VIRY.CZ

kamarádův notebook hlásí 23 virů a trojanů, antivir se ani nechce nechat otevřít, Např. Trojan- spy.html.bayfraud.hn, trojan-spy.win 32.wmpatch
Logfile of random's system information tool 1.08 (written by random/random)
Run by Dan at 2011-03-20 22:38:47
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 261 GB (90%) free of 292 GB
Total RAM: 1978 MB (49% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:39:45, on 20.3.2011
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v8.00 (8.00.7601.17514)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe
C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
C:\Program Files (x86)\OLYMPUS\OLYMPUS Master 2\MMonitor.exe
C:\Program Files (x86)\T-Mobile\Web'n'walk Manager\Manager.exe
C:\Program Files (x86)\Launch Manager\LManager.exe
C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe
C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
C:\Program Files (x86)\QuickTime\qttask.exe
C:\Program Files (x86)\Launch Manager\LMworker.exe
C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe
C:\ProgramData\836ed1\BM836_2121.exe
C:\Users\Dan\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Dan\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Dan\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Dan\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Dan\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Dan\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Dan\Downloads\RSIT.exe
C:\Program Files (x86)\trend micro\Dan.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACA ... 5v47m2131s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = my.daemon-search.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACA ... 5v47m2131s
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACA ... 5v47m2131s
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Pomocná služba pro přihlášení ke službě Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.6.6209.1142\swg.dll
O2 - BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll" (file missing)
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll" (file missing)
O4 - HKLM\..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
O4 - HKLM\..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe
O4 - HKLM\..\Run: [SuiteTray] "C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe"
O4 - HKLM\..\Run: [EgisUpdate] "C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe" -d
O4 - HKLM\..\Run: [EgisTecPMMUpdate] "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe"
O4 - HKLM\..\Run: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BackupManagerTray] "C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" -h -k
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [OM2_Monitor] "C:\Program Files (x86)\OLYMPUS\OLYMPUS Master 2\FirstStart.exe" /OM
O4 - HKCU\..\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [OM2_Monitor] "C:\Program Files (x86)\OLYMPUS\OLYMPUS Master 2\MMonitor.exe"
O4 - HKCU\..\Run: [T-Mobile Communication Centre] "C:\Program Files (x86)\T-Mobile\Web'n'walk Manager\Manager.exe" -autorun
O4 - HKCU\..\Run: [Best Malware Protection] "C:\ProgramData\836ed1\BM836_2121.exe" /s /d
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: WikiKomentáře Google... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{C67EC752-19B8-2400-C723-392C694313D8}: NameServer = 62.141.0.1 213.162.65.1
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Web'n'walk Manager mobile equipment installation service (ameisvc) - Gemfor s.r.o. - C:\Program Files (x86)\T-Mobile\Web'n'walk Manager\ameisvc.exe
O23 - Service: Dritek WMI Service (DsiWMIService) - Dritek System Inc. - C:\Program Files (x86)\Launch Manager\dsiwmis.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: Acer ePower Service (ePowerSvc) - Acer Incorporated - C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GREGService - Acer Incorporated - C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: MyWinLocker Service (MWLService) - Egis Technology Inc. - C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Norton Online Backup (NOBU) - Symantec Corporation - C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
O23 - Service: NTI IScheduleSvc - NewTech Infosystems, Inc. - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Updater Service - Acer Group - C:\Program Files\Acer\Acer Updater\UpdaterService.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 11889 bytes

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocná služba pro přihlášení ke službě Windows Live ID - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21 439168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9FDDE16B-836F-4806-AB1F-1455CBEFF289}]
Windows Live Messenger Companion Helper - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll [2010-09-23 393600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2011-03-05 298160]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.6.6209.1142\swg.dll [2011-03-05 848952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d2ce3e00-f94a-4740-988e-03dc2f38c34f}]
Bing Bar Helper - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll [2011-02-28 1089288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll [2011-01-20 988480]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2011-03-05 298160]
{8dcb7100-df86-4384-8842-8fa844297b3f} - Bing Bar - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll [2011-02-28 1089288]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"=C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [2010-04-13 284696]
"LManager"=C:\Program Files (x86)\Launch Manager\LManager.exe [2010-06-22 968272]
"SuiteTray"=C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [2010-05-27 337264]
"EgisUpdate"=C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe [2010-03-11 201584]
"EgisTecPMMUpdate"=C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe [2010-03-11 407920]
"Norton Online Backup"=C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [2010-06-01 1155928]
"Adobe Reader Speed Launcher"=C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-28 35696]
"BackupManagerTray"=C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [2010-06-28 265984]
"QuickTime Task"=C:\Program Files (x86)\QuickTime\qttask.exe [2006-09-01 282624]
"OM2_Monitor"=C:\Program Files (x86)\OLYMPUS\OLYMPUS Master 2\FirstStart.exe [2008-05-15 54576]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"swg"=C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2010-07-16 39408]
"Skype"=C:\Program Files (x86)\Skype\Phone\Skype.exe [2009-10-09 25623336]
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2011-01-20 1305408]
"OM2_Monitor"=C:\Program Files (x86)\OLYMPUS\OLYMPUS Master 2\MMonitor.exe [2008-05-15 95536]
"T-Mobile Communication Centre"=C:\Program Files (x86)\T-Mobile\Web'n'walk Manager\Manager.exe [2010-06-03 1347504]
"Best Malware Protection"=C:\ProgramData\836ed1\BM836_2121.exe [2011-03-20 6128640]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorUser"=2
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"DisallowRun"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

Dejte log z ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode, pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k nezadoucim kolizim s rezidentem antispyware

log je strasne dlouhej ani se na jednou nevešel, tady posílám další část a udělám combo
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]

Rozdělte na více postů.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="svchost.exe

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2011-03-20 22:01:55 ----D---- C:\Program Files (x86)\trend micro
2011-03-20 22:01:54 ----D---- C:\rsit
2011-03-20 21:18:42 ----SHD---- C:\Users\Dan\AppData\Roaming\Best Malware Protection
2011-03-20 21:18:42 ----SHD---- C:\ProgramData\BMSZP
2011-03-20 21:09:59 ----SHD---- C:\ProgramData\836ed1
2011-03-18 08:07:36 ----D---- C:\Program Files (x86)\Microsoft
2011-03-17 21:26:58 ----A---- C:\Windows\SysWOW64\dfshim.dll
2011-03-17 21:26:51 ----A---- C:\Windows\SysWOW64\mstscax.dll
2011-03-17 21:26:48 ----A---- C:\Windows\SysWOW64\d3d10warp.dll
2011-03-17 21:26:47 ----A---- C:\Windows\SysWOW64\mfc40u.dll
2011-03-17 21:26:47 ----A---- C:\Windows\SysWOW64\mfc40.dll
2011-03-17 21:26:41 ----A---- C:\Windows\SysWOW64\shell32.dll
2011-03-17 21:26:41 ----A---- C:\Windows\SysWOW64\secproc_isv.dll
2011-03-17 21:26:40 ----A---- C:\Windows\SysWOW64\secproc.dll
2011-03-17 21:26:40 ----A---- C:\Windows\SysWOW64\RMActivate_isv.exe
2011-03-17 21:26:39 ----A---- C:\Windows\SysWOW64\RMActivate.exe
2011-03-17 21:26:39 ----A---- C:\Windows\SysWOW64\ieframe.dll
2011-03-17 21:26:37 ----A---- C:\Windows\SysWOW64\mscoree.dll
2011-03-17 21:26:36 ----A---- C:\Windows\SysWOW64\ntkrnlpa.exe
2011-03-17 21:26:36 ----A---- C:\Windows\SysWOW64\mf.dll
2011-03-17 21:26:35 ----A---- C:\Windows\SysWOW64\CertEnroll.dll
2011-03-17 21:26:34 ----A---- C:\Windows\SysWOW64\iertutil.dll
2011-03-17 21:26:33 ----A---- C:\Windows\SysWOW64\wmp.dll
2011-03-17 21:26:33 ----A---- C:\Windows\SysWOW64\mssrch.dll
2011-03-17 21:26:33 ----A---- C:\Windows\explorer.exe
2011-03-17 21:26:31 ----A---- C:\Windows\SysWOW64\PresentationHostProxy.dll
2011-03-17 21:26:31 ----A---- C:\Windows\SysWOW64\PresentationHost.exe
2011-03-17 21:26:31 ----A---- C:\Windows\SysWOW64\ntoskrnl.exe
2011-03-17 21:26:31 ----A---- C:\Windows\SysWOW64\esent.dll
2011-03-17 21:26:30 ----A---- C:\Windows\SysWOW64\tquery.dll
2011-03-17 21:26:29 ----A---- C:\Windows\SysWOW64\RacEngn.dll
2011-03-17 21:26:27 ----A---- C:\Windows\SysWOW64\AuthFWSnapin.dll
2011-03-17 21:26:25 ----A---- C:\Windows\SysWOW64\wininet.dll
2011-03-17 21:26:25 ----A---- C:\Windows\SysWOW64\ole32.dll
2011-03-17 21:26:25 ----A---- C:\Windows\SysWOW64\ExplorerFrame.dll
2011-03-17 21:26:24 ----A---- C:\Windows\SysWOW64\urlmon.dll
2011-03-17 21:26:22 ----A---- C:\Windows\SysWOW64\vssapi.dll
2011-03-17 21:26:22 ----A---- C:\Windows\SysWOW64\SearchFolder.dll
2011-03-17 21:26:21 ----A---- C:\Windows\SysWOW64\taskschd.dll
2011-03-17 21:26:21 ----A---- C:\Windows\SysWOW64\explorer.exe
2011-03-17 21:26:21 ----A---- C:\Windows\SysWOW64\d3d9.dll
2011-03-17 21:26:20 ----A---- C:\Windows\SysWOW64\crypt32.dll
2011-03-17 21:26:19 ----A---- C:\Windows\SysWOW64\mstsc.exe
2011-03-17 21:26:18 ----A---- C:\Windows\SysWOW64\wer.dll
2011-03-17 21:26:18 ----A---- C:\Windows\SysWOW64\ntdll.dll
2011-03-17 21:26:18 ----A---- C:\Windows\SysWOW64\certcli.dll
2011-03-17 21:26:17 ----A---- C:\Windows\SysWOW64\msxml6.dll
2011-03-17 21:26:17 ----A---- C:\Windows\SysWOW64\dwmcore.dll
2011-03-17 21:26:16 ----A---- C:\Windows\SysWOW64\tcpmonui.dll
2011-03-17 21:26:16 ----A---- C:\Windows\SysWOW64\odbc32.dll
2011-03-17 21:26:15 ----A---- C:\Windows\SysWOW64\TSWorkspace.dll
2011-03-17 21:26:15 ----A---- C:\Windows\SysWOW64\quartz.dll
2011-03-17 21:26:15 ----A---- C:\Windows\SysWOW64\mstime.dll
2011-03-17 21:26:14 ----A---- C:\Windows\SysWOW64\tsmf.dll
2011-03-17 21:26:14 ----A---- C:\Windows\SysWOW64\dot3api.dll
2011-03-17 21:26:13 ----A---- C:\Windows\SysWOW64\winhttp.dll
2011-03-17 21:26:13 ----A---- C:\Windows\SysWOW64\setupapi.dll
2011-03-17 21:26:13 ----A---- C:\Windows\SysWOW64\MSVidCtl.dll
2011-03-17 21:26:13 ----A---- C:\Windows\SysWOW64\msfeeds.dll
2011-03-17 21:26:13 ----A---- C:\Windows\SysWOW64\iedkcs32.dll
2011-03-17 21:26:13 ----A---- C:\Windows\SysWOW64\dbgeng.dll
2011-03-17 21:26:13 ----A---- C:\Windows\SysWOW64\apphelp.dll
2011-03-17 21:26:12 ----A---- C:\Windows\SysWOW64\WindowsCodecs.dll
2011-03-17 21:26:12 ----A---- C:\Windows\SysWOW64\netlogon.dll
2011-03-17 21:26:12 ----A---- C:\Windows\SysWOW64\d3d11.dll
2011-03-17 21:26:11 ----A---- C:\Windows\SysWOW64\WMVDECOD.DLL
2011-03-17 21:26:11 ----A---- C:\Windows\SysWOW64\webio.dll
2011-03-17 21:26:11 ----A---- C:\Windows\SysWOW64\Query.dll
2011-03-17 21:26:11 ----A---- C:\Windows\SysWOW64\netcfgx.dll
2011-03-17 21:26:10 ----A---- C:\Windows\SysWOW64\WsmSvc.dll
2011-03-17 21:26:10 ----A---- C:\Windows\SysWOW64\advapi32.dll
2011-03-17 21:26:09 ----A---- C:\Windows\SysWOW64\upnp.dll
2011-03-17 21:26:09 ----A---- C:\Windows\SysWOW64\schannel.dll
2011-03-17 21:26:09 ----A---- C:\Windows\SysWOW64\netfxperf.dll
2011-03-17 21:26:09 ----A---- C:\Windows\SysWOW64\msv1_0.dll
2011-03-17 21:26:09 ----A---- C:\Windows\SysWOW64\mmcndmgr.dll
2011-03-17 21:26:09 ----A---- C:\Windows\SysWOW64\imapi2fs.dll
2011-03-17 21:26:09 ----A---- C:\Windows\SysWOW64\DShowRdpFilter.dll
2011-03-17 21:26:08 ----A---- C:\Windows\SysWOW64\shlwapi.dll
2011-03-17 21:26:08 ----A---- C:\Windows\SysWOW64\SessEnv.dll
2011-03-17 21:26:08 ----A---- C:\Windows\SysWOW64\PortableDeviceApi.dll
2011-03-17 21:26:08 ----A---- C:\Windows\SysWOW64\msdrm.dll
2011-03-17 21:26:08 ----A---- C:\Windows\SysWOW64\authui.dll
2011-03-17 21:26:07 ----A---- C:\Windows\SysWOW64\usp10.dll
2011-03-17 21:26:07 ----A---- C:\Windows\SysWOW64\userenv.dll
2011-03-17 21:26:07 ----A---- C:\Windows\SysWOW64\mcbuilder.exe
2011-03-17 21:26:07 ----A---- C:\Windows\SysWOW64\kernel32.dll
2011-03-17 21:26:07 ----A---- C:\Windows\SysWOW64\certmgr.dll
2011-03-17 21:26:06 ----A---- C:\Windows\SysWOW64\xpsservices.dll
2011-03-17 21:26:06 ----A---- C:\Windows\SysWOW64\d3d10_1core.dll
2011-03-17 21:26:05 ----A---- C:\Windows\SysWOW64\WebClnt.dll
2011-03-17 21:26:04 ----A---- C:\Windows\SysWOW64\comdlg32.dll
2011-03-17 21:26:03 ----A---- C:\Windows\SysWOW64\cmd.exe
2011-03-17 21:26:02 ----A---- C:\Windows\SysWOW64\dnsapi.dll
2011-03-17 21:26:01 ----A---- C:\Windows\SysWOW64\Wldap32.dll
2011-03-17 21:26:01 ----A---- C:\Windows\SysWOW64\win32spl.dll
2011-03-17 21:26:01 ----A---- C:\Windows\SysWOW64\user32.dll
2011-03-17 21:26:01 ----A---- C:\Windows\SysWOW64\propsys.dll
2011-03-17 21:26:01 ----A---- C:\Windows\SysWOW64\mfds.dll
2011-03-17 21:26:01 ----A---- C:\Windows\SysWOW64\framedynos.dll
2011-03-17 21:26:00 ----A---- C:\Windows\SysWOW64\ncsi.dll
2011-03-17 21:26:00 ----A---- C:\Windows\SysWOW64\azroles.dll
2011-03-17 21:25:59 ----A---- C:\Windows\SysWOW64\themeui.dll
2011-03-17 21:25:59 ----A---- C:\Windows\SysWOW64\taskeng.exe
2011-03-17 21:25:59 ----A---- C:\Windows\SysWOW64\credui.dll
2011-03-17 21:25:59 ----A---- C:\Windows\splwow64.exe
2011-03-17 21:25:58 ----A---- C:\Windows\SysWOW64\spp.dll
2011-03-17 21:25:58 ----A---- C:\Windows\SysWOW64\mswsock.dll
2011-03-17 21:25:58 ----A---- C:\Windows\SysWOW64\inetcomm.dll
2011-03-17 21:25:58 ----A---- C:\Windows\SysWOW64\dhcpcore.dll
2011-03-17 21:25:57 ----A---- C:\Windows\SysWOW64\wintrust.dll
2011-03-17 21:25:57 ----A---- C:\Windows\SysWOW64\NaturalLanguage6.dll
2011-03-17 21:25:57 ----A---- C:\Windows\SysWOW64\msxml3.dll
2011-03-17 21:25:57 ----A---- C:\Windows\SysWOW64\mfreadwrite.dll
2011-03-17 21:25:57 ----A---- C:\Windows\SysWOW64\dxgi.dll
2011-03-17 21:25:57 ----A---- C:\Windows\SysWOW64\dbghelp.dll
2011-03-17 21:25:57 ----A---- C:\Windows\SysWOW64\basecsp.dll
2011-03-17 21:25:56 ----A---- C:\Windows\SysWOW64\taskcomp.dll
2011-03-17 21:25:56 ----A---- C:\Windows\SysWOW64\evr.dll
2011-03-17 21:25:55 ----A---- C:\Windows\SysWOW64\WinSATAPI.dll
2011-03-17 21:25:55 ----A---- C:\Windows\SysWOW64\sqlsrv32.dll
2011-03-17 21:25:55 ----A---- C:\Windows\SysWOW64\calc.exe
2011-03-17 21:25:54 ----A---- C:\Windows\SysWOW64\UIRibbon.dll
2011-03-17 21:25:53 ----A---- C:\Windows\SysWOW64\ws2_32.dll
2011-03-17 21:25:53 ----A---- C:\Windows\SysWOW64\sxs.dll
2011-03-17 21:25:53 ----A---- C:\Windows\SysWOW64\stobject.dll
2011-03-17 21:25:53 ----A---- C:\Windows\SysWOW64\netshell.dll
2011-03-17 21:25:53 ----A---- C:\Windows\SysWOW64\ie4uinit.exe
2011-03-17 21:25:53 ----A---- C:\Windows\SysWOW64\gdi32.dll
2011-03-17 21:25:53 ----A---- C:\Windows\SysWOW64\cryptsvc.dll
2011-03-17 21:25:52 ----A---- C:\Windows\SysWOW64\comctl32.dll
2011-03-17 21:25:51 ----A---- C:\Windows\SysWOW64\WSDApi.dll
2011-03-17 21:25:51 ----A---- C:\Windows\SysWOW64\wmpeffects.dll
2011-03-17 21:25:51 ----A---- C:\Windows\SysWOW64\rpchttp.dll
2011-03-17 21:25:51 ----A---- C:\Windows\SysWOW64\prncache.dll
2011-03-17 21:25:51 ----A---- C:\Windows\SysWOW64\printui.dll
2011-03-17 21:25:51 ----A---- C:\Windows\SysWOW64\net1.exe
2011-03-17 21:25:51 ----A---- C:\Windows\SysWOW64\msi.dll
2011-03-17 21:25:50 ----A---- C:\Windows\SysWOW64\scansetting.dll
2011-03-17 21:25:50 ----A---- C:\Windows\SysWOW64\mfc42u.dll
2011-03-17 21:25:49 ----A---- C:\Windows\SysWOW64\MMDevAPI.dll
2011-03-17 21:25:49 ----A---- C:\Windows\SysWOW64\davclnt.dll
2011-03-17 21:25:48 ----A---- C:\Windows\SysWOW64\WMVCORE.DLL
2011-03-17 21:25:48 ----A---- C:\Windows\SysWOW64\wlangpui.dll
2011-03-17 21:25:48 ----A---- C:\Windows\SysWOW64\QSHVHOST.DLL
2011-03-17 21:25:48 ----A---- C:\Windows\SysWOW64\aaclient.dll
2011-03-17 21:25:47 ----A---- C:\Windows\SysWOW64\wpdshext.dll
2011-03-17 21:25:47 ----A---- C:\Windows\SysWOW64\webservices.dll
2011-03-17 21:25:47 ----A---- C:\Windows\SysWOW64\t2embed.dll
2011-03-17 21:25:47 ----A---- C:\Windows\SysWOW64\SyncCenter.dll
2011-03-17 21:25:47 ----A---- C:\Windows\SysWOW64\pnidui.dll
2011-03-17 21:25:47 ----A---- C:\Windows\SysWOW64\netdiagfx.dll
2011-03-17 21:25:47 ----A---- C:\Windows\SysWOW64\fde.dll
2011-03-17 21:25:46 ----A---- C:\Windows\SysWOW64\wuapi.dll
2011-03-17 21:25:46 ----A---- C:\Windows\SysWOW64\wscapi.dll
2011-03-17 21:25:45 ----A---- C:\Windows\SysWOW64\WinSCard.dll
2011-03-17 21:25:45 ----A---- C:\Windows\SysWOW64\pla.dll
2011-03-17 21:25:45 ----A---- C:\Windows\SysWOW64\msasn1.dll
2011-03-17 21:25:44 ----A---- C:\Windows\SysWOW64\winsta.dll
2011-03-17 21:25:44 ----A---- C:\Windows\SysWOW64\rdpcore.dll
2011-03-17 21:25:44 ----A---- C:\Windows\SysWOW64\MSMPEG2ENC.DLL
2011-03-17 21:25:44 ----A---- C:\Windows\SysWOW64\iepeers.dll
2011-03-17 21:25:43 ----A---- C:\Windows\SysWOW64\ntshrui.dll
2011-03-17 21:25:43 ----A---- C:\Windows\SysWOW64\imapi2.dll
2011-03-17 21:25:43 ----A---- C:\Windows\SysWOW64\gameux.dll
2011-03-17 21:25:43 ----A---- C:\Windows\SysWOW64\DXPTaskRingtone.dll
2011-03-17 21:25:42 ----A---- C:\Windows\SysWOW64\WMPEncEn.dll
2011-03-17 21:25:42 ----A---- C:\Windows\SysWOW64\winmm.dll
2011-03-17 21:25:42 ----A---- C:\Windows\SysWOW64\shsvcs.dll
2011-03-17 21:25:42 ----A---- C:\Windows\SysWOW64\onex.dll
2011-03-17 21:25:42 ----A---- C:\Windows\SysWOW64\mssvp.dll
2011-03-17 21:25:41 ----A---- C:\Windows\SysWOW64\samcli.dll
2011-03-17 21:25:41 ----A---- C:\Windows\SysWOW64\proquota.exe
2011-03-17 21:25:41 ----A---- C:\Windows\SysWOW64\netiohlp.dll
2011-03-17 21:25:41 ----A---- C:\Windows\SysWOW64\msutb.dll
2011-03-17 21:25:41 ----A---- C:\Windows\SysWOW64\IPHLPAPI.DLL
2011-03-17 21:25:41 ----A---- C:\Windows\SysWOW64\hbaapi.dll
2011-03-17 21:25:41 ----A---- C:\Windows\SysWOW64\autochk.exe
2011-03-17 21:25:41 ----A---- C:\Windows\SysWOW64\autofmt.exe
2011-03-17 21:25:40 ----A---- C:\Windows\SysWOW64\thumbcache.dll
2011-03-17 21:25:40 ----A---- C:\Windows\SysWOW64\msinfo32.exe
2011-03-17 21:25:40 ----A---- C:\Windows\SysWOW64\autoconv.exe
2011-03-17 21:25:40 ----A---- C:\Windows\SysWOW64\AudioSes.dll
2011-03-17 21:25:39 ----A---- C:\Windows\SysWOW64\wcncsvc.dll
2011-03-17 21:25:39 ----A---- C:\Windows\SysWOW64\tcpipcfg.dll
2011-03-17 21:25:39 ----A---- C:\Windows\SysWOW64\srchadmin.dll
2011-03-17 21:25:39 ----A---- C:\Windows\SysWOW64\schtasks.exe
2011-03-17 21:25:39 ----A---- C:\Windows\SysWOW64\regapi.dll
2011-03-17 21:25:39 ----A---- C:\Windows\SysWOW64\powercpl.dll
2011-03-17 21:25:39 ----A---- C:\Windows\SysWOW64\msihnd.dll
2011-03-17 21:25:39 ----A---- C:\Windows\SysWOW64\mscorier.dll
2011-03-17 21:25:39 ----A---- C:\Windows\SysWOW64\mimefilt.dll
2011-03-17 21:25:39 ----A---- C:\Windows\SysWOW64\ipsmsnap.dll
2011-03-17 21:25:39 ----A---- C:\Windows\SysWOW64\framedyn.dll
2011-03-17 21:25:39 ----A---- C:\Windows\SysWOW64\eapphost.dll
2011-03-17 21:25:38 ----A---- C:\Windows\SysWOW64\QAGENT.DLL
2011-03-17 21:25:38 ----A---- C:\Windows\SysWOW64\netid.dll
2011-03-17 21:25:38 ----A---- C:\Windows\SysWOW64\AuxiliaryDisplayCpl.dll
2011-03-17 21:25:38 ----A---- C:\Windows\SysWOW64\actxprxy.dll
2011-03-17 21:25:37 ----A---- C:\Windows\SysWOW64\wlanpref.dll
2011-03-17 21:25:37 ----A---- C:\Windows\SysWOW64\wdc.dll
2011-03-17 21:25:37 ----A---- C:\Windows\SysWOW64\Vault.dll
2011-03-17 21:25:37 ----A---- C:\Windows\SysWOW64\untfs.dll
2011-03-17 21:25:37 ----A---- C:\Windows\SysWOW64\StructuredQuery.dll
2011-03-17 21:25:37 ----A---- C:\Windows\SysWOW64\scesrv.dll
2011-03-17 21:25:37 ----A---- C:\Windows\SysWOW64\RpcRtRemote.dll
2011-03-17 21:25:37 ----A---- C:\Windows\SysWOW64\rastls.dll
2011-03-17 21:25:37 ----A---- C:\Windows\SysWOW64\oleaut32.dll
2011-03-17 21:25:37 ----A---- C:\Windows\SysWOW64\nci.dll
2011-03-17 21:25:37 ----A---- C:\Windows\SysWOW64\licmgr10.dll
2011-03-17 21:25:36 ----A---- C:\Windows\SysWOW64\WMNetMgr.dll
2011-03-17 21:25:36 ----A---- C:\Windows\SysWOW64\Robocopy.exe
2011-03-17 21:25:33 ----A---- C:\Windows\SysWOW64\DxpTaskSync.dll
2011-03-17 21:25:32 ----A---- C:\Windows\SysWOW64\taskmgr.exe
2011-03-17 21:25:32 ----A---- C:\Windows\SysWOW64\Display.dll
2011-03-17 21:25:31 ----A---- C:\Windows\SysWOW64\mtxclu.dll
2011-03-17 21:25:30 ----A---- C:\Windows\SysWOW64\XpsRasterService.dll
2011-03-17 21:25:30 ----A---- C:\Windows\SysWOW64\userinit.exe
2011-03-17 21:25:30 ----A---- C:\Windows\SysWOW64\puiobj.dll
2011-03-17 21:25:30 ----A---- C:\Windows\SysWOW64\mssphtb.dll
2011-03-17 21:25:29 ----A---- C:\Windows\SysWOW64\wiadefui.dll
2011-03-17 21:25:29 ----A---- C:\Windows\SysWOW64\termmgr.dll
2011-03-17 21:25:29 ----A---- C:\Windows\SysWOW64\sppcomapi.dll
2011-03-17 21:25:29 ----A---- C:\Windows\SysWOW64\shsetup.dll
2011-03-17 21:25:29 ----A---- C:\Windows\SysWOW64\rasppp.dll
2011-03-17 21:25:29 ----A---- C:\Windows\SysWOW64\logoncli.dll
2011-03-17 21:25:29 ----A---- C:\Windows\SysWOW64\eudcedit.exe
2011-03-17 21:25:29 ----A---- C:\Windows\SysWOW64\cabview.dll
2011-03-17 21:25:28 ----A---- C:\Windows\SysWOW64\FirewallControlPanel.dll
2011-03-17 21:25:27 ----A---- C:\Windows\SysWOW64\themecpl.dll
2011-03-17 21:25:27 ----A---- C:\Windows\SysWOW64\SensorsCpl.dll
2011-03-17 21:25:27 ----A---- C:\Windows\SysWOW64\hgcpl.dll
2011-03-17 21:25:27 ----A---- C:\Windows\SysWOW64\FWPUCLNT.DLL
2011-03-17 21:25:27 ----A---- C:\Windows\SysWOW64\dnscmmc.dll
2011-03-17 21:25:25 ----A---- C:\Windows\SysWOW64\tapisrv.dll
2011-03-17 21:25:25 ----A---- C:\Windows\SysWOW64\SndVolSSO.dll
2011-03-17 21:25:25 ----A---- C:\Windows\SysWOW64\scecli.dll
2011-03-17 21:25:25 ----A---- C:\Windows\SysWOW64\mscories.dll
2011-03-17 21:25:25 ----A---- C:\Windows\SysWOW64\mscms.dll
2011-03-17 21:25:25 ----A---- C:\Windows\SysWOW64\mprddm.dll
2011-03-17 21:25:25 ----A---- C:\Windows\SysWOW64\localsec.dll
2011-03-17 21:25:25 ----A---- C:\Windows\SysWOW64\iasacct.dll
2011-03-17 21:25:25 ----A---- C:\Windows\SysWOW64\fontext.dll
2011-03-17 21:25:24 ----A---- C:\Windows\SysWOW64\wlanui.dll
2011-03-17 21:25:24 ----A---- C:\Windows\SysWOW64\VAN.dll
2011-03-17 21:25:24 ----A---- C:\Windows\SysWOW64\usercpl.dll
2011-03-17 21:25:24 ----A---- C:\Windows\SysWOW64\qedit.dll
2011-03-17 21:25:24 ----A---- C:\Windows\SysWOW64\qdvd.dll
2011-03-17 21:25:24 ----A---- C:\Windows\SysWOW64\prntvpt.dll
2011-03-17 21:25:24 ----A---- C:\Windows\SysWOW64\PerfCenterCPL.dll
2011-03-17 21:25:24 ----A---- C:\Windows\SysWOW64\netcenter.dll
2011-03-17 21:25:24 ----A---- C:\Windows\SysWOW64\batmeter.dll
2011-03-17 21:25:23 ----A---- C:\Windows\SysWOW64\zipfldr.dll
2011-03-17 21:25:23 ----A---- C:\Windows\SysWOW64\w32tm.exe
2011-03-17 21:25:23 ----A---- C:\Windows\SysWOW64\spwizeng.dll
2011-03-17 21:25:23 ----A---- C:\Windows\SysWOW64\SndVol.exe
2011-03-17 21:25:23 ----A---- C:\Windows\SysWOW64\azroleui.dll
2011-03-17 21:25:23 ----A---- C:\Windows\SysWOW64\accessibilitycpl.dll
2011-03-17 21:25:22 ----A---- C:\Windows\SysWOW64\netjoin.dll
2011-03-17 21:25:22 ----A---- C:\Windows\SysWOW64\MSAC3ENC.DLL
2011-03-17 21:25:22 ----A---- C:\Windows\SysWOW64\fdeploy.dll
2011-03-17 21:25:22 ----A---- C:\Windows\SysWOW64\cryptui.dll
2011-03-17 21:25:22 ----A---- C:\Windows\SysWOW64\adsldp.dll
2011-03-17 21:25:21 ----A---- C:\Windows\SysWOW64\wusa.exe
2011-03-17 21:25:21 ----A---- C:\Windows\SysWOW64\sud.dll
2011-03-17 21:25:21 ----A---- C:\Windows\SysWOW64\prnfldr.dll
2011-03-17 21:25:21 ----A---- C:\Windows\SysWOW64\OnLineIDCpl.dll
2011-03-17 21:25:21 ----A---- C:\Windows\SysWOW64\networkmap.dll
2011-03-17 21:25:21 ----A---- C:\Windows\SysWOW64\msieftp.dll
2011-03-17 21:25:21 ----A---- C:\Windows\SysWOW64\MCEWMDRMNDBootstrap.dll
2011-03-17 21:25:21 ----A---- C:\Windows\SysWOW64\Faultrep.dll
2011-03-17 21:25:21 ----A---- C:\Windows\SysWOW64\cfgmgr32.dll
2011-03-17 21:25:21 ----A---- C:\Windows\SysWOW64\ActionCenter.dll
2011-03-17 21:25:20 ----A---- C:\Windows\SysWOW64\photowiz.dll
2011-03-17 21:25:20 ----A---- C:\Windows\SysWOW64\MediaMetadataHandler.dll
2011-03-17 21:25:20 ----A---- C:\Windows\SysWOW64\credssp.dll
2011-03-17 21:25:19 ----A---- C:\Windows\SysWOW64\iprtrmgr.dll
2011-03-17 21:25:19 ----A---- C:\Windows\SysWOW64\iasrad.dll
2011-03-17 21:25:18 ----A---- C:\Windows\SysWOW64\ftp.exe
2011-03-17 21:25:18 ----A---- C:\Windows\SysWOW64\dot3cfg.dll
2011-03-17 21:25:18 ----A---- C:\Windows\SysWOW64\defaultlocationcpl.dll
2011-03-17 21:25:17 ----A---- C:\Windows\SysWOW64\sisbkup.dll
2011-03-17 21:25:17 ----A---- C:\Windows\SysWOW64\shwebsvc.dll
2011-03-17 21:25:17 ----A---- C:\Windows\SysWOW64\odbcjt32.dll
2011-03-17 21:25:17 ----A---- C:\Windows\SysWOW64\ifsutil.dll
2011-03-17 21:25:17 ----A---- C:\Windows\SysWOW64\ieUnatt.exe
2011-03-17 21:25:17 ----A---- C:\Windows\SysWOW64\iesysprep.dll
2011-03-17 21:25:17 ----A---- C:\Windows\SysWOW64\efscore.dll
2011-03-17 21:25:17 ----A---- C:\Windows\SysWOW64\ActionCenterCPL.dll
2011-03-17 21:25:16 ----A---- C:\Windows\SysWOW64\syncui.dll
2011-03-17 21:25:16 ----A---- C:\Windows\SysWOW64\autoplay.dll
2011-03-17 21:25:15 ----A---- C:\Windows\SysWOW64\wmpmde.dll
2011-03-17 21:25:15 ----A---- C:\Windows\SysWOW64\systemcpl.dll
2011-03-17 21:25:15 ----A---- C:\Windows\SysWOW64\SmartcardCredentialProvider.dll
2011-03-17 21:25:15 ----A---- C:\Windows\SysWOW64\sethc.exe
2011-03-17 21:25:15 ----A---- C:\Windows\SysWOW64\rtutils.dll
2011-03-17 21:25:15 ----A---- C:\Windows\SysWOW64\riched20.dll
2011-03-17 21:25:15 ----A---- C:\Windows\SysWOW64\OobeFldr.dll
2011-03-17 21:25:15 ----A---- C:\Windows\SysWOW64\ntprint.dll
2011-03-17 21:25:15 ----A---- C:\Windows\SysWOW64\ntlanman.dll
2011-03-17 21:25:15 ----A---- C:\Windows\SysWOW64\nshwfp.dll
2011-03-17 21:25:15 ----A---- C:\Windows\SysWOW64\dskquoui.dll
2011-03-17 21:25:15 ----A---- C:\Windows\SysWOW64\DeviceCenter.dll
2011-03-17 21:25:14 ----A---- C:\Windows\SysWOW64\wmpsrcwp.dll
2011-03-17 21:25:14 ----A---- C:\Windows\SysWOW64\netplwiz.dll
2011-03-17 21:25:14 ----A---- C:\Windows\SysWOW64\NAPHLPR.DLL
2011-03-17 21:25:14 ----A---- C:\Windows\SysWOW64\migisol.dll
2011-03-17 21:25:14 ----A---- C:\Windows\SysWOW64\fms.dll
2011-03-17 21:25:14 ----A---- C:\Windows\SysWOW64\blackbox.dll
2011-03-17 21:25:14 ----A---- C:\Windows\SysWOW64\activeds.dll
2011-03-17 21:25:13 ----A---- C:\Windows\SysWOW64\httpapi.dll
2011-03-17 21:25:13 ----A---- C:\Windows\SysWOW64\cdosys.dll
2011-03-17 21:25:12 ----A---- C:\Windows\SysWOW64\nshipsec.dll
2011-03-17 21:25:12 ----A---- C:\Windows\SysWOW64\nlaapi.dll
2011-03-17 21:25:12 ----A---- C:\Windows\SysWOW64\isoburn.exe
2011-03-17 21:25:12 ----A---- C:\Windows\SysWOW64\asycfilt.dll
2011-03-17 21:25:11 ----A---- C:\Windows\SysWOW64\wuwebv.dll
2011-03-17 21:25:11 ----A---- C:\Windows\SysWOW64\wlanmsm.dll
2011-03-17 21:25:11 ----A---- C:\Windows\SysWOW64\wavemsp.dll
2011-03-17 21:25:11 ----A---- C:\Windows\SysWOW64\ReAgent.dll
2011-03-17 21:25:11 ----A---- C:\Windows\SysWOW64\msftedit.dll
2011-03-17 21:25:10 ----A---- C:\Windows\SysWOW64\provsvc.dll
2011-03-17 21:25:10 ----A---- C:\Windows\SysWOW64\dot3ui.dll
2011-03-17 21:25:10 ----A---- C:\Windows\SysWOW64\dfrgui.exe
2011-03-17 21:25:09 ----A---- C:\Windows\SysWOW64\tzutil.exe
2011-03-17 21:25:09 ----A---- C:\Windows\SysWOW64\ocsetup.exe
2011-03-17 21:25:09 ----A---- C:\Windows\SysWOW64\KernelBase.dll
2011-03-17 21:25:09 ----A---- C:\Windows\SysWOW64\dsuiext.dll
2011-03-17 21:25:08 ----A---- C:\Windows\SysWOW64\wvc.dll
2011-03-17 21:25:08 ----A---- C:\Windows\SysWOW64\wtsapi32.dll
2011-03-17 21:25:08 ----A---- C:\Windows\SysWOW64\wimgapi.dll
2011-03-17 21:25:08 ----A---- C:\Windows\SysWOW64\mstask.dll
2011-03-17 21:25:07 ----A---- C:\Windows\SysWOW64\webcheck.dll
2011-03-17 21:25:07 ----A---- C:\Windows\SysWOW64\twext.dll
2011-03-17 21:25:07 ----A---- C:\Windows\SysWOW64\shdocvw.dll
2011-03-17 21:25:06 ----A---- C:\Windows\twain_32.dll
2011-03-17 21:25:06 ----A---- C:\Windows\SysWOW64\setupugc.exe
2011-03-17 21:25:06 ----A---- C:\Windows\SysWOW64\qcap.dll
2011-03-17 21:25:06 ----A---- C:\Windows\SysWOW64\qasf.dll
2011-03-17 21:25:06 ----A---- C:\Windows\SysWOW64\occache.dll
2011-03-17 21:25:05 ----A---- C:\Windows\SysWOW64\wmdrmsdk.dll
2011-03-17 21:25:05 ----A---- C:\Windows\SysWOW64\uxlib.dll
2011-03-17 21:25:05 ----A---- C:\Windows\SysWOW64\slwga.dll
2011-03-17 21:25:05 ----A---- C:\Windows\SysWOW64\nslookup.exe
2011-03-17 21:25:05 ----A---- C:\Windows\SysWOW64\msvfw32.dll
2011-03-17 21:25:05 ----A---- C:\Windows\SysWOW64\msrating.dll
2011-03-17 21:25:05 ----A---- C:\Windows\SysWOW64\msfeedsbs.dll
2011-03-17 21:25:05 ----A---- C:\Windows\SysWOW64\mciavi32.dll
2011-03-17 21:25:05 ----A---- C:\Windows\SysWOW64\imgutil.dll
2011-03-17 21:25:05 ----A---- C:\Windows\SysWOW64\audiodev.dll
2011-03-17 21:25:04 ----A---- C:\Windows\SysWOW64\WPDShServiceObj.dll
2011-03-17 21:25:04 ----A---- C:\Windows\SysWOW64\wimserv.exe
2011-03-17 21:25:04 ----A---- C:\Windows\SysWOW64\TSpkg.dll
2011-03-17 21:25:04 ----A---- C:\Windows\SysWOW64\rpcrt4.dll
2011-03-17 21:25:04 ----A---- C:\Windows\SysWOW64\rdpencom.dll
2011-03-17 21:25:04 ----A---- C:\Windows\SysWOW64\msscp.dll
2011-03-17 21:25:04 ----A---- C:\Windows\SysWOW64\diskraid.exe
2011-03-17 21:25:04 ----A---- C:\Windows\SysWOW64\DevicePairingFolder.dll
2011-03-17 21:25:04 ----A---- C:\Windows\SysWOW64\clusapi.dll
2011-03-17 21:25:04 ----A---- C:\Windows\SysWOW64\acppage.dll
2011-03-17 21:25:03 ----A---- C:\Windows\SysWOW64\UserAccountControlSettings.dll
2011-03-17 21:25:03 ----A---- C:\Windows\SysWOW64\remotepg.dll
2011-03-17 21:25:03 ----A---- C:\Windows\SysWOW64\raschap.dll
2011-03-17 21:25:03 ----A---- C:\Windows\SysWOW64\QUTIL.DLL
2011-03-17 21:25:03 ----A---- C:\Windows\SysWOW64\perfmon.exe
2011-03-17 21:25:03 ----A---- C:\Windows\SysWOW64\olepro32.dll
2011-03-17 21:25:03 ----A---- C:\Windows\SysWOW64\odbccp32.dll
2011-03-17 21:25:03 ----A---- C:\Windows\SysWOW64\ocsetapi.dll
2011-03-17 21:25:03 ----A---- C:\Windows\SysWOW64\networkexplorer.dll
2011-03-17 21:25:03 ----A---- C:\Windows\SysWOW64\NAPCRYPT.DLL
2011-03-17 21:25:03 ----A---- C:\Windows\SysWOW64\input.dll
2011-03-17 21:25:03 ----A---- C:\Windows\SysWOW64\drmmgrtn.dll
2011-03-17 21:25:03 ----A---- C:\Windows\bfsvc.exe
2011-03-17 21:25:02 ----A---- C:\Windows\SysWOW64\wpdwcn.dll
2011-03-17 21:25:02 ----A---- C:\Windows\SysWOW64\wmpdxm.dll
2011-03-17 21:25:02 ----A---- C:\Windows\SysWOW64\vpnikeapi.dll
2011-03-17 21:25:02 ----A---- C:\Windows\SysWOW64\vdsbas.dll
2011-03-17 21:25:02 ----A---- C:\Windows\SysWOW64\runonce.exe
2011-03-17 21:25:02 ----A---- C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2011-03-17 21:25:02 ----A---- C:\Windows\SysWOW64\onexui.dll
2011-03-17 21:25:02 ----A---- C:\Windows\SysWOW64\logagent.exe
2011-03-17 21:25:02 ----A---- C:\Windows\SysWOW64\iTVData.dll
2011-03-17 21:25:02 ----A---- C:\Windows\SysWOW64\inseng.dll
2011-03-17 21:25:02 ----A---- C:\Windows\SysWOW64\dxdiagn.dll
2011-03-17 21:25:01 ----A---- C:\Windows\SysWOW64\wudriver.dll
2011-03-17 21:25:01 ----A---- C:\Windows\SysWOW64\wmpshell.dll
2011-03-17 21:25:01 ----A---- C:\Windows\SysWOW64\wmdrmdev.dll
2011-03-17 21:25:01 ----A---- C:\Windows\SysWOW64\unimdmat.dll
2011-03-17 21:25:01 ----A---- C:\Windows\SysWOW64\shacct.dll
2011-03-17 21:25:01 ----A---- C:\Windows\SysWOW64\msvidc32.dll
2011-03-17 21:25:01 ----A---- C:\Windows\SysWOW64\msiexec.exe
2011-03-17 21:25:01 ----A---- C:\Windows\SysWOW64\MFPlay.dll
2011-03-17 21:25:01 ----A---- C:\Windows\SysWOW64\lsmproxy.dll
2011-03-17 21:25:01 ----A---- C:\Windows\SysWOW64\eapp3hst.dll
2011-03-17 21:25:01 ----A---- C:\Windows\SysWOW64\d3d10level9.dll
2011-03-17 21:25:01 ----A---- C:\Windows\SysWOW64\bitsadmin.exe
2011-03-17 21:25:00 ----A---- C:\Windows\SysWOW64\sqlcese30.dll
2011-03-17 21:25:00 ----A---- C:\Windows\SysWOW64\rdpd3d.dll
2011-03-17 21:25:00 ----A---- C:\Windows\SysWOW64\mprapi.dll
2011-03-17 21:25:00 ----A---- C:\Windows\SysWOW64\iscsium.dll
2011-03-17 21:24:59 ----A---- C:\Windows\SysWOW64\WPDSp.dll
2011-03-17 21:24:59 ----A---- C:\Windows\SysWOW64\srvcli.dll
2011-03-17 21:24:59 ----A---- C:\Windows\SysWOW64\QSVRMGMT.DLL
2011-03-17 21:24:59 ----A---- C:\Windows\SysWOW64\PortableDeviceSyncProvider.dll
2011-03-17 21:24:59 ----A---- C:\Windows\SysWOW64\PortableDeviceStatus.dll
2011-03-17 21:24:59 ----A---- C:\Windows\SysWOW64\pdh.dll
2011-03-17 21:24:59 ----A---- C:\Windows\SysWOW64\OpcServices.dll
2011-03-17 21:24:59 ----A---- C:\Windows\SysWOW64\olethk32.dll
2011-03-17 21:24:59 ----A---- C:\Windows\SysWOW64\odbctrac.dll
2011-03-17 21:24:59 ----A---- C:\Windows\SysWOW64\ncryptui.dll
2011-03-17 21:24:59 ----A---- C:\Windows\SysWOW64\logman.exe
2011-03-17 21:24:59 ----A---- C:\Windows\SysWOW64\cscapi.dll
2011-03-17 21:24:58 ----A---- C:\Windows\SysWOW64\tsgqec.dll
2011-03-17 21:24:57 ----A---- C:\Windows\SysWOW64\WMPhoto.dll
2011-03-17 21:24:57 ----A---- C:\Windows\SysWOW64\WMADMOD.DLL
2011-03-17 21:24:57 ----A---- C:\Windows\SysWOW64\wiavideo.dll
2011-03-17 21:24:57 ----A---- C:\Windows\SysWOW64\utildll.dll
2011-03-17 21:24:57 ----A---- C:\Windows\SysWOW64\takeown.exe
2011-03-17 21:24:57 ----A---- C:\Windows\SysWOW64\mshtmled.dll
2011-03-17 21:24:57 ----A---- C:\Windows\SysWOW64\mapistub.dll
2011-03-17 21:24:57 ----A---- C:\Windows\SysWOW64\mapi32.dll
2011-03-17 21:24:57 ----A---- C:\Windows\SysWOW64\fphc.dll
2011-03-17 21:24:57 ----A---- C:\Windows\SysWOW64\dot3msm.dll
2011-03-17 21:24:57 ----A---- C:\Windows\SysWOW64\avifil32.dll
2011-03-17 21:24:56 ----A---- C:\Windows\SysWOW64\WMVSDECD.DLL
2011-03-17 21:24:56 ----A---- C:\Windows\SysWOW64\wmdrmnet.dll
2011-03-17 21:24:56 ----A---- C:\Windows\SysWOW64\sqmapi.dll
2011-03-17 21:24:56 ----A---- C:\Windows\SysWOW64\iyuv_32.dll
2011-03-17 21:24:56 ----A---- C:\Windows\SysWOW64\imagehlp.dll
2011-03-17 21:24:55 ----A---- C:\Windows\SysWOW64\wsnmp32.dll
2011-03-17 21:24:55 ----A---- C:\Windows\SysWOW64\WMSPDMOD.DLL
2011-03-17 21:24:55 ----A---- C:\Windows\SysWOW64\vfwwdm32.dll
2011-03-17 21:24:55 ----A---- C:\Windows\SysWOW64\sspicli.dll
2011-03-17 21:24:55 ----A---- C:\Windows\SysWOW64\sppinst.dll
2011-03-17 21:24:55 ----A---- C:\Windows\SysWOW64\qdv.dll
2011-03-17 21:24:55 ----A---- C:\Windows\SysWOW64\QCLIPROV.DLL
2011-03-17 21:24:55 ----A---- C:\Windows\SysWOW64\pdhui.dll
2011-03-17 21:24:55 ----A---- C:\Windows\SysWOW64\MuiUnattend.exe
2011-03-17 21:24:55 ----A---- C:\Windows\SysWOW64\msyuv.dll
2011-03-17 21:24:55 ----A---- C:\Windows\SysWOW64\msrle32.dll
2011-03-17 21:24:55 ----A---- C:\Windows\SysWOW64\msnetobj.dll
2011-03-17 21:24:55 ----A---- C:\Windows\SysWOW64\EhStorAPI.dll
2011-03-17 21:24:55 ----A---- C:\Windows\SysWOW64\cmstp.exe
2011-03-17 21:24:55 ----A---- C:\Windows\SysWOW64\cca.dll
2011-03-17 21:24:54 ----A---- C:\Windows\SysWOW64\tsbyuv.dll
2011-03-17 21:24:54 ----A---- C:\Windows\SysWOW64\setupcln.dll
2011-03-17 21:24:54 ----A---- C:\Windows\SysWOW64\relog.exe
2011-03-17 21:24:54 ----A---- C:\Windows\SysWOW64\netiougc.exe
2011-03-17 21:24:54 ----A---- C:\Windows\SysWOW64\msorcl32.dll
2011-03-17 21:24:54 ----A---- C:\Windows\SysWOW64\iscsicli.exe
2011-03-17 21:24:54 ----A---- C:\Windows\SysWOW64\iasrecst.dll
2011-03-17 21:24:54 ----A---- C:\Windows\SysWOW64\AzSqlExt.dll
2011-03-17 21:24:53 ----A---- C:\Windows\SysWOW64\wmpps.dll
2011-03-17 21:24:53 ----A---- C:\Windows\SysWOW64\wkscli.dll
2011-03-17 21:24:53 ----A---- C:\Windows\SysWOW64\syssetup.dll
2011-03-17 21:24:53 ----A---- C:\Windows\SysWOW64\spbcd.dll
2011-03-17 21:24:53 ----A---- C:\Windows\SysWOW64\secproc_ssp_isv.dll
2011-03-17 21:24:53 ----A---- C:\Windows\SysWOW64\secproc_ssp.dll
2011-03-17 21:24:53 ----A---- C:\Windows\SysWOW64\resutils.dll
2011-03-17 21:24:53 ----A---- C:\Windows\SysWOW64\rastapi.dll
2011-03-17 21:24:53 ----A---- C:\Windows\SysWOW64\netbtugc.exe
2011-03-17 21:24:53 ----A---- C:\Windows\SysWOW64\mydocs.dll
2011-03-17 21:24:53 ----A---- C:\Windows\SysWOW64\itircl.dll
2011-03-17 21:24:53 ----A---- C:\Windows\SysWOW64\diskpart.exe
2011-03-17 21:24:53 ----A---- C:\Windows\SysWOW64\CertPolEng.dll
2011-03-17 21:24:53 ----A---- C:\Windows\SysWOW64\amstream.dll
2011-03-17 21:24:52 ----A---- C:\Windows\SysWOW64\wuapp.exe
2011-03-17 21:24:52 ----A---- C:\Windows\SysWOW64\WerFaultSecure.exe
2011-03-17 21:24:52 ----A---- C:\Windows\SysWOW64\tlscsp.dll
2011-03-17 21:24:52 ----A---- C:\Windows\SysWOW64\secur32.dll
2011-03-17 21:24:52 ----A---- C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2011-03-17 21:24:52 ----A---- C:\Windows\SysWOW64\RMActivate_ssp.exe
2011-03-17 21:24:52 ----A---- C:\Windows\SysWOW64\ReAgentc.exe
2011-03-17 21:24:52 ----A---- C:\Windows\SysWOW64\netutils.dll
2011-03-17 21:24:52 ----A---- C:\Windows\SysWOW64\findstr.exe
2011-03-17 21:24:52 ----A---- C:\Windows\SysWOW64\eappgnui.dll
2011-03-17 21:24:51 ----A---- C:\Windows\SysWOW64\unlodctr.exe
2011-03-17 21:24:51 ----A---- C:\Windows\SysWOW64\sppc.dll
2011-03-17 21:24:51 ----A---- C:\Windows\SysWOW64\spopk.dll
2011-03-17 21:24:51 ----A---- C:\Windows\SysWOW64\shimgvw.dll
2011-03-17 21:24:51 ----A---- C:\Windows\SysWOW64\prevhost.exe
2011-03-17 21:24:51 ----A---- C:\Windows\SysWOW64\netapi32.dll
2011-03-17 21:24:51 ----A---- C:\Windows\SysWOW64\muifontsetup.dll
2011-03-17 21:24:51 ----A---- C:\Windows\SysWOW64\msdmo.dll
2011-03-17 21:24:51 ----A---- C:\Windows\SysWOW64\mobsync.exe
2011-03-17 21:24:51 ----A---- C:\Windows\SysWOW64\mciqtz32.dll
2011-03-17 21:24:51 ----A---- C:\Windows\SysWOW64\luainstall.dll
2011-03-17 21:24:51 ----A---- C:\Windows\SysWOW64\iccvid.dll
2011-03-17 21:24:51 ----A---- C:\Windows\SysWOW64\dnscacheugc.exe
2011-03-17 21:24:51 ----A---- C:\Windows\SysWOW64\cabinet.dll
2011-03-17 21:24:50 ----A---- C:\Windows\SysWOW64\rdprefdrvapi.dll
2011-03-17 21:24:49 ----A---- C:\Windows\SysWOW64\wups.dll
2011-03-17 21:24:49 ----A---- C:\Windows\SysWOW64\UIRibbonRes.dll
2011-03-17 21:24:49 ----A---- C:\Windows\SysWOW64\perfts.dll
2011-03-17 21:24:49 ----A---- C:\Windows\SysWOW64\odbcconf.dll
2011-03-17 21:24:49 ----A---- C:\Windows\SysWOW64\inetmib1.dll
2011-03-17 21:24:49 ----A---- C:\Windows\SysWOW64\imm32.dll
2011-03-17 21:24:49 ----A---- C:\Windows\SysWOW64\browcli.dll
2011-03-17 21:24:48 ----A---- C:\Windows\SysWOW64\TRAPI.dll
2011-03-17 21:24:48 ----A---- C:\Windows\SysWOW64\msfeedssync.exe
2011-03-17 21:24:48 ----A---- C:\Windows\SysWOW64\elsTrans.dll
2011-03-17 21:24:47 ----A---- C:\Windows\SysWOW64\wshbth.dll
2011-03-17 21:24:47 ----A---- C:\Windows\SysWOW64\sscore.dll
2011-03-17 21:24:47 ----A---- C:\Windows\SysWOW64\schedcli.dll
2011-03-17 21:24:47 ----A---- C:\Windows\SysWOW64\napdsnap.dll
2011-03-17 21:24:47 ----A---- C:\Windows\SysWOW64\dsauth.dll
2011-03-17 21:24:47 ----A---- C:\Windows\SysWOW64\cscdll.dll
2011-03-17 21:24:47 ----A---- C:\Windows\SysWOW64\bitsperf.dll
2011-03-17 21:24:46 ----A---- C:\Windows\SysWOW64\wsdchngr.dll
2011-03-17 21:24:46 ----A---- C:\Windows\SysWOW64\shgina.dll
2011-03-17 21:24:46 ----A---- C:\Windows\SysWOW64\riched32.dll
2011-03-17 21:24:45 ----A---- C:\Windows\SysWOW64\wshirda.dll
2011-03-17 21:24:44 ----A---- C:\Windows\SysWOW64\spwmp.dll
2011-03-17 21:24:44 ----A---- C:\Windows\SysWOW64\browseui.dll
2011-03-17 21:24:43 ----A---- C:\Windows\SysWOW64\wmploc.DLL
2011-03-17 21:24:43 ----A---- C:\Windows\SysWOW64\shunimpl.dll
2011-03-17 21:24:43 ----A---- C:\Windows\SysWOW64\KBDTUQ.DLL
2011-03-17 21:24:43 ----A---- C:\Windows\SysWOW64\KBDTUF.DLL
2011-03-17 21:24:43 ----A---- C:\Windows\SysWOW64\KBDSG.DLL
2011-03-17 21:24:43 ----A---- C:\Windows\SysWOW64\kbdlk41a.dll
2011-03-17 21:24:43 ----A---- C:\Windows\SysWOW64\KBDGR1.DLL
2011-03-17 21:24:43 ----A---- C:\Windows\SysWOW64\KBDGKL.DLL
2011-03-17 21:24:43 ----A---- C:\Windows\SysWOW64\dxmasf.dll
2011-03-17 21:24:43 ----A---- C:\Windows\SysWOW64\C_ISCII.DLL
2011-03-17 21:24:42 ----A---- C:\Windows\SysWOW64\tzres.dll
2011-03-17 21:24:42 ----A---- C:\Windows\SysWOW64\KBDUS.DLL
2011-03-17 21:24:42 ----A---- C:\Windows\SysWOW64\KBDUGHR1.DLL
2011-03-17 21:24:42 ----A---- C:\Windows\SysWOW64\KBDTURME.DLL
2011-03-17 21:24:42 ----A---- C:\Windows\SysWOW64\KBDTAJIK.DLL
2011-03-17 21:24:42 ----A---- C:\Windows\SysWOW64\KBDSF.DLL
2011-03-17 21:24:42 ----A---- C:\Windows\SysWOW64\KBDPO.DLL
2011-03-17 21:24:42 ----A---- C:\Windows\SysWOW64\KBDNEPR.DLL
2011-03-17 21:24:42 ----A---- C:\Windows\SysWOW64\KBDMON.DLL
2011-03-17 21:24:42 ----A---- C:\Windows\SysWOW64\KBDMAORI.DLL
2011-03-17 21:24:42 ----A---- C:\Windows\SysWOW64\KBDLT1.DLL
2011-03-17 21:24:42 ----A---- C:\Windows\SysWOW64\KBDINTEL.DLL
2011-03-17 21:24:42 ----A---- C:\Windows\SysWOW64\KBDINTAM.DLL
2011-03-17 21:24:42 ----A---- C:\Windows\SysWOW64\KBDINORI.DLL
2011-03-17 21:24:42 ----A---- C:\Windows\SysWOW64\KBDINMAR.DLL
2011-03-17 21:24:42 ----A---- C:\Windows\SysWOW64\KBDINKAN.DLL
2011-03-17 21:24:42 ----A---- C:\Windows\SysWOW64\KBDINHIN.DLL
2011-03-17 21:24:42 ----A---- C:\Windows\SysWOW64\KBDINBEN.DLL
2011-03-17 21:24:42 ----A---- C:\Windows\SysWOW64\KBDGEO.DLL
2011-03-17 21:24:42 ----A---- C:\Windows\SysWOW64\KBDCZ1.DLL
2011-03-17 21:24:42 ----A---- C:\Windows\SysWOW64\KBDBULG.DLL
2011-03-17 21:24:42 ----A---- C:\Windows\SysWOW64\KBDBLR.DLL
2011-03-17 21:24:42 ----A---- C:\Windows\SysWOW64\KBDBASH.DLL
2011-03-17 21:24:42 ----A---- C:\Windows\SysWOW64\dpnaddr.dll
2011-03-17 21:24:41 ----A---- C:\Windows\SysWOW64\nlsbres.dll
2011-03-17 21:24:40 ----A---- C:\Windows\SysWOW64\spwizres.dll
2011-03-17 21:24:40 ----A---- C:\Windows\SysWOW64\pifmgr.dll
2011-03-17 21:24:21 ----A---- C:\Windows\SysWOW64\wdscore.dll
2011-03-17 21:24:21 ----A---- C:\Windows\SysWOW64\PkgMgr.exe
2011-03-17 21:24:16 ----A---- C:\Windows\SysWOW64\drvstore.dll
2011-03-17 21:24:16 ----A---- C:\Windows\SysWOW64\dpx.dll
2011-03-17 21:24:14 ----A---- C:\Windows\SysWOW64\wbemcomn.dll
2011-03-17 21:02:24 ----A---- C:\Windows\SysWOW64\DWrite.dll
2011-03-17 21:02:23 ----A---- C:\Windows\SysWOW64\d2d1.dll
2011-03-17 13:09:07 ----D---- C:\Windows\Minidump
2011-03-17 12:43:27 ----A---- C:\Windows\SysWOW64\PerfStringBackup.INI
2011-03-17 12:43:26 ----D---- C:\Program Files (x86)\Microsoft Security Client
2011-03-14 20:42:20 ----D---- C:\Program Files (x86)\T-Mobile
2011-03-14 20:41:47 ----D---- C:\Program Files (x86)\ZTE
2011-03-13 18:44:48 ----A---- C:\Windows\SysWOW64\sbe.dll
2011-03-13 18:44:48 ----A---- C:\Windows\SysWOW64\EncDec.dll
2011-03-13 18:44:48 ----A---- C:\Windows\SysWOW64\CPFilters.dll
2011-02-26 17:12:15 ----D---- C:\Program Files (x86)\Common Files\Sonic Shared
2011-02-26 17:12:15 ----D---- C:\Program Files (x86)\Common Files\muvee Technologies
2011-02-26 17:11:25 ----RA---- C:\Windows\SysWOW64\msvcr80.dll
2011-02-26 17:11:25 ----RA---- C:\Windows\SysWOW64\msvcp80.dll
2011-02-26 17:11:25 ----RA---- C:\Windows\SysWOW64\atl80.dll
2011-02-26 17:09:43 ----D---- C:\Program Files (x86)\QuickTime
2011-02-26 17:09:35 ----D---- C:\ProgramData\Apple Computer
2011-02-26 17:08:47 ----D---- C:\Program Files (x86)\OLYMPUS
2011-02-26 17:06:59 ----D---- C:\Program Files (x86)\MSXML 4.0
2011-02-25 18:38:56 ----D---- C:\Windows\cs
2011-02-25 18:34:48 ----A---- C:\Windows\SysWOW64\XAudio2_5.dll
2011-02-25 18:34:48 ----A---- C:\Windows\SysWOW64\XAPOFX1_3.dll
2011-02-25 18:34:47 ----A---- C:\Windows\SysWOW64\d3dx10_42.dll
2011-02-23 12:49:00 ----A---- C:\Windows\SysWOW64\XpsPrint.dll
2011-02-23 12:49:00 ----A---- C:\Windows\SysWOW64\XpsGdiConverter.dll

======List of files/folders modified in the last 1 months======

2011-03-20 22:38:55 ----D---- C:\Windows\tracing
2011-03-20 22:38:16 ----D---- C:\Users\Dan\AppData\Roaming\Skype
2011-03-20 22:37:06 ----D---- C:\Windows\Temp
2011-03-20 22:25:29 ----D---- C:\Windows\Prefetch
2011-03-20 22:22:21 ----D---- C:\Windows\System32
2011-03-20 22:22:21 ----D---- C:\Windows\inf
2011-03-20 22:16:16 ----RD---- C:\Program Files
2011-03-20 22:01:55 ----RD---- C:\Program Files (x86)
2011-03-20 21:18:42 ----HD---- C:\ProgramData
2011-03-20 11:14:48 ----D---- C:\Windows
2011-03-19 23:37:34 ----D---- C:\Users\Dan\AppData\Roaming\Adobe
2011-03-18 13:36:27 ----D---- C:\Windows\rescache
2011-03-18 08:17:04 ----D---- C:\Windows\Microsoft.NET
2011-03-18 08:16:55 ----RSD---- C:\Windows\assembly
2011-03-18 08:08:53 ----SHD---- C:\Windows\Installer
2011-03-18 08:07:57 ----SD---- C:\ProgramData\Microsoft
2011-03-18 08:07:09 ----SHD---- C:\System Volume Information
2011-03-17 22:15:50 ----D---- C:\Windows\SysWOW64
2011-03-17 22:15:41 ----D---- C:\Windows\winsxs
2011-03-17 22:09:30 ----D---- C:\Program Files (x86)\Windows Sidebar
2011-03-17 22:09:30 ----D---- C:\Program Files (x86)\Windows Portable Devices
2011-03-17 22:09:30 ----D---- C:\Program Files (x86)\Windows Media Player
2011-03-17 22:09:30 ----D---- C:\Program Files (x86)\Windows Mail
2011-03-17 22:09:30 ----D---- C:\Program Files (x86)\Internet Explorer
2011-03-17 22:09:29 ----D---- C:\Program Files (x86)\Windows Photo Viewer
2011-03-17 22:09:21 ----D---- C:\Windows\servicing
2011-03-17 22:09:21 ----D---- C:\Windows\ehome
2011-03-17 22:09:10 ----D---- C:\Windows\SysWOW64\Setup
2011-03-17 22:09:10 ----D---- C:\Windows\SysWOW64\oobe
2011-03-17 22:09:10 ----D---- C:\Windows\SysWOW64\migration
2011-03-17 22:09:10 ----D---- C:\Windows\SysWOW64\da-DK
2011-03-17 22:09:10 ----D---- C:\Windows\SysWOW64\cs
2011-03-17 22:09:10 ----D---- C:\Windows\SysWOW64\AdvancedInstallers
2011-03-17 22:09:09 ----D---- C:\Windows\SysWOW64\cs-CZ
2011-03-17 22:09:06 ----D---- C:\Windows\SysWOW64\wbem
2011-03-17 22:09:06 ----D---- C:\Windows\SysWOW64\sppui
2011-03-17 22:09:06 ----D---- C:\Windows\SysWOW64\manifeststore
2011-03-17 22:09:06 ----D---- C:\Windows\SysWOW64\es-ES
2011-03-17 22:09:05 ----D---- C:\Windows\SysWOW64\migwiz
2011-03-17 22:09:05 ----D---- C:\Windows\SysWOW64\Dism
2011-03-17 22:08:48 ----D---- C:\Windows\PolicyDefinitions
2011-03-17 22:08:28 ----RSD---- C:\Windows\Fonts
2011-03-17 22:08:27 ----D---- C:\Windows\AppPatch
2011-03-17 21:42:22 ----A---- C:\Windows\SysWOW64\msclmd.dll
2011-03-17 12:38:35 ----D---- C:\ProgramData\McAfee
2011-03-17 12:38:35 ----D---- C:\Program Files (x86)\McAfee
2011-03-17 12:38:35 ----D---- C:\Program Files (x86)\Common Files
2011-03-14 20:44:23 ----SD---- C:\Users\Dan\AppData\Roaming\Microsoft
2011-03-14 20:42:47 ----D---- C:\Windows\ModemLogs
2011-03-13 20:47:01 ----D---- C:\Windows\debug
2011-03-06 16:08:03 ----D---- C:\ProgramData\Partner
2011-02-25 18:39:00 ----D---- C:\Program Files (x86)\Windows Live
2011-02-25 18:35:40 ----D---- C:\Program Files (x86)\Common Files\microsoft shared
2011-02-25 18:34:37 ----D---- C:\Windows\Logs
2011-02-25 18:18:03 ----D---- C:\Program Files (x86)\Microsoft Silverlight

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iaStor;Intel AHCI Controller; C:\Windows\system32\DRIVERS\iaStor.sys []
R0 PxHlpa64;PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys []
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys []
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys []
R1 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys []
R1 mwlPSDFilter;mwlPSDFilter; C:\Windows\system32\DRIVERS\mwlPSDFilter.sys []
R1 mwlPSDNServ;mwlPSDNServ; C:\Windows\system32\DRIVERS\mwlPSDNServ.sys []
R1 mwlPSDVDisk;mwlPSDVDisk; C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys []
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys []
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athrx.sys []
R3 ETD;ELAN PS/2 Port Input Device; C:\Windows\system32\DRIVERS\ETD.sys []
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys []
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys []
R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI; C:\Windows\system32\drivers\IntcHdmi.sys []
R3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\k57nd60a.sys []
R3 MpNWMon;Microsoft Malware Protection Network Driver; C:\Windows\system32\DRIVERS\MpNWMon.sys []
R3 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys []
R3 NTIDrvr;NTIDrvr; \??\C:\Windows\system32\drivers\NTIDrvr.sys []
R3 UBHelper;UBHelper; \??\C:\Windows\system32\drivers\UBHelper.sys []
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys []
R3 ZTEusbmdm6k;ZTE Proprietary USB Driver; C:\Windows\system32\DRIVERS\ZTEusbmdm6k.sys []
R3 ZTEusbnmea;ZTE NMEA Port; C:\Windows\system32\DRIVERS\ZTEusbnmea.sys []
R3 ZTEusbser6k;ZTE Diagnostic Port; C:\Windows\system32\DRIVERS\ZTEusbser6k.sys []
S3 fssfltr;FssFltr; C:\Windows\system32\DRIVERS\fssfltr.sys []
S3 massfilter;Mass Storage Filter Driver; C:\Windows\system32\drivers\massfilter.sys []
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys []
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader; C:\Windows\System32\Drivers\RtsUStor.sys []
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ameisvc;Web'n'walk Manager mobile equipment installation service; C:\Program Files (x86)\T-Mobile\Web'n'walk Manager\ameisvc.exe [2010-06-03 122096]
R2 DsiWMIService;Dritek WMI Service; C:\Program Files (x86)\Launch Manager\dsiwmis.exe [2010-06-22 321104]
R2 ePowerSvc;Acer ePower Service; C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe [2010-06-11 868896]
R2 GREGService;GREGService; C:\Program Files (x86)\Acer\Registration\GREGsvc.exe [2010-01-08 23584]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology; C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-04-13 13336]
R2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe [2010-11-11 12784]
R2 NOBU;Norton Online Backup; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2010-06-01 2804568]
R2 NTI IScheduleSvc;NTI IScheduleSvc; C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2010-06-28 255744]
R2 SeaPort;SeaPort; C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE [2011-02-25 249648]
R2 Updater Service;Updater Service; C:\Program Files\Acer\Acer Updater\UpdaterService.exe [2010-01-29 243232]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2010-09-21 2286976]
R3 NisSrv;@c:\Program Files\Microsoft Security Client\Antimalware\MpAsDesc.dll,-243; c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 282616]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-02-11 135664]
S3 BBSvc;Bing Bar Update Service; C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-02-28 183560]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2010-07-16 655624]
S3 fsssvc;Windows Live Family Safety Service; C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2010-09-23 1493352]
S3 gusvc;Google Software Updater; C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe [2010-07-16 182768]
S3 MWLService;MyWinLocker Service; C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [2010-05-27 305520]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe []
S4 wlcrasvc;Windows Live Mesh remote connections service; C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]

-----------------EOF-----------------

ComboFix 11-03-19.04 - Dan 20.03.2011 23:15:20.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.1978.980 [GMT 1:00]
Spuštěný z: c:\users\Dan\Downloads\ComboFix.exe
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\FullRemove.exe
c:\users\Dan\AppData\Local\Temp\{4C7B2AD0-F500-4185-A4E7-E1C429FB9D73}\eppmanifest.dll
c:\users\Dan\AppData\Local\Temp\{4C7B2AD0-F500-4185-A4E7-E1C429FB9D73}\setup.exe
c:\users\Dan\AppData\Local\Temp\{4C7B2AD0-F500-4185-A4E7-E1C429FB9D73}\sqmapi.dll
c:\users\Dan\AppData\Roaming\Best Malware Protection
c:\users\Dan\AppData\Roaming\Best Malware Protection\Instructions.ini
c:\users\Dan\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Best Malware Protection.lnk
c:\users\Dan\AppData\Roaming\Microsoft\Windows\Recent\CLSV.tmp
c:\users\Dan\AppData\Roaming\Microsoft\Windows\Recent\delfile.dll
c:\users\Dan\AppData\Roaming\Microsoft\Windows\Recent\dudl.dll
c:\users\Dan\AppData\Roaming\Microsoft\Windows\Recent\dudl.tmp
c:\users\Dan\AppData\Roaming\Microsoft\Windows\Recent\eb.exe
c:\users\Dan\AppData\Roaming\Microsoft\Windows\Recent\eb.sys
c:\users\Dan\AppData\Roaming\Microsoft\Windows\Recent\energy.sys
c:\users\Dan\AppData\Roaming\Microsoft\Windows\Recent\exec.tmp
c:\users\Dan\AppData\Roaming\Microsoft\Windows\Recent\fix.dll
c:\users\Dan\AppData\Roaming\Microsoft\Windows\Recent\PE.dll
c:\users\Dan\AppData\Roaming\Microsoft\Windows\Recent\PE.tmp
c:\users\Dan\AppData\Roaming\Microsoft\Windows\Recent\ppal.tmp
c:\users\Dan\AppData\Roaming\Microsoft\Windows\Recent\SICKBOY.drv
c:\users\Dan\AppData\Roaming\Microsoft\Windows\Recent\SICKBOY.sys
c:\users\Dan\AppData\Roaming\Microsoft\Windows\Recent\sld.drv
c:\users\Dan\AppData\Roaming\Microsoft\Windows\Recent\sld.sys
c:\users\Dan\AppData\Roaming\Microsoft\Windows\Recent\std.dll
c:\users\Dan\AppData\Roaming\Microsoft\Windows\Recent\std.drv
c:\users\Dan\AppData\Roaming\Microsoft\Windows\Recent\tjd.sys
c:\users\Dan\AppData\Roaming\Microsoft\Windows\Recent\tjd.tmp
c:\users\Dan\AppData\Roaming\Microsoft\Windows\Start Menu\Best Malware Protection.lnk
c:\users\Dan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Best Malware Protection.lnk
c:\users\Dan\Desktop\Best Malware Protection.lnk
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-02-20 do 2011-03-20 )))))))))))))))))))))))))))))))
.
.
2011-03-20 22:21 . 2011-03-20 22:21 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-03-20 21:16 . 2011-03-20 21:24 -------- d-----w- c:\program files\trend micro
2011-03-20 21:01 . 2011-03-20 21:39 -------- d-----w- c:\program files (x86)\trend micro
2011-03-20 21:01 . 2011-03-20 21:24 -------- d-----w- C:\rsit
2011-03-20 20:18 . 2011-03-20 20:18 -------- d-sh--w- c:\programdata\BMSZP
2011-03-20 20:09 . 2011-03-20 21:18 -------- d-sh--w- c:\programdata\836ed1
2011-03-18 07:07 . 2011-03-18 07:07 -------- d-----w- c:\program files (x86)\Microsoft
2011-03-17 20:32 . 2011-03-17 20:32 -------- d-----w- c:\windows\system32\SPReview
2011-03-17 20:29 . 2011-03-17 20:29 -------- d-----w- c:\windows\system32\EventProviders
2011-03-17 20:27 . 2010-11-05 01:57 48976 ----a-w- c:\windows\system32\netfxperf.dll
2011-03-17 20:27 . 2010-11-05 01:57 1942856 ----a-w- c:\windows\system32\dfshim.dll
2011-03-17 20:25 . 2010-11-20 13:27 303616 ----a-w- c:\windows\system32\scansetting.dll
2011-03-17 20:24 . 2010-11-20 13:27 78848 ----a-w- c:\windows\system32\spbcd.dll
2011-03-17 20:22 . 2010-11-20 13:27 524288 ----a-w- c:\windows\system32\wmicmiplugin.dll
2011-03-17 20:22 . 2010-11-20 13:27 529408 ----a-w- c:\windows\system32\wbemcomn.dll
2011-03-17 20:22 . 2010-11-20 13:27 1225216 ----a-w- c:\windows\system32\wbem\wbemcore.dll
2011-03-17 20:22 . 2010-11-20 13:27 933376 ----a-w- c:\windows\system32\SmiEngine.dll
2011-03-17 20:21 . 2010-11-20 13:25 199168 ----a-w- c:\windows\system32\PkgMgr.exe
2011-03-17 20:21 . 2010-11-20 13:26 422912 ----a-w- c:\windows\system32\drvstore.dll
2011-03-17 20:21 . 2010-11-20 13:26 399872 ----a-w- c:\windows\system32\dpx.dll
2011-03-17 20:02 . 2011-02-19 12:05 1139200 ----a-w- c:\windows\system32\FntCache.dll
2011-03-17 20:02 . 2011-02-19 12:04 1544192 ----a-w- c:\windows\system32\DWrite.dll
2011-03-17 20:02 . 2011-02-19 06:30 1076736 ----a-w- c:\windows\SysWow64\DWrite.dll
2011-03-17 20:02 . 2011-02-19 12:04 902656 ----a-w- c:\windows\system32\d2d1.dll
2011-03-17 20:02 . 2011-02-19 06:30 739840 ----a-w- c:\windows\SysWow64\d2d1.dll
2011-03-17 13:47 . 2011-02-23 09:34 7947600 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{AACC3A4D-D30E-487E-AB74-A0E3537AF097}\mpengine.dll
2011-03-17 13:47 . 2010-10-19 20:51 270720 ------w- c:\windows\system32\MpSigStub.exe
2011-03-14 19:42 . 2011-03-14 19:42 -------- d-----w- c:\program files (x86)\T-Mobile
2011-03-14 19:41 . 2010-03-02 12:59 121344 ----a-w- c:\windows\system32\drivers\ZTEusbser6k.sys
2011-03-14 19:41 . 2010-03-02 12:59 121344 ----a-w- c:\windows\system32\drivers\ZTEusbnmea.sys
2011-03-14 19:41 . 2010-03-02 12:59 121344 ----a-w- c:\windows\system32\drivers\ZTEusbmdm6k.sys
2011-03-14 19:41 . 2010-02-22 08:09 11776 ----a-w- c:\windows\system32\drivers\massfilter.sys
2011-03-14 19:41 . 2011-03-14 19:41 -------- d-----w- c:\program files (x86)\ZTE
2011-03-13 17:44 . 2010-12-23 10:42 1118720 ----a-w- c:\windows\system32\sbe.dll
2011-03-13 17:44 . 2010-12-23 10:42 961024 ----a-w- c:\windows\system32\CPFilters.dll
2011-03-13 17:44 . 2010-12-23 10:42 723968 ----a-w- c:\windows\system32\EncDec.dll
2011-03-13 17:44 . 2010-12-23 10:36 259072 ----a-w- c:\windows\system32\mpg2splt.ax
2011-03-13 17:44 . 2010-12-23 05:54 850944 ----a-w- c:\windows\SysWow64\sbe.dll
2011-03-13 17:44 . 2010-12-23 05:54 642048 ----a-w- c:\windows\SysWow64\CPFilters.dll
2011-03-13 17:44 . 2010-12-23 05:54 534528 ----a-w- c:\windows\SysWow64\EncDec.dll
2011-03-13 17:44 . 2010-12-23 05:50 199680 ----a-w- c:\windows\SysWow64\mpg2splt.ax
2011-02-26 16:12 . 2006-07-24 02:00 52664 ------w- c:\windows\system32\drivers\PxHlpa64.sys
2011-02-26 16:12 . 2006-07-24 02:00 3584 ------w- c:\windows\system32\drivers\cdralw2k.sys
2011-02-26 16:12 . 2006-07-24 02:00 3584 ------w- c:\windows\system32\drivers\cdr4_xp.sys
2011-02-26 16:12 . 2011-02-26 16:12 -------- d-----w- c:\program files (x86)\Common Files\Sonic Shared
2011-02-26 16:12 . 2011-02-26 16:12 -------- d-----w- c:\program files (x86)\Common Files\muvee Technologies
2011-02-26 16:11 . 2007-02-09 04:30 95744 ----a-r- c:\windows\SysWow64\atl80.dll
2011-02-26 16:11 . 2007-02-09 04:30 626688 ----a-r- c:\windows\SysWow64\msvcr80.dll
2011-02-26 16:11 . 2007-02-09 04:30 548864 ----a-r- c:\windows\SysWow64\msvcp80.dll
2011-02-26 16:10 . 2011-02-26 16:10 131072 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin7.dll
2011-02-26 16:10 . 2011-02-26 16:10 131072 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin6.dll
2011-02-26 16:10 . 2011-02-26 16:10 131072 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin5.dll
2011-02-26 16:10 . 2011-02-26 16:10 131072 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin4.dll
2011-02-26 16:10 . 2011-02-26 16:10 131072 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin3.dll
2011-02-26 16:10 . 2011-02-26 16:10 131072 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin2.dll
2011-02-26 16:10 . 2011-02-26 16:10 131072 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin.dll
2011-02-26 16:09 . 2011-02-26 16:10 -------- d-----w- c:\program files (x86)\QuickTime
2011-02-26 16:09 . 2011-02-26 16:09 -------- d-----w- c:\programdata\Apple Computer
2011-02-26 16:08 . 2011-02-26 16:08 -------- d-----w- c:\program files (x86)\OLYMPUS
2011-02-26 16:06 . 2011-02-26 16:06 -------- d-----w- c:\program files (x86)\MSXML 4.0
2011-02-25 17:38 . 2011-02-25 17:38 -------- d-----w- c:\windows\cs
2011-02-25 17:36 . 2011-02-25 17:36 -------- dc----w- c:\windows\system32\DRVSTORE
2011-02-25 17:36 . 2010-09-22 23:36 48488 ----a-w- c:\windows\system32\drivers\fssfltr.sys
2011-02-25 17:35 . 2011-02-25 17:36 -------- d-----w- c:\program files\Windows Live
2011-02-25 17:34 . 2009-09-04 16:44 69464 ----a-w- c:\windows\SysWow64\XAPOFX1_3.dll
2011-02-25 17:34 . 2009-09-04 16:44 515416 ----a-w- c:\windows\SysWow64\XAudio2_5.dll
2011-02-25 17:34 . 2009-09-04 16:29 453456 ----a-w- c:\windows\SysWow64\d3dx10_42.dll
2011-02-25 17:34 . 2009-09-04 16:29 523088 ----a-w- c:\windows\system32\d3dx10_42.dll
2011-02-25 17:34 . 2011-02-25 17:34 15712 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\35cd9eba1cbd5120b\MeshBetaRemover.exe
2011-02-25 17:34 . 2011-02-25 17:34 469256 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\33de80811cbd5120a\InstallManager_WLE_WLE.exe
2011-02-25 17:34 . 2011-02-25 17:34 94040 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\30e005691cbd51209\DSETUP.dll
2011-02-25 17:34 . 2011-02-25 17:34 525656 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\30e005691cbd51209\DXSETUP.exe
2011-02-25 17:34 . 2011-02-25 17:34 1691480 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\30e005691cbd51209\dsetup32.dll
2011-02-25 17:34 . 2011-02-25 17:34 94040 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\2ff1fbce1cbd51208\DSETUP.dll
2011-02-25 17:34 . 2011-02-25 17:34 525656 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\2ff1fbce1cbd51208\DXSETUP.exe
2011-02-25 17:34 . 2011-02-25 17:34 1691480 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\2ff1fbce1cbd51208\dsetup32.dll
2011-02-25 17:33 . 2011-03-07 17:28 -------- d-----w- c:\users\Dan\AppData\Local\Windows Live
2011-02-23 11:49 . 2011-01-07 12:17 1465344 ----a-w- c:\windows\system32\XpsPrint.dll
2011-02-23 11:49 . 2011-01-07 12:17 475648 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2011-02-23 11:49 . 2011-01-07 07:46 870912 ----a-w- c:\windows\SysWow64\XpsPrint.dll
2011-02-23 11:49 . 2011-01-07 07:46 288256 ----a-w- c:\windows\SysWow64\XpsGdiConverter.dll
2011-02-20 19:14 . 2011-02-20 19:15 -------- d-----w- c:\program files (x86)\The KMPlayer
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-17 20:42 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll
2011-03-17 20:42 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll
2011-03-13 13:09 . 2010-06-24 10:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-02-17 18:26 . 2011-02-17 18:26 254528 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2011-01-07 12:14 . 2011-02-12 13:19 46080 ----a-w- c:\windows\system32\atmlib.dll
2011-01-07 09:51 . 2011-02-12 13:24 1638912 ----a-w- c:\windows\system32\mshtml.tlb
2011-01-07 09:20 . 2011-02-12 13:19 366592 ----a-w- c:\windows\system32\atmfd.dll
2011-01-07 07:45 . 2011-02-12 13:19 34304 ----a-w- c:\windows\SysWow64\atmlib.dll
2011-01-07 06:01 . 2011-02-12 13:24 1638912 ----a-w- c:\windows\SysWow64\mshtml.tlb
2011-01-07 05:43 . 2011-02-12 13:19 294400 ----a-w- c:\windows\SysWow64\atmfd.dll
2011-01-05 10:34 . 2011-02-12 13:20 612864 ----a-w- c:\windows\system32\vbscript.dll
2011-01-05 06:56 . 2011-02-12 13:22 3129344 ----a-w- c:\windows\system32\win32k.sys
2011-01-05 05:55 . 2011-02-12 13:20 428032 ----a-w- c:\windows\SysWow64\vbscript.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2010-05-27 02:40 120176 ----a-w- c:\program files (x86)\EgisTec MyWinLocker\x86\PSDProtect.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SharingPrivate]
@="{08244EE6-92F0-47f2-9FC9-929BAA2E7235}"
[HKEY_CLASSES_ROOT\CLSID\{08244EE6-92F0-47f2-9FC9-929BAA2E7235}]
2010-11-20 12:20 442880 ----a-w- c:\windows\System32\ntshrui.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-07-16 39408]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2009-10-09 25623336]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408]
"OM2_Monitor"="c:\program files (x86)\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" [2008-05-15 95536]
"T-Mobile Communication Centre"="c:\program files (x86)\T-Mobile\Web'n'walk Manager\Manager.exe" [2010-06-03 1347504]
"Best Malware Protection"="c:\programdata\836ed1\BM836_2121.exe" [2011-03-20 6128640]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-04-13 284696]
"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2010-06-22 968272]
"SuiteTray"="c:\program files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe" [2010-05-27 337264]
"EgisUpdate"="c:\program files (x86)\EgisTec IPS\EgisUpdate.exe" [2010-03-11 201584]
"EgisTecPMMUpdate"="c:\program files (x86)\EgisTec IPS\PmmUpdate.exe" [2010-03-11 407920]
"Norton Online Backup"="c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe" [2010-06-01 1155928]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]
"BackupManagerTray"="c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" [2010-06-28 265984]
"QuickTime Task"="c:\program files (x86)\QuickTime\qttask.exe" [2006-09-01 282624]
"OM2_Monitor"="c:\program files (x86)\OLYMPUS\OLYMPUS Master 2\FirstStart.exe" [2008-05-15 54576]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 2 (0x2)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\a.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\aAvgApi.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\AAWTray.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\About.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\ackwin32.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\Ad-Aware.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\adaware.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\advxdwin.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\AdwarePrj.exe]
"Debugger"=svchost.exe
.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\fsm32.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\fsma32.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\fsmb32.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\gator.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\gav.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\gbmenu.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\gbn976rl.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\gbpoll.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\generics.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\gmt.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\guard.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\guarddog.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\guardgui.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\hacktracersetup.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\hbinst.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\hbsrv.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\History.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\homeav2010.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\hotactio.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\hotpatch.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\htlog.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\htpatch.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\hwpe.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\hxdl.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\hxiul.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\iamapp.exe]
"Debugger"=svchost.exe
.[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sms.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smss32.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\snetcfg.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\soap.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sofi.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SoftSafeness.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sperm.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spf.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sphinx.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoler.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolcv.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolsv32.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spywarexpguard.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spyxx.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srexe.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srng.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ss3edit.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ssgrate.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ssg_4104.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\st2.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\start.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\stcloader.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\supftrl.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\support.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\supporter5.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svc.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchostc.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchosts.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svshost.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sweep95.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sweepnet.sweepsrv.sys.swnetsup.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symlcsvc.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symproxysvc.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symtray.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\system.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\system32.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sysupd.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tapinstall.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taumon.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbscan.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tc.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tca.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tcm.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tds-3.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tds2-98.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tds2-nt.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\teekids.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tfak.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tfak5.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tgbob.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\titanin.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\titaninxp.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TPSrv.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trickler.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trjscan.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trjsetup.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trojantrap3.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrustWarrior.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tsadbot.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tsc.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tvmd.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tvtmd.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uiscan.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\undoboot.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\updat.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\upgrad.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\upgrepl.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utpost.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbcmserv.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbcons.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbust.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbwin9x.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbwinntw.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vcsetup.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vet32.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vet95.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vettray.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vfsetup.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vir-help.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\virusmdpersonalfirewall.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VisthAux.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VisthLic.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VisthUpd.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vnlan300.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vnpc3000.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vpc32.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vpc42.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vpfw30s.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vptray.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vscan40.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vscenu6.02d30.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsched.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsecomr.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vshwin32.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsisetup.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsmain.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsmon.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsserv.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsstat.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vswin9xe.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vswinntse.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vswinperse.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\w32dsm89.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\W3asbas.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\w9x.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\watchdog.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webdav.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WebProxy.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webscanx.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webtrap.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wfindv32.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\whoswatchingme.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wimmun32.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win-bugsfix.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win32.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win32us.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winactive.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winav.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windll32.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\window.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows Police Pro.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wininetd.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wininitx.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogin.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winmain.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winppr32.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winrecon.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winservn.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winssk32.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winstart.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winstart001.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wintsk32.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winupdate.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wkufind.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wnad.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wnt.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wradmin.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wrctrl.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsbgate.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscfxas.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscfxav.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscfxfw.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsctool.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wupdater.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wupdt.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wyvernworksfirewall.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xpdeluxe.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xpf202en.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xp_antispyware.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zapro.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zapsetup3001.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zatutor.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zonalm2601.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zonealarm.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avp32.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avpcc.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avpm.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\~1.exe]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\~2.exe]
"Debugger"=svchost.exe
.
------- Doplňkový sken -------
.
uStart Page = my.daemon-search.com
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0405&m=aspire_5336&r=27360211p345l0464z1h5v47m2131s
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: WikiKomentáře Google... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
TCP: {C67EC752-19B8-2400-C723-392C694313D8} = 62.141.0.1 213.162.65.1
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Toolbar-Locked - (no file)
SafeBoot-WudfPf
SafeBoot-WudfRd
SafeBoot-sacsvr
SafeBoot-vmms
Toolbar-Locked - (no file)
HKLM-Run-ETDWare - %ProgramFiles%\Elantech\ETDCtrl.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-1499124843-1653392340-3149791649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-1499124843-1653392340-3149791649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE
c:\program files (x86)\Launch Manager\LMworker.exe
.
**************************************************************************
.
Celkový čas: 2011-03-20 23:36:18 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-03-20 22:36
.
Před spuštěním: Volných bajtů: 274 034 929 664
Po spuštění: Volných bajtů: 273 649 061 888
.
- - End Of File - - 757FB9BF1E17B2CF9F8D8DC9C000B5AA

na ploše se mu také objevil best Mlavare protection , který má být zde C:\ProgramData\836ed1\BM836_2121.exe /hkd, ale tam ho nevidím, chtěl jsem ho odinstalovat asi zamezuje otevření antivirového programu

zkusil jsem podle tohoto, ale ten program je tam stále http://www.viry.cz/forum/viewtopic.php?f=13&t=110403
ale ten log je nějaký krátký((

his log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.

Rkill was run on 21.03.2011 at 2:49:42.
Operating System: Windows 7 Home Premium


Processes terminated by Rkill or while it was running:

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\runonce.exe
C:\Windows\SysWOW64\runonce.exe


Rkill completed on 21.03.2011 at 2:49:44.

Ještě dočistíme. Přesuňte ComboFix na plochu. Otevřte poznámkový blok a zkopírujte do něj:

Folder::
c:\programdata\BMSZP
c:\programdata\836ed1

Registry::
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\a.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\About.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\ackwin32.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\adaware.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\AdwarePrj.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\fsm32.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\fsma32.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\fsmb32.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\gator.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\gav.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\gbmenu.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\gbn976rl.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\gbpoll.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\generics.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\gmt.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\guarddog.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\guardgui.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\hacktracersetup.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\hbinst.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\hbsrv.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\History.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\homeav2010.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\hotactio.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\htlog.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\htpatch.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\hwpe.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\hxdl.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\hxiul.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\iamapp.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sms.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smss32.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\snetcfg.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\soap.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sofi.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SoftSafeness.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sperm.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spf.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sphinx.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolcv.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolsv32.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spywarexpguard.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spyxx.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srexe.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srng.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ss3edit.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ssgrate.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ssg_4104.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\st2.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\start.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\stcloader.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\supftrl.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\support.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\supporter5.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svc.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchostc.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchosts.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svshost.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sweep95.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sweepnet.sweepsrv.sys.swnetsup.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symlcsvc.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symproxysvc.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symtray.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\system.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\system32.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sysupd.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tapinstall.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taumon.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tc.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tca.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tcm.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tds-3.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tds2-98.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tds2-nt.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\teekids.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tfak.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tfak5.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tgbob.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\titanin.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\titaninxp.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TPSrv.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trickler.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trjscan.exe]
"Debugger"=-[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trjsetup.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trojantrap3.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrustWarrior.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tsadbot.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tsc.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tvmd.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tvtmd.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uiscan.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\undoboot.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\updat.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\upgrad.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\upgrepl.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utpost.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbcmserv.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbcons.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbust.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbwin9x.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbwinntw.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vcsetup.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vet32.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vet95.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vettray.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vfsetup.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vir-help.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\virusmdpersonalfirewall.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VisthAux.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VisthLic.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VisthUpd.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vnlan300.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vnpc3000.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vpc32.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vpc42.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vpfw30s.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vptray.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vscan40.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vscenu6.02d30.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsched.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsecomr.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vshwin32.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsisetup.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsmain.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsmon.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsserv.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsstat.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vswin9xe.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vswinntse.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vswinperse.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\w32dsm89.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\W3asbas.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\w9x.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\watchdog.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webdav.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WebProxy.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webscanx.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webtrap.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wfindv32.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\whoswatchingme.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wimmun32.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win-bugsfix.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win32.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win32us.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winactive.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winav.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windll32.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\window.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows Police Pro.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wininetd.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wininitx.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogin.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winmain.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winppr32.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winrecon.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winservn.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winssk32.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winstart.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winstart001.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wintsk32.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winupdate.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wkufind.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wnad.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wnt.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wradmin.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wrctrl.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsbgate.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscfxas.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscfxav.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscfxfw.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsctool.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wupdater.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wupdt.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wyvernworksfirewall.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xpdeluxe.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xpf202en.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xp_antispyware.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zapro.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zapsetup3001.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zatutor.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zonalm2601.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zonealarm.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avp32.exe]
"Debugger"=
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avpcc.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avpm.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\~1.exe]
"Debugger"=-
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\~2.exe]
"Debugger"=-

Uložte nas plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.