VIRY.CZ

Dobry den, prosim o kontrolu logu, antivir mi v Pc nasel nejake trojske kone, pocitac se mi hodne zasekava. Dekuji


Logfile of random's system information tool 1.09 (written by random/random)
Run by M3th0dman at 2012-05-01 13:57:04
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 9 GB (3%) free of 305 GB
Total RAM: 2047 MB (58% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:57:17, on 1.5.2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16876)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Avast\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\ME\INSTALACKY\PROCEXP.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\ASUS\EPU-4 Engine\FourEngine.exe
C:\Program Files\Avast\avastUI.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\EXPERTool\TBPanel.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\M3th0dman\Data aplikací\winlogon.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\ME\programz\totalcmd\TOTALCMD.EXE
C:\ME\games\dota\garena\Garena.exe
C:\Documents and Settings\M3th0dman\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\M3th0dman\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\M3th0dman\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\M3th0dman\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\M3th0dman\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\M3th0dman\Dokumenty\Downloads\RSIT.exe
C:\Program Files\trend micro\M3th0dman.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://startsear.ch/?aff=1
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://startsear.ch/?aff=1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
F2 - REG:system.ini: Shell=explorer.exe, svdhalp.exe
F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe,C:\Documents and Settings\M3th0dman\Data aplikací\winlogon.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: IE5BarLauncherBHO Class - {78F3A323-798E-4AEA-9A57-88F4B05FD5DD} - C:\Program Files\vShare.tv plugin\BarLcher.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Avast\aswWebRepIE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Avast\aswWebRepIE.dll
O3 - Toolbar: VShareToolBar - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - C:\Program Files\vShare.tv plugin\BarLcher.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Six Engine] "C:\Program Files\ASUS\EPU-4 Engine\FourEngine.exe" -r
O4 - HKLM\..\Run: [MSWUpdate] "C:\Documents and Settings\M3th0dman\Data aplikací\csrss.exe"
O4 - HKLM\..\Run: [Windows Defender] C:\Documents and Settings\M3th0dman\Data aplikací\QZL469K0QI.exe
O4 - HKLM\..\Run: [haha] C:\Documents and Settings\M3th0dman\Data aplikací\Sys32Disp.exe.exe
O4 - HKLM\..\Run: [GJNZY6I9K6848] C:\Documents and Settings\M3th0dman\Data aplikací\C03WQ9HIWU.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avast] "C:\Program Files\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [winlogon] C:\Documents and Settings\M3th0dman\Data aplikací\winlogon.exe
O4 - HKLM\..\Run: [svchost] C:\Documents and Settings\M3th0dman\Data aplikací\svchost.exe
O4 - HKLM\..\Run: [HPUsageTracking] "C:\Program Files\HP\HP UT\bin\hppusg.exe" "C:\Program Files\HP\HP UT\"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [GAINWARD] C:\Program Files\EXPERTool\TBPanel.exe /A
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [System] C:\Documents and Settings\M3th0dman\Music\lst.exe
O4 - HKCU\..\Run: [MSWUpdate] "C:\Documents and Settings\M3th0dman\Data aplikací\csrss.exe"
O4 - HKCU\..\Run: [RestoreSys] C:\Documents and Settings\M3th0dman\Data aplikací\243828059.exe
O4 - HKCU\..\Run: [Windows Defender] C:\Documents and Settings\M3th0dman\Data aplikací\QZL469K0QI.exe
O4 - HKCU\..\Run: [syshost32.exe] "C:\Documents and Settings\M3th0dman\Data aplikací\syshost32.exe"
O4 - HKCU\..\Run: [syshost64.exe] "C:\Documents and Settings\M3th0dman\Data aplikací\syshost32.exe"
O4 - HKCU\..\Run: [haha] C:\Documents and Settings\M3th0dman\Data aplikací\Sys32Disp.exe.exe
O4 - HKCU\..\Run: [worm, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null] file:///C:/Documents and Settings/M3th0dman/Local Settings/Temp/20054.exe
O4 - HKCU\..\Run: [Microsoft] file:///C:/Documents and Settings/M3th0dman/Local Settings/Temp/20054.exe
O4 - HKCU\..\Run: [GJNZY6I9K6848] C:\Documents and Settings\M3th0dman\Data aplikací\C03WQ9HIWU.exe
O4 - HKCU\..\Run: [svchost] C:\Documents and Settings\M3th0dman\Data aplikací\svchost.exe
O4 - HKCU\..\Run: [Windows Service Host] C:\Documents and Settings\M3th0dman\Data aplikací\svchost.exe
O4 - HKCU\..\Run: [{C90B7F57-99C2-3673-7E81-4E54EA6B7546}] "C:\Documents and Settings\M3th0dman\Data aplikací\Doob\qomis.exe"
O4 - HKCU\..\Run: [Winskob] C:\Documents and Settings\M3th0dman\Data aplikací\Microsoft\Winskob.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [winlogon] C:\Documents and Settings\M3th0dman\Data aplikací\winlogon.exe
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil10a.exe
O4 - HKLM\..\Policies\Explorer\Run: [Windows Defender] C:\Documents and Settings\M3th0dman\Data aplikací\QZL469K0QI.exe
O4 - HKLM\..\Policies\Explorer\Run: [GJNZY6I9K6848] C:\Documents and Settings\M3th0dman\Data aplikací\C03WQ9HIWU.exe
O4 - HKLM\..\Policies\Explorer\Run: [winlogon] C:\Documents and Settings\M3th0dman\Data aplikací\winlogon.exe
O4 - HKLM\..\Policies\Explorer\Run: [svchost] C:\Documents and Settings\M3th0dman\Data aplikací\svchost.exe
O4 - HKCU\..\Policies\Explorer\Run: [GJNZY6I9K6848] C:\Documents and Settings\M3th0dman\Data aplikací\C03WQ9HIWU.exe
O4 - HKCU\..\Policies\Explorer\Run: [svchost] C:\Documents and Settings\M3th0dman\Data aplikací\svchost.exe
O4 - HKCU\..\Policies\Explorer\Run: [winlogon] C:\Documents and Settings\M3th0dman\Data aplikací\winlogon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 8210510312
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Avast\AvastSvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 11405 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Adobe Flash Player Updater.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-03-26 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2012-02-18 325408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD}]
IE5BarLauncherBHO Class - C:\Program Files\vShare.tv plugin\BarLcher.dll [2011-09-22 177712]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! WebRep - C:\Program Files\Avast\aswWebRepIE.dll [2012-03-07 1003704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2012-02-18 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2012-02-18 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - avast! WebRep - C:\Program Files\Avast\aswWebRepIE.dll [2012-03-07 1003704]
{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - VShareToolBar - C:\Program Files\vShare.tv plugin\BarLcher.dll [2011-09-22 177712]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2007-03-01 153136]
"HDAudDeck"=C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe [2008-10-07 33538048]
"nwiz"=nwiz.exe /install []
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2008-11-17 17676288]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2008-06-19 57344]
"Six Engine"=C:\Program Files\ASUS\EPU-4 Engine\FourEngine.exe [2008-07-23 5625344]
"MSWUpdate"=C:\Documents and Settings\M3th0dman\Data aplikací\csrss.exe [2011-06-28 106497]
"Windows Defender"=C:\Documents and Settings\M3th0dman\Data aplikací\QZL469K0QI.exe []
"haha"=C:\Documents and Settings\M3th0dman\Data aplikací\Sys32Disp.exe.exe []
"GJNZY6I9K6848"=C:\Documents and Settings\M3th0dman\Data aplikací\C03WQ9HIWU.exe []
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2009-06-10 13758464]
"avast"=C:\Program Files\Avast\avastUI.exe [2012-03-07 4241512]
"winlogon"=C:\Documents and Settings\M3th0dman\Data aplikací\winlogon.exe [2012-04-30 106498]
"svchost"=C:\Documents and Settings\M3th0dman\Data aplikací\svchost.exe []
""= []
"HPUsageTracking"=C:\Program Files\HP\HP UT\bin\hppusg.exe [2007-11-02 36864]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2012-03-27 37296]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-01-02 843712]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2012-01-18 254696]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"Windows Defender"=C:\Documents and Settings\M3th0dman\Data aplikací\QZL469K0QI.exe []
"GJNZY6I9K6848"=C:\Documents and Settings\M3th0dman\Data aplikací\C03WQ9HIWU.exe []
"winlogon"=C:\Documents and Settings\M3th0dman\Data aplikací\winlogon.exe [2012-04-30 106498]
"svchost"=C:\Documents and Settings\M3th0dman\Data aplikací\svchost.exe []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"=C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2008-01-24 2289664]
"GAINWARD"=C:\Program Files\EXPERTool\TBPanel.exe [2009-05-12 2181672]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [2007-06-27 152872]
"System"=C:\Documents and Settings\M3th0dman\Music\lst.exe []
"MSWUpdate"=C:\Documents and Settings\M3th0dman\Data aplikací\csrss.exe [2011-06-28 106497]
"RestoreSys"=C:\Documents and Settings\M3th0dman\Data aplikací\243828059.exe []
"Windows Defender"=C:\Documents and Settings\M3th0dman\Data aplikací\QZL469K0QI.exe []
"syshost32.exe"=C:\Documents and Settings\M3th0dman\Data aplikací\syshost32.exe []
"syshost64.exe"=C:\Documents and Settings\M3th0dman\Data aplikací\syshost32.exe []
"haha"=C:\Documents and Settings\M3th0dman\Data aplikací\Sys32Disp.exe.exe []
"worm, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null"=file:///C:/Documents and Settings/M3th0dman/Local Settings/Temp/20054.exe []
"Microsoft"=file:///C:/Documents and Settings/M3th0dman/Local Settings/Temp/20054.exe []
"GJNZY6I9K6848"=C:\Documents and Settings\M3th0dman\Data aplikací\C03WQ9HIWU.exe []
"svchost"=C:\Documents and Settings\M3th0dman\Data aplikací\svchost.exe []
"Windows Service Host"=C:\Documents and Settings\M3th0dman\Data aplikací\svchost.exe []
"{C90B7F57-99C2-3673-7E81-4E54EA6B7546}"=C:\Documents and Settings\M3th0dman\Data aplikací\Doob\qomis.exe []
"Winskob"=C:\Documents and Settings\M3th0dman\Data aplikací\Microsoft\Winskob.exe []
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"winlogon"=C:\Documents and Settings\M3th0dman\Data aplikací\winlogon.exe [2012-04-30 106498]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"=C:\WINDOWS\system32\Macromed\Flash\FlashUtil10a.exe []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"GJNZY6I9K6848"=C:\Documents and Settings\M3th0dman\Data aplikací\C03WQ9HIWU.exe []
"svchost"=C:\Documents and Settings\M3th0dman\Data aplikací\svchost.exe []
"winlogon"=C:\Documents and Settings\M3th0dman\Data aplikací\winlogon.exe [2012-04-30 106498]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WdfLoadGroup]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\ME\programz\totalcmd\TOTALCMD.EXE"="C:\ME\programz\totalcmd\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit"
"C:\ME\games\CS\cstrike.exe"="C:\ME\games\CS\cstrike.exe:*:Enabled:Counter-Strike Launcher"
"C:\ME\programz\CZDC\CZDCKN.exe"="C:\ME\programz\CZDC\CZDCKN.exe:*:Enabled:CZDC"
"C:\ME\programz\QIP\qip.exe"="C:\ME\programz\QIP\qip.exe:*:Disabled:Quiet Internet Pager"
"C:\Program Files\Mozilla Firefox\firefox.exe"="C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:firefox"
"C:\Program Files\Miranda IM\miranda32.exe"="C:\Program Files\Miranda IM\miranda32.exe:*:Enabled:Miranda IM"
"C:\ME\games\dota\garena\Garena.exe"="C:\ME\games\dota\garena\Garena.exe:*:Enabled:Garena"
"C:\Program Files\XTB-Trader\terminal.exe"="C:\Program Files\XTB-Trader\terminal.exe:*:Enabled:XTB-Trader"
"C:\ME\games\dota\War 3 (Hamis)\Warcraft III\Warcraft III.exe"="C:\ME\games\dota\War 3 (Hamis)\Warcraft III\Warcraft III.exe:*:Enabled:Warcraft III"
"C:\Program Files\Google\Google Talk\googletalk.exe"="C:\Program Files\Google\Google Talk\googletalk.exe:*:Disabled:Google Talk"
"D:\NeroExpress\Installation\Setupx.exe"="D:\NeroExpress\Installation\Setupx.exe:*:Disabled:Nero ProductSetup"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\ME\games\Mafia2\Steam.exe"="C:\ME\games\Mafia2\Steam.exe:*:Enabled:Steam"
"C:\ME\programz\GuildFTP\GuildFTPd.exe"="C:\ME\programz\GuildFTP\GuildFTPd.exe:*:Enabled:GuildFTPd FTP Server Deamon"
"C:\Documents and Settings\M3th0dman\Local Settings\Temp\_tc0\DRM\server.exe"="C:\Documents and Settings\M3th0dman\Local Settings\Temp\_tc0\DRM\server.exe:*:Enabled:server"
"C:\ME\games\Assasins Creed\DRM\server.exe"="C:\ME\games\Assasins Creed\DRM\server.exe:*:Enabled:server"
"C:\ME\games\dota\war3.exe"="C:\ME\games\dota\war3.exe:*:Enabled:Warcraft III"
"C:\ME\games\CS\hl.exe"="C:\ME\games\CS\hl.exe:*:Disabled:Half-Life Launcher"
"C:\Documents and Settings\M3th0dman\Data aplikací\csrss.exe"="C:\Documents and Settings\M3th0dman\Data aplikací\csrss.exe:*:Enabled:Windows Messanger"
"C:\Documents and Settings\M3th0dman\Data aplikací\QZL469K0QI.exe"="C:\Documents and Settings\M3th0dman\Data aplikací\QZL469K0QI.exe:*:Enabled:Windows Messanger"
"C:\Documents and Settings\M3th0dman\Data aplikací\workingbs.exe"="C:\Documents and Settings\M3th0dman\Data aplikací\workingbs.exe:*:Enabled:Windows Messanger"
"C:\DOCUME~1\M3TH0D~1\LOCALS~1\Temp\svchost.exe"="C:\DOCUME~1\M3TH0D~1\LOCALS~1\Temp\svchost.exe:*:Enabled:Windows Messanger"
"C:\DOCUME~1\M3TH0D~1\LOCALS~1\Temp\DQ8TR0EFMH.exe"="C:\DOCUME~1\M3TH0D~1\LOCALS~1\Temp\DQ8TR0EFMH.exe:*:Enabled:Windows Messanger"
"C:\Documents and Settings\M3th0dman\Data aplikací\explorer.exe"="C:\Documents and Settings\M3th0dman\Data aplikací\explorer.exe:*:Enabled:Windows Messanger"
"C:\DOCUME~1\M3TH0D~1\LOCALS~1\Temp\LCRJHKNIZ6.exe"="C:\DOCUME~1\M3TH0D~1\LOCALS~1\Temp\LCRJHKNIZ6.exe:*:Enabled:Windows Messanger"
"C:\DOCUME~1\M3TH0D~1\LOCALS~1\Temp\KP4KFWAX6G.exe"="C:\DOCUME~1\M3TH0D~1\LOCALS~1\Temp\KP4KFWAX6G.exe:*:Enabled:Windows Messanger"
"C:\DOCUME~1\M3TH0D~1\LOCALS~1\Temp\19542.exe"="C:\DOCUME~1\M3TH0D~1\LOCALS~1\Temp\19542.exe:*:Enabled:Windows Messanger"
"C:\WINDOWS\explorer.exe"="C:\WINDOWS\explorer.exe:*:Disabled:Průzkumník Windows"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\Program Files\PokerStars\PokerStarsUpdate.exe"="C:\Program Files\PokerStars\PokerStarsUpdate.exe:*:Enabled:PokerStarsUpdate"
"C:\Program Files\Garena HostBot\GarenaHostBot.exe"="C:\Program Files\Garena HostBot\GarenaHostBot.exe:*:Disabled:Garena Host Bot - advanced hosting bot for garena"
"C:\ME\programz\HostBot\GarenaHostBot.exe"="C:\ME\programz\HostBot\GarenaHostBot.exe:*:Disabled:Garena Host Bot - advanced hosting bot for garena"
"C:\Program Files\Garena HostBot\ghost.exe"="C:\Program Files\Garena HostBot\ghost.exe:*:Disabled:ghost"
"C:\ME\programz\HostBot\ghost.exe"="C:\ME\programz\HostBot\ghost.exe:*:Disabled:ghost"
"C:\Program Files\Mozilla Firefox\plugin-container.exe"="C:\Program Files\Mozilla Firefox\plugin-container.exe:*:Enabled:Plugin Container for Firefox"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype "
"C:\WINDOWS\system32\csrss.exe"="C:\WINDOWS\system32\csrss.exe:*:Disabled:csrss"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe]
"Debugger=""C:\ME\INSTALACKY\PROCEXP.EXE"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"VIDC.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"VIDC.IYUV"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVU9"=tsbyuv.dll
"VIDC.YVYU"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=l3codecp.acm
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"msacm.voxacm160"=vct3216.acm
"msacm.scg726"=scg726.acm
"msacm.alf2cd"=alf2cd.acm
"vidc.dvsd"=mcdvd_32.dll
"vidc.DIVX"=DivX.dll
"vidc.mpg4"=mpg4c32.dll
"vidc.mp42"=mpg4c32.dll
"vidc.mp43"=mpg4c32.dll
"MSVideo8"=VfWWDM32.dll
"VIDC.XVID"=xvidvfw.dll
"VIDC.YV12"=xvidvfw.dll
"msacm.ac3acm"=ac3acm.acm
"msacm.lameacm"=lameACM.acm
"VIDC.FFDS"=ff_vfw.dll

======List of files/folders created in the last 1 month======

2012-05-01 13:57:05 ----D---- C:\Program Files\trend micro
2012-05-01 13:57:04 ----D---- C:\rsit
2012-05-01 09:30:29 ----A---- C:\WINDOWS\system32\FlashPlayerApp.exe
2012-04-30 17:33:35 ----SHD---- C:\Config.Msi

======List of files/folders modified in the last 1 month======

2012-05-01 13:57:11 ----D---- C:\WINDOWS\Prefetch
2012-05-01 13:57:05 ----RD---- C:\Program Files
2012-05-01 10:34:05 ----D---- C:\WINDOWS\Temp
2012-05-01 10:16:24 ----D---- C:\WINDOWS\system32
2012-05-01 09:30:30 ----SD---- C:\WINDOWS\Tasks
2012-04-30 23:10:37 ----D---- C:\Program Files\Mozilla Firefox
2012-04-30 20:20:47 ----D---- C:\WINDOWS\system32\CatRoot2
2012-04-30 19:57:43 ----D---- C:\Program Files\PokerStars
2012-04-30 18:30:43 ----N---- C:\Documents and Settings\M3th0dman\Data aplikací\winlogon.exe
2012-04-30 18:30:38 ----D---- C:\WINDOWS\system32\drivers
2012-04-30 18:21:54 ----D---- C:\WINDOWS\system32\drivers\etc
2012-04-30 17:46:59 ----A---- C:\WINDOWS\SchedLgU.Txt
2012-04-30 17:34:07 ----SHD---- C:\WINDOWS\Installer
2012-04-30 15:54:13 ----A---- C:\WINDOWS\winamp.ini
2012-04-29 18:53:58 ----D---- C:\Program Files\Avast
2012-04-24 15:08:19 ----D---- C:\Program Files\PKR
2012-04-22 21:58:26 ----D---- C:\WINDOWS
2012-04-22 21:49:01 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2012-04-22 21:30:18 ----RSD---- C:\WINDOWS\assembly
2012-04-22 21:30:16 ----D---- C:\Program Files\OpenOffice.org 3
2012-04-10 19:19:06 ----D---- C:\Documents and Settings\M3th0dman\Data aplikací\Skype

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2009-09-22 721904]
R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2012-03-07 24920]
R1 AsIO;AsIO; C:\WINDOWS\system32\drivers\AsIO.sys [2007-12-17 12400]
R1 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2012-03-07 35672]
R1 aswSnx;aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [2012-03-07 612184]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2012-03-07 337880]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2012-03-07 53848]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2012-03-07 20696]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2012-03-07 95704]
R2 MaVctrl;MaVctrl; C:\WINDOWS\system32\DRIVERS\MaVc2K.sys [2007-01-16 11986]
R2 TBPanel;TBPanel; C:\WINDOWS\system32\drivers\TBPanel.sys [2007-03-16 12256]
R3 GGSAFERDriver;GGSAFER Driver; \??\C:\ME\games\dota\garena\safedrv.sys []
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2008-11-25 4952576]
R3 L1e;Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller; C:\WINDOWS\system32\DRIVERS\l1e51x86.sys [2008-06-25 36864]
R3 L8042Kbd;Logitech SetPoint Keyboard Driver; C:\WINDOWS\system32\DRIVERS\L8042Kbd.sys [2009-06-17 20240]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-13 5810]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-07-03 8087712]
R3 seehcri;Sony Ericsson seehcri Device Driver; C:\WINDOWS\system32\DRIVERS\seehcri.sys [2008-01-09 27632]
R3 usbstor;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
S1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
S3 axhxpbmd;axhxpbmd; C:\WINDOWS\system32\drivers\axhxpbmd.sys []
S3 Cardex;Cardex; \??\C:\WINDOWS\system32\drivers\TBPANEL.SYS []
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 GarenaPEngine;GarenaPEngine; \??\C:\DOCUME~1\M3TH0D~1\LOCALS~1\Temp\JBI29.tmp []
S3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
S3 Huawei;HUAWEI Mobile Connect - USB Smart Card Reader; C:\WINDOWS\system32\DRIVERS\ewdcsc.sys []
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\WINDOWS\system32\DRIVERS\ewusbmdm.sys []
S3 hwusbdev;Huawei DataCard USB PNP Device; C:\WINDOWS\system32\DRIVERS\ewusbdev.sys []
S3 LHidFilt;Logitech SetPoint KMDF HID Filter Driver; C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys [2009-06-17 35472]
S3 LMouFilt;Logitech SetPoint KMDF Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\LMouFilt.Sys [2009-06-17 37392]
S3 mak810c;mak810c; C:\WINDOWS\System32\Drivers\mak810c.sys [2005-06-16 24784]
S3 mak810m;mak810m; C:\WINDOWS\System32\Drivers\mak810m.sys [2005-06-16 25044]
S3 mak810u;mak810u; C:\WINDOWS\System32\Drivers\mak810u.sys [2007-06-07 52693]
S3 monfilt;monfilt; C:\WINDOWS\system32\drivers\monfilt.sys [2006-01-04 1389056]
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
S3 MPE;Filtr MPE BDA; C:\WINDOWS\system32\DRIVERS\MPE.sys [2008-04-14 15232]
S3 MREMP50;MREMP50 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS []
S3 MREMP50a64;MREMP50a64 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS []
S3 MREMPR5;MREMPR5 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS []
S3 MRENDIS5;MRENDIS5 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS []
S3 MRESP50;MRESP50 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS []
S3 MRESP50a64;MRESP50a64 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS []
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2008-07-01 108800]
S3 s0016bus;Sony Ericsson Device 0016 driver (WDM); C:\WINDOWS\system32\DRIVERS\s0016bus.sys [2008-05-16 89256]
S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\s0016mdfl.sys [2008-05-16 15016]
S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\s0016mdm.sys [2008-05-16 120744]
S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\s0016mgmt.sys [2008-05-16 114216]
S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS); C:\WINDOWS\system32\DRIVERS\s0016nd5.sys [2008-05-16 25512]
S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\s0016obex.sys [2008-05-16 110632]
S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM); C:\WINDOWS\system32\DRIVERS\s0016unic.sys [2008-05-16 115752]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 SymIM;Symantec Network Security Intermediate Filter Service; C:\WINDOWS\system32\DRIVERS\SymIM.sys []
S3 SymIMMP;SymIMMP; C:\WINDOWS\system32\DRIVERS\SymIM.sys []
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service; C:\WINDOWS\system32\drivers\viahduaa.sys [2008-09-29 876288]
S3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
S3 WFIOCTL;WFIOCTL; \??\C:\Program Files\WinFast\WFDTV\WFIOCTL.SYS []
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Avast\AvastSvc.exe [2012-03-07 44768]
R2 BcmSqlStartupSvc;Služba spouštění serveru SQL Server aplikace Business Contact Manager; C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe [2008-01-16 30312]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2012-02-18 153376]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2008-01-24 73728]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2009-06-10 168004]
R2 SQLBrowser;SQL Server Browser; c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe [2008-11-24 239968]
R2 SQLWriter;SQL Server VSS Writer; c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe [2008-11-24 87904]
R2 UleadBurningHelper;Ulead Burning Helper; C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [2004-12-13 49152]
R3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-06-27 279848]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-01 253088]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ); c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2008-11-24 29263712]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-11-28 800040]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 MSSQLServerADHelper;SQL Server Active Directory Helper; c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [2008-11-24 45408]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

ComboFix 12-05-02.03 - M3th0dman 02.05.2012 20:51:54.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.2047.1571 [GMT 2:00]
Spuštěný z: c:\documents and settings\M3th0dman\Plocha\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\M3th0dman\Data aplikací\Doob\qomis.exe
C:\Install.exe
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
c:\windows\syskey2i.drv
c:\windows\system\oeminfo.ini
c:\windows\system32\SET96.tmp
c:\windows\system32\SETA2.tmp
c:\windows\system32\SETAF.tmp
c:\windows\WinUpdaterstd
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-04-02 do 2012-05-02 )))))))))))))))))))))))))))))))
.
.
2012-05-02 16:04 . 2012-05-02 16:04 512 ----a-w- C:\PhysicalMBR.bin
2012-05-02 15:59 . 2012-05-02 15:59 -------- d-----w- c:\documents and settings\Administrator
2012-05-01 13:22 . 2012-05-01 17:43 -------- d-----w- c:\documents and settings\All Users\Data aplikací\GarenaMessenger
2012-05-01 13:02 . 2012-05-01 13:02 -------- d-----w- c:\documents and settings\M3th0dman\Data aplikací\Garena
2012-05-01 11:57 . 2012-05-01 11:57 -------- d-----w- c:\program files\trend micro
2012-05-01 11:57 . 2012-05-01 11:57 -------- d-----w- C:\rsit
2012-05-01 07:30 . 2012-05-01 08:16 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-05-01 07:30 . 2012-05-01 08:16 418464 ----a-w- c:\windows\system32\FlashPlayerApp.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-02 17:19 . 2011-10-03 15:31 106500 ------w- c:\documents and settings\M3th0dman\Data aplikací\winlogon.exe
2012-03-06 23:15 . 2011-06-28 17:00 41184 ----a-w- c:\windows\avastSS.scr
2012-03-06 23:15 . 2011-06-28 17:00 201352 ----a-w- c:\windows\system32\aswBoot.exe
2012-03-06 23:03 . 2011-06-28 17:00 612184 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-03-06 23:03 . 2011-06-28 17:00 337880 ----a-w- c:\windows\system32\drivers\aswSP.sys
2012-03-06 23:02 . 2011-06-28 17:00 35672 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2012-03-06 23:01 . 2011-06-28 17:00 53848 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2012-03-06 23:01 . 2011-06-28 17:00 95704 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2012-03-06 23:01 . 2011-06-28 17:00 89048 ----a-w- c:\windows\system32\drivers\aswmon.sys
2012-03-06 23:01 . 2011-06-28 17:00 20696 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-03-06 22:58 . 2011-06-28 17:00 24920 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2012-02-18 18:40 . 2010-04-19 08:37 472808 ----a-w- c:\windows\system32\deployJava1.dll
2012-02-18 18:40 . 2009-10-13 15:02 73728 ----a-w- c:\windows\system32\javacpl.cpl
2012-02-15 18:00 . 2012-02-28 23:58 79360 ----a-w- c:\windows\system32\ff_vfw.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-03-06 23:15 123536 ----a-w- c:\program files\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-01-24 2289664]
"GAINWARD"="c:\program files\EXPERTool\TBPanel.exe" [2009-05-12 2181672]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 152872]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"HDAudDeck"="c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe" [2008-10-07 33538048]
"nwiz"="nwiz.exe" [2009-06-10 1657376]
"RTHDCPL"="RTHDCPL.EXE" [2008-11-17 17676288]
"Six Engine"="c:\program files\ASUS\EPU-4 Engine\FourEngine.exe" [2008-07-23 5625344]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-06-10 13758464]
"avast"="c:\program files\Avast\avastUI.exe" [2012-03-06 4241512]
"HPUsageTracking"="c:\program files\HP\HP UT\bin\hppusg.exe" [2007-11-02 36864]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\ME\\programz\\totalcmd\\TOTALCMD.EXE"=
"c:\\ME\\games\\CS\\cstrike.exe"=
"c:\\ME\\programz\\CZDC\\CZDCKN.exe"=
"c:\\Program Files\\Miranda IM\\miranda32.exe"=
"c:\\ME\\games\\dota\\garena\\Garena.exe"=
"c:\\Program Files\\XTB-Trader\\terminal.exe"=
"c:\\ME\\games\\dota\\War 3 (Hamis)\\Warcraft III\\Warcraft III.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\ME\\programz\\GuildFTP\\GuildFTPd.exe"=
"c:\\ME\\games\\Assasins Creed\\DRM\\server.exe"=
"c:\\ME\\games\\dota\\war3.exe"=
"c:\\ME\\games\\CS\\hl.exe"=
"c:\\Documents and Settings\\M3th0dman\\Data aplikací\\csrss.exe"=
"c:\\Documents and Settings\\M3th0dman\\Data aplikací\\explorer.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\PokerStars\\PokerStarsUpdate.exe"=
"c:\\WINDOWS\\system32\\csrss.exe"=
"c:\\Documents and Settings\\M3th0dman\\Dokumenty\\Downloads\\Blackshot_GarenaPlus_Installer.exe"=
"c:\\ME\\games\\dota\\garena plus\\Room\\garena_room.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [22.9.2009 12:29 721904]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [28.6.2011 19:00 612184]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [28.6.2011 19:00 337880]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [28.6.2011 19:00 20696]
R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\drivers\seehcri.sys [2.5.2010 19:34 27632]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [1.5.2012 9:30 253088]
S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\M3TH0D~1\LOCALS~1\Temp\JBI29.tmp --> c:\docume~1\M3TH0D~1\LOCALS~1\Temp\JBI29.tmp [?]
S3 GGSAFERDriver;GGSAFER Driver;\??\c:\me\games\dota\garena plus\Room\safedrv.sys --> c:\me\games\dota\garena plus\Room\safedrv.sys [?]
S3 Huawei;HUAWEI Mobile Connect - USB Smart Card Reader;c:\windows\system32\DRIVERS\ewdcsc.sys --> c:\windows\system32\DRIVERS\ewdcsc.sys [?]
S3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys --> c:\windows\system32\DRIVERS\ewusbdev.sys [?]
S3 mak810c;mak810c;c:\windows\system32\drivers\mak810c.sys [2.5.2010 15:59 24784]
S3 mak810m;mak810m;c:\windows\system32\drivers\mak810m.sys [2.5.2010 15:59 25044]
S3 mak810u;mak810u;c:\windows\system32\drivers\mak810u.sys [2.5.2010 15:59 52693]
S3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\drivers\s0016bus.sys [2.5.2010 19:34 89256]
S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\system32\drivers\s0016mdfl.sys [2.5.2010 19:34 15016]
S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\system32\drivers\s0016mdm.sys [2.5.2010 19:34 120744]
S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s0016mgmt.sys [2.5.2010 19:34 114216]
S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\system32\drivers\s0016nd5.sys [2.5.2010 19:34 25512]
S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\system32\drivers\s0016obex.sys [2.5.2010 19:34 110632]
S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\system32\drivers\s0016unic.sys [2.5.2010 19:34 115752]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [1.7.2009 11:17 876288]
S3 WFIOCTL;WFIOCTL;\??\c:\program files\WinFast\WFDTV\WFIOCTL.SYS --> c:\program files\WinFast\WFDTV\WFIOCTL.SYS [?]
.
--- Ostatní služby/ovladače v paměti ---
.
*Deregistered* - PROCEXP141
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-01-24 11:30 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2012-05-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-01 08:16]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://startsear.ch/?aff=1
mStart Page = hxxp://startsear.ch/?aff=1
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 213.46.172.36 213.46.172.37
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
HKCU-Run-RestoreSys - c:\documents and settings\M3th0dman\Data aplikací\243828059.exe
HKCU-Run-syshost32.exe - c:\documents and settings\M3th0dman\Data aplikací\syshost32.exe
HKCU-Run-syshost64.exe - c:\documents and settings\M3th0dman\Data aplikací\syshost32.exe
HKCU-Run-haha - c:\documents and settings\M3th0dman\Data aplikací\Sys32Disp.exe.exe
HKCU-Run-GJNZY6I9K6848 - c:\documents and settings\M3th0dman\Data aplikací\C03WQ9HIWU.exe
HKCU-Run-{C90B7F57-99C2-3673-7E81-4E54EA6B7546} - c:\documents and settings\M3th0dman\Data aplikací\Doob\qomis.exe
HKCU-Run-Winskob - c:\documents and settings\M3th0dman\Data aplikací\Microsoft\Winskob.exe
HKLM-Run-haha - c:\documents and settings\M3th0dman\Data aplikací\Sys32Disp.exe.exe
HKLM-Run-GJNZY6I9K6848 - c:\documents and settings\M3th0dman\Data aplikací\C03WQ9HIWU.exe
HKLM_ActiveSetup-{BBCCCA1D-E6AC-F13F-ECAD-D6D9FEAD8DB5} - c:\documents and settings\M3th0dman\Data aplikací\QZL469K0QI.exe
AddRemove-DAEMON Tools Toolbar - c:\program files\DAEMON Tools Toolbar\uninst.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-05-02 20:56
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HDAudDeck = c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe 1????????????????????????????????????????????????
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: SAMSUNG_HD322HJ rev.1AG01118 -> Harddisk0\DR0 -> \Device\Ide\IdePort2 P2T0L0-7
.
device: opened successfully
user: MBR read successfully
.
Disk trace:
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8A533ECC]<<
c:\docume~1\M3TH0D~1\LOCALS~1\Temp\catchme.sys
_asm { PUSH EBP; MOV EBP, ESP; SUB ESP, 0x1c; PUSH EBX; PUSH ESI; MOV DWORD [EBP-0x4], 0x89514879; SUB DWORD [EBP-0x4], 0x89514135; PUSH EDI; CALL 0xffffffffffffdf2c; }
1 ntkrnlpa!IofCallDriver[0x804EF1A6] -> \Device\Harddisk0\DR0[0x8A527AB8]
3 CLASSPNP[0xB80E8FD7] -> ntkrnlpa!IofCallDriver[0x804EF1A6] -> \Device\00000070[0x8A5A89E8]
5 ACPI[0xB7E66620] -> ntkrnlpa!IofCallDriver[0x804EF1A6] -> [0x8A5A9D98]
[0x8A4C8CF8] -> IRP_MJ_CREATE -> 0x8A533ECC
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [BP+0x0], CH; JL 0x2e; JNZ 0x3a; }
detected disk devices:
\Device\Ide\IdeDeviceP2T0L0-7 -> \??\IDE#DiskSAMSUNG_HD322HJ_________________________1AG01118#31534137394a5330323634383436202020202020#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
detected hooks:
\Driver\atapi DriverStartIo -> 0x8A533AF1
user & kernel MBR OK
sectors 625142446 (+255): user != kernel
Warning: possible TDL3 rootkit infection !
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]
"ImagePath"="\??\c:\docume~1\M3TH0D~1\LOCALS~1\Temp\JBI29.tmp"
.
Celkový čas: 2012-05-02 20:57:20
ComboFix-quarantined-files.txt 2012-05-02 18:57
.
Před spuštěním: Volných bajtů: 12 431 093 760
Po spuštění: Volných bajtů: 14 094 512 128
.
WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
.
- - End Of File - - 164D10DF9CD97C69FAF762DDC3CAD4CC

Logfile of random's system information tool 1.09 (written by random/random)
Run by M3th0dman at 2012-05-03 18:51:16
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 13 GB (4%) free of 305 GB
Total RAM: 2047 MB (74% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:54:09, on 3.5.2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16876)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Avast\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ASUS\EPU-4 Engine\FourEngine.exe
C:\Program Files\Avast\avastUI.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\EXPERTool\TBPanel.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Documents and Settings\M3th0dman\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\M3th0dman\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\M3th0dman\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\ME\programz\totalcmd\TOTALCMD.EXE
c:\Documents and Settings\M3th0dman\Dokumenty\Downloads\RSIT.exe
C:\Program Files\trend micro\M3th0dman.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://startsear.ch/?aff=1
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://startsear.ch/?aff=1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Avast\aswWebRepIE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Six Engine] "C:\Program Files\ASUS\EPU-4 Engine\FourEngine.exe" -r
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avast] "C:\Program Files\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [HPUsageTracking] "C:\Program Files\HP\HP UT\bin\hppusg.exe" "C:\Program Files\HP\HP UT\"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [GAINWARD] C:\Program Files\EXPERTool\TBPanel.exe /A
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [worm, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null] file:///C:/Documents and Settings/M3th0dman/Local Settings/Temp/20054.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 8210510312
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Avast\AvastSvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 7472 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Adobe Flash Player Updater.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-03-26 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2012-02-18 325408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! WebRep - C:\Program Files\Avast\aswWebRepIE.dll [2012-03-07 1003704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2012-02-18 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2012-02-18 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - avast! WebRep - C:\Program Files\Avast\aswWebRepIE.dll [2012-03-07 1003704]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2007-03-01 153136]
"HDAudDeck"=C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe [2008-10-07 33538048]
"nwiz"=nwiz.exe /install []
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2008-11-17 17676288]
"Six Engine"=C:\Program Files\ASUS\EPU-4 Engine\FourEngine.exe [2008-07-23 5625344]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2009-06-10 13758464]
"avast"=C:\Program Files\Avast\avastUI.exe [2012-03-07 4241512]
"HPUsageTracking"=C:\Program Files\HP\HP UT\bin\hppusg.exe [2007-11-02 36864]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2012-03-27 37296]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-01-02 843712]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2012-01-18 254696]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"=C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2008-01-24 2289664]
"GAINWARD"=C:\Program Files\EXPERTool\TBPanel.exe [2009-05-12 2181672]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [2007-06-27 152872]
"worm, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null"=file:///C:/Documents and Settings/M3th0dman/Local Settings/Temp/20054.exe []
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WdfLoadGroup]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\ME\programz\totalcmd\TOTALCMD.EXE"="C:\ME\programz\totalcmd\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit"
"C:\ME\games\CS\cstrike.exe"="C:\ME\games\CS\cstrike.exe:*:Enabled:Counter-Strike Launcher"
"C:\ME\programz\CZDC\CZDCKN.exe"="C:\ME\programz\CZDC\CZDCKN.exe:*:Enabled:CZDC"
"C:\Program Files\Miranda IM\miranda32.exe"="C:\Program Files\Miranda IM\miranda32.exe:*:Enabled:Miranda IM"
"C:\ME\games\dota\garena\Garena.exe"="C:\ME\games\dota\garena\Garena.exe:*:Enabled:Garena"
"C:\Program Files\XTB-Trader\terminal.exe"="C:\Program Files\XTB-Trader\terminal.exe:*:Enabled:XTB-Trader"
"C:\ME\games\dota\War 3 (Hamis)\Warcraft III\Warcraft III.exe"="C:\ME\games\dota\War 3 (Hamis)\Warcraft III\Warcraft III.exe:*:Enabled:Warcraft III"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\ME\programz\GuildFTP\GuildFTPd.exe"="C:\ME\programz\GuildFTP\GuildFTPd.exe:*:Enabled:GuildFTPd FTP Server Deamon"
"C:\ME\games\Assasins Creed\DRM\server.exe"="C:\ME\games\Assasins Creed\DRM\server.exe:*:Enabled:server"
"C:\ME\games\dota\war3.exe"="C:\ME\games\dota\war3.exe:*:Enabled:Warcraft III"
"C:\ME\games\CS\hl.exe"="C:\ME\games\CS\hl.exe:*:Disabled:Half-Life Launcher"
"C:\Documents and Settings\M3th0dman\Data aplikací\csrss.exe"="C:\Documents and Settings\M3th0dman\Data aplikací\csrss.exe:*:Enabled:Windows Messanger"
"C:\Documents and Settings\M3th0dman\Data aplikací\explorer.exe"="C:\Documents and Settings\M3th0dman\Data aplikací\explorer.exe:*:Enabled:Windows Messanger"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\Program Files\PokerStars\PokerStarsUpdate.exe"="C:\Program Files\PokerStars\PokerStarsUpdate.exe:*:Enabled:PokerStarsUpdate"
"C:\WINDOWS\system32\csrss.exe"="C:\WINDOWS\system32\csrss.exe:*:Disabled:csrss"
"C:\Documents and Settings\M3th0dman\Dokumenty\Downloads\Blackshot_GarenaPlus_Installer.exe"="C:\Documents and Settings\M3th0dman\Dokumenty\Downloads\Blackshot_GarenaPlus_Installer.exe:*:Enabled:Garena Installer"
"C:\ME\games\dota\garena plus\Room\garena_room.exe"="C:\ME\games\dota\garena plus\Room\garena_room.exe:*:Enabled:Garena"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype "

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"VIDC.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"VIDC.IYUV"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVU9"=tsbyuv.dll
"VIDC.YVYU"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=l3codecp.acm
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"msacm.voxacm160"=vct3216.acm
"msacm.scg726"=scg726.acm
"msacm.alf2cd"=alf2cd.acm
"vidc.dvsd"=mcdvd_32.dll
"vidc.DIVX"=DivX.dll
"vidc.mpg4"=mpg4c32.dll
"vidc.mp42"=mpg4c32.dll
"vidc.mp43"=mpg4c32.dll
"MSVideo8"=VfWWDM32.dll
"VIDC.XVID"=xvidvfw.dll
"VIDC.YV12"=xvidvfw.dll
"msacm.ac3acm"=ac3acm.acm
"msacm.lameacm"=lameACM.acm
"VIDC.FFDS"=ff_vfw.dll

======List of files/folders created in the last 1 month======

2012-05-03 18:29:30 ----A---- C:\TDSSKiller.2.7.34.0_03.05.2012_18.29.30_log.txt
2012-05-03 18:13:51 ----SHD---- C:\RECYCLER
2012-05-02 20:57:21 ----A---- C:\ComboFix.txt
2012-05-02 20:50:28 ----A---- C:\Boot.bak
2012-05-02 20:50:25 ----RASHD---- C:\cmdcons
2012-05-02 20:47:18 ----A---- C:\WINDOWS\zip.exe
2012-05-02 20:47:18 ----A---- C:\WINDOWS\SWXCACLS.exe
2012-05-02 20:47:18 ----A---- C:\WINDOWS\SWSC.exe
2012-05-02 20:47:18 ----A---- C:\WINDOWS\SWREG.exe
2012-05-02 20:47:18 ----A---- C:\WINDOWS\sed.exe
2012-05-02 20:47:18 ----A---- C:\WINDOWS\PEV.exe
2012-05-02 20:47:18 ----A---- C:\WINDOWS\NIRCMD.exe
2012-05-02 20:47:18 ----A---- C:\WINDOWS\MBR.exe
2012-05-02 20:47:18 ----A---- C:\WINDOWS\grep.exe
2012-05-02 20:47:11 ----D---- C:\WINDOWS\ERDNT
2012-05-02 20:47:10 ----D---- C:\ComboFix
2012-05-02 20:47:06 ----D---- C:\Qoobox
2012-05-02 18:15:56 ----A---- C:\PRIKAZ.TXT
2012-05-02 17:57:10 ----D---- C:\WINDOWS\pss
2012-05-01 15:22:49 ----D---- C:\Documents and Settings\M3th0dman\Data aplikací\GarenaPlus
2012-05-01 15:22:39 ----D---- C:\Documents and Settings\All Users\Data aplikací\GarenaMessenger
2012-05-01 15:02:13 ----D---- C:\Documents and Settings\M3th0dman\Data aplikací\Garena
2012-05-01 14:16:54 ----A---- C:\avenger.txt
2012-05-01 13:57:05 ----D---- C:\Program Files\trend micro
2012-05-01 13:57:04 ----D---- C:\rsit
2012-05-01 09:30:29 ----A---- C:\WINDOWS\system32\FlashPlayerApp.exe

======List of files/folders modified in the last 1 month======

2012-05-03 18:30:18 ----D---- C:\WINDOWS\system32\CatRoot2
2012-05-03 18:29:32 ----D---- C:\WINDOWS\system32\drivers
2012-05-03 18:27:02 ----D---- C:\WINDOWS\system32
2012-05-03 18:27:02 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2012-05-03 18:22:48 ----D---- C:\WINDOWS\Temp
2012-05-03 18:21:13 ----RASH---- C:\boot.ini
2012-05-03 18:21:13 ----A---- C:\WINDOWS\win.ini
2012-05-03 18:21:13 ----A---- C:\WINDOWS\system.ini
2012-05-03 18:11:02 ----A---- C:\WINDOWS\SchedLgU.Txt
2012-05-02 22:35:29 ----D---- C:\WINDOWS\system32\Restore
2012-05-02 21:01:54 ----D---- C:\WINDOWS\Prefetch
2012-05-02 21:01:03 ----SHD---- C:\System Volume Information
2012-05-02 20:56:06 ----D---- C:\WINDOWS
2012-05-02 20:55:58 ----D---- C:\WINDOWS\system32\drivers\etc
2012-05-02 20:55:16 ----D---- C:\WINDOWS\system
2012-05-02 20:53:59 ----D---- C:\WINDOWS\AppPatch
2012-05-02 20:53:59 ----D---- C:\Program Files\Common Files
2012-05-02 19:19:49 ----N---- C:\Documents and Settings\M3th0dman\Data aplikací\winlogon.exe
2012-05-02 17:59:01 ----D---- C:\Documents and Settings
2012-05-01 17:24:46 ----D---- C:\Documents and Settings\M3th0dman\Data aplikací\Skype
2012-05-01 17:23:38 ----D---- C:\Documents and Settings\M3th0dman\Data aplikací\skypePM
2012-05-01 15:20:10 ----A---- C:\WINDOWS\winamp.ini
2012-05-01 15:13:04 ----SHD---- C:\WINDOWS\Installer
2012-05-01 15:12:56 ----D---- C:\WINDOWS\WinSxS
2012-05-01 13:57:05 ----RD---- C:\Program Files
2012-05-01 09:30:30 ----SD---- C:\WINDOWS\Tasks
2012-04-30 23:10:37 ----D---- C:\Program Files\Mozilla Firefox
2012-04-30 19:57:43 ----D---- C:\Program Files\PokerStars
2012-04-29 18:53:58 ----D---- C:\Program Files\Avast
2012-04-24 15:08:19 ----D---- C:\Program Files\PKR
2012-04-22 21:30:18 ----RSD---- C:\WINDOWS\assembly
2012-04-22 21:30:16 ----D---- C:\Program Files\OpenOffice.org 3

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2009-09-22 721904]
R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2012-03-07 24920]
R1 AsIO;AsIO; C:\WINDOWS\system32\drivers\AsIO.sys [2007-12-17 12400]
R1 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2012-03-07 35672]
R1 aswSnx;aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [2012-03-07 612184]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2012-03-07 337880]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2012-03-07 53848]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2006-03-02 12032]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2012-03-07 20696]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2012-03-07 95704]
R2 MaVctrl;MaVctrl; C:\WINDOWS\system32\DRIVERS\MaVc2K.sys [2007-01-16 11986]
R2 TBPanel;TBPanel; C:\WINDOWS\system32\drivers\TBPanel.sys [2007-03-16 12256]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2008-11-25 4952576]
R3 L1e;Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller; C:\WINDOWS\system32\DRIVERS\l1e51x86.sys [2008-06-25 36864]
R3 L8042Kbd;Logitech SetPoint Keyboard Driver; C:\WINDOWS\system32\DRIVERS\L8042Kbd.sys [2009-06-17 20240]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-13 5810]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-07-03 8087712]
R3 seehcri;Sony Ericsson seehcri Device Driver; C:\WINDOWS\system32\DRIVERS\seehcri.sys [2008-01-09 27632]
R3 usbstor;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
S1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
S3 ausqpf5k;ausqpf5k; C:\WINDOWS\system32\drivers\ausqpf5k.sys []
S3 Cardex;Cardex; \??\C:\WINDOWS\system32\drivers\TBPANEL.SYS []
S3 catchme;catchme; \??\C:\DOCUME~1\M3TH0D~1\LOCALS~1\Temp\catchme.sys []
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 GarenaPEngine;GarenaPEngine; \??\C:\DOCUME~1\M3TH0D~1\LOCALS~1\Temp\JBI29.tmp []
S3 GGSAFERDriver;GGSAFER Driver; \??\C:\ME\games\dota\garena\safedrv.sys []
S3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
S3 Huawei;HUAWEI Mobile Connect - USB Smart Card Reader; C:\WINDOWS\system32\DRIVERS\ewdcsc.sys []
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\WINDOWS\system32\DRIVERS\ewusbmdm.sys []
S3 hwusbdev;Huawei DataCard USB PNP Device; C:\WINDOWS\system32\DRIVERS\ewusbdev.sys []
S3 LHidFilt;Logitech SetPoint KMDF HID Filter Driver; C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys [2009-06-17 35472]
S3 LMouFilt;Logitech SetPoint KMDF Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\LMouFilt.Sys [2009-06-17 37392]
S3 mak810c;mak810c; C:\WINDOWS\System32\Drivers\mak810c.sys [2005-06-16 24784]
S3 mak810m;mak810m; C:\WINDOWS\System32\Drivers\mak810m.sys [2005-06-16 25044]
S3 mak810u;mak810u; C:\WINDOWS\System32\Drivers\mak810u.sys [2007-06-07 52693]
S3 monfilt;monfilt; C:\WINDOWS\system32\drivers\monfilt.sys [2006-01-04 1389056]
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
S3 MPE;Filtr MPE BDA; C:\WINDOWS\system32\DRIVERS\MPE.sys [2008-04-14 15232]
S3 MREMP50;MREMP50 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS []
S3 MREMP50a64;MREMP50a64 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS []
S3 MREMPR5;MREMPR5 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS []
S3 MRENDIS5;MRENDIS5 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS []
S3 MRESP50;MRESP50 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS []
S3 MRESP50a64;MRESP50a64 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS []
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2008-07-01 108800]
S3 s0016bus;Sony Ericsson Device 0016 driver (WDM); C:\WINDOWS\system32\DRIVERS\s0016bus.sys [2008-05-16 89256]
S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\s0016mdfl.sys [2008-05-16 15016]
S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\s0016mdm.sys [2008-05-16 120744]
S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\s0016mgmt.sys [2008-05-16 114216]
S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS); C:\WINDOWS\system32\DRIVERS\s0016nd5.sys [2008-05-16 25512]
S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\s0016obex.sys [2008-05-16 110632]
S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM); C:\WINDOWS\system32\DRIVERS\s0016unic.sys [2008-05-16 115752]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 SymIM;Symantec Network Security Intermediate Filter Service; C:\WINDOWS\system32\DRIVERS\SymIM.sys []
S3 SymIMMP;SymIMMP; C:\WINDOWS\system32\DRIVERS\SymIM.sys []
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service; C:\WINDOWS\system32\drivers\viahduaa.sys [2008-09-29 876288]
S3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
S3 WFIOCTL;WFIOCTL; \??\C:\Program Files\WinFast\WFDTV\WFIOCTL.SYS []
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Avast\AvastSvc.exe [2012-03-07 44768]
R2 BcmSqlStartupSvc;Služba spouštění serveru SQL Server aplikace Business Contact Manager; C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe [2008-01-16 30312]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2012-02-18 153376]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2008-01-24 73728]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2009-06-10 168004]
R2 SQLBrowser;SQL Server Browser; c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe [2008-11-24 239968]
R2 SQLWriter;SQL Server VSS Writer; c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe [2008-11-24 87904]
R2 UleadBurningHelper;Ulead Burning Helper; C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [2004-12-13 49152]
R3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-06-27 279848]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-01 253088]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ); c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2008-11-24 29263712]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-11-28 800040]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 MSSQLServerADHelper;SQL Server Active Directory Helper; c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [2008-11-24 45408]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

18:29:30.0312 3728 TDSS rootkit removing tool 2.7.34.0 May 2 2012 09:59:18
18:29:30.0671 3728 ============================================================
18:29:30.0671 3728 Current date / time: 2012/05/03 18:29:30.0671
18:29:30.0671 3728 SystemInfo:
18:29:30.0671 3728
18:29:30.0671 3728 OS Version: 5.1.2600 ServicePack: 3.0
18:29:30.0687 3728 Product type: Workstation
18:29:30.0687 3728 ComputerName: A04-0629A
18:29:30.0687 3728 UserName: M3th0dman
18:29:30.0687 3728 Windows directory: C:\WINDOWS
18:29:30.0687 3728 System windows directory: C:\WINDOWS
18:29:30.0687 3728 Processor architecture: Intel x86
18:29:30.0687 3728 Number of processors: 2
18:29:30.0687 3728 Page size: 0x1000
18:29:30.0687 3728 Boot type: Normal boot
18:29:30.0687 3728 ============================================================
18:29:32.0718 3728 Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
18:29:32.0750 3728 Drive \Device\Harddisk6\DR12 - Size: 0x3DA00000 (0.96 Gb), SectorSize: 0x200, Cylinders: 0x7D, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
18:29:32.0750 3728 ============================================================
18:29:32.0750 3728 \Device\Harddisk0\DR0:
18:29:32.0843 3728 MBR partitions:
18:29:32.0843 3728 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x254297C1
18:29:32.0843 3728 \Device\Harddisk6\DR12:
18:29:32.0843 3728 MBR partitions:
18:29:32.0843 3728 \Device\Harddisk6\DR12\Partition0: MBR, Type 0x6, StartLBA 0x20, BlocksNum 0x1ECFE0
18:29:32.0843 3728 ============================================================
18:29:32.0890 3728 C: <-> \Device\Harddisk0\DR0\Partition0
18:29:32.0890 3728 ============================================================
18:29:32.0890 3728 Initialize success
18:29:32.0890 3728 ============================================================
18:30:16.0000 3940 ============================================================
18:30:16.0000 3940 Scan started
18:30:16.0000 3940 Mode: Manual; SigCheck; TDLFS;
18:30:16.0000 3940 ============================================================
18:30:17.0093 3940 Aavmker4 (473f97edc5a5312f3665ab2921196c0c) C:\WINDOWS\system32\drivers\Aavmker4.sys
18:30:18.0046 3940 Aavmker4 - ok
18:30:18.0062 3940 Abiosdsk - ok
18:30:18.0062 3940 abp480n5 - ok
18:30:18.0125 3940 ACPI (4fe34f1f3126b61fcc6b2043aa8112c9) C:\WINDOWS\system32\DRIVERS\ACPI.sys
18:30:27.0578 3940 ACPI - ok
18:30:27.0640 3940 ACPIEC (afdff022a01f0b11c776f0860c3b282f) C:\WINDOWS\system32\drivers\ACPIEC.sys
18:30:28.0015 3940 ACPIEC - ok
18:30:28.0171 3940 AdobeFlashPlayerUpdateSvc (459ac130c6ab892b1cd5d7544626efc5) C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
18:30:28.0171 3940 AdobeFlashPlayerUpdateSvc - ok
18:30:28.0187 3940 adpu160m - ok
18:30:28.0250 3940 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
18:30:28.0765 3940 aec - ok
18:30:28.0828 3940 AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys
18:30:28.0937 3940 AFD - ok
18:30:28.0937 3940 Aha154x - ok
18:30:28.0968 3940 aic78u2 - ok
18:30:28.0968 3940 aic78xx - ok
18:30:28.0984 3940 Alerter (e0a6fa244b8624d78fe5ff6f56a33bae) C:\WINDOWS\system32\alrsvc.dll
18:30:29.0328 3940 Alerter - ok
18:30:29.0328 3940 ALG (88842de939a827577bf24243699ac80a) C:\WINDOWS\System32\alg.exe
18:30:29.0734 3940 ALG - ok
18:30:29.0734 3940 AliIde - ok
18:30:29.0734 3940 amsint - ok
18:30:29.0765 3940 AppMgmt - ok
18:30:29.0765 3940 asc - ok
18:30:29.0796 3940 asc3350p - ok
18:30:29.0812 3940 asc3550 - ok
18:30:29.0843 3940 AsIO (2b4e66fac6503494a2c6f32bb6ab3826) C:\WINDOWS\system32\drivers\AsIO.sys
18:30:29.0875 3940 AsIO - ok
18:30:30.0000 3940 aspnet_state (0e5e4957549056e2bf2c49f4f6b601ad) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
18:30:30.0062 3940 aspnet_state - ok
18:30:30.0093 3940 aswFsBlk (0ae43c6c411254049279c2ee55630f95) C:\WINDOWS\system32\drivers\aswFsBlk.sys
18:30:30.0109 3940 aswFsBlk - ok
18:30:30.0156 3940 aswMon2 (8c30b7ddd2f1d8d138ebe40345af2b11) C:\WINDOWS\system32\drivers\aswMon2.sys
18:30:30.0187 3940 aswMon2 - ok
18:30:30.0203 3940 aswRdr (da12626fd9a67f4e917e2f2fbe1e1764) C:\WINDOWS\system32\drivers\aswRdr.sys
18:30:30.0234 3940 aswRdr - ok
18:30:30.0343 3940 aswSnx (dcb199b967375753b5019ec15f008f53) C:\WINDOWS\system32\drivers\aswSnx.sys
18:30:30.0359 3940 aswSnx - ok
18:30:30.0484 3940 aswSP (b32873e5a1443c0a1e322266e203bf10) C:\WINDOWS\system32\drivers\aswSP.sys
18:30:30.0500 3940 aswSP - ok
18:30:30.0531 3940 aswTdi (6ff544175a9180c5d88534d3d9c9a9f7) C:\WINDOWS\system32\drivers\aswTdi.sys
18:30:30.0546 3940 aswTdi - ok
18:30:30.0593 3940 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
18:30:31.0000 3940 AsyncMac - ok
18:30:31.0031 3940 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
18:30:31.0343 3940 atapi - ok
18:30:31.0343 3940 Atdisk - ok
18:30:31.0375 3940 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
18:30:31.0843 3940 Atmarpc - ok
18:30:31.0953 3940 AudioSrv (de31b88962a8645dba5a37b993e7b0f1) C:\WINDOWS\System32\audiosrv.dll
18:30:32.0296 3940 AudioSrv - ok
18:30:32.0312 3940 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
18:30:32.0812 3940 audstub - ok
18:30:32.0921 3940 avast! Antivirus (4041d31508a2a084dfb42c595854090f) C:\Program Files\Avast\AvastSvc.exe
18:30:32.0937 3940 avast! Antivirus - ok
18:30:33.0031 3940 BcmSqlStartupSvc (6163664c7e9cd110af70180c126c3fdc) C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
18:30:33.0046 3940 BcmSqlStartupSvc - ok
18:30:33.0078 3940 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
18:30:33.0343 3940 Beep - ok
18:30:33.0437 3940 BITS (19395d092fd85ddc2d9c7729cf5a2ac8) C:\WINDOWS\system32\qmgr.dll
18:30:34.0109 3940 BITS - ok
18:30:34.0156 3940 Browser (249276d3ef1e74b992299cb96099e4d7) C:\WINDOWS\System32\browser.dll
18:30:34.0500 3940 Browser - ok
18:30:34.0531 3940 Cardex (04e1c782cf14b7282ebc633b0fd3ed16) C:\WINDOWS\system32\drivers\TBPANEL.SYS
18:30:34.0562 3940 Cardex - ok
18:30:34.0703 3940 catchme - ok
18:30:34.0734 3940 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
18:30:35.0046 3940 cbidf2k - ok
18:30:35.0093 3940 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
18:30:35.0546 3940 CCDECODE - ok
18:30:35.0546 3940 cd20xrnt - ok
18:30:35.0593 3940 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
18:30:35.0921 3940 Cdaudio - ok
18:30:35.0937 3940 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
18:30:36.0421 3940 Cdfs - ok
18:30:36.0437 3940 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
18:30:41.0921 3940 Cdrom - ok
18:30:41.0921 3940 Changer - ok
18:30:41.0968 3940 CiSvc (e390dc1d7c461d7d56ec53402f329928) C:\WINDOWS\system32\cisvc.exe
18:30:42.0406 3940 CiSvc - ok
18:30:42.0437 3940 ClipSrv (064507a8dfa8c5c7e2ffddd3e6f424fa) C:\WINDOWS\system32\clipsrv.exe
18:30:42.0718 3940 ClipSrv - ok
18:30:42.0875 3940 clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
18:30:42.0937 3940 clr_optimization_v2.0.50727_32 - ok
18:30:42.0937 3940 CmdIde - ok
18:30:42.0937 3940 COMSysApp - ok
18:30:42.0968 3940 Cpqarray - ok
18:30:43.0031 3940 CryptSvc (f3ab0933cbd166d271992f411c27ccaf) C:\WINDOWS\System32\cryptsvc.dll
18:30:43.0421 3940 CryptSvc - ok
18:30:43.0421 3940 dac2w2k - ok
18:30:43.0437 3940 dac960nt - ok
18:30:43.0625 3940 DcomLaunch (be27674d1cbc3214aec84b4336a38bbf) C:\WINDOWS\system32\rpcss.dll
18:30:43.0843 3940 DcomLaunch - ok
18:30:43.0921 3940 Dhcp (8c9a53e285ac5e6704844d0459ec85be) C:\WINDOWS\System32\dhcpcsvc.dll
18:30:44.0421 3940 Dhcp - ok
18:30:44.0437 3940 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
18:30:44.0937 3940 Disk - ok
18:30:44.0937 3940 dmadmin - ok
18:30:45.0109 3940 dmboot (db5fd2bf5b07dc54bfcb3664ff05bd7c) C:\WINDOWS\system32\drivers\dmboot.sys
18:30:45.0421 3940 dmboot - ok
18:30:45.0484 3940 dmio (fff1720af51171f32f1ead5cf71f2810) C:\WINDOWS\system32\drivers\dmio.sys
18:30:45.0953 3940 dmio - ok
18:30:45.0984 3940 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
18:30:46.0296 3940 dmload - ok
18:30:46.0328 3940 dmserver (2bfefe9e865655a76982f050450b9591) C:\WINDOWS\System32\dmserver.dll
18:30:46.0796 3940 dmserver - ok
18:30:46.0843 3940 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
18:30:47.0156 3940 DMusic - ok
18:30:47.0187 3940 Dnscache (0634b791684b84f4a331f3d3536feef8) C:\WINDOWS\System32\dnsrslvr.dll
18:30:47.0656 3940 Dnscache - ok
18:30:47.0687 3940 Dot3svc (4a3e2bd20157a0946751229e92eb8621) C:\WINDOWS\System32\dot3svc.dll
18:30:48.0109 3940 Dot3svc - ok
18:30:48.0109 3940 dpti2o - ok
18:30:48.0156 3940 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
18:30:48.0796 3940 drmkaud - ok
18:30:48.0828 3940 EapHost (0887d9c2be8d940778cad1e3b85f2a41) C:\WINDOWS\System32\eapsvc.dll
18:30:49.0375 3940 EapHost - ok
18:30:49.0406 3940 ERSvc (a2a4912798f2be706abadd3d30800d16) C:\WINDOWS\System32\ersvc.dll
18:30:49.0703 3940 ERSvc - ok
18:30:49.0765 3940 Eventlog (9ef697af07bb8dd82c3b02ca953a95b7) C:\WINDOWS\system32\services.exe
18:30:50.0015 3940 Eventlog - ok
18:30:50.0109 3940 EventSystem (a371f11ef07653591c8de26afb13ce7f) C:\WINDOWS\system32\es.dll
18:30:50.0281 3940 EventSystem - ok
18:30:50.0359 3940 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
18:30:50.0812 3940 Fastfat - ok
18:30:50.0859 3940 FastUserSwitchingCompatibility (b927443008910b412bec72fc41c1bad0) C:\WINDOWS\System32\shsvcs.dll
18:30:51.0125 3940 FastUserSwitchingCompatibility - ok
18:30:51.0156 3940 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
18:30:51.0609 3940 Fdc - ok
18:30:51.0625 3940 Fips (ac366695a0796560aa37215ad5762aaf) C:\WINDOWS\system32\drivers\Fips.sys
18:30:52.0031 3940 Fips - ok
18:30:52.0062 3940 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
18:30:52.0562 3940 Flpydisk - ok
18:30:52.0609 3940 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
18:30:52.0921 3940 FltMgr - ok
18:30:53.0046 3940 FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
18:30:53.0140 3940 FontCache3.0.0.0 - ok
18:30:53.0156 3940 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
18:30:53.0640 3940 Fs_Rec - ok
18:30:53.0671 3940 Ftdisk (4e664d8541db4a66b73a24257e322e1f) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
18:30:54.0062 3940 Ftdisk - ok
18:30:54.0156 3940 GarenaPEngine - ok
18:30:54.0187 3940 GGSAFERDriver - ok
18:30:54.0203 3940 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
18:30:54.0468 3940 Gpc - ok
18:30:54.0515 3940 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
18:30:54.0828 3940 HDAudBus - ok
18:30:54.0859 3940 helpsvc (fcfe31fb75f8a6295b6b0af87a626282) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
18:30:55.0171 3940 helpsvc - ok
18:30:55.0218 3940 HidServ (00e25ee90166b3e1be6e74aebf858306) C:\WINDOWS\System32\hidserv.dll
18:30:55.0765 3940 HidServ - ok
18:30:55.0781 3940 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
18:30:56.0140 3940 HidUsb - ok
18:30:56.0171 3940 hkmsvc (7a6b320928f86bc851530d63c82965d9) C:\WINDOWS\System32\kmsvc.dll
18:30:56.0671 3940 hkmsvc - ok
18:30:56.0671 3940 hpn - ok
18:30:56.0750 3940 HTTP (f6aacf5bce2893e0c1754afeb672e5c9) C:\WINDOWS\system32\Drivers\HTTP.sys
18:30:57.0031 3940 HTTP - ok
18:30:57.0078 3940 HTTPFilter (58fe2f2da3bc5573f4a35b3760d3125f) C:\WINDOWS\System32\w3ssl.dll
18:30:57.0390 3940 HTTPFilter - ok
18:30:57.0390 3940 Huawei - ok
18:30:57.0406 3940 hwdatacard - ok
18:30:57.0421 3940 hwusbdev - ok
18:30:57.0437 3940 i2omgmt - ok
18:30:57.0437 3940 i2omp - ok
18:30:57.0500 3940 i8042prt (c528e27945367191e7bae364930b6932) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
18:30:58.0000 3940 i8042prt - ok
18:30:58.0437 3940 idsvc (c01ac32dc5c03076cfb852cb5da5229c) c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
18:30:58.0750 3940 idsvc - ok
18:30:58.0781 3940 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
18:30:59.0078 3940 Imapi - ok
18:30:59.0140 3940 ImapiService (f7b93aafad33b2320954c17e26c8d361) C:\WINDOWS\system32\imapi.exe
18:30:59.0453 3940 ImapiService - ok
18:30:59.0484 3940 ini910u - ok
18:31:01.0046 3940 IntcAzAudAddService (fb4293b1eab313c28d4a1b8db61aca72) C:\WINDOWS\system32\drivers\RtkHDAud.sys
18:31:01.0390 3940 IntcAzAudAddService - ok
18:31:01.0671 3940 IntelIde - ok
18:31:01.0718 3940 intelppm (27b290d632af2cf3cf40bfddb7370985) C:\WINDOWS\system32\DRIVERS\intelppm.sys
18:31:07.0062 3940 intelppm - ok
18:31:07.0093 3940 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
18:31:07.0578 3940 Ip6Fw - ok
18:31:07.0625 3940 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
18:31:07.0921 3940 IpFilterDriver - ok
18:31:07.0937 3940 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
18:31:08.0453 3940 IpInIp - ok
18:31:08.0500 3940 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
18:31:08.0812 3940 IpNat - ok
18:31:08.0843 3940 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
18:31:09.0312 3940 IPSec - ok
18:31:09.0343 3940 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
18:31:09.0593 3940 IRENUM - ok
18:31:09.0625 3940 isapnp (cc9f8a2d60aed1a51a3ac34c59b987ae) C:\WINDOWS\system32\DRIVERS\isapnp.sys
18:31:09.0968 3940 isapnp - ok
18:31:10.0171 3940 JavaQuickStarterService (0a5709543986843d37a92290b7838340) C:\Program Files\Java\jre6\bin\jqs.exe
18:31:10.0203 3940 JavaQuickStarterService - ok
18:31:10.0234 3940 Kbdclass (1b6162fe7f66b1a71a4b70f941c4aa9b) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
18:31:10.0765 3940 Kbdclass - ok
18:31:10.0796 3940 kbdhid (86c8f23616c6c6e5b2776901c17b945b) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
18:31:11.0078 3940 kbdhid - ok
18:31:11.0156 3940 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
18:31:11.0640 3940 kmixer - ok
18:31:11.0703 3940 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
18:31:16.0890 3940 KSecDD - ok
18:31:16.0906 3940 L1e (93e64bab9dee162ca0ca5258d132a047) C:\WINDOWS\system32\DRIVERS\l1e51x86.sys
18:31:22.0218 3940 L1e - ok
18:31:22.0234 3940 L8042Kbd (0c6e346cde730cf1356dd69ad6e9bc42) C:\WINDOWS\system32\DRIVERS\L8042Kbd.sys
18:31:22.0250 3940 L8042Kbd - ok
18:31:22.0296 3940 LanmanServer (21920ac69594ab021237054fa728fe46) C:\WINDOWS\System32\srvsvc.dll
18:31:22.0781 3940 LanmanServer - ok
18:31:22.0843 3940 lanmanworkstation (936c1d110232d23b621cb0196e4f80f0) C:\WINDOWS\System32\wkssvc.dll
18:31:23.0015 3940 lanmanworkstation - ok
18:31:23.0015 3940 lbrtfdc - ok
18:31:23.0078 3940 LHidFilt (7f9c7b28cf1c859e1c42619eea946dc8) C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys
18:31:23.0109 3940 LHidFilt - ok
18:31:23.0203 3940 LightScribeService (d57d1be0129c1b45653b0fa920bc4b38) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
18:31:23.0296 3940 LightScribeService ( UnsignedFile.Multi.Generic ) - warning
18:31:23.0296 3940 LightScribeService - detected UnsignedFile.Multi.Generic (1)
18:31:23.0359 3940 LmHosts (0ab159f536e3e8f7f07113702a07cca5) C:\WINDOWS\System32\lmhsvc.dll
18:31:23.0796 3940 LmHosts - ok
18:31:23.0812 3940 LMouFilt (ab33792a87285344f43b5ce23421bab0) C:\WINDOWS\system32\DRIVERS\LMouFilt.Sys
18:31:23.0812 3940 LMouFilt - ok
18:31:23.0859 3940 mak810c (494daad7dab01d160c37ae7d99b00de6) C:\WINDOWS\system32\Drivers\mak810c.sys
18:31:23.0890 3940 mak810c ( UnsignedFile.Multi.Generic ) - warning
18:31:23.0890 3940 mak810c - detected UnsignedFile.Multi.Generic (1)
18:31:23.0890 3940 mak810m (b2434b4f7827798abecd2103fb8f64a5) C:\WINDOWS\system32\Drivers\mak810m.sys
18:31:23.0937 3940 mak810m ( UnsignedFile.Multi.Generic ) - warning
18:31:23.0937 3940 mak810m - detected UnsignedFile.Multi.Generic (1)
18:31:23.0953 3940 mak810u (a8e54abb82e7c48341e5bad21d9b937b) C:\WINDOWS\system32\Drivers\mak810u.sys
18:31:24.0031 3940 mak810u ( UnsignedFile.Multi.Generic ) - warning
18:31:24.0031 3940 mak810u - detected UnsignedFile.Multi.Generic (1)
18:31:24.0078 3940 MaVctrl (8181ceb341cbb2f7f893f85b915d5e15) C:\WINDOWS\system32\DRIVERS\MaVc2K.sys
18:31:24.0156 3940 MaVctrl ( UnsignedFile.Multi.Generic ) - warning
18:31:24.0156 3940 MaVctrl - detected UnsignedFile.Multi.Generic (1)
18:31:24.0171 3940 Messenger (221cd1c815b8a6b79389c3f5d1018de8) C:\WINDOWS\System32\msgsvc.dll
18:31:24.0609 3940 Messenger - ok
18:31:24.0671 3940 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
18:31:25.0078 3940 mnmdd - ok
18:31:25.0125 3940 mnmsrvc (9a57d046f88f4b69751b11fd40088a61) C:\WINDOWS\system32\mnmsrvc.exe
18:31:25.0421 3940 mnmsrvc - ok
18:31:25.0421 3940 Modem (44032b0c6d9954d3fd26438330b99ee7) C:\WINDOWS\system32\drivers\Modem.sys
18:31:25.0828 3940 Modem - ok
18:31:27.0484 3940 monfilt (9fa7207d1b1adead88ae8eed9cdbbaa5) C:\WINDOWS\system32\drivers\monfilt.sys
18:31:52.0531 3940 monfilt - ok
18:31:52.0546 3940 Mouclass (4cb582831dbde63ce43b45d771218374) C:\WINDOWS\system32\DRIVERS\mouclass.sys
18:31:53.0078 3940 Mouclass - ok
18:31:53.0093 3940 mouhid (bb269eba740737ab749b214d568b6812) C:\WINDOWS\system32\DRIVERS\mouhid.sys
18:31:53.0375 3940 mouhid - ok
18:31:53.0375 3940 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
18:31:53.0656 3940 MountMgr - ok
18:31:53.0703 3940 MPE (c0f8e0c2c3c0437cf37c6781896dc3ec) C:\WINDOWS\system32\DRIVERS\MPE.sys
18:31:54.0140 3940 MPE - ok
18:31:54.0140 3940 mraid35x - ok
18:31:54.0234 3940 MREMP50 (9bd4dcb5412921864a7aacdedfbd1923) C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS
18:31:54.0328 3940 MREMP50 ( UnsignedFile.Multi.Generic ) - warning
18:31:54.0328 3940 MREMP50 - detected UnsignedFile.Multi.Generic (1)
18:31:54.0328 3940 MREMP50a64 - ok
18:31:54.0343 3940 MREMPR5 - ok
18:31:54.0343 3940 MRENDIS5 - ok
18:31:54.0421 3940 MRESP50 (07c02c892e8e1a72d6bf35004f0e9c5e) C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS
18:31:54.0484 3940 MRESP50 ( UnsignedFile.Multi.Generic ) - warning
18:31:54.0500 3940 MRESP50 - detected UnsignedFile.Multi.Generic (1)
18:31:54.0500 3940 MRESP50a64 - ok
18:31:54.0531 3940 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
18:31:54.0812 3940 MRxDAV - ok
18:31:54.0921 3940 MRxSmb (60ae98742484e7ab80c3c1450e708148) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
18:31:55.0046 3940 MRxSmb - ok
18:31:55.0062 3940 MSDTC (6db4d1521caba9a5ffab54ade0ae867d) C:\WINDOWS\system32\msdtc.exe
18:31:55.0406 3940 MSDTC - ok
18:31:55.0406 3940 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
18:31:55.0843 3940 Msfs - ok
18:31:55.0843 3940 MSIServer - ok
18:31:55.0890 3940 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
18:31:56.0296 3940 MSKSSRV - ok
18:31:56.0312 3940 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
18:31:56.0734 3940 MSPCLOCK - ok
18:31:56.0734 3940 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
18:31:57.0062 3940 MSPQM - ok
18:31:57.0125 3940 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
18:31:57.0625 3940 mssmbios - ok
18:31:57.0718 3940 MSSQL$MSSMLBIZ - ok
18:31:57.0750 3940 MSSQLServerADHelper (c06ea83f6fc2959e897c117255b6b1d5) c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe
18:31:57.0765 3940 MSSQLServerADHelper - ok
18:31:57.0796 3940 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
18:31:58.0156 3940 MSTEE - ok
18:31:58.0171 3940 MTsensor (d48659bb24c48345d926ecb45c1ebdf5) C:\WINDOWS\system32\DRIVERS\ASACPI.sys
18:31:58.0281 3940 MTsensor - ok
18:31:58.0281 3940 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
18:31:58.0750 3940 Mup - ok
18:31:58.0781 3940 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
18:31:59.0125 3940 NABTSFEC - ok
18:31:59.0281 3940 napagent (6ea362e9db03d44f6b996f4d8be237e9) C:\WINDOWS\System32\qagentrt.dll
18:31:59.0875 3940 napagent - ok
18:32:00.0296 3940 NBService (5e8edd6a52e897c19ec6e149fe6c7a8e) C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
18:32:00.0343 3940 NBService - ok
18:32:00.0406 3940 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
18:32:00.0843 3940 NDIS - ok
18:32:00.0875 3940 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
18:32:01.0203 3940 NdisIP - ok
18:32:01.0218 3940 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
18:32:01.0515 3940 NdisTapi - ok
18:32:01.0562 3940 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
18:32:01.0859 3940 Ndisuio - ok
18:32:01.0875 3940 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
18:32:02.0281 3940 NdisWan - ok
18:32:02.0281 3940 NDProxy (6215023940cfd3702b46abc304e1d45a) C:\WINDOWS\system32\drivers\NDProxy.sys
18:32:02.0609 3940 NDProxy - ok
18:32:02.0609 3940 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
18:32:02.0937 3940 NetBIOS - ok
18:32:02.0953 3940 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
18:32:03.0250 3940 NetBT - ok
18:32:03.0312 3940 NetDDE (933de774986ec85e48210c44ab431de6) C:\WINDOWS\system32\netdde.exe
18:32:03.0625 3940 NetDDE - ok
18:32:03.0625 3940 NetDDEdsdm (933de774986ec85e48210c44ab431de6) C:\WINDOWS\system32\netdde.exe
18:32:03.0984 3940 NetDDEdsdm - ok
18:32:04.0000 3940 Netlogon (ed0a176354487ceed65b80a7148ab739) C:\WINDOWS\system32\lsass.exe
18:32:04.0484 3940 Netlogon - ok
18:32:04.0593 3940 Netman (72e1e9e2977be08bdeedb6d8fd9d4d40) C:\WINDOWS\System32\netman.dll
18:32:05.0140 3940 Netman - ok
18:32:05.0265 3940 NetTcpPortSharing (d34612c5d02d026535b3095d620626ae) c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
18:32:05.0296 3940 NetTcpPortSharing - ok
18:32:05.0453 3940 Nla (1289b7611ccd6cb27596ae92cbf03e35) C:\WINDOWS\System32\mswsock.dll
18:32:05.0703 3940 Nla - ok
18:32:05.0921 3940 NMIndexingService (a328a46d87bb92ce4d8a4528e9d84787) C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
18:32:05.0968 3940 NMIndexingService - ok
18:32:06.0000 3940 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
18:32:06.0468 3940 Npfs - ok
18:32:06.0765 3940 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
18:32:32.0250 3940 Ntfs - ok
18:32:32.0296 3940 NtLmSsp (ed0a176354487ceed65b80a7148ab739) C:\WINDOWS\system32\lsass.exe
18:32:32.0718 3940 NtLmSsp - ok
18:32:32.0812 3940 NtmsSvc (023dd70573d644f3d9c8b1258a7bfd08) C:\WINDOWS\system32\ntmssvc.dll
18:32:33.0203 3940 NtmsSvc - ok
18:32:33.0218 3940 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
18:32:33.0515 3940 Null - ok
18:32:35.0812 3940 nv (bf506d232c5e6f2dae80f5c11b45c60e) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
18:32:36.0296 3940 nv - ok
18:32:36.0671 3940 NVSvc (ce8cce2b9f96aca02e5ded4298a7796d) C:\WINDOWS\system32\nvsvc32.exe
18:32:36.0890 3940 NVSvc ( UnsignedFile.Multi.Generic ) - warning
18:32:36.0890 3940 NVSvc - detected UnsignedFile.Multi.Generic (1)
18:32:36.0921 3940 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
18:32:37.0296 3940 NwlnkFlt - ok
18:32:37.0312 3940 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
18:32:37.0781 3940 NwlnkFwd - ok
18:32:37.0906 3940 ose (7a56cf3e3f12e8af599963b16f50fb6a) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
18:32:37.0953 3940 ose - ok
18:32:37.0984 3940 Parport (46f8db73b4a53e543f8e371dc7c75bae) C:\WINDOWS\system32\drivers\Parport.sys
18:32:38.0406 3940 Parport - ok
18:32:38.0421 3940 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
18:32:38.0796 3940 PartMgr - ok
18:32:38.0828 3940 ParVdm (1fae19d0457176318bba4a8795656ebc) C:\WINDOWS\system32\drivers\ParVdm.sys
18:32:39.0187 3940 ParVdm - ok
18:32:39.0203 3940 PCI (6ce351d149cb4befc702951e471e1730) C:\WINDOWS\system32\DRIVERS\pci.sys
18:32:39.0750 3940 PCI - ok
18:32:39.0750 3940 PCIDump - ok
18:32:39.0781 3940 PCIIde (8b70cbfffd94bfe8a30441d872ed066e) C:\WINDOWS\system32\DRIVERS\pciide.sys
18:32:39.0781 3940 Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\pciide.sys. Real md5: 8b70cbfffd94bfe8a30441d872ed066e, Fake md5: 2da4ec85e0ea7a45c6b2a05820492d5a
18:32:39.0781 3940 PCIIde ( Rootkit.Win32.TDSS.tdl3 ) - infected
18:32:39.0781 3940 PCIIde - detected Rootkit.Win32.TDSS.tdl3 (0)
18:32:39.0843 3940 Pcmcia (4fc31e6c19a5ce5198b1abff94cae758) C:\WINDOWS\system32\drivers\Pcmcia.sys
18:32:40.0250 3940 Pcmcia - ok
18:32:40.0250 3940 PDCOMP - ok
18:32:40.0250 3940 PDFRAME - ok
18:32:40.0250 3940 PDRELI - ok
18:32:40.0281 3940 PDRFRAME - ok
18:32:40.0296 3940 perc2 - ok
18:32:40.0296 3940 perc2hib - ok
18:32:40.0406 3940 PlugPlay (9ef697af07bb8dd82c3b02ca953a95b7) C:\WINDOWS\system32\services.exe
18:32:40.0687 3940 PlugPlay - ok
18:32:40.0718 3940 PolicyAgent (ed0a176354487ceed65b80a7148ab739) C:\WINDOWS\system32\lsass.exe
18:32:41.0140 3940 PolicyAgent - ok
18:32:41.0156 3940 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
18:32:41.0468 3940 PptpMiniport - ok
18:32:41.0468 3940 ProtectedStorage (ed0a176354487ceed65b80a7148ab739) C:\WINDOWS\system32\lsass.exe
18:32:41.0796 3940 ProtectedStorage - ok
18:32:41.0796 3940 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
18:32:57.0734 3940 PSched - ok
18:32:57.0750 3940 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
18:32:59.0062 3940 Ptilink - ok
18:32:59.0062 3940 ql1080 - ok
18:32:59.0062 3940 Ql10wnt - ok
18:32:59.0062 3940 ql12160 - ok
18:32:59.0062 3940 ql1240 - ok
18:32:59.0078 3940 ql1280 - ok
18:32:59.0078 3940 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
18:32:59.0359 3940 RasAcd - ok
18:32:59.0406 3940 RasAuto (2b5e44ea009f2f374b980e1e9a70635d) C:\WINDOWS\System32\rasauto.dll
18:32:59.0750 3940 RasAuto - ok
18:32:59.0765 3940 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
18:33:00.0109 3940 Rasl2tp - ok
18:33:00.0203 3940 RasMan (d57554c664b64604bd1ee13ea2c07e77) C:\WINDOWS\System32\rasmans.dll
18:33:00.0687 3940 RasMan - ok
18:33:00.0687 3940 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
18:33:01.0015 3940 RasPppoe - ok
18:33:01.0015 3940 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
18:33:01.0312 3940 Raspti - ok
18:33:01.0390 3940 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
18:33:01.0703 3940 Rdbss - ok
18:33:01.0703 3940 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
18:33:02.0156 3940 RDPCDD - ok
18:33:02.0234 3940 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
18:33:02.0703 3940 RDPWD - ok
18:33:02.0765 3940 RDSessMgr (c0d9d9711cb74ee9bc66353d8cbdab0e) C:\WINDOWS\system32\sessmgr.exe
18:33:03.0187 3940 RDSessMgr - ok
18:33:03.0187 3940 redbook (611bfd220305be3a85ae876ea47d4aa5) C:\WINDOWS\system32\DRIVERS\redbook.sys
18:33:03.0468 3940 redbook - ok
18:33:03.0500 3940 RemoteAccess (127c26b5371651043450e52542099aba) C:\WINDOWS\System32\mprdim.dll
18:33:03.0859 3940 RemoteAccess - ok
18:33:03.0875 3940 RpcLocator (718b3bdc0bc3c2f7d065a53d26202af9) C:\WINDOWS\system32\locator.exe
18:33:14.0343 3940 RpcLocator - ok
18:33:14.0562 3940 RpcSs (be27674d1cbc3214aec84b4336a38bbf) C:\WINDOWS\System32\rpcss.dll
18:33:14.0843 3940 RpcSs - ok
18:33:14.0906 3940 RSVP (09ab2e71e58b078038e3bfdba7ffc984) C:\WINDOWS\system32\rsvp.exe
18:33:15.0218 3940 RSVP - ok
18:33:15.0281 3940 RTLE8023xp (b52b25f41bf3511071a0e7d10d659c56) C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys
18:33:15.0515 3940 RTLE8023xp - ok
18:33:15.0609 3940 s0016bus (59509ad6cbc28f2c73056268985b3e48) C:\WINDOWS\system32\DRIVERS\s0016bus.sys
18:33:15.0609 3940 s0016bus - ok
18:33:15.0640 3940 s0016mdfl (b98c3a6f91f4fba285af9606a240c6b4) C:\WINDOWS\system32\DRIVERS\s0016mdfl.sys
18:33:15.0687 3940 s0016mdfl - ok
18:33:15.0703 3940 s0016mdm (8a83426f4fb7b5212825d9de76368b1a) C:\WINDOWS\system32\DRIVERS\s0016mdm.sys
18:33:15.0734 3940 s0016mdm - ok
18:33:15.0796 3940 s0016mgmt (7a78bba97feb5e6d24c49e93a3bf7287) C:\WINDOWS\system32\DRIVERS\s0016mgmt.sys
18:33:15.0812 3940 s0016mgmt - ok
18:33:15.0828 3940 s0016nd5 (34ef7b5f611957b73e7219dd5a222ad1) C:\WINDOWS\system32\DRIVERS\s0016nd5.sys
18:33:15.0828 3940 s0016nd5 - ok
18:33:15.0890 3940 s0016obex (36792935847143e4a3cda0dc87248487) C:\WINDOWS\system32\DRIVERS\s0016obex.sys
18:33:15.0953 3940 s0016obex - ok
18:33:15.0984 3940 s0016unic (927208754fb27fc3e7a659e77500c5d1) C:\WINDOWS\system32\DRIVERS\s0016unic.sys
18:33:16.0000 3940 s0016unic - ok
18:33:16.0046 3940 SamSs (ed0a176354487ceed65b80a7148ab739) C:\WINDOWS\system32\lsass.exe
18:33:16.0500 3940 SamSs - ok
18:33:16.0578 3940 SCardSvr (410046e401eb11e1e6749e9deea41d4a) C:\WINDOWS\System32\SCardSvr.exe
18:33:17.0046 3940 SCardSvr - ok
18:33:17.0093 3940 Schedule (3ff232a7731621b8902d81d42418c93c) C:\WINDOWS\system32\schedsvc.dll
18:33:17.0406 3940 Schedule - ok
18:33:17.0421 3940 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
18:33:17.0609 3940 Secdrv - ok
18:33:17.0625 3940 seclogon (477e2c3cc5e4a0d635bcb0ea8dcac3c6) C:\WINDOWS\System32\seclogon.dll
18:33:18.0078 3940 seclogon - ok
18:33:18.0109 3940 seehcri (e5b56569a9f79b70314fede6c953641e) C:\WINDOWS\system32\DRIVERS\seehcri.sys
18:33:18.0218 3940 seehcri - ok
18:33:18.0234 3940 SENS (a530b75c10c23c9ab28fdb6ce719e21f) C:\WINDOWS\system32\sens.dll
18:33:18.0578 3940 SENS - ok
18:33:18.0593 3940 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
18:33:18.0890 3940 serenum - ok
18:33:18.0890 3940 Serial (b842729337c9b921615c40d3c1a1af96) C:\WINDOWS\system32\DRIVERS\serial.sys
18:33:54.0281 3940 Serial - ok
18:33:54.0312 3940 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
18:33:54.0781 3940 Sfloppy - ok
18:33:54.0875 3940 SharedAccess (f58faca9621d2db01bd0927d9a0a208e) C:\WINDOWS\System32\ipnathlp.dll
18:33:55.0281 3940 SharedAccess - ok
18:33:55.0343 3940 ShellHWDetection (b927443008910b412bec72fc41c1bad0) C:\WINDOWS\System32\shsvcs.dll
18:33:55.0937 3940 ShellHWDetection - ok
18:33:55.0937 3940 Simbad - ok
18:33:55.0968 3940 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
18:33:56.0343 3940 SLIP - ok
18:33:56.0343 3940 Sparrow - ok
18:33:56.0406 3940 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
18:33:56.0843 3940 splitter - ok
18:33:56.0859 3940 Spooler (cb1090bca0e7b40d0b5b4e4d66531809) C:\WINDOWS\system32\spoolsv.exe
18:33:57.0234 3940 Spooler - ok
18:33:57.0546 3940 sptd (d15da1ba189770d93eea2d7e18f95af9) C:\WINDOWS\system32\Drivers\sptd.sys
18:33:57.0578 3940 Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: d15da1ba189770d93eea2d7e18f95af9
18:33:57.0578 3940 sptd ( LockedFile.Multi.Generic ) - warning
18:33:57.0578 3940 sptd - detected LockedFile.Multi.Generic (1)
18:33:57.0703 3940 SQLBrowser (b2ec3e1deac5f0a764bd3486d213a0af) c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
18:33:57.0765 3940 SQLBrowser - ok
18:33:57.0828 3940 SQLWriter (d2f4f32b59440011174b4f8137af4e0c) c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
18:33:57.0859 3940 SQLWriter - ok
18:33:57.0921 3940 sr (94610c8653635e4459316a0050d55ce7) C:\WINDOWS\system32\DRIVERS\sr.sys
18:33:58.0218 3940 sr - ok
18:33:58.0250 3940 srservice (35b91147124f64ac8081a2edb9ea4dee) C:\WINDOWS\system32\srsvc.dll
18:33:58.0546 3940 srservice - ok
18:33:58.0625 3940 Srv (3bb03f2ba89d2be417206c373d2af17c) C:\WINDOWS\system32\DRIVERS\srv.sys
18:33:58.0734 3940 Srv - ok
18:33:58.0796 3940 SSDPSRV (becd5271dc4e3b7c3d035f790fcbc1e5) C:\WINDOWS\System32\ssdpsrv.dll
18:34:04.0109 3940 SSDPSRV - ok
18:34:04.0296 3940 stisvc (c1cdd9275f6a115bb0ae1d55d8d27ba6) C:\WINDOWS\system32\wiaservc.dll
18:34:05.0250 3940 stisvc - ok
18:34:05.0265 3940 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
18:34:05.0578 3940 streamip - ok
18:34:05.0593 3940 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
18:34:06.0046 3940 swenum - ok
18:34:06.0093 3940 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
18:34:06.0375 3940 swmidi - ok
18:34:06.0375 3940 SwPrv - ok
18:34:06.0390 3940 symc810 - ok
18:34:06.0390 3940 symc8xx - ok
18:34:06.0390 3940 SymIM - ok
18:34:06.0390 3940 SymIMMP - ok
18:34:06.0406 3940 sym_hi - ok
18:34:06.0406 3940 sym_u3 - ok
18:34:06.0453 3940 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
18:34:06.0750 3940 sysaudio - ok
18:34:06.0796 3940 SysmonLog (ce06f01b88ace199a1bf460cac29c110) C:\WINDOWS\system32\smlogsvc.exe
18:34:07.0140 3940 SysmonLog - ok
18:34:07.0218 3940 TapiSrv (c2546cd7a398476f9df5614b2ae160e8) C:\WINDOWS\System32\tapisrv.dll
18:34:07.0562 3940 TapiSrv - ok
18:34:07.0578 3940 TBPanel (04e1c782cf14b7282ebc633b0fd3ed16) C:\WINDOWS\system32\drivers\TBPanel.sys
18:34:07.0734 3940 TBPanel - ok
18:34:07.0828 3940 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
18:34:07.0953 3940 Tcpip - ok
18:34:07.0984 3940 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
18:34:08.0281 3940 TDPIPE - ok
18:34:08.0296 3940 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
18:34:08.0578 3940 TDTCP - ok
18:34:08.0593 3940 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
18:34:08.0890 3940 TermDD - ok
18:34:08.0937 3940 TermService (a75dd6fc3dbee4fff5ebc9f2c28bb66e) C:\WINDOWS\System32\termsrv.dll
18:34:09.0375 3940 TermService - ok
18:34:09.0468 3940 Themes (b927443008910b412bec72fc41c1bad0) C:\WINDOWS\System32\shsvcs.dll
18:34:15.0000 3940 Themes - ok
18:34:15.0000 3940 TosIde - ok
18:34:15.0359 3940 TrkWks (38853304ccb938d30e0c4cde8d2c2a8a) C:\WINDOWS\system32\trkwks.dll
18:34:15.0953 3940 TrkWks - ok
18:34:16.0000 3940 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
18:34:16.0265 3940 Udfs - ok
18:34:16.0328 3940 UleadBurningHelper (332d341d92b933600d41953b08360dfb) C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
18:34:16.0406 3940 UleadBurningHelper ( UnsignedFile.Multi.Generic ) - warning
18:34:16.0406 3940 UleadBurningHelper - detected UnsignedFile.Multi.Generic (1)
18:34:16.0406 3940 ultra - ok
18:34:16.0484 3940 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
18:34:16.0781 3940 Update - ok
18:34:16.0843 3940 upnphost (651bd90dcee5b7bdc74a2eb7c9266f9e) C:\WINDOWS\System32\upnphost.dll
18:34:17.0265 3940 upnphost - ok
18:34:17.0265 3940 UPS (20a0f6a11959e92908717d09e87d670d) C:\WINDOWS\System32\ups.exe
18:34:17.0781 3940 UPS - ok
18:34:17.0828 3940 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
18:34:18.0125 3940 usbccgp - ok
18:34:18.0156 3940 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
18:34:18.0421 3940 usbehci - ok
18:34:18.0468 3940 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
18:34:18.0750 3940 usbhub - ok
18:34:18.0796 3940 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
18:34:19.0093 3940 usbprint - ok
18:34:19.0156 3940 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
18:34:19.0609 3940 usbscan - ok
18:34:19.0625 3940 usbstor (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
18:34:19.0921 3940 usbstor - ok
18:34:19.0968 3940 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
18:34:20.0250 3940 usbuhci - ok
18:34:20.0281 3940 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
18:34:20.0703 3940 VgaSave - ok
18:34:21.0046 3940 VIAHdAudAddService (a4c6422857e12a1b5a70cd96305860d5) C:\WINDOWS\system32\drivers\viahduaa.sys
18:34:21.0265 3940 VIAHdAudAddService - ok
18:34:21.0265 3940 ViaIde - ok
18:34:21.0296 3940 VolSnap (28a4b296b47782173c346e376cb374d1) C:\WINDOWS\system32\drivers\VolSnap.sys
18:34:21.0562 3940 VolSnap - ok
18:34:21.0640 3940 VSS (d6ba1a63d9e00933f1cd2a885573afb2) C:\WINDOWS\System32\vssvc.exe
18:34:21.0937 3940 VSS - ok
18:34:22.0015 3940 W32Time (fa4e1cdba256787f2149f4aad07bc91f) C:\WINDOWS\system32\w32time.dll
18:34:22.0359 3940 W32Time - ok
18:34:22.0390 3940 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
18:34:22.0687 3940 Wanarp - ok
18:34:22.0828 3940 Wdf01000 (fd47474bd21794508af449d9d91af6e6) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
18:34:22.0843 3940 Wdf01000 - ok
18:34:22.0859 3940 WDICA - ok
18:34:22.0906 3940 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
18:34:23.0250 3940 wdmaud - ok
18:34:23.0296 3940 WebClient (47ae51048a82dfa1cd6b51d369f7e169) C:\WINDOWS\System32\webclnt.dll
18:34:23.0921 3940 WebClient - ok
18:34:23.0984 3940 WFIOCTL - ok
18:34:24.0093 3940 winmgmt (e488332126e3b1182d2b8a0c35408ec6) C:\WINDOWS\system32\wbem\WMIsvc.dll
18:34:24.0406 3940 winmgmt - ok
18:34:24.0453 3940 WmdmPmSN (c51b4a5c05a5475708e3c81c7765b71d) C:\WINDOWS\system32\MsPMSNSv.dll
18:34:24.0578 3940 WmdmPmSN - ok
18:34:24.0609 3940 WmiApSrv (23f6f03272f7e5679f1f050aed5acee6) C:\WINDOWS\system32\wbem\wmiapsrv.exe
18:34:24.0937 3940 WmiApSrv - ok
18:34:24.0984 3940 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
18:34:25.0359 3940 WS2IFSL - ok
18:34:25.0421 3940 wscsvc (4c86d5faf78194995af9cc1075f65dd3) C:\WINDOWS\system32\wscsvc.dll
18:34:26.0000 3940 wscsvc - ok
18:34:26.0031 3940 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
18:34:26.0312 3940 WSTCODEC - ok
18:34:26.0343 3940 wuauserv (c1364564800ee9784192145324a23308) C:\WINDOWS\system32\wuauserv.dll
18:34:26.0718 3940 wuauserv - ok
18:34:26.0781 3940 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
18:34:26.0968 3940 WudfPf - ok
18:34:27.0015 3940 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
18:34:27.0671 3940 WudfRd - ok
18:34:27.0703 3940 WudfSvc (05231c04253c5bc30b26cbaae680ed89) C:\WINDOWS\System32\WUDFSvc.dll
18:34:27.0875 3940 WudfSvc - ok
18:34:28.0000 3940 WZCSVC (a27d4ba7264c0bf52f32d10405bea1d4) C:\WINDOWS\System32\wzcsvc.dll
18:34:28.0546 3940 WZCSVC - ok
18:34:28.0687 3940 xmlprov (eaa4bb9edb3fb10cf8979fe65e63658f) C:\WINDOWS\System32\xmlprov.dll
18:34:29.0203 3940 xmlprov - ok
18:34:29.0218 3940 MBR (0x1B8) (413fc2a0c716421b3158746d63736515) \Device\Harddisk0\DR0
18:34:30.0359 3940 \Device\Harddisk0\DR0 ( TDSS File System ) - warning
18:34:30.0359 3940 \Device\Harddisk0\DR0 - detected TDSS File System (1)
18:34:30.0359 3940 MBR (0x1B8) (e5fa06aca0d60ba9c870d0ef3d9898c9) \Device\Harddisk6\DR12
18:34:32.0765 3940 \Device\Harddisk6\DR12 - ok
18:34:32.0765 3940 Boot (0x1200) (2f4d77c3c84359e51cdc5160a07bcc0a) \Device\Harddisk0\DR0\Partition0
18:34:32.0765 3940 \Device\Harddisk0\DR0\Partition0 - ok
18:34:32.0765 3940 Boot (0x1200) (0d6e3e84df0bab89f4dc8b4bac071f67) \Device\Harddisk6\DR12\Partition0
18:34:32.0765 3940 \Device\Harddisk6\DR12\Partition0 - ok
18:34:32.0765 3940 ============================================================
18:34:32.0765 3940 Scan finished
18:34:32.0765 3940 ============================================================
18:34:32.0875 3928 Detected object count: 12
18:34:32.0875 3928 Actual detected object count: 12
18:35:17.0187 3928 LightScribeService ( UnsignedFile.Multi.Generic ) - skipped by user
18:35:17.0187 3928 LightScribeService ( UnsignedFile.Multi.Generic ) - User select action: Skip
18:35:17.0187 3928 mak810c ( UnsignedFile.Multi.Generic ) - skipped by user
18:35:17.0187 3928 mak810c ( UnsignedFile.Multi.Generic ) - User select action: Skip
18:35:17.0187 3928 mak810m ( UnsignedFile.Multi.Generic ) - skipped by user
18:35:17.0187 3928 mak810m ( UnsignedFile.Multi.Generic ) - User select action: Skip
18:35:17.0187 3928 mak810u ( UnsignedFile.Multi.Generic ) - skipped by user
18:35:17.0187 3928 mak810u ( UnsignedFile.Multi.Generic ) - User select action: Skip
18:35:17.0187 3928 MaVctrl ( UnsignedFile.Multi.Generic ) - skipped by user
18:35:17.0187 3928 MaVctrl ( UnsignedFile.Multi.Generic ) - User select action: Skip
18:35:17.0187 3928 MREMP50 ( UnsignedFile.Multi.Generic ) - skipped by user
18:35:17.0187 3928 MREMP50 ( UnsignedFile.Multi.Generic ) - User select action: Skip
18:35:17.0187 3928 MRESP50 ( UnsignedFile.Multi.Generic ) - skipped by user
18:35:17.0187 3928 MRESP50 ( UnsignedFile.Multi.Generic ) - User select action: Skip
18:35:17.0187 3928 NVSvc ( UnsignedFile.Multi.Generic ) - skipped by user
18:35:17.0187 3928 NVSvc ( UnsignedFile.Multi.Generic ) - User select action: Skip
18:35:17.0187 3928 PCIIde ( Rootkit.Win32.TDSS.tdl3 ) - skipped by user
18:35:17.0187 3928 PCIIde ( Rootkit.Win32.TDSS.tdl3 ) - User select action: Skip
18:35:17.0187 3928 sptd ( LockedFile.Multi.Generic ) - skipped by user
18:35:17.0187 3928 sptd ( LockedFile.Multi.Generic ) - User select action: Skip
18:35:17.0187 3928 UleadBurningHelper ( UnsignedFile.Multi.Generic ) - skipped by user
18:35:17.0187 3928 UleadBurningHelper ( UnsignedFile.Multi.Generic ) - User select action: Skip
18:35:17.0218 3928 \Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user
18:35:17.0218 3928 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip
18:35:30.0859 3776 Deinitialize success

zdravim byl jsem na vikend pryc tak pisu az ted, uz to vypada ze se pc spravil doted se po chvili zacal sekat a zpomalovat...


17:15:41.0390 3660 TDSS rootkit removing tool 2.7.34.0 May 2 2012 09:59:18
17:15:41.0859 3660 ============================================================
17:15:41.0859 3660 Current date / time: 2012/05/09 17:15:41.0859
17:15:41.0859 3660 SystemInfo:
17:15:41.0859 3660
17:15:41.0859 3660 OS Version: 5.1.2600 ServicePack: 3.0
17:15:41.0859 3660 Product type: Workstation
17:15:41.0859 3660 ComputerName: A04-0629A
17:15:41.0859 3660 UserName: M3th0dman
17:15:41.0859 3660 Windows directory: C:\WINDOWS
17:15:41.0859 3660 System windows directory: C:\WINDOWS
17:15:41.0859 3660 Processor architecture: Intel x86
17:15:41.0859 3660 Number of processors: 2
17:15:41.0859 3660 Page size: 0x1000
17:15:41.0859 3660 Boot type: Normal boot
17:15:41.0859 3660 ============================================================
17:15:43.0640 3660 Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
17:15:43.0656 3660 ============================================================
17:15:43.0656 3660 \Device\Harddisk0\DR0:
17:15:43.0656 3660 MBR partitions:
17:15:43.0656 3660 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x254297C1
17:15:43.0656 3660 ============================================================
17:15:43.0687 3660 C: <-> \Device\Harddisk0\DR0\Partition0
17:15:43.0687 3660 ============================================================
17:15:43.0687 3660 Initialize success
17:15:43.0687 3660 ============================================================
17:17:45.0234 2120 ============================================================
17:17:45.0234 2120 Scan started
17:17:45.0234 2120 Mode: Manual; SigCheck; TDLFS;
17:17:45.0234 2120 ============================================================
17:17:45.0828 2120 Aavmker4 (473f97edc5a5312f3665ab2921196c0c) C:\WINDOWS\system32\drivers\Aavmker4.sys
17:17:45.0937 2120 Aavmker4 - ok
17:17:45.0953 2120 Abiosdsk - ok
17:17:45.0953 2120 abp480n5 - ok
17:17:45.0984 2120 ACPI (4fe34f1f3126b61fcc6b2043aa8112c9) C:\WINDOWS\system32\DRIVERS\ACPI.sys
17:17:46.0484 2120 ACPI - ok
17:17:46.0500 2120 ACPIEC (afdff022a01f0b11c776f0860c3b282f) C:\WINDOWS\system32\drivers\ACPIEC.sys
17:17:46.0578 2120 ACPIEC - ok
17:17:46.0656 2120 AdobeFlashPlayerUpdateSvc (76d5a3d2a50402a0b9b6ed13c4371e79) C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
17:17:46.0671 2120 AdobeFlashPlayerUpdateSvc - ok
17:17:46.0671 2120 adpu160m - ok
17:17:46.0718 2120 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
17:17:46.0796 2120 aec - ok
17:17:46.0843 2120 AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys
17:17:46.0859 2120 AFD - ok
17:17:46.0859 2120 Aha154x - ok
17:17:46.0859 2120 aic78u2 - ok
17:17:46.0859 2120 aic78xx - ok
17:17:46.0906 2120 Alerter (e0a6fa244b8624d78fe5ff6f56a33bae) C:\WINDOWS\system32\alrsvc.dll
17:17:47.0015 2120 Alerter - ok
17:17:47.0046 2120 ALG (88842de939a827577bf24243699ac80a) C:\WINDOWS\System32\alg.exe
17:17:47.0078 2120 ALG - ok
17:17:47.0078 2120 AliIde - ok
17:17:47.0078 2120 amsint - ok
17:17:47.0093 2120 AppMgmt - ok
17:17:47.0093 2120 asc - ok
17:17:47.0093 2120 asc3350p - ok
17:17:47.0093 2120 asc3550 - ok
17:17:47.0125 2120 AsIO (2b4e66fac6503494a2c6f32bb6ab3826) C:\WINDOWS\system32\drivers\AsIO.sys
17:17:47.0140 2120 AsIO - ok
17:17:47.0187 2120 aspnet_state (0e5e4957549056e2bf2c49f4f6b601ad) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
17:17:47.0218 2120 aspnet_state - ok
17:17:47.0250 2120 aswFsBlk (0ae43c6c411254049279c2ee55630f95) C:\WINDOWS\system32\drivers\aswFsBlk.sys
17:17:47.0250 2120 aswFsBlk - ok
17:17:47.0265 2120 aswMon2 (8c30b7ddd2f1d8d138ebe40345af2b11) C:\WINDOWS\system32\drivers\aswMon2.sys
17:17:47.0265 2120 aswMon2 - ok
17:17:47.0281 2120 aswRdr (da12626fd9a67f4e917e2f2fbe1e1764) C:\WINDOWS\system32\drivers\aswRdr.sys
17:17:47.0281 2120 aswRdr - ok
17:17:47.0312 2120 aswSnx (dcb199b967375753b5019ec15f008f53) C:\WINDOWS\system32\drivers\aswSnx.sys
17:17:47.0343 2120 aswSnx - ok
17:17:47.0359 2120 aswSP (b32873e5a1443c0a1e322266e203bf10) C:\WINDOWS\system32\drivers\aswSP.sys
17:17:47.0375 2120 aswSP - ok
17:17:47.0406 2120 aswTdi (6ff544175a9180c5d88534d3d9c9a9f7) C:\WINDOWS\system32\drivers\aswTdi.sys
17:17:47.0406 2120 aswTdi - ok
17:17:47.0421 2120 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
17:17:47.0500 2120 AsyncMac - ok
17:17:47.0515 2120 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
17:17:47.0578 2120 atapi - ok
17:17:47.0593 2120 Atdisk - ok
17:17:47.0609 2120 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
17:17:47.0687 2120 Atmarpc - ok
17:17:47.0718 2120 AudioSrv (de31b88962a8645dba5a37b993e7b0f1) C:\WINDOWS\System32\audiosrv.dll
17:17:47.0796 2120 AudioSrv - ok
17:17:47.0828 2120 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
17:17:47.0906 2120 audstub - ok
17:17:48.0000 2120 avast! Antivirus (4041d31508a2a084dfb42c595854090f) C:\Program Files\Avast\AvastSvc.exe
17:17:48.0000 2120 avast! Antivirus - ok
17:17:48.0078 2120 BcmSqlStartupSvc (6163664c7e9cd110af70180c126c3fdc) C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
17:17:48.0078 2120 BcmSqlStartupSvc - ok
17:17:48.0109 2120 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
17:17:48.0187 2120 Beep - ok
17:17:48.0250 2120 BITS (19395d092fd85ddc2d9c7729cf5a2ac8) C:\WINDOWS\system32\qmgr.dll
17:17:48.0437 2120 BITS - ok
17:17:48.0468 2120 Browser (249276d3ef1e74b992299cb96099e4d7) C:\WINDOWS\System32\browser.dll
17:17:48.0546 2120 Browser - ok
17:17:48.0593 2120 Cardex (04e1c782cf14b7282ebc633b0fd3ed16) C:\WINDOWS\system32\drivers\TBPANEL.SYS
17:17:48.0593 2120 Cardex - ok
17:17:48.0750 2120 catchme - ok
17:17:48.0781 2120 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
17:17:48.0859 2120 cbidf2k - ok
17:17:48.0906 2120 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
17:17:48.0984 2120 CCDECODE - ok
17:17:48.0984 2120 cd20xrnt - ok
17:17:49.0015 2120 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
17:17:49.0093 2120 Cdaudio - ok
17:17:49.0140 2120 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
17:17:49.0218 2120 Cdfs - ok
17:17:49.0250 2120 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
17:17:49.0328 2120 Cdrom - ok
17:17:49.0328 2120 Changer - ok
17:17:49.0343 2120 CiSvc (e390dc1d7c461d7d56ec53402f329928) C:\WINDOWS\system32\cisvc.exe
17:17:49.0421 2120 CiSvc - ok
17:17:49.0437 2120 ClipSrv (064507a8dfa8c5c7e2ffddd3e6f424fa) C:\WINDOWS\system32\clipsrv.exe
17:17:49.0515 2120 ClipSrv - ok
17:17:49.0609 2120 clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
17:17:49.0671 2120 clr_optimization_v2.0.50727_32 - ok
17:17:49.0671 2120 CmdIde - ok
17:17:49.0671 2120 COMSysApp - ok
17:17:49.0687 2120 Cpqarray - ok
17:17:49.0718 2120 CryptSvc (f3ab0933cbd166d271992f411c27ccaf) C:\WINDOWS\System32\cryptsvc.dll
17:17:49.0781 2120 CryptSvc - ok
17:17:49.0796 2120 dac2w2k - ok
17:17:49.0796 2120 dac960nt - ok
17:17:49.0859 2120 DcomLaunch (be27674d1cbc3214aec84b4336a38bbf) C:\WINDOWS\system32\rpcss.dll
17:17:49.0875 2120 DcomLaunch - ok
17:17:49.0890 2120 Dhcp (8c9a53e285ac5e6704844d0459ec85be) C:\WINDOWS\System32\dhcpcsvc.dll
17:17:49.0968 2120 Dhcp - ok
17:17:49.0984 2120 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
17:17:50.0078 2120 Disk - ok
17:17:50.0078 2120 dmadmin - ok
17:17:50.0156 2120 dmboot (db5fd2bf5b07dc54bfcb3664ff05bd7c) C:\WINDOWS\system32\drivers\dmboot.sys
17:17:50.0250 2120 dmboot - ok
17:17:50.0265 2120 dmio (fff1720af51171f32f1ead5cf71f2810) C:\WINDOWS\system32\drivers\dmio.sys
17:17:50.0343 2120 dmio - ok
17:17:50.0375 2120 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
17:17:50.0468 2120 dmload - ok
17:17:50.0484 2120 dmserver (2bfefe9e865655a76982f050450b9591) C:\WINDOWS\System32\dmserver.dll
17:17:50.0578 2120 dmserver - ok
17:17:50.0625 2120 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
17:17:50.0703 2120 DMusic - ok
17:17:50.0703 2120 Dnscache (0634b791684b84f4a331f3d3536feef8) C:\WINDOWS\System32\dnsrslvr.dll
17:17:50.0781 2120 Dnscache - ok
17:17:50.0812 2120 Dot3svc (4a3e2bd20157a0946751229e92eb8621) C:\WINDOWS\System32\dot3svc.dll
17:17:50.0890 2120 Dot3svc - ok
17:17:50.0906 2120 dpti2o - ok
17:17:50.0921 2120 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
17:17:51.0000 2120 drmkaud - ok
17:17:51.0015 2120 EapHost (0887d9c2be8d940778cad1e3b85f2a41) C:\WINDOWS\System32\eapsvc.dll
17:17:51.0109 2120 EapHost - ok
17:17:51.0125 2120 ERSvc (a2a4912798f2be706abadd3d30800d16) C:\WINDOWS\System32\ersvc.dll
17:17:51.0203 2120 ERSvc - ok
17:17:51.0234 2120 Eventlog (9ef697af07bb8dd82c3b02ca953a95b7) C:\WINDOWS\system32\services.exe
17:17:51.0250 2120 Eventlog - ok
17:17:51.0296 2120 EventSystem (a371f11ef07653591c8de26afb13ce7f) C:\WINDOWS\system32\es.dll
17:17:51.0312 2120 EventSystem - ok
17:17:51.0359 2120 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
17:17:51.0437 2120 Fastfat - ok
17:17:51.0453 2120 FastUserSwitchingCompatibility (b927443008910b412bec72fc41c1bad0) C:\WINDOWS\System32\shsvcs.dll
17:17:51.0531 2120 FastUserSwitchingCompatibility - ok
17:17:51.0546 2120 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
17:17:51.0640 2120 Fdc - ok
17:17:51.0640 2120 Fips (ac366695a0796560aa37215ad5762aaf) C:\WINDOWS\system32\drivers\Fips.sys
17:17:51.0718 2120 Fips - ok
17:17:51.0734 2120 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
17:17:51.0812 2120 Flpydisk - ok
17:17:51.0843 2120 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
17:17:51.0921 2120 FltMgr - ok
17:17:52.0031 2120 FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
17:17:52.0031 2120 FontCache3.0.0.0 - ok
17:17:52.0078 2120 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
17:17:52.0156 2120 Fs_Rec - ok
17:17:52.0171 2120 Ftdisk (4e664d8541db4a66b73a24257e322e1f) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
17:17:52.0250 2120 Ftdisk - ok
17:17:52.0328 2120 GarenaPEngine - ok
17:17:52.0359 2120 GGSAFERDriver - ok
17:17:52.0375 2120 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
17:17:52.0437 2120 Gpc - ok
17:17:52.0468 2120 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
17:17:52.0546 2120 HDAudBus - ok
17:17:52.0578 2120 helpsvc (fcfe31fb75f8a6295b6b0af87a626282) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
17:17:52.0796 2120 helpsvc - ok
17:17:52.0843 2120 HidServ (00e25ee90166b3e1be6e74aebf858306) C:\WINDOWS\System32\hidserv.dll
17:17:52.0906 2120 HidServ - ok
17:17:52.0937 2120 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
17:17:53.0015 2120 HidUsb - ok
17:17:53.0031 2120 hkmsvc (7a6b320928f86bc851530d63c82965d9) C:\WINDOWS\System32\kmsvc.dll
17:17:53.0125 2120 hkmsvc - ok
17:17:53.0125 2120 hpn - ok
17:17:53.0140 2120 HTTP (f6aacf5bce2893e0c1754afeb672e5c9) C:\WINDOWS\system32\Drivers\HTTP.sys
17:17:53.0218 2120 HTTP - ok
17:17:53.0265 2120 HTTPFilter (58fe2f2da3bc5573f4a35b3760d3125f) C:\WINDOWS\System32\w3ssl.dll
17:17:53.0343 2120 HTTPFilter - ok
17:17:53.0343 2120 Huawei - ok
17:17:53.0359 2120 hwdatacard - ok
17:17:53.0359 2120 hwusbdev - ok
17:17:53.0359 2120 i2omgmt - ok
17:17:53.0359 2120 i2omp - ok
17:17:53.0406 2120 i8042prt (c528e27945367191e7bae364930b6932) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
17:17:53.0484 2120 i8042prt - ok
17:17:53.0562 2120 idsvc (c01ac32dc5c03076cfb852cb5da5229c) c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
17:17:53.0593 2120 idsvc - ok
17:17:53.0609 2120 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
17:17:53.0703 2120 Imapi - ok
17:17:53.0734 2120 ImapiService (f7b93aafad33b2320954c17e26c8d361) C:\WINDOWS\system32\imapi.exe
17:17:53.0812 2120 ImapiService - ok
17:17:53.0812 2120 ini910u - ok
17:17:54.0062 2120 IntcAzAudAddService (fb4293b1eab313c28d4a1b8db61aca72) C:\WINDOWS\system32\drivers\RtkHDAud.sys
17:17:54.0187 2120 IntcAzAudAddService - ok
17:17:54.0281 2120 IntelIde - ok
17:17:54.0296 2120 intelppm (27b290d632af2cf3cf40bfddb7370985) C:\WINDOWS\system32\DRIVERS\intelppm.sys
17:17:54.0390 2120 intelppm - ok
17:17:54.0406 2120 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
17:17:54.0468 2120 Ip6Fw - ok
17:17:54.0515 2120 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
17:17:54.0593 2120 IpFilterDriver - ok
17:17:54.0609 2120 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
17:17:54.0687 2120 IpInIp - ok
17:17:54.0703 2120 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
17:17:54.0781 2120 IpNat - ok
17:17:54.0812 2120 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
17:17:54.0890 2120 IPSec - ok
17:17:54.0921 2120 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
17:17:54.0953 2120 IRENUM - ok
17:17:54.0984 2120 isapnp (cc9f8a2d60aed1a51a3ac34c59b987ae) C:\WINDOWS\system32\DRIVERS\isapnp.sys
17:17:55.0062 2120 isapnp - ok
17:17:55.0218 2120 JavaQuickStarterService (0a5709543986843d37a92290b7838340) C:\Program Files\Java\jre6\bin\jqs.exe
17:17:55.0234 2120 JavaQuickStarterService - ok
17:17:55.0265 2120 Kbdclass (1b6162fe7f66b1a71a4b70f941c4aa9b) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
17:17:55.0343 2120 Kbdclass - ok
17:17:55.0375 2120 kbdhid (86c8f23616c6c6e5b2776901c17b945b) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
17:17:55.0453 2120 kbdhid - ok
17:17:55.0468 2120 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
17:17:55.0546 2120 kmixer - ok
17:17:55.0593 2120 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
17:17:55.0609 2120 KSecDD - ok
17:17:55.0625 2120 L1e (93e64bab9dee162ca0ca5258d132a047) C:\WINDOWS\system32\DRIVERS\l1e51x86.sys
17:17:55.0656 2120 L1e - ok
17:17:55.0671 2120 L8042Kbd (0c6e346cde730cf1356dd69ad6e9bc42) C:\WINDOWS\system32\DRIVERS\L8042Kbd.sys
17:17:55.0671 2120 L8042Kbd - ok
17:17:55.0718 2120 LanmanServer (21920ac69594ab021237054fa728fe46) C:\WINDOWS\System32\srvsvc.dll
17:17:55.0812 2120 LanmanServer - ok
17:17:55.0843 2120 lanmanworkstation (936c1d110232d23b621cb0196e4f80f0) C:\WINDOWS\System32\wkssvc.dll
17:17:55.0859 2120 lanmanworkstation - ok
17:17:55.0859 2120 lbrtfdc - ok
17:17:55.0890 2120 LHidFilt (7f9c7b28cf1c859e1c42619eea946dc8) C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys
17:17:55.0906 2120 LHidFilt - ok
17:17:55.0953 2120 LightScribeService (d57d1be0129c1b45653b0fa920bc4b38) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
17:17:55.0953 2120 LightScribeService ( UnsignedFile.Multi.Generic ) - warning
17:17:55.0953 2120 LightScribeService - detected UnsignedFile.Multi.Generic (1)
17:17:56.0000 2120 LmHosts (0ab159f536e3e8f7f07113702a07cca5) C:\WINDOWS\System32\lmhsvc.dll
17:17:56.0078 2120 LmHosts - ok
17:17:56.0078 2120 LMouFilt (ab33792a87285344f43b5ce23421bab0) C:\WINDOWS\system32\DRIVERS\LMouFilt.Sys
17:17:56.0093 2120 LMouFilt - ok
17:17:56.0125 2120 mak810c (494daad7dab01d160c37ae7d99b00de6) C:\WINDOWS\system32\Drivers\mak810c.sys
17:17:56.0140 2120 mak810c ( UnsignedFile.Multi.Generic ) - warning
17:17:56.0140 2120 mak810c - detected UnsignedFile.Multi.Generic (1)
17:17:56.0156 2120 mak810m (b2434b4f7827798abecd2103fb8f64a5) C:\WINDOWS\system32\Drivers\mak810m.sys
17:17:56.0171 2120 mak810m ( UnsignedFile.Multi.Generic ) - warning
17:17:56.0171 2120 mak810m - detected UnsignedFile.Multi.Generic (1)
17:17:56.0187 2120 mak810u (a8e54abb82e7c48341e5bad21d9b937b) C:\WINDOWS\system32\Drivers\mak810u.sys
17:17:56.0203 2120 mak810u ( UnsignedFile.Multi.Generic ) - warning
17:17:56.0203 2120 mak810u - detected UnsignedFile.Multi.Generic (1)
17:17:56.0234 2120 MaVctrl (8181ceb341cbb2f7f893f85b915d5e15) C:\WINDOWS\system32\DRIVERS\MaVc2K.sys
17:17:56.0234 2120 MaVctrl ( UnsignedFile.Multi.Generic ) - warning
17:17:56.0234 2120 MaVctrl - detected UnsignedFile.Multi.Generic (1)
17:17:56.0250 2120 Messenger (221cd1c815b8a6b79389c3f5d1018de8) C:\WINDOWS\System32\msgsvc.dll
17:17:56.0328 2120 Messenger - ok
17:17:56.0359 2120 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
17:17:56.0437 2120 mnmdd - ok
17:17:56.0468 2120 mnmsrvc (9a57d046f88f4b69751b11fd40088a61) C:\WINDOWS\system32\mnmsrvc.exe
17:17:56.0546 2120 mnmsrvc - ok
17:17:56.0562 2120 Modem (44032b0c6d9954d3fd26438330b99ee7) C:\WINDOWS\system32\drivers\Modem.sys
17:17:56.0640 2120 Modem - ok
17:17:56.0734 2120 monfilt (9fa7207d1b1adead88ae8eed9cdbbaa5) C:\WINDOWS\system32\drivers\monfilt.sys
17:17:56.0781 2120 monfilt - ok
17:17:56.0812 2120 Mouclass (4cb582831dbde63ce43b45d771218374) C:\WINDOWS\system32\DRIVERS\mouclass.sys
17:17:56.0875 2120 Mouclass - ok
17:17:56.0906 2120 mouhid (bb269eba740737ab749b214d568b6812) C:\WINDOWS\system32\DRIVERS\mouhid.sys
17:17:56.0984 2120 mouhid - ok
17:17:57.0015 2120 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
17:17:57.0093 2120 MountMgr - ok
17:17:57.0125 2120 MPE (c0f8e0c2c3c0437cf37c6781896dc3ec) C:\WINDOWS\system32\DRIVERS\MPE.sys
17:17:57.0203 2120 MPE - ok
17:17:57.0203 2120 mraid35x - ok
17:17:57.0296 2120 MREMP50 (9bd4dcb5412921864a7aacdedfbd1923) C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS
17:17:57.0312 2120 MREMP50 ( UnsignedFile.Multi.Generic ) - warning
17:17:57.0312 2120 MREMP50 - detected UnsignedFile.Multi.Generic (1)
17:17:57.0328 2120 MREMP50a64 - ok
17:17:57.0328 2120 MREMPR5 - ok
17:17:57.0328 2120 MRENDIS5 - ok
17:17:57.0343 2120 MRESP50 (07c02c892e8e1a72d6bf35004f0e9c5e) C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS
17:17:57.0343 2120 MRESP50 ( UnsignedFile.Multi.Generic ) - warning
17:17:57.0343 2120 MRESP50 - detected UnsignedFile.Multi.Generic (1)
17:17:57.0343 2120 MRESP50a64 - ok
17:17:57.0359 2120 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
17:17:57.0421 2120 MRxDAV - ok
17:17:57.0468 2120 MRxSmb (60ae98742484e7ab80c3c1450e708148) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
17:17:57.0484 2120 MRxSmb - ok
17:17:57.0531 2120 MSDTC (6db4d1521caba9a5ffab54ade0ae867d) C:\WINDOWS\system32\msdtc.exe
17:17:57.0609 2120 MSDTC - ok
17:17:57.0609 2120 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
17:17:57.0687 2120 Msfs - ok
17:17:57.0687 2120 MSIServer - ok
17:17:57.0718 2120 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
17:17:57.0781 2120 MSKSSRV - ok
17:17:57.0796 2120 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
17:17:57.0859 2120 MSPCLOCK - ok
17:17:57.0875 2120 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
17:17:57.0937 2120 MSPQM - ok
17:17:57.0984 2120 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
17:17:58.0046 2120 mssmbios - ok
17:17:58.0125 2120 MSSQL$MSSMLBIZ - ok
17:17:58.0187 2120 MSSQLServerADHelper (c06ea83f6fc2959e897c117255b6b1d5) c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe
17:17:58.0187 2120 MSSQLServerADHelper - ok
17:17:58.0203 2120 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
17:17:58.0281 2120 MSTEE - ok
17:17:58.0296 2120 MTsensor (d48659bb24c48345d926ecb45c1ebdf5) C:\WINDOWS\system32\DRIVERS\ASACPI.sys
17:17:58.0296 2120 MTsensor - ok
17:17:58.0312 2120 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
17:17:58.0375 2120 Mup - ok
17:17:58.0390 2120 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
17:17:58.0468 2120 NABTSFEC - ok
17:17:58.0500 2120 napagent (6ea362e9db03d44f6b996f4d8be237e9) C:\WINDOWS\System32\qagentrt.dll
17:17:58.0593 2120 napagent - ok
17:17:58.0671 2120 NBService (5e8edd6a52e897c19ec6e149fe6c7a8e) C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
17:17:58.0703 2120 NBService - ok
17:17:58.0734 2120 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
17:17:58.0812 2120 NDIS - ok
17:17:58.0812 2120 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
17:17:58.0890 2120 NdisIP - ok
17:17:58.0890 2120 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
17:17:58.0968 2120 NdisTapi - ok
17:17:58.0984 2120 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
17:17:59.0046 2120 Ndisuio - ok
17:17:59.0078 2120 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
17:17:59.0140 2120 NdisWan - ok
17:17:59.0140 2120 NDProxy (6215023940cfd3702b46abc304e1d45a) C:\WINDOWS\system32\drivers\NDProxy.sys
17:17:59.0218 2120 NDProxy - ok
17:17:59.0234 2120 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
17:17:59.0296 2120 NetBIOS - ok
17:17:59.0312 2120 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
17:17:59.0375 2120 NetBT - ok
17:17:59.0421 2120 NetDDE (933de774986ec85e48210c44ab431de6) C:\WINDOWS\system32\netdde.exe
17:17:59.0500 2120 NetDDE - ok
17:17:59.0500 2120 NetDDEdsdm (933de774986ec85e48210c44ab431de6) C:\WINDOWS\system32\netdde.exe
17:17:59.0578 2120 NetDDEdsdm - ok
17:17:59.0578 2120 Netlogon (ed0a176354487ceed65b80a7148ab739) C:\WINDOWS\system32\lsass.exe
17:17:59.0656 2120 Netlogon - ok
17:17:59.0671 2120 Netman (72e1e9e2977be08bdeedb6d8fd9d4d40) C:\WINDOWS\System32\netman.dll
17:17:59.0750 2120 Netman - ok
17:17:59.0875 2120 NetTcpPortSharing (d34612c5d02d026535b3095d620626ae) c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
17:17:59.0875 2120 NetTcpPortSharing - ok
17:17:59.0921 2120 Nla (1289b7611ccd6cb27596ae92cbf03e35) C:\WINDOWS\System32\mswsock.dll
17:17:59.0953 2120 Nla - ok
17:18:00.0062 2120 NMIndexingService (a328a46d87bb92ce4d8a4528e9d84787) C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
17:18:00.0062 2120 NMIndexingService - ok
17:18:00.0078 2120 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
17:18:00.0156 2120 Npfs - ok
17:18:00.0203 2120 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
17:18:00.0281 2120 Ntfs - ok
17:18:00.0281 2120 NtLmSsp (ed0a176354487ceed65b80a7148ab739) C:\WINDOWS\system32\lsass.exe
17:18:00.0343 2120 NtLmSsp - ok
17:18:00.0375 2120 NtmsSvc (023dd70573d644f3d9c8b1258a7bfd08) C:\WINDOWS\system32\ntmssvc.dll
17:18:00.0453 2120 NtmsSvc - ok
17:18:00.0500 2120 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
17:18:00.0562 2120 Null - ok
17:18:00.0921 2120 nv (bf506d232c5e6f2dae80f5c11b45c60e) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
17:18:01.0140 2120 nv - ok
17:18:01.0281 2120 NVSvc (ce8cce2b9f96aca02e5ded4298a7796d) C:\WINDOWS\system32\nvsvc32.exe
17:18:01.0296 2120 NVSvc ( UnsignedFile.Multi.Generic ) - warning
17:18:01.0296 2120 NVSvc - detected UnsignedFile.Multi.Generic (1)
17:18:01.0328 2120 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
17:18:01.0406 2120 NwlnkFlt - ok
17:18:01.0421 2120 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
17:18:01.0500 2120 NwlnkFwd - ok
17:18:01.0578 2120 ose (7a56cf3e3f12e8af599963b16f50fb6a) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
17:18:01.0593 2120 ose - ok
17:18:01.0625 2120 Parport (46f8db73b4a53e543f8e371dc7c75bae) C:\WINDOWS\system32\drivers\Parport.sys
17:18:01.0703 2120 Parport - ok
17:18:01.0734 2120 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
17:18:01.0812 2120 PartMgr - ok
17:18:01.0843 2120 ParVdm (1fae19d0457176318bba4a8795656ebc) C:\WINDOWS\system32\drivers\ParVdm.sys
17:18:01.0906 2120 ParVdm - ok
17:18:01.0953 2120 PCI (6ce351d149cb4befc702951e471e1730) C:\WINDOWS\system32\DRIVERS\pci.sys
17:18:02.0031 2120 PCI - ok
17:18:02.0031 2120 PCIDump - ok
17:18:02.0062 2120 PCIIde (2da4ec85e0ea7a45c6b2a05820492d5a) C:\WINDOWS\system32\DRIVERS\pciide.sys
17:18:02.0125 2120 PCIIde - ok
17:18:02.0171 2120 Pcmcia (4fc31e6c19a5ce5198b1abff94cae758) C:\WINDOWS\system32\drivers\Pcmcia.sys
17:18:02.0234 2120 Pcmcia - ok
17:18:02.0234 2120 PDCOMP - ok
17:18:02.0250 2120 PDFRAME - ok
17:18:02.0250 2120 PDRELI - ok
17:18:02.0250 2120 PDRFRAME - ok
17:18:02.0250 2120 perc2 - ok
17:18:02.0265 2120 perc2hib - ok
17:18:02.0281 2120 PlugPlay (9ef697af07bb8dd82c3b02ca953a95b7) C:\WINDOWS\system32\services.exe
17:18:02.0296 2120 PlugPlay - ok
17:18:02.0328 2120 PolicyAgent (ed0a176354487ceed65b80a7148ab739) C:\WINDOWS\system32\lsass.exe
17:18:02.0406 2120 PolicyAgent - ok
17:18:02.0421 2120 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
17:18:02.0484 2120 PptpMiniport - ok
17:18:02.0484 2120 ProtectedStorage (ed0a176354487ceed65b80a7148ab739) C:\WINDOWS\system32\lsass.exe
17:18:02.0546 2120 ProtectedStorage - ok
17:18:02.0562 2120 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
17:18:02.0796 2120 PSched - ok
17:18:02.0812 2120 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
17:18:02.0875 2120 Ptilink - ok
17:18:02.0875 2120 ql1080 - ok
17:18:02.0875 2120 Ql10wnt - ok
17:18:02.0890 2120 ql12160 - ok
17:18:02.0890 2120 ql1240 - ok
17:18:02.0890 2120 ql1280 - ok
17:18:02.0890 2120 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
17:18:02.0968 2120 RasAcd - ok
17:18:02.0984 2120 RasAuto (2b5e44ea009f2f374b980e1e9a70635d) C:\WINDOWS\System32\rasauto.dll
17:18:03.0062 2120 RasAuto - ok
17:18:03.0093 2120 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
17:18:03.0156 2120 Rasl2tp - ok
17:18:03.0171 2120 RasMan (d57554c664b64604bd1ee13ea2c07e77) C:\WINDOWS\System32\rasmans.dll
17:18:03.0250 2120 RasMan - ok
17:18:03.0265 2120 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
17:18:03.0328 2120 RasPppoe - ok
17:18:03.0328 2120 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
17:18:03.0406 2120 Raspti - ok
17:18:03.0437 2120 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
17:18:03.0515 2120 Rdbss - ok
17:18:03.0515 2120 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
17:18:03.0578 2120 RDPCDD - ok
17:18:03.0625 2120 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
17:18:03.0703 2120 RDPWD - ok
17:18:03.0750 2120 RDSessMgr (c0d9d9711cb74ee9bc66353d8cbdab0e) C:\WINDOWS\system32\sessmgr.exe
17:18:03.0812 2120 RDSessMgr - ok
17:18:03.0828 2120 redbook (611bfd220305be3a85ae876ea47d4aa5) C:\WINDOWS\system32\DRIVERS\redbook.sys
17:18:03.0890 2120 redbook - ok
17:18:03.0921 2120 RemoteAccess (127c26b5371651043450e52542099aba) C:\WINDOWS\System32\mprdim.dll
17:18:03.0984 2120 RemoteAccess - ok
17:18:04.0000 2120 RpcLocator (718b3bdc0bc3c2f7d065a53d26202af9) C:\WINDOWS\system32\locator.exe
17:18:04.0078 2120 RpcLocator - ok
17:18:04.0125 2120 RpcSs (be27674d1cbc3214aec84b4336a38bbf) C:\WINDOWS\System32\rpcss.dll
17:18:04.0140 2120 RpcSs - ok
17:18:04.0156 2120 RSVP (09ab2e71e58b078038e3bfdba7ffc984) C:\WINDOWS\system32\rsvp.exe
17:18:04.0234 2120 RSVP - ok
17:18:04.0265 2120 RTLE8023xp (b52b25f41bf3511071a0e7d10d659c56) C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys
17:18:04.0281 2120 RTLE8023xp - ok
17:18:04.0343 2120 s0016bus (59509ad6cbc28f2c73056268985b3e48) C:\WINDOWS\system32\DRIVERS\s0016bus.sys
17:18:04.0343 2120 s0016bus - ok
17:18:04.0375 2120 s0016mdfl (b98c3a6f91f4fba285af9606a240c6b4) C:\WINDOWS\system32\DRIVERS\s0016mdfl.sys
17:18:04.0390 2120 s0016mdfl - ok
17:18:04.0390 2120 s0016mdm (8a83426f4fb7b5212825d9de76368b1a) C:\WINDOWS\system32\DRIVERS\s0016mdm.sys
17:18:04.0406 2120 s0016mdm - ok
17:18:04.0421 2120 s0016mgmt (7a78bba97feb5e6d24c49e93a3bf7287) C:\WINDOWS\system32\DRIVERS\s0016mgmt.sys
17:18:04.0421 2120 s0016mgmt - ok
17:18:04.0437 2120 s0016nd5 (34ef7b5f611957b73e7219dd5a222ad1) C:\WINDOWS\system32\DRIVERS\s0016nd5.sys
17:18:04.0437 2120 s0016nd5 - ok
17:18:04.0468 2120 s0016obex (36792935847143e4a3cda0dc87248487) C:\WINDOWS\system32\DRIVERS\s0016obex.sys
17:18:04.0484 2120 s0016obex - ok
17:18:04.0500 2120 s0016unic (927208754fb27fc3e7a659e77500c5d1) C:\WINDOWS\system32\DRIVERS\s0016unic.sys
17:18:04.0500 2120 s0016unic - ok
17:18:04.0546 2120 SamSs (ed0a176354487ceed65b80a7148ab739) C:\WINDOWS\system32\lsass.exe
17:18:04.0609 2120 SamSs - ok
17:18:04.0640 2120 SCardSvr (410046e401eb11e1e6749e9deea41d4a) C:\WINDOWS\System32\SCardSvr.exe
17:18:04.0718 2120 SCardSvr - ok
17:18:04.0750 2120 Schedule (3ff232a7731621b8902d81d42418c93c) C:\WINDOWS\system32\schedsvc.dll
17:18:04.0843 2120 Schedule - ok
17:18:04.0843 2120 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
17:18:04.0875 2120 Secdrv - ok
17:18:04.0921 2120 seclogon (477e2c3cc5e4a0d635bcb0ea8dcac3c6) C:\WINDOWS\System32\seclogon.dll
17:18:05.0000 2120 seclogon - ok
17:18:05.0046 2120 seehcri (e5b56569a9f79b70314fede6c953641e) C:\WINDOWS\system32\DRIVERS\seehcri.sys
17:18:05.0062 2120 seehcri - ok
17:18:05.0093 2120 SENS (a530b75c10c23c9ab28fdb6ce719e21f) C:\WINDOWS\system32\sens.dll
17:18:05.0171 2120 SENS - ok
17:18:05.0187 2120 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
17:18:05.0265 2120 serenum - ok
17:18:05.0265 2120 Serial (b842729337c9b921615c40d3c1a1af96) C:\WINDOWS\system32\DRIVERS\serial.sys
17:18:05.0343 2120 Serial - ok
17:18:05.0343 2120 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
17:18:05.0421 2120 Sfloppy - ok
17:18:05.0468 2120 SharedAccess (f58faca9621d2db01bd0927d9a0a208e) C:\WINDOWS\System32\ipnathlp.dll
17:18:05.0546 2120 SharedAccess - ok
17:18:05.0578 2120 ShellHWDetection (b927443008910b412bec72fc41c1bad0) C:\WINDOWS\System32\shsvcs.dll
17:18:05.0640 2120 ShellHWDetection - ok
17:18:05.0640 2120 Simbad - ok
17:18:05.0687 2120 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
17:18:05.0750 2120 SLIP - ok
17:18:05.0750 2120 Sparrow - ok
17:18:05.0796 2120 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
17:18:05.0859 2120 splitter - ok
17:18:05.0875 2120 Spooler (cb1090bca0e7b40d0b5b4e4d66531809) C:\WINDOWS\system32\spoolsv.exe
17:18:05.0937 2120 Spooler - ok
17:18:06.0015 2120 sptd (d15da1ba189770d93eea2d7e18f95af9) C:\WINDOWS\system32\Drivers\sptd.sys
17:18:06.0015 2120 Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: d15da1ba189770d93eea2d7e18f95af9
17:18:06.0015 2120 sptd ( LockedFile.Multi.Generic ) - warning
17:18:06.0015 2120 sptd - detected LockedFile.Multi.Generic (1)
17:18:06.0078 2120 SQLBrowser (b2ec3e1deac5f0a764bd3486d213a0af) c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
17:18:06.0093 2120 SQLBrowser - ok
17:18:06.0125 2120 SQLWriter (d2f4f32b59440011174b4f8137af4e0c) c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
17:18:06.0140 2120 SQLWriter - ok
17:18:06.0171 2120 sr (94610c8653635e4459316a0050d55ce7) C:\WINDOWS\system32\DRIVERS\sr.sys
17:18:06.0203 2120 sr - ok
17:18:06.0234 2120 srservice (35b91147124f64ac8081a2edb9ea4dee) C:\WINDOWS\system32\srsvc.dll
17:18:06.0281 2120 srservice - ok
17:18:06.0312 2120 Srv (3bb03f2ba89d2be417206c373d2af17c) C:\WINDOWS\system32\DRIVERS\srv.sys
17:18:06.0359 2120 Srv - ok
17:18:06.0406 2120 SSDPSRV (becd5271dc4e3b7c3d035f790fcbc1e5) C:\WINDOWS\System32\ssdpsrv.dll
17:18:06.0453 2120 SSDPSRV - ok
17:18:06.0500 2120 stisvc (c1cdd9275f6a115bb0ae1d55d8d27ba6) C:\WINDOWS\system32\wiaservc.dll
17:18:06.0578 2120 stisvc - ok
17:18:06.0609 2120 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
17:18:06.0671 2120 streamip - ok
17:18:06.0718 2120 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
17:18:06.0781 2120 swenum - ok
17:18:06.0828 2120 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
17:18:06.0906 2120 swmidi - ok
17:18:06.0906 2120 SwPrv - ok
17:18:06.0906 2120 symc810 - ok
17:18:06.0906 2120 symc8xx - ok
17:18:06.0906 2120 SymIM - ok
17:18:06.0921 2120 SymIMMP - ok
17:18:06.0921 2120 sym_hi - ok
17:18:06.0921 2120 sym_u3 - ok
17:18:06.0937 2120 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
17:18:07.0000 2120 sysaudio - ok
17:18:07.0015 2120 SysmonLog (ce06f01b88ace199a1bf460cac29c110) C:\WINDOWS\system32\smlogsvc.exe
17:18:07.0093 2120 SysmonLog - ok
17:18:07.0125 2120 TapiSrv (c2546cd7a398476f9df5614b2ae160e8) C:\WINDOWS\System32\tapisrv.dll
17:18:07.0187 2120 TapiSrv - ok
17:18:07.0203 2120 TBPanel (04e1c782cf14b7282ebc633b0fd3ed16) C:\WINDOWS\system32\drivers\TBPanel.sys
17:18:07.0203 2120 TBPanel - ok
17:18:07.0265 2120 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
17:18:07.0281 2120 Tcpip - ok
17:18:07.0312 2120 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
17:18:07.0390 2120 TDPIPE - ok
17:18:07.0421 2120 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
17:18:07.0484 2120 TDTCP - ok
17:18:07.0500 2120 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
17:18:07.0562 2120 TermDD - ok
17:18:07.0593 2120 TermService (a75dd6fc3dbee4fff5ebc9f2c28bb66e) C:\WINDOWS\System32\termsrv.dll
17:18:07.0656 2120 TermService - ok
17:18:07.0703 2120 Themes (b927443008910b412bec72fc41c1bad0) C:\WINDOWS\System32\shsvcs.dll
17:18:07.0765 2120 Themes - ok
17:18:07.0765 2120 TosIde - ok
17:18:07.0812 2120 TrkWks (38853304ccb938d30e0c4cde8d2c2a8a) C:\WINDOWS\system32\trkwks.dll
17:18:07.0875 2120 TrkWks - ok
17:18:07.0921 2120 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
17:18:08.0000 2120 Udfs - ok
17:18:08.0078 2120 UleadBurningHelper (332d341d92b933600d41953b08360dfb) C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
17:18:08.0078 2120 UleadBurningHelper ( UnsignedFile.Multi.Generic ) - warning
17:18:08.0078 2120 UleadBurningHelper - detected UnsignedFile.Multi.Generic (1)
17:18:08.0078 2120 ultra - ok
17:18:08.0109 2120 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
17:18:08.0203 2120 Update - ok
17:18:08.0218 2120 upnphost (651bd90dcee5b7bdc74a2eb7c9266f9e) C:\WINDOWS\System32\upnphost.dll
17:18:08.0265 2120 upnphost - ok
17:18:08.0281 2120 UPS (20a0f6a11959e92908717d09e87d670d) C:\WINDOWS\System32\ups.exe
17:18:08.0343 2120 UPS - ok
17:18:08.0375 2120 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
17:18:08.0453 2120 usbccgp - ok
17:18:08.0500 2120 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
17:18:08.0562 2120 usbehci - ok
17:18:08.0609 2120 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
17:18:08.0671 2120 usbhub - ok
17:18:08.0703 2120 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
17:18:08.0781 2120 usbprint - ok
17:18:08.0812 2120 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
17:18:08.0875 2120 usbscan - ok
17:18:08.0890 2120 usbstor (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
17:18:08.0953 2120 usbstor - ok
17:18:08.0968 2120 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
17:18:09.0031 2120 usbuhci - ok
17:18:09.0078 2120 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
17:18:09.0156 2120 VgaSave - ok
17:18:09.0234 2120 VIAHdAudAddService (a4c6422857e12a1b5a70cd96305860d5) C:\WINDOWS\system32\drivers\viahduaa.sys
17:18:09.0265 2120 VIAHdAudAddService - ok
17:18:09.0265 2120 ViaIde - ok
17:18:09.0296 2120 VolSnap (28a4b296b47782173c346e376cb374d1) C:\WINDOWS\system32\drivers\VolSnap.sys
17:18:09.0375 2120 VolSnap - ok
17:18:09.0421 2120 VSS (d6ba1a63d9e00933f1cd2a885573afb2) C:\WINDOWS\System32\vssvc.exe
17:18:09.0453 2120 VSS - ok
17:18:09.0500 2120 W32Time (fa4e1cdba256787f2149f4aad07bc91f) C:\WINDOWS\system32\w32time.dll
17:18:09.0562 2120 W32Time - ok
17:18:09.0578 2120 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
17:18:09.0640 2120 Wanarp - ok
17:18:09.0703 2120 Wdf01000 (fd47474bd21794508af449d9d91af6e6) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
17:18:09.0718 2120 Wdf01000 - ok
17:18:09.0718 2120 WDICA - ok
17:18:09.0765 2120 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
17:18:09.0843 2120 wdmaud - ok
17:18:09.0859 2120 WebClient (47ae51048a82dfa1cd6b51d369f7e169) C:\WINDOWS\System32\webclnt.dll
17:18:09.0921 2120 WebClient - ok
17:18:10.0000 2120 WFIOCTL - ok
17:18:10.0078 2120 winmgmt (e488332126e3b1182d2b8a0c35408ec6) C:\WINDOWS\system32\wbem\WMIsvc.dll
17:18:10.0140 2120 winmgmt - ok
17:18:10.0171 2120 WmdmPmSN (c51b4a5c05a5475708e3c81c7765b71d) C:\WINDOWS\system32\MsPMSNSv.dll
17:18:10.0203 2120 WmdmPmSN - ok
17:18:10.0218 2120 WmiApSrv (23f6f03272f7e5679f1f050aed5acee6) C:\WINDOWS\system32\wbem\wmiapsrv.exe
17:18:10.0296 2120 WmiApSrv - ok
17:18:10.0328 2120 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
17:18:10.0406 2120 WS2IFSL - ok
17:18:10.0437 2120 wscsvc (4c86d5faf78194995af9cc1075f65dd3) C:\WINDOWS\system32\wscsvc.dll
17:18:10.0515 2120 wscsvc - ok
17:18:10.0531 2120 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
17:18:10.0593 2120 WSTCODEC - ok
17:18:10.0625 2120 wuauserv (c1364564800ee9784192145324a23308) C:\WINDOWS\system32\wuauserv.dll
17:18:10.0750 2120 wuauserv - ok
17:18:10.0781 2120 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
17:18:10.0796 2120 WudfPf - ok
17:18:10.0812 2120 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
17:18:10.0843 2120 WudfRd - ok
17:18:10.0875 2120 WudfSvc (05231c04253c5bc30b26cbaae680ed89) C:\WINDOWS\System32\WUDFSvc.dll
17:18:10.0906 2120 WudfSvc - ok
17:18:10.0937 2120 WZCSVC (a27d4ba7264c0bf52f32d10405bea1d4) C:\WINDOWS\System32\wzcsvc.dll
17:18:11.0031 2120 WZCSVC - ok
17:18:11.0078 2120 xmlprov (eaa4bb9edb3fb10cf8979fe65e63658f) C:\WINDOWS\System32\xmlprov.dll
17:18:11.0171 2120 xmlprov - ok
17:18:11.0203 2120 MBR (0x1B8) (413fc2a0c716421b3158746d63736515) \Device\Harddisk0\DR0
17:18:11.0406 2120 \Device\Harddisk0\DR0 ( TDSS File System ) - warning
17:18:11.0406 2120 \Device\Harddisk0\DR0 - detected TDSS File System (1)
17:18:11.0406 2120 Boot (0x1200) (2f4d77c3c84359e51cdc5160a07bcc0a) \Device\Harddisk0\DR0\Partition0
17:18:11.0406 2120 \Device\Harddisk0\DR0\Partition0 - ok
17:18:11.0406 2120 ============================================================
17:18:11.0406 2120 Scan finished
17:18:11.0406 2120 ============================================================
17:18:11.0515 2160 Detected object count: 11
17:18:11.0515 2160 Actual detected object count: 11
17:18:22.0812 2160 LightScribeService ( UnsignedFile.Multi.Generic ) - skipped by user
17:18:22.0812 2160 LightScribeService ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:18:22.0812 2160 mak810c ( UnsignedFile.Multi.Generic ) - skipped by user
17:18:22.0812 2160 mak810c ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:18:22.0812 2160 mak810m ( UnsignedFile.Multi.Generic ) - skipped by user
17:18:22.0812 2160 mak810m ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:18:22.0812 2160 mak810u ( UnsignedFile.Multi.Generic ) - skipped by user
17:18:22.0812 2160 mak810u ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:18:22.0812 2160 MaVctrl ( UnsignedFile.Multi.Generic ) - skipped by user
17:18:22.0812 2160 MaVctrl ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:18:22.0812 2160 MREMP50 ( UnsignedFile.Multi.Generic ) - skipped by user
17:18:22.0812 2160 MREMP50 ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:18:22.0828 2160 MRESP50 ( UnsignedFile.Multi.Generic ) - skipped by user
17:18:22.0828 2160 MRESP50 ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:18:22.0828 2160 NVSvc ( UnsignedFile.Multi.Generic ) - skipped by user
17:18:22.0828 2160 NVSvc ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:18:22.0828 2160 sptd ( LockedFile.Multi.Generic ) - skipped by user
17:18:22.0828 2160 sptd ( LockedFile.Multi.Generic ) - User select action: Skip
17:18:22.0828 2160 UleadBurningHelper ( UnsignedFile.Multi.Generic ) - skipped by user
17:18:22.0828 2160 UleadBurningHelper ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:18:22.0828 2160 \Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user
17:18:22.0828 2160 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip

Stáhnula se mi přes combofix ještě konzole pro zotavení...



ComboFix 12-05-09.01 - M3th0dman 10.05.2012 7:18.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.2047.1305 [GMT 2:00]
Spuštěný z: c:\documents and settings\M3th0dman\Plocha\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-04-10 do 2012-05-10 )))))))))))))))))))))))))))))))
.
.
2012-05-09 15:10 . 2012-05-09 15:10 -------- d-----w- C:\TDSSKiller_Quarantine
2012-05-02 16:04 . 2012-05-02 16:04 512 ----a-w- C:\PhysicalMBR.bin
2012-05-02 15:59 . 2012-05-02 15:59 -------- d-----w- c:\documents and settings\Administrator
2012-05-01 13:22 . 2012-05-09 15:27 -------- d-----w- c:\documents and settings\All Users\Data aplikací\GarenaMessenger
2012-05-01 13:02 . 2012-05-01 13:02 -------- d-----w- c:\documents and settings\M3th0dman\Data aplikací\Garena
2012-05-01 11:57 . 2012-05-03 16:51 -------- d-----w- c:\program files\trend micro
2012-05-01 11:57 . 2012-05-01 11:57 -------- d-----w- C:\rsit
2012-05-01 07:30 . 2012-05-09 16:17 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-05-01 07:30 . 2012-05-09 16:17 419488 ----a-w- c:\windows\system32\FlashPlayerApp.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-09 15:14 . 2006-03-02 13:00 3328 ----a-w- c:\windows\system32\drivers\pciide.sys
2012-05-02 17:19 . 2011-10-03 15:31 106500 ------w- c:\documents and settings\M3th0dman\Data aplikací\winlogon.exe
2012-03-06 23:15 . 2011-06-28 17:00 41184 ----a-w- c:\windows\avastSS.scr
2012-03-06 23:15 . 2011-06-28 17:00 201352 ----a-w- c:\windows\system32\aswBoot.exe
2012-03-06 23:03 . 2011-06-28 17:00 612184 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-03-06 23:03 . 2011-06-28 17:00 337880 ----a-w- c:\windows\system32\drivers\aswSP.sys
2012-03-06 23:02 . 2011-06-28 17:00 35672 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2012-03-06 23:01 . 2011-06-28 17:00 53848 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2012-03-06 23:01 . 2011-06-28 17:00 95704 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2012-03-06 23:01 . 2011-06-28 17:00 89048 ----a-w- c:\windows\system32\drivers\aswmon.sys
2012-03-06 23:01 . 2011-06-28 17:00 20696 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-03-06 22:58 . 2011-06-28 17:00 24920 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2012-02-18 18:40 . 2010-04-19 08:37 472808 ----a-w- c:\windows\system32\deployJava1.dll
2012-02-18 18:40 . 2009-10-13 15:02 73728 ----a-w- c:\windows\system32\javacpl.cpl
2012-02-15 18:00 . 2012-02-28 23:58 79360 ----a-w- c:\windows\system32\ff_vfw.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2012-05-02_18.56.05 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-05-09 15:14 . 2012-05-09 15:14 16384 c:\windows\Temp\Perflib_Perfdata_404.dat
- 2006-03-02 13:00 . 2012-05-02 16:26 85814 c:\windows\system32\perfc009.dat
+ 2006-03-02 13:00 . 2012-05-03 16:27 85814 c:\windows\system32\perfc009.dat
- 2006-03-02 13:00 . 2012-05-02 16:26 96764 c:\windows\system32\perfc005.dat
+ 2006-03-02 13:00 . 2012-05-03 16:27 96764 c:\windows\system32\perfc005.dat
- 2006-03-02 13:00 . 2012-05-02 16:26 482104 c:\windows\system32\perfh009.dat
+ 2006-03-02 13:00 . 2012-05-03 16:27 482104 c:\windows\system32\perfh009.dat
- 2006-03-02 13:00 . 2012-05-02 16:26 478986 c:\windows\system32\perfh005.dat
+ 2006-03-02 13:00 . 2012-05-03 16:27 478986 c:\windows\system32\perfh005.dat
+ 2012-05-09 16:17 . 2012-05-09 16:17 351904 c:\windows\system32\Macromed\Flash\FlashUtil32_11_2_202_235_Plugin.exe
+ 2012-05-09 15:17 . 2012-05-09 15:17 351904 c:\windows\system32\Macromed\Flash\FlashUtil32_11_2_202_235_ActiveX.exe
+ 2012-05-09 15:17 . 2012-05-09 15:17 424096 c:\windows\system32\Macromed\Flash\FlashUtil32_11_2_202_235_ActiveX.dll
+ 2012-05-01 07:30 . 2012-05-09 16:17 257696 c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
+ 2012-05-09 16:17 . 2012-05-09 16:17 8797856 c:\windows\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-03-06 23:15 123536 ----a-w- c:\program files\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-01-24 2289664]
"GAINWARD"="c:\program files\EXPERTool\TBPanel.exe" [2009-05-12 2181672]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 152872]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"HDAudDeck"="c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe" [2008-10-07 33538048]
"nwiz"="nwiz.exe" [2009-06-10 1657376]
"RTHDCPL"="RTHDCPL.EXE" [2008-11-17 17676288]
"Six Engine"="c:\program files\ASUS\EPU-4 Engine\FourEngine.exe" [2008-07-23 5625344]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-06-10 13758464]
"avast"="c:\program files\Avast\avastUI.exe" [2012-03-06 4241512]
"HPUsageTracking"="c:\program files\HP\HP UT\bin\hppusg.exe" [2007-11-02 36864]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\ME\\programz\\totalcmd\\TOTALCMD.EXE"=
"c:\\ME\\games\\CS\\cstrike.exe"=
"c:\\ME\\programz\\CZDC\\CZDCKN.exe"=
"c:\\Program Files\\Miranda IM\\miranda32.exe"=
"c:\\ME\\games\\dota\\garena\\Garena.exe"=
"c:\\Program Files\\XTB-Trader\\terminal.exe"=
"c:\\ME\\games\\dota\\War 3 (Hamis)\\Warcraft III\\Warcraft III.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\ME\\programz\\GuildFTP\\GuildFTPd.exe"=
"c:\\ME\\games\\Assasins Creed\\DRM\\server.exe"=
"c:\\ME\\games\\dota\\war3.exe"=
"c:\\ME\\games\\CS\\hl.exe"=
"c:\\Documents and Settings\\M3th0dman\\Data aplikací\\csrss.exe"=
"c:\\Documents and Settings\\M3th0dman\\Data aplikací\\explorer.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\PokerStars\\PokerStarsUpdate.exe"=
"c:\\WINDOWS\\system32\\csrss.exe"=
"c:\\Documents and Settings\\M3th0dman\\Dokumenty\\Downloads\\Blackshot_GarenaPlus_Installer.exe"=
"c:\\ME\\games\\dota\\garena plus\\Room\\garena_room.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [22.9.2009 12:29 721904]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [28.6.2011 19:00 612184]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [28.6.2011 19:00 337880]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [28.6.2011 19:00 20696]
R3 GGSAFERDriver;GGSAFER Driver;\??\c:\me\games\dota\garena plus\Room\safedrv.sys --> c:\me\games\dota\garena plus\Room\safedrv.sys [?]
R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\drivers\seehcri.sys [2.5.2010 19:34 27632]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [1.5.2012 9:30 257696]
S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\M3TH0D~1\LOCALS~1\Temp\JBI29.tmp --> c:\docume~1\M3TH0D~1\LOCALS~1\Temp\JBI29.tmp [?]
S3 Huawei;HUAWEI Mobile Connect - USB Smart Card Reader;c:\windows\system32\DRIVERS\ewdcsc.sys --> c:\windows\system32\DRIVERS\ewdcsc.sys [?]
S3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys --> c:\windows\system32\DRIVERS\ewusbdev.sys [?]
S3 mak810c;mak810c;c:\windows\system32\drivers\mak810c.sys [2.5.2010 15:59 24784]
S3 mak810m;mak810m;c:\windows\system32\drivers\mak810m.sys [2.5.2010 15:59 25044]
S3 mak810u;mak810u;c:\windows\system32\drivers\mak810u.sys [2.5.2010 15:59 52693]
S3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\drivers\s0016bus.sys [2.5.2010 19:34 89256]
S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\system32\drivers\s0016mdfl.sys [2.5.2010 19:34 15016]
S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\system32\drivers\s0016mdm.sys [2.5.2010 19:34 120744]
S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s0016mgmt.sys [2.5.2010 19:34 114216]
S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\system32\drivers\s0016nd5.sys [2.5.2010 19:34 25512]
S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\system32\drivers\s0016obex.sys [2.5.2010 19:34 110632]
S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\system32\drivers\s0016unic.sys [2.5.2010 19:34 115752]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [1.7.2009 11:17 876288]
S3 WFIOCTL;WFIOCTL;\??\c:\program files\WinFast\WFDTV\WFIOCTL.SYS --> c:\program files\WinFast\WFDTV\WFIOCTL.SYS [?]
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - 45036346
*NewlyCreated* - 67301781
*Deregistered* - 45036346
*Deregistered* - 67301781
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-01-24 11:30 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2012-05-10 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-01 16:17]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://startsear.ch/?aff=1
mStart Page = hxxp://startsear.ch/?aff=1
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 213.46.172.36 213.46.172.37
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
SafeBoot-45036346.sys
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-05-10 07:21
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HDAudDeck = c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe 1????????????????????????????????????????????????
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]
"ImagePath"="\??\c:\docume~1\M3TH0D~1\LOCALS~1\Temp\JBI29.tmp"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'explorer.exe'(3560)
c:\program files\Common Files\Ahead\Lib\NeroDigitalExt.dll
c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
c:\program files\Adobe\Reader 9.0\Reader\viewerps.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Celkový čas: 2012-05-10 07:22:15
ComboFix-quarantined-files.txt 2012-05-10 05:22
ComboFix2.txt 2012-05-02 18:57
.
Před spuštěním: Volných bajtů: 14 088 912 896
Po spuštění: Volných bajtů: 14 079 897 600
.
WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
.
- - End Of File - - 4D713D544A713B02F6572D3FCC8CC4A9

jinak dik moc vypada ze pc vylecen predtim jeste mi porad padal chrome i firefox kdyz sem si poustel ČTcko bo streamy nevis cim to muze byt??