 2010-12-27  )))))))))))))))))))))))))))))))
.

2010-12-27 21:57 . 2010-12-27 21:57	--------	d-----w-	c:\users\Default\AppData\Local\temp
2010-12-27 21:57 . 2010-12-27 22:00	--------	d-----w-	c:\users\ghost\AppData\Local\temp
2010-12-27 11:40 . 2010-12-27 11:40	--------	d-----w-	C:\rsit
2010-12-24 15:39 . 2010-04-07 07:10	571904	----a-w-	c:\windows\system32\oleaut32.dll
2010-12-24 14:27 . 2010-12-24 14:27	--------	d-----w-	c:\programdata\SUPERAntiSpyware.com
2010-12-24 14:09 . 2010-12-24 14:09	16968	----a-w-	c:\windows\system32\drivers\hitmanpro35.sys
2010-12-24 14:08 . 2010-12-24 14:08	--------	d-----w-	c:\programdata\Hitman Pro
2010-12-24 11:02 . 2010-12-24 11:12	--------	d-----w-	c:\users\ghost\AppData\Roaming\Notepad++
2010-12-24 11:02 . 2010-12-24 11:12	--------	d-----w-	c:\program files\Notepad++
2010-12-24 10:50 . 2010-12-24 10:50	108032	--sha-r-	c:\windows\system32\desktopo.dll
2010-12-23 22:34 . 2010-12-24 10:41	--------	d-----w-	c:\users\ghost\AppData\Roaming\Sublime Text
2010-12-23 22:33 . 2010-12-24 11:13	--------	d-----w-	c:\program files\Sublime Text
2010-12-23 19:49 . 2010-12-23 19:49	--------	d-----w-	c:\program files\Mozilla Firefox 4.0 Beta 8
2010-12-22 22:19 . 2010-12-22 22:19	--------	d-----w-	c:\programdata\ATI
2010-12-22 22:14 . 2010-12-22 22:16	--------	d-----w-	c:\program files\ATI Technologies
2010-12-21 13:48 . 2010-12-21 13:48	--------	d-----w-	c:\programdata\Trymedia
2010-12-21 13:42 . 2010-12-21 13:42	--------	d-----w-	c:\program files\Sierra
2010-12-18 16:55 . 2010-12-18 16:55	--------	d-----w-	c:\users\ghost\AppData\Roaming\Hothead Games
2010-12-18 16:10 . 2010-12-18 16:10	--------	d-----w-	c:\program files\EA
2010-12-17 11:45 . 2010-12-17 11:45	--------	d-----w-	C:\AMD
2010-12-16 16:28 . 2010-11-16 11:01	6273872	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{DEA4C2C0-A6F7-4685-9478-4801AA10548E}\mpengine.dll
2010-12-16 16:27 . 2010-12-16 16:27	--------	d-----w-	c:\program files\MSXML 4.0
2010-12-13 17:09 . 2010-12-13 17:09	--------	d-----w-	c:\users\ghost\AppData\Roaming\CrypTool
2010-12-13 16:47 . 2010-12-13 16:47	--------	d-----w-	c:\windows\Sun
2010-12-10 18:43 . 2010-12-10 18:43	--------	d-----w-	c:\program files\Speccy
2010-12-10 15:11 . 2010-12-23 17:20	--------	d-----w-	c:\users\ghost\AppData\Roaming\leafChat
2010-12-10 15:10 . 2010-12-10 15:10	--------	d-----w-	c:\program files\leafChat 2
2010-12-09 16:39 . 2010-12-09 16:40	--------	d-----w-	c:\users\ghost\.netbeans
2010-12-09 16:39 . 2010-12-09 16:39	--------	d-----w-	c:\users\ghost\.netbeans-registration
2010-12-09 16:37 . 2010-12-14 18:16	--------	d-----w-	c:\program files\NetBeans 6.9.1
2010-12-09 16:37 . 2010-12-09 16:40	--------	d-----w-	c:\users\ghost\.nbi
2010-12-09 16:36 . 2010-12-09 16:36	--------	d-----w-	c:\program files\Common Files\Java
2010-12-09 16:36 . 2010-12-09 16:36	472808	----a-w-	c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
2010-12-09 16:36 . 2010-12-09 16:36	472808	----a-w-	c:\windows\system32\deployJava1.dll
2010-12-09 16:36 . 2010-12-09 16:36	--------	d-----w-	c:\program files\Java
2010-12-08 20:22 . 2010-12-08 20:22	--------	d-----w-	c:\users\ghost\AppData\Roaming\CA
2010-12-08 20:21 . 2010-12-08 20:21	--------	d-----w-	c:\users\ghost\AppData\Local\Downloaded Installations
2010-12-01 17:02 . 2010-12-01 17:03	--------	d-----w-	c:\program files\OpenTTD
2010-12-01 14:11 . 2010-12-01 14:15	--------	d-----w-	c:\users\ghost\AppData\Local\DOSBox
2010-12-01 14:03 . 2010-12-01 14:03	--------	d--h--w-	c:\windows\PIF
2010-12-01 14:02 . 1997-12-17 17:33	304128	----a-w-	c:\windows\IsUninst.exe
2010-11-30 20:59 . 2010-11-30 20:59	--------	d-----w-	c:\users\ghost\AppData\Local\SKIDROW
2010-11-30 16:36 . 2010-11-30 16:36	--------	d-----w-	c:\program files\Lightworks
2010-11-28 11:38 . 2003-10-27 13:06	505104	----a-w-	c:\windows\system32\msxml.dll
2010-11-28 11:38 . 2003-10-27 13:06	115016	----a-w-	c:\windows\system32\MSINET.OCX
2010-11-28 11:38 . 2003-10-27 13:06	89360	----a-w-	c:\windows\system32\VB5DB.DLL
2010-11-28 11:38 . 2003-10-27 13:06	69632	----a-w-	c:\windows\system32\xmltok.dll
2010-11-28 11:38 . 2003-10-27 13:06	36864	----a-w-	c:\windows\system32\xmlparse.dll
2010-11-28 11:38 . 2003-10-27 13:06	28432	----a-w-	c:\windows\system32\msxmlr.dll
2010-11-28 11:38 . 2003-10-27 13:06	26096	----a-w-	c:\windows\system32\xmlinst.exe
2010-11-28 11:38 . 2003-10-27 13:06	35840	----a-w-	c:\windows\system32\comdlg32.oca
2010-11-28 11:38 . 2003-10-27 13:06	29184	----a-w-	c:\windows\system32\MSINET.oca
2010-11-28 11:38 . 2003-10-27 13:06	24576	----a-w-	c:\windows\system32\msxml3a.dll
2010-11-28 11:38 . 2003-10-27 13:06	140488	----a-w-	c:\windows\system32\comdlg32.ocx
2010-11-28 11:32 . 2010-12-18 14:18	--------	d-----w-	c:\program files\UBISOFT

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-20 17:09 . 2010-06-24 11:00	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-20 17:08 . 2010-06-24 11:00	20952	----a-w-	c:\windows\system32\drivers\mbam.sys
2010-12-20 10:16 . 2010-07-04 15:23	135096	----a-w-	c:\windows\system32\drivers\avipbb.sys
2010-11-26 02:58 . 2010-11-26 02:58	143360	----a-w-	c:\windows\system32\atiapfxx.exe
2010-11-26 02:58 . 2010-11-26 02:58	550400	----a-w-	c:\windows\system32\aticfx32.dll
2010-11-26 02:52 . 2010-11-26 02:52	278528	----a-w-	c:\windows\system32\Oemdspif.dll
2010-11-24 09:37 . 2010-07-04 15:23	61960	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2010-11-21 13:09 . 2010-11-21 13:09	796672	----a-w-	c:\windows\GPInstall.exe
2010-10-19 09:41 . 2010-03-01 17:10	222080	------w-	c:\windows\system32\MpSigStub.exe
2010-10-17 16:06 . 2010-10-17 16:11	100352	----a-w-	c:\windows\system32\Ribbon.dll
2010-10-16 14:33 . 2010-10-16 14:26	1781824	----a-w-	c:\programdata\Microsoft\VisualStudio\10.0\1033\ResourceCache.dll
2010-10-08 13:57 . 2010-10-30 17:08	143184	----a-w-	c:\windows\system32\drivers\VBoxDrv.sys
2010-10-08 13:57 . 2010-10-30 17:08	41936	----a-w-	c:\windows\system32\drivers\VBoxUSBMon.sys
2010-10-08 13:57 . 2010-10-08 13:57	111568	----a-w-	c:\windows\system32\drivers\VBoxNetFlt.sys
2010-10-08 13:57 . 2010-10-08 13:57	100560	----a-w-	c:\windows\system32\drivers\VBoxNetAdp.sys
2010-10-08 13:57 . 2010-10-08 13:57	133648	----a-w-	c:\windows\system32\VBoxNetFltNotify.dll
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2009-11-11 1468256]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2010-03-01 225280]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-03 281768]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-02-22 500208]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-03-01 7703072]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-7-17 795936]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages	REG_MULTI_SZ   	kerberos msv1_0 schannel wdigest tspkg pku2u livessp

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager]
2008-08-14 06:58	611712	----a-w-	c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2010-03-01 17:02	135664	----atw-	c:\users\ghost\AppData\Local\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2009-07-29 21:20	98304	----a-w-	c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2010-11-17 15:06	1242448	----a-w-	c:\program files\Steam\Steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 10:44	248552	----a-w-	c:\program files\Common Files\Java\Java Update\jusched.exe

R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);c:\windows\System32\drivers\sfsync03.sys [2005-12-06 35328]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2010-03-01 4994560]
R3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-03-01 106496]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2010-03-01 29472]
R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys [2009-07-24 101248]
R3 LogWatch;Event Log Watch;c:\ca_lic\LogWatNT.exe [2008-05-20 75016]
R3 OracleVssWriterDOMA;Oracle DOMA VSS Writer Service;c:\oracle\product\11.2.0\dbhome_1\bin\OraVSSW.exe DOMA [x]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2010-10-08 100560]
R4 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [2010-01-19 3595660]
R4 OracleJobSchedulerDOMA;OracleJobSchedulerDOMA;c:\oracle\product\11.2.0\dbhome_1\Bin\extjob.exe DOMA [x]
R4 OracleOraDb11g_home2TNSListener;OracleOraDb11g_home2TNSListener;c:\oracle\product\11.2.0\dbhome_1\BIN\TNSLSNR  [x]
R4 OracleServiceDOMA;OracleServiceDOMA;c:\oracle\product\11.2.0\dbhome_1\bin\ORACLE.EXE DOMA [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-07-04 697328]
S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys [2010-10-08 143184]
S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys [2010-10-08 41936]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-03-01 176128]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2010-11-03 135336]
S3 O2MDRDR;O2MDRDR;c:\windows\system32\DRIVERS\o2media.sys [2010-03-01 52128]
S3 O2SDRDR;O2SDRDR;c:\windows\system32\DRIVERS\o2sd.sys [2010-03-01 42144]
S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2009-04-03 27320]
S3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [2010-10-08 111568]

.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.bing.com/
uInternet Settings,ProxyOverride = localhost; 127.0.0.1; <local>
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
IE: Odeslat obrázek do zařízení &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Odeslat stránku do zařízení &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: {A9766CBD-E990-4156-B51C-29E4580AB4CA} = 208.67.220.220,208.67.222.222
FF - ProfilePath - c:\users\ghost\AppData\Roaming\Mozilla\Firefox\Profiles\lkqau6gy.doma\
FF - prefs.js: network.proxy.ftp - 192.168.20.1
FF - prefs.js: network.proxy.ftp_port - 3128
FF - prefs.js: network.proxy.gopher - 192.168.20.1
FF - prefs.js: network.proxy.gopher_port - 3128
FF - prefs.js: network.proxy.http - 192.168.20.1
FF - prefs.js: network.proxy.http_port - 3128
FF - prefs.js: network.proxy.socks - 192.168.20.1
FF - prefs.js: network.proxy.socks_port - 3128
FF - prefs.js: network.proxy.ssl - 192.168.20.1
FF - prefs.js: network.proxy.ssl_port - 3128
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox 4.0 Beta 8\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Firebug: firebug@software.joehewitt.com - %profile%\extensions\firebug@software.joehewitt.com
.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\OracleOraDb11g_home2TNSListener]
"ImagePath"="c:\oracle\product\11.2.0\dbhome_1\BIN\TNSLSNR "
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-836658686-317755832-3362451444-1000\Software\SecuROM\License information*]
"datasecu"=hex:8f,d5,99,98,60,56,ef,cf,48,ab,09,64,06,f9,7f,4b,e5,5d,e6,ed,04,
   18,44,b0,ce,25,e6,a1,29,29,02,65,ea,00,5d,68,d2,11,7b,da,26,d4,f4,60,41,38,\
"rkeysecu"=hex:0e,d1,a7,f4,0c,79,01,2b,da,f9,07,cc,23,dc,66,de

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'Explorer.exe'(4024)
c:\program files\WIDCOMM\Bluetooth Software\btmmhook.dll
c:\program files\WIDCOMM\Bluetooth Software\btncopy.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\atieclxx.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\WIDCOMM\Bluetooth Software\btwdins.exe
c:\windows\system32\DRIVERS\o2flash.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\windows\system32\conhost.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\DllHost.exe
c:\windows\system32\sppsvc.exe
.
**************************************************************************
.
Completion time: 2010-12-27  23:05:13 - machine was rebooted
ComboFix-quarantined-files.txt  2010-12-27 22:05
ComboFix2.txt  2010-12-27 20:59

Pre-Run: Volných bajtů: 95 131 160 576
Post-Run: Volných bajtů: 94 806 753 280

- - End Of File - - C033AFFE43AF86F7A5A8E040F5279144

Re: Problém zo security center vo Win 7

Napsal: 27 pro 2010 23:29
od Rudy
Pak bude vše v pořádku, log již vypadá čistý.

Re: Problém zo security center vo Win 7

Napsal: 27 pro 2010 23:36
od gh0st
ďakujem za pomoc :wink:

Re: Problém zo security center vo Win 7

Napsal: 28 pro 2010 20:03
od Rudy
Nemáte zač!
Všechny časy jsou v UTC+01:00
Stránka 1 z 1

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz