VIRY.CZ

Dobrý den,
při testu po restartu mi avast nasel rootkit. PC je mírně zpomalené. Prosím o kontrolu. Díky.

Logfile of random's system information tool 1.09 (written by random/random)
Run by Cajnik at 2011-11-29 09:47:25
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 8 GB (22%) free of 38 GB
Total RAM: 510 MB (37% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:47:53, on 29.11.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\Cajnik\Dokumenty\Stažené soubory\RSIT.exe
C:\Program Files\trend micro\Cajnik.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Bluetooth Manager.lnk = ?
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - c:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

--
End of file - 4888 bytes

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\Cajnik\Data aplikací\Mozilla\Firefox\Profiles\yc85q8jm.default

prefs.js - "browser.search.useDBForOrder" - true
prefs.js - "browser.startup.homepage" - "https://encrypted.google.com/"
prefs.js - "extensions.enabledItems" - "dealio@mybrowserbar.com:4.7, wtxpcom@mybrowserbar.com:4.7, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.24"
prefs.js - "keyword.URL" - "http://search.yahoo.com/search?fr=green ... =150911&p="

"wrc@avast.com"=C:\Program Files\AVAST Software\Avast\WebRep\FF

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\WINDOWS\System32\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

C:\Program Files\Mozilla Firefox\extensions\
dealio@mybrowserbar.com
wtxpcom@mybrowserbar.com
{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files\Mozilla Firefox\plugins\
nppdf32.dll

C:\Program Files\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml
yahoo.xml

C:\Documents and Settings\Cajnik\Data aplikací\Mozilla\Firefox\Profiles\yc85q8jm.default\searchplugins\
askcom.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-09-05 63912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2011-09-06 806456]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E99421FB-68DD-40F0-B4AC-B7027CAE2F1A}]
EpsonToolBandKicker Class - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll [2005-02-22 368640]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EE5D279F-081B-4404-994D-C6B60AAEBA6D} - EPSON Web-To-Page - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll [2005-02-22 368640]
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2011-09-06 806456]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\WINDOWS\System32\igfxtray.exe [2004-02-10 155648]
"HotKeysCmds"=C:\WINDOWS\System32\hkcmd.exe [2004-02-10 118784]
"avast"=C:\Program Files\AVAST Software\Avast\avastUI.exe [2011-09-06 3722416]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-06-06 937920]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BrowserChoice]
C:\WINDOWS\system32\browserchoice.exe [2010-02-12 293376]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe [2009-06-29 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Microsoft Office.lnk]
C:\PROGRA~1\MICROS~2\Office\OSA9.EXE [1999-02-17 65588]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Bluetooth Manager.lnk - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxsrvc.dll [2004-02-10 339968]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"vidc.iv41"=ir41_32.ax
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll

======List of files/folders created in the last 1 month======

2011-11-29 09:47:31 ----D---- C:\Program Files\trend micro
2011-11-29 09:47:25 ----D---- C:\rsit
2011-11-29 01:10:51 ----A---- C:\WINDOWS\system32\FNTCACHE.DAT
2011-11-28 23:06:05 ----D---- C:\Program Files\CCleaner
2011-11-28 22:46:20 ----A---- C:\WINDOWS\system32\drivers\aswFsBlk.sys
2011-11-28 22:46:19 ----A---- C:\WINDOWS\system32\drivers\aswSP.sys
2011-11-28 22:46:13 ----A---- C:\WINDOWS\system32\drivers\aswRdr.sys
2011-11-28 22:46:12 ----A---- C:\WINDOWS\system32\drivers\aswTdi.sys
2011-11-28 22:46:10 ----A---- C:\WINDOWS\system32\drivers\aswSnx.sys
2011-11-28 22:46:08 ----A---- C:\WINDOWS\system32\drivers\aswmon2.sys
2011-11-28 22:46:08 ----A---- C:\WINDOWS\system32\drivers\aswmon.sys
2011-11-28 22:46:07 ----A---- C:\WINDOWS\system32\drivers\aavmker4.sys
2011-11-28 22:44:53 ----A---- C:\WINDOWS\avastSS.scr
2011-11-28 22:44:50 ----A---- C:\WINDOWS\system32\aswBoot.exe
2011-11-28 22:43:43 ----D---- C:\Program Files\AVAST Software
2011-11-28 22:43:43 ----D---- C:\Documents and Settings\All Users\Data aplikací\AVAST Software
2011-11-28 21:51:12 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2011-11-28 21:50:58 ----HDC---- C:\WINDOWS\$NtUninstallKB2570791$
2011-11-28 21:50:46 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2011-11-28 21:50:30 ----HDC---- C:\WINDOWS\$NtUninstallKB959426$
2011-11-28 21:50:14 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2011-11-28 21:49:55 ----HDC---- C:\WINDOWS\$NtUninstallKB2387149$
2011-11-28 21:49:37 ----HDC---- C:\WINDOWS\$NtUninstallKB960859$
2011-11-28 21:49:18 ----HDC---- C:\WINDOWS\$NtUninstallKB2479943$
2011-11-28 21:49:02 ----HDC---- C:\WINDOWS\$NtUninstallKB2567680$
2011-11-28 21:48:44 ----HDC---- C:\WINDOWS\$NtUninstallKB2564958$
2011-11-28 21:48:32 ----HDC---- C:\WINDOWS\$NtUninstallKB2478971$
2011-11-28 21:48:17 ----HDC---- C:\WINDOWS\$NtUninstallKB2544893-v2$
2011-11-28 21:47:59 ----HDC---- C:\WINDOWS\$NtUninstallKB2536276-v2$
2011-11-28 21:47:42 ----HDC---- C:\WINDOWS\$NtUninstallKB2296011$
2011-11-28 21:47:27 ----HDC---- C:\WINDOWS\$NtUninstallKB2115168$
2011-11-28 21:47:14 ----HDC---- C:\WINDOWS\$NtUninstallKB975558_WM8$
2011-11-28 21:46:57 ----HDC---- C:\WINDOWS\$NtUninstallKB955759$
2011-11-28 21:46:38 ----HDC---- C:\WINDOWS\$NtUninstallKB2378111_WM9$
2011-11-28 21:46:20 ----HDC---- C:\WINDOWS\$NtUninstallKB974318$
2011-11-28 21:46:03 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$
2011-11-28 21:45:45 ----HDC---- C:\WINDOWS\$NtUninstallKB969059$
2011-11-28 21:45:28 ----HDC---- C:\WINDOWS\$NtUninstallKB2443105$
2011-11-28 21:45:13 ----HDC---- C:\WINDOWS\$NtUninstallKB2229593$
2011-11-28 21:42:03 ----HDC---- C:\WINDOWS\$NtUninstallKB2467659$
2011-11-28 21:40:40 ----D---- C:\WINDOWS\ie8updates
2011-11-28 21:38:33 ----D---- C:\WINDOWS\WBEM
2011-11-28 21:36:07 ----HDC---- C:\WINDOWS\ie8
2011-11-28 21:27:43 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2011-11-28 21:27:24 ----HDC---- C:\WINDOWS\$NtUninstallKB2481109$
2011-11-28 21:27:05 ----HDC---- C:\WINDOWS\$NtUninstallKB975713$
2011-11-28 21:26:52 ----HDC---- C:\WINDOWS\$NtUninstallKB2485663$
2011-11-28 21:26:38 ----HDC---- C:\WINDOWS\$NtUninstallKB2440591$
2011-11-28 21:26:25 ----HDC---- C:\WINDOWS\$NtUninstallKB982132$
2011-11-28 21:26:11 ----HDC---- C:\WINDOWS\$NtUninstallKB971657$
2011-11-28 21:25:57 ----HDC---- C:\WINDOWS\$NtUninstallKB978338$
2011-11-28 21:25:45 ----HDC---- C:\WINDOWS\$NtUninstallKB954155_WM9$
2011-11-28 21:25:33 ----HDC---- C:\WINDOWS\$NtUninstallKB2507938$
2011-11-28 21:25:10 ----HDC---- C:\WINDOWS\$NtUninstallKB972270$
2011-11-28 21:24:47 ----A---- C:\WINDOWS\system32\MRT.INI
2011-11-28 21:19:35 ----A---- C:\WINDOWS\system32\MRT.exe
2011-11-28 21:18:50 ----HDC---- C:\WINDOWS\$NtUninstallKB2510581$
2011-11-28 21:18:31 ----HDC---- C:\WINDOWS\$NtUninstallKB956744$
2011-11-28 21:18:16 ----HDC---- C:\WINDOWS\$NtUninstallKB2476490$
2011-11-28 21:18:00 ----HDC---- C:\WINDOWS\$NtUninstallKB974112$
2011-11-28 21:17:33 ----HDC---- C:\WINDOWS\$NtUninstallKB956572$
2011-11-28 21:17:02 ----HDC---- C:\WINDOWS\$NtUninstallKB2347290$
2011-11-28 21:16:47 ----HDC---- C:\WINDOWS\$NtUninstallKB956844$
2011-11-28 21:16:31 ----HDC---- C:\WINDOWS\$NtUninstallKB2641690$
2011-11-28 21:15:50 ----HDC---- C:\WINDOWS\$NtUninstallKB2483185$
2011-11-28 21:15:26 ----HDC---- C:\WINDOWS\$NtUninstallKB961501$
2011-11-28 21:15:09 ----HDC---- C:\WINDOWS\$NtUninstallKB2079403$
2011-11-28 21:14:53 ----HDC---- C:\WINDOWS\$NtUninstallKB979687$
2011-11-28 21:14:38 ----HDC---- C:\WINDOWS\$NtUninstallKB973869$
2011-11-28 21:14:25 ----HDC---- C:\WINDOWS\$NtUninstallKB975025$
2011-11-28 21:14:07 ----HDC---- C:\WINDOWS\$NtUninstallKB952004$
2011-11-28 21:13:50 ----HDC---- C:\WINDOWS\$NtUninstallKB974571$
2011-11-28 21:13:36 ----HDC---- C:\WINDOWS\$NtUninstallKB2567053$
2011-11-28 21:13:21 ----HDC---- C:\WINDOWS\$NtUninstallKB2592799$
2011-11-28 21:13:08 ----HDC---- C:\WINDOWS\$NtUninstallKB975560$
2011-11-28 21:12:44 ----HDC---- C:\WINDOWS\$NtUninstallKB973507$
2011-11-28 21:12:30 ----HDC---- C:\WINDOWS\$NtUninstallKB2570222$
2011-11-28 21:12:19 ----HDC---- C:\WINDOWS\$NtUninstallKB2535512$
2011-11-28 21:12:06 ----HDC---- C:\WINDOWS\$NtUninstallKB977816$
2011-11-28 21:11:48 ----HDC---- C:\WINDOWS\$NtUninstallKB973687$
2011-11-28 21:11:34 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2011-11-28 21:11:22 ----HDC---- C:\WINDOWS\$NtUninstallKB2412687$
2011-11-28 21:11:09 ----HDC---- C:\WINDOWS\$NtUninstallKB978601$
2011-11-28 21:10:57 ----HDC---- C:\WINDOWS\$NtUninstallKB2570947$
2011-11-28 21:10:46 ----HDC---- C:\WINDOWS\$NtUninstallKB2508272$
2011-11-28 21:10:35 ----HDC---- C:\WINDOWS\$NtUninstallKB980436$
2011-11-28 21:10:23 ----HDC---- C:\WINDOWS\$NtUninstallKB981322$
2011-11-28 21:10:10 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2011-11-28 21:09:55 ----HDC---- C:\WINDOWS\$NtUninstallKB978695_WM9$
2011-11-28 21:09:42 ----HDC---- C:\WINDOWS\$NtUninstallKB2507618$
2011-11-28 21:09:25 ----HDC---- C:\WINDOWS\$NtUninstallKB973904$
2011-11-28 21:09:05 ----HDC---- C:\WINDOWS\$NtUninstallKB973540_WM9$
2011-11-28 21:08:42 ----HDC---- C:\WINDOWS\$NtUninstallKB2419632$
2011-11-28 21:08:25 ----HDC---- C:\WINDOWS\$NtUninstallKB2508429$
2011-11-28 21:08:12 ----HDC---- C:\WINDOWS\$NtUninstallKB974392$
2011-11-28 21:07:31 ----HDC---- C:\WINDOWS\$NtUninstallKB971029$
2011-11-28 21:07:07 ----HDC---- C:\WINDOWS\$NtUninstallKB954459$
2011-11-28 21:06:51 ----HDC---- C:\WINDOWS\$NtUninstallKB2506212$
2011-11-28 21:06:33 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$
2011-11-28 21:06:20 ----HDC---- C:\WINDOWS\$NtUninstallKB977914$
2011-11-28 21:05:57 ----HDC---- C:\WINDOWS\$NtUninstallKB978542$
2011-11-28 21:05:43 ----HDC---- C:\WINDOWS\$NtUninstallKB979309$
2011-11-28 21:05:33 ----HDC---- C:\WINDOWS\$NtUninstallKB979482$
2011-11-28 21:05:21 ----HDC---- C:\WINDOWS\$NtUninstallKB978706$
2011-11-28 21:05:02 ----HDC---- C:\WINDOWS\$NtUninstallKB981997$
2011-11-28 21:04:45 ----HDC---- C:\WINDOWS\$NtUninstallKB960803$
2011-11-28 21:04:32 ----HDC---- C:\WINDOWS\$NtUninstallKB973815$
2011-11-28 21:03:56 ----HDC---- C:\WINDOWS\$NtUninstallKB2586448$
2011-11-28 21:03:30 ----HDC---- C:\WINDOWS\$NtUninstallKB975562$
2011-11-28 21:03:17 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2011-11-28 21:03:06 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$
2011-11-28 21:02:46 ----HDC---- C:\WINDOWS\$NtUninstallKB2509553$
2011-11-28 21:02:36 ----D---- C:\Program Files\MSXML 4.0
2011-11-28 21:02:14 ----HDC---- C:\WINDOWS\$NtUninstallKB982665$
2011-11-28 21:02:04 ----HDC---- C:\WINDOWS\$NtUninstallKB2541763$
2011-11-28 21:01:52 ----HDC---- C:\WINDOWS\$NtUninstallKB2544521$
2011-11-28 21:01:39 ----HDC---- C:\WINDOWS\$NtUninstallKB2478960$
2011-11-28 21:01:08 ----HDC---- C:\WINDOWS\$NtUninstallKB2393802$
2011-11-28 21:00:51 ----HDC---- C:\WINDOWS\$NtUninstallKB923561$
2011-11-28 21:00:40 ----HDC---- C:\WINDOWS\$NtUninstallKB2566454$
2011-11-28 21:00:29 ----HDC---- C:\WINDOWS\$NtUninstallKB2562937$
2011-11-28 21:00:18 ----HDC---- C:\WINDOWS\$NtUninstallKB975467$
2011-11-28 21:00:03 ----HDC---- C:\WINDOWS\$NtUninstallKB968389$
2011-11-28 20:59:50 ----HDC---- C:\WINDOWS\$NtUninstallKB2423089$
2011-11-28 20:59:30 ----HDC---- C:\WINDOWS\$NtUninstallKB2360937$
2011-11-28 20:44:56 ----N---- C:\WINDOWS\system32\drivers\bthport.sys
2011-11-28 20:34:47 ----D---- C:\WINDOWS\system32\cs-cz
2011-11-28 20:34:47 ----D---- C:\WINDOWS\system32\cs
2011-11-28 20:34:47 ----D---- C:\WINDOWS\Provisioning
2011-11-28 20:34:47 ----D---- C:\WINDOWS\PeerNet
2011-11-28 20:34:47 ----D---- C:\WINDOWS\Network Diagnostic
2011-11-28 20:34:47 ----D---- C:\WINDOWS\L2Schemas
2011-11-28 20:34:47 ----D---- C:\WINDOWS\ehome
2011-11-28 20:33:34 ----N---- C:\WINDOWS\system32\browserchoice.exe
2011-11-28 20:19:43 ----D---- C:\WINDOWS\system32\PreInstall
2011-11-28 20:19:41 ----A---- C:\WINDOWS\system32\spupdsvc.exe
2011-11-28 20:19:40 ----HDC---- C:\WINDOWS\$NtUninstallKB898461$
2011-11-28 20:19:40 ----HD---- C:\WINDOWS\$hf_mig$
2011-11-28 20:13:34 ----A---- C:\WINDOWS\system32\igfxres.dll
2011-11-28 20:09:28 ----D---- C:\WINDOWS\Prefetch
2011-11-28 19:57:44 ----A---- C:\WINDOWS\system32\bitsprx4.dll
2011-11-28 19:57:44 ----A---- C:\WINDOWS\system32\bitsprx3.dll
2011-11-28 19:57:44 ----A---- C:\WINDOWS\system32\bitsprx2.dll
2011-11-28 19:57:31 ----A---- C:\WINDOWS\system32\fltMc.exe
2011-11-28 19:57:31 ----A---- C:\WINDOWS\system32\fltlib.dll
2011-11-28 19:57:31 ----A---- C:\WINDOWS\system32\drivers\fltMgr.sys
2011-11-28 19:54:23 ----A---- C:\WINDOWS\system32\tsgqec.dll
2011-11-28 19:54:23 ----A---- C:\WINDOWS\system32\rhttpaa.dll
2011-11-28 19:54:23 ----A---- C:\WINDOWS\system32\aaclient.dll
2011-11-28 19:44:16 ----A---- C:\WINDOWS\system32\irclass.dll
2011-11-28 19:44:15 ----A---- C:\WINDOWS\system32\spxcoins.dll
2011-11-28 19:43:45 ----RA---- C:\WINDOWS\SET5E.tmp
2011-11-28 19:43:40 ----RA---- C:\WINDOWS\SET52.tmp
2011-11-28 19:43:37 ----RA---- C:\WINDOWS\SET51.tmp
2011-11-28 18:58:59 ----RD---- C:\Program Files\Skype

======List of files/folders modified in the last 1 month======

2011-11-29 09:47:31 ----RD---- C:\Program Files
2011-11-29 09:38:08 ----D---- C:\Instalace
2011-11-29 09:38:00 ----D---- C:\WINDOWS\Temp
2011-11-29 09:23:03 ----HD---- C:\WINDOWS\inf
2011-11-29 01:45:14 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-11-29 01:41:00 ----D---- C:\WINDOWS
2011-11-29 01:38:13 ----D---- C:\Documents and Settings\Cajnik\Data aplikací\Skype
2011-11-29 01:16:39 ----ASH---- C:\boot.ini
2011-11-29 01:10:51 ----D---- C:\WINDOWS\system32
2011-11-29 00:12:14 ----SD---- C:\WINDOWS\Tasks
2011-11-29 00:12:06 ----SHD---- C:\WINDOWS\Installer
2011-11-28 23:51:17 ----D---- C:\WINDOWS\pss
2011-11-28 23:46:21 ----D---- C:\WINDOWS\SoftwareDistribution
2011-11-28 23:46:21 ----D---- C:\WINDOWS\Debug
2011-11-28 23:46:20 ----D---- C:\WINDOWS\Minidump
2011-11-28 23:32:38 ----D---- C:\WINDOWS\system32\drivers
2011-11-28 23:26:16 ----D---- C:\Program Files\Google
2011-11-28 22:45:23 ----D---- C:\WINDOWS\WinSxS
2011-11-28 22:26:28 ----D---- C:\Program Files\Mozilla Firefox
2011-11-28 22:19:28 ----A---- C:\WINDOWS\win.ini
2011-11-28 22:19:28 ----A---- C:\WINDOWS\system.ini
2011-11-28 21:59:36 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2011-11-28 21:53:47 ----RSHDC---- C:\WINDOWS\system32\dllcache
2011-11-28 21:53:47 ----D---- C:\WINDOWS\AppPatch
2011-11-28 21:53:45 ----D---- C:\WINDOWS\Help
2011-11-28 21:53:45 ----D---- C:\Program Files\Internet Explorer
2011-11-28 21:53:43 ----D---- C:\WINDOWS\system32\wbem
2011-11-28 21:50:18 ----D---- C:\Program Files\Messenger
2011-11-28 21:47:21 ----D---- C:\WINDOWS\system32\CatRoot2
2011-11-28 21:38:03 ----D---- C:\WINDOWS\Media
2011-11-28 21:06:01 ----D---- C:\Program Files\Outlook Express
2011-11-28 21:05:07 ----D---- C:\Program Files\Movie Maker
2011-11-28 20:49:58 ----D---- C:\WINDOWS\SxsCaPendDel
2011-11-28 20:48:07 ----D---- C:\Program Files\Common Files
2011-11-28 20:40:51 ----D---- C:\WINDOWS\system32\Setup
2011-11-28 20:40:40 ----D---- C:\WINDOWS\system32\usmt
2011-11-28 20:40:22 ----D---- C:\WINDOWS\ime
2011-11-28 20:40:20 ----RSD---- C:\WINDOWS\Fonts
2011-11-28 20:39:41 ----D---- C:\WINDOWS\system32\npp
2011-11-28 20:39:30 ----D---- C:\WINDOWS\msagent
2011-11-28 20:36:54 ----D---- C:\WINDOWS\system32\1029
2011-11-28 20:36:47 ----D---- C:\WINDOWS\twain_32
2011-11-28 20:36:27 ----D---- C:\WINDOWS\system32\icsxml
2011-11-28 20:35:59 ----D---- C:\WINDOWS\system32\ias
2011-11-28 20:35:54 ----D---- C:\WINDOWS\system32\1033
2011-11-28 20:34:47 ----D---- C:\WINDOWS\Driver Cache
2011-11-28 20:15:46 ----SD---- C:\Documents and Settings\Cajnik\Data aplikací\Microsoft
2011-11-28 20:12:51 ----D---- C:\WINDOWS\Registration
2011-11-28 20:12:37 ----D---- C:\WINDOWS\system32\CatRoot
2011-11-28 20:09:41 ----SHD---- C:\System Volume Information
2011-11-28 20:09:41 ----D---- C:\WINDOWS\system32\Restore
2011-11-28 20:08:04 ----D---- C:\WINDOWS\system32\config
2011-11-28 20:00:58 ----D---- C:\Program Files\Windows Media Player
2011-11-28 20:00:44 ----SD---- C:\Documents and Settings\All Users\Data aplikací\Microsoft
2011-11-28 20:00:16 ----AC---- C:\WINDOWS\ODBCINST.INI
2011-11-28 19:59:39 ----ASHC---- C:\WINDOWS\fonts\desktop.ini
2011-11-28 19:58:44 ----RD---- C:\WINDOWS\Web
2011-11-28 19:58:26 ----RAHC---- C:\WINDOWS\system32\cdplayer.exe.manifest
2011-11-28 19:57:51 ----D---- C:\WINDOWS\srchasst
2011-11-28 19:57:38 ----D---- C:\WINDOWS\system32\oobe
2011-11-28 19:57:36 ----D---- C:\WINDOWS\security
2011-11-28 19:57:29 ----D---- C:\Program Files\NetMeeting
2011-11-28 19:57:27 ----D---- C:\Program Files\Common Files\System
2011-11-28 19:55:33 ----D---- C:\WINDOWS\system32\Com
2011-11-28 19:54:26 ----D---- C:\Program Files\Windows NT
2011-11-28 19:44:15 ----D---- C:\WINDOWS\system
2011-11-28 19:43:57 ----ASH---- C:\Documents and Settings\All Users\Data aplikací\desktop.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 IdeBusDr;IdeBusDr; C:\WINDOWS\System32\DRIVERS\IdeBusDr.sys [2002-10-14 13891]
R0 IdeChnDr;Intel(R) Ultra ATA Controller; C:\WINDOWS\System32\DRIVERS\IdeChnDr.sys [2002-10-14 101431]
R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2011-09-06 30808]
R1 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2011-09-06 34392]
R1 aswSnx;aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [2011-09-06 442200]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2011-09-06 320856]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2011-09-06 52568]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 Tosrfcom;Bluetooth RFCOMM; C:\WINDOWS\System32\Drivers\tosrfcom.sys [2005-08-01 64896]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2011-09-06 20568]
R2 aswMon2;aswMon2; C:\WINDOWS\system32\drivers\aswMon2.sys [2011-09-06 110552]
R3 aeaudio;aeaudio; C:\WINDOWS\system32\drivers\aeaudio.sys [2002-04-01 4816]
R3 E1000;Intel(R) PRO/1000 Adapter Driver; C:\WINDOWS\System32\DRIVERS\e1000325.sys [2002-10-17 103936]
R3 ialm;ialm; C:\WINDOWS\System32\DRIVERS\ialmnt5.sys [2004-02-10 681469]
R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2002-12-19 539008]
R3 tosporte;Bluetooth COM Port; C:\WINDOWS\System32\DRIVERS\tosporte.sys [2006-10-10 41600]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 NAL;Nal Service ; \??\C:\WINDOWS\System32\Drivers\iqvw32.sys []
S3 tosrfbd;Bluetooth RFBUS; C:\WINDOWS\System32\DRIVERS\tosrfbd.sys [2007-02-22 113920]
S3 tosrfbnp;Bluetooth RFBNEP; C:\WINDOWS\System32\Drivers\tosrfbnp.sys [2006-11-20 36480]
S3 Tosrfhid;Bluetooth RFHID; C:\WINDOWS\System32\DRIVERS\Tosrfhid.sys [2007-03-01 73728]
S3 tosrfnds;Bluetooth Personal Area Network; C:\WINDOWS\System32\DRIVERS\tosrfnds.sys [2005-01-06 18612]
S3 TosRfSnd;Bluetooth Audio; C:\WINDOWS\system32\drivers\tosrfsnd.sys [2007-01-22 53376]
S3 tosrfusb;Bluetooth USB Controller; C:\WINDOWS\System32\DRIVERS\tosrfusb.sys [2007-03-30 41856]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbprint;Třída USB Printer; C:\WINDOWS\System32\DRIVERS\usbprint.sys [2008-04-14 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\System32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2011-09-06 44768]
R2 TOSHIBA Bluetooth Service;TOSHIBA Bluetooth Service; C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe [2007-02-25 125048]
S3 NetSvc;Intel NCS NetService; c:\Program Files\Intel\NCS\Sync\NetSvc.exe [2002-09-27 139264]

-----------------EOF-----------------

Zdravim a pekny den preji

Kde jej Avast nachazi

Stahnete si TDSSKiller http://support.kaspersky.com/downloads/ ... killer.exe

Utilitu spustte a prikazte ji, at skenuje - klik na Start Scan
Pokud utilita najde infikekci, bude ji chtit lecit (Cure), povolte leceni kliknutim na Continue
Pokud utilita najde podezrely soubor (suspicious), bude jej chtit preskocit (Skip), povolte preskoceni kliknutim na Continue
Po dokonceni skenu bude mozna nutny restart PC, povolte jej kliknutim na Reboot now
Po restartu na Vas vyskoci log, pokud se tak nestane, najdete jej primo na disku, kde mate Windows (obvykle c:\) ve tvaru TDSSKiller.nejaka cisilka _log.txt - jeho obsah sem vlozte
Pokud restart nebude vyzadovan, kliknete na Close a nasledne na Report - vytvori se log - jeho obsah sem vlozte

Bohužel jsem si nezapomatoval cestu k souboru s logem avastu takže nevím přesně, kde byl rootkit nalezen bylo to C:\WINDOWS\system32\..... a dál nevím. Log z Tdsskiller zde:

0:12:39.0234 0128 TDSS rootkit removing tool 2.6.21.0 Nov 24 2011 12:32:44
10:12:39.0515 0128 ============================================================
10:12:39.0515 0128 Current date / time: 2011/11/29 10:12:39.0515
10:12:39.0515 0128 SystemInfo:
10:12:39.0515 0128
10:12:39.0515 0128 OS Version: 5.1.2600 ServicePack: 3.0
10:12:39.0515 0128 Product type: Workstation
10:12:39.0515 0128 ComputerName: ALENA-A5CVAFFXM
10:12:39.0515 0128 UserName: Cajnik
10:12:39.0515 0128 Windows directory: C:\WINDOWS
10:12:39.0515 0128 System windows directory: C:\WINDOWS
10:12:39.0515 0128 Processor architecture: Intel x86
10:12:39.0515 0128 Number of processors: 1
10:12:39.0515 0128 Page size: 0x1000
10:12:39.0515 0128 Boot type: Normal boot
10:12:39.0515 0128 ============================================================
10:12:42.0093 0128 Initialize success
10:12:52.0031 3636 ============================================================
10:12:52.0031 3636 Scan started
10:12:52.0031 3636 Mode: Manual;
10:12:52.0031 3636 ============================================================
10:12:53.0750 3636 Aavmker4 (95d1de2a6613494e853a9738d5d9acd4) C:\WINDOWS\system32\drivers\Aavmker4.sys
10:12:53.0765 3636 Aavmker4 - ok
10:12:54.0734 3636 Abiosdsk - ok
10:12:55.0671 3636 abp480n5 - ok
10:12:56.0750 3636 ACPI (4fe34f1f3126b61fcc6b2043aa8112c9) C:\WINDOWS\system32\DRIVERS\ACPI.sys
10:12:56.0781 3636 ACPI - ok
10:12:57.0640 3636 ACPIEC (afdff022a01f0b11c776f0860c3b282f) C:\WINDOWS\system32\drivers\ACPIEC.sys
10:12:57.0656 3636 ACPIEC - ok
10:12:58.0468 3636 adpu160m - ok
10:12:59.0359 3636 aeaudio (11c04b17ed2abbb4833694bcd644ac90) C:\WINDOWS\system32\drivers\aeaudio.sys
10:12:59.0359 3636 aeaudio - ok
10:13:00.0296 3636 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
10:13:00.0296 3636 aec - ok
10:13:01.0171 3636 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
10:13:01.0187 3636 AFD - ok
10:13:01.0968 3636 Aha154x - ok
10:13:02.0843 3636 aic78u2 - ok
10:13:03.0703 3636 aic78xx - ok
10:13:04.0500 3636 AliIde - ok
10:13:05.0281 3636 amsint - ok
10:13:06.0046 3636 asc - ok
10:13:06.0812 3636 asc3350p - ok
10:13:07.0859 3636 asc3550 - ok
10:13:08.0687 3636 aswFsBlk (c47623ffd181a1e7d63574dde2a0a711) C:\WINDOWS\system32\drivers\aswFsBlk.sys
10:13:08.0703 3636 aswFsBlk - ok
10:13:09.0546 3636 aswMon2 (fff2dbb17a3c89f87f78d5fa72ca47fd) C:\WINDOWS\system32\drivers\aswMon2.sys
10:13:09.0562 3636 aswMon2 - ok
10:13:10.0359 3636 aswRdr (36239e24470a3dd81fae37510953cc6c) C:\WINDOWS\system32\drivers\aswRdr.sys
10:13:10.0359 3636 aswRdr - ok
10:13:11.0359 3636 aswSnx (caa846e9c83836bdc3d2d700c678db65) C:\WINDOWS\system32\drivers\aswSnx.sys
10:13:11.0375 3636 aswSnx - ok
10:13:12.0468 3636 aswSP (748ae7f2d7da33adb063fe05704a9969) C:\WINDOWS\system32\drivers\aswSP.sys
10:13:12.0484 3636 aswSP - ok
10:13:14.0062 3636 aswTdi (ca9925ce1dbd07ffe1eb357752cf5577) C:\WINDOWS\system32\drivers\aswTdi.sys
10:13:14.0062 3636 aswTdi - ok
10:13:15.0000 3636 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
10:13:15.0015 3636 AsyncMac - ok
10:13:15.0968 3636 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
10:13:15.0968 3636 atapi - ok
10:13:16.0734 3636 Atdisk - ok
10:13:17.0578 3636 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
10:13:17.0593 3636 Atmarpc - ok
10:13:18.0437 3636 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
10:13:18.0437 3636 audstub - ok
10:13:19.0250 3636 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
10:13:19.0250 3636 Beep - ok
10:13:20.0125 3636 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
10:13:20.0125 3636 cbidf2k - ok
10:13:20.0906 3636 cd20xrnt - ok
10:13:21.0750 3636 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
10:13:21.0750 3636 Cdaudio - ok
10:13:22.0625 3636 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
10:13:22.0625 3636 Cdfs - ok
10:13:23.0515 3636 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
10:13:23.0515 3636 Cdrom - ok
10:13:24.0281 3636 Changer - ok
10:13:25.0156 3636 CmdIde - ok
10:13:25.0921 3636 Cpqarray - ok
10:13:26.0703 3636 dac2w2k - ok
10:13:27.0468 3636 dac960nt - ok
10:13:28.0312 3636 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
10:13:28.0312 3636 Disk - ok
10:13:29.0531 3636 dmboot (db5fd2bf5b07dc54bfcb3664ff05bd7c) C:\WINDOWS\system32\drivers\dmboot.sys
10:13:29.0546 3636 dmboot - ok
10:13:31.0468 3636 dmio (fff1720af51171f32f1ead5cf71f2810) C:\WINDOWS\system32\DRIVERS\dmio.sys
10:13:31.0468 3636 dmio - ok
10:13:32.0468 3636 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
10:13:32.0468 3636 dmload - ok
10:13:34.0046 3636 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
10:13:34.0062 3636 DMusic - ok
10:13:35.0468 3636 dpti2o - ok
10:13:36.0390 3636 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
10:13:36.0421 3636 drmkaud - ok
10:13:37.0421 3636 E1000 (785db16f68a89d4500a93625cead7b0e) C:\WINDOWS\system32\DRIVERS\e1000325.sys
10:13:37.0437 3636 E1000 - ok
10:13:38.0390 3636 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
10:13:38.0406 3636 Fastfat - ok
10:13:39.0234 3636 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
10:13:39.0250 3636 Fdc - ok
10:13:40.0734 3636 Fips (ac366695a0796560aa37215ad5762aaf) C:\WINDOWS\system32\drivers\Fips.sys
10:13:40.0843 3636 Fips - ok
10:13:42.0234 3636 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
10:13:42.0234 3636 Flpydisk - ok
10:13:43.0750 3636 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
10:13:43.0750 3636 FltMgr - ok
10:13:45.0125 3636 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
10:13:45.0125 3636 Fs_Rec - ok
10:13:46.0078 3636 Ftdisk (4e664d8541db4a66b73a24257e322e1f) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
10:13:46.0093 3636 Ftdisk - ok
10:13:47.0109 3636 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
10:13:47.0109 3636 Gpc - ok
10:13:48.0281 3636 hpn - ok
10:13:49.0468 3636 HTTP (f6aacf5bce2893e0c1754afeb672e5c9) C:\WINDOWS\system32\Drivers\HTTP.sys
10:13:49.0515 3636 HTTP - ok
10:13:50.0484 3636 i2omgmt - ok
10:13:51.0375 3636 i2omp - ok
10:13:52.0265 3636 i8042prt (c528e27945367191e7bae364930b6932) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
10:13:52.0281 3636 i8042prt - ok
10:13:53.0359 3636 ialm (da58a8be6a445835f603720c4bc8837e) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
10:13:53.0359 3636 ialm - ok
10:13:54.0171 3636 IdeBusDr (791f0829de88dd0ca77192f0dfad03b6) C:\WINDOWS\system32\DRIVERS\IdeBusDr.sys
10:13:54.0171 3636 IdeBusDr - ok
10:13:56.0203 3636 IdeChnDr (7d2b8be9e89628663c1fb571f7c34062) C:\WINDOWS\system32\DRIVERS\IdeChnDr.sys
10:13:56.0203 3636 IdeChnDr - ok
10:13:57.0078 3636 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
10:13:57.0078 3636 Imapi - ok
10:13:57.0890 3636 ini910u - ok
10:13:58.0703 3636 IntelIde (57d928e548b38502abba7a77a6eb7312) C:\WINDOWS\system32\DRIVERS\intelide.sys
10:13:58.0703 3636 IntelIde - ok
10:13:59.0671 3636 intelppm (27b290d632af2cf3cf40bfddb7370985) C:\WINDOWS\system32\DRIVERS\intelppm.sys
10:13:59.0796 3636 intelppm - ok
10:14:00.0781 3636 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
10:14:00.0781 3636 Ip6Fw - ok
10:14:01.0578 3636 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
10:14:01.0593 3636 IpFilterDriver - ok
10:14:02.0578 3636 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
10:14:02.0578 3636 IpInIp - ok
10:14:03.0578 3636 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
10:14:03.0593 3636 IpNat - ok
10:14:04.0500 3636 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
10:14:04.0515 3636 IPSec - ok
10:14:05.0328 3636 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
10:14:05.0328 3636 IRENUM - ok
10:14:06.0171 3636 isapnp (cc9f8a2d60aed1a51a3ac34c59b987ae) C:\WINDOWS\system32\DRIVERS\isapnp.sys
10:14:06.0171 3636 isapnp - ok
10:14:07.0203 3636 Kbdclass (1b6162fe7f66b1a71a4b70f941c4aa9b) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
10:14:07.0218 3636 Kbdclass - ok
10:14:08.0406 3636 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
10:14:08.0515 3636 kmixer - ok
10:14:09.0390 3636 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
10:14:09.0390 3636 KSecDD - ok
10:14:10.0421 3636 lbrtfdc - ok
10:14:11.0390 3636 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
10:14:11.0406 3636 mnmdd - ok
10:14:12.0375 3636 Modem (44032b0c6d9954d3fd26438330b99ee7) C:\WINDOWS\system32\drivers\Modem.sys
10:14:12.0390 3636 Modem - ok
10:14:13.0609 3636 Mouclass (4cb582831dbde63ce43b45d771218374) C:\WINDOWS\system32\DRIVERS\mouclass.sys
10:14:13.0609 3636 Mouclass - ok
10:14:15.0437 3636 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
10:14:15.0437 3636 MountMgr - ok
10:14:16.0250 3636 mraid35x - ok
10:14:17.0375 3636 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
10:14:17.0375 3636 MRxDAV - ok
10:14:18.0484 3636 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
10:14:18.0515 3636 MRxSmb - ok
10:14:19.0484 3636 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
10:14:19.0500 3636 Msfs - ok
10:14:20.0343 3636 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
10:14:20.0343 3636 MSKSSRV - ok
10:14:21.0187 3636 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
10:14:21.0187 3636 MSPCLOCK - ok
10:14:22.0015 3636 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
10:14:22.0015 3636 MSPQM - ok
10:14:22.0859 3636 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
10:14:22.0859 3636 mssmbios - ok
10:14:25.0062 3636 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
10:14:25.0062 3636 Mup - ok
10:14:25.0921 3636 NAL (ab7cc5ddfa1557bab312e12abb6a5158) C:\WINDOWS\System32\Drivers\iqvw32.sys
10:14:25.0921 3636 NAL - ok
10:14:26.0875 3636 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
10:14:26.0875 3636 NDIS - ok
10:14:28.0015 3636 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
10:14:28.0031 3636 NdisTapi - ok
10:14:28.0953 3636 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
10:14:28.0953 3636 Ndisuio - ok
10:14:30.0031 3636 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
10:14:30.0046 3636 NdisWan - ok
10:14:30.0921 3636 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
10:14:30.0921 3636 NDProxy - ok
10:14:30.0921 3636 Suspicious service (NoAccess): nebyz
10:14:31.0859 3636 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
10:14:31.0859 3636 NetBIOS - ok
10:14:33.0062 3636 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
10:14:33.0062 3636 NetBT - ok
10:14:33.0937 3636 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
10:14:33.0937 3636 Npfs - ok
10:14:35.0546 3636 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
10:14:35.0578 3636 Ntfs - ok
10:14:37.0062 3636 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
10:14:37.0062 3636 Null - ok
10:14:37.0984 3636 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
10:14:38.0000 3636 NwlnkFlt - ok
10:14:38.0796 3636 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
10:14:38.0796 3636 NwlnkFwd - ok
10:14:39.0875 3636 Parport (46f8db73b4a53e543f8e371dc7c75bae) C:\WINDOWS\system32\DRIVERS\parport.sys
10:14:39.0890 3636 Parport - ok
10:14:40.0796 3636 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
10:14:40.0796 3636 PartMgr - ok
10:14:42.0218 3636 ParVdm (1fae19d0457176318bba4a8795656ebc) C:\WINDOWS\system32\drivers\ParVdm.sys
10:14:42.0265 3636 ParVdm - ok
10:14:43.0718 3636 PCI (6ce351d149cb4befc702951e471e1730) C:\WINDOWS\system32\DRIVERS\pci.sys
10:14:43.0765 3636 PCI - ok
10:14:44.0578 3636 PCIDump - ok
10:14:45.0437 3636 PCIIde (2da4ec85e0ea7a45c6b2a05820492d5a) C:\WINDOWS\system32\drivers\PCIIde.sys
10:14:45.0437 3636 PCIIde - ok
10:14:46.0453 3636 Pcmcia (4fc31e6c19a5ce5198b1abff94cae758) C:\WINDOWS\system32\drivers\Pcmcia.sys
10:14:46.0484 3636 Pcmcia - ok
10:14:47.0656 3636 PDCOMP - ok
10:14:49.0265 3636 PDFRAME - ok
10:14:50.0062 3636 PDRELI - ok
10:14:50.0968 3636 PDRFRAME - ok
10:14:51.0828 3636 perc2 - ok
10:14:52.0671 3636 perc2hib - ok
10:14:53.0593 3636 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
10:14:53.0593 3636 PptpMiniport - ok
10:14:54.0453 3636 Processor (7eb15dce4ec3a0220bd796a15c18186e) C:\WINDOWS\system32\DRIVERS\processr.sys
10:14:54.0453 3636 Processor - ok
10:14:55.0578 3636 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
10:14:55.0609 3636 PSched - ok
10:14:56.0453 3636 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
10:14:56.0515 3636 Ptilink - ok
10:14:57.0296 3636 ql1080 - ok
10:14:58.0156 3636 Ql10wnt - ok
10:14:58.0906 3636 ql12160 - ok
10:14:59.0812 3636 ql1240 - ok
10:15:00.0703 3636 ql1280 - ok
10:15:01.0500 3636 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
10:15:01.0515 3636 RasAcd - ok
10:15:02.0625 3636 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
10:15:02.0640 3636 Rasl2tp - ok
10:15:03.0671 3636 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
10:15:03.0687 3636 RasPppoe - ok
10:15:04.0781 3636 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
10:15:04.0781 3636 Raspti - ok
10:15:07.0296 3636 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
10:15:07.0343 3636 Rdbss - ok
10:15:09.0406 3636 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
10:15:09.0406 3636 RDPCDD - ok
10:15:10.0625 3636 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
10:15:10.0734 3636 rdpdr - ok
10:15:11.0765 3636 RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
10:15:11.0843 3636 RDPWD - ok
10:15:12.0703 3636 redbook (611bfd220305be3a85ae876ea47d4aa5) C:\WINDOWS\system32\DRIVERS\redbook.sys
10:15:12.0703 3636 redbook - ok
10:15:14.0062 3636 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
10:15:14.0078 3636 Secdrv - ok
10:15:14.0984 3636 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
10:15:14.0984 3636 serenum - ok
10:15:15.0875 3636 Serial (b842729337c9b921615c40d3c1a1af96) C:\WINDOWS\system32\DRIVERS\serial.sys
10:15:15.0875 3636 Serial - ok
10:15:16.0703 3636 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
10:15:16.0703 3636 Sfloppy - ok
10:15:17.0656 3636 Simbad - ok
10:15:18.0843 3636 smwdm (70b8dd8707dbf6142530c106365df67d) C:\WINDOWS\system32\drivers\smwdm.sys
10:15:18.0859 3636 smwdm - ok
10:15:19.0796 3636 Sparrow - ok
10:15:20.0703 3636 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
10:15:20.0718 3636 splitter - ok
10:15:21.0625 3636 sr (94610c8653635e4459316a0050d55ce7) C:\WINDOWS\system32\DRIVERS\sr.sys
10:15:21.0640 3636 sr - ok
10:15:22.0625 3636 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
10:15:22.0640 3636 Srv - ok
10:15:23.0703 3636 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
10:15:23.0734 3636 swenum - ok
10:15:24.0578 3636 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
10:15:24.0578 3636 swmidi - ok
10:15:25.0406 3636 symc810 - ok
10:15:26.0187 3636 symc8xx - ok
10:15:26.0953 3636 sym_hi - ok
10:15:27.0890 3636 sym_u3 - ok
10:15:29.0000 3636 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
10:15:29.0140 3636 sysaudio - ok
10:15:30.0218 3636 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
10:15:30.0265 3636 Tcpip - ok
10:15:31.0093 3636 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
10:15:31.0109 3636 TDPIPE - ok
10:15:32.0031 3636 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
10:15:32.0031 3636 TDTCP - ok
10:15:32.0921 3636 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
10:15:32.0921 3636 TermDD - ok
10:15:33.0765 3636 TosIde - ok
10:15:36.0000 3636 tosporte (8d624d3bd1f2d78bd1c01a2d4e954b4e) C:\WINDOWS\system32\DRIVERS\tosporte.sys
10:15:36.0015 3636 tosporte - ok
10:15:37.0125 3636 tosrfbd (266df087a8c24da34ff40cf3df86ccfb) C:\WINDOWS\system32\DRIVERS\tosrfbd.sys
10:15:37.0140 3636 tosrfbd - ok
10:15:38.0046 3636 tosrfbnp (90c8525bc578aaffe87c2d0ed4379e9e) C:\WINDOWS\system32\Drivers\tosrfbnp.sys
10:15:38.0046 3636 tosrfbnp - ok
10:15:39.0000 3636 Tosrfcom (5ba1ca3b3cddb1ddc67df473f05d1ec2) C:\WINDOWS\system32\Drivers\tosrfcom.sys
10:15:39.0187 3636 Tosrfcom - ok
10:15:40.0140 3636 Tosrfhid (7c807ba9660e2995cc0217a14a24094c) C:\WINDOWS\system32\DRIVERS\Tosrfhid.sys
10:15:40.0140 3636 Tosrfhid - ok
10:15:40.0984 3636 tosrfnds (c52fd27b9adf3a1f22cb90e6bcf9b0cb) C:\WINDOWS\system32\DRIVERS\tosrfnds.sys
10:15:41.0000 3636 tosrfnds - ok
10:15:42.0078 3636 TosRfSnd (a4ce9572bc4ac8d329455059b43c5bea) C:\WINDOWS\system32\drivers\tosrfsnd.sys
10:15:42.0109 3636 TosRfSnd - ok
10:15:42.0953 3636 tosrfusb (602818649c84eb774d6971da65f79cc8) C:\WINDOWS\system32\DRIVERS\tosrfusb.sys
10:15:42.0953 3636 tosrfusb - ok
10:15:43.0921 3636 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
10:15:43.0937 3636 Udfs - ok
10:15:44.0703 3636 ultra - ok
10:15:45.0703 3636 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
10:15:45.0718 3636 Update - ok
10:15:46.0578 3636 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
10:15:46.0578 3636 usbccgp - ok
10:15:48.0546 3636 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
10:15:48.0593 3636 usbehci - ok
10:15:49.0453 3636 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
10:15:49.0453 3636 usbhub - ok
10:15:50.0343 3636 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
10:15:50.0343 3636 usbprint - ok
10:15:51.0156 3636 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
10:15:51.0171 3636 usbscan - ok
10:15:52.0031 3636 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
10:15:52.0046 3636 USBSTOR - ok
10:15:52.0921 3636 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
10:15:52.0921 3636 usbuhci - ok
10:15:54.0218 3636 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
10:15:54.0218 3636 VgaSave - ok
10:15:55.0031 3636 ViaIde - ok
10:15:55.0843 3636 VolSnap (28a4b296b47782173c346e376cb374d1) C:\WINDOWS\system32\drivers\VolSnap.sys
10:15:55.0843 3636 VolSnap - ok
10:15:56.0671 3636 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
10:15:56.0687 3636 Wanarp - ok
10:15:57.0453 3636 WDICA - ok
10:15:58.0359 3636 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
10:15:58.0375 3636 wdmaud - ok
10:15:58.0546 3636 MBR (0x1B8) (413fc2a0c716421b3158746d63736515) \Device\Harddisk0\DR0
10:15:58.0843 3636 \Device\Harddisk0\DR0 - ok
10:15:58.0859 3636 Boot (0x1200) (4c53893fb8c58b019fa07b8a8aa43122) \Device\Harddisk0\DR0\Partition0
10:15:58.0859 3636 \Device\Harddisk0\DR0\Partition0 - ok
10:15:58.0859 3636 ============================================================
10:15:58.0859 3636 Scan finished
10:15:58.0859 3636 ============================================================
10:15:58.0906 3624 Detected object count: 0
10:15:58.0906 3624 Actual detected object count: 0

Stahnete aswMBR http://public.avast.com/%7Egmerek/aswMBR.exe a ulozte jej na plochu.

Utilitu spustte a prikazte ji, at skenuje - klik na Scan
Kliknutim na Save log ulozte log aswMBR na plochu
Obsah logu aswMBR mi sem vlozte

aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
Run date: 2011-11-29 10:47:26
-----------------------------
10:47:26.187 OS Version: Windows 5.1.2600 Service Pack 3
10:47:26.187 Number of processors: 1 586 0x209
10:47:26.187 ComputerName: ALENA-A5CVAFFXM UserName: Cajnik
10:47:29.812 Initialize success
10:47:31.265 AVAST engine defs: 11112802
10:47:59.234 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
10:47:59.234 Disk 0 Vendor: WDC_WD400EB-75CPF0 06.04G06 Size: 38166MB BusType: 3
10:47:59.265 Disk 0 MBR read successfully
10:47:59.265 Disk 0 MBR scan
10:47:59.265 Disk 0 Windows XP default MBR code
10:47:59.281 Disk 0 scanning sectors +78140160
10:47:59.453 Disk 0 scanning C:\WINDOWS\system32\drivers
10:48:31.781 Service scanning
10:48:34.859 Modules scanning
10:48:51.515 Disk 0 trace - called modules:
10:48:51.546 ntoskrnl.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll
10:48:51.546 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x82389ab8]
10:48:51.546 3 CLASSPNP.SYS[f8577fd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x823d0d98]
10:48:52.500 AVAST engine scan C:\WINDOWS
10:49:01.828 AVAST engine scan C:\WINDOWS\system32
10:55:12.156 AVAST engine scan C:\WINDOWS\system32\drivers
10:55:36.656 AVAST engine scan C:\Documents and Settings\Cajnik
11:04:55.468 AVAST engine scan C:\Documents and Settings\All Users
11:05:41.500 Scan finished successfully
11:08:01.328 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Cajnik\Plocha\MBR.dat"
11:08:01.343 The log file has been saved successfully to "C:\Documents and Settings\Cajnik\Plocha\aswMBR.txt"

Omlouvam se za vstup

Kdyz spustite Avast, kliknete na Testovat pocitac, objevi se vam napis Zaznamy testu. Nenajdete tam vysledky toho testu a nazvem toho souboru?
Jestli ano, napiste ho sem.

Preji uspesne doreseni

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\85IJODIZ\yozdt[1].bmp

Závažnost: Vysoká
Stav: Hrozba: Win32:Rootkit-gen [Rtk]
Akce: Přesunut do Truhly
Výsledek: Akce proběhla úspěšně

Dekuji kolegovi za vstup, tohle nam hodne pomuze

Stahnete OTM (viz muj podpis)

Pokud pouzivate Win Vista ci W7, kliknete na OTM pravym a dejte Run As Administrator ci Spustit jako spravce
Do leveho okna Paste Instructions for Items to be Moved (pod zlutou caru) vlozte obsah, ktery mate nize

Kód: Vybrat vše

:reg
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BrowserChoice]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

:files
C:\Documents and Settings\Cajnik\Data aplikací\Mozilla\Firefox\Profiles\yc85q8jm.default\searchplugins\askcom.xml
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\*.*
%windir%\system32\*.tmp.dll /s
%windir%\system32\SET*.tmp /s
%windir%\*.tmp

:commands
[RESETHOSTS]
[EMPTYTEMP]
[EMPTYFLASH]

Kliknete na cervene tlacitko MoveIt!
Budete vyzvani na restart, dejte Yes, log pote najdete C:\_OTM\MovedFiles, obsah sem vlozte

All processes killed
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BrowserChoice\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task\ deleted successfully.
========== FILES ==========
C:\Documents and Settings\Cajnik\Data aplikací\Mozilla\Firefox\Profiles\yc85q8jm.default\searchplugins\askcom.xml moved successfully.
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\desktop.ini moved successfully.
File/Folder C:\WINDOWS\system32\*.tmp.dll not found.
File/Folder C:\WINDOWS\system32\SET*.tmp not found.
C:\WINDOWS\SET3.tmp moved successfully.
C:\WINDOWS\SET51.tmp moved successfully.
C:\WINDOWS\SET52.tmp moved successfully.
C:\WINDOWS\SET5E.tmp moved successfully.
C:\WINDOWS\SETA.tmp moved successfully.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 26941149 bytes
->Temporary Internet Files folder emptied: 66280780 bytes
->Flash cache emptied: 65038 bytes

User: All Users

User: Cajnik
->Temp folder emptied: 24838071 bytes
->Temporary Internet Files folder emptied: 15986070 bytes
->FireFox cache emptied: 48611396 bytes
->Flash cache emptied: 721 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 133487 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 402 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 2504 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 692612 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 104415 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 4049620 bytes
RecycleBin emptied: 86563674 bytes

Total Files Cleaned = 262,00 mb

[EMPTYFLASH]

User: Administrator
->Flash cache emptied: 0 bytes

User: All Users

User: Cajnik
->Flash cache emptied: 0 bytes

User: Default User

User: LocalService

User: NetworkService

Total Flash Files Cleaned = 0,00 mb

OTM by OldTimer - Version 3.1.19.0 log created on 11292011_140558

Files moved on Reboot...
File move failed. C:\WINDOWS\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...

jak se chova nas pacient

Zdá se, že je stabilizován a reaguje o poznání svižněji. Děkuji mnohokrát!

Tak jeste uklidime

T-Cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe

Stahnete a spustte
Pro potvrzeni volby mackejte A, Enter
Po pouziti utilitu smazte
Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

OTC http://oldtimer.geekstogo.com/OTC.exe

Stahnete a spustte
Kliknete na CleanUp a potvrdte YES
Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

Stahnete a spustte
Kliknete na Start a potvrdte OK
Program uklidi a restartuje pc
Po pouziti utilitu smazte

Stahnete Ccleaner (viz muj podpis)
Panel čistič

Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

dejte Hledej problémy
nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za tyden

Doporucuji provest defragmentaci disku

Nejjednodussi (ale nejmene ucinny) zpusob je pomoci utility ve windowsech
- Kliknete na Tento pocitac, dale na disk kliknete pravym tlacitkem, vyberte Vlastnosti
- prepnete se do zalozky Nastroje
- Nyni vidite pomucky Defragmentace - spustte ji kliknutim na Defragmentovat
- Toto provedte se vsemi disky
Dalsi moznosti (a mnou doporucenou) je pres programek Defraggler http://www.stahuj.centrum.cz/utility_a_ ... efraggler/
- Program stahnete, nainstalujte (dejte fajfku pryc u yahoo toolbaru) a spustte
- Kliknete na Analyzovat
- Pokud je ve sloupci Fragmentováno vice jak 5%, doporucuji provest defragmentaci (klik na Defragmentovat)
- Postup provedte se vsemi disky
Posledni moznost je pres jednoduchy programek JKDefrag http://www.stahuj.centrum.cz/utility_a_ ... /jkdefrag/
- Vyhodou programku je, ze se neinstaluje
- Staci tedy jen stahnout dle verze vaseho OS a rozbalit
- Nasledne spustit pomoci souboru JKDefrag pripadne JKDefrag64
- Probehne analyza disku a nasledne i defragmentace

A pokud nejsou problemy ci dotazy, je to z nasi strany vse

jinak i za kolegu, nemate zac, rado se stalo

VIRY.CZ

avast nasel rootkit

avast nasel rootkit

Re: avast nasel rootkit

Re: avast nasel rootkit

Re: avast nasel rootkit

Re: avast nasel rootkit

Re: avast nasel rootkit

Re: avast nasel rootkit

Re: avast nasel rootkit

Re: avast nasel rootkit

Re: avast nasel rootkit

Re: avast nasel rootkit

Re: avast nasel rootkit