VIRY.CZ

Zdravím. Avast! našel a odstranil nějaké viry v mém pc. Stále se mi to ale nezdá prosím o kontrolu logu. Předem díky.


Logfile of random's system information tool 1.09 (written by random/random)
Run by HP at 2012-11-27 13:15:42
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 23 GB (30%) free of 75 GB
Total RAM: 2047 MB (70% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:15:54, on 27.11.2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17114)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Microsoft Activation Assistant\FGUPM.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\T-Mobile\Web'n'walk Manager\ameisvc.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Cyberlink\Shared Files\brs.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe
C:\Program Files\PIXELA\Everio MediaBrowser\MBCameraMonitor.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\HP\Dokumenty\Stažené soubory\RSIT.exe
C:\Program Files\trend micro\HP.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [RemoteControl8] "C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe"
O4 - HKLM\..\Run: [PDVD8LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe"
O4 - HKLM\..\Run: [BDRegion] C:\Program Files\Cyberlink\Shared Files\brs.exe
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Regedit32] C:\WINDOWS\system32\regedit.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [nofyxiciwass] C:\Documents and Settings\HP\nofyxiciwass.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: LUMIX Simple Viewer.lnk = ?
O4 - Global Startup: MBCameraMonitor.lnk = ?
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{33073D0F-A0A9-48EE-80FE-1C120F079D71}: NameServer = 192.168.2.1,213.250.192.1
O20 - AppInit_DLLs:
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Web'n'walk Manager mobile equipment installation service (ameisvc) - Gemfor s.r.o. - C:\Program Files\T-Mobile\Web'n'walk Manager\ameisvc.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 7261 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Adobe Flash Player Updater.job
C:\WINDOWS\tasks\avast! Emergency Update.job
C:\WINDOWS\tasks\MP Scheduled Scan.job

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\HP\Data aplikací\Mozilla\Firefox\Profiles\n76aviwn.default

prefs.js - "browser.startup.homepage" - "http://www.seznam.cz/"
prefs.js - "extensions.enabledItems" - "{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}:6.0.10, {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}:6.0.11, {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}:6.0.13, {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}:6.0.17, jqs@sun.com:1.0, {20a82645-c095-46ed-80e3-08825760534b}:1.2.1, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.28"
prefs.js - "keyword.URL" - "http://dts.search-results.com/sr?src=ff ... 06&sr=0&q="

"{20a82645-c095-46ed-80e3-08825760534b}"=C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
"jqs@sun.com"=C:\Program Files\Java\jre6\lib\deploy\jqs\ff


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.5.502.110 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_5_502_110.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_37]
"Description"=
"Path"=C:\WINDOWS\system32\npdeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WPF,version=3.5]
"Description"=Windows Presentation Foundation plug-in for Mozilla browsers
"Path"=C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files\Mozilla Firefox\plugins\
np-mswmp.dll
nppdf32.dll
WMP Firefox Plugin License.rtf
WMP Firefox Plugin RelNotes.txt

C:\Program Files\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
mall-cz.xml
Search_Results.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

C:\Documents and Settings\HP\Data aplikací\Mozilla\Firefox\Profiles\n76aviwn.default\extensions\
{20a82645-c095-46ed-80e3-08825760534b}

C:\Documents and Settings\HP\Data aplikací\Mozilla\Firefox\Profiles\n76aviwn.default\searchplugins\
Search_Results.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-07-30 75232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2012-10-25 329712]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2012-10-25 59376]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2012-10-25 79856]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"High Definition Audio Property Page Shortcut"=C:\WINDOWS\system32\CHDAudPropShortcut.exe [2006-07-27 61952]
"QlbCtrl"=C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [2006-11-06 159744]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2007-08-23 8478720]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2007-08-23 81920]
"NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2006-01-12 155648]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2006-11-03 866584]
"RemoteControl8"=C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe [2008-03-20 83240]
"PDVD8LanguageShortcut"=C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe [2007-12-14 50472]
"BDRegion"=C:\Program Files\Cyberlink\Shared Files\brs.exe [2008-05-19 91432]
"avast5"=C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe [2012-10-30 4297136]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2012-07-31 38872]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-07-11 919008]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2012-09-17 254896]
"Regedit32"=C:\WINDOWS\system32\regedit.exe []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-08-20 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe [2006-03-01 90112]
"nofyxiciwass"=C:\Documents and Settings\HP\nofyxiciwass.exe []

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
LUMIX Simple Viewer.lnk - C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe
MBCameraMonitor.lnk - C:\Program Files\PIXELA\Everio MediaBrowser\MBCameraMonitor.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=" "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]
UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll [2008-08-20 239616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"=C:\PROGRA~1\WINDOW~4\MpShHook.dll [2006-11-03 83224]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\fglpmcla]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\fglpmcla.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\fglpmkervault]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\fglpmkervault.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{DAE27768-D527-4e28-9395-0619B4F81D40}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Nero\Nero 7\Nero Home\NeroHome.exe"="C:\Program Files\Nero\Nero 7\Nero Home\NeroHome.exe:*:Enabled:Nero Home"
"C:\Program Files\Microsoft Games\Age of Empires III\age3.exe"="C:\Program Files\Microsoft Games\Age of Empires III\age3.exe:*:Enabled:Age of Empires 3"
"C:\WINDOWS\system32\svchost.exe"="C:\WINDOWS\system32\svchost.exe:*:Enabled:Microsoft Office"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"VIDC.IYUV"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVU9"=tsbyuv.dll
"VIDC.YVYU"=msyuv.dll
"wavemapper"=msacm32.drv
"MSVideo8"=VfWWDM32.dll
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======List of files/folders created in the last 1 month======

2012-11-27 13:15:42 ----D---- C:\rsit
2012-11-27 13:15:42 ----D---- C:\Program Files\trend micro
2012-11-26 23:11:21 ----D---- C:\Program Files\Mozilla Firefox
2012-11-19 16:10:57 ----A---- C:\WINDOWS\system32\drivers\aswSnx.sys
2012-11-16 22:42:09 ----D---- C:\Program Files\Common Files\Java
2012-11-16 22:40:32 ----A---- C:\WINDOWS\system32\javaws.exe
2012-11-16 22:40:32 ----A---- C:\WINDOWS\system32\javaw.exe
2012-11-16 22:40:32 ----A---- C:\WINDOWS\system32\java.exe
2012-11-16 22:35:55 ----D---- C:\Program Files\Adobe
2012-11-15 23:18:47 ----A---- C:\WINDOWS\system32\MRT.INI
2012-11-15 23:09:29 ----HDC---- C:\WINDOWS\$NtUninstallKB2727528$
2012-11-15 23:09:13 ----HDC---- C:\WINDOWS\$NtUninstallKB2761226$
2012-11-15 21:16:13 ----SHD---- C:\Config.Msi

======List of files/folders modified in the last 1 month======

2012-11-27 13:15:48 ----D---- C:\WINDOWS\Temp
2012-11-27 13:15:42 ----RD---- C:\Program Files
2012-11-27 13:10:16 ----D---- C:\WINDOWS\system32\CatRoot2
2012-11-27 13:10:14 ----SD---- C:\WINDOWS\Tasks
2012-11-27 13:07:56 ----D---- C:\WINDOWS
2012-11-27 13:06:54 ----D---- C:\Program Files\Mozilla Maintenance Service
2012-11-27 00:08:39 ----A---- C:\WINDOWS\SchedLgU.Txt
2012-11-26 23:13:48 ----D---- C:\WINDOWS\Prefetch
2012-11-19 16:10:57 ----D---- C:\WINDOWS\system32\drivers
2012-11-19 16:10:54 ----D---- C:\WINDOWS\system32
2012-11-19 15:43:54 ----D---- C:\WINDOWS\Debug
2012-11-16 22:42:10 ----SHD---- C:\WINDOWS\Installer
2012-11-16 22:42:09 ----D---- C:\Program Files\Common Files
2012-11-16 22:40:10 ----D---- C:\Program Files\Java
2012-11-16 22:39:44 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2012-11-16 22:36:09 ----D---- C:\Program Files\Common Files\Adobe
2012-11-16 22:36:07 ----D---- C:\Documents and Settings\All Users\Data aplikací\Adobe
2012-11-16 00:09:05 ----RSD---- C:\WINDOWS\assembly
2012-11-16 00:04:58 ----D---- C:\WINDOWS\Microsoft.NET
2012-11-15 23:09:44 ----A---- C:\WINDOWS\system32\MRT.exe
2012-11-15 23:09:34 ----HD---- C:\WINDOWS\inf
2012-11-15 23:09:32 ----RSHDC---- C:\WINDOWS\system32\dllcache
2012-11-15 23:06:46 ----D---- C:\WINDOWS\WinSxS
2012-11-15 16:21:56 ----HD---- C:\WINDOWS\$hf_mig$
2012-11-13 06:46:53 ----D---- C:\Documents and Settings\HP\Data aplikací\BSplayer PRO
2012-11-12 21:28:48 ----A---- C:\WINDOWS\NeroDigital.ini
2012-11-09 20:28:22 ----A---- C:\WINDOWS\system32\FlashPlayerApp.exe
2012-10-30 23:50:59 ----A---- C:\WINDOWS\system32\aswBoot.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 a347bus;a347bus; C:\WINDOWS\system32\DRIVERS\a347bus.sys [2004-04-30 160640]
R0 a347scsi;a347scsi; C:\WINDOWS\System32\Drivers\a347scsi.sys [2004-04-30 5248]
R0 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2012-10-30 25256]
R1 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2012-10-30 35928]
R1 aswSnx;aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [2012-10-30 738504]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2012-10-30 361032]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2012-10-30 54232]
R1 PCLEPCI;PCLEPCI; \??\C:\WINDOWS\system32\drivers\pclepci.sys []
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-14 8832]
R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}; \??\C:\Program Files\CyberLink\PowerDVD8\000.fcl []
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2012-10-30 21256]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2012-10-30 97608]
R3 AR5416;Atheros Wireless Adapter Service; C:\WINDOWS\system32\DRIVERS\athw.sys [2008-04-27 1310464]
R3 HdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\CHDAud.sys [2006-07-27 581632]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-08-20 144384]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2007-08-23 6844864]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2007-06-28 45824]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2007-06-28 20480]
R3 nvsmu;nvsmu; C:\WINDOWS\system32\DRIVERS\nvsmu.sys [2007-02-16 12032]
R3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2008-08-20 79232]
R3 sffdisk;Ovladač třídy úložiště SFF; C:\WINDOWS\system32\DRIVERS\sffdisk.sys [2008-08-20 11904]
R3 sffp_sd;Ovladač protokolu úložiště SFF pro paměť sběrnici SDBus; C:\WINDOWS\system32\DRIVERS\sffp_sd.sys [2008-08-20 11008]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-08-20 32128]
R3 usbvideo;Zobrazovací zařízení USB (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2008-04-14 121984]
R3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-07-19 491488]
R3 WSIMD;wsimd Service; C:\WINDOWS\system32\DRIVERS\wsimd.sys [2008-02-08 57408]
S0 ohci1394;Hostitelský řadič IEEE 1394 dle standardu OHCI; C:\WINDOWS\system32\DRIVERS\ohci1394.sys [2008-04-14 61696]
S3 AMDPCI;AMDPCI; \??\C:\DOCUME~1\HP\LOCALS~1\Temp\AMDPCI.sys []
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 EverestDriver;Lavalys EVEREST Kernel Driver; \??\G:\Everest Ultimate Edition V. 4.00.976\kerneld.wnt []
S3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
S3 massfilter;Mass Storage Filter Driver; C:\WINDOWS\system32\drivers\massfilter.sys [2010-02-22 9216]
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 Ser2pl;Prolific Serial port driver; C:\WINDOWS\system32\DRIVERS\ser2pl.sys [2003-07-16 43264]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 UIUSys;Conexant Setup API; C:\WINDOWS\system32\DRIVERS\UIUSYS.SYS []
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S3 ZTEusbmdm6k;ZTE Proprietary USB Driver; C:\WINDOWS\system32\DRIVERS\ZTEusbmdm6k.sys [2010-03-02 105856]
S3 ZTEusbnmea;ZTE NMEA Port; C:\WINDOWS\system32\DRIVERS\ZTEusbnmea.sys [2010-03-02 105856]
S3 ZTEusbser6k;ZTE Diagnostic Port; C:\WINDOWS\system32\DRIVERS\ZTEusbser6k.sys [2010-03-02 105856]
S4 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2008-08-20 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ameisvc;Web'n'walk Manager mobile equipment installation service; C:\Program Files\T-Mobile\Web'n'walk Manager\ameisvc.exe [2012-06-12 124856]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2012-10-30 44808]
R2 FGSchedules;FlexGo Schedules Service; C:\Program Files\Microsoft Activation Assistant\FGUPM.exe [2008-06-09 564016]
R2 FGUPM;FlexGo UPM Service; C:\Program Files\Microsoft Activation Assistant\FGUPM.exe [2008-06-09 564016]
R2 hpqwmiex;hpqwmiex; C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe [2006-05-02 135168]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2012-09-24 153584]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2007-08-23 155716]
R2 WinDefend;Windows Defender; C:\Program Files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-08-20 14336]
S3 AddFiltr;AddFiltr; C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe [2006-06-26 126976]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-11-09 250808]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2012-11-26 115168]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S4 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe []
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Zdravim

Jeste nam tam neco zustalo

Stahnete Farbar Service Scanner http://download.bleepingcomputer.com/farbar/FSS.exe

• Ulozte nejlepe na Plochu
• U vsech polozek udelejte zatrzitko (tim je oznacite pro skenovani)
• Kliknete na Scan
• Po dokonceni skenu se objevi log FSS.txt ten sem vlozte

Stahnete RKill http://download.bleepingcomputer.com/grinler/rkill.com

• Pokud ho havet blokuje, pouzijte jeden z nasledujicich - i ty prejmenovane

  Rkill EXE:
  http://download.bleepingcomputer.com/grinler/rkill.exe
  
  Rkill iExplore.exe:
  http://download.bleepingcomputer.com/gr ... xplore.exe
  
  Rkill uSeRiNiT.exe:
  http://download.bleepingcomputer.com/gr ... eRiNiT.exe
  
  Rkill WiNlOgOn.exe:
  http://download.bleepingcomputer.com/gr ... NlOgOn.exe

• Ulozte nejlepena plochu a ukoncete vsechny aplikace (jinak to udela RKill za Vas)
• Spustte tradicne dvojklikem - program probehne do par sekund a ukonci i svou cinnost
• RKill ukonci vsechny ne-systemove procesy - tedy i procesy, pod kterymi bezi havet
• Na plose vznikne log Rkill.txt ten mi sem vlozte
• Ted nerestartujte PC - prisli byste o ucinek RKillu

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK
Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

• Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
• Pokud mate Win XP spustte pod uctem Spravce\Administratora
• Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
• Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
• Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
• Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
• Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
• Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
• Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

Farbar Service Scanner Version: 09-11-2012
Ran by HP (administrator) on 27-11-2012 at 13:43:44
Running from "C:\Documents and Settings\HP\Dokumenty\Stažené soubory"
Microsoft Windows XP Service Pack 3 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo IP is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Security Center:
============

Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


File Check:
========
C:\WINDOWS\system32\dhcpcsvc.dll
[2008-08-20 13:00] - [2008-08-20 13:00] - 0125952 ____A (Microsoft Corporation) 8C9A53E285AC5E6704844D0459EC85BE

C:\WINDOWS\system32\Drivers\afd.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\netbt.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\tcpip.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\ipsec.sys => MD5 is legit
C:\WINDOWS\system32\dnsrslvr.dll
[2008-08-20 13:00] - [2009-04-20 18:19] - 0045568 ____A (Microsoft Corporation) DFAA406BF19F4EE806A6F8D4342137F7

C:\WINDOWS\system32\ipnathlp.dll
[2008-08-20 13:00] - [2008-08-20 13:00] - 0329728 ____A (Microsoft Corporation) F58FACA9621D2DB01BD0927D9A0A208E

C:\WINDOWS\system32\netman.dll
[2008-08-20 13:00] - [2008-08-20 13:00] - 0198144 ____A (Microsoft Corporation) 72E1E9E2977BE08BDEEDB6D8FD9D4D40

C:\WINDOWS\system32\wbem\WMIsvc.dll
[2008-12-09 14:45] - [2008-08-20 13:00] - 0144896 ____A (Microsoft Corporation) E488332126E3B1182D2B8A0C35408EC6

C:\WINDOWS\system32\srsvc.dll
[2008-12-09 14:47] - [2008-08-20 13:00] - 0171008 ____A (Microsoft Corporation) 35B91147124F64AC8081A2EDB9EA4DEE

C:\WINDOWS\system32\Drivers\sr.sys
[2008-12-09 14:47] - [2008-08-20 13:00] - 0073344 ____A (Microsoft Corporation) 94610C8653635E4459316A0050D55CE7

C:\WINDOWS\system32\wscsvc.dll
[2008-08-20 13:00] - [2008-08-20 13:00] - 0080896 ____A (Microsoft Corporation) 4C86D5FAF78194995AF9CC1075F65DD3

C:\WINDOWS\system32\wbem\WMIsvc.dll
[2008-12-09 14:45] - [2008-08-20 13:00] - 0144896 ____A (Microsoft Corporation) E488332126E3B1182D2B8A0C35408EC6

C:\WINDOWS\system32\wuauserv.dll
[2008-12-09 14:48] - [2008-08-20 13:00] - 0006656 ____A (Microsoft Corporation) C1364564800EE9784192145324A23308

C:\WINDOWS\system32\qmgr.dll
[2008-12-09 14:48] - [2008-08-20 13:00] - 0409088 ____A (Microsoft Corporation) 19395D092FD85DDC2D9C7729CF5A2AC8

C:\WINDOWS\system32\es.dll
[2008-08-20 13:00] - [2008-07-07 21:29] - 0253952 ____A (Microsoft Corporation) A371F11EF07653591C8DE26AFB13CE7F

C:\WINDOWS\system32\cryptsvc.dll
[2008-08-20 13:00] - [2008-08-20 13:00] - 0062464 ____A (Microsoft Corporation) F3AB0933CBD166D271992F411C27CCAF

C:\WINDOWS\system32\svchost.exe
[2008-08-20 13:00] - [2008-08-20 13:00] - 0014336 ____A (Microsoft Corporation) BE4A520E29B6391F49E79CCC52044D93

C:\WINDOWS\system32\rpcss.dll
[2008-08-20 13:00] - [2009-02-09 11:56] - 0401408 ____A (Microsoft Corporation) BE27674D1CBC3214AEC84B4336A38BBF

C:\WINDOWS\system32\services.exe
[2008-08-20 13:00] - [2009-02-09 12:25] - 0111104 ____A (Microsoft Corporation) 9EF697AF07BB8DD82C3B02CA953A95B7


Extra List:
=======
aswTdi(268435456) Gpc(3) IPSec(5) NetBT(6) PSched(7) Tcpip(4) WSIMD(8)
0x09000000050000000100000002000000030000000400000000000010060000000700000008000000
IpSec Tag value is correct.

**** End of log ****

Rkill 2.4.5 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2012 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 11/27/2012 01:46:58 PM in x86 mode.
Windows Version: Microsoft Windows XP Service Pack 3

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* No malware processes found to kill.

Checking Registry for malware related settings:

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* No issues found.

Checking Windows Service Integrity:

* No issues found.

Searching for Missing Digital Signatures:

* C:\WINDOWS\System32\drivers\atapi.sys [NoSig]

Checking HOSTS File:

* HOSTS file entries found:

127.0.0.1 localhost

Program finished at: 11/27/2012 01:47:51 PM
Execution time: 0 hours(s), 0 minute(s), and 53 seconds(s)

ComboFix 12-11-27.01 - HP 27.11.2012 14:12:35.1.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2047.1517 [GMT 1:00]
Spuštěný z: c:\documents and settings\HP\Plocha\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\HP\nofyxiciwass.exe
c:\windows\iun6002.exe
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
c:\windows\system32\PowerToyReadme.htm
c:\windows\system32\SET215.tmp
c:\windows\system32\SET217.tmp
c:\windows\system32\SET21B.tmp
c:\windows\system32\SET21C.tmp
c:\windows\system32\SET223.tmp
c:\windows\system32\SET225.tmp
.
Nakažená kopie c:\windows\system32\ntdll.dll byla nalezena a vyléčena.
Obnovena kopie z - c:\windows\$hf_mig$\KB2393802\SP3QFE\ntdll.dll
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-10-27 do 2012-11-27 )))))))))))))))))))))))))))))))
.
.
2072-04-03 12:13 . 2008-03-21 13:46 607296 ------w- c:\program files\Microsoft Games\Age of Empires III\deformerdllyD.dll
2071-07-25 08:13 . 2006-11-21 19:48 203576 ------w- c:\program files\Microsoft Games\Age of Empires III\autopatcher2.exe
2012-11-27 12:15 . 2012-11-27 12:15 -------- d-----w- C:\rsit
2012-11-27 12:15 . 2012-11-27 12:15 -------- d-----w- c:\program files\trend micro
2012-11-27 12:11 . 2012-11-08 18:00 6812136 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Windows Defender\Definition Updates\{A711BE17-DD3F-43A6-94C0-FAEF0DD9D55A}\mpengine.dll
2012-11-19 15:10 . 2012-10-30 22:51 738504 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-11-16 21:42 . 2012-11-16 21:42 -------- d-----w- c:\program files\Common Files\Java
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-11-09 19:28 . 2012-06-11 08:26 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-11-09 19:28 . 2011-08-05 20:31 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-11-08 18:00 . 2008-12-17 19:03 6812136 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2012-10-30 22:51 . 2008-12-17 20:50 361032 ----a-w- c:\windows\system32\drivers\aswSP.sys
2012-10-30 22:51 . 2008-12-17 20:21 54232 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2012-10-30 22:51 . 2008-12-17 20:21 35928 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2012-10-30 22:51 . 2008-12-17 20:21 97608 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2012-10-30 22:51 . 2008-12-17 20:21 89752 ----a-w- c:\windows\system32\drivers\aswmon.sys
2012-10-30 22:51 . 2008-12-17 20:50 21256 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-10-30 22:51 . 2008-12-17 20:21 25256 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2012-10-30 22:51 . 2010-10-21 18:20 41224 ----a-w- c:\windows\avastSS.scr
2012-10-30 22:50 . 2008-12-17 20:21 227648 ----a-w- c:\windows\system32\aswBoot.exe
2012-10-22 19:57 . 2008-08-20 12:00 1866368 ----a-w- c:\windows\system32\win32k.sys
2012-10-02 18:04 . 2008-08-20 12:00 58368 ----a-w- c:\windows\system32\synceng.dll
2012-09-24 14:32 . 2012-10-10 18:57 477168 ----a-w- c:\windows\system32\npdeployJava1.dll
2012-09-24 14:32 . 2012-10-10 18:57 473072 ----a-w- c:\windows\system32\deployJava1.dll
2012-09-24 12:51 . 2012-10-10 18:57 73728 ----a-w- c:\windows\system32\javacpl.cpl
2012-11-26 22:11 . 2012-11-26 22:11 262112 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2008-08-20 12:00 . !HASH: COULD NOT OPEN FILE !!!!! . 96512 . . [------] . . c:\windows\system32\drivers\atapi.sys
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-10-30 22:50 121528 ----a-w- c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\lib\NMBgMonitor.exe" [2006-03-01 90112]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-07-27 61952]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-11-06 159744]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-08-23 8478720]
"nwiz"="nwiz.exe" [2007-08-23 1626112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-08-23 81920]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2008-03-20 83240]
"PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2007-12-14 50472]
"BDRegion"="c:\program files\Cyberlink\Shared Files\brs.exe" [2008-05-19 91432]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-07-31 38872]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-11 919008]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-09-17 254896]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-08-20 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
LUMIX Simple Viewer.lnk - c:\program files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe [2008-12-17 61440]
MBCameraMonitor.lnk - c:\program files\PIXELA\Everio MediaBrowser\MBCameraMonitor.exe [2010-1-23 541976]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=
.
R0 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [17.12.2008 22:56 160640]
R0 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [17.12.2008 22:56 5248]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [19.11.2012 16:10 738504]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [17.12.2008 21:50 361032]
R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};c:\program files\CyberLink\PowerDVD8\000.fcl [15.5.2008 12:07 61424]
R2 ameisvc;Web'n'walk Manager mobile equipment installation service;c:\program files\T-Mobile\Web'n'walk Manager\ameisvc.exe [12.6.2012 12:01 124856]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [17.12.2008 21:50 21256]
R2 FGSchedules;FlexGo Schedules Service;c:\program files\Microsoft Activation Assistant\FGUPM.exe [9.6.2008 17:50 564016]
R2 FGUPM;FlexGo UPM Service;c:\program files\Microsoft Activation Assistant\FGUPM.exe [9.6.2008 17:50 564016]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [3.11.2006 19:19 13592]
R3 FGLPMCLA;LPM Class Device Driver;c:\windows\system32\drivers\FGLPMCLA.sys [9.6.2008 17:44 26160]
R3 FGLPMKER;Kernel-mode LPM Mini Device Driver;c:\windows\system32\drivers\FGLPMKERVAULT.sys [9.6.2008 17:44 351488]
S3 EverestDriver;Lavalys EVEREST Kernel Driver;\??\g:\everest ultimate edition v. 4.00.976\kerneld.wnt --> g:\everest ultimate edition v. 4.00.976\kerneld.wnt [?]
S3 massfilter;Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [15.2.2011 20:29 9216]
.
Obsah adresáře 'Naplánované úlohy'
.
2012-11-27 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-11 19:28]
.
2012-11-27 c:\windows\Tasks\avast! Emergency Update.job
- c:\program files\Alwil Software\Avast5\AvastEmUpdate.exe [2012-11-19 22:50]
.
2012-11-27 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
TCP: DhcpNameServer = 213.250.192.1 213.250.194.1
TCP: Interfaces\{33073D0F-A0A9-48EE-80FE-1C120F079D71}: NameServer = 192.168.2.1,213.250.192.1
FF - ProfilePath - c:\documents and settings\HP\Data aplikací\Mozilla\Firefox\Profiles\n76aviwn.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://dts.search-results.com/sr?src=ffb&appid=418&systemid=406&sr=0&q=
FF - ExtSQL: 2012-10-10 20:57; {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}; c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
FF - ExtSQL: 2012-11-16 22:40; {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}; c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
FF - ExtSQL: !HIDDEN! 2010-01-27 08:26; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Toolbar-10 - (no file)
HKCU-Run-nofyxiciwass - c:\documents and settings\HP\nofyxiciwass.exe
AddRemove-Cool's_Codec_pack_4.12 - c:\windows\iun6002.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-11-27 14:19
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EverestDriver]
"ImagePath"="\??\g:\everest ultimate edition v. 4.00.976\kerneld.wnt"
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD8\000.fcl"
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\FGLPMCLA]
"ImagePath"="system32\DRIVERS\fglpmcla.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\FGLPMKER]
"ImagePath"="system32\DRIVERS\fglpmkervault.sys"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'explorer.exe'(2180)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\RUNDLL32.EXE
.
**************************************************************************
.
Celkový čas: 2012-11-27 14:22:54 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-11-27 13:22
.
Před spuštěním: Volných bajtů: 23 767 023 616
Po spuštění: Volných bajtů: 24 161 701 888
.
WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - 8F9F6CAB0C0108A10D8F4AA71CCB5B58





snad se zadařilo.

Stahnete SPTD http://www.duplexsecure.com/en/downloads

• Vyberte z uvedene stranky verzi dle sveho operacniho systemu (32(x86)bit ci 64(x64)bit)
• Ulozte na plochu a spustte
• Zvolte moznost Uninstall a restartujte PC - pokud nepujde kliknout (tlacitko bude sede), krok preskocte

Stahnete Defogger http://www.jpshortstuff.247fixes.com/Defogger.exe

• Ulozte na plochu a spustte
• Kliknete na Disable a restartujte PC - pokud nepujde kliknout (tlacitko bude sede), krok preskocte

Stahnete aswMBR http://public.avast.com/%7Egmerek/aswMBR.exe a ulozte jej na plochu.

• Utilitu spustte a prikazte ji, at skenuje - klik na Scan
• Kliknutim na Save log ulozte log aswMBR na plochu
• Obsah logu aswMBR mi sem vlozte

Zdravím.

Bod 1 přeskočen.
Bod 2 a 3 splněn.


aswMBR version 0.9.9.1707 Copyright(c) 2011 AVAST Software
Run date: 2012-11-28 19:21:33
-----------------------------
19:21:33.734 OS Version: Windows 5.1.2600 Service Pack 3
19:21:33.734 Number of processors: 2 586 0x6802
19:21:33.734 ComputerName: NOTEBOOK_RULE UserName: HP
19:21:34.484 Initialize success
19:21:38.375 AVAST engine defs: 12112800
19:22:01.109 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-e
19:22:01.109 Disk 0 Vendor: WDC_WD2500BEVS-60UST0 01.01A01 Size: 238475MB BusType: 3
19:22:01.109 Disk 1 \Device\Harddisk1\SR0 -> \Device\SdBus-0
19:22:01.109 Disk 1 Vendor: ( Size: 976MB BusType: 12
19:22:01.156 Disk 0 MBR read successfully
19:22:01.156 Disk 0 MBR scan
19:22:01.156 Disk 0 Windows XP default MBR code
19:22:01.156 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 74998 MB offset 63
19:22:01.171 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 163473 MB offset 153597465
19:22:01.187 Disk 0 scanning sectors +488392065
19:22:01.250 Disk 0 scanning C:\WINDOWS\system32\drivers
19:22:06.656 Service scanning
19:22:08.859 Service FGLPMCLA C:\WINDOWS\system32\DRIVERS\fglpmcla.sys **LOCKED**
19:22:08.906 Service FGLPMKER C:\WINDOWS\system32\DRIVERS\fglpmkervault.sys **LOCKED**
19:22:16.406 Modules scanning
19:22:20.578 Disk 0 trace - called modules:
19:22:20.593 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
19:22:20.593 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x89d37ab8]
19:22:20.593 3 CLASSPNP.SYS[ba0e8fd7] -> nt!IofCallDriver -> \Device\00000078[0x89cb44c0]
19:22:20.593 5 ACPI.sys[b9f7f620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-e[0x89cedd98]
19:22:20.828 AVAST engine scan C:\WINDOWS
19:22:27.828 AVAST engine scan C:\WINDOWS\system32
19:23:57.921 AVAST engine scan C:\WINDOWS\system32\drivers
19:24:06.437 AVAST engine scan C:\Documents and Settings\HP
19:26:05.437 AVAST engine scan C:\Documents and Settings\All Users
19:31:35.609 Scan finished successfully
19:31:58.515 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\HP\Plocha\MBR.dat"
19:31:58.515 The log file has been saved successfully to "C:\Documents and Settings\HP\Plocha\aswMBR.txt"

Stahnete si TDSSKiller http://support.kaspersky.com/downloads/ ... killer.exe

• Kliknete na volbu Change parametrs
• V okne Additional Option zakliknete vsechny moznosti
• Kliknete na OK
• Utilite prikazte, at skenuje - klik na Start Scan
• Po dokonceni skenu se objevi okno, zkontrolujte, zda-li je vsude moznost Skip
• Pokud moznost Skip nebude primarne nastavena, prekliknete ji na Skip
• Pokud mate vsude Skip, kliknete na Continue
• Na disku, kde mate Windows (obvykle c:\) ve tvaru TDSSKiller.nejaka cisilka _log.txt bude log - jeho obsah sem vlozte

20:37:50.0500 2260 TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35
20:37:50.0671 2260 ============================================================
20:37:50.0671 2260 Current date / time: 2012/11/28 20:37:50.0671
20:37:50.0671 2260 SystemInfo:
20:37:50.0671 2260
20:37:50.0671 2260 OS Version: 5.1.2600 ServicePack: 3.0
20:37:50.0671 2260 Product type: Workstation
20:37:50.0671 2260 ComputerName: NOTEBOOK_RULE
20:37:50.0671 2260 UserName: HP
20:37:50.0671 2260 Windows directory: C:\WINDOWS
20:37:50.0671 2260 System windows directory: C:\WINDOWS
20:37:50.0671 2260 Processor architecture: Intel x86
20:37:50.0671 2260 Number of processors: 2
20:37:50.0671 2260 Page size: 0x1000
20:37:50.0671 2260 Boot type: Normal boot
20:37:50.0671 2260 ============================================================
20:37:51.0984 2260 Drive \Device\Harddisk0\DR0 - Size: 0x3A38B2E000 (232.89 Gb), SectorSize: 0x200, Cylinders: 0x76C1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
20:37:52.0000 2260 ============================================================
20:37:52.0000 2260 \Device\Harddisk0\DR0:
20:37:52.0000 2260 MBR partitions:
20:37:52.0000 2260 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x927B5DA
20:37:52.0000 2260 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x927B619, BlocksNum 0x13F48F68
20:37:52.0000 2260 ============================================================
20:37:52.0031 2260 C: <-> \Device\Harddisk0\DR0\Partition1
20:37:52.0093 2260 E: <-> \Device\Harddisk0\DR0\Partition2
20:37:52.0093 2260 ============================================================
20:37:52.0093 2260 Initialize success
20:37:52.0093 2260 ============================================================
20:39:01.0953 0812 ============================================================
20:39:01.0953 0812 Scan started
20:39:01.0953 0812 Mode: Manual; SigCheck; TDLFS;
20:39:01.0953 0812 ============================================================
20:39:02.0609 0812 ================ Scan system memory ========================
20:39:02.0609 0812 System memory - ok
20:39:02.0609 0812 ================ Scan services =============================
20:39:02.0750 0812 [ 1F61CACACB521215F39061789147968C ] a347bus C:\WINDOWS\system32\DRIVERS\a347bus.sys
20:39:02.0875 0812 a347bus ( UnsignedFile.Multi.Generic ) - warning
20:39:02.0875 0812 a347bus - detected UnsignedFile.Multi.Generic (1)
20:39:02.0890 0812 [ 113E4B318BBAA7483CA4E582A4D63F49 ] a347scsi C:\WINDOWS\System32\Drivers\a347scsi.sys
20:39:02.0906 0812 a347scsi ( UnsignedFile.Multi.Generic ) - warning
20:39:02.0906 0812 a347scsi - detected UnsignedFile.Multi.Generic (1)
20:39:02.0921 0812 [ 149A8F7ADF9742554DC323E290551E3E ] Aavmker4 C:\WINDOWS\system32\drivers\Aavmker4.sys
20:39:03.0000 0812 Aavmker4 - ok
20:39:03.0000 0812 Abiosdsk - ok
20:39:03.0015 0812 abp480n5 - ok
20:39:03.0031 0812 [ 4FE34F1F3126B61FCC6B2043AA8112C9 ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys
20:39:03.0171 0812 ACPI - ok
20:39:03.0187 0812 [ AFDFF022A01F0B11C776F0860C3B282F ] ACPIEC C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
20:39:03.0328 0812 ACPIEC - ok
20:39:03.0390 0812 [ E6D2486EC85A36B8336ED456D0317D96 ] AddFiltr C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
20:39:03.0406 0812 AddFiltr ( UnsignedFile.Multi.Generic ) - warning
20:39:03.0406 0812 AddFiltr - detected UnsignedFile.Multi.Generic (1)
20:39:03.0484 0812 [ 0CB0AA071C7B86A64F361DCFDF357329 ] AdobeFlashPlayerUpdateSvc C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
20:39:03.0500 0812 AdobeFlashPlayerUpdateSvc - ok
20:39:03.0500 0812 adpu160m - ok
20:39:03.0531 0812 [ 8BED39E3C35D6A489438B8141717A557 ] aec C:\WINDOWS\system32\drivers\aec.sys
20:39:03.0671 0812 aec - ok
20:39:03.0703 0812 [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD C:\WINDOWS\System32\drivers\afd.sys
20:39:03.0734 0812 AFD - ok
20:39:03.0750 0812 Aha154x - ok
20:39:03.0750 0812 aic78u2 - ok
20:39:03.0750 0812 aic78xx - ok
20:39:03.0796 0812 [ E0A6FA244B8624D78FE5FF6F56A33BAE ] Alerter C:\WINDOWS\system32\alrsvc.dll
20:39:03.0937 0812 Alerter - ok
20:39:04.0031 0812 [ 88842DE939A827577BF24243699AC80A ] ALG C:\WINDOWS\System32\alg.exe
20:39:04.0093 0812 ALG - ok
20:39:04.0093 0812 AliIde - ok
20:39:04.0171 0812 AMDPCI - ok
20:39:04.0218 0812 [ 950305BB9AB6207C3E53F90E4B6BC787 ] ameisvc C:\Program Files\T-Mobile\Web'n'walk Manager\ameisvc.exe
20:39:04.0234 0812 ameisvc - ok
20:39:04.0250 0812 amsint - ok
20:39:04.0265 0812 [ 6B8E7A90E576D4FE308F97C69060A171 ] AppMgmt C:\WINDOWS\System32\appmgmts.dll
20:39:04.0343 0812 AppMgmt - ok
20:39:04.0421 0812 [ 5EC514EFC539B092ECD8C0507A634D74 ] AR5416 C:\WINDOWS\system32\DRIVERS\athw.sys
20:39:04.0531 0812 AR5416 ( UnsignedFile.Multi.Generic ) - warning
20:39:04.0531 0812 AR5416 - detected UnsignedFile.Multi.Generic (1)
20:39:04.0531 0812 asc - ok
20:39:04.0531 0812 asc3350p - ok
20:39:04.0546 0812 asc3550 - ok
20:39:04.0625 0812 [ 0E5E4957549056E2BF2C49F4F6B601AD ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
20:39:04.0656 0812 aspnet_state - ok
20:39:04.0703 0812 [ DE6ED95AEF259979B2830450072A627B ] aswFsBlk C:\WINDOWS\system32\drivers\aswFsBlk.sys
20:39:04.0718 0812 aswFsBlk - ok
20:39:04.0734 0812 [ 84F0BE324EE111338589F448C3E8BAB2 ] aswMon2 C:\WINDOWS\system32\drivers\aswMon2.sys
20:39:04.0750 0812 aswMon2 - ok
20:39:04.0796 0812 [ 7C9F0A2AB17D52261A9252A2EB320884 ] aswRdr C:\WINDOWS\system32\drivers\aswRdr.sys
20:39:04.0812 0812 aswRdr - ok
20:39:04.0875 0812 [ B32E9AD44A1DBB3E8095E80F8DF32B03 ] aswSnx C:\WINDOWS\system32\drivers\aswSnx.sys
20:39:04.0921 0812 aswSnx - ok
20:39:04.0953 0812 [ 67B558895695545FB0568B7541F3BCA7 ] aswSP C:\WINDOWS\system32\drivers\aswSP.sys
20:39:05.0000 0812 aswSP - ok
20:39:05.0015 0812 [ E3E73B2B73A4DFADFDDF557192C4B08A ] aswTdi C:\WINDOWS\system32\drivers\aswTdi.sys
20:39:05.0046 0812 aswTdi - ok
20:39:05.0046 0812 aswUpdSv - ok
20:39:05.0078 0812 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys
20:39:05.0218 0812 AsyncMac - ok
20:39:05.0234 0812 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys
20:39:05.0390 0812 atapi - ok
20:39:05.0390 0812 Atdisk - ok
20:39:05.0406 0812 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys
20:39:05.0546 0812 Atmarpc - ok
20:39:05.0562 0812 [ DE31B88962A8645DBA5A37B993E7B0F1 ] AudioSrv C:\WINDOWS\System32\audiosrv.dll
20:39:05.0703 0812 AudioSrv - ok
20:39:05.0734 0812 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys
20:39:05.0875 0812 audstub - ok
20:39:05.0937 0812 [ 8FA553E9AE69808D99C164733A0F9590 ] avast! Antivirus C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
20:39:05.0953 0812 avast! Antivirus - ok
20:39:05.0984 0812 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINDOWS\system32\drivers\Beep.sys
20:39:06.0125 0812 Beep - ok
20:39:06.0156 0812 [ 19395D092FD85DDC2D9C7729CF5A2AC8 ] BITS C:\WINDOWS\system32\qmgr.dll
20:39:06.0312 0812 BITS - ok
20:39:06.0359 0812 [ 89E739BBA5F636297EA5B5F811189E06 ] Browser C:\WINDOWS\System32\browser.dll
20:39:06.0375 0812 Browser - ok
20:39:06.0375 0812 catchme - ok
20:39:06.0406 0812 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys
20:39:06.0546 0812 cbidf2k - ok
20:39:06.0562 0812 [ 0BE5AEF125BE881C4F854C554F2B025C ] CCDECODE C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
20:39:06.0703 0812 CCDECODE - ok
20:39:06.0703 0812 cd20xrnt - ok
20:39:06.0734 0812 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys
20:39:06.0875 0812 Cdaudio - ok
20:39:06.0906 0812 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys
20:39:07.0046 0812 Cdfs - ok
20:39:07.0062 0812 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys
20:39:07.0218 0812 Cdrom - ok
20:39:07.0234 0812 Changer - ok
20:39:07.0250 0812 [ E390DC1D7C461D7D56EC53402F329928 ] CiSvc C:\WINDOWS\system32\cisvc.exe
20:39:07.0406 0812 CiSvc - ok
20:39:07.0421 0812 [ 064507A8DFA8C5C7E2FFDDD3E6F424FA ] ClipSrv C:\WINDOWS\system32\clipsrv.exe
20:39:07.0578 0812 ClipSrv - ok
20:39:07.0625 0812 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
20:39:07.0718 0812 clr_optimization_v2.0.50727_32 - ok
20:39:07.0750 0812 [ 0F6C187D38D98F8DF904589A5F94D411 ] CmBatt C:\WINDOWS\system32\DRIVERS\CmBatt.sys
20:39:07.0890 0812 CmBatt - ok
20:39:07.0890 0812 CmdIde - ok
20:39:07.0906 0812 [ 6E4C9F21F0FAE8940661144F41B13203 ] Compbatt C:\WINDOWS\system32\DRIVERS\compbatt.sys
20:39:08.0046 0812 Compbatt - ok
20:39:08.0062 0812 COMSysApp - ok
20:39:08.0062 0812 Cpqarray - ok
20:39:08.0093 0812 [ F3AB0933CBD166D271992F411C27CCAF ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll
20:39:08.0250 0812 CryptSvc - ok
20:39:08.0250 0812 dac2w2k - ok
20:39:08.0250 0812 dac960nt - ok
20:39:08.0296 0812 [ BE27674D1CBC3214AEC84B4336A38BBF ] DcomLaunch C:\WINDOWS\system32\rpcss.dll
20:39:08.0328 0812 DcomLaunch - ok
20:39:08.0359 0812 [ 8C9A53E285AC5E6704844D0459EC85BE ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll
20:39:08.0484 0812 Dhcp - ok
20:39:08.0515 0812 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys
20:39:08.0656 0812 Disk - ok
20:39:08.0656 0812 dmadmin - ok
20:39:08.0718 0812 [ DB5FD2BF5B07DC54BFCB3664FF05BD7C ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys
20:39:08.0875 0812 dmboot - ok
20:39:08.0875 0812 [ FFF1720AF51171F32F1EAD5CF71F2810 ] dmio C:\WINDOWS\system32\drivers\dmio.sys
20:39:09.0046 0812 dmio - ok
20:39:09.0078 0812 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINDOWS\system32\drivers\dmload.sys
20:39:09.0218 0812 dmload - ok
20:39:09.0218 0812 [ 2BFEFE9E865655A76982F050450B9591 ] dmserver C:\WINDOWS\System32\dmserver.dll
20:39:09.0359 0812 dmserver - ok
20:39:09.0375 0812 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys
20:39:09.0531 0812 DMusic - ok
20:39:09.0562 0812 [ DFAA406BF19F4EE806A6F8D4342137F7 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll
20:39:09.0593 0812 Dnscache - ok
20:39:09.0609 0812 [ 4A3E2BD20157A0946751229E92EB8621 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll
20:39:09.0765 0812 Dot3svc - ok
20:39:09.0765 0812 dpti2o - ok
20:39:09.0812 0812 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys
20:39:09.0937 0812 drmkaud - ok
20:39:09.0968 0812 [ 0887D9C2BE8D940778CAD1E3B85F2A41 ] EapHost C:\WINDOWS\System32\eapsvc.dll
20:39:10.0093 0812 EapHost - ok
20:39:10.0125 0812 [ A2A4912798F2BE706ABADD3D30800D16 ] ERSvc C:\WINDOWS\System32\ersvc.dll
20:39:10.0265 0812 ERSvc - ok
20:39:10.0281 0812 [ 9EF697AF07BB8DD82C3B02CA953A95B7 ] Eventlog C:\WINDOWS\system32\services.exe
20:39:10.0312 0812 Eventlog - ok
20:39:10.0343 0812 [ A371F11EF07653591C8DE26AFB13CE7F ] EventSystem C:\WINDOWS\system32\es.dll
20:39:10.0375 0812 EventSystem - ok
20:39:10.0375 0812 EverestDriver - ok
20:39:10.0421 0812 [ 38D332A6D56AF32635675F132548343E ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys
20:39:10.0546 0812 Fastfat - ok
20:39:10.0578 0812 [ EE9A2B9EA968A792A053C9D1A86BF870 ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll
20:39:10.0609 0812 FastUserSwitchingCompatibility - ok
20:39:10.0640 0812 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc C:\WINDOWS\system32\drivers\Fdc.sys
20:39:10.0781 0812 Fdc - ok
20:39:10.0781 0812 Suspicious service (NoAccess): FGLPMCLA
20:39:10.0843 0812 [ 102C4B15D5E69F399E98EEF8735D0A71 ] FGLPMCLA C:\WINDOWS\system32\DRIVERS\fglpmcla.sys
20:39:10.0843 0812 FGLPMCLA ( LockedService.Multi.Generic ) - warning
20:39:10.0843 0812 FGLPMCLA - detected LockedService.Multi.Generic (1)
20:39:10.0843 0812 Suspicious service (NoAccess): FGLPMKER
20:39:10.0859 0812 [ F969755741414C21105FADA2FE028D13 ] FGLPMKER C:\WINDOWS\system32\DRIVERS\fglpmkervault.sys
20:39:10.0875 0812 FGLPMKER ( LockedService.Multi.Generic ) - warning
20:39:10.0875 0812 FGLPMKER - detected LockedService.Multi.Generic (1)
20:39:11.0015 0812 [ FB75DAF11F4662A18B4F0C2A460DF7D5 ] FGSchedules C:\Program Files\Microsoft Activation Assistant\FGUPM.exe
20:39:11.0093 0812 FGSchedules ( UnsignedFile.Multi.Generic ) - warning
20:39:11.0093 0812 FGSchedules - detected UnsignedFile.Multi.Generic (1)
20:39:11.0109 0812 [ FB75DAF11F4662A18B4F0C2A460DF7D5 ] FGUPM C:\Program Files\Microsoft Activation Assistant\FGUPM.exe
20:39:11.0125 0812 FGUPM ( UnsignedFile.Multi.Generic ) - warning
20:39:11.0125 0812 FGUPM - detected UnsignedFile.Multi.Generic (1)
20:39:11.0156 0812 [ AC366695A0796560AA37215AD5762AAF ] Fips C:\WINDOWS\system32\drivers\Fips.sys
20:39:11.0312 0812 Fips - ok
20:39:11.0312 0812 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk C:\WINDOWS\system32\drivers\Flpydisk.sys
20:39:11.0453 0812 Flpydisk - ok
20:39:11.0484 0812 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr C:\WINDOWS\system32\DRIVERS\fltMgr.sys
20:39:11.0609 0812 FltMgr - ok
20:39:11.0671 0812 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
20:39:11.0687 0812 FontCache3.0.0.0 - ok
20:39:11.0687 0812 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys
20:39:11.0843 0812 Fs_Rec - ok
20:39:11.0859 0812 [ 4E664D8541DB4A66B73A24257E322E1F ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys
20:39:12.0015 0812 Ftdisk - ok
20:39:12.0031 0812 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys
20:39:12.0187 0812 Gpc - ok
20:39:12.0218 0812 [ 4905D28AA09F63E6A2F4E93ED6DD7D19 ] HdAudAddService C:\WINDOWS\system32\drivers\CHDAud.sys
20:39:12.0296 0812 HdAudAddService - ok
20:39:12.0343 0812 [ 573C7D0A32852B48F3058CFD8026F511 ] HDAudBus C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
20:39:12.0468 0812 HDAudBus - ok
20:39:12.0531 0812 [ FCFE31FB75F8A6295B6B0AF87A626282 ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
20:39:12.0687 0812 helpsvc - ok
20:39:12.0703 0812 HidServ - ok
20:39:12.0734 0812 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] HidUsb C:\WINDOWS\system32\DRIVERS\hidusb.sys
20:39:12.0875 0812 HidUsb - ok
20:39:12.0906 0812 [ 7A6B320928F86BC851530D63C82965D9 ] hkmsvc C:\WINDOWS\System32\kmsvc.dll
20:39:13.0062 0812 hkmsvc - ok
20:39:13.0062 0812 hpn - ok
20:39:13.0109 0812 [ 04C1DCBB226C6AE647B794833CE3CEB6 ] hpqwmiex C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
20:39:13.0125 0812 hpqwmiex ( UnsignedFile.Multi.Generic ) - warning
20:39:13.0125 0812 hpqwmiex - detected UnsignedFile.Multi.Generic (1)
20:39:13.0171 0812 [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys
20:39:13.0187 0812 HTTP - ok
20:39:13.0218 0812 [ 58FE2F2DA3BC5573F4A35B3760D3125F ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll
20:39:13.0359 0812 HTTPFilter - ok
20:39:13.0359 0812 i2omgmt - ok
20:39:13.0375 0812 i2omp - ok
20:39:13.0390 0812 [ C528E27945367191E7BAE364930B6932 ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys
20:39:13.0546 0812 i8042prt - ok
20:39:13.0625 0812 [ 1CF03C69B49ACB70C722DF92755C0C8C ] IDriverT C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
20:39:13.0640 0812 IDriverT ( UnsignedFile.Multi.Generic ) - warning
20:39:13.0640 0812 IDriverT - detected UnsignedFile.Multi.Generic (1)
20:39:13.0718 0812 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
20:39:13.0796 0812 idsvc - ok
20:39:13.0828 0812 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys
20:39:13.0968 0812 Imapi - ok
20:39:14.0000 0812 [ F7B93AAFAD33B2320954C17E26C8D361 ] ImapiService C:\WINDOWS\system32\imapi.exe
20:39:14.0140 0812 ImapiService - ok
20:39:14.0140 0812 ini910u - ok
20:39:14.0156 0812 IntelIde - ok
20:39:14.0187 0812 [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
20:39:14.0328 0812 Ip6Fw - ok
20:39:14.0359 0812 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
20:39:14.0515 0812 IpFilterDriver - ok
20:39:14.0515 0812 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys
20:39:14.0656 0812 IpInIp - ok
20:39:14.0687 0812 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys
20:39:14.0843 0812 IpNat - ok
20:39:14.0875 0812 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys
20:39:15.0031 0812 IPSec - ok
20:39:15.0062 0812 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys
20:39:15.0125 0812 IRENUM - ok
20:39:15.0140 0812 [ CC9F8A2D60AED1A51A3AC34C59B987AE ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys
20:39:15.0296 0812 isapnp - ok
20:39:15.0359 0812 [ 691B9B7C0CC1653732717D292D6B305D ] JavaQuickStarterService C:\Program Files\Java\jre6\bin\jqs.exe
20:39:15.0375 0812 JavaQuickStarterService - ok
20:39:15.0406 0812 [ 1B6162FE7F66B1A71A4B70F941C4AA9B ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys
20:39:15.0546 0812 Kbdclass - ok
20:39:15.0578 0812 [ 692BCF44383D056AED41B045A323D378 ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys
20:39:15.0703 0812 kmixer - ok
20:39:15.0734 0812 [ B467646C54CC746128904E1654C750C1 ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys
20:39:15.0765 0812 KSecDD - ok
20:39:15.0796 0812 [ 3428E8F86F8ADD36B42FB23542C7B3E4 ] LanmanServer C:\WINDOWS\System32\srvsvc.dll
20:39:15.0828 0812 LanmanServer - ok
20:39:15.0875 0812 [ 936C1D110232D23B621CB0196E4F80F0 ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll
20:39:15.0906 0812 lanmanworkstation - ok
20:39:15.0921 0812 lbrtfdc - ok
20:39:15.0937 0812 [ 0AB159F536E3E8F7F07113702A07CCA5 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll
20:39:16.0093 0812 LmHosts - ok
20:39:16.0125 0812 [ 0B058116D3D4ECCA7DED38F16E0581B2 ] massfilter C:\WINDOWS\system32\drivers\massfilter.sys
20:39:16.0156 0812 massfilter - ok
20:39:16.0171 0812 [ 221CD1C815B8A6B79389C3F5D1018DE8 ] Messenger C:\WINDOWS\System32\msgsvc.dll
20:39:16.0312 0812 Messenger - ok
20:39:16.0343 0812 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys
20:39:16.0484 0812 mnmdd - ok
20:39:16.0515 0812 [ 9A57D046F88F4B69751B11FD40088A61 ] mnmsrvc C:\WINDOWS\system32\mnmsrvc.exe
20:39:16.0671 0812 mnmsrvc - ok
20:39:16.0687 0812 [ 44032B0C6D9954D3FD26438330B99EE7 ] Modem C:\WINDOWS\system32\drivers\Modem.sys
20:39:16.0828 0812 Modem - ok
20:39:16.0828 0812 [ 4CB582831DBDE63CE43B45D771218374 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys
20:39:16.0984 0812 Mouclass - ok
20:39:17.0031 0812 [ BB269EBA740737AB749B214D568B6812 ] mouhid C:\WINDOWS\system32\DRIVERS\mouhid.sys
20:39:17.0156 0812 mouhid - ok
20:39:17.0187 0812 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys
20:39:17.0328 0812 MountMgr - ok
20:39:17.0375 0812 [ 313265CF4F5F02ED927774DA1DB3FE00 ] MozillaMaintenance C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
20:39:17.0390 0812 MozillaMaintenance - ok
20:39:17.0406 0812 mraid35x - ok
20:39:17.0421 0812 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys
20:39:17.0562 0812 MRxDAV - ok
20:39:17.0609 0812 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
20:39:17.0656 0812 MRxSmb - ok
20:39:17.0703 0812 [ 6DB4D1521CABA9A5FFAB54ADE0AE867D ] MSDTC C:\WINDOWS\system32\msdtc.exe
20:39:17.0843 0812 MSDTC - ok
20:39:17.0859 0812 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys
20:39:18.0000 0812 Msfs - ok
20:39:18.0015 0812 MSIServer - ok
20:39:18.0046 0812 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys
20:39:18.0187 0812 MSKSSRV - ok
20:39:18.0203 0812 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys
20:39:18.0359 0812 MSPCLOCK - ok
20:39:18.0375 0812 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys
20:39:18.0531 0812 MSPQM - ok
20:39:18.0562 0812 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys
20:39:18.0687 0812 mssmbios - ok
20:39:18.0718 0812 [ E53736A9E30C45FA9E7B5EAC55056D1D ] MSTEE C:\WINDOWS\system32\drivers\MSTEE.sys
20:39:18.0859 0812 MSTEE - ok
20:39:18.0875 0812 [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup C:\WINDOWS\system32\drivers\Mup.sys
20:39:18.0890 0812 Mup - ok
20:39:18.0906 0812 [ 5B50F1B2A2ED47D560577B221DA734DB ] NABTSFEC C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
20:39:19.0062 0812 NABTSFEC - ok
20:39:19.0093 0812 [ 6EA362E9DB03D44F6B996F4D8BE237E9 ] napagent C:\WINDOWS\System32\qagentrt.dll
20:39:19.0250 0812 napagent - ok
20:39:19.0281 0812 [ 1DF7F42665C94B825322FAE71721130D ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys
20:39:19.0453 0812 NDIS - ok
20:39:19.0468 0812 [ 7FF1F1FD8609C149AA432F95A8163D97 ] NdisIP C:\WINDOWS\system32\DRIVERS\NdisIP.sys
20:39:19.0609 0812 NdisIP - ok
20:39:19.0640 0812 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys
20:39:19.0656 0812 NdisTapi - ok
20:39:19.0687 0812 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys
20:39:19.0843 0812 Ndisuio - ok
20:39:19.0875 0812 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys
20:39:20.0015 0812 NdisWan - ok
20:39:20.0046 0812 [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys
20:39:20.0078 0812 NDProxy - ok
20:39:20.0109 0812 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys
20:39:20.0265 0812 NetBIOS - ok
20:39:20.0296 0812 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys
20:39:20.0421 0812 NetBT - ok
20:39:20.0468 0812 [ 933DE774986EC85E48210C44AB431DE6 ] NetDDE C:\WINDOWS\system32\netdde.exe
20:39:20.0656 0812 NetDDE - ok
20:39:20.0656 0812 [ 933DE774986EC85E48210C44AB431DE6 ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe
20:39:20.0796 0812 NetDDEdsdm - ok
20:39:20.0828 0812 [ ED0A176354487CEED65B80A7148AB739 ] Netlogon C:\WINDOWS\system32\lsass.exe
20:39:21.0000 0812 Netlogon - ok
20:39:21.0015 0812 [ 72E1E9E2977BE08BDEEDB6D8FD9D4D40 ] Netman C:\WINDOWS\System32\netman.dll
20:39:21.0156 0812 Netman - ok
20:39:21.0203 0812 [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
20:39:21.0218 0812 NetTcpPortSharing - ok
20:39:21.0250 0812 [ 39EE7C3BFBC64BA87CC8CF67386E814C ] Nla C:\WINDOWS\System32\mswsock.dll
20:39:21.0296 0812 Nla - ok
20:39:21.0328 0812 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys
20:39:21.0484 0812 Npfs - ok
20:39:21.0531 0812 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys
20:39:21.0687 0812 Ntfs - ok
20:39:21.0703 0812 [ ED0A176354487CEED65B80A7148AB739 ] NtLmSsp C:\WINDOWS\system32\lsass.exe
20:39:21.0843 0812 NtLmSsp - ok
20:39:21.0875 0812 [ 023DD70573D644F3D9C8B1258A7BFD08 ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll
20:39:22.0046 0812 NtmsSvc - ok
20:39:22.0062 0812 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINDOWS\system32\drivers\Null.sys
20:39:22.0203 0812 Null - ok
20:39:22.0406 0812 [ 71D5AE11BF1A595D987BE8EA36365E83 ] nv C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
20:39:22.0765 0812 nv - ok
20:39:22.0812 0812 [ 982702A22349C2B31F7DCEF62241058F ] NVENETFD C:\WINDOWS\system32\DRIVERS\NVENETFD.sys
20:39:22.0828 0812 NVENETFD - ok
20:39:22.0859 0812 [ BC0F2C4ED9D6DA9A2519C55AF7D4FC60 ] nvnetbus C:\WINDOWS\system32\DRIVERS\nvnetbus.sys
20:39:22.0890 0812 nvnetbus - ok
20:39:22.0890 0812 [ 9AEBC32F9D6E02EBEE0369AB296FE7C8 ] nvsmu C:\WINDOWS\system32\DRIVERS\nvsmu.sys
20:39:22.0921 0812 nvsmu - ok
20:39:22.0937 0812 [ 5E8878F15555EF4DD41AB2908249E843 ] NVSvc C:\WINDOWS\system32\nvsvc32.exe
20:39:22.0968 0812 NVSvc - ok
20:39:23.0015 0812 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
20:39:23.0171 0812 NwlnkFlt - ok
20:39:23.0187 0812 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
20:39:23.0328 0812 NwlnkFwd - ok
20:39:23.0359 0812 [ CA33832DF41AFB202EE7AEB05145922F ] ohci1394 C:\WINDOWS\system32\DRIVERS\ohci1394.sys
20:39:23.0515 0812 ohci1394 - ok
20:39:23.0531 0812 [ 46F8DB73B4A53E543F8E371DC7C75BAE ] Parport C:\WINDOWS\system32\drivers\Parport.sys
20:39:23.0703 0812 Parport - ok
20:39:23.0718 0812 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys
20:39:23.0859 0812 PartMgr - ok
20:39:23.0890 0812 [ 1FAE19D0457176318BBA4A8795656EBC ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys
20:39:24.0031 0812 ParVdm - ok
20:39:24.0046 0812 [ 6CE351D149CB4BEFC702951E471E1730 ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys
20:39:24.0203 0812 PCI - ok
20:39:24.0203 0812 PCIDump - ok
20:39:24.0234 0812 [ 2DA4EC85E0EA7A45C6B2A05820492D5A ] PCIIde C:\WINDOWS\system32\DRIVERS\pciide.sys
20:39:24.0359 0812 PCIIde - ok
20:39:24.0390 0812 [ 1BEBE7DE8508A02650CDCE45C664C2A2 ] PCLEPCI C:\WINDOWS\system32\drivers\pclepci.sys
20:39:24.0406 0812 PCLEPCI ( UnsignedFile.Multi.Generic ) - warning
20:39:24.0406 0812 PCLEPCI - detected UnsignedFile.Multi.Generic (1)
20:39:24.0437 0812 [ 4FC31E6C19A5CE5198B1ABFF94CAE758 ] Pcmcia C:\WINDOWS\system32\drivers\Pcmcia.sys
20:39:24.0609 0812 Pcmcia - ok
20:39:24.0625 0812 PDCOMP - ok
20:39:24.0625 0812 PDFRAME - ok
20:39:24.0625 0812 PDRELI - ok
20:39:24.0640 0812 PDRFRAME - ok
20:39:24.0640 0812 perc2 - ok
20:39:24.0640 0812 perc2hib - ok
20:39:24.0671 0812 [ 9EF697AF07BB8DD82C3B02CA953A95B7 ] PlugPlay C:\WINDOWS\system32\services.exe
20:39:24.0703 0812 PlugPlay - ok
20:39:24.0718 0812 [ ED0A176354487CEED65B80A7148AB739 ] PolicyAgent C:\WINDOWS\system32\lsass.exe
20:39:24.0859 0812 PolicyAgent - ok
20:39:24.0875 0812 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys
20:39:25.0062 0812 PptpMiniport - ok
20:39:25.0093 0812 [ 7EB15DCE4EC3A0220BD796A15C18186E ] Processor C:\WINDOWS\system32\DRIVERS\processr.sys
20:39:25.0234 0812 Processor - ok
20:39:25.0234 0812 [ ED0A176354487CEED65B80A7148AB739 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe
20:39:25.0375 0812 ProtectedStorage - ok
20:39:25.0390 0812 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys
20:39:25.0531 0812 PSched - ok
20:39:25.0531 0812 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys
20:39:25.0687 0812 Ptilink - ok
20:39:25.0687 0812 ql1080 - ok
20:39:25.0687 0812 Ql10wnt - ok
20:39:25.0703 0812 ql12160 - ok
20:39:25.0703 0812 ql1240 - ok
20:39:25.0703 0812 ql1280 - ok
20:39:25.0718 0812 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys
20:39:25.0875 0812 RasAcd - ok
20:39:25.0890 0812 [ 2B5E44EA009F2F374B980E1E9A70635D ] RasAuto C:\WINDOWS\System32\rasauto.dll
20:39:26.0046 0812 RasAuto - ok
20:39:26.0078 0812 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
20:39:26.0203 0812 Rasl2tp - ok
20:39:26.0234 0812 [ D57554C664B64604BD1EE13EA2C07E77 ] RasMan C:\WINDOWS\System32\rasmans.dll
20:39:26.0375 0812 RasMan - ok
20:39:26.0390 0812 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys
20:39:26.0531 0812 RasPppoe - ok
20:39:26.0531 0812 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys
20:39:26.0671 0812 Raspti - ok
20:39:26.0703 0812 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys
20:39:26.0843 0812 Rdbss - ok
20:39:26.0859 0812 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
20:39:27.0000 0812 RDPCDD - ok
20:39:27.0031 0812 [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr C:\WINDOWS\system32\DRIVERS\rdpdr.sys
20:39:27.0187 0812 rdpdr - ok
20:39:27.0234 0812 [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys
20:39:27.0250 0812 RDPWD - ok
20:39:27.0296 0812 [ C0D9D9711CB74EE9BC66353D8CBDAB0E ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe
20:39:27.0468 0812 RDSessMgr - ok
20:39:27.0484 0812 [ 611BFD220305BE3A85AE876EA47D4AA5 ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys
20:39:27.0640 0812 redbook - ok
20:39:27.0687 0812 [ 127C26B5371651043450E52542099ABA ] RemoteAccess C:\WINDOWS\System32\mprdim.dll
20:39:27.0843 0812 RemoteAccess - ok
20:39:27.0875 0812 [ 8F31505484A190D5B22274708799F4EC ] RemoteRegistry C:\WINDOWS\system32\regsvc.dll
20:39:28.0031 0812 RemoteRegistry - ok
20:39:28.0062 0812 [ 718B3BDC0BC3C2F7D065A53D26202AF9 ] RpcLocator C:\WINDOWS\system32\locator.exe
20:39:28.0203 0812 RpcLocator - ok
20:39:28.0234 0812 [ BE27674D1CBC3214AEC84B4336A38BBF ] RpcSs C:\WINDOWS\System32\rpcss.dll
20:39:28.0281 0812 RpcSs - ok
20:39:28.0328 0812 [ 09AB2E71E58B078038E3BFDBA7FFC984 ] RSVP C:\WINDOWS\system32\rsvp.exe
20:39:28.0468 0812 RSVP - ok
20:39:28.0484 0812 [ ED0A176354487CEED65B80A7148AB739 ] SamSs C:\WINDOWS\system32\lsass.exe
20:39:28.0640 0812 SamSs - ok
20:39:28.0671 0812 [ 410046E401EB11E1E6749E9DEEA41D4A ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe
20:39:29.0000 0812 SCardSvr - ok
20:39:29.0031 0812 [ 3FF232A7731621B8902D81D42418C93C ] Schedule C:\WINDOWS\system32\schedsvc.dll
20:39:29.0203 0812 Schedule - ok
20:39:29.0218 0812 [ 8D04819A3CE51B9EB47E5689B44D43C4 ] sdbus C:\WINDOWS\system32\DRIVERS\sdbus.sys
20:39:29.0359 0812 sdbus - ok
20:39:29.0390 0812 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys
20:39:29.0453 0812 Secdrv - ok
20:39:29.0468 0812 [ 477E2C3CC5E4A0D635BCB0EA8DCAC3C6 ] seclogon C:\WINDOWS\System32\seclogon.dll
20:39:29.0640 0812 seclogon - ok
20:39:29.0656 0812 [ A530B75C10C23C9AB28FDB6CE719E21F ] SENS C:\WINDOWS\system32\sens.dll
20:39:29.0828 0812 SENS - ok
20:39:29.0859 0812 [ B490AD520257DDA26C1D587A71E527B5 ] Ser2pl C:\WINDOWS\system32\DRIVERS\ser2pl.sys
20:39:29.0890 0812 Ser2pl - ok
20:39:29.0906 0812 [ 0F29512CCD6BEAD730039FB4BD2C85CE ] Serenum C:\WINDOWS\system32\DRIVERS\serenum.sys
20:39:30.0062 0812 Serenum - ok
20:39:30.0078 0812 [ B842729337C9B921615C40D3C1A1AF96 ] Serial C:\WINDOWS\system32\drivers\Serial.sys
20:39:30.0234 0812 Serial - ok
20:39:30.0265 0812 [ 0FA803C64DF0914B41F807EA276BF2A6 ] sffdisk C:\WINDOWS\system32\DRIVERS\sffdisk.sys
20:39:30.0406 0812 sffdisk - ok
20:39:30.0421 0812 [ C17C331E435ED8737525C86A7557B3AC ] sffp_sd C:\WINDOWS\system32\DRIVERS\sffp_sd.sys
20:39:30.0578 0812 sffp_sd - ok
20:39:30.0593 0812 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINDOWS\system32\drivers\Sfloppy.sys
20:39:30.0734 0812 Sfloppy - ok
20:39:30.0750 0812 [ F58FACA9621D2DB01BD0927D9A0A208E ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll
20:39:30.0906 0812 SharedAccess - ok
20:39:30.0937 0812 [ EE9A2B9EA968A792A053C9D1A86BF870 ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll
20:39:30.0968 0812 ShellHWDetection - ok
20:39:30.0968 0812 Simbad - ok
20:39:31.0000 0812 [ 866D538EBE33709A5C9F5C62B73B7D14 ] SLIP C:\WINDOWS\system32\DRIVERS\SLIP.sys
20:39:31.0156 0812 SLIP - ok
20:39:31.0171 0812 Sparrow - ok
20:39:31.0203 0812 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINDOWS\system32\drivers\splitter.sys
20:39:31.0343 0812 splitter - ok
20:39:31.0375 0812 [ 60784F891563FB1B767F70117FC2428F ] Spooler C:\WINDOWS\system32\spoolsv.exe
20:39:31.0421 0812 Spooler - ok
20:39:31.0453 0812 [ 94610C8653635E4459316A0050D55CE7 ] sr C:\WINDOWS\system32\DRIVERS\sr.sys
20:39:31.0515 0812 sr - ok
20:39:31.0531 0812 [ 35B91147124F64AC8081A2EDB9EA4DEE ] srservice C:\WINDOWS\system32\srsvc.dll
20:39:31.0593 0812 srservice - ok
20:39:31.0625 0812 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys
20:39:31.0656 0812 Srv - ok
20:39:31.0687 0812 [ BECD5271DC4E3B7C3D035F790FCBC1E5 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll
20:39:31.0750 0812 SSDPSRV - ok
20:39:31.0812 0812 [ C1CDD9275F6A115BB0AE1D55D8D27BA6 ] stisvc C:\WINDOWS\system32\wiaservc.dll
20:39:31.0968 0812 stisvc - ok
20:39:32.0000 0812 [ 77813007BA6265C4B6098187E6ED79D2 ] streamip C:\WINDOWS\system32\DRIVERS\StreamIP.sys
20:39:32.0140 0812 streamip - ok
20:39:32.0156 0812 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys
20:39:32.0312 0812 swenum - ok
20:39:32.0328 0812 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys
20:39:32.0484 0812 swmidi - ok
20:39:32.0484 0812 SwPrv - ok
20:39:32.0500 0812 symc810 - ok
20:39:32.0500 0812 symc8xx - ok
20:39:32.0515 0812 sym_hi - ok
20:39:32.0515 0812 sym_u3 - ok
20:39:32.0515 0812 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys
20:39:32.0671 0812 sysaudio - ok
20:39:32.0703 0812 [ CE06F01B88ACE199A1BF460CAC29C110 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe
20:39:32.0843 0812 SysmonLog - ok
20:39:32.0875 0812 [ C2546CD7A398476F9DF5614B2AE160E8 ] TapiSrv C:\WINDOWS\System32\tapisrv.dll
20:39:33.0031 0812 TapiSrv - ok
20:39:33.0078 0812 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys
20:39:33.0109 0812 Tcpip - ok
20:39:33.0125 0812 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys
20:39:33.0281 0812 TDPIPE - ok
20:39:33.0296 0812 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys
20:39:33.0437 0812 TDTCP - ok
20:39:33.0453 0812 [ 88155247177638048422893737429D9E ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys
20:39:33.0609 0812 TermDD - ok
20:39:33.0656 0812 [ A75DD6FC3DBEE4FFF5EBC9F2C28BB66E ] TermService C:\WINDOWS\System32\termsrv.dll
20:39:33.0812 0812 TermService - ok
20:39:33.0843 0812 [ EE9A2B9EA968A792A053C9D1A86BF870 ] Themes C:\WINDOWS\System32\shsvcs.dll
20:39:33.0859 0812 Themes - ok
20:39:33.0890 0812 [ CD0CC7B167D78043A41C98D4921EFB54 ] TlntSvr C:\WINDOWS\system32\tlntsvr.exe
20:39:33.0953 0812 TlntSvr - ok
20:39:33.0968 0812 TosIde - ok
20:39:33.0984 0812 [ 38853304CCB938D30E0C4CDE8D2C2A8A ] TrkWks C:\WINDOWS\system32\trkwks.dll
20:39:34.0140 0812 TrkWks - ok
20:39:34.0156 0812 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys
20:39:34.0328 0812 Udfs - ok
20:39:34.0328 0812 UIUSys - ok
20:39:34.0328 0812 ultra - ok
20:39:34.0375 0812 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update C:\WINDOWS\system32\DRIVERS\update.sys
20:39:34.0515 0812 Update - ok
20:39:34.0546 0812 [ 651BD90DCEE5B7BDC74A2EB7C9266F9E ] upnphost C:\WINDOWS\System32\upnphost.dll
20:39:34.0625 0812 upnphost - ok
20:39:34.0640 0812 [ 20A0F6A11959E92908717D09E87D670D ] UPS C:\WINDOWS\System32\ups.exe
20:39:34.0781 0812 UPS - ok
20:39:34.0812 0812 [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys
20:39:35.0078 0812 usbccgp - ok
20:39:35.0093 0812 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys
20:39:35.0234 0812 usbehci - ok
20:39:35.0250 0812 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys
20:39:35.0406 0812 usbhub - ok
20:39:35.0437 0812 [ 0DAECCE65366EA32B162F85F07C6753B ] usbohci C:\WINDOWS\system32\DRIVERS\usbohci.sys
20:39:35.0578 0812 usbohci - ok
20:39:35.0609 0812 [ A717C8721046828520C9EDF31288FC00 ] usbprint C:\WINDOWS\system32\DRIVERS\usbprint.sys
20:39:35.0781 0812 usbprint - ok
20:39:35.0828 0812 [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys
20:39:35.0984 0812 usbscan - ok
20:39:36.0015 0812 [ A32426D9B14A089EAA1D922E0C5801A9 ] USBSTOR C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
20:39:36.0156 0812 USBSTOR - ok
20:39:36.0187 0812 [ 63BBFCA7F390F4C49ED4B96BFB1633E0 ] usbvideo C:\WINDOWS\system32\Drivers\usbvideo.sys
20:39:36.0328 0812 usbvideo - ok
20:39:36.0343 0812 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINDOWS\System32\drivers\vga.sys
20:39:36.0484 0812 VgaSave - ok
20:39:36.0484 0812 Scan interrupted by user!
20:39:36.0484 0812 ================ Scan global ===============================
20:39:36.0484 0812 Scan interrupted by user!
20:39:36.0484 0812 ================ Scan MBR ==================================
20:39:36.0484 0812 Scan interrupted by user!
20:39:36.0484 0812 ================ Scan VBR ==================================
20:39:36.0484 0812 Scan interrupted by user!
20:39:36.0484 0812 ============================================================
20:39:36.0484 0812 Scan finished
20:39:36.0484 0812 ============================================================
20:39:36.0609 3812 Detected object count: 11
20:39:36.0609 3812 Actual detected object count: 11
20:40:40.0296 3812 a347bus ( UnsignedFile.Multi.Generic ) - skipped by user
20:40:40.0296 3812 a347bus ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:40:40.0296 3812 a347scsi ( UnsignedFile.Multi.Generic ) - skipped by user
20:40:40.0296 3812 a347scsi ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:40:40.0296 3812 AddFiltr ( UnsignedFile.Multi.Generic ) - skipped by user
20:40:40.0296 3812 AddFiltr ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:40:40.0296 3812 AR5416 ( UnsignedFile.Multi.Generic ) - skipped by user
20:40:40.0296 3812 AR5416 ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:40:40.0296 3812 FGLPMCLA ( LockedService.Multi.Generic ) - skipped by user
20:40:40.0296 3812 FGLPMCLA ( LockedService.Multi.Generic ) - User select action: Skip
20:40:40.0296 3812 FGLPMKER ( LockedService.Multi.Generic ) - skipped by user
20:40:40.0296 3812 FGLPMKER ( LockedService.Multi.Generic ) - User select action: Skip
20:40:40.0312 3812 FGSchedules ( UnsignedFile.Multi.Generic ) - skipped by user
20:40:40.0312 3812 FGSchedules ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:40:40.0312 3812 FGUPM ( UnsignedFile.Multi.Generic ) - skipped by user
20:40:40.0312 3812 FGUPM ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:40:40.0312 3812 hpqwmiex ( UnsignedFile.Multi.Generic ) - skipped by user
20:40:40.0312 3812 hpqwmiex ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:40:40.0312 3812 IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user
20:40:40.0312 3812 IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:40:40.0312 3812 PCLEPCI ( UnsignedFile.Multi.Generic ) - skipped by user
20:40:40.0312 3812 PCLEPCI ( UnsignedFile.Multi.Generic ) - User select action: Skip

Pokud nemate, tak presunte Combofix na plochu

• Spustte poznamkovy blok (Start-spustit-notepad)
• Zkopirujte skript nize

• Kód: Vybrat vše

  KillAll::
  
  Registry::
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=-
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "NeroFilterCheck"=-
  "RemoteControl8"=-
  "PDVD8LanguageShortcut"=-
  "BDRegion"=-
  "Adobe Reader Speed Launcher"=-
  "Adobe ARM"=-
  "SunJavaUpdateSched"=-
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
  "CTFMON.EXE"=-
  "DWQueuedReporting"=-
  [HKEY_LOCAL_MACHINE\software\microsoft\security center]
  "AntiVirusOverride"=dword:00000000
  
  File::
  c:\windows\Tasks\Adobe Flash Player Updater.job
  c:\windows\Tasks\avast! Emergency Update.job
  c:\windows\Tasks\MP Scheduled Scan.job
  
  DDS::
  FF - prefs.js: keyword.URL - hxxp://dts.search-results.com/sr?src=ff ... 06&sr=0&q=
  
  ClearJavaCache::
  
  Reboot::

• Ulozte vytvoreny TXT jako CFScript.txt
• Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
  
• Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Pokud vyskoci hlaska "Pokus pouzit neplatnou operaci na klic registru, ktery je oznacen pro odstraneni", tak jen restartujte PC - registr se da do kupy - jedna se o vnitrni chybu, kterou zpusobuje CF a autor ji zatim neumi bohuzel opravit

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

ComboFix 12-11-27.01 - HP 29.11.2012 0:46.2.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2047.1383 [GMT 1:00]
Spuštěný z: c:\documents and settings\HP\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\HP\Plocha\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
FILE ::
"c:\windows\Tasks\Adobe Flash Player Updater.job"
"c:\windows\Tasks\avast! Emergency Update.job"
"c:\windows\Tasks\MP Scheduled Scan.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\Tasks\Adobe Flash Player Updater.job
c:\windows\Tasks\avast! Emergency Update.job
c:\windows\Tasks\MP Scheduled Scan.job
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-10-28 do 2012-11-28 )))))))))))))))))))))))))))))))
.
.
2072-04-03 12:13 . 2008-03-21 13:46 607296 ------w- c:\program files\Microsoft Games\Age of Empires III\deformerdllyD.dll
2071-07-25 08:13 . 2006-11-21 19:48 203576 ------w- c:\program files\Microsoft Games\Age of Empires III\autopatcher2.exe
2012-11-27 12:15 . 2012-11-27 12:15 -------- d-----w- C:\rsit
2012-11-27 12:15 . 2012-11-27 12:15 -------- d-----w- c:\program files\trend micro
2012-11-27 12:11 . 2012-11-08 18:00 6812136 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Windows Defender\Definition Updates\{A711BE17-DD3F-43A6-94C0-FAEF0DD9D55A}\mpengine.dll
2012-11-19 15:10 . 2012-10-30 22:51 738504 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-11-16 21:42 . 2012-11-16 21:42 -------- d-----w- c:\program files\Common Files\Java
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-11-09 19:28 . 2012-06-11 08:26 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-11-09 19:28 . 2011-08-05 20:31 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-11-08 18:00 . 2008-12-17 19:03 6812136 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2012-10-30 22:51 . 2008-12-17 20:50 361032 ----a-w- c:\windows\system32\drivers\aswSP.sys
2012-10-30 22:51 . 2008-12-17 20:21 54232 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2012-10-30 22:51 . 2008-12-17 20:21 35928 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2012-10-30 22:51 . 2008-12-17 20:21 97608 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2012-10-30 22:51 . 2008-12-17 20:21 89752 ----a-w- c:\windows\system32\drivers\aswmon.sys
2012-10-30 22:51 . 2008-12-17 20:50 21256 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-10-30 22:51 . 2008-12-17 20:21 25256 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2012-10-30 22:51 . 2010-10-21 18:20 41224 ----a-w- c:\windows\avastSS.scr
2012-10-30 22:50 . 2008-12-17 20:21 227648 ----a-w- c:\windows\system32\aswBoot.exe
2012-10-22 19:57 . 2008-08-20 12:00 1866368 ----a-w- c:\windows\system32\win32k.sys
2012-10-02 18:04 . 2008-08-20 12:00 58368 ----a-w- c:\windows\system32\synceng.dll
2012-09-24 14:32 . 2012-10-10 18:57 477168 ----a-w- c:\windows\system32\npdeployJava1.dll
2012-09-24 14:32 . 2012-10-10 18:57 473072 ----a-w- c:\windows\system32\deployJava1.dll
2012-09-24 12:51 . 2012-10-10 18:57 73728 ----a-w- c:\windows\system32\javacpl.cpl
2012-11-26 22:11 . 2012-11-26 22:11 262112 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-10-30 22:50 121528 ----a-w- c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-07-27 61952]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-11-06 159744]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-08-23 8478720]
"nwiz"="nwiz.exe" [2007-08-23 1626112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-08-23 81920]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [19.11.2012 16:10 738504]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [17.12.2008 21:50 361032]
R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};c:\program files\CyberLink\PowerDVD8\000.fcl [15.5.2008 12:07 61424]
R2 ameisvc;Web'n'walk Manager mobile equipment installation service;c:\program files\T-Mobile\Web'n'walk Manager\ameisvc.exe [12.6.2012 12:01 124856]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [17.12.2008 21:50 21256]
R2 FGSchedules;FlexGo Schedules Service;c:\program files\Microsoft Activation Assistant\FGUPM.exe [9.6.2008 17:50 564016]
R2 FGUPM;FlexGo UPM Service;c:\program files\Microsoft Activation Assistant\FGUPM.exe [9.6.2008 17:50 564016]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [3.11.2006 19:19 13592]
R3 FGLPMCLA;LPM Class Device Driver;c:\windows\system32\drivers\FGLPMCLA.sys [9.6.2008 17:44 26160]
R3 FGLPMKER;Kernel-mode LPM Mini Device Driver;c:\windows\system32\drivers\FGLPMKERVAULT.sys [9.6.2008 17:44 351488]
S3 EverestDriver;Lavalys EVEREST Kernel Driver;\??\g:\everest ultimate edition v. 4.00.976\kerneld.wnt --> g:\everest ultimate edition v. 4.00.976\kerneld.wnt [?]
S3 massfilter;Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [15.2.2011 20:29 9216]
S4 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [17.12.2008 22:56 160640]
S4 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [17.12.2008 22:56 5248]
.
Obsah adresáře 'Naplánované úlohy'
.
2012-11-28 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
TCP: DhcpNameServer = 213.250.192.1 213.250.194.1
TCP: Interfaces\{33073D0F-A0A9-48EE-80FE-1C120F079D71}: NameServer = 192.168.2.1,213.250.192.1
FF - ProfilePath - c:\documents and settings\HP\Data aplikací\Mozilla\Firefox\Profiles\n76aviwn.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://dts.search-results.com/sr?src=ffb&appid=418&systemid=406&sr=0&q=
FF - ExtSQL: 2012-10-10 20:57; {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}; c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
FF - ExtSQL: 2012-11-16 22:40; {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}; c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
FF - ExtSQL: !HIDDEN! 2010-01-27 08:26; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-11-29 00:54
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EverestDriver]
"ImagePath"="\??\g:\everest ultimate edition v. 4.00.976\kerneld.wnt"
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD8\000.fcl"
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\FGLPMCLA]
"ImagePath"="system32\DRIVERS\fglpmcla.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\FGLPMKER]
"ImagePath"="system32\DRIVERS\fglpmkervault.sys"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'explorer.exe'(2604)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\RUNDLL32.EXE
.
**************************************************************************
.
Celkový čas: 2012-11-29 00:57:32 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-11-28 23:57
ComboFix2.txt 2012-11-27 13:22
.
Před spuštěním: Volných bajtů: 21 354 283 008
Po spuštění: Volných bajtů: 21 498 724 352
.
- - End Of File - - DD28D56135CE4383F1FB0429A9350675

Fajn, jak se chova PC

Zdravím, vše vypadá zatím ok, akorát přestal mi automaticky najíždět po spuštění Avast. Nějakej nápad? nebo ho mám zkusit přeinstalovat?

Tak jeste uklidime

Odinstalujte Combofix

• Prejmenujte ComboFix na Uninstall
• Spustte jej
• Tohle smaze Combofix a jeho slozky

T-Cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe

• Stahnete a spustte
• Pro potvrzeni volby mackejte A, Enter
• Po pouziti utilitu smazte
• Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

OTC http://oldtimer.geekstogo.com/OTC.exe

• Stahnete a spustte
• Kliknete na CleanUp a potvrdte YES
• Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

• Stahnete a spustte
• Kliknete na Start a potvrdte OK
• Program uklidi a restartuje pc
• Po pouziti utilitu smazte

Stahnete Ccleaner http://forum.viry.cz/viewtopic.php?t=7478
Panel čistič

• Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

• dejte Hledej problémy
• nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
• postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

• Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za tyden

Avast preinstalujte

A pokud nejsou problemy ci dotazy, je to z me strany vse

Zdravím. Vše už zase valí tak jak má. Takže moc děkuju za Váš čas a pomoc.
Díky.