VIRY.CZ

Dobry den,
Microsoft essentials mi dnes ohlasil tento virus, s tym ze mam problem so zobrazivanim stranok v IE, FF, Chrome. Viete mi pomoct?

Prikladam log z RSIT:

Logfile of random's system information tool 1.09 (written by random/random)
Run by baril_pa at 2011-12-04 08:35:51
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 218 GB (76%) free of 288 GB
Total RAM: 1967 MB (35% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 8:35:59, on 4. 12. 2011
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Users\baril_pa\AppData\Roaming\B0AB3\9882D.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Program Files (x86)\LP\2DCB\A82.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\B3460\lvvm.exe
C:\Users\baril_pa\Downloads\RSIT.exe
C:\Program Files (x86)\trend micro\baril_pa.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.bing.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.bing.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:58242
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [A82.exe] C:\Program Files (x86)\LP\2DCB\A82.exe
O4 - HKCU\..\Run: [Thunderbird] "C:\Program Files (x86)\Mozilla Thunderbird\thunderbird" -turbo
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files (x86)\uTorrent\uTorrent.exe" /MINIMIZED
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&oslať do programu OneNote - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
O8 - Extra context menu item: Odoslať obrázok do &Zariadenia s rozhraním Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Odoslať stránku do &Zariadenia s rozhraním Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O8 - Extra context menu item: Translate this web page with Babylon - res://C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm
O8 - Extra context menu item: Translate with Babylon - res://C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Action.htm
O9 - Extra button: Odoslať do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&oslať do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: &Prepojené poznámky programu OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: &Prepojené poznámky programu OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: Odoslať do rozhrania Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: Odoslať do &Zariadenie s rozhraním Bluetooth... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {45830FF9-D9E6-4F41-86ED-B266933D8E90} (RtspVaPgCtrlNew Class) - http://192.168.133.165/RtspVaPgDec.cab
O16 - DPF: {73888E2B-FF04-416C-8847-984D7FC4507F} (RtspVaPgCtrlNew2 Class) - http://192.168.1.3/RtspVaPgDecNew2.cab
O16 - DPF: {F8E691A0-C92E-4E42-9CDA-62FC07A9483B} (nvUnifiedControl Control) - http://actiftp.hosting4less.com/ACTIGEN ... ontrol.ocx
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = intechgroup.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = intechgroup.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = intechgroup.local
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b20011ea53a6b83e\AESTSr64.exe
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - LSI Corporation - C:\Program Files\LSI SoftModem\agr64svc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\windows\system32\atiesrxx.exe (file missing)
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\windows\system32\fxssvc.exe (file missing)
O23 - Service: HP Health Check Service - Unknown owner - C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe (file missing)
O23 - Service: HP Service (hpsrv) - Unknown owner - C:\windows\system32\Hpservice.exe (file missing)
O23 - Service: Intel(R) Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Seagate Scheduler2 Service (SgtSch2Svc) - Unknown owner - C:\Program Files (x86)\Common Files\Seagate\Schedule2\schedul2.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\windows\system32\sppsvc.exe (file missing)
O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b20011ea53a6b83e\STacSV64.exe
O23 - Service: TeamViewer 6 (TeamViewer6) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management & Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Validity VCS Fingerprint Service (vcsFPService) - Validity Sensors, Inc. - C:\windows\system32\vcsFPService.exe
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: webcamXP Service (wxpSvc) - Unknown owner - C:\Program Files (x86)\webcamXP 5\wService.exe

--
End of file - 11789 bytes

=========Mozilla firefox=========

ProfilePath - C:\Users\baril_pa\AppData\Roaming\Mozilla\Firefox\Profiles\3a0tzbjw.default

prefs.js - "extensions.enabledItems" - "{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.4"

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\windows\SysWOW64\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/ShockwavePlayer]
"Description"=Adobe Shockwave Player
"Path"=C:\windows\system32\Adobe\Director\np32dsw.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

C:\Program Files (x86)\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files (x86)\Mozilla Firefox\components\
binary.manifest
browsercomps.dll
nsIQTScriptablePlugin.xpt

C:\Program Files (x86)\Mozilla Firefox\searchplugins\
atlas-sk.xml
azet-sk.xml
dunaj-sk.xml
eBay.xml
google.xml
slovnik-sk.xml
wikipedia-sk.xml
zoznam-sk.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-09-05 63912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18 403840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL [2010-12-21 561552]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2011-06-27 42272]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"=C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [2010-03-04 284696]
"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2010-08-05 98304]
"APSDaemon"=C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [2011-09-27 59240]
"QuickTime Task"=C:\Program Files (x86)\QuickTime\QTTask.exe [2011-10-24 421888]
"ST7501"= []
"A82.exe"=C:\Program Files (x86)\LP\2DCB\A82.exe [2011-12-04 287232]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Thunderbird"=C:\Program Files (x86)\Mozilla Thunderbird\thunderbird -turbo []
"Skype"=C:\Program Files (x86)\Skype\Phone\Skype.exe [2011-10-13 17351304]
"uTorrent"=C:\Program Files (x86)\uTorrent\uTorrent.exe [2011-10-20 641400]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0
"HideSCAHealth"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files (x86)\xchat\xchat.exe"="C:\Program Files (x86)\xchat\xchat.exe:*:Enabled:XChat IRC Client"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\SysWOW64\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*
.scr - open - C:\windows\system32\notepad.exe "%1"
.scr - install -
.scr - config -

======List of files/folders created in the last 1 month======

2011-12-04 08:35:51 ----D---- C:\rsit
2011-12-04 08:35:51 ----D---- C:\Program Files (x86)\trend micro
2011-12-04 08:30:01 ----D---- C:\Program Files (x86)\LP
2011-12-04 07:41:36 ----D---- C:\Program Files (x86)\ESET
2011-12-03 20:43:50 ----D---- C:\Program Files (x86)\B3460
2011-12-03 20:43:16 ----D---- C:\Users\baril_pa\AppData\Roaming\B0AB3
2011-12-03 14:20:04 ----D---- C:\Crystal Bowl Healing
2011-12-03 14:07:29 ----D---- C:\Chakra Meditation Music
2011-12-02 18:22:15 ----D---- C:\log
2011-12-01 20:09:06 ----D---- C:\ProgramData\webcamXP 5
2011-12-01 20:09:02 ----D---- C:\Program Files (x86)\webcamXP 5
2011-11-29 22:12:25 ----D---- C:\Users\baril_pa\AppData\Roaming\Dropbox
2011-11-29 10:35:05 ----D---- C:\ProgramData\Apple Computer
2011-11-29 10:35:05 ----D---- C:\Program Files (x86)\QuickTime
2011-11-29 10:30:52 ----D---- C:\Program Files (x86)\Apple Software Update
2011-11-25 19:39:47 ----D---- C:\Program Files (x86)\Subtitle Edit
2011-11-25 19:32:18 ----D---- C:\Program Files (x86)\URUSoft
2011-11-23 22:37:22 ----A---- C:\windows\SysWOW64\D3DCompiler_43.dll
2011-11-23 22:37:21 ----A---- C:\windows\SysWOW64\D3DX9_43.dll
2011-11-23 12:28:52 ----D---- C:\windows\SysWOW64\VivotekIPP
2011-11-22 17:53:36 ----D---- C:\Program Files (x86)\Common Files\Intel Corporation
2011-11-17 13:07:04 ----A---- C:\windows\Language_trs.ini
2011-11-17 13:06:55 ----A---- C:\windows\Ascd_tmp.ini
2011-11-13 20:59:36 ----D---- C:\Users\baril_pa\AppData\Roaming\Mirillis
2011-11-13 20:59:36 ----D---- C:\ProgramData\Mirillis
2011-11-11 12:24:05 ----D---- C:\Users\baril_pa\AppData\Roaming\OutlookSync
2011-11-11 12:24:04 ----D---- C:\Users\baril_pa\AppData\Roaming\FolderSync
2011-11-11 12:23:44 ----D---- C:\Users\baril_pa\AppData\Roaming\PQI

======List of files/folders modified in the last 1 month======

2011-12-04 08:35:51 ----RD---- C:\Program Files (x86)
2011-12-04 08:35:49 ----D---- C:\Users\baril_pa\AppData\Roaming\uTorrent
2011-12-04 08:35:46 ----D---- C:\Users\baril_pa\AppData\Roaming\Skype
2011-12-04 08:34:46 ----D---- C:\windows\Temp
2011-12-04 08:32:59 ----A---- C:\windows\SysWOW64\log.txt
2011-12-04 08:32:41 ----HD---- C:\ProgramData
2011-12-04 08:30:29 ----D---- C:\windows\Prefetch
2011-12-04 08:16:29 ----D---- C:\windows\System32
2011-12-04 08:16:29 ----D---- C:\windows\inf
2011-12-04 08:14:08 ----SHD---- C:\System Volume Information
2011-12-04 08:09:57 ----D---- C:\Windows
2011-12-04 08:07:55 ----D---- C:\Users\baril_pa\AppData\Roaming\X-Chat 2
2011-12-04 07:54:13 ----D---- C:\Users\baril_pa\AppData\Roaming\GHISLER
2011-12-03 14:20:57 ----D---- C:\Users\baril_pa\AppData\Roaming\foobar2000
2011-12-01 21:16:39 ----D---- C:\Users\baril_pa\AppData\Roaming\Media Player Classic
2011-12-01 21:13:18 ----SHD---- C:\windows\Installer
2011-12-01 21:13:18 ----HD---- C:\Config.Msi
2011-12-01 20:09:08 ----D---- C:\windows\SysWOW64
2011-11-29 15:56:23 ----D---- C:\Users\baril_pa\AppData\Roaming\Apple Computer
2011-11-29 11:53:45 ----D---- C:\Users\baril_pa\AppData\Roaming\vlc
2011-11-26 18:30:22 ----D---- C:\windows\Logs
2011-11-26 18:29:08 ----D---- C:\Program Files (x86)\Acro Software
2011-11-26 18:28:42 ----RD---- C:\Program Files
2011-11-25 19:40:32 ----D---- C:\Users\baril_pa\AppData\Roaming\Subtitle Edit
2011-11-25 19:40:08 ----RSD---- C:\windows\assembly
2011-11-23 12:28:53 ----D---- C:\windows\Downloaded Program Files
2011-11-23 11:46:44 ----D---- C:\Program Files (x86)\VIVOTEK Inc
2011-11-23 10:50:09 ----D---- C:\Program Files (x86)\Common Files
2011-11-22 08:39:59 ----RSD---- C:\windows\Fonts
2011-11-20 23:20:42 ----D---- C:\Users\baril_pa\AppData\Roaming\FTPRush
2011-11-17 13:06:52 ----D---- C:\windows\SysWOW64\drivers
2011-11-10 18:54:09 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2011-11-10 18:49:52 ----D---- C:\windows\debug
2011-11-10 17:50:12 ----D---- C:\windows\winsxs
2011-11-10 09:26:33 ----D---- C:\Program Files (x86)\Common Files\System
2011-11-10 08:11:51 ----D---- C:\ProgramData\Microsoft Help
2011-11-09 07:42:09 ----D---- C:\Program Files (x86)\Mozilla Thunderbird
2011-11-08 20:32:11 ----D---- C:\Program Files (x86)\Mozilla Firefox

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 hpdskflt;HP Filter; C:\windows\system32\DRIVERS\hpdskflt.sys []
R0 iaStor;Intel AHCI Controller; C:\windows\system32\DRIVERS\iaStor.sys []
R0 rdyboost;ReadyBoost; C:\windows\System32\drivers\rdyboost.sys []
R0 timounter;Seagate DiscWizard Image Backup Archive Explorer; C:\windows\system32\DRIVERS\timntr.sys []
R0 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\windows\system32\drivers\vmbus.sys []
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\windows\system32\drivers\csc.sys []
R1 MpFilter;Microsoft Malware Protection Driver; C:\windows\system32\DRIVERS\MpFilter.sys []
R1 vpcnfltr;Virtual PC Network Filter Driver; C:\windows\system32\DRIVERS\vpcnfltr.sys []
R1 vpcvmm;@%SystemRoot%\system32\drivers\vpcvmm.sys,-100; C:\windows\system32\drivers\vpcvmm.sys []
R1 vwififlt;Virtual WiFi Filter Driver; C:\windows\system32\DRIVERS\vwififlt.sys []
R2 tifsfilter;Seagate DiscWizard FS Filter; C:\windows\system32\DRIVERS\tifsfilt.sys []
R3 Accelerometer;HP Mobile Data Protection Sensor; C:\windows\system32\DRIVERS\Accelerometer.sys []
R3 Afc;PPdus ASPI Shell; C:\windows\SysWOW64\drivers\Afc.sys [2006-11-14 22784]
R3 AgereSoftModem;Agere Systems Soft Modem; C:\windows\system32\DRIVERS\agrsm64.sys []
R3 amdkmdag;amdkmdag; C:\windows\system32\DRIVERS\atikmdag.sys []
R3 amdkmdap;amdkmdap; C:\windows\system32\DRIVERS\atikmpag.sys []
R3 AtiHdmiService;ATI Function Driver for High Definition Audio Service; C:\windows\system32\drivers\AtiHdmi.sys []
R3 BCM43XX;Broadcom 802.11 Network Adapter Driver; C:\windows\system32\DRIVERS\bcmwl664.sys []
R3 BthEnum;Bluetooth Request Block Driver; C:\windows\system32\drivers\BthEnum.sys []
R3 BthPan;Bluetooth Device (Personal Area Network); C:\windows\system32\DRIVERS\bthpan.sys []
R3 BTHUSB;Bluetooth Radio USB Driver; C:\windows\System32\Drivers\BTHUSB.sys []
R3 btwampfl;Bluetooth AMP USB Filter; C:\windows\system32\drivers\btwampfl.sys []
R3 btwaudio;Bluetooth Audio Device Service; C:\windows\system32\drivers\btwaudio.sys []
R3 btwavdt;Bluetooth AVDT Service; C:\windows\system32\DRIVERS\btwavdt.sys []
R3 btwl2cap;Bluetooth L2CAP Service; C:\windows\system32\DRIVERS\btwl2cap.sys []
R3 btwrchid;btwrchid; C:\windows\system32\DRIVERS\btwrchid.sys []
R3 HECIx64;Intel(R) Management Engine Interface; C:\windows\system32\DRIVERS\HECIx64.sys []
R3 Impcd;Impcd; C:\windows\system32\DRIVERS\Impcd.sys []
R3 NisDrv;Microsoft Network Inspection System; C:\windows\system32\DRIVERS\NisDrvWFP.sys []
R3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\windows\system32\DRIVERS\rfcomm.sys []
R3 RTL8167;Realtek 8167 NT Driver; C:\windows\system32\DRIVERS\Rt64win7.sys []
R3 SNP2UVC;USB2.0 PC Camera (SNP2UVC); C:\windows\system32\DRIVERS\snp2uvc.sys []
R3 STHDA;IDT High Definition Audio CODEC; C:\windows\system32\DRIVERS\stwrt64.sys []
R3 SynTP;Synaptics TouchPad Driver; C:\windows\system32\DRIVERS\SynTP.sys []
R3 vpcbus;Virtual PC Host Bus Service; C:\windows\system32\DRIVERS\vpchbus.sys []
R3 vpcusb;USB Virtualization Connector Service; C:\windows\system32\DRIVERS\vpcusb.sys []
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\windows\system32\DRIVERS\vwifimp.sys []
R3 WinUSB;WinUSB Service; C:\windows\system32\DRIVERS\WinUSB.sys []
S3 ALSysIO;ALSysIO; \??\C:\Users\baril_pa\AppData\Local\Temp\ALSysIO64.sys []
S3 ARCVCAM;ARCVCAM, ArcSoft Webcam Sharing Manager Driver; C:\windows\system32\DRIVERS\ArcSoftVCapture.sys []
S3 BTHPORT;Bluetooth Port Driver; C:\windows\System32\Drivers\BTHport.sys []
S3 FTDIBUS;USB Serial Converter Driver; C:\windows\system32\drivers\ftdibus.sys []
S3 FTSER2K;USB Serial Port Driver; C:\windows\system32\drivers\ftser2k.sys []
S3 HPFXBULK;HPFXBULK; C:\windows\system32\drivers\hpfx64bulk.sys []
S3 HpqKbFiltr;HpqKbFilter Driver; C:\windows\system32\DRIVERS\HpqKbFiltr.sys []
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\windows\system32\DRIVERS\ewusbmdm.sys []
S3 hwusbdev;Huawei DataCard USB PNP Device; C:\windows\system32\DRIVERS\ewusbdev.sys []
S3 MpNWMon;Microsoft Malware Protection Network Driver; C:\windows\system32\DRIVERS\MpNWMon.sys []
S3 npf;NetGroup Packet Filter Driver; C:\windows\system32\drivers\npf.sys []
S3 pciide;pciide; C:\windows\system32\drivers\pciide.sys []
S3 RDPDR;Terminal Server Device Redirector Driver; C:\windows\System32\drivers\rdpdr.sys []
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader; C:\windows\System32\Drivers\RtsUStor.sys []
S3 s3cap;s3cap; C:\windows\system32\drivers\vms3cap.sys []
S3 sdbus;sdbus; C:\windows\system32\drivers\sdbus.sys []
S3 storvsc;storvsc; C:\windows\system32\drivers\storvsc.sys []
S3 tap0801;TAP-Win32 Adapter V8; C:\windows\system32\DRIVERS\tap0801.sys []
S3 tapoas;TAP-Win32 Adapter OAS; C:\windows\system32\DRIVERS\tapoas.sys []
S3 TPM;TPM; C:\windows\system32\drivers\tpm.sys []
S3 TsUsbFlt;TsUsbFlt; C:\windows\system32\drivers\tsusbflt.sys []
S3 usbscan;USB Scanner Driver; C:\windows\system32\DRIVERS\usbscan.sys []
S3 VMBusHID;VMBusHID; C:\windows\system32\drivers\VMBusHID.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
R2 AESTFilters;Andrea ST Filters Service; C:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b20011ea53a6b83e\AESTSr64.exe [2009-03-03 89600]
R2 AgereModemAudio;Agere Modem Call Progress Audio; C:\Program Files\LSI SoftModem\agr64svc.exe [2009-11-02 16896]
R2 AMD External Events Utility;AMD External Events Utility; C:\windows\system32\atiesrxx.exe []
R2 btwdins;Bluetooth Service; C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe [2010-06-09 952096]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\windows\System32\svchost.exe [2009-07-14 20992]
R2 hpsrv;HP Service; C:\windows\system32\Hpservice.exe []
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology; C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-04 13336]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [2009-06-17 73728]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2009-11-04 268824]
R2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe [2011-04-27 12784]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\windows\System32\svchost.exe [2009-07-14 20992]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\windows\System32\svchost.exe [2009-07-14 20992]
R2 STacSV;Audio Service; C:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b20011ea53a6b83e\STacSV64.exe [2010-03-17 244736]
R2 TeamViewer6;TeamViewer 6; C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-11-03 2358656]
R2 UNS;Intel(R) Management & Security Application User Notification Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-11-04 2320920]
R2 vcsFPService;Validity VCS Fingerprint Service; C:\windows\system32\vcsFPService.exe [2009-12-14 1639728]
R3 NisSrv;@c:\Program Files\Microsoft Security Client\Antimalware\MpAsDesc.dll,-243; c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 288272]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 HP Health Check Service;HP Health Check Service; C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe []
S2 SgtSch2Svc;Seagate Scheduler2 Service; C:\Program Files (x86)\Common Files\Seagate\Schedule2\schedul2.exe []
S3 AppMgmt;@appmgmts.dll,-3250; C:\windows\system32\svchost.exe [2009-07-14 20992]
S3 aspnet_state;ASP.NET State Service; C:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe []
S3 IDriverT;InstallDriver Table Manager; C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [2005-11-14 69632]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\windows\System32\svchost.exe [2009-07-14 20992]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\windows\system32\Wat\WatAdminSvc.exe []
S4 NetMsmqActivator;@C:\windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

-----------------EOF-----------------

Dobrý den

Mrkneme první na havěť podrobněji

Malwarebytes' Anti-Malware Obrázek

Stáhneme,nainstalujeme a spustíme(pokud si nevíte rady jak,klikněte ZDE)
Vybereme Úplná kontrola a klikneme na tlačítko Prohledat
Program provede kontrolu počítače a na konci se vám objeví hláska,že bylo skenování dokončeno,tak potvrdíme tlačítkem OK
Objeví se vám log,který mi sem vložte
NIC NEMAZAT!!Program mívá občas falešné detekce,takže mazat budeme až po konzultaci

prikladam log...

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Verzia databázy: 8307

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

4. 12. 2011 10:43:48
mbam-log-2011-12-04 (10-43-39).txt

Typ kontroly: Úplná kontrola (C:\|F:\|)
Objektov kontrolovaných: 338326
Uplynutý čas: 39 min, 58 sek

Infikované služby pamäte: 1
Infikované moduly pamäte: 0
Infikované registračné kľúče: 0
Infikované registračné hodnoty: 3
Infikované položky registračných dát: 0
Infikované priečinky: 0
Infikované súbory: 2

Infikované služby pamäte:
c:\program files (x86)\LP\2DCB\A82.exe (Backdoor.CycBot) -> 4664 -> No action taken.

Infikované moduly pamäte:
(Škodlivé položky neboli zistené)

Infikované registračné kľúče:
(Škodlivé položky neboli zistené)

Infikované registračné hodnoty:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Hijack.Shell.Gen) -> Value: Shell -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer (PUM.Bad.Proxy) -> Value: ProxyServer -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\A82.exe (Backdoor.CycBot) -> Value: A82.exe -> No action taken.

Infikované položky registračných dát:
(Škodlivé položky neboli zistené)

Infikované priečinky:
(Škodlivé položky neboli zistené)

Infikované súbory:
c:\$Recycle.Bin\s-1-5-21-4238845511-2545688853-254789308-1188\$R7XV1TR.tmp (Spyware.Password) -> No action taken.
c:\program files (x86)\LP\2DCB\A82.exe (Backdoor.CycBot) -> No action taken.

Nalezené položky dejte smazat..

Stáhněte program RogueKiller

Spuste program
Stiskněte klávesu 2 a enter
Objeví se vám log a ten sem vložte
Stějně tak opakujte s volbou 3 a 4 a vložte logy

Program nepoužívejte bez doporučení Rádce a pozorně se řiďte následujících pokynu,protože program netoleruje chyby a může dojít k úplnému poškození systému!!

Stáhneme si Combofix
Program uložíme nejlépe na Plochu
Vypneme všechny rezidentní štíty.Jak antiviru,tak antispywaru a firewallu
Vypneme všechny běžící aplikace (ICQ,prohlížeč,programy) a necháme pouze Combofix
Spustíme Combofix.exe s administrátorským oprávněním
U Windows XP se přihlásíme pod účtem správce
Ve Windows 7 a Vista klikněte pravým tlačítkem myši na Combofix.exe a dejte ,,Spustit jako správce,,)
Hned po startu programu na vás vyskočí licenční podmínky,tak potvrdíme tlačítkemANO
Pokud vám Combofix nabídne instalaci Konzoly pro zotavení,tak souhlaste a nechte nainstalovat(zde je potřeba aktivní připojení na internet)
Pokračujte dle pokynů programu a během skenování na nic neklikejte,na pc nepracujte(ICQ,jiné aplikace,internet..).Nechte počítač v klidu.
Celý sken tvá mezi 5-15 min,ale pokud je v PC hodně havěti,tak se čas může lišit.
Po skončení skenování(případném restartu počítače) se vám zobrazí log z Combofixu,který mi vložte sem(Kdyby se log nezobrazil,tak jej najdete zde: C:\ComboFix.txt
(Pokud si nevíte rady s kterýmkoliv z výše uvedených kroků,tak se ptejte nebo mrkněte na detailnější návod včetně obrázků http://www.bleepingcomputer.com/combofi ... t-combofix )

3 logy...

RogueKiller V6.1.12 [12/02/2011] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.geekstogo.com/forum/files/fi ... guekiller/
Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User: baril_pa [Admin rights]
Mode: Remove -- Date : 12/04/2011 15:19:24

¤¤¤ Bad processes: 2 ¤¤¤
[BLACKLIST] lvvm.exe -- C:\Program Files (x86)\B3460\lvvm.exe -> KILLED [TermProc]
[SUSP PATH] 9882D.exe -- C:\Users\baril_pa\AppData\Roaming\B0AB3\9882D.exe -> KILLED [TermProc]

¤¤¤ Registry Entries: 10 ¤¤¤
[PROXY IE] HKCU\[...]\Internet Settings : ProxyEnable (1) -> NOT REMOVED, USE PROXYFIX
[PROXY IE] HKCU\[...]\Internet Settings : ProxyServer (http=127.0.0.1:58242) -> NOT REMOVED, USE PROXYFIX
[PROXY FF] 3a0tzbjw.default\ 127.0.0.1:58242 -> NOT REMOVED, USE PROXYFIX
[PROXY FF] lshqlik3.default\ 127.0.0.1:58242 -> NOT REMOVED, USE PROXYFIX
[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> REPLACED (2)
[HJ] HKLM\[...]\System : EnableLUA (0) -> REPLACED (1)
[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ] HKCU\[...]\ClassicStartMenu : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ] HKCU\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver: [NOT LOADED] ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
127.0.0.1 localhost127.0.0.1 localhost
127.0.0.1 activate.adobe.com

Finished : << RKreport[1].txt >>
RKreport[1].txt

RogueKiller V6.1.12 [12/02/2011] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.geekstogo.com/forum/files/fi ... guekiller/
Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User: baril_pa [Admin rights]
Mode: HOSTSFix -- Date : 12/04/2011 15:21:57

¤¤¤ Bad processes: 0 ¤¤¤

¤¤¤ Driver: [NOT LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
127.0.0.1 localhost

¤¤¤ Resetted HOSTS: ¤¤¤
127.0.0.1 localhost

Finished : << RKreport[3].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt

RogueKiller V6.1.12 [12/02/2011] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.geekstogo.com/forum/files/fi ... guekiller/
Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User: baril_pa [Admin rights]
Mode: ProxyFix -- Date : 12/04/2011 15:22:27

¤¤¤ Bad processes: 2 ¤¤¤
[SUSP PATH] 9882D.exe -- C:\Users\baril_pa\AppData\Roaming\B0AB3\9882D.exe -> KILLED [TermProc]
[BLACKLIST] lvvm.exe -- C:\Program Files (x86)\B3460\lvvm.exe -> KILLED [TermProc]

¤¤¤ Driver: [NOT LOADED] ¤¤¤

¤¤¤ Registry Entries: 4 ¤¤¤
[PROXY IE] HKCU\[...]\Internet Settings : ProxyEnable (1) -> REPLACED (0)
[PROXY IE] HKCU\[...]\Internet Settings : ProxyServer (http=127.0.0.1:58242) -> DELETED
[PROXY FF] 3a0tzbjw.default\ 127.0.0.1:58242 -> DELETED
[PROXY FF] lshqlik3.default\ 127.0.0.1:58242 -> DELETED

Finished : << RKreport[4].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt ; RKreport[4].txt

Výborně

pokračujte Combofixem

akurat riesim problem s MS security essential...ten combofix mi stal ukazuje, he je aktivny...

komplet vsetky logy...

RogueKiller V6.1.12 [12/02/2011] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.geekstogo.com/forum/files/fi ... guekiller/
Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User: baril_pa [Admin rights]
Mode: Remove -- Date : 12/04/2011 16:13:41

¤¤¤ Bad processes: 3 ¤¤¤
[SUSP PATH] lvvm.exe -- C:\Users\baril_pa\AppData\Roaming\B3460\lvvm.exe -> KILLED [TermProc]
[SUSP PATH] A82.exe -- C:\Users\baril_pa\AppData\Roaming\Microsoft\2DCB\A82.exe -> KILLED [TermProc]
[SUSP PATH] 9882D.exe -- C:\Users\baril_pa\AppData\Roaming\B0AB3\9882D.exe -> KILLED [TermProc]

¤¤¤ Registry Entries: 8 ¤¤¤
[SUSP PATH] HKCU\[...]\Run : A82.exe (C:\Users\baril_pa\AppData\Roaming\Microsoft\2DCB\A82.exe) -> DELETED
[SUSP PATH] HKCU\[...]\Winlogon : Shell (explorer.exe,C:\Users\baril_pa\AppData\Roaming\B0AB3\9882D.exe) -> DELETED
[SUSP PATH] HKCU\[...]\Windows : Load (C:\Users\baril_pa\AppData\Roaming\B3460\lvvm.exe) -> DELETED
[SUSP PATH] At1.job : C:\Users\baril_pa\AppData\Roaming\firefox.exe -> DELETED
[PROXY IE] HKCU\[...]\Internet Settings : ProxyEnable (1) -> NOT REMOVED, USE PROXYFIX
[PROXY IE] HKCU\[...]\Internet Settings : ProxyServer (http=127.0.0.1:58242) -> NOT REMOVED, USE PROXYFIX
[PROXY FF] 3a0tzbjw.default\ 127.0.0.1:58242 -> NOT REMOVED, USE PROXYFIX
[PROXY FF] lshqlik3.default\ 127.0.0.1:58242 -> NOT REMOVED, USE PROXYFIX

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver: [NOT LOADED] ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
127.0.0.1 localhost

RogueKiller V6.1.12 [12/02/2011] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.geekstogo.com/forum/files/fi ... guekiller/
Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User: baril_pa [Admin rights]
Mode: HOSTSFix -- Date : 12/04/2011 16:14:33

¤¤¤ Bad processes: 0 ¤¤¤

¤¤¤ Driver: [NOT LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
127.0.0.1 localhost

¤¤¤ Resetted HOSTS: ¤¤¤
127.0.0.1 localhost

RogueKiller V6.1.12 [12/02/2011] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.geekstogo.com/forum/files/fi ... guekiller/
Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User: baril_pa [Admin rights]
Mode: ProxyFix -- Date : 12/04/2011 16:15:26

¤¤¤ Bad processes: 0 ¤¤¤

¤¤¤ Driver: [NOT LOADED] ¤¤¤

¤¤¤ Registry Entries: 4 ¤¤¤
[PROXY IE] HKCU\[...]\Internet Settings : ProxyEnable (1) -> REPLACED (0)
[PROXY IE] HKCU\[...]\Internet Settings : ProxyServer (http=127.0.0.1:58242) -> DELETED
[PROXY FF] 3a0tzbjw.default\ 127.0.0.1:58242 -> DELETED
[PROXY FF] lshqlik3.default\ 127.0.0.1:58242 -> DELETED

ComboFix 11-12-04.02 - baril_pa . 12. 2011 16:20:28.1.4 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1250.421.1051.18.1967.1075 [GMT 1:00]
Running from: c:\users\baril_pa\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\LP
c:\program files (x86)\LP\2DCB\25C8.tmp
c:\program files (x86)\LP\2DCB\988.tmp
c:\program files (x86)\LP\2DCB\A82.exe
c:\program files (x86)\LP\2DCB\CDB.tmp
c:\users\baril_pa\AppData\Roaming\B0AB3
c:\users\baril_pa\AppData\Roaming\B0AB3\3460.0AB
c:\users\baril_pa\AppData\Roaming\B0AB3\9882D.exe
c:\users\baril_pa\AppData\Roaming\firefox.exe
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
c:\windows\SysWow64\Packet.dll
c:\windows\SysWow64\pthreadVC.dll
c:\windows\SysWow64\wpcap.dll
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_NPF
-------\Service_npf
.
.
((((((((((((((((((((((((( Files Created from 2011-11-04 to 2011-12-04 )))))))))))))))))))))))))))))))
.
.
2011-12-04 15:25 . 2011-12-04 15:25 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-12-04 15:25 . 2011-12-04 15:25 -------- d-----w- c:\users\Admin\AppData\Local\temp
2011-12-04 15:25 . 2011-12-04 15:25 -------- d-----w- c:\users\adm_arcus\AppData\Local\temp
2011-12-04 14:34 . 2011-12-04 14:34 -------- d-----w- c:\users\baril_pa\AppData\Roaming\B3460
2011-12-04 14:34 . 2011-12-04 14:34 286720 ----a-w- c:\users\baril_pa\AppData\Roaming\Microsoft\2DCB\A82.exe
2011-12-04 14:33 . 2011-12-04 14:33 -------- d-----w- c:\users\baril_pa\AppData\Local\VirtualStore
2011-12-04 09:01 . 2011-12-04 09:01 -------- d-----w- c:\users\baril_pa\AppData\Roaming\Malwarebytes
2011-12-04 09:01 . 2011-12-04 09:01 -------- d-----w- c:\programdata\Malwarebytes
2011-12-04 09:01 . 2011-12-04 09:01 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-12-04 09:01 . 2011-08-31 16:00 25416 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-12-04 07:35 . 2011-12-04 07:36 -------- d-----w- C:\rsit
2011-12-04 07:35 . 2011-12-04 07:35 -------- d-----w- c:\program files (x86)\trend micro
2011-12-04 06:41 . 2011-12-04 06:41 -------- d-----w- c:\program files (x86)\ESET
2011-12-03 19:43 . 2011-12-03 19:44 -------- d-----w- c:\program files (x86)\B3460
2011-12-03 13:20 . 2011-12-03 13:20 -------- d-----w- C:\Crystal Bowl Healing
2011-12-03 13:07 . 2011-12-03 13:07 -------- d-----w- C:\Chakra Meditation Music
2011-12-02 17:22 . 2011-12-02 17:22 -------- d-----w- C:\log
2011-12-01 19:09 . 2011-12-01 19:15 -------- d-----w- c:\programdata\webcamXP 5
2011-12-01 19:09 . 2011-12-01 19:09 -------- d-----w- c:\program files (x86)\webcamXP 5
2011-11-29 21:16 . 2011-12-01 14:55 -------- d-----r- c:\users\baril_pa\Dropbox
2011-11-29 21:12 . 2011-12-01 20:11 -------- d-----w- c:\users\baril_pa\AppData\Roaming\Dropbox
2011-11-29 09:35 . 2011-11-29 09:35 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin7.dll
2011-11-29 09:35 . 2011-11-29 09:35 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin6.dll
2011-11-29 09:35 . 2011-11-29 09:35 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin5.dll
2011-11-29 09:35 . 2011-11-29 09:35 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin4.dll
2011-11-29 09:35 . 2011-11-29 09:35 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin3.dll
2011-11-29 09:35 . 2011-11-29 09:35 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin2.dll
2011-11-29 09:35 . 2011-11-29 09:35 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin.dll
2011-11-29 09:35 . 2011-11-29 09:35 -------- d-----w- c:\program files (x86)\QuickTime
2011-11-29 09:35 . 2011-11-29 09:35 -------- d-----w- c:\programdata\Apple Computer
2011-11-29 09:30 . 2011-11-29 09:30 -------- d-----w- c:\program files (x86)\Apple Software Update
2011-11-25 18:39 . 2011-11-25 18:39 -------- d-----w- c:\program files (x86)\Subtitle Edit
2011-11-25 18:32 . 2011-11-25 18:32 -------- d-----w- c:\program files (x86)\URUSoft
2011-11-23 21:37 . 2010-05-26 10:41 2106216 ----a-w- c:\windows\SysWow64\D3DCompiler_43.dll
2011-11-23 21:37 . 2010-05-26 10:41 1998168 ----a-w- c:\windows\SysWow64\D3DX9_43.dll
2011-11-23 11:28 . 2011-11-23 11:28 -------- d-----w- c:\windows\SysWow64\VivotekIPP
2011-11-22 16:53 . 2011-11-22 16:53 -------- d-----w- c:\program files (x86)\Common Files\Intel Corporation
2011-11-13 19:59 . 2011-11-15 06:52 -------- d-----w- c:\users\baril_pa\AppData\Roaming\Mirillis
2011-11-13 19:59 . 2011-11-15 06:52 -------- d-----w- c:\programdata\Mirillis
2011-11-13 19:59 . 2011-11-15 06:52 -------- d-----w- c:\users\baril_pa\AppData\Local\Mirillis
2011-11-11 11:24 . 2011-11-11 12:15 -------- d-----w- c:\users\baril_pa\AppData\Roaming\OutlookSync
2011-11-11 11:24 . 2011-11-11 11:24 -------- d-----w- c:\users\baril_pa\AppData\Roaming\FolderSync
2011-11-11 11:23 . 2011-11-11 11:23 -------- d-----w- c:\users\baril_pa\AppData\Roaming\PQI
2011-11-09 20:11 . 2011-10-01 05:45 886784 ----a-w- c:\program files\Common Files\System\wab32.dll
2011-11-09 20:11 . 2011-10-01 04:37 708608 ----a-w- c:\program files (x86)\Common Files\System\wab32.dll
2011-11-09 20:11 . 2011-09-29 16:29 1923952 ----a-w- c:\windows\system32\drivers\tcpip.sys
2011-11-09 20:11 . 2011-09-29 04:03 3144704 ----a-w- c:\windows\system32\win32k.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-12 09:47 . 2011-06-21 12:59 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-10-27 09:34 . 2011-10-27 09:50 668938 ----a-w- c:\windows\unins000.exe
2011-10-24 13:29 . 2011-10-24 13:29 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx
2011-10-24 13:29 . 2011-10-24 13:29 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts
2011-09-14 15:32 . 2011-09-14 15:32 1768960 ----a-w- c:\windows\SysWow64\PmTrdvw2.dll
2011-09-14 15:32 . 2011-09-14 15:32 909312 ----a-w- c:\windows\SysWow64\PmTable.ocx
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Thunderbird"="c:\program files (x86)\Mozilla Thunderbird\thunderbird -turbo" [X]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2011-10-13 17351304]
"uTorrent"="c:\program files (x86)\uTorrent\uTorrent.exe" [2011-10-20 641400]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-03-04 284696]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-08-05 98304]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbam.exe" [2011-08-31 1047208]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HideSCAHealth"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 SgtSch2Svc;Seagate Scheduler2 Service;c:\program files (x86)\Common Files\Seagate\Schedule2\schedul2.exe [x]
R3 ALSysIO;ALSysIO;c:\users\baril_pa\AppData\Local\Temp\ALSysIO64.sys [x]
R3 ARCVCAM;ARCVCAM, ArcSoft Webcam Sharing Manager Driver;c:\windows\system32\DRIVERS\ArcSoftVCapture.sys [x]
R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys [x]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 tap0801;TAP-Win32 Adapter V8;c:\windows\system32\DRIVERS\tap0801.sys [x]
R3 tapoas;TAP-Win32 Adapter OAS;c:\windows\system32\DRIVERS\tapoas.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Služba Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 wxpSvc;webcamXP Service;c:\program files (x86)\webcamXP 5\wService.exe [2011-07-27 5023744]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b20011ea53a6b83e\AESTSr64.exe [2009-03-03 89600]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-04 13336]
S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-11-03 2358656]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-11-04 2320920]
S2 vcsFPService;Validity VCS Fingerprint Service;c:\windows\system32\vcsFPService.exe [2009-12-14 2019120]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys [x]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-06-17 20:11 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"combofix"="c:\combofix\CF4585.3XE" [2010-11-20 345088]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.bing.com
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://www.bing.com
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovať do programu Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Od&oslať do programu OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: Odoslať obrázok do &Zariadenia s rozhraním Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Odoslať stránku do &Zariadenia s rozhraním Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: Translate this web page with Babylon - c:\program files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm
IE: Translate with Babylon - c:\program files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Action.htm
TCP: DhcpNameServer = 192.168.0.1
DPF: {45830FF9-D9E6-4F41-86ED-B266933D8E90} - hxxp://192.168.133.165/RtspVaPgDec.cab
DPF: {73888E2B-FF04-416C-8847-984D7FC4507F} - hxxp://192.168.1.3/RtspVaPgDecNew2.cab
DPF: {F8E691A0-C92E-4E42-9CDA-62FC07A9483B} - hxxp://actiftp.hosting4less.com/ACTIGENERAL/AP&Manual/Live%20Demo/nvUnifiedControl.ocx
FF - ProfilePath - c:\users\baril_pa\AppData\Roaming\Mozilla\Firefox\Profiles\lshqlik3.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.sk/
.
- - - - ORPHANS REMOVED - - - -
.
Wow6432Node-HKLM-Run-ST7501 - (no file)
Wow6432Node-HKLM-Run-A82.exe - c:\program files (x86)\LP\2DCB\A82.exe
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wxpSvc]
"ImagePath"="c:\program files (x86)\webcamXP 5\wService.exe /startedbyscm:5053B757-40E35B3B-webcamSRV"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11c_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11c_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
.
**************************************************************************
.
Completion time: 2011-12-04 16:30:30 - machine was rebooted
ComboFix-quarantined-files.txt 2011-12-04 15:30
.
Pre-Run: 221 080 690 688 bytes free
Post-Run: 220 456 308 736 bytes free
.
- - End Of File - - 1434AB5E89A363F8BD94659FCDA99834

Otevřeme si Poznámkový blok Obrázek

(stiskneme klávesovou kombinaci WIN+R a napíšeme ,,notepad,, bez úvozovek a dáme enter)

Vložíme do něj následující script:

Kód: Vybrat vše


KillAll::

Folder::
c:\program files (x86)\B3460
c:\users\baril_pa\AppData\Roaming\Microsoft\2DCB\
c:\users\baril_pa\AppData\Roaming\B3460

DDS::
uStart Page = hxxp://www.bing.com
mStart Page = hxxp://www.bing.com

RegLock::
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

Reboot::

Soubor uložíme na Plochu jako CFScript.txt
Poté tento soubor uchopíme levým tlačítkem myši a přetáhneme na ikonu Combofixu a upustíme
Poté Combofix provede všechny operace a udělá nový log,který sem vložte

Může se stát,že po aplikaci scriptu nenaběhne Windows běžným způsobem.V tomto případě restartujte počítač a při startu mačkejte F8 a zvolte možnost Poslední známá funkční konfigurace

Stáhněte si TDSSKiller

Spuste program a klikněte na Start Scan
Pokud program najde infikekci,tak ji bude lecit (Cure), povolte léčení kliknutím na tlačítko Continue
Pokud program najde podezrely soubor (suspicious),bude ho chtít přeskočit (Skip), povolte přeskočení kliknutim na tlačítko Continue
Po dokončení skenování bude možná potřeba restartovat počítač,ten povolíte programu kliknutím na tlačítko Reboot now
Po restartování počítače na vás vyskočí log(pokud se tak nestane,tak ho najdete na disku,kde máte nainstalovaná systém s názvem TDSSKiller.xxxx_log.txt) a vložte mi sem jeho obsah
Pokud nebude program požadovat restartování počítače,klikněte na tlačítko Close a následně na Report , čímž se Vám vytvoří log a jeho obsah mu sem vložte

nove logy:

ComboFix 11-12-04.02 - baril_pa . 12. 2011 9:06.2.4 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1250.421.1051.18.1967.848 [GMT 1:00]
Running from: c:\users\baril_pa\Desktop\ComboFix.exe
Command switches used :: c:\users\baril_pa\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\B3460
c:\program files (x86)\B3460\lvvm.exe
c:\users\baril_pa\AppData\Roaming\B3460
c:\users\baril_pa\AppData\Roaming\B3460\lvvm.exe
c:\users\baril_pa\AppData\Roaming\Microsoft\2DCB
c:\users\baril_pa\AppData\Roaming\Microsoft\2DCB\1C08.tmp
c:\users\baril_pa\AppData\Roaming\Microsoft\2DCB\8C95.tmp
c:\users\baril_pa\AppData\Roaming\Microsoft\2DCB\A82.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-11-06 to 2011-12-06 )))))))))))))))))))))))))))))))
.
.
2011-12-06 08:12 . 2011-12-06 08:12 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-12-06 08:12 . 2011-12-06 08:12 -------- d-----w- c:\users\Admin\AppData\Local\temp
2011-12-06 08:12 . 2011-12-06 08:12 -------- d-----w- c:\users\adm_arcus\AppData\Local\temp
2011-12-06 06:32 . 2011-11-30 01:21 8822856 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{7DD8170E-1981-4858-BA24-421FDBEBB2BE}\mpengine.dll
2011-12-04 14:33 . 2011-12-04 14:33 -------- d-----w- c:\users\baril_pa\AppData\Local\VirtualStore
2011-12-04 09:01 . 2011-12-04 09:01 -------- d-----w- c:\users\baril_pa\AppData\Roaming\Malwarebytes
2011-12-04 09:01 . 2011-12-04 09:01 -------- d-----w- c:\programdata\Malwarebytes
2011-12-04 09:01 . 2011-12-04 09:01 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-12-04 09:01 . 2011-08-31 16:00 25416 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-12-04 07:35 . 2011-12-04 07:36 -------- d-----w- C:\rsit
2011-12-04 07:35 . 2011-12-04 07:35 -------- d-----w- c:\program files (x86)\trend micro
2011-12-04 06:41 . 2011-12-04 06:41 -------- d-----w- c:\program files (x86)\ESET
2011-12-03 13:20 . 2011-12-03 13:20 -------- d-----w- C:\Crystal Bowl Healing
2011-12-03 13:07 . 2011-12-03 13:07 -------- d-----w- C:\Chakra Meditation Music
2011-12-02 17:22 . 2011-12-02 17:22 -------- d-----w- C:\log
2011-12-01 19:09 . 2011-12-01 19:15 -------- d-----w- c:\programdata\webcamXP 5
2011-12-01 19:09 . 2011-12-01 19:09 -------- d-----w- c:\program files (x86)\webcamXP 5
2011-11-29 21:16 . 2011-12-01 14:55 -------- d-----r- c:\users\baril_pa\Dropbox
2011-11-29 21:12 . 2011-12-01 20:11 -------- d-----w- c:\users\baril_pa\AppData\Roaming\Dropbox
2011-11-29 09:35 . 2011-11-29 09:35 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin7.dll
2011-11-29 09:35 . 2011-11-29 09:35 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin6.dll
2011-11-29 09:35 . 2011-11-29 09:35 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin5.dll
2011-11-29 09:35 . 2011-11-29 09:35 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin4.dll
2011-11-29 09:35 . 2011-11-29 09:35 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin3.dll
2011-11-29 09:35 . 2011-11-29 09:35 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin2.dll
2011-11-29 09:35 . 2011-11-29 09:35 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin.dll
2011-11-29 09:35 . 2011-11-29 09:35 -------- d-----w- c:\program files (x86)\QuickTime
2011-11-29 09:35 . 2011-11-29 09:35 -------- d-----w- c:\programdata\Apple Computer
2011-11-29 09:30 . 2011-11-29 09:30 -------- d-----w- c:\program files (x86)\Apple Software Update
2011-11-25 18:39 . 2011-11-25 18:39 -------- d-----w- c:\program files (x86)\Subtitle Edit
2011-11-25 18:32 . 2011-11-25 18:32 -------- d-----w- c:\program files (x86)\URUSoft
2011-11-23 21:37 . 2010-05-26 10:41 2106216 ----a-w- c:\windows\SysWow64\D3DCompiler_43.dll
2011-11-23 21:37 . 2010-05-26 10:41 1998168 ----a-w- c:\windows\SysWow64\D3DX9_43.dll
2011-11-23 11:28 . 2011-11-23 11:28 -------- d-----w- c:\windows\SysWow64\VivotekIPP
2011-11-22 16:53 . 2011-11-22 16:53 -------- d-----w- c:\program files (x86)\Common Files\Intel Corporation
2011-11-13 19:59 . 2011-11-15 06:52 -------- d-----w- c:\users\baril_pa\AppData\Roaming\Mirillis
2011-11-13 19:59 . 2011-11-15 06:52 -------- d-----w- c:\programdata\Mirillis
2011-11-13 19:59 . 2011-11-15 06:52 -------- d-----w- c:\users\baril_pa\AppData\Local\Mirillis
2011-11-11 11:24 . 2011-11-11 12:15 -------- d-----w- c:\users\baril_pa\AppData\Roaming\OutlookSync
2011-11-11 11:24 . 2011-11-11 11:24 -------- d-----w- c:\users\baril_pa\AppData\Roaming\FolderSync
2011-11-11 11:23 . 2011-11-11 11:23 -------- d-----w- c:\users\baril_pa\AppData\Roaming\PQI
2011-11-09 20:11 . 2011-10-01 05:45 886784 ----a-w- c:\program files\Common Files\System\wab32.dll
2011-11-09 20:11 . 2011-10-01 04:37 708608 ----a-w- c:\program files (x86)\Common Files\System\wab32.dll
2011-11-09 20:11 . 2011-09-29 16:29 1923952 ----a-w- c:\windows\system32\drivers\tcpip.sys
2011-11-09 20:11 . 2011-09-29 04:03 3144704 ----a-w- c:\windows\system32\win32k.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-12 09:47 . 2011-06-21 12:59 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-10-27 09:34 . 2011-10-27 09:50 668938 ----a-w- c:\windows\unins000.exe
2011-10-24 13:29 . 2011-10-24 13:29 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx
2011-10-24 13:29 . 2011-10-24 13:29 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts
2011-09-14 15:32 . 2011-09-14 15:32 1768960 ----a-w- c:\windows\SysWow64\PmTrdvw2.dll
2011-09-14 15:32 . 2011-09-14 15:32 909312 ----a-w- c:\windows\SysWow64\PmTable.ocx
.
.
((((((((((((((((((((((((((((( SnapShot@2011-12-04_15.27.28 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-12-05 23:19 . 2011-12-06 06:30 53314 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2011-12-06 06:30 45478 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
- 2009-07-14 05:10 . 2011-12-04 15:13 45478 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2011-03-17 11:24 . 2011-12-06 06:30 13198 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-4238845511-2545688853-254789308-1188_UserData.bin
- 2010-12-05 23:15 . 2011-12-04 15:26 2958 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Bluetooth\bthservsdp.dat
+ 2010-12-05 23:15 . 2011-12-06 08:12 2958 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Bluetooth\bthservsdp.dat
- 2011-12-04 15:26 . 2011-12-04 15:26 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-12-06 08:13 . 2011-12-06 08:13 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-12-06 08:13 . 2011-12-06 08:13 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2011-12-04 15:26 . 2011-12-04 15:26 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-07-14 02:36 . 2011-12-04 15:17 661832 c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2011-12-06 07:37 661832 c:\windows\system32\perfh009.dat
- 2009-07-14 02:36 . 2011-12-04 15:17 126022 c:\windows\system32\perfc009.dat
+ 2009-07-14 02:36 . 2011-12-06 07:37 126022 c:\windows\system32\perfc009.dat
- 2011-03-17 08:52 . 2010-10-19 20:51 270720 c:\windows\system32\MpSigStub.exe
+ 2011-03-17 08:52 . 2011-05-24 17:14 270720 c:\windows\system32\MpSigStub.exe
- 2009-07-14 05:01 . 2011-12-04 15:26 368428 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2011-12-06 08:12 368428 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2011-12-05 14:00 . 2011-12-05 14:00 882860 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-4238845511-2545688853-254789308-1188-4096.dat
+ 2011-12-04 15:11 . 2011-12-06 08:12 9347424 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-4238845511-2545688853-254789308-1188-8192.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Thunderbird"="c:\program files (x86)\Mozilla Thunderbird\thunderbird -turbo" [X]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2011-10-13 17351304]
"uTorrent"="c:\program files (x86)\uTorrent\uTorrent.exe" [2011-10-20 641400]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-03-04 284696]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-08-05 98304]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HideSCAHealth"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 SgtSch2Svc;Seagate Scheduler2 Service;c:\program files (x86)\Common Files\Seagate\Schedule2\schedul2.exe [x]
R3 ALSysIO;ALSysIO;c:\users\baril_pa\AppData\Local\Temp\ALSysIO64.sys [x]
R3 ARCVCAM;ARCVCAM, ArcSoft Webcam Sharing Manager Driver;c:\windows\system32\DRIVERS\ArcSoftVCapture.sys [x]
R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys [x]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 tap0801;TAP-Win32 Adapter V8;c:\windows\system32\DRIVERS\tap0801.sys [x]
R3 tapoas;TAP-Win32 Adapter OAS;c:\windows\system32\DRIVERS\tapoas.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Služba Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 wxpSvc;webcamXP Service;c:\program files (x86)\webcamXP 5\wService.exe [2011-07-27 5023744]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b20011ea53a6b83e\AESTSr64.exe [2009-03-03 89600]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-04 13336]
S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-11-03 2358656]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-11-04 2320920]
S2 vcsFPService;Validity VCS Fingerprint Service;c:\windows\system32\vcsFPService.exe [2009-12-14 2019120]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys [x]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-06-17 20:11 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovať do programu Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Od&oslať do programu OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: Odoslať obrázok do &Zariadenia s rozhraním Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Odoslať stránku do &Zariadenia s rozhraním Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: Translate this web page with Babylon - c:\program files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm
IE: Translate with Babylon - c:\program files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Action.htm
TCP: DhcpNameServer = 192.168.133.133 193.93.72.10 192.168.133.3
DPF: {45830FF9-D9E6-4F41-86ED-B266933D8E90} - hxxp://192.168.133.165/RtspVaPgDec.cab
DPF: {73888E2B-FF04-416C-8847-984D7FC4507F} - hxxp://192.168.1.3/RtspVaPgDecNew2.cab
DPF: {F8E691A0-C92E-4E42-9CDA-62FC07A9483B} - hxxp://actiftp.hosting4less.com/ACTIGENERAL/AP&Manual/Live%20Demo/nvUnifiedControl.ocx
FF - ProfilePath - c:\users\baril_pa\AppData\Roaming\Mozilla\Firefox\Profiles\lshqlik3.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.sk/
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wxpSvc]
"ImagePath"="c:\program files (x86)\webcamXP 5\wService.exe /startedbyscm:5053B757-40E35B3B-webcamSRV"
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
.
**************************************************************************
.
Completion time: 2011-12-06 09:22:48 - machine was rebooted
ComboFix-quarantined-files.txt 2011-12-06 08:22
ComboFix2.txt 2011-12-04 15:30
.
Pre-Run: 211 518 590 976 bytes free
Post-Run: 211 196 313 600 bytes free
.
- - End Of File - - 422B2996EADBE09AB8E8F152510874B1

09:27:48.0556 2720 TDSS rootkit removing tool 2.6.21.0 Nov 24 2011 12:32:44
09:27:49.0008 2720 ============================================================
09:27:49.0008 2720 Current date / time: 2011/12/06 09:27:49.0008
09:27:49.0008 2720 SystemInfo:
09:27:49.0008 2720
09:27:49.0008 2720 OS Version: 6.1.7601 ServicePack: 1.0
09:27:49.0008 2720 Product type: Workstation
09:27:49.0008 2720 ComputerName: INT-W31
09:27:49.0008 2720 UserName: baril_pa
09:27:49.0008 2720 Windows directory: C:\windows
09:27:49.0008 2720 System windows directory: C:\windows
09:27:49.0008 2720 Running under WOW64
09:27:49.0008 2720 Processor architecture: Intel x64
09:27:49.0008 2720 Number of processors: 4
09:27:49.0008 2720 Page size: 0x1000
09:27:49.0008 2720 Boot type: Normal boot
09:27:49.0008 2720 ============================================================
09:27:49.0305 2720 Initialize success
09:27:50.0163 1844 ============================================================
09:27:50.0163 1844 Scan started
09:27:50.0163 1844 Mode: Manual;
09:27:50.0163 1844 ============================================================
09:27:50.0522 1844 1394ohci (a87d604aea360176311474c87a63bb88) C:\windows\system32\drivers\1394ohci.sys
09:27:50.0522 1844 1394ohci - ok
09:27:50.0584 1844 Accelerometer (5c368f4b04ed2a923e6afca2d37baff5) C:\windows\system32\DRIVERS\Accelerometer.sys
09:27:50.0584 1844 Accelerometer - ok
09:27:50.0631 1844 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\windows\system32\drivers\ACPI.sys
09:27:50.0631 1844 ACPI - ok
09:27:50.0662 1844 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\windows\system32\drivers\acpipmi.sys
09:27:50.0662 1844 AcpiPmi - ok
09:27:50.0725 1844 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\windows\system32\DRIVERS\adp94xx.sys
09:27:50.0725 1844 adp94xx - ok
09:27:50.0772 1844 adpahci (597f78224ee9224ea1a13d6350ced962) C:\windows\system32\DRIVERS\adpahci.sys
09:27:50.0772 1844 adpahci - ok
09:27:50.0787 1844 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\windows\system32\DRIVERS\adpu320.sys
09:27:50.0787 1844 adpu320 - ok
09:27:50.0803 1844 Afc - ok
09:27:50.0865 1844 AFD (d5b031c308a409a0a576bff4cf083d30) C:\windows\system32\drivers\afd.sys
09:27:50.0865 1844 AFD - ok
09:27:50.0959 1844 AgereSoftModem (a6ab6f0ace87da76b4c401813d18be95) C:\windows\system32\DRIVERS\agrsm64.sys
09:27:50.0959 1844 AgereSoftModem - ok
09:27:51.0006 1844 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\windows\system32\drivers\agp440.sys
09:27:51.0006 1844 agp440 - ok
09:27:51.0037 1844 aliide (5812713a477a3ad7363c7438ca2ee038) C:\windows\system32\drivers\aliide.sys
09:27:51.0037 1844 aliide - ok
09:27:51.0115 1844 ALSysIO - ok
09:27:51.0146 1844 amdide (1ff8b4431c353ce385c875f194924c0c) C:\windows\system32\drivers\amdide.sys
09:27:51.0146 1844 amdide - ok
09:27:51.0177 1844 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\windows\system32\DRIVERS\amdk8.sys
09:27:51.0177 1844 AmdK8 - ok
09:27:51.0318 1844 amdkmdag (650ddccd6657e20737433cb774521b81) C:\windows\system32\DRIVERS\atikmdag.sys
09:27:51.0349 1844 amdkmdag - ok
09:27:51.0396 1844 amdkmdap (f51b013c55b30dbe3ad59a7fe197c5ba) C:\windows\system32\DRIVERS\atikmpag.sys
09:27:51.0396 1844 amdkmdap - ok
09:27:51.0411 1844 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\windows\system32\DRIVERS\amdppm.sys
09:27:51.0411 1844 AmdPPM - ok
09:27:51.0443 1844 amdsata (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\windows\system32\drivers\amdsata.sys
09:27:51.0443 1844 amdsata - ok
09:27:51.0474 1844 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\windows\system32\DRIVERS\amdsbs.sys
09:27:51.0474 1844 amdsbs - ok
09:27:51.0490 1844 amdxata (540daf1cea6094886d72126fd7c33048) C:\windows\system32\drivers\amdxata.sys
09:27:51.0490 1844 amdxata - ok
09:27:51.0536 1844 AppID (89a69c3f2f319b43379399547526d952) C:\windows\system32\drivers\appid.sys
09:27:51.0536 1844 AppID - ok
09:27:51.0583 1844 arc (c484f8ceb1717c540242531db7845c4e) C:\windows\system32\DRIVERS\arc.sys
09:27:51.0583 1844 arc - ok
09:27:51.0599 1844 arcsas (019af6924aefe7839f61c830227fe79c) C:\windows\system32\DRIVERS\arcsas.sys
09:27:51.0599 1844 arcsas - ok
09:27:51.0614 1844 ARCVCAM - ok
09:27:51.0692 1844 AsyncMac (769765ce2cc62867468cea93969b2242) C:\windows\system32\DRIVERS\asyncmac.sys
09:27:51.0692 1844 AsyncMac - ok
09:27:51.0724 1844 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\windows\system32\drivers\atapi.sys
09:27:51.0724 1844 atapi - ok
09:27:51.0786 1844 AtiHdmiService (2d648572ba9a610952fcafba1e119c2d) C:\windows\system32\drivers\AtiHdmi.sys
09:27:51.0786 1844 AtiHdmiService - ok
09:27:51.0848 1844 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\windows\system32\DRIVERS\bxvbda.sys
09:27:51.0864 1844 b06bdrv - ok
09:27:51.0880 1844 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\windows\system32\DRIVERS\b57nd60a.sys
09:27:51.0880 1844 b57nd60a - ok
09:27:51.0958 1844 BCM43XX (810be94a9e42309b3f74217ac28bc6ac) C:\windows\system32\DRIVERS\bcmwl664.sys
09:27:51.0973 1844 BCM43XX - ok
09:27:51.0989 1844 Beep (16a47ce2decc9b099349a5f840654746) C:\windows\system32\drivers\Beep.sys
09:27:51.0989 1844 Beep - ok
09:27:52.0051 1844 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\windows\system32\DRIVERS\blbdrive.sys
09:27:52.0051 1844 blbdrive - ok
09:27:52.0082 1844 bowser (6c02a83164f5cc0a262f4199f0871cf5) C:\windows\system32\DRIVERS\bowser.sys
09:27:52.0082 1844 bowser - ok
09:27:52.0098 1844 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\windows\system32\DRIVERS\BrFiltLo.sys
09:27:52.0098 1844 BrFiltLo - ok
09:27:52.0114 1844 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\windows\system32\DRIVERS\BrFiltUp.sys
09:27:52.0114 1844 BrFiltUp - ok
09:27:52.0145 1844 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\windows\System32\Drivers\Brserid.sys
09:27:52.0145 1844 Brserid - ok
09:27:52.0176 1844 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\windows\System32\Drivers\BrSerWdm.sys
09:27:52.0176 1844 BrSerWdm - ok
09:27:52.0192 1844 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\windows\System32\Drivers\BrUsbMdm.sys
09:27:52.0192 1844 BrUsbMdm - ok
09:27:52.0207 1844 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\windows\System32\Drivers\BrUsbSer.sys
09:27:52.0207 1844 BrUsbSer - ok
09:27:52.0254 1844 BthEnum (cf98190a94f62e405c8cb255018b2315) C:\windows\system32\drivers\BthEnum.sys
09:27:52.0254 1844 BthEnum - ok
09:27:52.0285 1844 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\windows\system32\DRIVERS\bthmodem.sys
09:27:52.0285 1844 BTHMODEM - ok
09:27:52.0301 1844 BthPan (02dd601b708dd0667e1331fa8518e9ff) C:\windows\system32\DRIVERS\bthpan.sys
09:27:52.0301 1844 BthPan - ok
09:27:52.0348 1844 BTHPORT (64c198198501f7560ee41d8d1efa7952) C:\windows\System32\Drivers\BTHport.sys
09:27:52.0348 1844 BTHPORT - ok
09:27:52.0395 1844 BTHUSB (f188b7394d81010767b6df3178519a37) C:\windows\System32\Drivers\BTHUSB.sys
09:27:52.0395 1844 BTHUSB - ok
09:27:52.0441 1844 btwampfl (59e3510784548c6939c1b3b985c232e3) C:\windows\system32\drivers\btwampfl.sys
09:27:52.0441 1844 btwampfl - ok
09:27:52.0488 1844 btwaudio (1872074ed0a3fb22e3f1e3197b984bfa) C:\windows\system32\drivers\btwaudio.sys
09:27:52.0488 1844 btwaudio - ok
09:27:52.0535 1844 btwavdt (691cf076c33ab1c3a5b2fd5450300733) C:\windows\system32\DRIVERS\btwavdt.sys
09:27:52.0535 1844 btwavdt - ok
09:27:52.0597 1844 btwl2cap (07096d2bc22ccb6cea5a532df0be8a75) C:\windows\system32\DRIVERS\btwl2cap.sys
09:27:52.0597 1844 btwl2cap - ok
09:27:52.0629 1844 btwrchid (c9273b20dec8ce38dbce5d29de63c907) C:\windows\system32\DRIVERS\btwrchid.sys
09:27:52.0629 1844 btwrchid - ok
09:27:52.0644 1844 catchme - ok
09:27:52.0691 1844 cdfs (b8bd2bb284668c84865658c77574381a) C:\windows\system32\DRIVERS\cdfs.sys
09:27:52.0691 1844 cdfs - ok
09:27:52.0753 1844 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\windows\system32\DRIVERS\cdrom.sys
09:27:52.0753 1844 cdrom - ok
09:27:52.0785 1844 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\windows\system32\DRIVERS\circlass.sys
09:27:52.0785 1844 circlass - ok
09:27:52.0816 1844 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\windows\system32\CLFS.sys
09:27:52.0816 1844 CLFS - ok
09:27:52.0894 1844 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\windows\system32\DRIVERS\CmBatt.sys
09:27:52.0910 1844 CmBatt - ok
09:27:52.0941 1844 cmdide (e19d3f095812725d88f9001985b94edd) C:\windows\system32\drivers\cmdide.sys
09:27:52.0941 1844 cmdide - ok
09:27:52.0988 1844 CNG (d5fea92400f12412b3922087c09da6a5) C:\windows\system32\Drivers\cng.sys
09:27:52.0988 1844 CNG - ok
09:27:53.0034 1844 Compbatt (102de219c3f61415f964c88e9085ad14) C:\windows\system32\DRIVERS\compbatt.sys
09:27:53.0034 1844 Compbatt - ok
09:27:53.0066 1844 CompositeBus (03edb043586cceba243d689bdda370a8) C:\windows\system32\drivers\CompositeBus.sys
09:27:53.0066 1844 CompositeBus - ok
09:27:53.0097 1844 crcdisk (1c827878a998c18847245fe1f34ee597) C:\windows\system32\DRIVERS\crcdisk.sys
09:27:53.0097 1844 crcdisk - ok
09:27:53.0144 1844 CSC (54da3dfd29ed9f1619b6f53f3ce55e49) C:\windows\system32\drivers\csc.sys
09:27:53.0144 1844 CSC - ok
09:27:53.0175 1844 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\windows\system32\Drivers\dfsc.sys
09:27:53.0175 1844 DfsC - ok
09:27:53.0206 1844 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\windows\system32\drivers\discache.sys
09:27:53.0206 1844 discache - ok
09:27:53.0237 1844 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\windows\system32\DRIVERS\disk.sys
09:27:53.0237 1844 Disk - ok
09:27:53.0284 1844 drmkaud (9b19f34400d24df84c858a421c205754) C:\windows\system32\drivers\drmkaud.sys
09:27:53.0284 1844 drmkaud - ok
09:27:53.0331 1844 DXGKrnl (f5bee30450e18e6b83a5012c100616fd) C:\windows\System32\drivers\dxgkrnl.sys
09:27:53.0331 1844 DXGKrnl - ok
09:27:53.0409 1844 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\windows\system32\DRIVERS\evbda.sys
09:27:53.0424 1844 ebdrv - ok
09:27:53.0487 1844 elxstor (0e5da5369a0fcaea12456dd852545184) C:\windows\system32\DRIVERS\elxstor.sys
09:27:53.0487 1844 elxstor - ok
09:27:53.0502 1844 ErrDev (34a3c54752046e79a126e15c51db409b) C:\windows\system32\drivers\errdev.sys
09:27:53.0518 1844 ErrDev - ok
09:27:53.0534 1844 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\windows\system32\drivers\exfat.sys
09:27:53.0534 1844 exfat - ok
09:27:53.0565 1844 fastfat (0adc83218b66a6db380c330836f3e36d) C:\windows\system32\drivers\fastfat.sys
09:27:53.0565 1844 fastfat - ok
09:27:53.0627 1844 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\windows\system32\DRIVERS\fdc.sys
09:27:53.0627 1844 fdc - ok
09:27:53.0643 1844 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\windows\system32\drivers\fileinfo.sys
09:27:53.0643 1844 FileInfo - ok
09:27:53.0659 1844 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\windows\system32\drivers\filetrace.sys
09:27:53.0659 1844 Filetrace - ok
09:27:53.0690 1844 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\windows\system32\DRIVERS\flpydisk.sys
09:27:53.0690 1844 flpydisk - ok
09:27:53.0737 1844 FltMgr (da6b67270fd9db3697b20fce94950741) C:\windows\system32\drivers\fltmgr.sys
09:27:53.0737 1844 FltMgr - ok
09:27:53.0768 1844 FsDepends (d43703496149971890703b4b1b723eac) C:\windows\system32\drivers\FsDepends.sys
09:27:53.0768 1844 FsDepends - ok
09:27:53.0783 1844 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\windows\system32\drivers\Fs_Rec.sys
09:27:53.0783 1844 Fs_Rec - ok
09:27:53.0846 1844 FTDIBUS (fa169871d8fadcc6539c4e8726610286) C:\windows\system32\drivers\ftdibus.sys
09:27:53.0846 1844 FTDIBUS - ok
09:27:53.0877 1844 FTSER2K (24237091348d1efb5635a1cf9649e311) C:\windows\system32\drivers\ftser2k.sys
09:27:53.0877 1844 FTSER2K - ok
09:27:53.0924 1844 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\windows\system32\DRIVERS\fvevol.sys
09:27:53.0924 1844 fvevol - ok
09:27:53.0955 1844 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\windows\system32\DRIVERS\gagp30kx.sys
09:27:53.0955 1844 gagp30kx - ok
09:27:53.0971 1844 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\windows\system32\drivers\hcw85cir.sys
09:27:53.0971 1844 hcw85cir - ok
09:27:54.0033 1844 HdAudAddService (975761c778e33cd22498059b91e7373a) C:\windows\system32\drivers\HdAudio.sys
09:27:54.0033 1844 HdAudAddService - ok
09:27:54.0080 1844 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\windows\system32\drivers\HDAudBus.sys
09:27:54.0080 1844 HDAudBus - ok
09:27:54.0127 1844 HECIx64 (b6ac71aaa2b10848f57fc49d55a651af) C:\windows\system32\DRIVERS\HECIx64.sys
09:27:54.0127 1844 HECIx64 - ok
09:27:54.0127 1844 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\windows\system32\DRIVERS\HidBatt.sys
09:27:54.0127 1844 HidBatt - ok
09:27:54.0173 1844 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\windows\system32\DRIVERS\hidbth.sys
09:27:54.0173 1844 HidBth - ok
09:27:54.0205 1844 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\windows\system32\DRIVERS\hidir.sys
09:27:54.0205 1844 HidIr - ok
09:27:54.0252 1844 HidUsb (9592090a7e2b61cd582b612b6df70536) C:\windows\system32\DRIVERS\hidusb.sys
09:27:54.0267 1844 HidUsb - ok
09:27:54.0298 1844 hpdskflt (4e0bec0f78096ffd6d3314b497fc49d3) C:\windows\system32\DRIVERS\hpdskflt.sys
09:27:54.0298 1844 hpdskflt - ok
09:27:54.0345 1844 HPFXBULK (dbd2bb97a574fc565b1eb5c0a03f917a) C:\windows\system32\drivers\hpfx64bulk.sys
09:27:54.0345 1844 HPFXBULK - ok
09:27:54.0392 1844 HpqKbFiltr (b98ee5d4535a685634b90f7e04de0df7) C:\windows\system32\DRIVERS\HpqKbFiltr.sys
09:27:54.0392 1844 HpqKbFiltr - ok
09:27:54.0423 1844 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\windows\system32\drivers\HpSAMD.sys
09:27:54.0423 1844 HpSAMD - ok
09:27:54.0501 1844 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\windows\system32\drivers\HTTP.sys
09:27:54.0501 1844 HTTP - ok
09:27:54.0564 1844 hwdatacard (8f9b0fc4ec3a8194bd4cbc5ed3e7abeb) C:\windows\system32\DRIVERS\ewusbmdm.sys
09:27:54.0564 1844 hwdatacard - ok
09:27:54.0595 1844 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\windows\system32\drivers\hwpolicy.sys
09:27:54.0595 1844 hwpolicy - ok
09:27:54.0642 1844 hwusbdev (230c041af8df1d2308c3ac5146e3ff4f) C:\windows\system32\DRIVERS\ewusbdev.sys
09:27:54.0642 1844 hwusbdev - ok
09:27:54.0688 1844 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\windows\system32\DRIVERS\i8042prt.sys
09:27:54.0688 1844 i8042prt - ok
09:27:54.0735 1844 iaStor (abbf174cb394f5c437410a788b7e404a) C:\windows\system32\DRIVERS\iaStor.sys
09:27:54.0735 1844 iaStor - ok
09:27:54.0813 1844 iaStorV (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\windows\system32\drivers\iaStorV.sys
09:27:54.0813 1844 iaStorV - ok
09:27:54.0876 1844 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\windows\system32\DRIVERS\iirsp.sys
09:27:54.0876 1844 iirsp - ok
09:27:54.0907 1844 Impcd (4b6363cd4610bb848531bb260b15dfcc) C:\windows\system32\DRIVERS\Impcd.sys
09:27:54.0907 1844 Impcd - ok
09:27:54.0954 1844 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\windows\system32\drivers\intelide.sys
09:27:54.0954 1844 intelide - ok
09:27:55.0001 1844 intelppm (ada036632c664caa754079041cf1f8c1) C:\windows\system32\DRIVERS\intelppm.sys
09:27:55.0001 1844 intelppm - ok
09:27:55.0032 1844 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\windows\system32\DRIVERS\ipfltdrv.sys
09:27:55.0032 1844 IpFilterDriver - ok
09:27:55.0063 1844 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\windows\system32\drivers\IPMIDrv.sys
09:27:55.0063 1844 IPMIDRV - ok
09:27:55.0094 1844 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\windows\system32\drivers\ipnat.sys
09:27:55.0094 1844 IPNAT - ok
09:27:55.0125 1844 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\windows\system32\drivers\irenum.sys
09:27:55.0125 1844 IRENUM - ok
09:27:55.0141 1844 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\windows\system32\drivers\isapnp.sys
09:27:55.0157 1844 isapnp - ok
09:27:55.0172 1844 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\windows\system32\drivers\msiscsi.sys
09:27:55.0172 1844 iScsiPrt - ok
09:27:55.0203 1844 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\windows\system32\DRIVERS\kbdclass.sys
09:27:55.0203 1844 kbdclass - ok
09:27:55.0219 1844 kbdhid (0705eff5b42a9db58548eec3b26bb484) C:\windows\system32\DRIVERS\kbdhid.sys
09:27:55.0219 1844 kbdhid - ok
09:27:55.0266 1844 KSecDD (ccd53b5bd33ce0c889e830d839c8b66e) C:\windows\system32\Drivers\ksecdd.sys
09:27:55.0266 1844 KSecDD - ok
09:27:55.0281 1844 KSecPkg (9ff918a261752c12639e8ad4208d2c2f) C:\windows\system32\Drivers\ksecpkg.sys
09:27:55.0281 1844 KSecPkg - ok
09:27:55.0297 1844 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\windows\system32\drivers\ksthunk.sys
09:27:55.0313 1844 ksthunk - ok
09:27:55.0375 1844 lltdio (1538831cf8ad2979a04c423779465827) C:\windows\system32\DRIVERS\lltdio.sys
09:27:55.0375 1844 lltdio - ok
09:27:55.0437 1844 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\windows\system32\DRIVERS\lsi_fc.sys
09:27:55.0437 1844 LSI_FC - ok
09:27:55.0469 1844 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\windows\system32\DRIVERS\lsi_sas.sys
09:27:55.0469 1844 LSI_SAS - ok
09:27:55.0500 1844 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\windows\system32\DRIVERS\lsi_sas2.sys
09:27:55.0500 1844 LSI_SAS2 - ok
09:27:55.0515 1844 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\windows\system32\DRIVERS\lsi_scsi.sys
09:27:55.0515 1844 LSI_SCSI - ok
09:27:55.0578 1844 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\windows\system32\drivers\luafv.sys
09:27:55.0578 1844 luafv - ok
09:27:55.0594 1844 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\windows\system32\DRIVERS\megasas.sys
09:27:55.0594 1844 megasas - ok
09:27:55.0625 1844 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\windows\system32\DRIVERS\MegaSR.sys
09:27:55.0625 1844 MegaSR - ok
09:27:55.0656 1844 Modem (800ba92f7010378b09f9ed9270f07137) C:\windows\system32\drivers\modem.sys
09:27:55.0656 1844 Modem - ok
09:27:55.0687 1844 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\windows\system32\DRIVERS\monitor.sys
09:27:55.0687 1844 monitor - ok
09:27:55.0734 1844 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\windows\system32\DRIVERS\mouclass.sys
09:27:55.0734 1844 mouclass - ok
09:27:55.0765 1844 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\windows\system32\DRIVERS\mouhid.sys
09:27:55.0781 1844 mouhid - ok
09:27:55.0812 1844 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\windows\system32\drivers\mountmgr.sys
09:27:55.0812 1844 mountmgr - ok
09:27:55.0843 1844 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\windows\system32\drivers\mpio.sys
09:27:55.0843 1844 mpio - ok
09:27:55.0874 1844 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\windows\system32\drivers\mpsdrv.sys
09:27:55.0874 1844 mpsdrv - ok
09:27:55.0906 1844 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\windows\system32\drivers\mrxdav.sys
09:27:55.0906 1844 MRxDAV - ok
09:27:55.0937 1844 mrxsmb (a5d9106a73dc88564c825d317cac68ac) C:\windows\system32\DRIVERS\mrxsmb.sys
09:27:55.0937 1844 mrxsmb - ok
09:27:55.0984 1844 mrxsmb10 (d711b3c1d5f42c0c2415687be09fc163) C:\windows\system32\DRIVERS\mrxsmb10.sys
09:27:55.0984 1844 mrxsmb10 - ok
09:27:56.0015 1844 mrxsmb20 (9423e9d355c8d303e76b8cfbd8a5c30c) C:\windows\system32\DRIVERS\mrxsmb20.sys
09:27:56.0015 1844 mrxsmb20 - ok
09:27:56.0030 1844 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\windows\system32\drivers\msahci.sys
09:27:56.0030 1844 msahci - ok
09:27:56.0062 1844 msdsm (db801a638d011b9633829eb6f663c900) C:\windows\system32\drivers\msdsm.sys
09:27:56.0062 1844 msdsm - ok
09:27:56.0093 1844 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\windows\system32\drivers\Msfs.sys
09:27:56.0093 1844 Msfs - ok
09:27:56.0140 1844 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\windows\System32\drivers\mshidkmdf.sys
09:27:56.0140 1844 mshidkmdf - ok
09:27:56.0155 1844 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\windows\system32\drivers\msisadrv.sys
09:27:56.0155 1844 msisadrv - ok
09:27:56.0202 1844 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\windows\system32\drivers\MSKSSRV.sys
09:27:56.0202 1844 MSKSSRV - ok
09:27:56.0218 1844 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\windows\system32\drivers\MSPCLOCK.sys
09:27:56.0218 1844 MSPCLOCK - ok
09:27:56.0311 1844 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\windows\system32\drivers\MSPQM.sys
09:27:56.0311 1844 MSPQM - ok
09:27:56.0343 1844 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\windows\system32\drivers\MsRPC.sys
09:27:56.0343 1844 MsRPC - ok
09:27:56.0374 1844 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\windows\system32\drivers\mssmbios.sys
09:27:56.0374 1844 mssmbios - ok
09:27:56.0389 1844 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\windows\system32\drivers\MSTEE.sys
09:27:56.0389 1844 MSTEE - ok
09:27:56.0421 1844 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\windows\system32\DRIVERS\MTConfig.sys
09:27:56.0421 1844 MTConfig - ok
09:27:56.0452 1844 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\windows\system32\Drivers\mup.sys
09:27:56.0452 1844 Mup - ok
09:27:56.0514 1844 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\windows\system32\DRIVERS\nwifi.sys
09:27:56.0514 1844 NativeWifiP - ok
09:27:56.0592 1844 NDIS (79b47fd40d9a817e932f9d26fac0a81c) C:\windows\system32\drivers\ndis.sys
09:27:56.0592 1844 NDIS - ok
09:27:56.0608 1844 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\windows\system32\DRIVERS\ndiscap.sys
09:27:56.0623 1844 NdisCap - ok
09:27:56.0655 1844 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\windows\system32\DRIVERS\ndistapi.sys
09:27:56.0655 1844 NdisTapi - ok
09:27:56.0686 1844 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\windows\system32\DRIVERS\ndisuio.sys
09:27:56.0686 1844 Ndisuio - ok
09:27:56.0717 1844 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\windows\system32\DRIVERS\ndiswan.sys
09:27:56.0733 1844 NdisWan - ok
09:27:56.0748 1844 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\windows\system32\drivers\NDProxy.sys
09:27:56.0748 1844 NDProxy - ok
09:27:56.0795 1844 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\windows\system32\DRIVERS\netbios.sys
09:27:56.0795 1844 NetBIOS - ok
09:27:56.0811 1844 NetBT (09594d1089c523423b32a4229263f068) C:\windows\system32\DRIVERS\netbt.sys
09:27:56.0811 1844 NetBT - ok
09:27:56.0889 1844 nfrd960 (77889813be4d166cdab78ddba990da92) C:\windows\system32\DRIVERS\nfrd960.sys
09:27:56.0889 1844 nfrd960 - ok
09:27:56.0936 1844 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\windows\system32\drivers\Npfs.sys
09:27:56.0936 1844 Npfs - ok
09:27:56.0951 1844 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\windows\system32\drivers\nsiproxy.sys
09:27:56.0951 1844 nsiproxy - ok
09:27:57.0014 1844 Ntfs (a2f74975097f52a00745f9637451fdd8) C:\windows\system32\drivers\Ntfs.sys
09:27:57.0014 1844 Ntfs - ok
09:27:57.0045 1844 Null (9899284589f75fa8724ff3d16aed75c1) C:\windows\system32\drivers\Null.sys
09:27:57.0045 1844 Null - ok
09:27:57.0107 1844 nvraid (0a92cb65770442ed0dc44834632f66ad) C:\windows\system32\drivers\nvraid.sys
09:27:57.0107 1844 nvraid - ok
09:27:57.0138 1844 nvstor (dab0e87525c10052bf65f06152f37e4a) C:\windows\system32\drivers\nvstor.sys
09:27:57.0154 1844 nvstor - ok
09:27:57.0185 1844 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\windows\system32\drivers\nv_agp.sys
09:27:57.0185 1844 nv_agp - ok
09:27:57.0232 1844 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\windows\system32\drivers\ohci1394.sys
09:27:57.0232 1844 ohci1394 - ok
09:27:57.0310 1844 Parport (0086431c29c35be1dbc43f52cc273887) C:\windows\system32\DRIVERS\parport.sys
09:27:57.0310 1844 Parport - ok
09:27:57.0341 1844 partmgr (871eadac56b0a4c6512bbe32753ccf79) C:\windows\system32\drivers\partmgr.sys
09:27:57.0341 1844 partmgr - ok
09:27:57.0372 1844 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\windows\system32\drivers\pci.sys
09:27:57.0372 1844 pci - ok
09:27:57.0404 1844 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\windows\system32\drivers\pciide.sys
09:27:57.0404 1844 pciide - ok
09:27:57.0419 1844 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\windows\system32\DRIVERS\pcmcia.sys
09:27:57.0419 1844 pcmcia - ok
09:27:57.0450 1844 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\windows\system32\drivers\pcw.sys
09:27:57.0450 1844 pcw - ok
09:27:57.0482 1844 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\windows\system32\drivers\peauth.sys
09:27:57.0482 1844 PEAUTH - ok
09:27:57.0575 1844 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\windows\system32\DRIVERS\raspptp.sys
09:27:57.0575 1844 PptpMiniport - ok
09:27:57.0607 1844 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\windows\system32\DRIVERS\processr.sys
09:27:57.0607 1844 Processor - ok
09:27:57.0653 1844 Psched (0557cf5a2556bd58e26384169d72438d) C:\windows\system32\DRIVERS\pacer.sys
09:27:57.0653 1844 Psched - ok
09:27:57.0716 1844 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\windows\system32\DRIVERS\ql2300.sys
09:27:57.0716 1844 ql2300 - ok
09:27:57.0763 1844 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\windows\system32\DRIVERS\ql40xx.sys
09:27:57.0763 1844 ql40xx - ok
09:27:57.0794 1844 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\windows\system32\drivers\qwavedrv.sys
09:27:57.0794 1844 QWAVEdrv - ok
09:27:57.0825 1844 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\windows\system32\DRIVERS\rasacd.sys
09:27:57.0825 1844 RasAcd - ok
09:27:57.0872 1844 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\windows\system32\DRIVERS\AgileVpn.sys
09:27:57.0872 1844 RasAgileVpn - ok
09:27:57.0903 1844 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\windows\system32\DRIVERS\rasl2tp.sys
09:27:57.0903 1844 Rasl2tp - ok
09:27:57.0919 1844 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\windows\system32\DRIVERS\raspppoe.sys
09:27:57.0919 1844 RasPppoe - ok
09:27:57.0950 1844 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\windows\system32\DRIVERS\rassstp.sys
09:27:57.0950 1844 RasSstp - ok
09:27:57.0981 1844 rdbss (77f665941019a1594d887a74f301fa2f) C:\windows\system32\DRIVERS\rdbss.sys
09:27:57.0981 1844 rdbss - ok
09:27:58.0012 1844 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\windows\system32\DRIVERS\rdpbus.sys
09:27:58.0012 1844 rdpbus - ok
09:27:58.0028 1844 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\windows\system32\DRIVERS\RDPCDD.sys
09:27:58.0028 1844 RDPCDD - ok
09:27:58.0059 1844 RDPDR (1b6163c503398b23ff8b939c67747683) C:\windows\system32\drivers\rdpdr.sys
09:27:58.0059 1844 RDPDR - ok
09:27:58.0106 1844 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\windows\system32\drivers\rdpencdd.sys
09:27:58.0106 1844 RDPENCDD - ok
09:27:58.0137 1844 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\windows\system32\drivers\rdprefmp.sys
09:27:58.0137 1844 RDPREFMP - ok
09:27:58.0168 1844 RDPWD (15b66c206b5cb095bab980553f38ed23) C:\windows\system32\drivers\RDPWD.sys
09:27:58.0168 1844 RDPWD - ok
09:27:58.0199 1844 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\windows\system32\drivers\rdyboost.sys
09:27:58.0215 1844 rdyboost - ok
09:27:58.0262 1844 RFCOMM (3dd798846e2c28102b922c56e71b7932) C:\windows\system32\DRIVERS\rfcomm.sys
09:27:58.0262 1844 RFCOMM - ok
09:27:58.0309 1844 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\windows\system32\DRIVERS\rspndr.sys
09:27:58.0309 1844 rspndr - ok
09:27:58.0371 1844 RSUSBSTOR (30f463768d5143bfd7b2df822b53cf4d) C:\windows\system32\Drivers\RtsUStor.sys
09:27:58.0371 1844 RSUSBSTOR - ok
09:27:58.0418 1844 RTL8167 (ee082e06a82ff630351d1e0ebbd3d8d0) C:\windows\system32\DRIVERS\Rt64win7.sys
09:27:58.0418 1844 RTL8167 - ok
09:27:58.0449 1844 s3cap (e60c0a09f997826c7627b244195ab581) C:\windows\system32\drivers\vms3cap.sys
09:27:58.0449 1844 s3cap - ok
09:27:58.0496 1844 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\windows\system32\drivers\sbp2port.sys
09:27:58.0496 1844 sbp2port - ok
09:27:58.0543 1844 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\windows\system32\DRIVERS\scfilter.sys
09:27:58.0543 1844 scfilter - ok
09:27:58.0590 1844 sdbus (111e0ebc0ad79cb0fa014b907b231cf0) C:\windows\system32\drivers\sdbus.sys
09:27:58.0590 1844 sdbus - ok
09:27:58.0636 1844 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\windows\system32\drivers\secdrv.sys
09:27:58.0636 1844 secdrv - ok
09:27:58.0683 1844 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\windows\system32\DRIVERS\serenum.sys
09:27:58.0683 1844 Serenum - ok
09:27:58.0714 1844 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\windows\system32\DRIVERS\serial.sys
09:27:58.0714 1844 Serial - ok
09:27:58.0761 1844 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\windows\system32\DRIVERS\sermouse.sys
09:27:58.0761 1844 sermouse - ok
09:27:58.0808 1844 sffdisk (a554811bcd09279536440c964ae35bbf) C:\windows\system32\drivers\sffdisk.sys
09:27:58.0808 1844 sffdisk - ok
09:27:58.0824 1844 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\windows\system32\drivers\sffp_mmc.sys
09:27:58.0824 1844 sffp_mmc - ok
09:27:58.0839 1844 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\windows\system32\drivers\sffp_sd.sys
09:27:58.0839 1844 sffp_sd - ok
09:27:58.0870 1844 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\windows\system32\DRIVERS\sfloppy.sys
09:27:58.0870 1844 sfloppy - ok
09:27:58.0933 1844 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\windows\system32\DRIVERS\SiSRaid2.sys
09:27:58.0933 1844 SiSRaid2 - ok
09:27:58.0949 1844 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\windows\system32\DRIVERS\sisraid4.sys
09:27:58.0949 1844 SiSRaid4 - ok
09:27:58.0995 1844 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\windows\system32\DRIVERS\smb.sys
09:27:58.0995 1844 Smb - ok
09:27:59.0089 1844 SNP2UVC (94820815a302e54b63f0d3fb919c225d) C:\windows\system32\DRIVERS\snp2uvc.sys
09:27:59.0105 1844 SNP2UVC - ok
09:27:59.0120 1844 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\windows\system32\drivers\spldr.sys
09:27:59.0120 1844 spldr - ok
09:27:59.0198 1844 srv (441fba48bff01fdb9d5969ebc1838f0b) C:\windows\system32\DRIVERS\srv.sys
09:27:59.0198 1844 srv - ok
09:27:59.0229 1844 srv2 (b4adebbf5e3677cce9651e0f01f7cc28) C:\windows\system32\DRIVERS\srv2.sys
09:27:59.0229 1844 srv2 - ok
09:27:59.0245 1844 srvnet (27e461f0be5bff5fc737328f749538c3) C:\windows\system32\DRIVERS\srvnet.sys
09:27:59.0245 1844 srvnet - ok
09:27:59.0307 1844 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\windows\system32\DRIVERS\stexstor.sys
09:27:59.0307 1844 stexstor - ok
09:27:59.0354 1844 STHDA (4a9d087c9a97071b9d06db38567da906) C:\windows\system32\DRIVERS\stwrt64.sys
09:27:59.0354 1844 STHDA - ok
09:27:59.0417 1844 storflt (7785dc213270d2fc066538daf94087e7) C:\windows\system32\drivers\vmstorfl.sys
09:27:59.0417 1844 storflt - ok
09:27:59.0448 1844 storvsc (d34e4943d5ac096c8edeebfd80d76e23) C:\windows\system32\drivers\storvsc.sys
09:27:59.0448 1844 storvsc - ok
09:27:59.0479 1844 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\windows\system32\drivers\swenum.sys
09:27:59.0479 1844 swenum - ok
09:27:59.0541 1844 SynTP (d268d2a0db2a2bbe963e688d0b039267) C:\windows\system32\DRIVERS\SynTP.sys
09:27:59.0541 1844 SynTP - ok
09:27:59.0604 1844 tap0801 (8502bfc9c990567e4049358ec063d621) C:\windows\system32\DRIVERS\tap0801.sys
09:27:59.0604 1844 tap0801 - ok
09:27:59.0666 1844 tapoas (927d0cdb3f96efc1e98fb1a2c9fb67ad) C:\windows\system32\DRIVERS\tapoas.sys
09:27:59.0666 1844 tapoas - ok
09:27:59.0729 1844 Tcpip (fc62769e7bff2896035aeed399108162) C:\windows\system32\drivers\tcpip.sys
09:27:59.0744 1844 Tcpip - ok
09:27:59.0807 1844 TCPIP6 (fc62769e7bff2896035aeed399108162) C:\windows\system32\DRIVERS\tcpip.sys
09:27:59.0822 1844 TCPIP6 - ok
09:27:59.0854 1844 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\windows\system32\drivers\tcpipreg.sys
09:27:59.0854 1844 tcpipreg - ok
09:27:59.0885 1844 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\windows\system32\drivers\tdpipe.sys
09:27:59.0885 1844 TDPIPE - ok
09:27:59.0916 1844 TDTCP (e4245bda3190a582d55ed09e137401a9) C:\windows\system32\drivers\tdtcp.sys
09:27:59.0916 1844 TDTCP - ok
09:27:59.0963 1844 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\windows\system32\DRIVERS\tdx.sys
09:27:59.0963 1844 tdx - ok
09:28:00.0025 1844 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\windows\system32\drivers\termdd.sys
09:28:00.0025 1844 TermDD - ok
09:28:00.0088 1844 tifsfilter (3e24b7fe52bc455da8d6e2cc2b4ca23f) C:\windows\system32\DRIVERS\tifsfilt.sys
09:28:00.0088 1844 tifsfilter - ok
09:28:00.0103 1844 timounter (ec4fd4d147985a97e881729e808e6f34) C:\windows\system32\DRIVERS\timntr.sys
09:28:00.0119 1844 timounter - ok
09:28:00.0150 1844 TPM (dbcc20c02e8a3e43b03c304a4e40a84f) C:\windows\system32\drivers\tpm.sys
09:28:00.0150 1844 TPM - ok
09:28:00.0181 1844 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\windows\system32\DRIVERS\tssecsrv.sys
09:28:00.0181 1844 tssecsrv - ok
09:28:00.0228 1844 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\windows\system32\drivers\tsusbflt.sys
09:28:00.0228 1844 TsUsbFlt - ok
09:28:00.0275 1844 tunnel (3566a8daafa27af944f5d705eaa64894) C:\windows\system32\DRIVERS\tunnel.sys
09:28:00.0275 1844 tunnel - ok
09:28:00.0306 1844 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\windows\system32\DRIVERS\uagp35.sys
09:28:00.0306 1844 uagp35 - ok
09:28:00.0322 1844 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\windows\system32\DRIVERS\udfs.sys
09:28:00.0322 1844 udfs - ok
09:28:00.0384 1844 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\windows\system32\drivers\uliagpkx.sys
09:28:00.0384 1844 uliagpkx - ok
09:28:00.0431 1844 umbus (dc54a574663a895c8763af0fa1ff7561) C:\windows\system32\DRIVERS\umbus.sys
09:28:00.0431 1844 umbus - ok
09:28:00.0462 1844 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\windows\system32\DRIVERS\umpass.sys
09:28:00.0462 1844 UmPass - ok
09:28:00.0525 1844 usbaudio (82e8f44688e6fac57b5b7c6fc7adbc2a) C:\windows\system32\drivers\usbaudio.sys
09:28:00.0525 1844 usbaudio - ok
09:28:00.0556 1844 usbccgp (6f1a3157a1c89435352ceb543cdb359c) C:\windows\system32\DRIVERS\usbccgp.sys
09:28:00.0556 1844 usbccgp - ok
09:28:00.0603 1844 usbcir (af0892a803fdda7492f595368e3b68e7) C:\windows\system32\drivers\usbcir.sys
09:28:00.0603 1844 usbcir - ok
09:28:00.0618 1844 usbehci (c025055fe7b87701eb042095df1a2d7b) C:\windows\system32\drivers\usbehci.sys
09:28:00.0634 1844 usbehci - ok
09:28:00.0665 1844 usbhub (287c6c9410b111b68b52ca298f7b8c24) C:\windows\system32\DRIVERS\usbhub.sys
09:28:00.0665 1844 usbhub - ok
09:28:00.0696 1844 usbohci (9840fc418b4cbd632d3d0a667a725c31) C:\windows\system32\drivers\usbohci.sys
09:28:00.0696 1844 usbohci - ok
09:28:00.0743 1844 usbprint (73188f58fb384e75c4063d29413cee3d) C:\windows\system32\DRIVERS\usbprint.sys
09:28:00.0743 1844 usbprint - ok
09:28:00.0774 1844 usbscan (aaa2513c8aed8b54b189fd0c6b1634c0) C:\windows\system32\DRIVERS\usbscan.sys
09:28:00.0774 1844 usbscan - ok
09:28:00.0821 1844 USBSTOR (fed648b01349a3c8395a5169db5fb7d6) C:\windows\system32\DRIVERS\USBSTOR.SYS
09:28:00.0821 1844 USBSTOR - ok
09:28:00.0852 1844 usbuhci (62069a34518bcf9c1fd9e74b3f6db7cd) C:\windows\system32\drivers\usbuhci.sys
09:28:00.0852 1844 usbuhci - ok
09:28:00.0899 1844 usbvideo (454800c2bc7f3927ce030141ee4f4c50) C:\windows\system32\Drivers\usbvideo.sys
09:28:00.0899 1844 usbvideo - ok
09:28:00.0961 1844 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\windows\system32\drivers\vdrvroot.sys
09:28:00.0961 1844 vdrvroot - ok
09:28:01.0008 1844 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\windows\system32\DRIVERS\vgapnp.sys
09:28:01.0008 1844 vga - ok
09:28:01.0024 1844 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\windows\System32\drivers\vga.sys
09:28:01.0024 1844 VgaSave - ok
09:28:01.0055 1844 vhdmp (2ce2df28c83aeaf30084e1b1eb253cbb) C:\windows\system32\drivers\vhdmp.sys
09:28:01.0055 1844 vhdmp - ok
09:28:01.0086 1844 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\windows\system32\drivers\viaide.sys
09:28:01.0086 1844 viaide - ok
09:28:01.0118 1844 vmbus (86ea3e79ae350fea5331a1303054005f) C:\windows\system32\drivers\vmbus.sys
09:28:01.0118 1844 vmbus - ok
09:28:01.0149 1844 VMBusHID (7de90b48f210d29649380545db45a187) C:\windows\system32\drivers\VMBusHID.sys
09:28:01.0149 1844 VMBusHID - ok
09:28:01.0180 1844 volmgr (d2aafd421940f640b407aefaaebd91b0) C:\windows\system32\drivers\volmgr.sys
09:28:01.0180 1844 volmgr - ok
09:28:01.0211 1844 volmgrx (a255814907c89be58b79ef2f189b843b) C:\windows\system32\drivers\volmgrx.sys
09:28:01.0211 1844 volmgrx - ok
09:28:01.0242 1844 volsnap (0d08d2f3b3ff84e433346669b5e0f639) C:\windows\system32\drivers\volsnap.sys
09:28:01.0242 1844 volsnap - ok
09:28:01.0289 1844 vpcbus (b4a73ca4ef9a02b9738cea9ad5fe5917) C:\windows\system32\DRIVERS\vpchbus.sys
09:28:01.0289 1844 vpcbus - ok
09:28:01.0336 1844 vpcnfltr (e675fb2b48c54f09895482e2253b289c) C:\windows\system32\DRIVERS\vpcnfltr.sys
09:28:01.0336 1844 vpcnfltr - ok
09:28:01.0352 1844 vpcusb (5fb42082b0d19a0268705f1dd343df20) C:\windows\system32\DRIVERS\vpcusb.sys
09:28:01.0352 1844 vpcusb - ok
09:28:01.0398 1844 vpcvmm (207b6539799cc1c112661a9b620dd233) C:\windows\system32\drivers\vpcvmm.sys
09:28:01.0398 1844 vpcvmm - ok
09:28:01.0430 1844 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\windows\system32\DRIVERS\vsmraid.sys
09:28:01.0430 1844 vsmraid - ok
09:28:01.0461 1844 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\windows\system32\DRIVERS\vwifibus.sys
09:28:01.0461 1844 vwifibus - ok
09:28:01.0492 1844 vwififlt (6a3d66263414ff0d6fa754c646612f3f) C:\windows\system32\DRIVERS\vwififlt.sys
09:28:01.0492 1844 vwififlt - ok
09:28:01.0523 1844 vwifimp (6a638fc4bfddc4d9b186c28c91bd1a01) C:\windows\system32\DRIVERS\vwifimp.sys
09:28:01.0523 1844 vwifimp - ok
09:28:01.0554 1844 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\windows\system32\DRIVERS\wacompen.sys
09:28:01.0554 1844 WacomPen - ok
09:28:01.0601 1844 WANARP (356afd78a6ed4457169241ac3965230c) C:\windows\system32\DRIVERS\wanarp.sys
09:28:01.0601 1844 WANARP - ok
09:28:01.0632 1844 Wanarpv6 (356afd78a6ed4457169241ac3965230c) C:\windows\system32\DRIVERS\wanarp.sys
09:28:01.0632 1844 Wanarpv6 - ok
09:28:01.0679 1844 Wd (72889e16ff12ba0f235467d6091b17dc) C:\windows\system32\DRIVERS\wd.sys
09:28:01.0679 1844 Wd - ok
09:28:01.0726 1844 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\windows\system32\drivers\Wdf01000.sys
09:28:01.0726 1844 Wdf01000 - ok
09:28:01.0773 1844 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\windows\system32\DRIVERS\wfplwf.sys
09:28:01.0773 1844 WfpLwf - ok
09:28:01.0789 1844 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\windows\system32\drivers\wimmount.sys
09:28:01.0789 1844 WIMMount - ok
09:28:01.0851 1844 WinUSB (fe88b288356e7b47b74b13372add906d) C:\windows\system32\DRIVERS\WinUSB.sys
09:28:01.0851 1844 WinUSB - ok
09:28:01.0898 1844 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\windows\system32\drivers\wmiacpi.sys
09:28:01.0898 1844 WmiAcpi - ok
09:28:01.0945 1844 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\windows\system32\drivers\ws2ifsl.sys
09:28:01.0945 1844 ws2ifsl - ok
09:28:02.0023 1844 WudfPf (d3381dc54c34d79b22cee0d65ba91b7c) C:\windows\system32\drivers\WudfPf.sys
09:28:02.0023 1844 WudfPf - ok
09:28:02.0069 1844 WUDFRd (cf8d590be3373029d57af80914190682) C:\windows\system32\DRIVERS\WUDFRd.sys
09:28:02.0069 1844 WUDFRd - ok
09:28:02.0132 1844 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
09:28:02.0147 1844 \Device\Harddisk0\DR0 - ok
09:28:02.0147 1844 Boot (0x1200) (a7f87870940ef3358619332dd559d1fe) \Device\Harddisk0\DR0\Partition0
09:28:02.0147 1844 \Device\Harddisk0\DR0\Partition0 - ok
09:28:02.0163 1844 Boot (0x1200) (a84759faf0873ff05cfef8f61c4aae04) \Device\Harddisk0\DR0\Partition1
09:28:02.0163 1844 \Device\Harddisk0\DR0\Partition1 - ok
09:28:02.0194 1844 Boot (0x1200) (c0bdfd2fdf6366489fad47e22fcad601) \Device\Harddisk0\DR0\Partition2
09:28:02.0210 1844 \Device\Harddisk0\DR0\Partition2 - ok
09:28:02.0241 1844 Boot (0x1200) (04ccb5a604eea202bddda597962850d2) \Device\Harddisk0\DR0\Partition3
09:28:02.0241 1844 \Device\Harddisk0\DR0\Partition3 - ok
09:28:02.0241 1844 ============================================================
09:28:02.0241 1844 Scan finished
09:28:02.0241 1844 ============================================================
09:28:02.0257 2468 Detected object count: 0
09:28:02.0257 2468 Actual detected object count: 0

Fajn

zítra na ty logy mrknu

dobrou noc

zdravim,
pozrel sa niekto na tie logy? Znova sa mi objavuje to iste....vdaka

Chybička se vbloudila, zapomněl jsem na vás. Příště křičte dříve.. momentálně mám nějakou práci, ale hned jak bude chvilka, mrknu na to

Poprosím o nový log z CF, situace se mohla změnit..

Program nepoužívejte bez doporučení Rádce a pozorně se řiďte následujících pokynu,protože program netoleruje chyby a může dojít k úplnému poškození systému!!

Stáhneme si Combofix
Program uložíme nejlépe na Plochu
Vypneme všechny rezidentní štíty.Jak antiviru,tak antispywaru a firewallu
Vypneme všechny běžící aplikace (ICQ,prohlížeč,programy) a necháme pouze Combofix
Spustíme Combofix.exe s administrátorským oprávněním
U Windows XP se přihlásíme pod účtem správce
Ve Windows 7 a Vista klikněte pravým tlačítkem myši na Combofix.exe a dejte ,,Spustit jako správce,,)
Hned po startu programu na vás vyskočí licenční podmínky,tak potvrdíme tlačítkemANO
Pokud vám Combofix nabídne instalaci Konzoly pro zotavení,tak souhlaste a nechte nainstalovat(zde je potřeba aktivní připojení na internet)
Pokračujte dle pokynů programu a během skenování na nic neklikejte,na pc nepracujte(ICQ,jiné aplikace,internet..).Nechte počítač v klidu.
Celý sken tvá mezi 5-15 min,ale pokud je v PC hodně havěti,tak se čas může lišit.
Po skončení skenování(případném restartu počítače) se vám zobrazí log z Combofixu,který mi vložte sem(Kdyby se log nezobrazil,tak jej najdete zde: C:\ComboFix.txt
(Pokud si nevíte rady s kterýmkoliv z výše uvedených kroků,tak se ptejte nebo mrkněte na detailnější návod včetně obrázků http://www.bleepingcomputer.com/combofi ... t-combofix )

ComboFix 11-12-10.01 - baril_pa . 12. 2011 19:46:42.3.4 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1250.421.1051.18.1967.1067 [GMT 1:00]
Running from: c:\users\baril_pa\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\LP
c:\program files (x86)\LP\2DCB\12C0.tmp
c:\program files (x86)\LP\2DCB\155A.tmp
c:\program files (x86)\LP\2DCB\1AEE.tmp
c:\program files (x86)\LP\2DCB\3B04.tmp
c:\program files (x86)\LP\2DCB\4F2.tmp
c:\program files (x86)\LP\2DCB\784B.tmp
c:\program files (x86)\LP\2DCB\A82.exe
c:\program files (x86)\LP\2DCB\AC45.tmp
c:\program files (x86)\LP\2DCB\B005.exe
c:\program files (x86)\LP\2DCB\B005.tmp
c:\program files (x86)\LP\2DCB\B64A.tmp
c:\program files (x86)\LP\2DCB\CAD1.tmp
c:\program files (x86)\LP\2DCB\CBA4.tmp
c:\program files (x86)\LP\2DCB\CD26.tmp
c:\program files (x86)\LP\2DCB\D168.tmp
c:\program files (x86)\LP\2DCB\E6B0.tmp
c:\program files (x86)\LP\2DCB\F9F.tmp
c:\users\baril_pa\AppData\Roaming\B0AB3
c:\users\baril_pa\AppData\Roaming\B0AB3\3460.0AB
c:\users\baril_pa\AppData\Roaming\B0AB3\9882D.exe
c:\users\baril_pa\AppData\Roaming\dvdae
c:\users\baril_pa\AppData\Roaming\dvdae\dvdae.config
c:\users\baril_pa\AppData\Roaming\dvdae\dvdae.lic
c:\users\baril_pa\AppData\Roaming\DVDSubEditLastFile0.txt
.
.
((((((((((((((((((((((((( Files Created from 2011-11-11 to 2011-12-11 )))))))))))))))))))))))))))))))
.
.
2011-12-11 18:57 . 2011-12-11 18:57 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-12-11 18:57 . 2011-12-11 18:57 -------- d-----w- c:\users\Admin\AppData\Local\temp
2011-12-11 18:57 . 2011-12-11 18:57 -------- d-----w- c:\users\adm_arcus\AppData\Local\temp
2011-12-11 08:28 . 2011-12-11 08:28 -------- d-----w- c:\program files (x86)\B3460
2011-12-11 07:46 . 2011-12-11 07:46 -------- d-----w- C:\usa
2011-12-10 18:56 . 2011-12-10 18:59 -------- d-----w- C:\win2
2011-12-09 13:42 . 2005-11-28 22:02 294912 ----a-w- C:\PgcDemux.exe
2011-12-09 13:31 . 2011-12-09 13:31 279616 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2011-12-09 13:31 . 2011-12-09 13:31 -------- d-----w- c:\program files (x86)\DAEMON Tools Lite
2011-12-09 13:30 . 2011-12-09 13:32 -------- d-----w- c:\users\baril_pa\AppData\Roaming\DAEMON Tools Lite
2011-12-09 13:30 . 2011-12-09 13:30 -------- d-----w- c:\programdata\DAEMON Tools Lite
2011-12-09 12:03 . 2011-12-10 08:27 -------- d-----w- C:\Winnetou II
2011-12-09 10:54 . 2011-12-09 10:54 -------- d-----w- C:\eac3to
2011-12-09 10:54 . 2008-02-22 20:55 499707 ----a-w- C:\EAC3toGUI.exe
2011-12-09 06:17 . 2011-11-30 01:21 8822856 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{09FC6630-935D-4F75-9212-03B841325041}\mpengine.dll
2011-12-08 20:44 . 2011-12-08 20:44 -------- d-----w- c:\users\baril_pa\AppData\Roaming\ImTOO
2011-12-08 20:43 . 2011-12-08 20:43 -------- d-----w- c:\program files (x86)\ImTOO
2011-12-08 20:41 . 2011-12-08 20:42 -------- d-----w- c:\program files (x86)\DVD Decrypter
2011-12-08 20:35 . 2011-12-08 20:35 276256 ----a-w- c:\windows\system32\drivers\DigiartyVirtualCDBus.sys
2011-12-08 20:35 . 2011-12-08 20:35 -------- d-----w- c:\users\baril_pa\AppData\Roaming\Digiarty
2011-12-08 20:35 . 2011-12-08 20:35 -------- d-----w- c:\program files\Digiarty
2011-12-08 20:30 . 2011-12-08 20:45 -------- d-----w- c:\users\baril_pa\AppData\Roaming\dvdcss
2011-12-08 20:28 . 2011-12-09 13:24 -------- d-----w- c:\program files (x86)\DVD Audio Extractor
2011-12-06 08:35 . 2011-12-06 08:35 -------- d-----w- c:\program files\ESET
2011-12-06 08:32 . 2011-12-06 08:32 -------- d-----w- c:\users\baril_pa\AppData\Local\ESET
2011-12-04 14:33 . 2011-12-04 14:33 -------- d-----w- c:\users\baril_pa\AppData\Local\VirtualStore
2011-12-04 14:25 . 2011-12-06 08:31 -------- d-----w- C:\rs
2011-12-04 09:01 . 2011-12-04 09:01 -------- d-----w- c:\users\baril_pa\AppData\Roaming\Malwarebytes
2011-12-04 09:01 . 2011-12-04 09:01 -------- d-----w- c:\programdata\Malwarebytes
2011-12-04 09:01 . 2011-08-31 16:00 25416 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-12-04 07:35 . 2011-12-04 07:35 -------- d-----w- c:\program files (x86)\trend micro
2011-12-01 19:09 . 2011-12-01 19:15 -------- d-----w- c:\programdata\webcamXP 5
2011-12-01 19:09 . 2011-12-01 19:09 -------- d-----w- c:\program files (x86)\webcamXP 5
2011-11-29 21:16 . 2011-12-01 14:55 -------- d-----r- c:\users\baril_pa\Dropbox
2011-11-29 21:12 . 2011-12-01 20:11 -------- d-----w- c:\users\baril_pa\AppData\Roaming\Dropbox
2011-11-29 09:35 . 2011-11-29 09:35 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin7.dll
2011-11-29 09:35 . 2011-11-29 09:35 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin6.dll
2011-11-29 09:35 . 2011-11-29 09:35 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin5.dll
2011-11-29 09:35 . 2011-11-29 09:35 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin4.dll
2011-11-29 09:35 . 2011-11-29 09:35 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin3.dll
2011-11-29 09:35 . 2011-11-29 09:35 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin2.dll
2011-11-29 09:35 . 2011-11-29 09:35 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin.dll
2011-11-29 09:35 . 2011-11-29 09:35 -------- d-----w- c:\program files (x86)\QuickTime
2011-11-29 09:35 . 2011-11-29 09:35 -------- d-----w- c:\programdata\Apple Computer
2011-11-29 09:30 . 2011-11-29 09:30 -------- d-----w- c:\program files (x86)\Apple Software Update
2011-11-25 18:32 . 2011-12-10 05:48 -------- d-----w- c:\program files (x86)\URUSoft
2011-11-23 21:37 . 2010-05-26 10:41 2106216 ----a-w- c:\windows\SysWow64\D3DCompiler_43.dll
2011-11-23 21:37 . 2010-05-26 10:41 1998168 ----a-w- c:\windows\SysWow64\D3DX9_43.dll
2011-11-23 11:28 . 2011-11-23 11:28 -------- d-----w- c:\windows\SysWow64\VivotekIPP
2011-11-22 16:53 . 2011-11-22 16:53 -------- d-----w- c:\program files (x86)\Common Files\Intel Corporation
2011-11-13 19:59 . 2011-11-15 06:52 -------- d-----w- c:\users\baril_pa\AppData\Roaming\Mirillis
2011-11-13 19:59 . 2011-11-15 06:52 -------- d-----w- c:\programdata\Mirillis
2011-11-13 19:59 . 2011-11-15 06:52 -------- d-----w- c:\users\baril_pa\AppData\Local\Mirillis
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-12 09:47 . 2011-06-21 12:59 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-10-27 09:34 . 2011-10-27 09:50 668938 ----a-w- c:\windows\unins000.exe
2011-10-24 13:29 . 2011-10-24 13:29 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx
2011-10-24 13:29 . 2011-10-24 13:29 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts
2011-09-29 16:29 . 2011-11-09 20:11 1923952 ----a-w- c:\windows\system32\drivers\tcpip.sys
2011-09-29 04:03 . 2011-11-09 20:11 3144704 ----a-w- c:\windows\system32\win32k.sys
2011-09-14 15:32 . 2011-09-14 15:32 1768960 ----a-w- c:\windows\SysWow64\PmTrdvw2.dll
2011-09-14 15:32 . 2011-09-14 15:32 909312 ----a-w- c:\windows\SysWow64\PmTable.ocx
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Thunderbird"="c:\program files (x86)\Mozilla Thunderbird\thunderbird -turbo" [X]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2011-10-13 17351304]
"uTorrent"="c:\program files (x86)\uTorrent\uTorrent.exe" [2011-10-20 641400]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-03-04 284696]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-08-05 98304]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HideSCAHealth"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 SgtSch2Svc;Seagate Scheduler2 Service;c:\program files (x86)\Common Files\Seagate\Schedule2\schedul2.exe [x]
R3 ALSysIO;ALSysIO;c:\users\baril_pa\AppData\Local\Temp\ALSysIO64.sys [x]
R3 ARCVCAM;ARCVCAM, ArcSoft Webcam Sharing Manager Driver;c:\windows\system32\DRIVERS\ArcSoftVCapture.sys [x]
R3 DigiartyVirtualCDBus;Digiarty Virtual Driver;c:\windows\system32\drivers\DigiartyVirtualCDBus.sys [x]
R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys [x]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 tap0801;TAP-Win32 Adapter V8;c:\windows\system32\DRIVERS\tap0801.sys [x]
R3 tapoas;TAP-Win32 Adapter OAS;c:\windows\system32\DRIVERS\tapoas.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Služba Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 wxpSvc;webcamXP Service;c:\program files (x86)\webcamXP 5\wService.exe [2011-07-27 5023744]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b20011ea53a6b83e\AESTSr64.exe [2009-03-03 89600]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe [2011-01-12 810144]
S2 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [x]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-04 13336]
S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-11-03 2358656]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-11-04 2320920]
S2 vcsFPService;Validity VCS Fingerprint Service;c:\windows\system32\vcsFPService.exe [2009-12-14 2019120]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys [x]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-06-17 20:11 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2011-01-12 2918656]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyServer = http=127.0.0.1:64323
IE: E&xportovať do programu Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Od&oslať do programu OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: Odoslať obrázok do &Zariadenia s rozhraním Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Odoslať stránku do &Zariadenia s rozhraním Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: Translate this web page with Babylon - c:\program files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm
IE: Translate with Babylon - c:\program files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Action.htm
TCP: DhcpNameServer = 192.168.0.1
DPF: {45830FF9-D9E6-4F41-86ED-B266933D8E90} - hxxp://192.168.133.165/RtspVaPgDec.cab
DPF: {73888E2B-FF04-416C-8847-984D7FC4507F} - hxxp://192.168.1.3/RtspVaPgDecNew2.cab
DPF: {F8E691A0-C92E-4E42-9CDA-62FC07A9483B} - hxxp://actiftp.hosting4less.com/ACTIGENERAL/AP&Manual/Live%20Demo/nvUnifiedControl.ocx
FF - ProfilePath - c:\users\baril_pa\AppData\Roaming\Mozilla\Firefox\Profiles\3a0tzbjw.default\
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 64323
FF - prefs.js: network.proxy.type - 1
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
.
- - - - ORPHANS REMOVED - - - -
.
Wow6432Node-HKLM-Run-A82.exe - c:\program files (x86)\LP\2DCB\A82.exe
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wxpSvc]
"ImagePath"="c:\program files (x86)\webcamXP 5\wService.exe /startedbyscm:5053B757-40E35B3B-webcamSRV"
.
Completion time: 2011-12-11 19:59:51
ComboFix-quarantined-files.txt 2011-12-11 18:59
.
Pre-Run: 177 233 276 928 bytes free
Post-Run: 176 591 151 104 bytes free
.
- - End Of File - - C0570E98BD8289C47C35D100EFDE1484

VIRY.CZ

Backdoor: cycbot.b

Backdoor: cycbot.b

Re: Backdoor: cycbot.b

Re: Backdoor: cycbot.b

Re: Backdoor: cycbot.b

Re: Backdoor: cycbot.b

Re: Backdoor: cycbot.b

Re: Backdoor: cycbot.b

Re: Backdoor: cycbot.b

Re: Backdoor: cycbot.b

Re: Backdoor: cycbot.b

Re: Backdoor: cycbot.b

Re: Backdoor: cycbot.b

Re: Backdoor: cycbot.b

Re: Backdoor: cycbot.b

Re: Backdoor: cycbot.b