VIRY.CZ

Logfile of random's system information tool 1.09 (written by random/random)
Run by Martin at 2012-08-12 02:53:14
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 5 GB (18%) free of 25 GB
Total RAM: 2047 MB (76% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 2:53:19, on 12.8.2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\PROGRA~1\AVG\AVG2012\avgrsx.exe
C:\Program Files\AVG\AVG2012\avgcsrvx.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\soft602\602updsvc\602updsvc.exe
C:\Program Files\AVG\AVG2012\avgfws.exe
C:\Program Files\AVG\AVG2012\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AVG\AVG2012\avgnsx.exe
C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe
C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe
C:\Program Files\AVG\AVG2012\avgcsrvx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\AVG\AVG2012\avgtray.exe
C:\Program Files\AVG Secure Search\vprot.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Martin\Dokumenty\Downloads\RSIT.exe
C:\Program Files\trend micro\Martin.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [AVG_TRAY] "C:\Program Files\AVG\AVG2012\avgtray.exe"
O4 - HKLM\..\Run: [vProt] "C:\Program Files\AVG Secure Search\vprot.exe"
O4 - HKLM\..\Run: [ROC_roc_dec12] "C:\Program Files\AVG Secure Search\ROC_roc_dec12.exe" /PROMPT /CMPID=roc_dec12
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HF_G_Jul] "C:\Program Files\AVG Secure Search\HF_G_Jul.exe" /DoAction
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files\ICQ7.4\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files\ICQ7.4\ICQ.exe
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 2165289718
O16 - DPF: {672EE252-D813-4F5E-81BB-5DD163DD4FA5} (Active602XMLFiller Control) - https://www.mojedatovaschranka.cz/stati ... ctivex.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 9909101375
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll
O18 - Protocol: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\11.2.0\ViProtocol.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: 602Updater (602XML Updater) - Software602 a.s. - C:\Program Files\Common Files\soft602\602updsvc\602updsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: AVG Security Toolbar Service - Unknown owner - C:\Program Files\AVG\AVG10\Toolbar\ToolbarBroker.exe
O23 - Service: AVG Firewall (avgfws) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2012\avgfws.exe
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2012\avgwdsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: vToolbarUpdater11.2.0 - Unknown owner - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe

--
End of file - 7935 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Adobe Flash Player Updater.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{42653625-03EE-47DF-B0C1-D1BF228DB4DC}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Podpora odkazu pro Adobe PDF Reader - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files\AVG\AVG2012\avgssie.dll [2011-11-11 1378144]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2012-02-18 325408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
AVG Security Toolbar - C:\Program Files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll [2012-07-12 2074208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2012-02-18 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2012-02-18 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{95B7759C-8C7F-4BF1-B163-73684A933233} - AVG Security Toolbar - C:\Program Files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll [2012-07-12 2074208]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2005-09-22 90112]
"HPDJ Taskbar Utility"=C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe [2004-03-04 172032]
""= []
"AVG_TRAY"=C:\Program Files\AVG\AVG2012\avgtray.exe [2012-01-24 2416480]
"vProt"=C:\Program Files\AVG Secure Search\vprot.exe [2012-07-12 1107552]
"ROC_roc_dec12"=C:\Program Files\AVG Secure Search\ROC_roc_dec12.exe [2012-01-15 928096]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2012-01-18 254696]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2007-12-05 8523776]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2007-12-05 81920]
"HF_G_Jul"=C:\Program Files\AVG Secure Search\HF_G_Jul.exe [2012-07-18 36960]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ActivControl]
C:\Program Files\Activ Software\ActivDriver\ActivControl2.exe [2010-12-17 1094000]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe [2003-12-22 241664]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe [2010-06-09 49208]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Philips Device Listener]
C:\Program Files\Philips\Philips Songbird Resources\Autolauncher\PhilipsDeviceListener.exe [2010-05-27 375296]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PinnacleDriverCheck]
C:\WINDOWS\system32\PSDrvCheck.exe [2004-03-10 406016]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Shockwave Updater]
C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~1.EXE [2008-08-06 447928]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe [2007-06-13 528384]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
C:\Program Files\Windows Defender\MSASCui.exe [2006-11-03 866584]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2007-02-15 236928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"=C:\PROGRA~1\WIFD1F~1\MpShHook.dll [2006-11-03 83224]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WinDefend]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=0x91000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"D:\Záloha - programy\utorrent-portable\utorrent.exe"="D:\Záloha - programy\utorrent-portable\utorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\ICQ7.4\ICQ.exe"="C:\Program Files\ICQ7.4\ICQ.exe:*:Enabled:ICQ7.4"
"C:\Program Files\AVG\AVG2012\avgmfapx.exe"="C:\Program Files\AVG\AVG2012\avgmfapx.exe:*:Enabled:Instalátor AVG"
"C:\Program Files\AVG\AVG2012\avgnsx.exe"="C:\Program Files\AVG\AVG2012\avgnsx.exe:*:Enabled:Webový štít"
"C:\Program Files\AVG\AVG2012\avgdiagex.exe"="C:\Program Files\AVG\AVG2012\avgdiagex.exe:*:Enabled:AVG Diagnostika 2012"
"C:\Program Files\AVG\AVG2012\avgemcx.exe"="C:\Program Files\AVG\AVG2012\avgemcx.exe:*:Enabled:Obecná kontrola pošty"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\ICQ7.4\ICQ.exe"="C:\Program Files\ICQ7.4\ICQ.exe:*:Enabled:ICQ7.4"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"VIDC.IYUV"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVU9"=tsbyuv.dll
"VIDC.YVYU"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"VIDC.MJPG"=Pvmjpg21.dll
"VIDC.PIM1"=pclepim1.dll
"VIDC.I420"=vdrcodec.dll
"VIDC.FFDS"=ff_vfw.dll
"vidc.XVID"=xvidvfw.dll
"vidc.tscc"=tsccvid.dll

======List of files/folders created in the last 1 month======

2012-08-12 02:53:14 ----DC---- C:\rsit
2012-08-12 02:53:14 ----DC---- C:\Program Files\trend micro
2012-07-26 22:12:16 ----AC---- C:\WINDOWS\system32\FlashPlayerInstaller.exe
2012-07-24 22:05:08 ----DC---- C:\Program Files\Common Files\soft602
2012-07-24 22:05:06 ----DC---- C:\Documents and Settings\Martin\Data aplikací\602XML
2012-07-24 22:04:58 ----DC---- C:\Documents and Settings\Martin\Data aplikací\602Installer
2012-07-24 22:04:29 ----DC---- C:\Program Files\Software602
2012-07-13 09:24:23 ----HDC---- C:\WINDOWS\$NtUninstallKB2691442$
2012-07-13 09:24:13 ----HDC---- C:\WINDOWS\$NtUninstallKB2718523$
2012-07-13 09:24:05 ----HDC---- C:\WINDOWS\$NtUninstallKB2655992$
2012-07-13 09:23:58 ----HDC---- C:\WINDOWS\$NtUninstallKB2719985$
2012-07-13 09:21:50 ----HDC---- C:\WINDOWS\$NtUninstallKB2698365$

======List of files/folders modified in the last 1 month======

2012-08-12 02:53:14 ----RDC---- C:\Program Files
2012-08-12 02:49:55 ----DC---- C:\WINDOWS\Temp
2012-08-12 02:42:56 ----DC---- C:\WINDOWS\Prefetch
2012-08-12 02:14:40 ----DC---- C:\Documents and Settings\All Users\Data aplikací\MFAData
2012-08-12 02:11:32 ----DC---- C:\WINDOWS\system32\CatRoot2
2012-08-12 02:09:35 ----DC---- C:\WINDOWS\system32
2012-08-12 02:08:27 ----DC---- C:\WINDOWS\system32\drivers
2012-08-12 02:07:21 ----DC---- C:\WINDOWS\system32\config
2012-08-12 02:06:56 ----DC---- C:\WINDOWS\system32\wbem
2012-08-12 02:06:56 ----DC---- C:\WINDOWS\Registration
2012-08-12 02:06:35 ----DC---- C:\Documents and Settings\Martin\Data aplikací\U3
2012-08-12 02:06:18 ----A---- C:\WINDOWS\SchedLgU.Txt
2012-08-12 01:31:57 ----DC---- C:\WINDOWS
2012-08-11 23:40:29 ----DC---- C:\WINDOWS\system32\drivers\AVG
2012-08-07 13:26:09 ----AC---- C:\WINDOWS\wincmd.ini
2012-08-04 18:12:23 ----AC---- C:\WINDOWS\system32\FlashPlayerApp.exe
2012-07-26 16:59:25 ----SHDC---- C:\WINDOWS\Installer
2012-07-26 16:59:21 ----DC---- C:\WINDOWS\WinSxS
2012-07-26 16:59:20 ----D---- C:\Program Files\MSXML 4.0
2012-07-25 13:13:17 ----DC---- C:\WINDOWS\Debug
2012-07-24 22:05:12 ----SDC---- C:\WINDOWS\Downloaded Program Files
2012-07-24 22:05:08 ----DC---- C:\Program Files\Common Files
2012-07-24 22:04:45 ----HDC---- C:\WINDOWS\inf
2012-07-18 19:43:33 ----DC---- C:\Program Files\AVG Secure Search
2012-07-13 09:42:08 ----RSHDC---- C:\WINDOWS\system32\dllcache
2012-07-13 09:24:10 ----HDC---- C:\WINDOWS\$hf_mig$
2012-07-13 09:21:59 ----AC---- C:\WINDOWS\system32\MRT.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 AVGIDSEH;AVGIDSEH; C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys [2011-07-11 23120]
R0 Avgrkx86;AVG Anti-Rootkit Driver; C:\WINDOWS\system32\DRIVERS\avgrkx86.sys [2011-09-13 32592]
R0 gagp30kx;Filtr Microsoft Generic AGPv3.0 pro procesorovou platformu K8; C:\WINDOWS\system32\DRIVERS\gagp30kx.sys [2008-04-13 46464]
R0 ohci1394;Hostitelský řadič IEEE 1394 dle standardu OHCI VIA; C:\WINDOWS\system32\DRIVERS\ohci1394.sys [2008-04-13 61696]
R0 viamraid;viamraid; C:\WINDOWS\system32\DRIVERS\viamraid.sys [2006-03-31 100992]
R0 videX32;videX32; C:\WINDOWS\system32\DRIVERS\videX32.sys [2006-02-23 9728]
R0 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-15 76544]
R1 AmdK8;AMD Processor Driver; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2005-03-09 36352]
R1 Avgldx86;AVG AVI Loader Driver; C:\WINDOWS\system32\DRIVERS\avgldx86.sys [2011-10-07 230608]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield; C:\WINDOWS\system32\DRIVERS\avgmfx86.sys [2011-08-08 40016]
R1 Avgtdix;AVG TDI Driver; C:\WINDOWS\system32\DRIVERS\avgtdix.sys [2011-07-11 295248]
R1 PCLEPCI;PCLEPCI; \??\C:\WINDOWS\system32\drivers\pclepci.sys []
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2005-09-22 3727680]
R3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 ASAPIW2k;ASAPIW2K; C:\WINDOWS\system32\drivers\ASAPIW2k.sys [2004-03-10 11264]
R3 Avgfwdx;Avgfwdx; C:\WINDOWS\system32\DRIVERS\avgfwdx.sys [2011-05-23 30944]
R3 AVGIDSDriver;AVGIDSDriver; C:\WINDOWS\system32\DRIVERS\AVGIDSDriver.Sys [2011-07-11 134608]
R3 AVGIDSFilter;AVGIDSFilter; C:\WINDOWS\system32\DRIVERS\AVGIDSFilter.Sys [2011-07-11 24272]
R3 AVGIDSShim;AVGIDSShim; C:\WINDOWS\system32\DRIVERS\AVGIDSShim.Sys [2011-10-04 16720]
R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service; C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2008-09-22 43520]
R3 GEARAspiWDM;GEARAspiWDM; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2010-05-10 15664]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 MarvinBus;Pinnacle Marvin Bus; C:\WINDOWS\system32\DRIVERS\MarvinBus.sys [2004-06-21 78976]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2007-12-05 7435392]
R3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 xcpip;Ovladač protokolu TCP/IP; C:\WINDOWS\system32\drivers\xcpip.sys []
R3 xpsec;Ovladač IPSEC; C:\WINDOWS\system32\drivers\xpsec.sys []
S3 61883;61883 Unit Device; C:\WINDOWS\system32\DRIVERS\61883.sys [2008-04-13 48128]
S3 Avc;AVC Device; C:\WINDOWS\system32\DRIVERS\avc.sys [2008-04-13 38912]
S3 Avgfwfd;AVG network filter service; C:\WINDOWS\system32\DRIVERS\avgfwdx.sys [2011-05-23 30944]
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 CrystalSysInfo;CrystalSysInfo; \??\C:\Program Files\MediaCoder\SysInfo.sys []
S3 FETND5BV;VIA Rhine-Family Fast Ethernet Adapter Driver Service; C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2008-09-22 43520]
S3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\fetnd5.sys [2001-08-17 27165]
S3 MSDV;Microsoft DV Camera and VCR; C:\WINDOWS\system32\DRIVERS\msdv.sys [2008-04-13 51200]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 pcouffin;VSO Software pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [2009-10-04 47360]
S3 Point32;Microsoft IntelliPoint Filter Driver; C:\WINDOWS\system32\DRIVERS\point32.sys []
S3 s125bus;Sony Ericsson Device 125 driver (WDM); C:\WINDOWS\system32\DRIVERS\s125bus.sys [2007-04-24 83336]
S3 s125mdfl;Sony Ericsson Device 125 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\s125mdfl.sys [2007-04-24 15112]
S3 s125mdm;Sony Ericsson Device 125 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\s125mdm.sys [2007-04-24 108680]
S3 s125mgmt;Sony Ericsson Device 125 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\s125mgmt.sys [2007-04-24 100488]
S3 s125obex;Sony Ericsson Device 125 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\s125obex.sys [2007-04-24 98696]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 StMp3Rec;Player Recovery Device Control Driver; C:\WINDOWS\System32\Drivers\StMp3Rec.sys []
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 wceusbsh;Windows CE USB Serial Host Driver; C:\WINDOWS\system32\DRIVERS\wceusbsh.sys [2006-11-06 28672]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-15 82688]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 602XML Updater;602Updater; C:\Program Files\Common Files\soft602\602updsvc\602updsvc.exe [2011-10-10 85344]
R2 avgfws;AVG Firewall; C:\Program Files\AVG\AVG2012\avgfws.exe [2011-11-23 2391832]
R2 AVGIDSAgent;AVGIDSAgent; C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe [2011-10-12 4433248]
R2 avgwd;AVG WatchDog; C:\Program Files\AVG\AVG2012\avgwdsvc.exe [2011-08-02 192776]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2012-02-18 153376]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2007-12-05 155716]
R2 vToolbarUpdater11.2.0;vToolbarUpdater11.2.0; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe [2012-07-12 935008]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 WinDefend;Windows Defender; C:\Program Files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-04 250056]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2010-03-18 35160]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service; C:\Program Files\AVG\AVG10\Toolbar\ToolbarBroker.exe [2011-09-01 1025352]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [2005-11-14 69632]
S3 idsvc;Služba Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 WinRM;Windows Remote Management (WS-Management); C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S4 NetTcpPortSharing;Služba sdílení portů Net.Tcp; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Kód: Vybrat vše

MBRScan v1.1.1

OS             : Windows XP Home Service Pack 3 (32 bit)
PROCESSOR      : x86 Family 15 Model 44 Stepping 2, AuthenticAMD
BOOT           : Normal Boot
DATE           : 2012/08/12 (ISO 8601) at 10:11:38
________________________________________________________________________________

DISK           : Device\Harddisk0\DR0 __SAMSUNG SP1203N (TL100-30)
BUS_TYPE       : (0x03)  P-ATA
USE_PIO        : YES
MAX_TRANSFER   : 128 Kb
ALIGNMENT_MASK : word aligned
________________________________________________________________________________

Device\Harddisk0\DR0	111.8 Go  [Fixed] ==> Unknown MBR Code

MBR_MD5   : 06C4A6CF948DAD9339030D6E53BF4BCE
MBR_SHA1  : 18DB7B7B89915336C7DACCA373AAA21223B7520E

Device\Harddisk0\Partition1	24.41 Go  	0x07 NTFS / HPFS __ BOOTABLE __
Device\Harddisk0\Partition2	87.40 Go  	0x07 NTFS / HPFS
________________________________________________________________________________

############################### Additional scan ################################

DRIVER  : C:\WINDOWS\system32\drivers\xpsec.sys => Invisible on the disk
ADDRESS : 0xAFD3C000
SIZE    : 76.0 Ko

DRIVER  : C:\WINDOWS\system32\drivers\xcpip.sys => Invisible on the disk
ADDRESS : 0xAFCE3000
SIZE    : 356.0 Ko

SystemStartOptions : NOEXECUTE=OPTIN  FASTDETECT

________________________________________________________________________________

_____FAKED   \Device\Harddisk0\DR0  

0x00000000   33 C0 8E D8 8E C0 8E D0 BC 00 7C BE 1A 7C BF 00   3À.Ø.À.Ð¼.|¾.|¿.
0x00000010   06 B9 E6 01 50 57 FC F3 A4 CB BE A4 07 B1 04 90   .¹æ.PWüó¤Ë¾¤.±..
0x00000020   80 3C 80 74 0D 38 2C 0F 85 C0 00 83 C6 10 E2 F0   .<.t.8,..À..Æ.âð
0x00000030   CD 18 66 8B 44 08 8B 14 89 E3 B9 01 00 E8 64 00   Í.f.D....ã¹..èd.
0x00000040   73 0C 8B 4C 02 B8 01 02 CD 13 0F 82 B8 00 B9 55   s..L.¸..Í...¸.¹U
0x00000050   AA 2B 0E FE 7D 0F 85 CF 00 66 B8 00 00 00 00 66   ª+.þ}..Ï.f¸....f
0x00000060   39 44 08 72 08 66 8B 44 08 66 03 44 0C 83 C6 10   9D.r.f.D.f.D..Æ.
0x00000070   81 FE E4 07 72 E9 66 09 C0 74 1E B9 09 00 81 C3   .þä.réf.Àt.¹...Ã
0x00000080   00 02 E8 1F 00 72 12 89 DE 81 C6 0C 02 8D 54 F4   ..è..r..Þ.Æ...Tô
0x00000090   66 81 3C 75 2F F3 A4 74 05 EA 00 7C 00 00 89 DE   f.<u/ó¤t.ê.|...Þ
0x000000A0   FF D2 EB F5 66 60 B2 80 BB AA 55 B4 41 CD 13 73   .Òëõf`².»ªU´AÍ.s
0x000000B0   04 F9 66 61 C3 81 FB 55 AA 75 F6 F6 C1 01 74 F1   .ùfaÃ.ûUªuööÁ.tñ
0x000000C0   66 61 66 60 6A 00 6A 00 66 50 06 53 51 6A 10 B4   faf`j.j.fP.SQj.´
0x000000D0   42 89 E6 CD 13 61 66 61 C3 5E AC 08 C0 74 FC 56   B.æÍ.afaÃ^¬.ÀtüV
0x000000E0   1E BB 07 00 B4 0E CD 10 1F EB EE E8 EB FF 49 6E   .»..´.Í..ëîèë.In
0x000000F0   76 61 6C 69 64 20 70 61 72 74 69 74 69 6F 6E 20   valid partition 
0x00000100   74 61 62 6C 65 00 E8 D0 FF 45 72 72 6F 72 20 6C   table.èÐ.Error l
0x00000110   6F 61 64 69 6E 67 20 6F 70 65 72 61 74 69 6E 67   oading operating
0x00000120   20 73 79 73 74 65 6D 00 E8 AE FF 4D 69 73 73 69    system.è®.Missi
0x00000130   6E 67 20 6F 70 65 72 61 74 69 6E 67 20 73 79 73   ng operating sys
0x00000140   74 65 6D 00 00 00 00 00 00 00 00 00 00 00 00 00   tem.............
0x00000150   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x00000160   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x00000170   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x00000180   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x00000190   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x000001A0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x000001B0   00 00 00 00 00 2C 44 6A E4 43 E5 43 00 00 80 01   .....,DjäCåC....
0x000001C0   01 00 07 FE FF FF 3F 00 00 00 74 3C 0D 03 00 00   ...þ..?...t<....
0x000001D0   C1 FF 0F FE FF FF B3 3C 0D 03 51 B7 EC 0A 00 00   Á..þ..³<..Q·ì...
0x000001E0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x000001F0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA   ..............Uª

__ORIGINAL   \Device\Harddisk0\DR0  

0x00000000   33 C0 8E D0 BC 00 7C FB 50 07 50 1F FC BE 1B 7C   3À.Ð¼.|ûP.P.ü¾.|
0x00000010   BF 1B 06 50 57 B9 E5 01 F3 A4 CB BD BE 07 B1 04   ¿..PW¹å.ó¤Ë½¾.±.
0x00000020   38 6E 00 7C 09 75 13 83 C5 10 E2 F4 CD 18 8B F5   8n.|.u..Å.âôÍ..õ
0x00000030   83 C6 10 49 74 19 38 2C 74 F6 A0 B5 07 B4 07 8B   .Æ.It.8,tö.µ.´..
0x00000040   F0 AC 3C 00 74 FC BB 07 00 B4 0E CD 10 EB F2 88   ð¬<.tü»..´.Í.ëò.
0x00000050   4E 10 E8 46 00 73 2A FE 46 10 80 7E 04 0B 74 0B   N.èF.s*þF..~..t.
0x00000060   80 7E 04 0C 74 05 A0 B6 07 75 D2 80 46 02 06 83   .~..t..¶.uÒ.F...
0x00000070   46 08 06 83 56 0A 00 E8 21 00 73 05 A0 B6 07 EB   F...V..è!.s..¶.ë
0x00000080   BC 81 3E FE 7D 55 AA 74 0B 80 7E 10 00 74 C8 A0   ¼.>þ}Uªt..~..tÈ.
0x00000090   B7 07 EB A9 8B FC 1E 57 8B F5 CB BF 05 00 8A 56   ·.ë©.ü.W.õË¿...V
0x000000A0   00 B4 08 CD 13 72 23 8A C1 24 3F 98 8A DE 8A FC   .´.Í.r#.Á$?..Þ.ü
0x000000B0   43 F7 E3 8B D1 86 D6 B1 06 D2 EE 42 F7 E2 39 56   C÷ã.Ñ.Ö±.ÒîB÷â9V
0x000000C0   0A 77 23 72 05 39 46 08 73 1C B8 01 02 BB 00 7C   .w#r.9F.s.¸..».|
0x000000D0   8B 4E 02 8B 56 00 CD 13 73 51 4F 74 4E 32 E4 8A   .N..V.Í.sQOtN2ä.
0x000000E0   56 00 CD 13 EB E4 8A 56 00 60 BB AA 55 B4 41 CD   V.Í.ëä.V.`»ªU´AÍ
0x000000F0   13 72 36 81 FB 55 AA 75 30 F6 C1 01 74 2B 61 60   .r6.ûUªu0öÁ.t+a`
0x00000100   6A 00 6A 00 FF 76 0A FF 76 08 6A 00 68 00 7C 6A   j.j..v..v.j.h.|j
0x00000110   01 6A 10 B4 42 8B F4 CD 13 61 61 73 0E 4F 74 0B   .j.´B.ôÍ.aas.Ot.
0x00000120   32 E4 8A 56 00 CD 13 EB D6 61 F9 C3 4E 65 70 6C   2ä.V.Í.ëÖaùÃNepl
0x00000130   61 74 6E A0 20 74 61 62 75 6C 6B 61 20 6F 64 64   atn. tabulka odd
0x00000140   A1 6C 85 00 43 68 79 62 61 20 70 FD 69 20 6E 61   ¡l..Chyba pýi na
0x00000150   9F A1 74 A0 6E A1 20 6F 70 65 72 61 9F 6E A1 68   .¡t.n¡ opera.n¡h
0x00000160   6F 20 73 79 73 74 82 6D 75 00 4F 70 65 72 61 9F   o syst.mu.Opera.
0x00000170   6E A1 20 73 79 73 74 82 6D 20 6E 65 6E 61 6C 65   n¡ syst.m nenale
0x00000180   7A 65 6E 00 00 00 00 00 00 00 00 00 00 00 00 00   zen.............
0x00000190   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x000001A0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x000001B0   00 00 00 00 00 2C 44 6A E4 43 E5 43 00 00 80 01   .....,DjäCåC....
0x000001C0   01 00 07 FE FF FF 3F 00 00 00 74 3C 0D 03 00 00   ...þ..?...t<....
0x000001D0   C1 FF 0F FE FF FF B3 3C 0D 03 51 B7 EC 0A 00 00   Á..þ..³<..Q·ì...
0x000001E0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x000001F0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA   ..............Uª

__________________________16_BIT_ASM_CODE
   
0x0000    33c0            XOR AX, AX   
0x0002    8ed8            MOV DS, AX   
0x0004    8ec0            MOV ES, AX   
0x0006    8ed0            MOV SS, AX   
0x0008    bc 007c         MOV SP, 0x7c00   
0x000B    be 1a7c         MOV SI, 0x7c1a   
0x000E    bf 0006         MOV DI, 0x600   
0x0011    b9 e601         MOV CX, 0x1e6   
0x0014    50              PUSH AX   
0x0015    57              PUSH DI   
0x0016    fc              CLD   
0x0017    f3 a4           REP MOVSB   
0x0019    cb              RETF   
0x001A    be a407         MOV SI, 0x7a4   
0x001D    b1 04           MOV CL, 0x4   
0x001F    90              NOP   
0x0020    803c 80         CMP BYTE [SI], 0x80   
0x0023    74 0d           JZ 0x32   
0x0025    382c            CMP [SI], CH   
0x0027    0f85 c000       JNZ 0xeb   
0x002B    83c6 10         ADD SI, 0x10   
0x002E    e2 f0           LOOP 0x20   
0x0030    cd 18           INT 0x18   
0x0032    66 8b44 08      MOV EAX, [SI+0x8]   
0x0036    8b14            MOV DX, [SI]   
0x0038    89e3            MOV BX, SP   
0x003A    b9 0100         MOV CX, 0x1   
0x003D    e8 6400         CALL 0xa4   
0x0040    73 0c           JAE 0x4e   
0x0042    8b4c 02         MOV CX, [SI+0x2]   
0x0045    b8 0102         MOV AX, 0x201   
0x0048    cd 13           INT 0x13   
0x004A    0f82 b800       JB 0x106   
0x004E    b9 55aa         MOV CX, 0xaa55   
0x0051    2b0e fe7d       SUB CX, [0x7dfe]   
0x0055    0f85 cf00       JNZ 0x128   
0x0059    66 b8 00000000  MOV EAX, 0x0   
0x005F    66 3944 08      CMP [SI+0x8], EAX   
0x0063    72 08           JB 0x6d   
0x0065    66 8b44 08      MOV EAX, [SI+0x8]   
0x0069    66 0344 0c      ADD EAX, [SI+0xc]   
0x006D    83c6 10         ADD SI, 0x10   
0x0070    81fe e407       CMP SI, 0x7e4   
0x0074    72 e9           JB 0x5f   
0x0076    66 09c0         OR EAX, EAX   
0x0079    74 1e           JZ 0x99   
0x007B    b9 0900         MOV CX, 0x9   
0x007E    81c3 0002       ADD BX, 0x200   
0x0082    e8 1f00         CALL 0xa4   
0x0085    72 12           JB 0x99   
0x0087    89de            MOV SI, BX   
0x0089    81c6 0c02       ADD SI, 0x20c   
0x008D    8d54 f4         LEA DX, [SI-0xc]   
0x0090    66 813c 752ff3a4CMP DWORD [SI], 0xa4f32f75   
0x0097    74 05           JZ 0x9e   
0x0099    ea 007c 0000    JMP FAR 0x0:0x7c00   
0x009E    89de            MOV SI, BX   
0x00A0    ffd2            CALL DX   
0x00A2    eb f5           JMP 0x99   
0x00A4    66 60           PUSHAD   
0x00A6    b2 80           MOV DL, 0x80   
0x00A8    bb aa55         MOV BX, 0x55aa   
0x00AB    b4 41           MOV AH, 0x41   
0x00AD    cd 13           INT 0x13   
0x00AF    73 04           JAE 0xb5   
0x00B1    f9              STC   
0x00B2    66 61           POPAD   
0x00B4    c3              RET   
0x00B5    81fb 55aa       CMP BX, 0xaa55   
0x00B9    75 f6           JNZ 0xb1   
0x00BB    f6c1 01         TEST CL, 0x1   
0x00BE    74 f1           JZ 0xb1   
0x00C0    66 61           POPAD   
0x00C2    66 60           PUSHAD   
0x00C4    6a 00           PUSH 0x0   
0x00C6    6a 00           PUSH 0x0   
0x00C8    66 50           PUSH EAX   
0x00CA    06              PUSH ES   
0x00CB    53              PUSH BX   
0x00CC    51              PUSH CX   
0x00CD    6a 10           PUSH 0x10   
0x00CF    b4 42           MOV AH, 0x42   
0x00D1    89e6            MOV SI, SP   
0x00D3    cd 13           INT 0x13   
0x00D5    61              POPA   
0x00D6    66 61           POPAD   
0x00D8    c3              RET   
0x00D9    5e              POP SI   
0x00DA    ac              LODSB   
0x00DB    08c0            OR AL, AL   
0x00DD    74 fc           JZ 0xdb   
0x00DF    56              PUSH SI   
0x00E0    1e              PUSH DS   
0x00E1    bb 0700         MOV BX, 0x7   
0x00E4    b4 0e           MOV AH, 0xe   
0x00E6    cd 10           INT 0x10   
0x00E8    1f              POP DS   
0x00E9    eb ee           JMP 0xd9   
0x00EB    e8 ebff         CALL 0xd9   
0x00EE    49              DEC CX   
0x00EF    6e              OUTSB   
0x00F0    76 61           JBE 0x153   
0x00F2    6c              INSB   
0x00F3    6964 20 7061    IMUL SP, [SI+0x20], 0x6170   
0x00F8    72 74           JB 0x16e   
0x00FA    6974 69 6f6e    IMUL SI, [SI+0x69], 0x6e6f   
0x00FF    2074 61         AND [SI+0x61], DH   
0x0102    626c 65         BOUND BP, [SI+0x65]   
0x0105    00e8            ADD AL, CH   
0x0107    d0ff            SAR BH, 0x1   
0x0109    45              INC BP   
0x010A    72 72           JB 0x17e   
0x010C    6f              OUTSW   
0x010D    72 20           JB 0x12f   
0x010F    6c              INSB   
0x0110    6f              OUTSW   
0x0111    61              POPA   
0x0112    64 696e 67 206f IMUL BP, FS:[BP+0x67], 0x6f20   
0x0118    70 65           JO 0x17f   
0x011A    72 61           JB 0x17d   
0x011C    74 69           JZ 0x187   
0x011E    6e              OUTSB   
0x011F    67 2073 79      AND [EBX+0x79], DH   
0x0123    73 74           JAE 0x199   
0x0125    65 6d           INS WORD GS:[DI], DX   
0x0127    00e8            ADD AL, CH   
0x0129    ae              SCASB   
0x012A    ff4d 69         DEC WORD [DI+0x69]   
0x012D    73 73           JAE 0x1a2   
0x012F    696e 67 206f    IMUL BP, [BP+0x67], 0x6f20   
0x0134    70 65           JO 0x19b   
0x0136    72 61           JB 0x199   
0x0138    74 69           JZ 0x1a3   
0x013A    6e              OUTSB   
0x013B    67 2073 79      AND [EBX+0x79], DH   
0x013F    73 74           JAE 0x1b5   
0x0141    65 6d           INS WORD GS:[DI], DX   
0x0143    0000            ADD [BX+SI], AL   
0x0145    0000            ADD [BX+SI], AL   
0x0147    0000            ADD [BX+SI], AL   
0x0149    0000            ADD [BX+SI], AL   
0x014B    0000            ADD [BX+SI], AL   
0x014D    0000            ADD [BX+SI], AL   
0x014F    0000            ADD [BX+SI], AL   
0x0151    0000            ADD [BX+SI], AL   
0x0153    0000            ADD [BX+SI], AL   
0x0155    0000            ADD [BX+SI], AL   
0x0157    0000            ADD [BX+SI], AL   
0x0159    0000            ADD [BX+SI], AL   
0x015B    0000            ADD [BX+SI], AL   
0x015D    0000            ADD [BX+SI], AL   
0x015F    0000            ADD [BX+SI], AL   
0x0161    0000            ADD [BX+SI], AL   
0x0163    0000            ADD [BX+SI], AL   
0x0165    0000            ADD [BX+SI], AL   
0x0167    0000            ADD [BX+SI], AL   
0x0169    0000            ADD [BX+SI], AL   
0x016B    0000            ADD [BX+SI], AL   
0x016D    0000            ADD [BX+SI], AL   
0x016F    0000            ADD [BX+SI], AL   
0x0171    0000            ADD [BX+SI], AL   
0x0173    0000            ADD [BX+SI], AL   
0x0175    0000            ADD [BX+SI], AL   
0x0177    0000            ADD [BX+SI], AL   
0x0179    0000            ADD [BX+SI], AL   
0x017B    0000            ADD [BX+SI], AL   
0x017D    0000            ADD [BX+SI], AL   
0x017F    0000            ADD [BX+SI], AL   
0x0181    0000            ADD [BX+SI], AL   
0x0183    0000            ADD [BX+SI], AL   
0x0185    0000            ADD [BX+SI], AL   
0x0187    0000            ADD [BX+SI], AL   
0x0189    0000            ADD [BX+SI], AL   
0x018B    0000            ADD [BX+SI], AL   
0x018D    0000            ADD [BX+SI], AL   
0x018F    0000            ADD [BX+SI], AL   
0x0191    0000            ADD [BX+SI], AL   
0x0193    0000            ADD [BX+SI], AL   
0x0195    0000            ADD [BX+SI], AL   
0x0197    0000            ADD [BX+SI], AL   
0x0199    0000            ADD [BX+SI], AL   
0x019B    0000            ADD [BX+SI], AL   
0x019D    0000            ADD [BX+SI], AL   
0x019F    0000            ADD [BX+SI], AL   
0x01A1    0000            ADD [BX+SI], AL   
0x01A3    0000            ADD [BX+SI], AL   
0x01A5    0000            ADD [BX+SI], AL   
0x01A7    0000            ADD [BX+SI], AL   
0x01A9    0000            ADD [BX+SI], AL   
0x01AB    0000            ADD [BX+SI], AL   
0x01AD    0000            ADD [BX+SI], AL   
0x01AF    0000            ADD [BX+SI], AL   
0x01B1    0000            ADD [BX+SI], AL   
0x01B3    0000            ADD [BX+SI], AL   
0x01B5    2c 44           SUB AL, 0x44   
0x01B7    6a e4           PUSH -0x1c   
0x01B9    43              INC BX   
0x01BA    e5 43           IN AX, 0x43   
0x01BC    0000            ADD [BX+SI], AL   
0x01BE    8001 01         ADD BYTE [BX+DI], 0x1   
0x01C1    0007            ADD [BX], AL   
0x01C3    fe              DB 0xfe   
0x01C4    ff              DB 0xff   
0x01C5    ff              DB 0xff   
0x01C6    3f              AAS   
0x01C7    0000            ADD [BX+SI], AL   
0x01C9    0074 3c         ADD [SI+0x3c], DH   
0x01CC    0d 0300         OR AX, 0x3   
0x01CF    00c1            ADD CL, AL   
0x01D1    ff0f            DEC WORD [BX]   
0x01D3    fe              DB 0xfe   
0x01D4    ff              DB 0xff   
0x01D5    ffb3 3c0d       PUSH WORD [BP+DI+0xd3c]   
0x01D9    0351 b7         ADD DX, [BX+DI-0x49]   
0x01DC    ec              IN AL, DX   
0x01DD    0a00            OR AL, [BX+SI]   
0x01DF    0000            ADD [BX+SI], AL   
0x01E1    0000            ADD [BX+SI], AL   
0x01E3    0000            ADD [BX+SI], AL   
0x01E5    0000            ADD [BX+SI], AL   
0x01E7    0000            ADD [BX+SI], AL   
0x01E9    0000            ADD [BX+SI], AL   
0x01EB    0000            ADD [BX+SI], AL   
0x01ED    0000            ADD [BX+SI], AL   
0x01EF    0000            ADD [BX+SI], AL   
0x01F1    0000            ADD [BX+SI], AL   
0x01F3    0000            ADD [BX+SI], AL   
0x01F5    0000            ADD [BX+SI], AL   
0x01F7    0000            ADD [BX+SI], AL   
0x01F9    0000            ADD [BX+SI], AL   
0x01FB    0000            ADD [BX+SI], AL   
0x01FD    0055 aa         ADD [DI-0x56], DL

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-08-12 10:14:21
-----------------------------
10:14:21.953 OS Version: Windows 5.1.2600 Service Pack 3
10:14:21.953 Number of processors: 1 586 0x2C02
10:14:21.953 ComputerName: MARTIN-B598CED7 UserName: Martin
10:14:22.593 Initialize success
10:15:08.750 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
10:15:08.750 Disk 0 Vendor: SAMSUNG_SP1203N TL100-30 Size: 114498MB BusType: 3
10:15:08.750 Disk 0 MBR read successfully
10:15:08.750 Disk 0 MBR scan
10:15:08.750 Disk 0 Windows XP default MBR code
10:15:08.750 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 24999 MB offset 63
10:15:08.750 Disk 0 Partition - 00 0F Extended LBA 89494 MB offset 51199155
10:15:08.765 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 89494 MB offset 51199218
10:15:08.765 Disk 0 scanning sectors +234484740
10:15:08.843 Disk 0 scanning C:\WINDOWS\system32\drivers
10:15:15.281 Service scanning
10:15:28.562 Modules scanning
10:15:35.171 Disk 0 trace - called modules:
10:15:35.187 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys videX32.sys PCIIDEX.SYS
10:15:35.687 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x89de7ab8]
10:15:35.687 3 CLASSPNP.SYS[ba108fd7] -> nt!IofCallDriver -> \Device\00000070[0x89df6908]
10:15:35.687 5 ACPI.sys[b9f7f620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x89df7940]
10:15:35.687 Scan finished successfully
10:15:51.062 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Martin\Dokumenty\Downloads\MBR.dat"
10:15:51.078 The log file has been saved successfully to "C:\Documents and Settings\Martin\Dokumenty\Downloads\aswMBR.txt"

SHA256: a89d2d86ecff3a8273cef85621ccf4b89ed8d5ac4e0d8d681d9b00ab75258622
File name: MBR.dat
Detection ratio: 0 / 42
Analysis date: 2012-08-12 08:44:39 UTC ( 1 minuta ago )

AhnLab-V3 - 20120808
AntiVir - 20120808
Antiy-AVL - 20120808
Avast - 20120808
AVG - 20120808
BitDefender - 20120808
ByteHero - 20120723
CAT-QuickHeal - 20120808
ClamAV - 20120808
Commtouch - 20120808
Comodo - 20120808
DrWeb - 20120808
Emsisoft - 20120808
eSafe - 20120808
ESET-NOD32 - 20120808
F-Prot - 20120808
F-Secure - 20120808
Fortinet - 20120808
GData - 20120808
Ikarus - 20120808
Jiangmin - 20120808
K7AntiVirus - 20120808
Kaspersky - 20120808
McAfee - 20120808
McAfee-GW-Edition - 20120808
Microsoft - 20120808
Norman - 20120808
nProtect - 20120808
Panda - 20120808
PCTools - 20120808
Rising - 20120808
Sophos - 20120808
SUPERAntiSpyware - 20120808
Symantec - 20120808
TheHacker - 20120808
TotalDefense - 20120807
TrendMicro - 20120808
TrendMicro-HouseCall - 20120808
VBA32 - 20120807
VIPRE - 20120808
ViRobot - 20120808
VirusBuster - 20120808

Test dump souborů na virustoal:

SHA256: 6e2c48141e7eae816a642346e43e0a016fc8c6e0c0ad2ef2ae1b662314aa2dac
File name: Dump_Hdd0_DR0.mbr
Detection ratio: 15 / 42
Analysis date: 2012-08-12 09:18:21 UTC ( 0 minut ago )

AhnLab-V3 - 20120811
AntiVir - 20120812
Antiy-AVL - 20120811
Avast Win32:MBRoot-J [Trj] 20120812
AVG - 20120812
BitDefender Rootkit.MBR.Mebroot.B (Boot image) 20120812
ByteHero - 20120723
CAT-QuickHeal BootKit.Wistler 20120811
ClamAV - 20120811
Commtouch MBRoot.C 20120811
Comodo - 20120812
DrWeb - 20120812
Emsisoft Trojan.DOS.Sinowal!IK 20120812
eSafe - 20120809
ESET-NOD32 - 20120811
F-Prot MBRoot.C 20120810
F-Secure Rootkit.MBR.Mebroot.B $Boot image$ 20120812
Fortinet - 20120812
GData Rootkit.MBR.Mebroot.B 20120812
Ikarus Trojan.DOS.Sinowal 20120812
Jiangmin - 20120812
K7AntiVirus Backdoor 20120810
Kaspersky Rootkit.Boot.Sinowal.b 20120812
McAfee BackDoor-DWL!mbr 20120812
McAfee-GW-Edition BackDoor-DWL!mbr 20120811
Microsoft - 20120812
Norman - 20120811
nProtect - 20120810
Panda - 20120812
PCTools - 20120812
Rising - 20120810
Sophos - 20120812
SUPERAntiSpyware - 20120811
Symantec - 20120812
TheHacker - 20120812
TotalDefense Sinowal.A 20120812
TrendMicro - 20120812
TrendMicro-HouseCall - 20120812
VBA32 - 20120810
VIPRE Trojan.Boot.Sinowal.Gen (v) 20120812
ViRobot - 20120811
VirusBuster - 20120811

SHA256: a89d2d86ecff3a8273cef85621ccf4b89ed8d5ac4e0d8d681d9b00ab75258622
File name: Dump_Hdd0_DR0.old
Detection ratio: 0 / 38
Analysis date: 2012-08-12 09:20:44 UTC ( 1 minuta ago )

AntiVir - 20120808
Antiy-AVL - 20120808
Avast - 20120808
AVG - 20120808
BitDefender - 20120808
ByteHero - 20120723
CAT-QuickHeal - 20120808
Commtouch - 20120808
Comodo - 20120808
Emsisoft - 20120808
eSafe - 20120808
ESET-NOD32 - 20120808
F-Prot - 20120808
F-Secure - 20120808
Fortinet - 20120808
GData - 20120808
Ikarus - 20120808
Jiangmin - 20120808
K7AntiVirus - 20120808
Kaspersky - 20120808
McAfee - 20120808
McAfee-GW-Edition - 20120808
Microsoft - 20120808
Norman - 20120808
nProtect - 20120808
Panda - 20120808
PCTools - 20120808
Rising - 20120808
Sophos - 20120808
SUPERAntiSpyware - 20120808
Symantec - 20120808
TheHacker - 20120808
TotalDefense - 20120807
TrendMicro - 20120808
TrendMicro-HouseCall - 20120808
VIPRE - 20120808
ViRobot - 20120808
VirusBuster - 20120808

Přikládám vámi žádané soubory Dump a PhysicalMBR.

Přikládám obrázek z příkazového řádku po zadání mbrfix/drive 0 driveinfo.

: obrázek cmd okna.jpg (46.03 KiB) Zobrazeno 1421 x

Zde je log z Avengeru:

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

Driver "xpsec" deleted successfully.
Driver "xcpip" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

Zde je log z MBRScanu a v příloze z OTL.

Kód: Vybrat vše

MBRScan v1.1.1

OS             : Windows XP Home Service Pack 3 (32 bit)
PROCESSOR      : x86 Family 15 Model 44 Stepping 2, AuthenticAMD
BOOT           : Normal Boot
DATE           : 2012/08/12 (ISO 8601) at 17:53:54
________________________________________________________________________________

DISK           : Device\Harddisk0\DR0 __SAMSUNG SP1203N (TL100-30)
BUS_TYPE       : (0x03)  P-ATA
USE_PIO        : YES
MAX_TRANSFER   : 128 Kb
ALIGNMENT_MASK : word aligned
________________________________________________________________________________

DISK           : Device\Harddisk1\DR3 __S31B0906 USB DISK (1100)
BUS_TYPE       : (0x07)  USB
USE_PIO        : NO
MAX_TRANSFER   : 64 Kb
ALIGNMENT_MASK : byte aligned
________________________________________________________________________________

Device\Harddisk0\DR0	111.8 Go  [Fixed] ==> Unknown MBR Code

MBR_MD5   : 06C4A6CF948DAD9339030D6E53BF4BCE
MBR_SHA1  : 18DB7B7B89915336C7DACCA373AAA21223B7520E

Device\Harddisk0\Partition1	24.41 Go  	0x07 NTFS / HPFS __ BOOTABLE __
Device\Harddisk0\Partition2	87.40 Go  	0x07 NTFS / HPFS
________________________________________________________________________________

Device\Harddisk1\DR3	1.87 Go  [Removable] ==> XP MBR Code

MBR_MD5   : 1A7A0C164C5B91B2D211A9A4EB07DE1F
MBR_SHA1  : 69245C6CECA93550846177BB5BC2F2BAD35DCF70

Device\Harddisk1\Partition1	1.87 Go __ BOOTABLE __
________________________________________________________________________________

############################### Additional scan ################################

DRIVER  : C:\WINDOWS\system32\drivers\xpsec.sys => Invisible on the disk
ADDRESS : 0xB01D1000
SIZE    : 76.0 Ko

DRIVER  : C:\WINDOWS\system32\drivers\xcpip.sys => Invisible on the disk
ADDRESS : 0xB0178000
SIZE    : 356.0 Ko

SystemStartOptions : NOEXECUTE=OPTIN  FASTDETECT

________________________________________________________________________________

_____FAKED   \Device\Harddisk0\DR0  

0x00000000   33 C0 8E D8 8E C0 8E D0 BC 00 7C BE 1A 7C BF 00   3À.Ø.À.Ð¼.|¾.|¿.
0x00000010   06 B9 E6 01 50 57 FC F3 A4 CB BE A4 07 B1 04 90   .¹æ.PWüó¤Ë¾¤.±..
0x00000020   80 3C 80 74 0D 38 2C 0F 85 C0 00 83 C6 10 E2 F0   .<.t.8,..À..Æ.âð
0x00000030   CD 18 66 8B 44 08 8B 14 89 E3 B9 01 00 E8 64 00   Í.f.D....ã¹..èd.
0x00000040   73 0C 8B 4C 02 B8 01 02 CD 13 0F 82 B8 00 B9 55   s..L.¸..Í...¸.¹U
0x00000050   AA 2B 0E FE 7D 0F 85 CF 00 66 B8 00 00 00 00 66   ª+.þ}..Ï.f¸....f
0x00000060   39 44 08 72 08 66 8B 44 08 66 03 44 0C 83 C6 10   9D.r.f.D.f.D..Æ.
0x00000070   81 FE E4 07 72 E9 66 09 C0 74 1E B9 09 00 81 C3   .þä.réf.Àt.¹...Ã
0x00000080   00 02 E8 1F 00 72 12 89 DE 81 C6 0C 02 8D 54 F4   ..è..r..Þ.Æ...Tô
0x00000090   66 81 3C 75 2F F3 A4 74 05 EA 00 7C 00 00 89 DE   f.<u/ó¤t.ê.|...Þ
0x000000A0   FF D2 EB F5 66 60 B2 80 BB AA 55 B4 41 CD 13 73   .Òëõf`².»ªU´AÍ.s
0x000000B0   04 F9 66 61 C3 81 FB 55 AA 75 F6 F6 C1 01 74 F1   .ùfaÃ.ûUªuööÁ.tñ
0x000000C0   66 61 66 60 6A 00 6A 00 66 50 06 53 51 6A 10 B4   faf`j.j.fP.SQj.´
0x000000D0   42 89 E6 CD 13 61 66 61 C3 5E AC 08 C0 74 FC 56   B.æÍ.afaÃ^¬.ÀtüV
0x000000E0   1E BB 07 00 B4 0E CD 10 1F EB EE E8 EB FF 49 6E   .»..´.Í..ëîèë.In
0x000000F0   76 61 6C 69 64 20 70 61 72 74 69 74 69 6F 6E 20   valid partition 
0x00000100   74 61 62 6C 65 00 E8 D0 FF 45 72 72 6F 72 20 6C   table.èÐ.Error l
0x00000110   6F 61 64 69 6E 67 20 6F 70 65 72 61 74 69 6E 67   oading operating
0x00000120   20 73 79 73 74 65 6D 00 E8 AE FF 4D 69 73 73 69    system.è®.Missi
0x00000130   6E 67 20 6F 70 65 72 61 74 69 6E 67 20 73 79 73   ng operating sys
0x00000140   74 65 6D 00 00 00 00 00 00 00 00 00 00 00 00 00   tem.............
0x00000150   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x00000160   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x00000170   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x00000180   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x00000190   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x000001A0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x000001B0   00 00 00 00 00 2C 44 6A E4 43 E5 43 00 00 80 01   .....,DjäCåC....
0x000001C0   01 00 07 FE FF FF 3F 00 00 00 74 3C 0D 03 00 00   ...þ..?...t<....
0x000001D0   C1 FF 0F FE FF FF B3 3C 0D 03 51 B7 EC 0A 00 00   Á..þ..³<..Q·ì...
0x000001E0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x000001F0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA   ..............Uª

__ORIGINAL   \Device\Harddisk0\DR0  

0x00000000   33 C0 8E D0 BC 00 7C FB 50 07 50 1F FC BE 1B 7C   3À.Ð¼.|ûP.P.ü¾.|
0x00000010   BF 1B 06 50 57 B9 E5 01 F3 A4 CB BD BE 07 B1 04   ¿..PW¹å.ó¤Ë½¾.±.
0x00000020   38 6E 00 7C 09 75 13 83 C5 10 E2 F4 CD 18 8B F5   8n.|.u..Å.âôÍ..õ
0x00000030   83 C6 10 49 74 19 38 2C 74 F6 A0 B5 07 B4 07 8B   .Æ.It.8,tö.µ.´..
0x00000040   F0 AC 3C 00 74 FC BB 07 00 B4 0E CD 10 EB F2 88   ð¬<.tü»..´.Í.ëò.
0x00000050   4E 10 E8 46 00 73 2A FE 46 10 80 7E 04 0B 74 0B   N.èF.s*þF..~..t.
0x00000060   80 7E 04 0C 74 05 A0 B6 07 75 D2 80 46 02 06 83   .~..t..¶.uÒ.F...
0x00000070   46 08 06 83 56 0A 00 E8 21 00 73 05 A0 B6 07 EB   F...V..è!.s..¶.ë
0x00000080   BC 81 3E FE 7D 55 AA 74 0B 80 7E 10 00 74 C8 A0   ¼.>þ}Uªt..~..tÈ.
0x00000090   B7 07 EB A9 8B FC 1E 57 8B F5 CB BF 05 00 8A 56   ·.ë©.ü.W.õË¿...V
0x000000A0   00 B4 08 CD 13 72 23 8A C1 24 3F 98 8A DE 8A FC   .´.Í.r#.Á$?..Þ.ü
0x000000B0   43 F7 E3 8B D1 86 D6 B1 06 D2 EE 42 F7 E2 39 56   C÷ã.Ñ.Ö±.ÒîB÷â9V
0x000000C0   0A 77 23 72 05 39 46 08 73 1C B8 01 02 BB 00 7C   .w#r.9F.s.¸..».|
0x000000D0   8B 4E 02 8B 56 00 CD 13 73 51 4F 74 4E 32 E4 8A   .N..V.Í.sQOtN2ä.
0x000000E0   56 00 CD 13 EB E4 8A 56 00 60 BB AA 55 B4 41 CD   V.Í.ëä.V.`»ªU´AÍ
0x000000F0   13 72 36 81 FB 55 AA 75 30 F6 C1 01 74 2B 61 60   .r6.ûUªu0öÁ.t+a`
0x00000100   6A 00 6A 00 FF 76 0A FF 76 08 6A 00 68 00 7C 6A   j.j..v..v.j.h.|j
0x00000110   01 6A 10 B4 42 8B F4 CD 13 61 61 73 0E 4F 74 0B   .j.´B.ôÍ.aas.Ot.
0x00000120   32 E4 8A 56 00 CD 13 EB D6 61 F9 C3 4E 65 70 6C   2ä.V.Í.ëÖaùÃNepl
0x00000130   61 74 6E A0 20 74 61 62 75 6C 6B 61 20 6F 64 64   atn. tabulka odd
0x00000140   A1 6C 85 00 43 68 79 62 61 20 70 FD 69 20 6E 61   ¡l..Chyba pýi na
0x00000150   9F A1 74 A0 6E A1 20 6F 70 65 72 61 9F 6E A1 68   .¡t.n¡ opera.n¡h
0x00000160   6F 20 73 79 73 74 82 6D 75 00 4F 70 65 72 61 9F   o syst.mu.Opera.
0x00000170   6E A1 20 73 79 73 74 82 6D 20 6E 65 6E 61 6C 65   n¡ syst.m nenale
0x00000180   7A 65 6E 00 00 00 00 00 00 00 00 00 00 00 00 00   zen.............
0x00000190   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x000001A0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x000001B0   00 00 00 00 00 2C 44 6A E4 43 E5 43 00 00 80 01   .....,DjäCåC....
0x000001C0   01 00 07 FE FF FF 3F 00 00 00 74 3C 0D 03 00 00   ...þ..?...t<....
0x000001D0   C1 FF 0F FE FF FF B3 3C 0D 03 51 B7 EC 0A 00 00   Á..þ..³<..Q·ì...
0x000001E0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x000001F0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA   ..............Uª

__________________________16_BIT_ASM_CODE
   
0x0000    33c0            XOR AX, AX   
0x0002    8ed8            MOV DS, AX   
0x0004    8ec0            MOV ES, AX   
0x0006    8ed0            MOV SS, AX   
0x0008    bc 007c         MOV SP, 0x7c00   
0x000B    be 1a7c         MOV SI, 0x7c1a   
0x000E    bf 0006         MOV DI, 0x600   
0x0011    b9 e601         MOV CX, 0x1e6   
0x0014    50              PUSH AX   
0x0015    57              PUSH DI   
0x0016    fc              CLD   
0x0017    f3 a4           REP MOVSB   
0x0019    cb              RETF   
0x001A    be a407         MOV SI, 0x7a4   
0x001D    b1 04           MOV CL, 0x4   
0x001F    90              NOP   
0x0020    803c 80         CMP BYTE [SI], 0x80   
0x0023    74 0d           JZ 0x32   
0x0025    382c            CMP [SI], CH   
0x0027    0f85 c000       JNZ 0xeb   
0x002B    83c6 10         ADD SI, 0x10   
0x002E    e2 f0           LOOP 0x20   
0x0030    cd 18           INT 0x18   
0x0032    66 8b44 08      MOV EAX, [SI+0x8]   
0x0036    8b14            MOV DX, [SI]   
0x0038    89e3            MOV BX, SP   
0x003A    b9 0100         MOV CX, 0x1   
0x003D    e8 6400         CALL 0xa4   
0x0040    73 0c           JAE 0x4e   
0x0042    8b4c 02         MOV CX, [SI+0x2]   
0x0045    b8 0102         MOV AX, 0x201   
0x0048    cd 13           INT 0x13   
0x004A    0f82 b800       JB 0x106   
0x004E    b9 55aa         MOV CX, 0xaa55   
0x0051    2b0e fe7d       SUB CX, [0x7dfe]   
0x0055    0f85 cf00       JNZ 0x128   
0x0059    66 b8 00000000  MOV EAX, 0x0   
0x005F    66 3944 08      CMP [SI+0x8], EAX   
0x0063    72 08           JB 0x6d   
0x0065    66 8b44 08      MOV EAX, [SI+0x8]   
0x0069    66 0344 0c      ADD EAX, [SI+0xc]   
0x006D    83c6 10         ADD SI, 0x10   
0x0070    81fe e407       CMP SI, 0x7e4   
0x0074    72 e9           JB 0x5f   
0x0076    66 09c0         OR EAX, EAX   
0x0079    74 1e           JZ 0x99   
0x007B    b9 0900         MOV CX, 0x9   
0x007E    81c3 0002       ADD BX, 0x200   
0x0082    e8 1f00         CALL 0xa4   
0x0085    72 12           JB 0x99   
0x0087    89de            MOV SI, BX   
0x0089    81c6 0c02       ADD SI, 0x20c   
0x008D    8d54 f4         LEA DX, [SI-0xc]   
0x0090    66 813c 752ff3a4CMP DWORD [SI], 0xa4f32f75   
0x0097    74 05           JZ 0x9e   
0x0099    ea 007c 0000    JMP FAR 0x0:0x7c00   
0x009E    89de            MOV SI, BX   
0x00A0    ffd2            CALL DX   
0x00A2    eb f5           JMP 0x99   
0x00A4    66 60           PUSHAD   
0x00A6    b2 80           MOV DL, 0x80   
0x00A8    bb aa55         MOV BX, 0x55aa   
0x00AB    b4 41           MOV AH, 0x41   
0x00AD    cd 13           INT 0x13   
0x00AF    73 04           JAE 0xb5   
0x00B1    f9              STC   
0x00B2    66 61           POPAD   
0x00B4    c3              RET   
0x00B5    81fb 55aa       CMP BX, 0xaa55   
0x00B9    75 f6           JNZ 0xb1   
0x00BB    f6c1 01         TEST CL, 0x1   
0x00BE    74 f1           JZ 0xb1   
0x00C0    66 61           POPAD   
0x00C2    66 60           PUSHAD   
0x00C4    6a 00           PUSH 0x0   
0x00C6    6a 00           PUSH 0x0   
0x00C8    66 50           PUSH EAX   
0x00CA    06              PUSH ES   
0x00CB    53              PUSH BX   
0x00CC    51              PUSH CX   
0x00CD    6a 10           PUSH 0x10   
0x00CF    b4 42           MOV AH, 0x42   
0x00D1    89e6            MOV SI, SP   
0x00D3    cd 13           INT 0x13   
0x00D5    61              POPA   
0x00D6    66 61           POPAD   
0x00D8    c3              RET   
0x00D9    5e              POP SI   
0x00DA    ac              LODSB   
0x00DB    08c0            OR AL, AL   
0x00DD    74 fc           JZ 0xdb   
0x00DF    56              PUSH SI   
0x00E0    1e              PUSH DS   
0x00E1    bb 0700         MOV BX, 0x7   
0x00E4    b4 0e           MOV AH, 0xe   
0x00E6    cd 10           INT 0x10   
0x00E8    1f              POP DS   
0x00E9    eb ee           JMP 0xd9   
0x00EB    e8 ebff         CALL 0xd9   
0x00EE    49              DEC CX   
0x00EF    6e              OUTSB   
0x00F0    76 61           JBE 0x153   
0x00F2    6c              INSB   
0x00F3    6964 20 7061    IMUL SP, [SI+0x20], 0x6170   
0x00F8    72 74           JB 0x16e   
0x00FA    6974 69 6f6e    IMUL SI, [SI+0x69], 0x6e6f   
0x00FF    2074 61         AND [SI+0x61], DH   
0x0102    626c 65         BOUND BP, [SI+0x65]   
0x0105    00e8            ADD AL, CH   
0x0107    d0ff            SAR BH, 0x1   
0x0109    45              INC BP   
0x010A    72 72           JB 0x17e   
0x010C    6f              OUTSW   
0x010D    72 20           JB 0x12f   
0x010F    6c              INSB   
0x0110    6f              OUTSW   
0x0111    61              POPA   
0x0112    64 696e 67 206f IMUL BP, FS:[BP+0x67], 0x6f20   
0x0118    70 65           JO 0x17f   
0x011A    72 61           JB 0x17d   
0x011C    74 69           JZ 0x187   
0x011E    6e              OUTSB   
0x011F    67 2073 79      AND [EBX+0x79], DH   
0x0123    73 74           JAE 0x199   
0x0125    65 6d           INS WORD GS:[DI], DX   
0x0127    00e8            ADD AL, CH   
0x0129    ae              SCASB   
0x012A    ff4d 69         DEC WORD [DI+0x69]   
0x012D    73 73           JAE 0x1a2   
0x012F    696e 67 206f    IMUL BP, [BP+0x67], 0x6f20   
0x0134    70 65           JO 0x19b   
0x0136    72 61           JB 0x199   
0x0138    74 69           JZ 0x1a3   
0x013A    6e              OUTSB   
0x013B    67 2073 79      AND [EBX+0x79], DH   
0x013F    73 74           JAE 0x1b5   
0x0141    65 6d           INS WORD GS:[DI], DX   
0x0143    0000            ADD [BX+SI], AL   
0x0145    0000            ADD [BX+SI], AL   
0x0147    0000            ADD [BX+SI], AL   
0x0149    0000            ADD [BX+SI], AL   
0x014B    0000            ADD [BX+SI], AL   
0x014D    0000            ADD [BX+SI], AL   
0x014F    0000            ADD [BX+SI], AL   
0x0151    0000            ADD [BX+SI], AL   
0x0153    0000            ADD [BX+SI], AL   
0x0155    0000            ADD [BX+SI], AL   
0x0157    0000            ADD [BX+SI], AL   
0x0159    0000            ADD [BX+SI], AL   
0x015B    0000            ADD [BX+SI], AL   
0x015D    0000            ADD [BX+SI], AL   
0x015F    0000            ADD [BX+SI], AL   
0x0161    0000            ADD [BX+SI], AL   
0x0163    0000            ADD [BX+SI], AL   
0x0165    0000            ADD [BX+SI], AL   
0x0167    0000            ADD [BX+SI], AL   
0x0169    0000            ADD [BX+SI], AL   
0x016B    0000            ADD [BX+SI], AL   
0x016D    0000            ADD [BX+SI], AL   
0x016F    0000            ADD [BX+SI], AL   
0x0171    0000            ADD [BX+SI], AL   
0x0173    0000            ADD [BX+SI], AL   
0x0175    0000            ADD [BX+SI], AL   
0x0177    0000            ADD [BX+SI], AL   
0x0179    0000            ADD [BX+SI], AL   
0x017B    0000            ADD [BX+SI], AL   
0x017D    0000            ADD [BX+SI], AL   
0x017F    0000            ADD [BX+SI], AL   
0x0181    0000            ADD [BX+SI], AL   
0x0183    0000            ADD [BX+SI], AL   
0x0185    0000            ADD [BX+SI], AL   
0x0187    0000            ADD [BX+SI], AL   
0x0189    0000            ADD [BX+SI], AL   
0x018B    0000            ADD [BX+SI], AL   
0x018D    0000            ADD [BX+SI], AL   
0x018F    0000            ADD [BX+SI], AL   
0x0191    0000            ADD [BX+SI], AL   
0x0193    0000            ADD [BX+SI], AL   
0x0195    0000            ADD [BX+SI], AL   
0x0197    0000            ADD [BX+SI], AL   
0x0199    0000            ADD [BX+SI], AL   
0x019B    0000            ADD [BX+SI], AL   
0x019D    0000            ADD [BX+SI], AL   
0x019F    0000            ADD [BX+SI], AL   
0x01A1    0000            ADD [BX+SI], AL   
0x01A3    0000            ADD [BX+SI], AL   
0x01A5    0000            ADD [BX+SI], AL   
0x01A7    0000            ADD [BX+SI], AL   
0x01A9    0000            ADD [BX+SI], AL   
0x01AB    0000            ADD [BX+SI], AL   
0x01AD    0000            ADD [BX+SI], AL   
0x01AF    0000            ADD [BX+SI], AL   
0x01B1    0000            ADD [BX+SI], AL   
0x01B3    0000            ADD [BX+SI], AL   
0x01B5    2c 44           SUB AL, 0x44   
0x01B7    6a e4           PUSH -0x1c   
0x01B9    43              INC BX   
0x01BA    e5 43           IN AX, 0x43   
0x01BC    0000            ADD [BX+SI], AL   
0x01BE    8001 01         ADD BYTE [BX+DI], 0x1   
0x01C1    0007            ADD [BX], AL   
0x01C3    fe              DB 0xfe   
0x01C4    ff              DB 0xff   
0x01C5    ff              DB 0xff   
0x01C6    3f              AAS   
0x01C7    0000            ADD [BX+SI], AL   
0x01C9    0074 3c         ADD [SI+0x3c], DH   
0x01CC    0d 0300         OR AX, 0x3   
0x01CF    00c1            ADD CL, AL   
0x01D1    ff0f            DEC WORD [BX]   
0x01D3    fe              DB 0xfe   
0x01D4    ff              DB 0xff   
0x01D5    ffb3 3c0d       PUSH WORD [BP+DI+0xd3c]   
0x01D9    0351 b7         ADD DX, [BX+DI-0x49]   
0x01DC    ec              IN AL, DX   
0x01DD    0a00            OR AL, [BX+SI]   
0x01DF    0000            ADD [BX+SI], AL   
0x01E1    0000            ADD [BX+SI], AL   
0x01E3    0000            ADD [BX+SI], AL   
0x01E5    0000            ADD [BX+SI], AL   
0x01E7    0000            ADD [BX+SI], AL   
0x01E9    0000            ADD [BX+SI], AL   
0x01EB    0000            ADD [BX+SI], AL   
0x01ED    0000            ADD [BX+SI], AL   
0x01EF    0000            ADD [BX+SI], AL   
0x01F1    0000            ADD [BX+SI], AL   
0x01F3    0000            ADD [BX+SI], AL   
0x01F5    0000            ADD [BX+SI], AL   
0x01F7    0000            ADD [BX+SI], AL   
0x01F9    0000            ADD [BX+SI], AL   
0x01FB    0000            ADD [BX+SI], AL   
0x01FD    0055 aa         ADD [DI-0x56], DL   


_______MBR   \Device\Harddisk1\DR3  

0x00000000   33 C0 8E D0 BC 00 7C FB 50 07 50 1F FC BE 1B 7C   3À.Ð¼.|ûP.P.ü¾.|
0x00000010   BF 1B 06 50 57 B9 E5 01 F3 A4 CB BD BE 07 B1 04   ¿..PW¹å.ó¤Ë½¾.±.
0x00000020   38 6E 00 7C 09 75 13 83 C5 10 E2 F4 CD 18 8B F5   8n.|.u..Å.âôÍ..õ
0x00000030   83 C6 10 49 74 19 38 2C 74 F6 A0 B5 07 B4 07 8B   .Æ.It.8,tö.µ.´..
0x00000040   F0 AC 3C 00 74 FC BB 07 00 B4 0E CD 10 EB F2 88   ð¬<.tü»..´.Í.ëò.
0x00000050   4E 10 E8 46 00 73 2A FE 46 10 80 7E 04 0B 74 0B   N.èF.s*þF..~..t.
0x00000060   80 7E 04 0C 74 05 A0 B6 07 75 D2 80 46 02 06 83   .~..t..¶.uÒ.F...
0x00000070   46 08 06 83 56 0A 00 E8 21 00 73 05 A0 B6 07 EB   F...V..è!.s..¶.ë
0x00000080   BC 81 3E FE 7D 55 AA 74 0B 80 7E 10 00 74 C8 A0   ¼.>þ}Uªt..~..tÈ.
0x00000090   B7 07 EB A9 8B FC 1E 57 8B F5 CB BF 05 00 8A 56   ·.ë©.ü.W.õË¿...V
0x000000A0   00 B4 08 CD 13 72 23 8A C1 24 3F 98 8A DE 8A FC   .´.Í.r#.Á$?..Þ.ü
0x000000B0   43 F7 E3 8B D1 86 D6 B1 06 D2 EE 42 F7 E2 39 56   C÷ã.Ñ.Ö±.ÒîB÷â9V
0x000000C0   0A 77 23 72 05 39 46 08 73 1C B8 01 02 BB 00 7C   .w#r.9F.s.¸..».|
0x000000D0   8B 4E 02 8B 56 00 CD 13 73 51 4F 74 4E 32 E4 8A   .N..V.Í.sQOtN2ä.
0x000000E0   56 00 CD 13 EB E4 8A 56 00 60 BB AA 55 B4 41 CD   V.Í.ëä.V.`»ªU´AÍ
0x000000F0   13 72 36 81 FB 55 AA 75 30 F6 C1 01 74 2B 61 60   .r6.ûUªu0öÁ.t+a`
0x00000100   6A 00 6A 00 FF 76 0A FF 76 08 6A 00 68 00 7C 6A   j.j..v..v.j.h.|j
0x00000110   01 6A 10 B4 42 8B F4 CD 13 61 61 73 0E 4F 74 0B   .j.´B.ôÍ.aas.Ot.
0x00000120   32 E4 8A 56 00 CD 13 EB D6 61 F9 C3 49 6E 76 61   2ä.V.Í.ëÖaùÃInva
0x00000130   6C 69 64 20 70 61 72 74 69 74 69 6F 6E 20 74 61   lid partition ta
0x00000140   62 6C 65 00 45 72 72 6F 72 20 6C 6F 61 64 69 6E   ble.Error loadin
0x00000150   67 20 6F 70 65 72 61 74 69 6E 67 20 73 79 73 74   g operating syst
0x00000160   65 6D 00 4D 69 73 73 69 6E 67 20 6F 70 65 72 61   em.Missing opera
0x00000170   74 69 6E 67 20 73 79 73 74 65 6D 00 00 00 00 00   ting system.....
0x00000180   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x00000190   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x000001A0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x000001B0   00 00 00 00 00 2C 44 63 18 2E 07 C3 00 00 80 01   .....,Dc...Ã....
0x000001C0   01 00 0B 80 E0 BC 20 00 00 00 E0 BF 3B 00 00 00   ....à¼ ...à¿;...
0x000001D0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x000001E0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x000001F0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA   ..............Uª

__________________________16_BIT_ASM_CODE
   
0x0000    33c0            XOR AX, AX   
0x0002    8ed0            MOV SS, AX   
0x0004    bc 007c         MOV SP, 0x7c00   
0x0007    fb              STI   
0x0008    50              PUSH AX   
0x0009    07              POP ES   
0x000A    50              PUSH AX   
0x000B    1f              POP DS   
0x000C    fc              CLD   
0x000D    be 1b7c         MOV SI, 0x7c1b   
0x0010    bf 1b06         MOV DI, 0x61b   
0x0013    50              PUSH AX   
0x0014    57              PUSH DI   
0x0015    b9 e501         MOV CX, 0x1e5   
0x0018    f3 a4           REP MOVSB   
0x001A    cb              RETF   
0x001B    bd be07         MOV BP, 0x7be   
0x001E    b1 04           MOV CL, 0x4   
0x0020    386e 00         CMP [BP+0x0], CH   
0x0023    7c 09           JL 0x2e   
0x0025    75 13           JNZ 0x3a   
0x0027    83c5 10         ADD BP, 0x10   
0x002A    e2 f4           LOOP 0x20   
0x002C    cd 18           INT 0x18   
0x002E    8bf5            MOV SI, BP   
0x0030    83c6 10         ADD SI, 0x10   
0x0033    49              DEC CX   
0x0034    74 19           JZ 0x4f   
0x0036    382c            CMP [SI], CH   
0x0038    74 f6           JZ 0x30   
0x003A    a0 b507         MOV AL, [0x7b5]   
0x003D    b4 07           MOV AH, 0x7   
0x003F    8bf0            MOV SI, AX   
0x0041    ac              LODSB   
0x0042    3c 00           CMP AL, 0x0   
0x0044    74 fc           JZ 0x42   
0x0046    bb 0700         MOV BX, 0x7   
0x0049    b4 0e           MOV AH, 0xe   
0x004B    cd 10           INT 0x10   
0x004D    eb f2           JMP 0x41   
0x004F    884e 10         MOV [BP+0x10], CL   
0x0052    e8 4600         CALL 0x9b   
0x0055    73 2a           JAE 0x81   
0x0057    fe46 10         INC BYTE [BP+0x10]   
0x005A    807e 04 0b      CMP BYTE [BP+0x4], 0xb   
0x005E    74 0b           JZ 0x6b   
0x0060    807e 04 0c      CMP BYTE [BP+0x4], 0xc   
0x0064    74 05           JZ 0x6b   
0x0066    a0 b607         MOV AL, [0x7b6]   
0x0069    75 d2           JNZ 0x3d   
0x006B    8046 02 06      ADD BYTE [BP+0x2], 0x6   
0x006F    8346 08 06      ADD WORD [BP+0x8], 0x6   
0x0073    8356 0a 00      ADC WORD [BP+0xa], 0x0   
0x0077    e8 2100         CALL 0x9b   
0x007A    73 05           JAE 0x81   
0x007C    a0 b607         MOV AL, [0x7b6]   
0x007F    eb bc           JMP 0x3d   
0x0081    813e fe7d 55aa  CMP WORD [0x7dfe], 0xaa55   
0x0087    74 0b           JZ 0x94   
0x0089    807e 10 00      CMP BYTE [BP+0x10], 0x0   
0x008D    74 c8           JZ 0x57   
0x008F    a0 b707         MOV AL, [0x7b7]   
0x0092    eb a9           JMP 0x3d   
0x0094    8bfc            MOV DI, SP   
0x0096    1e              PUSH DS   
0x0097    57              PUSH DI   
0x0098    8bf5            MOV SI, BP   
0x009A    cb              RETF   
0x009B    bf 0500         MOV DI, 0x5   
0x009E    8a56 00         MOV DL, [BP+0x0]   
0x00A1    b4 08           MOV AH, 0x8   
0x00A3    cd 13           INT 0x13   
0x00A5    72 23           JB 0xca   
0x00A7    8ac1            MOV AL, CL   
0x00A9    24 3f           AND AL, 0x3f   
0x00AB    98              CBW   
0x00AC    8ade            MOV BL, DH   
0x00AE    8afc            MOV BH, AH   
0x00B0    43              INC BX   
0x00B1    f7e3            MUL BX   
0x00B3    8bd1            MOV DX, CX   
0x00B5    86d6            XCHG DH, DL   
0x00B7    b1 06           MOV CL, 0x6   
0x00B9    d2ee            SHR DH, CL   
0x00BB    42              INC DX   
0x00BC    f7e2            MUL DX   
0x00BE    3956 0a         CMP [BP+0xa], DX   
0x00C1    77 23           JA 0xe6   
0x00C3    72 05           JB 0xca   
0x00C5    3946 08         CMP [BP+0x8], AX   
0x00C8    73 1c           JAE 0xe6   
0x00CA    b8 0102         MOV AX, 0x201   
0x00CD    bb 007c         MOV BX, 0x7c00   
0x00D0    8b4e 02         MOV CX, [BP+0x2]   
0x00D3    8b56 00         MOV DX, [BP+0x0]   
0x00D6    cd 13           INT 0x13   
0x00D8    73 51           JAE 0x12b   
0x00DA    4f              DEC DI   
0x00DB    74 4e           JZ 0x12b   
0x00DD    32e4            XOR AH, AH   
0x00DF    8a56 00         MOV DL, [BP+0x0]   
0x00E2    cd 13           INT 0x13   
0x00E4    eb e4           JMP 0xca   
0x00E6    8a56 00         MOV DL, [BP+0x0]   
0x00E9    60              PUSHA   
0x00EA    bb aa55         MOV BX, 0x55aa   
0x00ED    b4 41           MOV AH, 0x41   
0x00EF    cd 13           INT 0x13   
0x00F1    72 36           JB 0x129   
0x00F3    81fb 55aa       CMP BX, 0xaa55   
0x00F7    75 30           JNZ 0x129   
0x00F9    f6c1 01         TEST CL, 0x1   
0x00FC    74 2b           JZ 0x129   
0x00FE    61              POPA   
0x00FF    60              PUSHA   
0x0100    6a 00           PUSH 0x0   
0x0102    6a 00           PUSH 0x0   
0x0104    ff76 0a         PUSH WORD [BP+0xa]   
0x0107    ff76 08         PUSH WORD [BP+0x8]   
0x010A    6a 00           PUSH 0x0   
0x010C    68 007c         PUSH 0x7c00   
0x010F    6a 01           PUSH 0x1   
0x0111    6a 10           PUSH 0x10   
0x0113    b4 42           MOV AH, 0x42   
0x0115    8bf4            MOV SI, SP   
0x0117    cd 13           INT 0x13   
0x0119    61              POPA   
0x011A    61              POPA   
0x011B    73 0e           JAE 0x12b   
0x011D    4f              DEC DI   
0x011E    74 0b           JZ 0x12b   
0x0120    32e4            XOR AH, AH   
0x0122    8a56 00         MOV DL, [BP+0x0]   
0x0125    cd 13           INT 0x13   
0x0127    eb d6           JMP 0xff   
0x0129    61              POPA   
0x012A    f9              STC   
0x012B    c3              RET   
0x012C    49              DEC CX   
0x012D    6e              OUTSB   
0x012E    76 61           JBE 0x191   
0x0130    6c              INSB   
0x0131    6964 20 7061    IMUL SP, [SI+0x20], 0x6170   
0x0136    72 74           JB 0x1ac   
0x0138    6974 69 6f6e    IMUL SI, [SI+0x69], 0x6e6f   
0x013D    2074 61         AND [SI+0x61], DH   
0x0140    626c 65         BOUND BP, [SI+0x65]   
0x0143    0045 72         ADD [DI+0x72], AL   
0x0146    72 6f           JB 0x1b7   
0x0148    72 20           JB 0x16a   
0x014A    6c              INSB   
0x014B    6f              OUTSW   
0x014C    61              POPA   
0x014D    64 696e 67 206f IMUL BP, FS:[BP+0x67], 0x6f20   
0x0153    70 65           JO 0x1ba   
0x0155    72 61           JB 0x1b8   
0x0157    74 69           JZ 0x1c2   
0x0159    6e              OUTSB   
0x015A    67 2073 79      AND [EBX+0x79], DH   
0x015E    73 74           JAE 0x1d4   
0x0160    65 6d           INS WORD GS:[DI], DX   
0x0162    004d 69         ADD [DI+0x69], CL   
0x0165    73 73           JAE 0x1da   
0x0167    696e 67 206f    IMUL BP, [BP+0x67], 0x6f20   
0x016C    70 65           JO 0x1d3   
0x016E    72 61           JB 0x1d1   
0x0170    74 69           JZ 0x1db   
0x0172    6e              OUTSB   
0x0173    67 2073 79      AND [EBX+0x79], DH   
0x0177    73 74           JAE 0x1ed   
0x0179    65 6d           INS WORD GS:[DI], DX   
0x017B    0000            ADD [BX+SI], AL   
0x017D    0000            ADD [BX+SI], AL   
0x017F    0000            ADD [BX+SI], AL   
0x0181    0000            ADD [BX+SI], AL   
0x0183    0000            ADD [BX+SI], AL   
0x0185    0000            ADD [BX+SI], AL   
0x0187    0000            ADD [BX+SI], AL   
0x0189    0000            ADD [BX+SI], AL   
0x018B    0000            ADD [BX+SI], AL   
0x018D    0000            ADD [BX+SI], AL   
0x018F    0000            ADD [BX+SI], AL   
0x0191    0000            ADD [BX+SI], AL   
0x0193    0000            ADD [BX+SI], AL   
0x0195    0000            ADD [BX+SI], AL   
0x0197    0000            ADD [BX+SI], AL   
0x0199    0000            ADD [BX+SI], AL   
0x019B    0000            ADD [BX+SI], AL   
0x019D    0000            ADD [BX+SI], AL   
0x019F    0000            ADD [BX+SI], AL   
0x01A1    0000            ADD [BX+SI], AL   
0x01A3    0000            ADD [BX+SI], AL   
0x01A5    0000            ADD [BX+SI], AL   
0x01A7    0000            ADD [BX+SI], AL   
0x01A9    0000            ADD [BX+SI], AL   
0x01AB    0000            ADD [BX+SI], AL   
0x01AD    0000            ADD [BX+SI], AL   
0x01AF    0000            ADD [BX+SI], AL   
0x01B1    0000            ADD [BX+SI], AL   
0x01B3    0000            ADD [BX+SI], AL   
0x01B5    2c 44           SUB AL, 0x44   
0x01B7    6318            ARPL [BX+SI], BX   
0x01B9    2e              DB 0x2e   
0x01B9    2e 07           POP ES   
0x01BB    c3              RET   
0x01BC    0000            ADD [BX+SI], AL   
0x01BE    8001 01         ADD BYTE [BX+DI], 0x1   
0x01C1    000b            ADD [BP+DI], CL   
0x01C3    80e0 bc         AND AL, 0xbc   
0x01C6    2000            AND [BX+SI], AL   
0x01C8    0000            ADD [BX+SI], AL   
0x01CA    e0 bf           LOOPNZ 0x18b   
0x01CC    3b00            CMP AX, [BX+SI]   
0x01CE    0000            ADD [BX+SI], AL   
0x01D0    0000            ADD [BX+SI], AL   
0x01D2    0000            ADD [BX+SI], AL   
0x01D4    0000            ADD [BX+SI], AL   
0x01D6    0000            ADD [BX+SI], AL   
0x01D8    0000            ADD [BX+SI], AL   
0x01DA    0000            ADD [BX+SI], AL   
0x01DC    0000            ADD [BX+SI], AL   
0x01DE    0000            ADD [BX+SI], AL   
0x01E0    0000            ADD [BX+SI], AL   
0x01E2    0000            ADD [BX+SI], AL   
0x01E4    0000            ADD [BX+SI], AL   
0x01E6    0000            ADD [BX+SI], AL   
0x01E8    0000            ADD [BX+SI], AL   
0x01EA    0000            ADD [BX+SI], AL   
0x01EC    0000            ADD [BX+SI], AL   
0x01EE    0000            ADD [BX+SI], AL   
0x01F0    0000            ADD [BX+SI], AL   
0x01F2    0000            ADD [BX+SI], AL   
0x01F4    0000            ADD [BX+SI], AL   
0x01F6    0000            ADD [BX+SI], AL   
0x01F8    0000            ADD [BX+SI], AL   
0x01FA    0000            ADD [BX+SI], AL   
0x01FC    0000            ADD [BX+SI], AL   
0x01FE    55              PUSH BP   
0x01FF    aa              STOSB

18:23:35.0812 0268 TDSS rootkit removing tool 2.7.48.0 Jul 24 2012 13:16:32
18:23:37.0812 0268 ============================================================
18:23:37.0812 0268 Current date / time: 2012/08/12 18:23:37.0812
18:23:37.0812 0268 SystemInfo:
18:23:37.0812 0268
18:23:37.0812 0268 OS Version: 5.1.2600 ServicePack: 3.0
18:23:37.0812 0268 Product type: Workstation
18:23:37.0812 0268 ComputerName: MARTIN-B598CED7
18:23:37.0812 0268 UserName: Martin
18:23:37.0812 0268 Windows directory: C:\WINDOWS
18:23:37.0812 0268 System windows directory: C:\WINDOWS
18:23:37.0812 0268 Processor architecture: Intel x86
18:23:37.0812 0268 Number of processors: 1
18:23:37.0812 0268 Page size: 0x1000
18:23:37.0812 0268 Boot type: Normal boot
18:23:37.0812 0268 ============================================================
18:23:40.0250 0268 Drive \Device\Harddisk0\DR0 - Size: 0x1BF4290000 (111.82 Gb), SectorSize: 0x200, Cylinders: 0x3904, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000020
18:23:40.0265 0268 Drive \Device\Harddisk1\DR3 - Size: 0x77800000 (1.87 Gb), SectorSize: 0x200, Cylinders: 0xF3, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
18:23:40.0265 0268 ============================================================
18:23:40.0265 0268 \Device\Harddisk0\DR0:
18:23:40.0265 0268 MBR partitions:
18:23:40.0265 0268 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x30D3C74
18:23:40.0296 0268 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x30D3CF2, BlocksNum 0xAECB712
18:23:40.0296 0268 \Device\Harddisk1\DR3:
18:23:40.0296 0268 MBR partitions:
18:23:40.0296 0268 \Device\Harddisk1\DR3\Partition0: MBR, Type 0xB, StartLBA 0x20, BlocksNum 0x3BBFE0
18:23:40.0296 0268 ============================================================
18:23:40.0343 0268 C: <-> \Device\Harddisk0\DR0\Partition0
18:23:40.0359 0268 D: <-> \Device\Harddisk0\DR0\Partition1
18:23:40.0359 0268 ============================================================
18:23:40.0359 0268 Initialize success
18:23:40.0359 0268 ============================================================
18:24:19.0125 2420 ============================================================
18:24:19.0125 2420 Scan started
18:24:19.0125 2420 Mode: Manual; SigCheck; TDLFS;
18:24:19.0125 2420 ============================================================
18:24:19.0593 2420 !SASCORE (c0393eb99a6c72c6bef9bfc4a72b33a6) C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
18:24:19.0750 2420 !SASCORE - ok
18:24:19.0890 2420 602XML Updater (f11d68e40ed62fdb7c460c445f1ec4e5) C:\Program Files\Common Files\soft602\602updsvc\602updsvc.exe
18:24:19.0921 2420 602XML Updater - ok
18:24:20.0015 2420 61883 (914a9709fc3bf419ad2f85547f2a4832) C:\WINDOWS\system32\DRIVERS\61883.sys
18:24:20.0218 2420 61883 - ok
18:24:20.0234 2420 Abiosdsk - ok
18:24:20.0265 2420 abp480n5 - ok
18:24:20.0312 2420 ACPI (4fe34f1f3126b61fcc6b2043aa8112c9) C:\WINDOWS\system32\DRIVERS\ACPI.sys
18:24:20.0578 2420 ACPI - ok
18:24:20.0609 2420 ACPIEC (afdff022a01f0b11c776f0860c3b282f) C:\WINDOWS\system32\drivers\ACPIEC.sys
18:24:20.0812 2420 ACPIEC - ok
18:24:20.0906 2420 AdobeFlashPlayerUpdateSvc (f19c98ad81d2c0e1bbfd8153d2c80ee8) C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
18:24:20.0953 2420 AdobeFlashPlayerUpdateSvc - ok
18:24:20.0984 2420 adpu160m - ok
18:24:21.0031 2420 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
18:24:21.0218 2420 aec - ok
18:24:21.0265 2420 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
18:24:21.0328 2420 AFD - ok
18:24:21.0343 2420 Aha154x - ok
18:24:21.0375 2420 aic78u2 - ok
18:24:21.0406 2420 aic78xx - ok
18:24:21.0593 2420 ALCXWDM (93f93a8e3e14cbbf1ce9a5af1a70c095) C:\WINDOWS\system32\drivers\ALCXWDM.SYS
18:24:21.0890 2420 ALCXWDM - ok
18:24:22.0000 2420 Alerter (e0a6fa244b8624d78fe5ff6f56a33bae) C:\WINDOWS\system32\alrsvc.dll
18:24:22.0156 2420 Alerter - ok
18:24:22.0203 2420 ALG (88842de939a827577bf24243699ac80a) C:\WINDOWS\System32\alg.exe
18:24:22.0281 2420 ALG - ok
18:24:22.0312 2420 AliIde - ok
18:24:22.0375 2420 AmdK8 (59301936898ae62245a6f09c0aba9475) C:\WINDOWS\system32\DRIVERS\AmdK8.sys
18:24:22.0406 2420 AmdK8 - ok
18:24:22.0421 2420 amsint - ok
18:24:22.0437 2420 AppMgmt - ok
18:24:22.0484 2420 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
18:24:22.0687 2420 Arp1394 - ok
18:24:22.0703 2420 ASAPIW2k (4f9cbbf95e8f7a0d4c0edcfe3b78102e) C:\WINDOWS\system32\drivers\ASAPIW2k.sys
18:24:22.0734 2420 ASAPIW2k ( UnsignedFile.Multi.Generic ) - warning
18:24:22.0734 2420 ASAPIW2k - detected UnsignedFile.Multi.Generic (1)
18:24:22.0765 2420 asc - ok
18:24:22.0796 2420 asc3350p - ok
18:24:22.0828 2420 asc3550 - ok
18:24:23.0000 2420 aspnet_state (776acefa0ca9df0faa51a5fb2f435705) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
18:24:23.0015 2420 aspnet_state - ok
18:24:23.0046 2420 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
18:24:23.0250 2420 AsyncMac - ok
18:24:23.0296 2420 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
18:24:23.0500 2420 atapi - ok
18:24:23.0531 2420 Atdisk - ok
18:24:23.0562 2420 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
18:24:23.0781 2420 Atmarpc - ok
18:24:23.0828 2420 AudioSrv (de31b88962a8645dba5a37b993e7b0f1) C:\WINDOWS\System32\audiosrv.dll
18:24:24.0046 2420 AudioSrv - ok
18:24:24.0093 2420 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
18:24:24.0281 2420 audstub - ok
18:24:24.0328 2420 Avc (f8e6956a614f15a0860474c5e2a7de6b) C:\WINDOWS\system32\DRIVERS\avc.sys
18:24:24.0531 2420 Avc - ok
18:24:24.0703 2420 AVG Security Toolbar Service (3a457c2f798cad79cd30224e723e01fb) C:\Program Files\AVG\AVG10\Toolbar\ToolbarBroker.exe
18:24:24.0796 2420 AVG Security Toolbar Service - ok
18:24:24.0843 2420 Avgfwdx (841b0a982065bffc7d7e84009f2fa76f) C:\WINDOWS\system32\DRIVERS\avgfwdx.sys
18:24:24.0859 2420 Avgfwdx - ok
18:24:24.0875 2420 Avgfwfd (841b0a982065bffc7d7e84009f2fa76f) C:\WINDOWS\system32\DRIVERS\avgfwdx.sys
18:24:24.0890 2420 Avgfwfd - ok
18:24:25.0062 2420 avgfws (5cd22eb540f82c70e33e530003f3903b) C:\Program Files\AVG\AVG2012\avgfws.exe
18:24:25.0296 2420 avgfws - ok
18:24:25.0515 2420 AVGIDSAgent (6d440ff3f44ca72edfd6176c6d6a89c0) C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe
18:24:25.0796 2420 AVGIDSAgent - ok
18:24:25.0890 2420 AVGIDSDriver (4fa401b33c1b50c816486f6951244a14) C:\WINDOWS\system32\DRIVERS\AVGIDSDriver.Sys
18:24:25.0906 2420 AVGIDSDriver - ok
18:24:25.0953 2420 AVGIDSEH (69578bc9d43d614c6b3455db4af19762) C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys
18:24:25.0968 2420 AVGIDSEH - ok
18:24:26.0015 2420 AVGIDSFilter (6df528406aa22201f392b9b19121cd6f) C:\WINDOWS\system32\DRIVERS\AVGIDSFilter.Sys
18:24:26.0031 2420 AVGIDSFilter - ok
18:24:26.0062 2420 AVGIDSShim (1e01c2166b5599802bcd61b9691f7476) C:\WINDOWS\system32\DRIVERS\AVGIDSShim.Sys
18:24:26.0078 2420 AVGIDSShim - ok
18:24:26.0125 2420 Avgldx86 (bf8118cd5e2255387b715b534d64acd1) C:\WINDOWS\system32\DRIVERS\avgldx86.sys
18:24:26.0156 2420 Avgldx86 - ok
18:24:26.0187 2420 Avgmfx86 (1c77ef67f196466adc9924cb288afe87) C:\WINDOWS\system32\DRIVERS\avgmfx86.sys
18:24:26.0203 2420 Avgmfx86 - ok
18:24:26.0218 2420 Avgrkx86 (f2038ed7284b79dcef581468121192a9) C:\WINDOWS\system32\DRIVERS\avgrkx86.sys
18:24:26.0281 2420 Avgrkx86 - ok
18:24:26.0343 2420 Avgtdix (a6d562b612216d8d02a35ebeb92366bd) C:\WINDOWS\system32\DRIVERS\avgtdix.sys
18:24:26.0375 2420 Avgtdix - ok
18:24:26.0484 2420 avgwd (6699ece24fe4b3f752a66c66a602ee86) C:\Program Files\AVG\AVG2012\avgwdsvc.exe
18:24:26.0531 2420 avgwd - ok
18:24:26.0578 2420 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
18:24:26.0796 2420 Beep - ok
18:24:26.0890 2420 BITS (19395d092fd85ddc2d9c7729cf5a2ac8) C:\WINDOWS\system32\qmgr.dll
18:24:27.0109 2420 BITS - ok
18:24:27.0156 2420 Browser (249276d3ef1e74b992299cb96099e4d7) C:\WINDOWS\System32\browser.dll
18:24:27.0390 2420 Browser - ok
18:24:27.0437 2420 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
18:24:27.0671 2420 cbidf2k - ok
18:24:27.0718 2420 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
18:24:27.0937 2420 CCDECODE - ok
18:24:27.0953 2420 cd20xrnt - ok
18:24:28.0000 2420 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
18:24:28.0203 2420 Cdaudio - ok
18:24:28.0296 2420 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
18:24:28.0531 2420 Cdfs - ok
18:24:28.0578 2420 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
18:24:28.0843 2420 Cdrom - ok
18:24:28.0875 2420 Changer - ok
18:24:28.0921 2420 CiSvc (e390dc1d7c461d7d56ec53402f329928) C:\WINDOWS\system32\cisvc.exe
18:24:29.0140 2420 CiSvc - ok
18:24:29.0171 2420 ClipSrv (064507a8dfa8c5c7e2ffddd3e6f424fa) C:\WINDOWS\system32\clipsrv.exe
18:24:29.0406 2420 ClipSrv - ok
18:24:29.0640 2420 clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
18:24:29.0671 2420 clr_optimization_v2.0.50727_32 - ok
18:24:29.0953 2420 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
18:24:29.0968 2420 clr_optimization_v4.0.30319_32 - ok
18:24:30.0000 2420 CmdIde - ok
18:24:30.0031 2420 COMSysApp - ok
18:24:30.0093 2420 Cpqarray - ok
18:24:30.0156 2420 CryptSvc (f3ab0933cbd166d271992f411c27ccaf) C:\WINDOWS\System32\cryptsvc.dll
18:24:30.0359 2420 CryptSvc - ok
18:24:30.0375 2420 CrystalSysInfo - ok
18:24:30.0406 2420 dac2w2k - ok
18:24:30.0437 2420 dac960nt - ok
18:24:30.0734 2420 DcomLaunch (be27674d1cbc3214aec84b4336a38bbf) C:\WINDOWS\system32\rpcss.dll
18:24:30.0796 2420 DcomLaunch - ok
18:24:30.0953 2420 Dhcp (8c9a53e285ac5e6704844d0459ec85be) C:\WINDOWS\System32\dhcpcsvc.dll
18:24:31.0171 2420 Dhcp - ok
18:24:31.0203 2420 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
18:24:31.0421 2420 Disk - ok
18:24:31.0437 2420 dmadmin - ok
18:24:31.0500 2420 dmboot (db5fd2bf5b07dc54bfcb3664ff05bd7c) C:\WINDOWS\system32\drivers\dmboot.sys
18:24:31.0734 2420 dmboot - ok
18:24:31.0796 2420 dmio (fff1720af51171f32f1ead5cf71f2810) C:\WINDOWS\system32\drivers\dmio.sys
18:24:32.0031 2420 dmio - ok
18:24:32.0062 2420 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
18:24:32.0265 2420 dmload - ok
18:24:32.0328 2420 dmserver (2bfefe9e865655a76982f050450b9591) C:\WINDOWS\System32\dmserver.dll
18:24:32.0515 2420 dmserver - ok
18:24:32.0562 2420 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
18:24:32.0812 2420 DMusic - ok
18:24:32.0875 2420 Dnscache (dfaa406bf19f4ee806a6f8d4342137f7) C:\WINDOWS\System32\dnsrslvr.dll
18:24:32.0937 2420 Dnscache - ok
18:24:33.0000 2420 Dot3svc (4a3e2bd20157a0946751229e92eb8621) C:\WINDOWS\System32\dot3svc.dll
18:24:33.0187 2420 Dot3svc - ok
18:24:33.0218 2420 dpti2o - ok
18:24:33.0281 2420 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
18:24:33.0484 2420 drmkaud - ok
18:24:33.0500 2420 EapHost (0887d9c2be8d940778cad1e3b85f2a41) C:\WINDOWS\System32\eapsvc.dll
18:24:33.0734 2420 EapHost - ok
18:24:33.0765 2420 ERSvc (a2a4912798f2be706abadd3d30800d16) C:\WINDOWS\System32\ersvc.dll
18:24:34.0031 2420 ERSvc - ok
18:24:34.0078 2420 Eventlog (9ef697af07bb8dd82c3b02ca953a95b7) C:\WINDOWS\system32\services.exe
18:24:34.0109 2420 Eventlog - ok
18:24:34.0156 2420 EventSystem (a371f11ef07653591c8de26afb13ce7f) C:\WINDOWS\system32\es.dll
18:24:34.0187 2420 EventSystem - ok
18:24:34.0234 2420 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
18:24:34.0390 2420 Fastfat - ok
18:24:34.0437 2420 FastUserSwitchingCompatibility (ee9a2b9ea968a792a053c9d1a86bf870) C:\WINDOWS\System32\shsvcs.dll
18:24:34.0484 2420 FastUserSwitchingCompatibility - ok
18:24:34.0531 2420 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
18:24:34.0781 2420 Fdc - ok
18:24:34.0828 2420 FET5X86V (e7072827d0b5f9bd99d6961571a38973) C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys
18:24:34.0875 2420 FET5X86V - ok
18:24:34.0890 2420 FETND5BV (e7072827d0b5f9bd99d6961571a38973) C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys
18:24:34.0937 2420 FETND5BV - ok
18:24:34.0984 2420 FETNDIS (e9648254056bce81a85380c0c3647dc4) C:\WINDOWS\system32\DRIVERS\fetnd5.sys
18:24:35.0203 2420 FETNDIS - ok
18:24:35.0265 2420 Fips (ac366695a0796560aa37215ad5762aaf) C:\WINDOWS\system32\drivers\Fips.sys
18:24:35.0468 2420 Fips - ok
18:24:35.0500 2420 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
18:24:35.0703 2420 Flpydisk - ok
18:24:35.0765 2420 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
18:24:35.0953 2420 FltMgr - ok
18:24:36.0046 2420 FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
18:24:36.0062 2420 FontCache3.0.0.0 - ok
18:24:36.0125 2420 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
18:24:36.0359 2420 Fs_Rec - ok
18:24:36.0390 2420 Ftdisk (4e664d8541db4a66b73a24257e322e1f) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
18:24:36.0578 2420 Ftdisk - ok
18:24:36.0625 2420 gagp30kx (3a74c423cf6bcca6982715878f450a3b) C:\WINDOWS\system32\DRIVERS\gagp30kx.sys
18:24:37.0015 2420 gagp30kx - ok
18:24:37.0046 2420 gameenum (065639773d8b03f33577f6cdaea21063) C:\WINDOWS\system32\DRIVERS\gameenum.sys
18:24:37.0265 2420 gameenum - ok
18:24:37.0296 2420 GEARAspiWDM (4ac51459805264affd5f6fdfb9d9235f) C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys
18:24:37.0312 2420 GEARAspiWDM - ok
18:24:37.0375 2420 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
18:24:37.0625 2420 Gpc - ok
18:24:37.0703 2420 helpsvc (fcfe31fb75f8a6295b6b0af87a626282) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
18:24:37.0906 2420 helpsvc - ok
18:24:37.0937 2420 HidServ - ok
18:24:38.0000 2420 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
18:24:38.0218 2420 HidUsb - ok
18:24:38.0250 2420 hkmsvc (7a6b320928f86bc851530d63c82965d9) C:\WINDOWS\System32\kmsvc.dll
18:24:38.0453 2420 hkmsvc - ok
18:24:38.0468 2420 hpn - ok
18:24:38.0546 2420 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
18:24:38.0578 2420 HTTP - ok
18:24:38.0609 2420 HTTPFilter (58fe2f2da3bc5573f4a35b3760d3125f) C:\WINDOWS\System32\w3ssl.dll
18:24:38.0859 2420 HTTPFilter - ok
18:24:38.0890 2420 i2omgmt - ok
18:24:38.0921 2420 i2omp - ok
18:24:39.0000 2420 i8042prt (c528e27945367191e7bae364930b6932) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
18:24:39.0328 2420 i8042prt - ok
18:24:39.0437 2420 IDriverT (daf66902f08796f9c694901660e5a64a) C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
18:24:39.0453 2420 IDriverT ( UnsignedFile.Multi.Generic ) - warning
18:24:39.0453 2420 IDriverT - detected UnsignedFile.Multi.Generic (1)
18:24:39.0546 2420 idsvc (c01ac32dc5c03076cfb852cb5da5229c) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
18:24:39.0625 2420 idsvc - ok
18:24:39.0671 2420 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
18:24:39.0890 2420 Imapi - ok
18:24:39.0968 2420 ImapiService (f7b93aafad33b2320954c17e26c8d361) C:\WINDOWS\system32\imapi.exe
18:24:40.0140 2420 ImapiService - ok
18:24:40.0171 2420 ini910u - ok
18:24:40.0203 2420 IntelIde - ok
18:24:40.0250 2420 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
18:24:40.0437 2420 Ip6Fw - ok
18:24:40.0484 2420 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
18:24:40.0703 2420 IpFilterDriver - ok
18:24:40.0718 2420 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
18:24:40.0921 2420 IpInIp - ok
18:24:41.0000 2420 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
18:24:41.0187 2420 IpNat - ok
18:24:41.0218 2420 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
18:24:41.0421 2420 IPSec - ok
18:24:41.0453 2420 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
18:24:41.0531 2420 IRENUM - ok
18:24:41.0578 2420 isapnp (cc9f8a2d60aed1a51a3ac34c59b987ae) C:\WINDOWS\system32\DRIVERS\isapnp.sys
18:24:41.0765 2420 isapnp - ok
18:24:41.0890 2420 JavaQuickStarterService (0a5709543986843d37a92290b7838340) C:\Program Files\Java\jre6\bin\jqs.exe
18:24:41.0906 2420 JavaQuickStarterService - ok
18:24:41.0937 2420 Kbdclass (1b6162fe7f66b1a71a4b70f941c4aa9b) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
18:24:42.0156 2420 Kbdclass - ok
18:24:42.0203 2420 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
18:24:42.0375 2420 kmixer - ok
18:24:42.0421 2420 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
18:24:42.0453 2420 KSecDD - ok
18:24:42.0515 2420 lanmanserver (3428e8f86f8add36b42fb23542c7b3e4) C:\WINDOWS\System32\srvsvc.dll
18:24:42.0546 2420 lanmanserver - ok
18:24:42.0609 2420 lanmanworkstation (936c1d110232d23b621cb0196e4f80f0) C:\WINDOWS\System32\wkssvc.dll
18:24:42.0656 2420 lanmanworkstation - ok
18:24:42.0687 2420 lbrtfdc - ok
18:24:42.0781 2420 LmHosts (0ab159f536e3e8f7f07113702a07cca5) C:\WINDOWS\System32\lmhsvc.dll
18:24:42.0968 2420 LmHosts - ok
18:24:43.0031 2420 MarvinBus (d51e16339213898bc20c58670274ec3e) C:\WINDOWS\system32\DRIVERS\MarvinBus.sys
18:24:43.0062 2420 MarvinBus - ok
18:24:43.0156 2420 MDM (11f714f85530a2bd134074dc30e99fca) C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
18:24:43.0187 2420 MDM - ok
18:24:43.0218 2420 Messenger (221cd1c815b8a6b79389c3f5d1018de8) C:\WINDOWS\System32\msgsvc.dll
18:24:43.0437 2420 Messenger - ok
18:24:43.0468 2420 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
18:24:43.0687 2420 mnmdd - ok
18:24:43.0734 2420 mnmsrvc (9a57d046f88f4b69751b11fd40088a61) C:\WINDOWS\system32\mnmsrvc.exe
18:24:43.0921 2420 mnmsrvc - ok
18:24:43.0984 2420 Modem (44032b0c6d9954d3fd26438330b99ee7) C:\WINDOWS\system32\drivers\Modem.sys
18:24:44.0171 2420 Modem - ok
18:24:44.0218 2420 Mouclass (4cb582831dbde63ce43b45d771218374) C:\WINDOWS\system32\DRIVERS\mouclass.sys
18:24:44.0437 2420 Mouclass - ok
18:24:44.0468 2420 mouhid (bb269eba740737ab749b214d568b6812) C:\WINDOWS\system32\DRIVERS\mouhid.sys
18:24:44.0687 2420 mouhid - ok
18:24:44.0750 2420 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
18:24:44.0906 2420 MountMgr - ok
18:24:44.0921 2420 mraid35x - ok
18:24:44.0953 2420 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
18:24:45.0125 2420 MRxDAV - ok
18:24:45.0203 2420 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
18:24:45.0250 2420 MRxSmb - ok
18:24:45.0296 2420 MSDTC (6db4d1521caba9a5ffab54ade0ae867d) C:\WINDOWS\system32\msdtc.exe
18:24:45.0531 2420 MSDTC - ok
18:24:45.0609 2420 MSDV (1477849772712bac69c144dcf2c9ce81) C:\WINDOWS\system32\DRIVERS\msdv.sys
18:24:45.0796 2420 MSDV - ok
18:24:45.0843 2420 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
18:24:46.0046 2420 Msfs - ok
18:24:46.0062 2420 MSIServer - ok
18:24:46.0093 2420 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
18:24:46.0296 2420 MSKSSRV - ok
18:24:46.0328 2420 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
18:24:46.0546 2420 MSPCLOCK - ok
18:24:46.0578 2420 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
18:24:46.0796 2420 MSPQM - ok
18:24:46.0843 2420 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
18:24:47.0046 2420 mssmbios - ok
18:24:47.0078 2420 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
18:24:47.0250 2420 MSTEE - ok
18:24:47.0296 2420 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
18:24:47.0343 2420 Mup - ok
18:24:47.0375 2420 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
18:24:47.0578 2420 NABTSFEC - ok
18:24:47.0671 2420 napagent (6ea362e9db03d44f6b996f4d8be237e9) C:\WINDOWS\System32\qagentrt.dll
18:24:47.0859 2420 napagent - ok
18:24:47.0937 2420 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
18:24:48.0140 2420 NDIS - ok
18:24:48.0171 2420 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
18:24:48.0375 2420 NdisIP - ok
18:24:48.0421 2420 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
18:24:48.0453 2420 NdisTapi - ok
18:24:48.0500 2420 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
18:24:48.0687 2420 Ndisuio - ok
18:24:48.0703 2420 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
18:24:48.0890 2420 NdisWan - ok
18:24:48.0937 2420 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
18:24:49.0015 2420 NDProxy - ok
18:24:49.0046 2420 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
18:24:49.0234 2420 NetBIOS - ok
18:24:49.0281 2420 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
18:24:49.0468 2420 NetBT - ok
18:24:49.0515 2420 NetDDE (933de774986ec85e48210c44ab431de6) C:\WINDOWS\system32\netdde.exe
18:24:49.0718 2420 NetDDE - ok
18:24:49.0750 2420 NetDDEdsdm (933de774986ec85e48210c44ab431de6) C:\WINDOWS\system32\netdde.exe
18:24:49.0921 2420 NetDDEdsdm - ok
18:24:49.0968 2420 Netlogon (ed0a176354487ceed65b80a7148ab739) C:\WINDOWS\system32\lsass.exe
18:24:50.0171 2420 Netlogon - ok
18:24:50.0218 2420 Netman (72e1e9e2977be08bdeedb6d8fd9d4d40) C:\WINDOWS\System32\netman.dll
18:24:50.0421 2420 Netman - ok
18:24:50.0515 2420 NetTcpPortSharing (d34612c5d02d026535b3095d620626ae) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
18:24:50.0562 2420 NetTcpPortSharing - ok
18:24:50.0578 2420 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
18:24:50.0765 2420 NIC1394 - ok
18:24:50.0828 2420 Nla (39ee7c3bfbc64ba87cc8cf67386e814c) C:\WINDOWS\System32\mswsock.dll
18:24:50.0859 2420 Nla - ok
18:24:50.0890 2420 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
18:24:51.0109 2420 Npfs - ok
18:24:51.0187 2420 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
18:24:51.0390 2420 Ntfs - ok
18:24:51.0406 2420 NtLmSsp (ed0a176354487ceed65b80a7148ab739) C:\WINDOWS\system32\lsass.exe
18:24:51.0593 2420 NtLmSsp - ok
18:24:51.0671 2420 NtmsSvc (023dd70573d644f3d9c8b1258a7bfd08) C:\WINDOWS\system32\ntmssvc.dll
18:24:51.0890 2420 NtmsSvc - ok
18:24:51.0937 2420 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
18:24:52.0140 2420 Null - ok
18:24:52.0531 2420 nv (8c0456001b6900114bbb1c548bd8aaf5) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
18:24:52.0984 2420 nv - ok
18:24:53.0093 2420 NVSvc (472a00d2183c9e5edb3e076272741812) C:\WINDOWS\system32\nvsvc32.exe
18:24:53.0140 2420 NVSvc - ok
18:24:53.0171 2420 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
18:24:53.0421 2420 NwlnkFlt - ok
18:24:53.0453 2420 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
18:24:53.0656 2420 NwlnkFwd - ok
18:24:53.0718 2420 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
18:24:53.0921 2420 ohci1394 - ok
18:24:53.0984 2420 ose (7a56cf3e3f12e8af599963b16f50fb6a) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
18:24:54.0015 2420 ose - ok
18:24:54.0078 2420 Parport (46f8db73b4a53e543f8e371dc7c75bae) C:\WINDOWS\system32\DRIVERS\parport.sys
18:24:54.0281 2420 Parport - ok
18:24:54.0312 2420 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
18:24:54.0484 2420 PartMgr - ok
18:24:54.0546 2420 ParVdm (1fae19d0457176318bba4a8795656ebc) C:\WINDOWS\system32\drivers\ParVdm.sys
18:24:54.0765 2420 ParVdm - ok
18:24:54.0796 2420 PCI (6ce351d149cb4befc702951e471e1730) C:\WINDOWS\system32\DRIVERS\pci.sys
18:24:54.0984 2420 PCI - ok
18:24:55.0000 2420 PCIDump - ok
18:24:55.0031 2420 PCIIde - ok
18:24:55.0062 2420 PCLEPCI (1bebe7de8508a02650cdce45c664c2a2) C:\WINDOWS\system32\drivers\pclepci.sys
18:24:55.0093 2420 PCLEPCI ( UnsignedFile.Multi.Generic ) - warning
18:24:55.0093 2420 PCLEPCI - detected UnsignedFile.Multi.Generic (1)
18:24:55.0125 2420 Pcmcia (4fc31e6c19a5ce5198b1abff94cae758) C:\WINDOWS\system32\drivers\Pcmcia.sys
18:24:55.0312 2420 Pcmcia - ok
18:24:55.0375 2420 pcouffin (5b6c11de7e839c05248ced8825470fef) C:\WINDOWS\system32\Drivers\pcouffin.sys
18:24:55.0406 2420 pcouffin ( UnsignedFile.Multi.Generic ) - warning
18:24:55.0406 2420 pcouffin - detected UnsignedFile.Multi.Generic (1)
18:24:55.0437 2420 PDCOMP - ok
18:24:55.0468 2420 PDFRAME - ok
18:24:55.0500 2420 PDRELI - ok
18:24:55.0531 2420 PDRFRAME - ok
18:24:55.0562 2420 perc2 - ok
18:24:55.0593 2420 perc2hib - ok
18:24:55.0734 2420 PlugPlay (9ef697af07bb8dd82c3b02ca953a95b7) C:\WINDOWS\system32\services.exe
18:24:55.0765 2420 PlugPlay - ok
18:24:55.0781 2420 Point32 - ok
18:24:55.0843 2420 PolicyAgent (ed0a176354487ceed65b80a7148ab739) C:\WINDOWS\system32\lsass.exe
18:24:56.0015 2420 PolicyAgent - ok
18:24:56.0046 2420 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
18:24:56.0265 2420 PptpMiniport - ok
18:24:56.0296 2420 Processor (7eb15dce4ec3a0220bd796a15c18186e) C:\WINDOWS\system32\DRIVERS\processr.sys
18:24:56.0468 2420 Processor - ok
18:24:56.0500 2420 ProtectedStorage (ed0a176354487ceed65b80a7148ab739) C:\WINDOWS\system32\lsass.exe
18:24:56.0687 2420 ProtectedStorage - ok
18:24:56.0703 2420 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
18:24:56.0953 2420 PSched - ok
18:24:56.0984 2420 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
18:24:57.0171 2420 Ptilink - ok
18:24:57.0187 2420 ql1080 - ok
18:24:57.0203 2420 Ql10wnt - ok
18:24:57.0234 2420 ql12160 - ok
18:24:57.0265 2420 ql1240 - ok
18:24:57.0296 2420 ql1280 - ok
18:24:57.0343 2420 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
18:24:57.0531 2420 RasAcd - ok
18:24:57.0593 2420 RasAuto (2b5e44ea009f2f374b980e1e9a70635d) C:\WINDOWS\System32\rasauto.dll
18:24:57.0781 2420 RasAuto - ok
18:24:57.0812 2420 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
18:24:58.0031 2420 Rasl2tp - ok
18:24:58.0078 2420 RasMan (d57554c664b64604bd1ee13ea2c07e77) C:\WINDOWS\System32\rasmans.dll
18:24:58.0250 2420 RasMan - ok
18:24:58.0296 2420 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
18:24:58.0484 2420 RasPppoe - ok
18:24:58.0515 2420 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
18:24:58.0687 2420 Raspti - ok
18:24:58.0734 2420 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
18:24:58.0937 2420 Rdbss - ok
18:24:58.0984 2420 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
18:24:59.0156 2420 RDPCDD - ok
18:24:59.0218 2420 RDPWD (6589db6e5969f8eee594cf71171c5028) C:\WINDOWS\system32\drivers\RDPWD.sys
18:24:59.0281 2420 RDPWD - ok
18:24:59.0312 2420 RDSessMgr (c0d9d9711cb74ee9bc66353d8cbdab0e) C:\WINDOWS\system32\sessmgr.exe
18:24:59.0500 2420 RDSessMgr - ok
18:24:59.0546 2420 redbook (611bfd220305be3a85ae876ea47d4aa5) C:\WINDOWS\system32\DRIVERS\redbook.sys
18:24:59.0750 2420 redbook - ok
18:24:59.0781 2420 RemoteAccess (127c26b5371651043450e52542099aba) C:\WINDOWS\System32\mprdim.dll
18:24:59.0984 2420 RemoteAccess - ok
18:25:00.0015 2420 RpcLocator (718b3bdc0bc3c2f7d065a53d26202af9) C:\WINDOWS\system32\locator.exe
18:25:00.0250 2420 RpcLocator - ok
18:25:00.0328 2420 RpcSs (be27674d1cbc3214aec84b4336a38bbf) C:\WINDOWS\system32\rpcss.dll
18:25:00.0359 2420 RpcSs - ok
18:25:00.0421 2420 RSVP (09ab2e71e58b078038e3bfdba7ffc984) C:\WINDOWS\system32\rsvp.exe
18:25:00.0593 2420 RSVP - ok
18:25:00.0625 2420 s125bus (06847aa6f3a9bf7c44134d00a2e578c0) C:\WINDOWS\system32\DRIVERS\s125bus.sys
18:25:00.0640 2420 s125bus - ok
18:25:00.0687 2420 s125mdfl (f83f88e1b125308fb5015ea0349502b0) C:\WINDOWS\system32\DRIVERS\s125mdfl.sys
18:25:00.0703 2420 s125mdfl - ok
18:25:00.0843 2420 s125mdm (402a97756c14940ad6ae5169c2fb105e) C:\WINDOWS\system32\DRIVERS\s125mdm.sys
18:25:00.0875 2420 s125mdm - ok
18:25:00.0906 2420 s125mgmt (82b14c51de76825ec769a6374e4c57d6) C:\WINDOWS\system32\DRIVERS\s125mgmt.sys
18:25:00.0937 2420 s125mgmt - ok
18:25:00.0968 2420 s125obex (bedfc5707c356fd073bf1a4afe442d91) C:\WINDOWS\system32\DRIVERS\s125obex.sys
18:25:00.0984 2420 s125obex - ok
18:25:01.0046 2420 SamSs (ed0a176354487ceed65b80a7148ab739) C:\WINDOWS\system32\lsass.exe
18:25:01.0218 2420 SamSs - ok
18:25:01.0281 2420 SASDIFSV (39763504067962108505bff25f024345) C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
18:25:01.0328 2420 SASDIFSV - ok
18:25:01.0359 2420 SASKUTIL (77b9fc20084b48408ad3e87570eb4a85) C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
18:25:01.0390 2420 SASKUTIL - ok
18:25:01.0421 2420 SCardSvr (410046e401eb11e1e6749e9deea41d4a) C:\WINDOWS\System32\SCardSvr.exe
18:25:01.0640 2420 SCardSvr - ok
18:25:01.0703 2420 Schedule (3ff232a7731621b8902d81d42418c93c) C:\WINDOWS\system32\schedsvc.dll
18:25:01.0906 2420 Schedule - ok
18:25:02.0031 2420 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
18:25:02.0171 2420 Secdrv - ok
18:25:02.0296 2420 seclogon (477e2c3cc5e4a0d635bcb0ea8dcac3c6) C:\WINDOWS\System32\seclogon.dll
18:25:02.0515 2420 seclogon - ok
18:25:02.0593 2420 SENS (a530b75c10c23c9ab28fdb6ce719e21f) C:\WINDOWS\system32\sens.dll
18:25:02.0796 2420 SENS - ok
18:25:02.0843 2420 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
18:25:03.0031 2420 serenum - ok
18:25:03.0062 2420 Serial (b842729337c9b921615c40d3c1a1af96) C:\WINDOWS\system32\DRIVERS\serial.sys
18:25:03.0281 2420 Serial - ok
18:25:03.0390 2420 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\DRIVERS\sfloppy.sys
18:25:03.0625 2420 Sfloppy - ok
18:25:04.0500 2420 SharedAccess (f58faca9621d2db01bd0927d9a0a208e) C:\WINDOWS\System32\ipnathlp.dll
18:25:04.0703 2420 SharedAccess - ok
18:25:05.0093 2420 ShellHWDetection (ee9a2b9ea968a792a053c9d1a86bf870) C:\WINDOWS\System32\shsvcs.dll
18:25:05.0109 2420 ShellHWDetection - ok
18:25:05.0140 2420 Simbad - ok
18:25:05.0187 2420 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
18:25:05.0406 2420 SLIP - ok
18:25:05.0453 2420 Sparrow - ok
18:25:05.0484 2420 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
18:25:05.0718 2420 splitter - ok
18:25:05.0890 2420 Spooler (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe
18:25:05.0937 2420 Spooler - ok
18:25:06.0265 2420 sr (94610c8653635e4459316a0050d55ce7) C:\WINDOWS\system32\DRIVERS\sr.sys
18:25:06.0390 2420 sr - ok
18:25:06.0796 2420 srservice (35b91147124f64ac8081a2edb9ea4dee) C:\WINDOWS\system32\srsvc.dll
18:25:06.0890 2420 srservice - ok
18:25:06.0984 2420 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
18:25:07.0031 2420 Srv - ok
18:25:07.0062 2420 SSDPSRV (becd5271dc4e3b7c3d035f790fcbc1e5) C:\WINDOWS\System32\ssdpsrv.dll
18:25:07.0156 2420 SSDPSRV - ok
18:25:07.0218 2420 stisvc (c1cdd9275f6a115bb0ae1d55d8d27ba6) C:\WINDOWS\system32\wiaservc.dll
18:25:07.0406 2420 stisvc - ok
18:25:07.0437 2420 StMp3Rec - ok
18:25:07.0484 2420 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
18:25:07.0687 2420 streamip - ok
18:25:07.0734 2420 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
18:25:07.0968 2420 swenum - ok
18:25:08.0015 2420 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
18:25:08.0218 2420 swmidi - ok
18:25:08.0250 2420 SwPrv - ok
18:25:08.0296 2420 symc810 - ok
18:25:08.0328 2420 symc8xx - ok
18:25:08.0359 2420 sym_hi - ok
18:25:08.0390 2420 sym_u3 - ok
18:25:08.0437 2420 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
18:25:08.0640 2420 sysaudio - ok
18:25:08.0671 2420 SysmonLog (ce06f01b88ace199a1bf460cac29c110) C:\WINDOWS\system32\smlogsvc.exe
18:25:08.0875 2420 SysmonLog - ok
18:25:08.0953 2420 TapiSrv (c2546cd7a398476f9df5614b2ae160e8) C:\WINDOWS\System32\tapisrv.dll
18:25:09.0125 2420 TapiSrv - ok
18:25:09.0218 2420 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
18:25:09.0265 2420 Tcpip - ok
18:25:09.0296 2420 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
18:25:09.0484 2420 TDPIPE - ok
18:25:09.0531 2420 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
18:25:09.0703 2420 TDTCP - ok
18:25:09.0750 2420 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
18:25:09.0953 2420 TermDD - ok
18:25:10.0031 2420 TermService (a75dd6fc3dbee4fff5ebc9f2c28bb66e) C:\WINDOWS\System32\termsrv.dll
18:25:10.0250 2420 TermService - ok
18:25:10.0312 2420 Themes (ee9a2b9ea968a792a053c9d1a86bf870) C:\WINDOWS\System32\shsvcs.dll
18:25:10.0328 2420 Themes - ok
18:25:10.0343 2420 TosIde - ok
18:25:10.0406 2420 TrkWks (38853304ccb938d30e0c4cde8d2c2a8a) C:\WINDOWS\system32\trkwks.dll
18:25:10.0578 2420 TrkWks - ok
18:25:10.0640 2420 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
18:25:10.0843 2420 Udfs - ok
18:25:10.0875 2420 ultra - ok
18:25:10.0968 2420 UnlockerDriver5 (bb879dcfd22926efbeb3298129898cbb) C:\Program Files\Unlocker\UnlockerDriver5.sys
18:25:10.0984 2420 UnlockerDriver5 ( UnsignedFile.Multi.Generic ) - warning
18:25:10.0984 2420 UnlockerDriver5 - detected UnsignedFile.Multi.Generic (1)
18:25:11.0078 2420 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
18:25:11.0265 2420 Update - ok
18:25:11.0328 2420 upnphost (651bd90dcee5b7bdc74a2eb7c9266f9e) C:\WINDOWS\System32\upnphost.dll
18:25:11.0437 2420 upnphost - ok
18:25:11.0468 2420 UPS (20a0f6a11959e92908717d09e87d670d) C:\WINDOWS\System32\ups.exe
18:25:11.0640 2420 UPS - ok
18:25:11.0687 2420 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
18:25:11.0890 2420 usbccgp - ok
18:25:11.0921 2420 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
18:25:12.0140 2420 usbehci - ok
18:25:12.0203 2420 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
18:25:12.0375 2420 usbhub - ok
18:25:12.0421 2420 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
18:25:12.0625 2420 usbprint - ok
18:25:12.0656 2420 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
18:25:12.0828 2420 usbscan - ok
18:25:12.0875 2420 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
18:25:13.0062 2420 USBSTOR - ok
18:25:13.0109 2420 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
18:25:13.0296 2420 usbuhci - ok
18:25:13.0328 2420 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
18:25:13.0562 2420 VgaSave - ok
18:25:13.0593 2420 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys
18:25:13.0781 2420 ViaIde - ok
18:25:13.0812 2420 viamraid (9f3f276c7300ed211129757a411b605f) C:\WINDOWS\system32\DRIVERS\viamraid.sys
18:25:13.0859 2420 viamraid - ok
18:25:13.0890 2420 videX32 (c8ee49fa76eb7c41a9cddfe58151a74e) C:\WINDOWS\system32\DRIVERS\videX32.sys
18:25:13.0921 2420 videX32 - ok
18:25:13.0968 2420 VolSnap (28a4b296b47782173c346e376cb374d1) C:\WINDOWS\system32\drivers\VolSnap.sys
18:25:14.0171 2420 VolSnap - ok
18:25:14.0218 2420 VSS (d6ba1a63d9e00933f1cd2a885573afb2) C:\WINDOWS\System32\vssvc.exe
18:25:14.0312 2420 VSS - ok
18:25:14.0437 2420 vToolbarUpdater11.2.0 (8ed347bad8d1fb7c40b593bfb01786d2) C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe
18:25:14.0531 2420 vToolbarUpdater11.2.0 - ok
18:25:14.0593 2420 W32Time (fa4e1cdba256787f2149f4aad07bc91f) C:\WINDOWS\system32\w32time.dll
18:25:14.0765 2420 W32Time - ok
18:25:14.0828 2420 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
18:25:15.0000 2420 Wanarp - ok
18:25:15.0046 2420 wceusbsh (46a247f6617526afe38b6f12f5512120) C:\WINDOWS\system32\DRIVERS\wceusbsh.sys
18:25:15.0093 2420 wceusbsh - ok
18:25:15.0125 2420 WDICA - ok
18:25:15.0171 2420 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
18:25:15.0375 2420 wdmaud - ok
18:25:15.0421 2420 WebClient (47ae51048a82dfa1cd6b51d369f7e169) C:\WINDOWS\System32\webclnt.dll
18:25:15.0625 2420 WebClient - ok
18:25:15.0703 2420 WinDefend (f45dd1e1365d857dd08bc23563370d0e) C:\Program Files\Windows Defender\MsMpEng.exe
18:25:15.0734 2420 WinDefend - ok
18:25:15.0859 2420 winmgmt (e488332126e3b1182d2b8a0c35408ec6) C:\WINDOWS\system32\wbem\WMIsvc.dll
18:25:16.0031 2420 winmgmt - ok
18:25:16.0125 2420 WinRM (4d34cedd74bdbf2b6a935eae3bf80543) C:\WINDOWS\system32\WsmSvc.dll
18:25:16.0218 2420 WinRM - ok
18:25:16.0296 2420 WmdmPmSN (c51b4a5c05a5475708e3c81c7765b71d) C:\WINDOWS\system32\MsPMSNSv.dll
18:25:16.0328 2420 WmdmPmSN - ok
18:25:16.0421 2420 WmiApSrv (23f6f03272f7e5679f1f050aed5acee6) C:\WINDOWS\system32\wbem\wmiapsrv.exe
18:25:16.0671 2420 WmiApSrv - ok
18:25:16.0765 2420 WMPNetworkSvc (3739866d20abd42f26a7b85f9e2560af) C:\Program Files\Windows Media Player\WMPNetwk.exe
18:25:16.0859 2420 WMPNetworkSvc - ok
18:25:16.0906 2420 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys
18:25:16.0953 2420 WpdUsb - ok
18:25:17.0109 2420 WPFFontCache_v0400 (dcf3e3edf5109ee8bc02fe6e1f045795) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
18:25:17.0171 2420 WPFFontCache_v0400 - ok
18:25:17.0250 2420 wscsvc (4c86d5faf78194995af9cc1075f65dd3) C:\WINDOWS\system32\wscsvc.dll
18:25:17.0437 2420 wscsvc - ok
18:25:17.0453 2420 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
18:25:17.0656 2420 WSTCODEC - ok
18:25:17.0687 2420 wuauserv (c1364564800ee9784192145324a23308) C:\WINDOWS\system32\wuauserv.dll
18:25:17.0875 2420 wuauserv - ok
18:25:17.0921 2420 WudfPf (50eb9e21963b4f06fd010d007d54351b) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
18:25:17.0953 2420 WudfPf - ok
18:25:18.0000 2420 WudfRd (6e209664bdea8a15b5e8e480d6c607c2) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
18:25:18.0031 2420 WudfRd - ok
18:25:18.0062 2420 WudfSvc (ae93084d2d236887ba56467ae42b4955) C:\WINDOWS\System32\WUDFSvc.dll
18:25:18.0109 2420 WudfSvc - ok
18:25:18.0171 2420 WZCSVC (a27d4ba7264c0bf52f32d10405bea1d4) C:\WINDOWS\System32\wzcsvc.dll
18:25:18.0375 2420 WZCSVC - ok
18:25:18.0406 2420 xcpip - ok
18:25:18.0453 2420 xmlprov (eaa4bb9edb3fb10cf8979fe65e63658f) C:\WINDOWS\System32\xmlprov.dll
18:25:18.0640 2420 xmlprov - ok
18:25:18.0687 2420 xpsec - ok
18:25:18.0781 2420 MBR (0x1B8) (413fc2a0c716421b3158746d63736515) \Device\Harddisk0\DR0
18:25:19.0296 2420 \Device\Harddisk0\DR0 - ok
18:25:19.0328 2420 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk1\DR3
18:25:23.0312 2420 \Device\Harddisk1\DR3 - ok
18:25:23.0359 2420 Boot (0x1200) (2a428c9241450d392bb02fe064243745) \Device\Harddisk0\DR0\Partition0
18:25:23.0359 2420 \Device\Harddisk0\DR0\Partition0 - ok
18:25:23.0375 2420 Boot (0x1200) (742aeba24479ecdfc8cdef1830220a35) \Device\Harddisk0\DR0\Partition1
18:25:23.0390 2420 \Device\Harddisk0\DR0\Partition1 - ok
18:25:23.0390 2420 Boot (0x1200) (74ccb0072e0331b7cbc9b6307ae89ca9) \Device\Harddisk1\DR3\Partition0
18:25:23.0406 2420 \Device\Harddisk1\DR3\Partition0 - ok
18:25:23.0406 2420 ============================================================
18:25:23.0406 2420 Scan finished
18:25:23.0406 2420 ============================================================
18:25:23.0562 2876 Detected object count: 5
18:25:23.0578 2876 Actual detected object count: 5
18:26:02.0656 2876 ASAPIW2k ( UnsignedFile.Multi.Generic ) - skipped by user
18:26:02.0656 2876 ASAPIW2k ( UnsignedFile.Multi.Generic ) - User select action: Skip
18:26:02.0671 2876 IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user
18:26:02.0671 2876 IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip
18:26:02.0671 2876 PCLEPCI ( UnsignedFile.Multi.Generic ) - skipped by user
18:26:02.0671 2876 PCLEPCI ( UnsignedFile.Multi.Generic ) - User select action: Skip
18:26:02.0671 2876 pcouffin ( UnsignedFile.Multi.Generic ) - skipped by user
18:26:02.0671 2876 pcouffin ( UnsignedFile.Multi.Generic ) - User select action: Skip
18:26:02.0687 2876 UnlockerDriver5 ( UnsignedFile.Multi.Generic ) - skipped by user
18:26:02.0687 2876 UnlockerDriver5 ( UnsignedFile.Multi.Generic ) - User select action: Skip

Pro informaci, toto nalezl AVG - v příloze.

Na uvedený odkaz se neze dostat.

Mam nabotovano. Omlouvam se za spozdeni pc je strasne pomale.

Tak zde je log z Avengeru:

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

Driver "xpsec" deleted successfully.
Driver "xcpip" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

A zde z MBRScan:

Kód: Vybrat vše

MBRScan v1.1.1

OS             : Windows XP Home Service Pack 3 (32 bit)
PROCESSOR      : x86 Family 15 Model 44 Stepping 2, AuthenticAMD
BOOT           : Normal Boot
DATE           : 2012/08/12 (ISO 8601) at 21:12:29
________________________________________________________________________________

DISK           : Device\Harddisk0\DR0 __SAMSUNG SP1203N (TL100-30)
BUS_TYPE       : (0x03)  P-ATA
USE_PIO        : YES
MAX_TRANSFER   : 128 Kb
ALIGNMENT_MASK : word aligned
________________________________________________________________________________

DISK           : Device\Harddisk1\DR3 __S31B0906 USB DISK (1100)
BUS_TYPE       : (0x07)  USB
USE_PIO        : NO
MAX_TRANSFER   : 64 Kb
ALIGNMENT_MASK : byte aligned
________________________________________________________________________________

Device\Harddisk0\DR0	111.8 Go  [Fixed] ==> XP MBR Code

MBR_MD5   : 1BB15324C0096C2F2D153733503B7D58
MBR_SHA1  : 49425A091FFAD6994D4CACA6CEAAD21FA58C450A

Device\Harddisk0\Partition1	24.41 Go  	0x07 NTFS / HPFS __ BOOTABLE __
Device\Harddisk0\Partition2	87.40 Go  	0x07 NTFS / HPFS
________________________________________________________________________________

Device\Harddisk1\DR3	1.87 Go  [Removable] ==> XP MBR Code

MBR_MD5   : 1A7A0C164C5B91B2D211A9A4EB07DE1F
MBR_SHA1  : 69245C6CECA93550846177BB5BC2F2BAD35DCF70

Device\Harddisk1\Partition1	1.87 Go __ BOOTABLE __
________________________________________________________________________________

############################### Additional scan ################################

SystemStartOptions : NOEXECUTE=OPTIN  FASTDETECT

________________________________________________________________________________

_______MBR   \Device\Harddisk0\DR0  

0x00000000   33 C0 8E D0 BC 00 7C FB 50 07 50 1F FC BE 1B 7C   3À.Ð¼.|ûP.P.ü¾.|
0x00000010   BF 1B 06 50 57 B9 E5 01 F3 A4 CB BD BE 07 B1 04   ¿..PW¹å.ó¤Ë½¾.±.
0x00000020   38 6E 00 7C 09 75 13 83 C5 10 E2 F4 CD 18 8B F5   8n.|.u..Å.âôÍ..õ
0x00000030   83 C6 10 49 74 19 38 2C 74 F6 A0 B5 07 B4 07 8B   .Æ.It.8,tö.µ.´..
0x00000040   F0 AC 3C 00 74 FC BB 07 00 B4 0E CD 10 EB F2 88   ð¬<.tü»..´.Í.ëò.
0x00000050   4E 10 E8 46 00 73 2A FE 46 10 80 7E 04 0B 74 0B   N.èF.s*þF..~..t.
0x00000060   80 7E 04 0C 74 05 A0 B6 07 75 D2 80 46 02 06 83   .~..t..¶.uÒ.F...
0x00000070   46 08 06 83 56 0A 00 E8 21 00 73 05 A0 B6 07 EB   F...V..è!.s..¶.ë
0x00000080   BC 81 3E FE 7D 55 AA 74 0B 80 7E 10 00 74 C8 A0   ¼.>þ}Uªt..~..tÈ.
0x00000090   B7 07 EB A9 8B FC 1E 57 8B F5 CB BF 05 00 8A 56   ·.ë©.ü.W.õË¿...V
0x000000A0   00 B4 08 CD 13 72 23 8A C1 24 3F 98 8A DE 8A FC   .´.Í.r#.Á$?..Þ.ü
0x000000B0   43 F7 E3 8B D1 86 D6 B1 06 D2 EE 42 F7 E2 39 56   C÷ã.Ñ.Ö±.ÒîB÷â9V
0x000000C0   0A 77 23 72 05 39 46 08 73 1C B8 01 02 BB 00 7C   .w#r.9F.s.¸..».|
0x000000D0   8B 4E 02 8B 56 00 CD 13 73 51 4F 74 4E 32 E4 8A   .N..V.Í.sQOtN2ä.
0x000000E0   56 00 CD 13 EB E4 8A 56 00 60 BB AA 55 B4 41 CD   V.Í.ëä.V.`»ªU´AÍ
0x000000F0   13 72 36 81 FB 55 AA 75 30 F6 C1 01 74 2B 61 60   .r6.ûUªu0öÁ.t+a`
0x00000100   6A 00 6A 00 FF 76 0A FF 76 08 6A 00 68 00 7C 6A   j.j..v..v.j.h.|j
0x00000110   01 6A 10 B4 42 8B F4 CD 13 61 61 73 0E 4F 74 0B   .j.´B.ôÍ.aas.Ot.
0x00000120   32 E4 8A 56 00 CD 13 EB D6 61 F9 C3 4E 65 70 6C   2ä.V.Í.ëÖaùÃNepl
0x00000130   61 74 6E A0 20 74 61 62 75 6C 6B 61 20 6F 64 64   atn. tabulka odd
0x00000140   A1 6C 85 00 43 68 79 62 61 20 70 FD 69 20 6E 61   ¡l..Chyba pýi na
0x00000150   9F A1 74 A0 6E A1 20 6F 70 65 72 61 9F 6E A1 68   .¡t.n¡ opera.n¡h
0x00000160   6F 20 73 79 73 74 82 6D 75 00 4F 70 65 72 61 9F   o syst.mu.Opera.
0x00000170   6E A1 20 73 79 73 74 82 6D 20 6E 65 6E 61 6C 65   n¡ syst.m nenale
0x00000180   7A 65 6E 00 00 00 00 00 00 00 00 00 00 00 00 00   zen.............
0x00000190   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x000001A0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x000001B0   00 00 00 00 00 2C 44 6A E4 43 E5 43 00 00 80 01   .....,DjäCåC....
0x000001C0   01 00 07 FE FF FF 3F 00 00 00 74 3C 0D 03 00 00   ...þ..?...t<....
0x000001D0   C1 FF 0F FE FF FF B3 3C 0D 03 51 B7 EC 0A 00 00   Á..þ..³<..Q·ì...
0x000001E0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x000001F0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA   ..............Uª

__________________________16_BIT_ASM_CODE
   
0x0000    33c0            XOR AX, AX   
0x0002    8ed0            MOV SS, AX   
0x0004    bc 007c         MOV SP, 0x7c00   
0x0007    fb              STI   
0x0008    50              PUSH AX   
0x0009    07              POP ES   
0x000A    50              PUSH AX   
0x000B    1f              POP DS   
0x000C    fc              CLD   
0x000D    be 1b7c         MOV SI, 0x7c1b   
0x0010    bf 1b06         MOV DI, 0x61b   
0x0013    50              PUSH AX   
0x0014    57              PUSH DI   
0x0015    b9 e501         MOV CX, 0x1e5   
0x0018    f3 a4           REP MOVSB   
0x001A    cb              RETF   
0x001B    bd be07         MOV BP, 0x7be   
0x001E    b1 04           MOV CL, 0x4   
0x0020    386e 00         CMP [BP+0x0], CH   
0x0023    7c 09           JL 0x2e   
0x0025    75 13           JNZ 0x3a   
0x0027    83c5 10         ADD BP, 0x10   
0x002A    e2 f4           LOOP 0x20   
0x002C    cd 18           INT 0x18   
0x002E    8bf5            MOV SI, BP   
0x0030    83c6 10         ADD SI, 0x10   
0x0033    49              DEC CX   
0x0034    74 19           JZ 0x4f   
0x0036    382c            CMP [SI], CH   
0x0038    74 f6           JZ 0x30   
0x003A    a0 b507         MOV AL, [0x7b5]   
0x003D    b4 07           MOV AH, 0x7   
0x003F    8bf0            MOV SI, AX   
0x0041    ac              LODSB   
0x0042    3c 00           CMP AL, 0x0   
0x0044    74 fc           JZ 0x42   
0x0046    bb 0700         MOV BX, 0x7   
0x0049    b4 0e           MOV AH, 0xe   
0x004B    cd 10           INT 0x10   
0x004D    eb f2           JMP 0x41   
0x004F    884e 10         MOV [BP+0x10], CL   
0x0052    e8 4600         CALL 0x9b   
0x0055    73 2a           JAE 0x81   
0x0057    fe46 10         INC BYTE [BP+0x10]   
0x005A    807e 04 0b      CMP BYTE [BP+0x4], 0xb   
0x005E    74 0b           JZ 0x6b   
0x0060    807e 04 0c      CMP BYTE [BP+0x4], 0xc   
0x0064    74 05           JZ 0x6b   
0x0066    a0 b607         MOV AL, [0x7b6]   
0x0069    75 d2           JNZ 0x3d   
0x006B    8046 02 06      ADD BYTE [BP+0x2], 0x6   
0x006F    8346 08 06      ADD WORD [BP+0x8], 0x6   
0x0073    8356 0a 00      ADC WORD [BP+0xa], 0x0   
0x0077    e8 2100         CALL 0x9b   
0x007A    73 05           JAE 0x81   
0x007C    a0 b607         MOV AL, [0x7b6]   
0x007F    eb bc           JMP 0x3d   
0x0081    813e fe7d 55aa  CMP WORD [0x7dfe], 0xaa55   
0x0087    74 0b           JZ 0x94   
0x0089    807e 10 00      CMP BYTE [BP+0x10], 0x0   
0x008D    74 c8           JZ 0x57   
0x008F    a0 b707         MOV AL, [0x7b7]   
0x0092    eb a9           JMP 0x3d   
0x0094    8bfc            MOV DI, SP   
0x0096    1e              PUSH DS   
0x0097    57              PUSH DI   
0x0098    8bf5            MOV SI, BP   
0x009A    cb              RETF   
0x009B    bf 0500         MOV DI, 0x5   
0x009E    8a56 00         MOV DL, [BP+0x0]   
0x00A1    b4 08           MOV AH, 0x8   
0x00A3    cd 13           INT 0x13   
0x00A5    72 23           JB 0xca   
0x00A7    8ac1            MOV AL, CL   
0x00A9    24 3f           AND AL, 0x3f   
0x00AB    98              CBW   
0x00AC    8ade            MOV BL, DH   
0x00AE    8afc            MOV BH, AH   
0x00B0    43              INC BX   
0x00B1    f7e3            MUL BX   
0x00B3    8bd1            MOV DX, CX   
0x00B5    86d6            XCHG DH, DL   
0x00B7    b1 06           MOV CL, 0x6   
0x00B9    d2ee            SHR DH, CL   
0x00BB    42              INC DX   
0x00BC    f7e2            MUL DX   
0x00BE    3956 0a         CMP [BP+0xa], DX   
0x00C1    77 23           JA 0xe6   
0x00C3    72 05           JB 0xca   
0x00C5    3946 08         CMP [BP+0x8], AX   
0x00C8    73 1c           JAE 0xe6   
0x00CA    b8 0102         MOV AX, 0x201   
0x00CD    bb 007c         MOV BX, 0x7c00   
0x00D0    8b4e 02         MOV CX, [BP+0x2]   
0x00D3    8b56 00         MOV DX, [BP+0x0]   
0x00D6    cd 13           INT 0x13   
0x00D8    73 51           JAE 0x12b   
0x00DA    4f              DEC DI   
0x00DB    74 4e           JZ 0x12b   
0x00DD    32e4            XOR AH, AH   
0x00DF    8a56 00         MOV DL, [BP+0x0]   
0x00E2    cd 13           INT 0x13   
0x00E4    eb e4           JMP 0xca   
0x00E6    8a56 00         MOV DL, [BP+0x0]   
0x00E9    60              PUSHA   
0x00EA    bb aa55         MOV BX, 0x55aa   
0x00ED    b4 41           MOV AH, 0x41   
0x00EF    cd 13           INT 0x13   
0x00F1    72 36           JB 0x129   
0x00F3    81fb 55aa       CMP BX, 0xaa55   
0x00F7    75 30           JNZ 0x129   
0x00F9    f6c1 01         TEST CL, 0x1   
0x00FC    74 2b           JZ 0x129   
0x00FE    61              POPA   
0x00FF    60              PUSHA   
0x0100    6a 00           PUSH 0x0   
0x0102    6a 00           PUSH 0x0   
0x0104    ff76 0a         PUSH WORD [BP+0xa]   
0x0107    ff76 08         PUSH WORD [BP+0x8]   
0x010A    6a 00           PUSH 0x0   
0x010C    68 007c         PUSH 0x7c00   
0x010F    6a 01           PUSH 0x1   
0x0111    6a 10           PUSH 0x10   
0x0113    b4 42           MOV AH, 0x42   
0x0115    8bf4            MOV SI, SP   
0x0117    cd 13           INT 0x13   
0x0119    61              POPA   
0x011A    61              POPA   
0x011B    73 0e           JAE 0x12b   
0x011D    4f              DEC DI   
0x011E    74 0b           JZ 0x12b   
0x0120    32e4            XOR AH, AH   
0x0122    8a56 00         MOV DL, [BP+0x0]   
0x0125    cd 13           INT 0x13   
0x0127    eb d6           JMP 0xff   
0x0129    61              POPA   
0x012A    f9              STC   
0x012B    c3              RET   
0x012C    4e              DEC SI   
0x012D    65              DB 0x65   
0x012D    65 70 6c        JO 0x19c   
0x0130    61              POPA   
0x0131    74 6e           JZ 0x1a1   
0x0133    a0 2074         MOV AL, [0x7420]   
0x0136    61              POPA   
0x0137    6275 6c         BOUND SI, [DI+0x6c]   
0x013A    6b61 20 6f      IMUL SP, [BX+DI+0x20], 0x6f   
0x013E    64              DB 0x64   
0x013F    64 a1 6c85      MOV AX, FS:[0x856c]   
0x0143    0043 68         ADD [BP+DI+0x68], AL   
0x0146    79 62           JNS 0x1aa   
0x0148    61              POPA   
0x0149    2070 fd         AND [BX+SI-0x3], DH   
0x014C    6920 6e61       IMUL SP, [BX+SI], 0x616e   
0x0150    9f              LAHF   
0x0151    a1 74a0         MOV AX, [0xa074]   
0x0154    6e              OUTSB   
0x0155    a1 206f         MOV AX, [0x6f20]   
0x0158    70 65           JO 0x1bf   
0x015A    72 61           JB 0x1bd   
0x015C    9f              LAHF   
0x015D    6e              OUTSB   
0x015E    a1 686f         MOV AX, [0x6f68]   
0x0161    2073 79         AND [BP+DI+0x79], DH   
0x0164    73 74           JAE 0x1da   
0x0166    826d 75 00      SUB BYTE [DI+0x75], 0x0   
0x016A    4f              DEC DI   
0x016B    70 65           JO 0x1d2   
0x016D    72 61           JB 0x1d0   
0x016F    9f              LAHF   
0x0170    6e              OUTSB   
0x0171    a1 2073         MOV AX, [0x7320]   
0x0174    79 73           JNS 0x1e9   
0x0176    74 82           JZ 0xfa   
0x0178    6d              INSW   
0x0179    206e 65         AND [BP+0x65], CH   
0x017C    6e              OUTSB   
0x017D    61              POPA   
0x017E    6c              INSB   
0x017F    65              DB 0x65   
0x017F    65 7a 65        JP 0x1e7   
0x0182    6e              OUTSB   
0x0183    0000            ADD [BX+SI], AL   
0x0185    0000            ADD [BX+SI], AL   
0x0187    0000            ADD [BX+SI], AL   
0x0189    0000            ADD [BX+SI], AL   
0x018B    0000            ADD [BX+SI], AL   
0x018D    0000            ADD [BX+SI], AL   
0x018F    0000            ADD [BX+SI], AL   
0x0191    0000            ADD [BX+SI], AL   
0x0193    0000            ADD [BX+SI], AL   
0x0195    0000            ADD [BX+SI], AL   
0x0197    0000            ADD [BX+SI], AL   
0x0199    0000            ADD [BX+SI], AL   
0x019B    0000            ADD [BX+SI], AL   
0x019D    0000            ADD [BX+SI], AL   
0x019F    0000            ADD [BX+SI], AL   
0x01A1    0000            ADD [BX+SI], AL   
0x01A3    0000            ADD [BX+SI], AL   
0x01A5    0000            ADD [BX+SI], AL   
0x01A7    0000            ADD [BX+SI], AL   
0x01A9    0000            ADD [BX+SI], AL   
0x01AB    0000            ADD [BX+SI], AL   
0x01AD    0000            ADD [BX+SI], AL   
0x01AF    0000            ADD [BX+SI], AL   
0x01B1    0000            ADD [BX+SI], AL   
0x01B3    0000            ADD [BX+SI], AL   
0x01B5    2c 44           SUB AL, 0x44   
0x01B7    6a e4           PUSH -0x1c   
0x01B9    43              INC BX   
0x01BA    e5 43           IN AX, 0x43   
0x01BC    0000            ADD [BX+SI], AL   
0x01BE    8001 01         ADD BYTE [BX+DI], 0x1   
0x01C1    0007            ADD [BX], AL   
0x01C3    fe              DB 0xfe   
0x01C4    ff              DB 0xff   
0x01C5    ff              DB 0xff   
0x01C6    3f              AAS   
0x01C7    0000            ADD [BX+SI], AL   
0x01C9    0074 3c         ADD [SI+0x3c], DH   
0x01CC    0d 0300         OR AX, 0x3   
0x01CF    00c1            ADD CL, AL   
0x01D1    ff0f            DEC WORD [BX]   
0x01D3    fe              DB 0xfe   
0x01D4    ff              DB 0xff   
0x01D5    ffb3 3c0d       PUSH WORD [BP+DI+0xd3c]   
0x01D9    0351 b7         ADD DX, [BX+DI-0x49]   
0x01DC    ec              IN AL, DX   
0x01DD    0a00            OR AL, [BX+SI]   
0x01DF    0000            ADD [BX+SI], AL   
0x01E1    0000            ADD [BX+SI], AL   
0x01E3    0000            ADD [BX+SI], AL   
0x01E5    0000            ADD [BX+SI], AL   
0x01E7    0000            ADD [BX+SI], AL   
0x01E9    0000            ADD [BX+SI], AL   
0x01EB    0000            ADD [BX+SI], AL   
0x01ED    0000            ADD [BX+SI], AL   
0x01EF    0000            ADD [BX+SI], AL   
0x01F1    0000            ADD [BX+SI], AL   
0x01F3    0000            ADD [BX+SI], AL   
0x01F5    0000            ADD [BX+SI], AL   
0x01F7    0000            ADD [BX+SI], AL   
0x01F9    0000            ADD [BX+SI], AL   
0x01FB    0000            ADD [BX+SI], AL   
0x01FD    0055 aa         ADD [DI-0x56], DL   


_______MBR   \Device\Harddisk1\DR3  

0x00000000   33 C0 8E D0 BC 00 7C FB 50 07 50 1F FC BE 1B 7C   3À.Ð¼.|ûP.P.ü¾.|
0x00000010   BF 1B 06 50 57 B9 E5 01 F3 A4 CB BD BE 07 B1 04   ¿..PW¹å.ó¤Ë½¾.±.
0x00000020   38 6E 00 7C 09 75 13 83 C5 10 E2 F4 CD 18 8B F5   8n.|.u..Å.âôÍ..õ
0x00000030   83 C6 10 49 74 19 38 2C 74 F6 A0 B5 07 B4 07 8B   .Æ.It.8,tö.µ.´..
0x00000040   F0 AC 3C 00 74 FC BB 07 00 B4 0E CD 10 EB F2 88   ð¬<.tü»..´.Í.ëò.
0x00000050   4E 10 E8 46 00 73 2A FE 46 10 80 7E 04 0B 74 0B   N.èF.s*þF..~..t.
0x00000060   80 7E 04 0C 74 05 A0 B6 07 75 D2 80 46 02 06 83   .~..t..¶.uÒ.F...
0x00000070   46 08 06 83 56 0A 00 E8 21 00 73 05 A0 B6 07 EB   F...V..è!.s..¶.ë
0x00000080   BC 81 3E FE 7D 55 AA 74 0B 80 7E 10 00 74 C8 A0   ¼.>þ}Uªt..~..tÈ.
0x00000090   B7 07 EB A9 8B FC 1E 57 8B F5 CB BF 05 00 8A 56   ·.ë©.ü.W.õË¿...V
0x000000A0   00 B4 08 CD 13 72 23 8A C1 24 3F 98 8A DE 8A FC   .´.Í.r#.Á$?..Þ.ü
0x000000B0   43 F7 E3 8B D1 86 D6 B1 06 D2 EE 42 F7 E2 39 56   C÷ã.Ñ.Ö±.ÒîB÷â9V
0x000000C0   0A 77 23 72 05 39 46 08 73 1C B8 01 02 BB 00 7C   .w#r.9F.s.¸..».|
0x000000D0   8B 4E 02 8B 56 00 CD 13 73 51 4F 74 4E 32 E4 8A   .N..V.Í.sQOtN2ä.
0x000000E0   56 00 CD 13 EB E4 8A 56 00 60 BB AA 55 B4 41 CD   V.Í.ëä.V.`»ªU´AÍ
0x000000F0   13 72 36 81 FB 55 AA 75 30 F6 C1 01 74 2B 61 60   .r6.ûUªu0öÁ.t+a`
0x00000100   6A 00 6A 00 FF 76 0A FF 76 08 6A 00 68 00 7C 6A   j.j..v..v.j.h.|j
0x00000110   01 6A 10 B4 42 8B F4 CD 13 61 61 73 0E 4F 74 0B   .j.´B.ôÍ.aas.Ot.
0x00000120   32 E4 8A 56 00 CD 13 EB D6 61 F9 C3 49 6E 76 61   2ä.V.Í.ëÖaùÃInva
0x00000130   6C 69 64 20 70 61 72 74 69 74 69 6F 6E 20 74 61   lid partition ta
0x00000140   62 6C 65 00 45 72 72 6F 72 20 6C 6F 61 64 69 6E   ble.Error loadin
0x00000150   67 20 6F 70 65 72 61 74 69 6E 67 20 73 79 73 74   g operating syst
0x00000160   65 6D 00 4D 69 73 73 69 6E 67 20 6F 70 65 72 61   em.Missing opera
0x00000170   74 69 6E 67 20 73 79 73 74 65 6D 00 00 00 00 00   ting system.....
0x00000180   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x00000190   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x000001A0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x000001B0   00 00 00 00 00 2C 44 63 18 2E 07 C3 00 00 80 01   .....,Dc...Ã....
0x000001C0   01 00 0B 80 E0 BC 20 00 00 00 E0 BF 3B 00 00 00   ....à¼ ...à¿;...
0x000001D0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x000001E0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x000001F0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA   ..............Uª

__________________________16_BIT_ASM_CODE
   
0x0000    33c0            XOR AX, AX   
0x0002    8ed0            MOV SS, AX   
0x0004    bc 007c         MOV SP, 0x7c00   
0x0007    fb              STI   
0x0008    50              PUSH AX   
0x0009    07              POP ES   
0x000A    50              PUSH AX   
0x000B    1f              POP DS   
0x000C    fc              CLD   
0x000D    be 1b7c         MOV SI, 0x7c1b   
0x0010    bf 1b06         MOV DI, 0x61b   
0x0013    50              PUSH AX   
0x0014    57              PUSH DI   
0x0015    b9 e501         MOV CX, 0x1e5   
0x0018    f3 a4           REP MOVSB   
0x001A    cb              RETF   
0x001B    bd be07         MOV BP, 0x7be   
0x001E    b1 04           MOV CL, 0x4   
0x0020    386e 00         CMP [BP+0x0], CH   
0x0023    7c 09           JL 0x2e   
0x0025    75 13           JNZ 0x3a   
0x0027    83c5 10         ADD BP, 0x10   
0x002A    e2 f4           LOOP 0x20   
0x002C    cd 18           INT 0x18   
0x002E    8bf5            MOV SI, BP   
0x0030    83c6 10         ADD SI, 0x10   
0x0033    49              DEC CX   
0x0034    74 19           JZ 0x4f   
0x0036    382c            CMP [SI], CH   
0x0038    74 f6           JZ 0x30   
0x003A    a0 b507         MOV AL, [0x7b5]   
0x003D    b4 07           MOV AH, 0x7   
0x003F    8bf0            MOV SI, AX   
0x0041    ac              LODSB   
0x0042    3c 00           CMP AL, 0x0   
0x0044    74 fc           JZ 0x42   
0x0046    bb 0700         MOV BX, 0x7   
0x0049    b4 0e           MOV AH, 0xe   
0x004B    cd 10           INT 0x10   
0x004D    eb f2           JMP 0x41   
0x004F    884e 10         MOV [BP+0x10], CL   
0x0052    e8 4600         CALL 0x9b   
0x0055    73 2a           JAE 0x81   
0x0057    fe46 10         INC BYTE [BP+0x10]   
0x005A    807e 04 0b      CMP BYTE [BP+0x4], 0xb   
0x005E    74 0b           JZ 0x6b   
0x0060    807e 04 0c      CMP BYTE [BP+0x4], 0xc   
0x0064    74 05           JZ 0x6b   
0x0066    a0 b607         MOV AL, [0x7b6]   
0x0069    75 d2           JNZ 0x3d   
0x006B    8046 02 06      ADD BYTE [BP+0x2], 0x6   
0x006F    8346 08 06      ADD WORD [BP+0x8], 0x6   
0x0073    8356 0a 00      ADC WORD [BP+0xa], 0x0   
0x0077    e8 2100         CALL 0x9b   
0x007A    73 05           JAE 0x81   
0x007C    a0 b607         MOV AL, [0x7b6]   
0x007F    eb bc           JMP 0x3d   
0x0081    813e fe7d 55aa  CMP WORD [0x7dfe], 0xaa55   
0x0087    74 0b           JZ 0x94   
0x0089    807e 10 00      CMP BYTE [BP+0x10], 0x0   
0x008D    74 c8           JZ 0x57   
0x008F    a0 b707         MOV AL, [0x7b7]   
0x0092    eb a9           JMP 0x3d   
0x0094    8bfc            MOV DI, SP   
0x0096    1e              PUSH DS   
0x0097    57              PUSH DI   
0x0098    8bf5            MOV SI, BP   
0x009A    cb              RETF   
0x009B    bf 0500         MOV DI, 0x5   
0x009E    8a56 00         MOV DL, [BP+0x0]   
0x00A1    b4 08           MOV AH, 0x8   
0x00A3    cd 13           INT 0x13   
0x00A5    72 23           JB 0xca   
0x00A7    8ac1            MOV AL, CL   
0x00A9    24 3f           AND AL, 0x3f   
0x00AB    98              CBW   
0x00AC    8ade            MOV BL, DH   
0x00AE    8afc            MOV BH, AH   
0x00B0    43              INC BX   
0x00B1    f7e3            MUL BX   
0x00B3    8bd1            MOV DX, CX   
0x00B5    86d6            XCHG DH, DL   
0x00B7    b1 06           MOV CL, 0x6   
0x00B9    d2ee            SHR DH, CL   
0x00BB    42              INC DX   
0x00BC    f7e2            MUL DX   
0x00BE    3956 0a         CMP [BP+0xa], DX   
0x00C1    77 23           JA 0xe6   
0x00C3    72 05           JB 0xca   
0x00C5    3946 08         CMP [BP+0x8], AX   
0x00C8    73 1c           JAE 0xe6   
0x00CA    b8 0102         MOV AX, 0x201   
0x00CD    bb 007c         MOV BX, 0x7c00   
0x00D0    8b4e 02         MOV CX, [BP+0x2]   
0x00D3    8b56 00         MOV DX, [BP+0x0]   
0x00D6    cd 13           INT 0x13   
0x00D8    73 51           JAE 0x12b   
0x00DA    4f              DEC DI   
0x00DB    74 4e           JZ 0x12b   
0x00DD    32e4            XOR AH, AH   
0x00DF    8a56 00         MOV DL, [BP+0x0]   
0x00E2    cd 13           INT 0x13   
0x00E4    eb e4           JMP 0xca   
0x00E6    8a56 00         MOV DL, [BP+0x0]   
0x00E9    60              PUSHA   
0x00EA    bb aa55         MOV BX, 0x55aa   
0x00ED    b4 41           MOV AH, 0x41   
0x00EF    cd 13           INT 0x13   
0x00F1    72 36           JB 0x129   
0x00F3    81fb 55aa       CMP BX, 0xaa55   
0x00F7    75 30           JNZ 0x129   
0x00F9    f6c1 01         TEST CL, 0x1   
0x00FC    74 2b           JZ 0x129   
0x00FE    61              POPA   
0x00FF    60              PUSHA   
0x0100    6a 00           PUSH 0x0   
0x0102    6a 00           PUSH 0x0   
0x0104    ff76 0a         PUSH WORD [BP+0xa]   
0x0107    ff76 08         PUSH WORD [BP+0x8]   
0x010A    6a 00           PUSH 0x0   
0x010C    68 007c         PUSH 0x7c00   
0x010F    6a 01           PUSH 0x1   
0x0111    6a 10           PUSH 0x10   
0x0113    b4 42           MOV AH, 0x42   
0x0115    8bf4            MOV SI, SP   
0x0117    cd 13           INT 0x13   
0x0119    61              POPA   
0x011A    61              POPA   
0x011B    73 0e           JAE 0x12b   
0x011D    4f              DEC DI   
0x011E    74 0b           JZ 0x12b   
0x0120    32e4            XOR AH, AH   
0x0122    8a56 00         MOV DL, [BP+0x0]   
0x0125    cd 13           INT 0x13   
0x0127    eb d6           JMP 0xff   
0x0129    61              POPA   
0x012A    f9              STC   
0x012B    c3              RET   
0x012C    49              DEC CX   
0x012D    6e              OUTSB   
0x012E    76 61           JBE 0x191   
0x0130    6c              INSB   
0x0131    6964 20 7061    IMUL SP, [SI+0x20], 0x6170   
0x0136    72 74           JB 0x1ac   
0x0138    6974 69 6f6e    IMUL SI, [SI+0x69], 0x6e6f   
0x013D    2074 61         AND [SI+0x61], DH   
0x0140    626c 65         BOUND BP, [SI+0x65]   
0x0143    0045 72         ADD [DI+0x72], AL   
0x0146    72 6f           JB 0x1b7   
0x0148    72 20           JB 0x16a   
0x014A    6c              INSB   
0x014B    6f              OUTSW   
0x014C    61              POPA   
0x014D    64 696e 67 206f IMUL BP, FS:[BP+0x67], 0x6f20   
0x0153    70 65           JO 0x1ba   
0x0155    72 61           JB 0x1b8   
0x0157    74 69           JZ 0x1c2   
0x0159    6e              OUTSB   
0x015A    67 2073 79      AND [EBX+0x79], DH   
0x015E    73 74           JAE 0x1d4   
0x0160    65 6d           INS WORD GS:[DI], DX   
0x0162    004d 69         ADD [DI+0x69], CL   
0x0165    73 73           JAE 0x1da   
0x0167    696e 67 206f    IMUL BP, [BP+0x67], 0x6f20   
0x016C    70 65           JO 0x1d3   
0x016E    72 61           JB 0x1d1   
0x0170    74 69           JZ 0x1db   
0x0172    6e              OUTSB   
0x0173    67 2073 79      AND [EBX+0x79], DH   
0x0177    73 74           JAE 0x1ed   
0x0179    65 6d           INS WORD GS:[DI], DX   
0x017B    0000            ADD [BX+SI], AL   
0x017D    0000            ADD [BX+SI], AL   
0x017F    0000            ADD [BX+SI], AL   
0x0181    0000            ADD [BX+SI], AL   
0x0183    0000            ADD [BX+SI], AL   
0x0185    0000            ADD [BX+SI], AL   
0x0187    0000            ADD [BX+SI], AL   
0x0189    0000            ADD [BX+SI], AL   
0x018B    0000            ADD [BX+SI], AL   
0x018D    0000            ADD [BX+SI], AL   
0x018F    0000            ADD [BX+SI], AL   
0x0191    0000            ADD [BX+SI], AL   
0x0193    0000            ADD [BX+SI], AL   
0x0195    0000            ADD [BX+SI], AL   
0x0197    0000            ADD [BX+SI], AL   
0x0199    0000            ADD [BX+SI], AL   
0x019B    0000            ADD [BX+SI], AL   
0x019D    0000            ADD [BX+SI], AL   
0x019F    0000            ADD [BX+SI], AL   
0x01A1    0000            ADD [BX+SI], AL   
0x01A3    0000            ADD [BX+SI], AL   
0x01A5    0000            ADD [BX+SI], AL   
0x01A7    0000            ADD [BX+SI], AL   
0x01A9    0000            ADD [BX+SI], AL   
0x01AB    0000            ADD [BX+SI], AL   
0x01AD    0000            ADD [BX+SI], AL   
0x01AF    0000            ADD [BX+SI], AL   
0x01B1    0000            ADD [BX+SI], AL   
0x01B3    0000            ADD [BX+SI], AL   
0x01B5    2c 44           SUB AL, 0x44   
0x01B7    6318            ARPL [BX+SI], BX   
0x01B9    2e              DB 0x2e   
0x01B9    2e 07           POP ES   
0x01BB    c3              RET   
0x01BC    0000            ADD [BX+SI], AL   
0x01BE    8001 01         ADD BYTE [BX+DI], 0x1   
0x01C1    000b            ADD [BP+DI], CL   
0x01C3    80e0 bc         AND AL, 0xbc   
0x01C6    2000            AND [BX+SI], AL   
0x01C8    0000            ADD [BX+SI], AL   
0x01CA    e0 bf           LOOPNZ 0x18b   
0x01CC    3b00            CMP AX, [BX+SI]   
0x01CE    0000            ADD [BX+SI], AL   
0x01D0    0000            ADD [BX+SI], AL   
0x01D2    0000            ADD [BX+SI], AL   
0x01D4    0000            ADD [BX+SI], AL   
0x01D6    0000            ADD [BX+SI], AL   
0x01D8    0000            ADD [BX+SI], AL   
0x01DA    0000            ADD [BX+SI], AL   
0x01DC    0000            ADD [BX+SI], AL   
0x01DE    0000            ADD [BX+SI], AL   
0x01E0    0000            ADD [BX+SI], AL   
0x01E2    0000            ADD [BX+SI], AL   
0x01E4    0000            ADD [BX+SI], AL   
0x01E6    0000            ADD [BX+SI], AL   
0x01E8    0000            ADD [BX+SI], AL   
0x01EA    0000            ADD [BX+SI], AL   
0x01EC    0000            ADD [BX+SI], AL   
0x01EE    0000            ADD [BX+SI], AL   
0x01F0    0000            ADD [BX+SI], AL   
0x01F2    0000            ADD [BX+SI], AL   
0x01F4    0000            ADD [BX+SI], AL   
0x01F6    0000            ADD [BX+SI], AL   
0x01F8    0000            ADD [BX+SI], AL   
0x01FA    0000            ADD [BX+SI], AL   
0x01FC    0000            ADD [BX+SI], AL   
0x01FE    55              PUSH BP   
0x01FF    aa              STOSB

Kód: Vybrat vše

MBRScan v1.1.1

OS             : Windows XP Home Service Pack 3 (32 bit)
PROCESSOR      : x86 Family 15 Model 44 Stepping 2, AuthenticAMD
BOOT           : Normal Boot
DATE           : 2012/08/12 (ISO 8601) at 21:20:53
________________________________________________________________________________

DISK           : Device\Harddisk0\DR0 __SAMSUNG SP1203N (TL100-30)
BUS_TYPE       : (0x03)  P-ATA
USE_PIO        : YES
MAX_TRANSFER   : 128 Kb
ALIGNMENT_MASK : word aligned
________________________________________________________________________________

DISK           : Device\Harddisk1\DR3 __S31B0906 USB DISK (1100)
BUS_TYPE       : (0x07)  USB
USE_PIO        : NO
MAX_TRANSFER   : 64 Kb
ALIGNMENT_MASK : byte aligned
________________________________________________________________________________

Device\Harddisk0\DR0	111.8 Go  [Fixed] ==> XP MBR Code

MBR_MD5   : 1BB15324C0096C2F2D153733503B7D58
MBR_SHA1  : 49425A091FFAD6994D4CACA6CEAAD21FA58C450A

Device\Harddisk0\Partition1	24.41 Go  	0x07 NTFS / HPFS __ BOOTABLE __
Device\Harddisk0\Partition2	87.40 Go  	0x07 NTFS / HPFS
________________________________________________________________________________

Device\Harddisk1\DR3	1.87 Go  [Removable] ==> XP MBR Code

MBR_MD5   : 1A7A0C164C5B91B2D211A9A4EB07DE1F
MBR_SHA1  : 69245C6CECA93550846177BB5BC2F2BAD35DCF70

Device\Harddisk1\Partition1	1.87 Go __ BOOTABLE __
________________________________________________________________________________

############################### Additional scan ################################

SystemStartOptions : NOEXECUTE=OPTIN  FASTDETECT

________________________________________________________________________________

_______MBR   \Device\Harddisk0\DR0  

0x00000000   33 C0 8E D0 BC 00 7C FB 50 07 50 1F FC BE 1B 7C   3À.Ð¼.|ûP.P.ü¾.|
0x00000010   BF 1B 06 50 57 B9 E5 01 F3 A4 CB BD BE 07 B1 04   ¿..PW¹å.ó¤Ë½¾.±.
0x00000020   38 6E 00 7C 09 75 13 83 C5 10 E2 F4 CD 18 8B F5   8n.|.u..Å.âôÍ..õ
0x00000030   83 C6 10 49 74 19 38 2C 74 F6 A0 B5 07 B4 07 8B   .Æ.It.8,tö.µ.´..
0x00000040   F0 AC 3C 00 74 FC BB 07 00 B4 0E CD 10 EB F2 88   ð¬<.tü»..´.Í.ëò.
0x00000050   4E 10 E8 46 00 73 2A FE 46 10 80 7E 04 0B 74 0B   N.èF.s*þF..~..t.
0x00000060   80 7E 04 0C 74 05 A0 B6 07 75 D2 80 46 02 06 83   .~..t..¶.uÒ.F...
0x00000070   46 08 06 83 56 0A 00 E8 21 00 73 05 A0 B6 07 EB   F...V..è!.s..¶.ë
0x00000080   BC 81 3E FE 7D 55 AA 74 0B 80 7E 10 00 74 C8 A0   ¼.>þ}Uªt..~..tÈ.
0x00000090   B7 07 EB A9 8B FC 1E 57 8B F5 CB BF 05 00 8A 56   ·.ë©.ü.W.õË¿...V
0x000000A0   00 B4 08 CD 13 72 23 8A C1 24 3F 98 8A DE 8A FC   .´.Í.r#.Á$?..Þ.ü
0x000000B0   43 F7 E3 8B D1 86 D6 B1 06 D2 EE 42 F7 E2 39 56   C÷ã.Ñ.Ö±.ÒîB÷â9V
0x000000C0   0A 77 23 72 05 39 46 08 73 1C B8 01 02 BB 00 7C   .w#r.9F.s.¸..».|
0x000000D0   8B 4E 02 8B 56 00 CD 13 73 51 4F 74 4E 32 E4 8A   .N..V.Í.sQOtN2ä.
0x000000E0   56 00 CD 13 EB E4 8A 56 00 60 BB AA 55 B4 41 CD   V.Í.ëä.V.`»ªU´AÍ
0x000000F0   13 72 36 81 FB 55 AA 75 30 F6 C1 01 74 2B 61 60   .r6.ûUªu0öÁ.t+a`
0x00000100   6A 00 6A 00 FF 76 0A FF 76 08 6A 00 68 00 7C 6A   j.j..v..v.j.h.|j
0x00000110   01 6A 10 B4 42 8B F4 CD 13 61 61 73 0E 4F 74 0B   .j.´B.ôÍ.aas.Ot.
0x00000120   32 E4 8A 56 00 CD 13 EB D6 61 F9 C3 4E 65 70 6C   2ä.V.Í.ëÖaùÃNepl
0x00000130   61 74 6E A0 20 74 61 62 75 6C 6B 61 20 6F 64 64   atn. tabulka odd
0x00000140   A1 6C 85 00 43 68 79 62 61 20 70 FD 69 20 6E 61   ¡l..Chyba pýi na
0x00000150   9F A1 74 A0 6E A1 20 6F 70 65 72 61 9F 6E A1 68   .¡t.n¡ opera.n¡h
0x00000160   6F 20 73 79 73 74 82 6D 75 00 4F 70 65 72 61 9F   o syst.mu.Opera.
0x00000170   6E A1 20 73 79 73 74 82 6D 20 6E 65 6E 61 6C 65   n¡ syst.m nenale
0x00000180   7A 65 6E 00 00 00 00 00 00 00 00 00 00 00 00 00   zen.............
0x00000190   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x000001A0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x000001B0   00 00 00 00 00 2C 44 6A E4 43 E5 43 00 00 80 01   .....,DjäCåC....
0x000001C0   01 00 07 FE FF FF 3F 00 00 00 74 3C 0D 03 00 00   ...þ..?...t<....
0x000001D0   C1 FF 0F FE FF FF B3 3C 0D 03 51 B7 EC 0A 00 00   Á..þ..³<..Q·ì...
0x000001E0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x000001F0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA   ..............Uª

__________________________16_BIT_ASM_CODE
   
0x0000    33c0            XOR AX, AX   
0x0002    8ed0            MOV SS, AX   
0x0004    bc 007c         MOV SP, 0x7c00   
0x0007    fb              STI   
0x0008    50              PUSH AX   
0x0009    07              POP ES   
0x000A    50              PUSH AX   
0x000B    1f              POP DS   
0x000C    fc              CLD   
0x000D    be 1b7c         MOV SI, 0x7c1b   
0x0010    bf 1b06         MOV DI, 0x61b   
0x0013    50              PUSH AX   
0x0014    57              PUSH DI   
0x0015    b9 e501         MOV CX, 0x1e5   
0x0018    f3 a4           REP MOVSB   
0x001A    cb              RETF   
0x001B    bd be07         MOV BP, 0x7be   
0x001E    b1 04           MOV CL, 0x4   
0x0020    386e 00         CMP [BP+0x0], CH   
0x0023    7c 09           JL 0x2e   
0x0025    75 13           JNZ 0x3a   
0x0027    83c5 10         ADD BP, 0x10   
0x002A    e2 f4           LOOP 0x20   
0x002C    cd 18           INT 0x18   
0x002E    8bf5            MOV SI, BP   
0x0030    83c6 10         ADD SI, 0x10   
0x0033    49              DEC CX   
0x0034    74 19           JZ 0x4f   
0x0036    382c            CMP [SI], CH   
0x0038    74 f6           JZ 0x30   
0x003A    a0 b507         MOV AL, [0x7b5]   
0x003D    b4 07           MOV AH, 0x7   
0x003F    8bf0            MOV SI, AX   
0x0041    ac              LODSB   
0x0042    3c 00           CMP AL, 0x0   
0x0044    74 fc           JZ 0x42   
0x0046    bb 0700         MOV BX, 0x7   
0x0049    b4 0e           MOV AH, 0xe   
0x004B    cd 10           INT 0x10   
0x004D    eb f2           JMP 0x41   
0x004F    884e 10         MOV [BP+0x10], CL   
0x0052    e8 4600         CALL 0x9b   
0x0055    73 2a           JAE 0x81   
0x0057    fe46 10         INC BYTE [BP+0x10]   
0x005A    807e 04 0b      CMP BYTE [BP+0x4], 0xb   
0x005E    74 0b           JZ 0x6b   
0x0060    807e 04 0c      CMP BYTE [BP+0x4], 0xc   
0x0064    74 05           JZ 0x6b   
0x0066    a0 b607         MOV AL, [0x7b6]   
0x0069    75 d2           JNZ 0x3d   
0x006B    8046 02 06      ADD BYTE [BP+0x2], 0x6   
0x006F    8346 08 06      ADD WORD [BP+0x8], 0x6   
0x0073    8356 0a 00      ADC WORD [BP+0xa], 0x0   
0x0077    e8 2100         CALL 0x9b   
0x007A    73 05           JAE 0x81   
0x007C    a0 b607         MOV AL, [0x7b6]   
0x007F    eb bc           JMP 0x3d   
0x0081    813e fe7d 55aa  CMP WORD [0x7dfe], 0xaa55   
0x0087    74 0b           JZ 0x94   
0x0089    807e 10 00      CMP BYTE [BP+0x10], 0x0   
0x008D    74 c8           JZ 0x57   
0x008F    a0 b707         MOV AL, [0x7b7]   
0x0092    eb a9           JMP 0x3d   
0x0094    8bfc            MOV DI, SP   
0x0096    1e              PUSH DS   
0x0097    57              PUSH DI   
0x0098    8bf5            MOV SI, BP   
0x009A    cb              RETF   
0x009B    bf 0500         MOV DI, 0x5   
0x009E    8a56 00         MOV DL, [BP+0x0]   
0x00A1    b4 08           MOV AH, 0x8   
0x00A3    cd 13           INT 0x13   
0x00A5    72 23           JB 0xca   
0x00A7    8ac1            MOV AL, CL   
0x00A9    24 3f           AND AL, 0x3f   
0x00AB    98              CBW   
0x00AC    8ade            MOV BL, DH   
0x00AE    8afc            MOV BH, AH   
0x00B0    43              INC BX   
0x00B1    f7e3            MUL BX   
0x00B3    8bd1            MOV DX, CX   
0x00B5    86d6            XCHG DH, DL   
0x00B7    b1 06           MOV CL, 0x6   
0x00B9    d2ee            SHR DH, CL   
0x00BB    42              INC DX   
0x00BC    f7e2            MUL DX   
0x00BE    3956 0a         CMP [BP+0xa], DX   
0x00C1    77 23           JA 0xe6   
0x00C3    72 05           JB 0xca   
0x00C5    3946 08         CMP [BP+0x8], AX   
0x00C8    73 1c           JAE 0xe6   
0x00CA    b8 0102         MOV AX, 0x201   
0x00CD    bb 007c         MOV BX, 0x7c00   
0x00D0    8b4e 02         MOV CX, [BP+0x2]   
0x00D3    8b56 00         MOV DX, [BP+0x0]   
0x00D6    cd 13           INT 0x13   
0x00D8    73 51           JAE 0x12b   
0x00DA    4f              DEC DI   
0x00DB    74 4e           JZ 0x12b   
0x00DD    32e4            XOR AH, AH   
0x00DF    8a56 00         MOV DL, [BP+0x0]   
0x00E2    cd 13           INT 0x13   
0x00E4    eb e4           JMP 0xca   
0x00E6    8a56 00         MOV DL, [BP+0x0]   
0x00E9    60              PUSHA   
0x00EA    bb aa55         MOV BX, 0x55aa   
0x00ED    b4 41           MOV AH, 0x41   
0x00EF    cd 13           INT 0x13   
0x00F1    72 36           JB 0x129   
0x00F3    81fb 55aa       CMP BX, 0xaa55   
0x00F7    75 30           JNZ 0x129   
0x00F9    f6c1 01         TEST CL, 0x1   
0x00FC    74 2b           JZ 0x129   
0x00FE    61              POPA   
0x00FF    60              PUSHA   
0x0100    6a 00           PUSH 0x0   
0x0102    6a 00           PUSH 0x0   
0x0104    ff76 0a         PUSH WORD [BP+0xa]   
0x0107    ff76 08         PUSH WORD [BP+0x8]   
0x010A    6a 00           PUSH 0x0   
0x010C    68 007c         PUSH 0x7c00   
0x010F    6a 01           PUSH 0x1   
0x0111    6a 10           PUSH 0x10   
0x0113    b4 42           MOV AH, 0x42   
0x0115    8bf4            MOV SI, SP   
0x0117    cd 13           INT 0x13   
0x0119    61              POPA   
0x011A    61              POPA   
0x011B    73 0e           JAE 0x12b   
0x011D    4f              DEC DI   
0x011E    74 0b           JZ 0x12b   
0x0120    32e4            XOR AH, AH   
0x0122    8a56 00         MOV DL, [BP+0x0]   
0x0125    cd 13           INT 0x13   
0x0127    eb d6           JMP 0xff   
0x0129    61              POPA   
0x012A    f9              STC   
0x012B    c3              RET   
0x012C    4e              DEC SI   
0x012D    65              DB 0x65   
0x012D    65 70 6c        JO 0x19c   
0x0130    61              POPA   
0x0131    74 6e           JZ 0x1a1   
0x0133    a0 2074         MOV AL, [0x7420]   
0x0136    61              POPA   
0x0137    6275 6c         BOUND SI, [DI+0x6c]   
0x013A    6b61 20 6f      IMUL SP, [BX+DI+0x20], 0x6f   
0x013E    64              DB 0x64   
0x013F    64 a1 6c85      MOV AX, FS:[0x856c]   
0x0143    0043 68         ADD [BP+DI+0x68], AL   
0x0146    79 62           JNS 0x1aa   
0x0148    61              POPA   
0x0149    2070 fd         AND [BX+SI-0x3], DH   
0x014C    6920 6e61       IMUL SP, [BX+SI], 0x616e   
0x0150    9f              LAHF   
0x0151    a1 74a0         MOV AX, [0xa074]   
0x0154    6e              OUTSB   
0x0155    a1 206f         MOV AX, [0x6f20]   
0x0158    70 65           JO 0x1bf   
0x015A    72 61           JB 0x1bd   
0x015C    9f              LAHF   
0x015D    6e              OUTSB   
0x015E    a1 686f         MOV AX, [0x6f68]   
0x0161    2073 79         AND [BP+DI+0x79], DH   
0x0164    73 74           JAE 0x1da   
0x0166    826d 75 00      SUB BYTE [DI+0x75], 0x0   
0x016A    4f              DEC DI   
0x016B    70 65           JO 0x1d2   
0x016D    72 61           JB 0x1d0   
0x016F    9f              LAHF   
0x0170    6e              OUTSB   
0x0171    a1 2073         MOV AX, [0x7320]   
0x0174    79 73           JNS 0x1e9   
0x0176    74 82           JZ 0xfa   
0x0178    6d              INSW   
0x0179    206e 65         AND [BP+0x65], CH   
0x017C    6e              OUTSB   
0x017D    61              POPA   
0x017E    6c              INSB   
0x017F    65              DB 0x65   
0x017F    65 7a 65        JP 0x1e7   
0x0182    6e              OUTSB   
0x0183    0000            ADD [BX+SI], AL   
0x0185    0000            ADD [BX+SI], AL   
0x0187    0000            ADD [BX+SI], AL   
0x0189    0000            ADD [BX+SI], AL   
0x018B    0000            ADD [BX+SI], AL   
0x018D    0000            ADD [BX+SI], AL   
0x018F    0000            ADD [BX+SI], AL   
0x0191    0000            ADD [BX+SI], AL   
0x0193    0000            ADD [BX+SI], AL   
0x0195    0000            ADD [BX+SI], AL   
0x0197    0000            ADD [BX+SI], AL   
0x0199    0000            ADD [BX+SI], AL   
0x019B    0000            ADD [BX+SI], AL   
0x019D    0000            ADD [BX+SI], AL   
0x019F    0000            ADD [BX+SI], AL   
0x01A1    0000            ADD [BX+SI], AL   
0x01A3    0000            ADD [BX+SI], AL   
0x01A5    0000            ADD [BX+SI], AL   
0x01A7    0000            ADD [BX+SI], AL   
0x01A9    0000            ADD [BX+SI], AL   
0x01AB    0000            ADD [BX+SI], AL   
0x01AD    0000            ADD [BX+SI], AL   
0x01AF    0000            ADD [BX+SI], AL   
0x01B1    0000            ADD [BX+SI], AL   
0x01B3    0000            ADD [BX+SI], AL   
0x01B5    2c 44           SUB AL, 0x44   
0x01B7    6a e4           PUSH -0x1c   
0x01B9    43              INC BX   
0x01BA    e5 43           IN AX, 0x43   
0x01BC    0000            ADD [BX+SI], AL   
0x01BE    8001 01         ADD BYTE [BX+DI], 0x1   
0x01C1    0007            ADD [BX], AL   
0x01C3    fe              DB 0xfe   
0x01C4    ff              DB 0xff   
0x01C5    ff              DB 0xff   
0x01C6    3f              AAS   
0x01C7    0000            ADD [BX+SI], AL   
0x01C9    0074 3c         ADD [SI+0x3c], DH   
0x01CC    0d 0300         OR AX, 0x3   
0x01CF    00c1            ADD CL, AL   
0x01D1    ff0f            DEC WORD [BX]   
0x01D3    fe              DB 0xfe   
0x01D4    ff              DB 0xff   
0x01D5    ffb3 3c0d       PUSH WORD [BP+DI+0xd3c]   
0x01D9    0351 b7         ADD DX, [BX+DI-0x49]   
0x01DC    ec              IN AL, DX   
0x01DD    0a00            OR AL, [BX+SI]   
0x01DF    0000            ADD [BX+SI], AL   
0x01E1    0000            ADD [BX+SI], AL   
0x01E3    0000            ADD [BX+SI], AL   
0x01E5    0000            ADD [BX+SI], AL   
0x01E7    0000            ADD [BX+SI], AL   
0x01E9    0000            ADD [BX+SI], AL   
0x01EB    0000            ADD [BX+SI], AL   
0x01ED    0000            ADD [BX+SI], AL   
0x01EF    0000            ADD [BX+SI], AL   
0x01F1    0000            ADD [BX+SI], AL   
0x01F3    0000            ADD [BX+SI], AL   
0x01F5    0000            ADD [BX+SI], AL   
0x01F7    0000            ADD [BX+SI], AL   
0x01F9    0000            ADD [BX+SI], AL   
0x01FB    0000            ADD [BX+SI], AL   
0x01FD    0055 aa         ADD [DI-0x56], DL   


_______MBR   \Device\Harddisk1\DR3  

0x00000000   33 C0 8E D0 BC 00 7C FB 50 07 50 1F FC BE 1B 7C   3À.Ð¼.|ûP.P.ü¾.|
0x00000010   BF 1B 06 50 57 B9 E5 01 F3 A4 CB BD BE 07 B1 04   ¿..PW¹å.ó¤Ë½¾.±.
0x00000020   38 6E 00 7C 09 75 13 83 C5 10 E2 F4 CD 18 8B F5   8n.|.u..Å.âôÍ..õ
0x00000030   83 C6 10 49 74 19 38 2C 74 F6 A0 B5 07 B4 07 8B   .Æ.It.8,tö.µ.´..
0x00000040   F0 AC 3C 00 74 FC BB 07 00 B4 0E CD 10 EB F2 88   ð¬<.tü»..´.Í.ëò.
0x00000050   4E 10 E8 46 00 73 2A FE 46 10 80 7E 04 0B 74 0B   N.èF.s*þF..~..t.
0x00000060   80 7E 04 0C 74 05 A0 B6 07 75 D2 80 46 02 06 83   .~..t..¶.uÒ.F...
0x00000070   46 08 06 83 56 0A 00 E8 21 00 73 05 A0 B6 07 EB   F...V..è!.s..¶.ë
0x00000080   BC 81 3E FE 7D 55 AA 74 0B 80 7E 10 00 74 C8 A0   ¼.>þ}Uªt..~..tÈ.
0x00000090   B7 07 EB A9 8B FC 1E 57 8B F5 CB BF 05 00 8A 56   ·.ë©.ü.W.õË¿...V
0x000000A0   00 B4 08 CD 13 72 23 8A C1 24 3F 98 8A DE 8A FC   .´.Í.r#.Á$?..Þ.ü
0x000000B0   43 F7 E3 8B D1 86 D6 B1 06 D2 EE 42 F7 E2 39 56   C÷ã.Ñ.Ö±.ÒîB÷â9V
0x000000C0   0A 77 23 72 05 39 46 08 73 1C B8 01 02 BB 00 7C   .w#r.9F.s.¸..».|
0x000000D0   8B 4E 02 8B 56 00 CD 13 73 51 4F 74 4E 32 E4 8A   .N..V.Í.sQOtN2ä.
0x000000E0   56 00 CD 13 EB E4 8A 56 00 60 BB AA 55 B4 41 CD   V.Í.ëä.V.`»ªU´AÍ
0x000000F0   13 72 36 81 FB 55 AA 75 30 F6 C1 01 74 2B 61 60   .r6.ûUªu0öÁ.t+a`
0x00000100   6A 00 6A 00 FF 76 0A FF 76 08 6A 00 68 00 7C 6A   j.j..v..v.j.h.|j
0x00000110   01 6A 10 B4 42 8B F4 CD 13 61 61 73 0E 4F 74 0B   .j.´B.ôÍ.aas.Ot.
0x00000120   32 E4 8A 56 00 CD 13 EB D6 61 F9 C3 49 6E 76 61   2ä.V.Í.ëÖaùÃInva
0x00000130   6C 69 64 20 70 61 72 74 69 74 69 6F 6E 20 74 61   lid partition ta
0x00000140   62 6C 65 00 45 72 72 6F 72 20 6C 6F 61 64 69 6E   ble.Error loadin
0x00000150   67 20 6F 70 65 72 61 74 69 6E 67 20 73 79 73 74   g operating syst
0x00000160   65 6D 00 4D 69 73 73 69 6E 67 20 6F 70 65 72 61   em.Missing opera
0x00000170   74 69 6E 67 20 73 79 73 74 65 6D 00 00 00 00 00   ting system.....
0x00000180   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x00000190   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x000001A0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x000001B0   00 00 00 00 00 2C 44 63 18 2E 07 C3 00 00 80 01   .....,Dc...Ã....
0x000001C0   01 00 0B 80 E0 BC 20 00 00 00 E0 BF 3B 00 00 00   ....à¼ ...à¿;...
0x000001D0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x000001E0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x000001F0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA   ..............Uª

__________________________16_BIT_ASM_CODE
   
0x0000    33c0            XOR AX, AX   
0x0002    8ed0            MOV SS, AX   
0x0004    bc 007c         MOV SP, 0x7c00   
0x0007    fb              STI   
0x0008    50              PUSH AX   
0x0009    07              POP ES   
0x000A    50              PUSH AX   
0x000B    1f              POP DS   
0x000C    fc              CLD   
0x000D    be 1b7c         MOV SI, 0x7c1b   
0x0010    bf 1b06         MOV DI, 0x61b   
0x0013    50              PUSH AX   
0x0014    57              PUSH DI   
0x0015    b9 e501         MOV CX, 0x1e5   
0x0018    f3 a4           REP MOVSB   
0x001A    cb              RETF   
0x001B    bd be07         MOV BP, 0x7be   
0x001E    b1 04           MOV CL, 0x4   
0x0020    386e 00         CMP [BP+0x0], CH   
0x0023    7c 09           JL 0x2e   
0x0025    75 13           JNZ 0x3a   
0x0027    83c5 10         ADD BP, 0x10   
0x002A    e2 f4           LOOP 0x20   
0x002C    cd 18           INT 0x18   
0x002E    8bf5            MOV SI, BP   
0x0030    83c6 10         ADD SI, 0x10   
0x0033    49              DEC CX   
0x0034    74 19           JZ 0x4f   
0x0036    382c            CMP [SI], CH   
0x0038    74 f6           JZ 0x30   
0x003A    a0 b507         MOV AL, [0x7b5]   
0x003D    b4 07           MOV AH, 0x7   
0x003F    8bf0            MOV SI, AX   
0x0041    ac              LODSB   
0x0042    3c 00           CMP AL, 0x0   
0x0044    74 fc           JZ 0x42   
0x0046    bb 0700         MOV BX, 0x7   
0x0049    b4 0e           MOV AH, 0xe   
0x004B    cd 10           INT 0x10   
0x004D    eb f2           JMP 0x41   
0x004F    884e 10         MOV [BP+0x10], CL   
0x0052    e8 4600         CALL 0x9b   
0x0055    73 2a           JAE 0x81   
0x0057    fe46 10         INC BYTE [BP+0x10]   
0x005A    807e 04 0b      CMP BYTE [BP+0x4], 0xb   
0x005E    74 0b           JZ 0x6b   
0x0060    807e 04 0c      CMP BYTE [BP+0x4], 0xc   
0x0064    74 05           JZ 0x6b   
0x0066    a0 b607         MOV AL, [0x7b6]   
0x0069    75 d2           JNZ 0x3d   
0x006B    8046 02 06      ADD BYTE [BP+0x2], 0x6   
0x006F    8346 08 06      ADD WORD [BP+0x8], 0x6   
0x0073    8356 0a 00      ADC WORD [BP+0xa], 0x0   
0x0077    e8 2100         CALL 0x9b   
0x007A    73 05           JAE 0x81   
0x007C    a0 b607         MOV AL, [0x7b6]   
0x007F    eb bc           JMP 0x3d   
0x0081    813e fe7d 55aa  CMP WORD [0x7dfe], 0xaa55   
0x0087    74 0b           JZ 0x94   
0x0089    807e 10 00      CMP BYTE [BP+0x10], 0x0   
0x008D    74 c8           JZ 0x57   
0x008F    a0 b707         MOV AL, [0x7b7]   
0x0092    eb a9           JMP 0x3d   
0x0094    8bfc            MOV DI, SP   
0x0096    1e              PUSH DS   
0x0097    57              PUSH DI   
0x0098    8bf5            MOV SI, BP   
0x009A    cb              RETF   
0x009B    bf 0500         MOV DI, 0x5   
0x009E    8a56 00         MOV DL, [BP+0x0]   
0x00A1    b4 08           MOV AH, 0x8   
0x00A3    cd 13           INT 0x13   
0x00A5    72 23           JB 0xca   
0x00A7    8ac1            MOV AL, CL   
0x00A9    24 3f           AND AL, 0x3f   
0x00AB    98              CBW   
0x00AC    8ade            MOV BL, DH   
0x00AE    8afc            MOV BH, AH   
0x00B0    43              INC BX   
0x00B1    f7e3            MUL BX   
0x00B3    8bd1            MOV DX, CX   
0x00B5    86d6            XCHG DH, DL   
0x00B7    b1 06           MOV CL, 0x6   
0x00B9    d2ee            SHR DH, CL   
0x00BB    42              INC DX   
0x00BC    f7e2            MUL DX   
0x00BE    3956 0a         CMP [BP+0xa], DX   
0x00C1    77 23           JA 0xe6   
0x00C3    72 05           JB 0xca   
0x00C5    3946 08         CMP [BP+0x8], AX   
0x00C8    73 1c           JAE 0xe6   
0x00CA    b8 0102         MOV AX, 0x201   
0x00CD    bb 007c         MOV BX, 0x7c00   
0x00D0    8b4e 02         MOV CX, [BP+0x2]   
0x00D3    8b56 00         MOV DX, [BP+0x0]   
0x00D6    cd 13           INT 0x13   
0x00D8    73 51           JAE 0x12b   
0x00DA    4f              DEC DI   
0x00DB    74 4e           JZ 0x12b   
0x00DD    32e4            XOR AH, AH   
0x00DF    8a56 00         MOV DL, [BP+0x0]   
0x00E2    cd 13           INT 0x13   
0x00E4    eb e4           JMP 0xca   
0x00E6    8a56 00         MOV DL, [BP+0x0]   
0x00E9    60              PUSHA   
0x00EA    bb aa55         MOV BX, 0x55aa   
0x00ED    b4 41           MOV AH, 0x41   
0x00EF    cd 13           INT 0x13   
0x00F1    72 36           JB 0x129   
0x00F3    81fb 55aa       CMP BX, 0xaa55   
0x00F7    75 30           JNZ 0x129   
0x00F9    f6c1 01         TEST CL, 0x1   
0x00FC    74 2b           JZ 0x129   
0x00FE    61              POPA   
0x00FF    60              PUSHA   
0x0100    6a 00           PUSH 0x0   
0x0102    6a 00           PUSH 0x0   
0x0104    ff76 0a         PUSH WORD [BP+0xa]   
0x0107    ff76 08         PUSH WORD [BP+0x8]   
0x010A    6a 00           PUSH 0x0   
0x010C    68 007c         PUSH 0x7c00   
0x010F    6a 01           PUSH 0x1   
0x0111    6a 10           PUSH 0x10   
0x0113    b4 42           MOV AH, 0x42   
0x0115    8bf4            MOV SI, SP   
0x0117    cd 13           INT 0x13   
0x0119    61              POPA   
0x011A    61              POPA   
0x011B    73 0e           JAE 0x12b   
0x011D    4f              DEC DI   
0x011E    74 0b           JZ 0x12b   
0x0120    32e4            XOR AH, AH   
0x0122    8a56 00         MOV DL, [BP+0x0]   
0x0125    cd 13           INT 0x13   
0x0127    eb d6           JMP 0xff   
0x0129    61              POPA   
0x012A    f9              STC   
0x012B    c3              RET   
0x012C    49              DEC CX   
0x012D    6e              OUTSB   
0x012E    76 61           JBE 0x191   
0x0130    6c              INSB   
0x0131    6964 20 7061    IMUL SP, [SI+0x20], 0x6170   
0x0136    72 74           JB 0x1ac   
0x0138    6974 69 6f6e    IMUL SI, [SI+0x69], 0x6e6f   
0x013D    2074 61         AND [SI+0x61], DH   
0x0140    626c 65         BOUND BP, [SI+0x65]   
0x0143    0045 72         ADD [DI+0x72], AL   
0x0146    72 6f           JB 0x1b7   
0x0148    72 20           JB 0x16a   
0x014A    6c              INSB   
0x014B    6f              OUTSW   
0x014C    61              POPA   
0x014D    64 696e 67 206f IMUL BP, FS:[BP+0x67], 0x6f20   
0x0153    70 65           JO 0x1ba   
0x0155    72 61           JB 0x1b8   
0x0157    74 69           JZ 0x1c2   
0x0159    6e              OUTSB   
0x015A    67 2073 79      AND [EBX+0x79], DH   
0x015E    73 74           JAE 0x1d4   
0x0160    65 6d           INS WORD GS:[DI], DX   
0x0162    004d 69         ADD [DI+0x69], CL   
0x0165    73 73           JAE 0x1da   
0x0167    696e 67 206f    IMUL BP, [BP+0x67], 0x6f20   
0x016C    70 65           JO 0x1d3   
0x016E    72 61           JB 0x1d1   
0x0170    74 69           JZ 0x1db   
0x0172    6e              OUTSB   
0x0173    67 2073 79      AND [EBX+0x79], DH   
0x0177    73 74           JAE 0x1ed   
0x0179    65 6d           INS WORD GS:[DI], DX   
0x017B    0000            ADD [BX+SI], AL   
0x017D    0000            ADD [BX+SI], AL   
0x017F    0000            ADD [BX+SI], AL   
0x0181    0000            ADD [BX+SI], AL   
0x0183    0000            ADD [BX+SI], AL   
0x0185    0000            ADD [BX+SI], AL   
0x0187    0000            ADD [BX+SI], AL   
0x0189    0000            ADD [BX+SI], AL   
0x018B    0000            ADD [BX+SI], AL   
0x018D    0000            ADD [BX+SI], AL   
0x018F    0000            ADD [BX+SI], AL   
0x0191    0000            ADD [BX+SI], AL   
0x0193    0000            ADD [BX+SI], AL   
0x0195    0000            ADD [BX+SI], AL   
0x0197    0000            ADD [BX+SI], AL   
0x0199    0000            ADD [BX+SI], AL   
0x019B    0000            ADD [BX+SI], AL   
0x019D    0000            ADD [BX+SI], AL   
0x019F    0000            ADD [BX+SI], AL   
0x01A1    0000            ADD [BX+SI], AL   
0x01A3    0000            ADD [BX+SI], AL   
0x01A5    0000            ADD [BX+SI], AL   
0x01A7    0000            ADD [BX+SI], AL   
0x01A9    0000            ADD [BX+SI], AL   
0x01AB    0000            ADD [BX+SI], AL   
0x01AD    0000            ADD [BX+SI], AL   
0x01AF    0000            ADD [BX+SI], AL   
0x01B1    0000            ADD [BX+SI], AL   
0x01B3    0000            ADD [BX+SI], AL   
0x01B5    2c 44           SUB AL, 0x44   
0x01B7    6318            ARPL [BX+SI], BX   
0x01B9    2e              DB 0x2e   
0x01B9    2e 07           POP ES   
0x01BB    c3              RET   
0x01BC    0000            ADD [BX+SI], AL   
0x01BE    8001 01         ADD BYTE [BX+DI], 0x1   
0x01C1    000b            ADD [BP+DI], CL   
0x01C3    80e0 bc         AND AL, 0xbc   
0x01C6    2000            AND [BX+SI], AL   
0x01C8    0000            ADD [BX+SI], AL   
0x01CA    e0 bf           LOOPNZ 0x18b   
0x01CC    3b00            CMP AX, [BX+SI]   
0x01CE    0000            ADD [BX+SI], AL   
0x01D0    0000            ADD [BX+SI], AL   
0x01D2    0000            ADD [BX+SI], AL   
0x01D4    0000            ADD [BX+SI], AL   
0x01D6    0000            ADD [BX+SI], AL   
0x01D8    0000            ADD [BX+SI], AL   
0x01DA    0000            ADD [BX+SI], AL   
0x01DC    0000            ADD [BX+SI], AL   
0x01DE    0000            ADD [BX+SI], AL   
0x01E0    0000            ADD [BX+SI], AL   
0x01E2    0000            ADD [BX+SI], AL   
0x01E4    0000            ADD [BX+SI], AL   
0x01E6    0000            ADD [BX+SI], AL   
0x01E8    0000            ADD [BX+SI], AL   
0x01EA    0000            ADD [BX+SI], AL   
0x01EC    0000            ADD [BX+SI], AL   
0x01EE    0000            ADD [BX+SI], AL   
0x01F0    0000            ADD [BX+SI], AL   
0x01F2    0000            ADD [BX+SI], AL   
0x01F4    0000            ADD [BX+SI], AL   
0x01F6    0000            ADD [BX+SI], AL   
0x01F8    0000            ADD [BX+SI], AL   
0x01FA    0000            ADD [BX+SI], AL   
0x01FC    0000            ADD [BX+SI], AL   
0x01FE    55              PUSH BP   
0x01FF    aa              STOSB

V příloze přikládám log z OTL. AVG spuštěno, čekám na dokončení kontroly.

VIRY.CZ

Problém s napadeným PC - generic27.AkPW- log z RSIT přiložen

Problém s napadeným PC - generic27.AkPW- log z RSIT přiložen

Re: Problém s napadeným PC - generic27.AkPW- log z RSIT přil

Re: Problém s napadeným PC - generic27.AkPW- log z RSIT přil

Re: Problém s napadeným PC - generic27.AkPW- log z RSIT přil

Re: Problém s napadeným PC - generic27.AkPW- log z RSIT přil

Re: Problém s napadeným PC - generic27.AkPW- log z RSIT přil

Re: Problém s napadeným PC - generic27.AkPW- log z RSIT přil

Re: Problém s napadeným PC - generic27.AkPW- log z RSIT přil

Re: Problém s napadeným PC - generic27.AkPW- log z RSIT přil

Re: Problém s napadeným PC - generic27.AkPW- log z RSIT přil

Re: Problém s napadeným PC - generic27.AkPW- log z RSIT přil

Re: Problém s napadeným PC - generic27.AkPW- log z RSIT přil

Re: Problém s napadeným PC - generic27.AkPW- log z RSIT přil

Re: Problém s napadeným PC - generic27.AkPW- log z RSIT přil

Re: Problém s napadeným PC - generic27.AkPW- log z RSIT přil