Dobrý den, mám problém s virem. Pokoušel jsem se ho odstarnit podle návodu na internetu. Ale po restartu byl opět nalezen antivirem, nicméně počítač už beží podstatně lépe. Prosím o radu.
log:
Logfile of random's system information tool 1.09 (written by random/random)
Run by katka at 2013-07-01 17:33:44
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 10 GB (13%) free of 76 GB
Total RAM: 1527 MB (50% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:33:57, on 1.7.2013
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Y Soft\SafeQ Client\Client\SafeQ Client.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Stickies\stickies.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\katka\Dokumenty\Stažené soubory\RSIT.exe
C:\Program Files\trend micro\katka.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = About:Blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?affID=111881 ... 1a738abb82
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.myheritage.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SafeQ Client] "C:\Program Files\Y Soft\SafeQ Client\Client\SafeQ Client.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Startup: Stickies.lnk = C:\Program Files\Stickies\stickies.exe
O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Stickies.lnk = C:\Program Files\Stickies\stickies.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/katka/LOCALS~1/Temp/msohtmlclip1/01/clip_image002.jpg
--
End of file - 13184 bytes
======Scheduled tasks folder======
C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
C:\WINDOWS\tasks\Adobe Flash Player Updater.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\Norton Security Scan for katka.job
=========Mozilla firefox=========
ProfilePath - C:\Documents and Settings\katka\Data aplikací\Mozilla\Firefox\Profiles\w11n10ul.default
prefs.js - "browser.search.suggest.enabled" - false
prefs.js - "browser.search.useDBForOrder" - true
prefs.js - "browser.startup.homepage" - "http://www.seznam.cz/"
prefs.js - "keyword.URL" - "http://search.babylon.com/?affID=111881 ... 38abb82&q="
"{20a82645-c095-46ed-80e3-08825760534b}"=c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
"jqs@sun.com"=C:\Program Files\Java\jre6\lib\deploy\jqs\ff
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.7.700.224 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/ShockwavePlayer]
"Description"=Adobe Shockwave Player
"Path"=C:\WINDOWS\system32\Adobe\Director\np32dsw.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WPF,version=3.5]
"Description"=Windows Presentation Foundation plug-in for Mozilla browsers
"Path"=c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll
C:\Program Files\Mozilla Firefox\extensions\
{800b5000-a755-47e1-992b-48a1c1357f07}
{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
C:\Program Files\Mozilla Firefox\plugins\
npdeployJava1.dll
nppdf32.dll
np_gp.dll
C:\Program Files\Mozilla Firefox\searchplugins\
babylon.xml
mall-cz.xml
C:\Documents and Settings\katka\Data aplikací\Mozilla\Firefox\Profiles\w11n10ul.default\extensions\
{003D3EDC-99B9-4a34-9C20-60CB94F7E829}
{20a82645-c095-46ed-80e3-08825760534b}
C:\Documents and Settings\katka\Data aplikací\Mozilla\Firefox\Profiles\w11n10ul.default\searchplugins\
icqplugin-12.xml
icqplugin-13.xml
icqplugin-14.xml
icqplugin-15.xml
icqplugin-16.xml
icqplugin-17.xml
icqplugin-18.xml
icqplugin-19.xml
icqplugin-2.xml
icqplugin-20.xml
icqplugin-21.xml
icqplugin-3.xml
icqplugin-4.xml
icqplugin-5.xml
icqplugin-6.xml
icqplugin-7.xml
icqplugin-8.xml
icqplugin-9.xml
icqplugin.xml
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23 60568]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2DB66063-BB98-466A-AA0D-3E7ACF5ED853}]
WebTransBHO Class - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll [2011-05-03 520192]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2007-08-31 1122128]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2013-06-25 192592]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Browser Helper - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2011-10-10 3834016]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll [2012-12-15 1000984]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-08-04 42272]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2011-08-04 79648]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{BFC32E1D-EE75-4A48-BC60-104E11EE2431} - WebTranslator - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll [2011-05-03 520192]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2013-06-25 192592]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"=C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [2005-10-12 139264]
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2007-08-08 141848]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2007-08-08 162328]
"Persistence"=C:\WINDOWS\system32\igfxpers.exe [2007-08-08 137752]
"SoundMAXPnP"=C:\Program Files\Analog Devices\Core\smax4pnp.exe [2005-05-20 925696]
"SoundMAX"=C:\Program Files\Analog Devices\SoundMAX\Smax4.exe [2005-05-06 716800]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2007-06-07 827392]
"hpWirelessAssistant"=C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe [2006-02-14 454656]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2009-02-26 30040]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2011-04-08 254696]
"HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2006-12-10 49152]
"SafeQ Client"=C:\Program Files\Y Soft\SafeQ Client\Client\SafeQ Client.exe [2012-07-20 259072]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-12-18 946352]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232]
"OEXPRESS"= []
"RocketDock"=C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-19 630784]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2010-04-01 357696]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2009-05-16 39408]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
C:\Program Files\DAEMON Tools Lite\daemon.exe -autorun []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
C:\Program Files\ICQ6\ICQ.exe silent []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\JustVoip]
C:\Program Files\JustVoip.com\JustVoip\JustVoip.exe -nosplash -minimized []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files\Skype\Phone\Skype.exe [2012-11-09 17877168]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^katka^Nabídka Start^Programy^Po spuštění^OpenOffice.org 2.3.lnk]
C:\PROGRA~1\OPENOF~1.3\program\QUICKS~1.EXE []
C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
Stickies.lnk - C:\Program Files\Stickies\stickies.exe
C:\Documents and Settings\katka\Nabídka Start\Programy\Po spuštění
RocketDock.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
Stickies.lnk - C:\Program Files\Stickies\stickies.exe
TransBar.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
UberIcon.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
Y'z Shadow.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2007-08-08 204800]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"authentication packages"=msv1_0
nwprovau
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mbamchameleon]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\hitmanpro37]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\hitmanpro37.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mbamchameleon]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoResolveSearch"=1
"HonorAutoRunSetting"=1
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\Program Files\ICQLite\ICQLite.exe"="C:\Program Files\ICQLite\ICQLite.exe:*:Enabled:ICQ Lite"
"C:\Program Files\Microsoft Office\Office12\WINWORD.EXE"="C:\Program Files\Microsoft Office\Office12\WINWORD.EXE:*:Enabled:Microsoft Office Word"
"C:\Program Files\JustVoip.com\JustVoip\JustVoip.exe"="C:\Program Files\JustVoip.com\JustVoip\JustVoip.exe:*:Enabled:JustVoip"
"C:\Documents and Settings\katka\Local Settings\Temp\jivexviewer\jre\bin\JiveX[dv] light"="C:\Documents and Settings\katka\Local Settings\Temp\jivexviewer\jre\bin\JiveX[dv] light:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Documents and Settings\katka\Local Settings\Temp\AlphaZIP-111139515\StrongDC.exe"="C:\Documents and Settings\katka\Local Settings\Temp\AlphaZIP-111139515\StrongDC.exe:*:Enabled:StrongDC++"
"C:\Documents and Settings\katka\Local Settings\Temp\AlphaZIP-27994609\StrongDC.exe"="C:\Documents and Settings\katka\Local Settings\Temp\AlphaZIP-27994609\StrongDC.exe:*:Enabled:StrongDC++"
"C:\DC\StrongDC.exe"="C:\DC\StrongDC.exe:*:Enabled:StrongDC++"
"C:\Program Files\VideoLAN\VLC\vlc.exe"="C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player"
"C:\Program Files\SecondLife\SLVoice.exe"="C:\Program Files\SecondLife\SLVoice.exe:*:Enabled:SLVoice"
"C:\Program Files\ICQ6\ICQ.exe"="C:\Program Files\ICQ6\ICQ.exe:*:Enabled:ICQ6"
"C:\Program Files\ICQ6.5\ICQ.exe"="C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Hasbro Interactive\RollerCoaster Tycoon Demo\rct.exe"="C:\Program Files\Hasbro Interactive\RollerCoaster Tycoon Demo\rct.exe:*:Enabled:rct"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\WINDOWS\system32\muzapp.exe"="C:\WINDOWS\system32\muzapp.exe:*:Enabled:MUZ AOD APP player"
"C:\Documents and Settings\katka\Plocha\DC\StrongDC.exe"="C:\Documents and Settings\katka\Plocha\DC\StrongDC.exe:*:Enabled:StrongDC++"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype. Take a deep breath "
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"VIDC.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVU9"=tsbyuv.dll
"VIDC.YVYU"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.l3acm"=C:\WINDOWS\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"vidc.iv50"=ir50_32.dll
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv41"=ir41_32.ax
"vidc.XVID"=xvidvfw.dll
"MSVideo8"=VfWWDM32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
======List of files/folders created in the last 1 month======
2013-07-01 17:33:44 ----D---- C:\rsit
2013-07-01 17:33:44 ----D---- C:\Program Files\trend micro
2013-07-01 15:47:58 ----D---- C:\Program Files\Common Files\Adobe
2013-07-01 13:07:43 ----D---- C:\Program Files\ESET
2013-07-01 12:49:37 ----D---- C:\Documents and Settings\All Users\Data aplikací\HitmanPro
2013-07-01 12:08:56 ----D---- C:\Documents and Settings\katka\Data aplikací\Malwarebytes
2013-07-01 12:08:50 ----D---- C:\Documents and Settings\All Users\Data aplikací\Malwarebytes
2013-07-01 12:08:49 ----A---- C:\WINDOWS\system32\drivers\mbam.sys
2013-07-01 12:08:48 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2013-07-01 12:08:09 ----A---- C:\WINDOWS\system32\drivers\mbamchameleon.sys
2013-07-01 12:04:14 ----A---- C:\TDSSKiller.2.8.16.0_01.07.2013_12.04.14_log.txt
2013-07-01 10:48:02 ----A---- C:\WINDOWS\ntbtlog.txt
2013-06-24 20:40:44 ----D---- C:\Documents and Settings\katka\Data aplikací\Printer Info Cache
2013-06-24 20:40:42 ----D---- C:\Documents and Settings\katka\Data aplikací\Image Zone Express
2013-06-24 18:18:04 ----D---- C:\Documents and Settings\katka\Data aplikací\stickies
2013-06-24 18:18:03 ----A---- C:\WINDOWS\uninstallstickies.bat
2013-06-24 18:18:02 ----D---- C:\Program Files\Stickies
2013-06-24 18:14:59 ----A---- C:\WINDOWS\system32\DreamPopUpMenu.dll
2013-06-24 18:14:58 ----D---- C:\Program Files\GooferToDo
2013-06-14 09:39:39 ----HDC---- C:\WINDOWS\$NtUninstallKB2839229$
2013-06-12 13:33:02 ----A---- C:\WINDOWS\system32\FlashPlayerInstaller.exe
======List of files/folders modified in the last 1 month======
2013-07-01 17:33:49 ----D---- C:\WINDOWS\Prefetch
2013-07-01 17:33:44 ----RD---- C:\Program Files
2013-07-01 15:53:24 ----SHD---- C:\WINDOWS\Installer
2013-07-01 15:53:23 ----HD---- C:\Config.Msi
2013-07-01 15:50:16 ----D---- C:\WINDOWS\system32
2013-07-01 15:48:10 ----D---- C:\Documents and Settings\All Users\Data aplikací\Adobe
2013-07-01 15:47:58 ----D---- C:\Program Files\Common Files
2013-07-01 15:47:58 ----D---- C:\Program Files\Adobe
2013-07-01 15:40:02 ----D---- C:\WINDOWS\Temp
2013-07-01 15:39:54 ----D---- C:\WINDOWS\system32\CatRoot2
2013-07-01 13:07:05 ----D---- C:\WINDOWS\system32\drivers
2013-07-01 12:22:40 ----HDC---- C:\WINDOWS\$NtUninstallKB938464_0$
2013-07-01 12:21:53 ----D---- C:\Program Files\ICQToolbar
2013-07-01 12:02:41 ----D---- C:\Temp
2013-07-01 10:48:02 ----D---- C:\WINDOWS
2013-07-01 10:46:15 ----A---- C:\WINDOWS\SchedLgU.Txt
2013-06-30 17:55:46 ----D---- C:\Program Files\Common Files\Symantec Shared
2013-06-30 17:18:14 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2013-06-16 15:11:57 ----AC---- C:\WINDOWS\NeroDigital.ini
2013-06-14 09:44:49 ----HD---- C:\WINDOWS\inf
2013-06-14 09:40:38 ----D---- C:\Documents and Settings\All Users\Data aplikací\Microsoft Help
2013-06-14 09:39:43 ----RSHDC---- C:\WINDOWS\system32\dllcache
2013-06-14 09:39:15 ----A---- C:\WINDOWS\imsins.BAK
2013-06-14 09:39:04 ----D---- C:\Program Files\Internet Explorer
2013-06-14 09:38:52 ----D---- C:\WINDOWS\ie8updates
2013-06-12 13:33:06 ----A---- C:\WINDOWS\system32\FlashPlayerApp.exe
2013-06-07 11:13:09 ----D---- C:\Documents and Settings\katka\Data aplikací\Skype
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 iaStor;Intel AHCI Controller; C:\WINDOWS\System32\DRIVERS\iaStor.sys [2005-10-12 874240]
R0 ohci1394;Hostitelský řadič IEEE 1394 dle standardu OHCI Texas Instruments; C:\WINDOWS\System32\DRIVERS\ohci1394.sys [2008-04-13 61696]
R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2010-10-15 691696]
R0 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
R1 A2DDA;A2 Direct Disk Access Support Driver; \??\C:\Documents and Settings\katka\Plocha\Emisoft\Run\a2ddax86.sys []
R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-04-29 96104]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\System32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-06-09 28520]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\System32\DRIVERS\wmiacpi.sys [2008-04-13 8832]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2009-12-07 56816]
R2 NwlnkIpx;Transportní protokol kompatibilní s NWLink IPX/SPX/NetBIOS; C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys [2008-04-13 88320]
R2 NwlnkNb;Služba NWLink pro rozhraní NetBIOS; C:\WINDOWS\system32\DRIVERS\nwlnknb.sys [2002-09-23 63232]
R2 NwlnkSpx;Protokol NWLink SPX/SPXII; C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys [2002-09-23 55936]
R3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\ADIHdAud.sys [2006-02-28 176128]
R3 AEAudioService;AEAudio Service; C:\WINDOWS\system32\drivers\AEAudio.sys [2005-06-07 152960]
R3 AgereSoftModem;Agere Systems Soft Modem; C:\WINDOWS\system32\DRIVERS\AGRSM.sys [2006-08-28 1160320]
R3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\System32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 BCM43XX;Ovladač síťového adaptéru Broadcom 802.11; C:\WINDOWS\system32\DRIVERS\bcmwl5.sys [2006-11-01 604928]
R3 bcm4sbxp;Broadcom 440x 10/100 Integrated Controller; C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys [2005-08-05 45312]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\igxpmp32.sys [2007-08-08 5760096]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\System32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 NWRDR;NetWare Rdr; C:\WINDOWS\system32\DRIVERS\nwrdr.sys [2008-04-13 163584]
R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2007-06-07 201920]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
S3 aybcnrq3;aybcnrq3; C:\WINDOWS\system32\drivers\aybcnrq3.sys []
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 dgderdrv;dgderdrv; C:\WINDOWS\System32\drivers\dgderdrv.sys []
S3 FsUsbExDisk;FsUsbExDisk; \??\C:\WINDOWS\system32\FsUsbExDisk.SYS []
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2005-10-22 49920]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2005-10-22 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2005-10-22 21568]
S3 mbamchameleon;mbamchameleon; \??\C:\WINDOWS\system32\drivers\mbamchameleon.sys []
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 ovt519;VGA USB Camera; C:\WINDOWS\System32\Drivers\ov519vid.sys []
S3 PAC207;Trust WB-1400T Webcam; C:\WINDOWS\system32\DRIVERS\pfc027.sys [2005-02-24 162176]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys []
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 TrueSight;TrueSight; \??\C:\WINDOWS\system32\TrueSight.sys []
S3 usbaudio;Ovladač zvukové karty USB (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 usbvideo;Zobrazovací zařízení USB (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2008-04-13 121984]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2009-08-05 185089]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2009-06-09 108289]
R2 hpqddsvc;Služba HP CUE DeviceDiscovery; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 IAANTMon;Intel(R) Matrix Storage Event Monitor; C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe [2005-10-12 86140]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2011-05-04 153376]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R2 NWCWorkstation;Klient systému NetWare; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R2 STI Simulator;STI Simulator; C:\WINDOWS\System32\PAStiSvc.exe [2005-01-14 53248]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R3 hpqcxs08;hpqcxs08; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S2 bjhwjesr;apucfhg; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-03-10 135664]
S2 kcfbp;Center Driver; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2012-11-09 160944]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-12 256904]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 getPlus(R) Helper;getPlus(R) Helper; C:\Program Files\NOS\bin\getPlus_HelperSvc.exe [2009-06-04 66048]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-03-10 135664]
S3 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2012-08-21 194032]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2009-02-26 64856]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2013-05-17 117144]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-07-20 440696]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
-----------------EOF-----------------
Zavirovaný počítač
Moderátor: Moderátoři
Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Vážení uživaterlé!
Ve dnech 4. - 6-9.2026 budou někteříí naši členové na každoročním srazu fóra. Žádáme vás, abyste měli strpení, nemusí se na na řešení vašeho problému dostat hned. Děkujeme za pochopení.
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Vážení uživaterlé!
Ve dnech 4. - 6-9.2026 budou někteříí naši členové na každoročním srazu fóra. Žádáme vás, abyste měli strpení, nemusí se na na řešení vašeho problému dostat hned. Děkujeme za pochopení.
Re: Zavirovaný počítač
Zdravim 
Co jste tam mel a dle ceho jste to lecil 
Poprosim o tento log C:\TDSSKiller.2.8.16.0_01.07.2013_12.04.14_log.txt
Co jste tam mel a dle ceho jste to lecil Poprosim o tento log C:\TDSSKiller.2.8.16.0_01.07.2013_12.04.14_log.txt"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen
od 1. února 2011.
Člen
od 1. února 2011.Re: Zavirovaný počítač
Avira našla tento virus: TR/Crypt.XPACK.Gen
Postupoval jsem postupně podle tohoto návodu http://malwaretips.com/blogs/remove-trcrypt-xpack-gen
12:04:14.0250 1176 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
12:04:14.0515 1176 ============================================================
12:04:14.0515 1176 Current date / time: 2013/07/01 12:04:14.0515
12:04:14.0515 1176 SystemInfo:
12:04:14.0515 1176
12:04:14.0515 1176 OS Version: 5.1.2600 ServicePack: 3.0
12:04:14.0515 1176 Product type: Workstation
12:04:14.0515 1176 ComputerName: XX-5WI2T6TYBCMW
12:04:14.0515 1176 UserName: katka
12:04:14.0515 1176 Windows directory: C:\WINDOWS
12:04:14.0515 1176 System windows directory: C:\WINDOWS
12:04:14.0515 1176 Processor architecture: Intel x86
12:04:14.0515 1176 Number of processors: 1
12:04:14.0515 1176 Page size: 0x1000
12:04:14.0515 1176 Boot type: Safe boot with network
12:04:14.0515 1176 ============================================================
12:04:15.0796 1176 Drive \Device\Harddisk0\DR0 - Size: 0x12A1F16000 (74.53 Gb), SectorSize: 0x200, Cylinders: 0x2861, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xF0, Type 'K0', Flags 0x00000050
12:04:15.0796 1176 ============================================================
12:04:15.0796 1176 \Device\Harddisk0\DR0:
12:04:15.0796 1176 MBR partitions:
12:04:15.0796 1176 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x950A5C1
12:04:15.0796 1176 ============================================================
12:04:15.0812 1176 C: <-> \Device\Harddisk0\DR0\Partition1
12:04:15.0828 1176 ============================================================
12:04:15.0828 1176 Initialize success
12:04:15.0828 1176 ============================================================
12:04:23.0593 1280 ============================================================
12:04:23.0593 1280 Scan started
12:04:23.0593 1280 Mode: Manual;
12:04:23.0593 1280 ============================================================
12:04:24.0937 1280 ================ Scan system memory ========================
12:04:24.0937 1280 System memory - ok
12:04:24.0937 1280 ================ Scan services =============================
12:04:25.0156 1280 Abiosdsk - ok
12:04:25.0187 1280 abp480n5 - ok
12:04:25.0250 1280 [ 4FE34F1F3126B61FCC6B2043AA8112C9 ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys
12:04:25.0250 1280 ACPI - ok
12:04:25.0296 1280 [ AFDFF022A01F0B11C776F0860C3B282F ] ACPIEC C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
12:04:25.0296 1280 ACPIEC - ok
12:04:25.0359 1280 [ 761D5BBDB6A5867C9F8EBBB545AF7B34 ] ADIHdAudAddService C:\WINDOWS\system32\drivers\ADIHdAud.sys
12:04:25.0359 1280 ADIHdAudAddService - ok
12:04:25.0453 1280 [ 9915504F602D277EE47FD843A677FD15 ] AdobeFlashPlayerUpdateSvc C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
12:04:25.0453 1280 AdobeFlashPlayerUpdateSvc - ok
12:04:25.0484 1280 adpu160m - ok
12:04:25.0515 1280 [ C984DE22ED71414ABC42C1E03D412E33 ] AEAudioService C:\WINDOWS\system32\drivers\AEAudio.sys
12:04:25.0515 1280 AEAudioService - ok
12:04:25.0562 1280 [ 8BED39E3C35D6A489438B8141717A557 ] aec C:\WINDOWS\system32\drivers\aec.sys
12:04:25.0562 1280 aec - ok
12:04:25.0640 1280 [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD C:\WINDOWS\System32\drivers\afd.sys
12:04:25.0640 1280 AFD - ok
12:04:25.0734 1280 [ 90456051C422E09BC36E6340DD891F0C ] AgereSoftModem C:\WINDOWS\system32\DRIVERS\AGRSM.sys
12:04:25.0765 1280 AgereSoftModem - ok
12:04:25.0796 1280 Aha154x - ok
12:04:25.0812 1280 aic78u2 - ok
12:04:25.0859 1280 aic78xx - ok
12:04:25.0890 1280 [ E0A6FA244B8624D78FE5FF6F56A33BAE ] Alerter C:\WINDOWS\system32\alrsvc.dll
12:04:25.0890 1280 Alerter - ok
12:04:25.0937 1280 [ 88842DE939A827577BF24243699AC80A ] ALG C:\WINDOWS\System32\alg.exe
12:04:25.0937 1280 ALG - ok
12:04:25.0953 1280 AliIde - ok
12:04:25.0984 1280 amsint - ok
12:04:26.0078 1280 [ 9015BC03F62940527EC92D45EE89E46F ] AntiVirSchedulerService C:\Program Files\Avira\AntiVir Desktop\sched.exe
12:04:26.0078 1280 AntiVirSchedulerService - ok
12:04:26.0156 1280 [ B8720A787C1223492E6F319465E996CE ] AntiVirService C:\Program Files\Avira\AntiVir Desktop\avguard.exe
12:04:26.0171 1280 AntiVirService - ok
12:04:26.0218 1280 [ 6B8E7A90E576D4FE308F97C69060A171 ] AppMgmt C:\WINDOWS\System32\appmgmts.dll
12:04:26.0218 1280 AppMgmt - ok
12:04:26.0281 1280 [ B5B8A80875C1DEDEDA8B02765642C32F ] Arp1394 C:\WINDOWS\system32\DRIVERS\arp1394.sys
12:04:26.0281 1280 Arp1394 - ok
12:04:26.0312 1280 asc - ok
12:04:26.0328 1280 asc3350p - ok
12:04:26.0359 1280 asc3550 - ok
12:04:26.0484 1280 [ 0E5E4957549056E2BF2C49F4F6B601AD ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
12:04:26.0484 1280 aspnet_state - ok
12:04:26.0531 1280 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys
12:04:26.0531 1280 AsyncMac - ok
12:04:26.0578 1280 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys
12:04:26.0578 1280 atapi - ok
12:04:26.0625 1280 Atdisk - ok
12:04:26.0656 1280 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys
12:04:26.0656 1280 Atmarpc - ok
12:04:26.0718 1280 [ DE31B88962A8645DBA5A37B993E7B0F1 ] AudioSrv C:\WINDOWS\System32\audiosrv.dll
12:04:26.0718 1280 AudioSrv - ok
12:04:26.0750 1280 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys
12:04:26.0750 1280 audstub - ok
12:04:26.0796 1280 [ 6A646C46B9415E13095AA9B352040A7A ] avgio C:\Program Files\Avira\AntiVir Desktop\avgio.sys
12:04:26.0796 1280 avgio - ok
12:04:26.0843 1280 [ 14FE36D8F2C6A2435275338D061A0B66 ] avgntflt C:\WINDOWS\system32\DRIVERS\avgntflt.sys
12:04:26.0843 1280 avgntflt - ok
12:04:26.0921 1280 [ 452E382340BB0C5E694ED9D3625356D0 ] avipbb C:\WINDOWS\system32\DRIVERS\avipbb.sys
12:04:26.0921 1280 avipbb - ok
12:04:27.0015 1280 [ B89BCF0A25AEB3B47030AC83287F894A ] BCM43XX C:\WINDOWS\system32\DRIVERS\bcmwl5.sys
12:04:27.0031 1280 BCM43XX - ok
12:04:27.0062 1280 [ C768C8A463D32C219CE291645A0621A4 ] bcm4sbxp C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys
12:04:27.0062 1280 bcm4sbxp - ok
12:04:27.0109 1280 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINDOWS\system32\drivers\Beep.sys
12:04:27.0109 1280 Beep - ok
12:04:27.0171 1280 [ 19395D092FD85DDC2D9C7729CF5A2AC8 ] BITS C:\WINDOWS\system32\qmgr.dll
12:04:27.0187 1280 BITS - ok
12:04:27.0234 1280 bjhwjesr - ok
12:04:27.0296 1280 [ 89E739BBA5F636297EA5B5F811189E06 ] Browser C:\WINDOWS\System32\browser.dll
12:04:27.0296 1280 Browser - ok
12:04:27.0343 1280 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys
12:04:27.0343 1280 cbidf2k - ok
12:04:27.0437 1280 [ 0BE5AEF125BE881C4F854C554F2B025C ] CCDECODE C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
12:04:27.0437 1280 CCDECODE - ok
12:04:27.0468 1280 cd20xrnt - ok
12:04:27.0500 1280 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys
12:04:27.0500 1280 Cdaudio - ok
12:04:27.0531 1280 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys
12:04:27.0531 1280 Cdfs - ok
12:04:27.0562 1280 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys
12:04:27.0562 1280 Cdrom - ok
12:04:27.0593 1280 Changer - ok
12:04:27.0640 1280 [ E390DC1D7C461D7D56EC53402F329928 ] CiSvc C:\WINDOWS\system32\cisvc.exe
12:04:27.0640 1280 CiSvc - ok
12:04:27.0687 1280 [ 064507A8DFA8C5C7E2FFDDD3E6F424FA ] ClipSrv C:\WINDOWS\system32\clipsrv.exe
12:04:27.0687 1280 ClipSrv - ok
12:04:27.0734 1280 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
12:04:27.0765 1280 clr_optimization_v2.0.50727_32 - ok
12:04:27.0796 1280 [ 0F6C187D38D98F8DF904589A5F94D411 ] CmBatt C:\WINDOWS\system32\DRIVERS\CmBatt.sys
12:04:27.0796 1280 CmBatt - ok
12:04:27.0812 1280 CmdIde - ok
12:04:27.0875 1280 [ 6E4C9F21F0FAE8940661144F41B13203 ] Compbatt C:\WINDOWS\system32\DRIVERS\compbatt.sys
12:04:27.0875 1280 Compbatt - ok
12:04:27.0890 1280 COMSysApp - ok
12:04:27.0937 1280 Cpqarray - ok
12:04:28.0000 1280 [ F3AB0933CBD166D271992F411C27CCAF ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll
12:04:28.0000 1280 CryptSvc - ok
12:04:28.0015 1280 dac2w2k - ok
12:04:28.0046 1280 dac960nt - ok
12:04:28.0109 1280 [ BE27674D1CBC3214AEC84B4336A38BBF ] DcomLaunch C:\WINDOWS\system32\rpcss.dll
12:04:28.0109 1280 DcomLaunch - ok
12:04:28.0125 1280 dgderdrv - ok
12:04:28.0171 1280 [ 8C9A53E285AC5E6704844D0459EC85BE ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll
12:04:28.0171 1280 Dhcp - ok
12:04:28.0187 1280 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys
12:04:28.0187 1280 Disk - ok
12:04:28.0218 1280 dmadmin - ok
12:04:28.0265 1280 [ DB5FD2BF5B07DC54BFCB3664FF05BD7C ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys
12:04:28.0296 1280 dmboot - ok
12:04:28.0343 1280 [ FFF1720AF51171F32F1EAD5CF71F2810 ] dmio C:\WINDOWS\system32\drivers\dmio.sys
12:04:28.0343 1280 dmio - ok
12:04:28.0375 1280 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINDOWS\system32\drivers\dmload.sys
12:04:28.0375 1280 dmload - ok
12:04:28.0421 1280 [ 2BFEFE9E865655A76982F050450B9591 ] dmserver C:\WINDOWS\System32\dmserver.dll
12:04:28.0421 1280 dmserver - ok
12:04:28.0453 1280 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys
12:04:28.0468 1280 DMusic - ok
12:04:28.0546 1280 [ DFAA406BF19F4EE806A6F8D4342137F7 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll
12:04:28.0546 1280 Dnscache - ok
12:04:28.0593 1280 [ 4A3E2BD20157A0946751229E92EB8621 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll
12:04:28.0593 1280 Dot3svc - ok
12:04:28.0609 1280 dpti2o - ok
12:04:28.0687 1280 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys
12:04:28.0687 1280 drmkaud - ok
12:04:28.0734 1280 [ 0887D9C2BE8D940778CAD1E3B85F2A41 ] EapHost C:\WINDOWS\System32\eapsvc.dll
12:04:28.0734 1280 EapHost - ok
12:04:28.0781 1280 [ A2A4912798F2BE706ABADD3D30800D16 ] ERSvc C:\WINDOWS\System32\ersvc.dll
12:04:28.0781 1280 ERSvc - ok
12:04:28.0828 1280 [ 9EF697AF07BB8DD82C3B02CA953A95B7 ] Eventlog C:\WINDOWS\system32\services.exe
12:04:28.0828 1280 Eventlog - ok
12:04:28.0890 1280 [ A371F11EF07653591C8DE26AFB13CE7F ] EventSystem C:\WINDOWS\System32\es.dll
12:04:28.0906 1280 EventSystem - ok
12:04:28.0937 1280 [ 38D332A6D56AF32635675F132548343E ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys
12:04:28.0937 1280 Fastfat - ok
12:04:29.0015 1280 [ EE9A2B9EA968A792A053C9D1A86BF870 ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll
12:04:29.0015 1280 FastUserSwitchingCompatibility - ok
12:04:29.0046 1280 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc C:\WINDOWS\system32\drivers\Fdc.sys
12:04:29.0062 1280 Fdc - ok
12:04:29.0078 1280 [ AC366695A0796560AA37215AD5762AAF ] Fips C:\WINDOWS\system32\drivers\Fips.sys
12:04:29.0078 1280 Fips - ok
12:04:29.0109 1280 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk C:\WINDOWS\system32\drivers\Flpydisk.sys
12:04:29.0109 1280 Flpydisk - ok
12:04:29.0140 1280 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr C:\WINDOWS\system32\drivers\fltmgr.sys
12:04:29.0140 1280 FltMgr - ok
12:04:29.0218 1280 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
12:04:29.0218 1280 FontCache3.0.0.0 - ok
12:04:29.0296 1280 [ CBE5F69A5E5B918225F420BA748F3742 ] FsUsbExDisk C:\WINDOWS\system32\FsUsbExDisk.SYS
12:04:29.0296 1280 FsUsbExDisk - ok
12:04:29.0328 1280 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys
12:04:29.0343 1280 Fs_Rec - ok
12:04:29.0390 1280 [ 4E664D8541DB4A66B73A24257E322E1F ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys
12:04:29.0390 1280 Ftdisk - ok
12:04:29.0437 1280 [ FBF9A126F8F027AC4A35BBEC7BD3275B ] getPlus(R) Helper C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
12:04:29.0437 1280 getPlus(R) Helper - ok
12:04:29.0500 1280 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys
12:04:29.0500 1280 Gpc - ok
12:04:29.0593 1280 [ 8F0DE4FEF8201E306F9938B0905AC96A ] gupdate C:\Program Files\Google\Update\GoogleUpdate.exe
12:04:29.0593 1280 gupdate - ok
12:04:29.0656 1280 [ 8F0DE4FEF8201E306F9938B0905AC96A ] gupdatem C:\Program Files\Google\Update\GoogleUpdate.exe
12:04:29.0656 1280 gupdatem - ok
12:04:29.0718 1280 [ 5D4BC124FAAE6730AC002CDB67BF1A1C ] gusvc C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
12:04:29.0718 1280 gusvc - ok
12:04:29.0765 1280 [ 573C7D0A32852B48F3058CFD8026F511 ] HDAudBus C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
12:04:29.0765 1280 HDAudBus - ok
12:04:29.0843 1280 [ FCFE31FB75F8A6295B6B0AF87A626282 ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
12:04:29.0843 1280 helpsvc - ok
12:04:29.0921 1280 [ 00E25EE90166B3E1BE6E74AEBF858306 ] HidServ C:\WINDOWS\System32\hidserv.dll
12:04:29.0921 1280 HidServ - ok
12:04:29.0968 1280 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] HidUsb C:\WINDOWS\system32\DRIVERS\hidusb.sys
12:04:29.0968 1280 HidUsb - ok
12:04:30.0046 1280 [ 7A6B320928F86BC851530D63C82965D9 ] hkmsvc C:\WINDOWS\System32\kmsvc.dll
12:04:30.0046 1280 hkmsvc - ok
12:04:30.0062 1280 hpn - ok
12:04:30.0187 1280 [ CC8A7D8A8DC9F357B57796583CF8B85F ] hpqcxs08 C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll
12:04:30.0187 1280 hpqcxs08 - ok
12:04:30.0218 1280 [ 4C2CA71CAAFD2CF1A673FC8DBFD219C4 ] hpqddsvc C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll
12:04:30.0234 1280 hpqddsvc - ok
12:04:30.0296 1280 [ D03D10F7DED688FECF50F8FBF1EA9B8A ] HPZid412 C:\WINDOWS\system32\DRIVERS\HPZid412.sys
12:04:30.0296 1280 HPZid412 - ok
12:04:30.0328 1280 [ 89F41658929393487B6B7D13C8528CE3 ] HPZipr12 C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
12:04:30.0328 1280 HPZipr12 - ok
12:04:30.0359 1280 [ ABCB05CCDBF03000354B9553820E39F8 ] HPZius12 C:\WINDOWS\system32\DRIVERS\HPZius12.sys
12:04:30.0359 1280 HPZius12 - ok
12:04:30.0421 1280 [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys
12:04:30.0421 1280 HTTP - ok
12:04:30.0484 1280 [ 58FE2F2DA3BC5573F4A35B3760D3125F ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll
12:04:30.0484 1280 HTTPFilter - ok
12:04:30.0515 1280 i2omgmt - ok
12:04:30.0546 1280 i2omp - ok
12:04:30.0578 1280 [ C528E27945367191E7BAE364930B6932 ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys
12:04:30.0578 1280 i8042prt - ok
12:04:30.0656 1280 [ 0B66A9A2137213075F753579E7D573A5 ] IAANTMon C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
12:04:30.0671 1280 IAANTMon - ok
12:04:30.0890 1280 [ 28423512370705AEDA6A652FEDB25468 ] ialm C:\WINDOWS\system32\DRIVERS\igxpmp32.sys
12:04:31.0046 1280 ialm - ok
12:04:31.0109 1280 [ 309C4D86D989FB1FCF64BD30DC81C51B ] iaStor C:\WINDOWS\system32\DRIVERS\iaStor.sys
12:04:31.0125 1280 iaStor - ok
12:04:31.0203 1280 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
12:04:31.0250 1280 idsvc - ok
12:04:31.0296 1280 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys
12:04:31.0296 1280 Imapi - ok
12:04:31.0359 1280 [ F7B93AAFAD33B2320954C17E26C8D361 ] ImapiService C:\WINDOWS\System32\imapi.exe
12:04:31.0359 1280 ImapiService - ok
12:04:31.0390 1280 ini910u - ok
12:04:31.0468 1280 [ 57D928E548B38502ABBA7A77A6EB7312 ] IntelIde C:\WINDOWS\system32\DRIVERS\intelide.sys
12:04:31.0468 1280 IntelIde - ok
12:04:31.0531 1280 [ 27B290D632AF2CF3CF40BFDDB7370985 ] intelppm C:\WINDOWS\system32\DRIVERS\intelppm.sys
12:04:31.0531 1280 intelppm - ok
12:04:31.0562 1280 [ 3BB22519A194418D5FEC05D800A19AD0 ] ip6fw C:\WINDOWS\system32\drivers\ip6fw.sys
12:04:31.0562 1280 ip6fw - ok
12:04:31.0625 1280 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
12:04:31.0625 1280 IpFilterDriver - ok
12:04:31.0671 1280 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys
12:04:31.0671 1280 IpInIp - ok
12:04:31.0718 1280 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys
12:04:31.0718 1280 IpNat - ok
12:04:31.0750 1280 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys
12:04:31.0750 1280 IPSec - ok
12:04:31.0796 1280 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys
12:04:31.0796 1280 IRENUM - ok
12:04:31.0843 1280 [ CC9F8A2D60AED1A51A3AC34C59B987AE ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys
12:04:31.0843 1280 isapnp - ok
12:04:31.0937 1280 [ 9DBA73C2F1E76EC4CB837E67C5743596 ] JavaQuickStarterService C:\Program Files\Java\jre6\bin\jqs.exe
12:04:31.0953 1280 JavaQuickStarterService - ok
12:04:31.0968 1280 [ 1B6162FE7F66B1A71A4B70F941C4AA9B ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys
12:04:31.0968 1280 Kbdclass - ok
12:04:32.0015 1280 [ 86C8F23616C6C6E5B2776901C17B945B ] kbdhid C:\WINDOWS\system32\DRIVERS\kbdhid.sys
12:04:32.0015 1280 kbdhid - ok
12:04:32.0046 1280 kcfbp - ok
12:04:32.0093 1280 [ 692BCF44383D056AED41B045A323D378 ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys
12:04:32.0093 1280 kmixer - ok
12:04:32.0140 1280 [ B467646C54CC746128904E1654C750C1 ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys
12:04:32.0140 1280 KSecDD - ok
12:04:32.0234 1280 [ 3428E8F86F8ADD36B42FB23542C7B3E4 ] lanmanserver C:\WINDOWS\System32\srvsvc.dll
12:04:32.0234 1280 lanmanserver - ok
12:04:32.0281 1280 [ 936C1D110232D23B621CB0196E4F80F0 ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll
12:04:32.0281 1280 lanmanworkstation - ok
12:04:32.0312 1280 lbrtfdc - ok
12:04:32.0375 1280 [ 0AB159F536E3E8F7F07113702A07CCA5 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll
12:04:32.0375 1280 LmHosts - ok
12:04:32.0437 1280 [ 221CD1C815B8A6B79389C3F5D1018DE8 ] Messenger C:\WINDOWS\System32\msgsvc.dll
12:04:32.0437 1280 Messenger - ok
12:04:32.0546 1280 [ 123271BD5237AB991DC5C21FDF8835EB ] Microsoft Office Groove Audit Service C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe
12:04:32.0546 1280 Microsoft Office Groove Audit Service - ok
12:04:32.0609 1280 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys
12:04:32.0609 1280 mnmdd - ok
12:04:32.0656 1280 [ 9A57D046F88F4B69751B11FD40088A61 ] mnmsrvc C:\WINDOWS\System32\mnmsrvc.exe
12:04:32.0656 1280 mnmsrvc - ok
12:04:32.0718 1280 [ 44032B0C6D9954D3FD26438330B99EE7 ] Modem C:\WINDOWS\system32\drivers\Modem.sys
12:04:32.0718 1280 Modem - ok
12:04:32.0765 1280 [ 4CB582831DBDE63CE43B45D771218374 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys
12:04:32.0765 1280 Mouclass - ok
12:04:32.0828 1280 [ BB269EBA740737AB749B214D568B6812 ] mouhid C:\WINDOWS\system32\DRIVERS\mouhid.sys
12:04:32.0828 1280 mouhid - ok
12:04:32.0859 1280 [ 65653F3B4477F3C63E68A9659F85EE2E ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys
12:04:32.0859 1280 MountMgr - ok
12:04:32.0921 1280 [ 825BF0E46B4470A463AEB641480C5FCA ] MozillaMaintenance C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
12:04:32.0937 1280 MozillaMaintenance - ok
12:04:32.0953 1280 mraid35x - ok
12:04:33.0000 1280 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys
12:04:33.0000 1280 MRxDAV - ok
12:04:33.0078 1280 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
12:04:33.0078 1280 MRxSmb - ok
12:04:33.0125 1280 [ 6DB4D1521CABA9A5FFAB54ADE0AE867D ] MSDTC C:\WINDOWS\System32\msdtc.exe
12:04:33.0125 1280 MSDTC - ok
12:04:33.0187 1280 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys
12:04:33.0187 1280 Msfs - ok
12:04:33.0203 1280 MSIServer - ok
12:04:33.0250 1280 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys
12:04:33.0250 1280 MSKSSRV - ok
12:04:33.0296 1280 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys
12:04:33.0296 1280 MSPCLOCK - ok
12:04:33.0359 1280 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys
12:04:33.0359 1280 MSPQM - ok
12:04:33.0390 1280 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys
12:04:33.0390 1280 mssmbios - ok
12:04:33.0468 1280 [ E53736A9E30C45FA9E7B5EAC55056D1D ] MSTEE C:\WINDOWS\system32\drivers\MSTEE.sys
12:04:33.0468 1280 MSTEE - ok
12:04:33.0515 1280 [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup C:\WINDOWS\system32\drivers\Mup.sys
12:04:33.0515 1280 Mup - ok
12:04:33.0593 1280 [ 5B50F1B2A2ED47D560577B221DA734DB ] NABTSFEC C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
12:04:33.0593 1280 NABTSFEC - ok
12:04:33.0671 1280 [ 6EA362E9DB03D44F6B996F4D8BE237E9 ] napagent C:\WINDOWS\System32\qagentrt.dll
12:04:33.0671 1280 napagent - ok
12:04:33.0703 1280 [ 1DF7F42665C94B825322FAE71721130D ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys
12:04:33.0703 1280 NDIS - ok
12:04:33.0750 1280 [ 7FF1F1FD8609C149AA432F95A8163D97 ] NdisIP C:\WINDOWS\system32\DRIVERS\NdisIP.sys
12:04:33.0750 1280 NdisIP - ok
12:04:33.0796 1280 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys
12:04:33.0796 1280 NdisTapi - ok
12:04:33.0828 1280 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys
12:04:33.0828 1280 Ndisuio - ok
12:04:33.0890 1280 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys
12:04:33.0890 1280 NdisWan - ok
12:04:33.0953 1280 [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys
12:04:33.0953 1280 NDProxy - ok
12:04:34.0015 1280 [ A081CB6FB9A12668F233EB5414BE3A0E ] Net Driver HPZ12 C:\WINDOWS\system32\HPZinw12.dll
12:04:34.0015 1280 Net Driver HPZ12 - ok
12:04:34.0062 1280 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys
12:04:34.0062 1280 NetBIOS - ok
12:04:34.0125 1280 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys
12:04:34.0125 1280 NetBT - ok
12:04:34.0187 1280 [ 933DE774986EC85E48210C44AB431DE6 ] NetDDE C:\WINDOWS\system32\netdde.exe
12:04:34.0187 1280 NetDDE - ok
12:04:34.0203 1280 [ 933DE774986EC85E48210C44AB431DE6 ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe
12:04:34.0218 1280 NetDDEdsdm - ok
12:04:34.0250 1280 [ ED0A176354487CEED65B80A7148AB739 ] Netlogon C:\WINDOWS\System32\lsass.exe
12:04:34.0250 1280 Netlogon - ok
12:04:34.0296 1280 [ 72E1E9E2977BE08BDEEDB6D8FD9D4D40 ] Netman C:\WINDOWS\System32\netman.dll
12:04:34.0296 1280 Netman - ok
12:04:34.0343 1280 [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
12:04:34.0343 1280 NetTcpPortSharing - ok
12:04:34.0390 1280 [ E9E47CFB2D461FA0FC75B7A74C6383EA ] NIC1394 C:\WINDOWS\system32\DRIVERS\nic1394.sys
12:04:34.0390 1280 NIC1394 - ok
12:04:34.0453 1280 [ 39EE7C3BFBC64BA87CC8CF67386E814C ] Nla C:\WINDOWS\System32\mswsock.dll
12:04:34.0453 1280 Nla - ok
12:04:34.0500 1280 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys
12:04:34.0500 1280 Npfs - ok
12:04:34.0562 1280 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys
12:04:34.0578 1280 Ntfs - ok
12:04:34.0593 1280 [ ED0A176354487CEED65B80A7148AB739 ] NtLmSsp C:\WINDOWS\System32\lsass.exe
12:04:34.0593 1280 NtLmSsp - ok
12:04:34.0656 1280 [ 023DD70573D644F3D9C8B1258A7BFD08 ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll
12:04:34.0656 1280 NtmsSvc - ok
12:04:34.0687 1280 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINDOWS\system32\drivers\Null.sys
12:04:34.0687 1280 Null - ok
12:04:34.0750 1280 [ ADB82FBC435AE7504082B3C714C3885D ] NWCWorkstation C:\WINDOWS\System32\nwwks.dll
12:04:34.0750 1280 NWCWorkstation - ok
12:04:34.0796 1280 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
12:04:34.0796 1280 NwlnkFlt - ok
12:04:34.0828 1280 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
12:04:34.0828 1280 NwlnkFwd - ok
12:04:34.0859 1280 [ 8B8B1BE2DBA4025DA6786C645F77F123 ] NwlnkIpx C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys
12:04:34.0859 1280 NwlnkIpx - ok
12:04:34.0906 1280 [ 56D34A67C05E94E16377C60609741FF8 ] NwlnkNb C:\WINDOWS\system32\DRIVERS\nwlnknb.sys
12:04:34.0906 1280 NwlnkNb - ok
12:04:34.0968 1280 [ C0BB7D1615E1ACBDC99757F6CEAF8CF0 ] NwlnkSpx C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys
12:04:34.0968 1280 NwlnkSpx - ok
12:04:35.0031 1280 [ 36B9B950E3D2E100970A48D8BAD86740 ] NWRDR C:\WINDOWS\system32\DRIVERS\nwrdr.sys
12:04:35.0031 1280 NWRDR - ok
12:04:35.0156 1280 [ 785F487A64950F3CB8E9F16253BA3B7B ] odserv C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
12:04:35.0156 1280 odserv - ok
12:04:35.0187 1280 [ CA33832DF41AFB202EE7AEB05145922F ] ohci1394 C:\WINDOWS\system32\DRIVERS\ohci1394.sys
12:04:35.0187 1280 ohci1394 - ok
12:04:35.0250 1280 [ 5A432A042DAE460ABE7199B758E8606C ] ose C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
12:04:35.0265 1280 ose - ok
12:04:35.0312 1280 ovt519 - ok
12:04:35.0390 1280 [ 3F24EAEB165328E00D687BF3B60A448A ] PAC207 C:\WINDOWS\system32\DRIVERS\pfc027.sys
12:04:35.0390 1280 PAC207 - ok
12:04:35.0437 1280 [ 46F8DB73B4A53E543F8E371DC7C75BAE ] Parport C:\WINDOWS\system32\drivers\Parport.sys
12:04:35.0437 1280 Parport - ok
12:04:35.0468 1280 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys
12:04:35.0468 1280 PartMgr - ok
12:04:35.0515 1280 [ 1FAE19D0457176318BBA4A8795656EBC ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys
12:04:35.0531 1280 ParVdm - ok
12:04:35.0531 1280 pccsmcfd - ok
12:04:35.0578 1280 [ 6CE351D149CB4BEFC702951E471E1730 ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys
12:04:35.0578 1280 PCI - ok
12:04:35.0625 1280 PCIDump - ok
12:04:35.0656 1280 [ 2DA4EC85E0EA7A45C6B2A05820492D5A ] PCIIde C:\WINDOWS\system32\DRIVERS\pciide.sys
12:04:35.0656 1280 PCIIde - ok
12:04:35.0687 1280 [ 4FC31E6C19A5CE5198B1ABFF94CAE758 ] Pcmcia C:\WINDOWS\system32\DRIVERS\pcmcia.sys
12:04:35.0687 1280 Pcmcia - ok
12:04:35.0718 1280 PDCOMP - ok
12:04:35.0750 1280 PDFRAME - ok
12:04:35.0781 1280 PDRELI - ok
12:04:35.0812 1280 PDRFRAME - ok
12:04:35.0828 1280 perc2 - ok
12:04:35.0859 1280 perc2hib - ok
12:04:35.0968 1280 [ 9EF697AF07BB8DD82C3B02CA953A95B7 ] PlugPlay C:\WINDOWS\system32\services.exe
12:04:35.0984 1280 PlugPlay - ok
12:04:36.0031 1280 [ 65BC271F337637731D3C71455AE1F476 ] Pml Driver HPZ12 C:\WINDOWS\system32\HPZipm12.dll
12:04:36.0031 1280 Pml Driver HPZ12 - ok
12:04:36.0062 1280 [ ED0A176354487CEED65B80A7148AB739 ] PolicyAgent C:\WINDOWS\System32\lsass.exe
12:04:36.0062 1280 PolicyAgent - ok
12:04:36.0109 1280 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys
12:04:36.0109 1280 PptpMiniport - ok
12:04:36.0125 1280 [ 7EB15DCE4EC3A0220BD796A15C18186E ] Processor C:\WINDOWS\system32\DRIVERS\processr.sys
12:04:36.0125 1280 Processor - ok
12:04:36.0140 1280 [ ED0A176354487CEED65B80A7148AB739 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe
12:04:36.0140 1280 ProtectedStorage - ok
12:04:36.0187 1280 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys
12:04:36.0187 1280 PSched - ok
12:04:36.0234 1280 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys
12:04:36.0234 1280 Ptilink - ok
12:04:36.0250 1280 ql1080 - ok
12:04:36.0265 1280 Ql10wnt - ok
12:04:36.0296 1280 ql12160 - ok
12:04:36.0312 1280 ql1240 - ok
12:04:36.0343 1280 ql1280 - ok
12:04:36.0390 1280 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys
12:04:36.0390 1280 RasAcd - ok
12:04:36.0421 1280 [ 2B5E44EA009F2F374B980E1E9A70635D ] RasAuto C:\WINDOWS\System32\rasauto.dll
12:04:36.0437 1280 RasAuto - ok
12:04:36.0484 1280 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
12:04:36.0484 1280 Rasl2tp - ok
12:04:36.0546 1280 [ D57554C664B64604BD1EE13EA2C07E77 ] RasMan C:\WINDOWS\System32\rasmans.dll
12:04:36.0546 1280 RasMan - ok
12:04:36.0578 1280 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys
12:04:36.0578 1280 RasPppoe - ok
12:04:36.0625 1280 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys
12:04:36.0625 1280 Raspti - ok
12:04:36.0656 1280 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys
12:04:36.0656 1280 Rdbss - ok
12:04:36.0687 1280 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
12:04:36.0687 1280 RDPCDD - ok
12:04:36.0750 1280 [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr C:\WINDOWS\system32\DRIVERS\rdpdr.sys
12:04:36.0750 1280 rdpdr - ok
12:04:36.0828 1280 [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys
12:04:36.0828 1280 RDPWD - ok
12:04:36.0875 1280 [ C0D9D9711CB74EE9BC66353D8CBDAB0E ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe
12:04:36.0875 1280 RDSessMgr - ok
12:04:36.0906 1280 [ 611BFD220305BE3A85AE876EA47D4AA5 ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys
12:04:36.0906 1280 redbook - ok
12:04:36.0968 1280 [ 127C26B5371651043450E52542099ABA ] RemoteAccess C:\WINDOWS\System32\mprdim.dll
12:04:36.0968 1280 RemoteAccess - ok
12:04:37.0000 1280 [ 8F31505484A190D5B22274708799F4EC ] RemoteRegistry C:\WINDOWS\system32\regsvc.dll
12:04:37.0015 1280 RemoteRegistry - ok
12:04:37.0078 1280 [ 718B3BDC0BC3C2F7D065A53D26202AF9 ] RpcLocator C:\WINDOWS\System32\locator.exe
12:04:37.0078 1280 RpcLocator - ok
12:04:37.0109 1280 [ BE27674D1CBC3214AEC84B4336A38BBF ] RpcSs C:\WINDOWS\system32\rpcss.dll
12:04:37.0125 1280 RpcSs - ok
12:04:37.0171 1280 [ 09AB2E71E58B078038E3BFDBA7FFC984 ] RSVP C:\WINDOWS\System32\rsvp.exe
12:04:37.0187 1280 RSVP - ok
12:04:37.0218 1280 [ ED0A176354487CEED65B80A7148AB739 ] SamSs C:\WINDOWS\system32\lsass.exe
12:04:37.0218 1280 SamSs - ok
12:04:37.0265 1280 [ 410046E401EB11E1E6749E9DEEA41D4A ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe
12:04:37.0265 1280 SCardSvr - ok
12:04:37.0312 1280 [ 3FF232A7731621B8902D81D42418C93C ] Schedule C:\WINDOWS\system32\schedsvc.dll
12:04:37.0312 1280 Schedule - ok
12:04:37.0390 1280 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys
12:04:37.0390 1280 Secdrv - ok
12:04:37.0453 1280 [ 477E2C3CC5E4A0D635BCB0EA8DCAC3C6 ] seclogon C:\WINDOWS\System32\seclogon.dll
12:04:37.0453 1280 seclogon - ok
12:04:37.0468 1280 [ A530B75C10C23C9AB28FDB6CE719E21F ] SENS C:\WINDOWS\system32\sens.dll
12:04:37.0468 1280 SENS - ok
12:04:37.0515 1280 [ B842729337C9B921615C40D3C1A1AF96 ] Serial C:\WINDOWS\system32\drivers\Serial.sys
12:04:37.0515 1280 Serial - ok
12:04:37.0593 1280 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINDOWS\system32\drivers\Sfloppy.sys
12:04:37.0593 1280 Sfloppy - ok
12:04:37.0640 1280 [ F58FACA9621D2DB01BD0927D9A0A208E ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll
12:04:37.0656 1280 SharedAccess - ok
12:04:37.0687 1280 [ EE9A2B9EA968A792A053C9D1A86BF870 ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll
12:04:37.0687 1280 ShellHWDetection - ok
12:04:37.0718 1280 Simbad - ok
12:04:37.0796 1280 [ A4FAB5F7818A69DA6E740943CB8F7CA9 ] SkypeUpdate C:\Program Files\Skype\Updater\Updater.exe
12:04:37.0796 1280 SkypeUpdate - ok
12:04:37.0875 1280 [ 866D538EBE33709A5C9F5C62B73B7D14 ] SLIP C:\WINDOWS\system32\DRIVERS\SLIP.sys
12:04:37.0875 1280 SLIP - ok
12:04:37.0921 1280 Sparrow - ok
12:04:37.0984 1280 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINDOWS\system32\drivers\splitter.sys
12:04:37.0984 1280 splitter - ok
12:04:38.0046 1280 [ 60784F891563FB1B767F70117FC2428F ] Spooler C:\WINDOWS\system32\spoolsv.exe
12:04:38.0046 1280 Spooler - ok
12:04:38.0140 1280 [ CDDDEC541BC3C96F91ECB48759673505 ] sptd C:\WINDOWS\system32\Drivers\sptd.sys
12:04:38.0156 1280 sptd - ok
12:04:38.0203 1280 [ 94610C8653635E4459316A0050D55CE7 ] sr C:\WINDOWS\System32\DRIVERS\sr.sys
12:04:38.0203 1280 sr - ok
12:04:38.0265 1280 [ 35B91147124F64AC8081A2EDB9EA4DEE ] srservice C:\WINDOWS\System32\srsvc.dll
12:04:38.0265 1280 srservice - ok
12:04:38.0343 1280 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys
12:04:38.0343 1280 Srv - ok
12:04:38.0390 1280 [ BECD5271DC4E3B7C3D035F790FCBC1E5 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll
12:04:38.0390 1280 SSDPSRV - ok
12:04:38.0453 1280 [ 654DFEA96BC82B4ACDA4F37E5E4A3BBF ] ssmdrv C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
12:04:38.0453 1280 ssmdrv - ok
12:04:38.0531 1280 [ ED78DFAD8EFCDFBC89500492C4D14645 ] STI Simulator C:\WINDOWS\System32\PAStiSvc.exe
12:04:38.0531 1280 STI Simulator - ok
12:04:38.0593 1280 [ C1CDD9275F6A115BB0AE1D55D8D27BA6 ] stisvc C:\WINDOWS\system32\wiaservc.dll
12:04:38.0593 1280 stisvc - ok
12:04:38.0656 1280 [ 77813007BA6265C4B6098187E6ED79D2 ] streamip C:\WINDOWS\system32\DRIVERS\StreamIP.sys
12:04:38.0656 1280 streamip - ok
12:04:38.0703 1280 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys
12:04:38.0703 1280 swenum - ok
12:04:38.0750 1280 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys
12:04:38.0750 1280 swmidi - ok
12:04:38.0765 1280 SwPrv - ok
12:04:38.0828 1280 symc810 - ok
12:04:38.0843 1280 symc8xx - ok
12:04:38.0875 1280 sym_hi - ok
12:04:38.0906 1280 sym_u3 - ok
12:04:38.0984 1280 [ 6F9CFF60129569EC39EFC490F4BCDE0E ] SynTP C:\WINDOWS\system32\DRIVERS\SynTP.sys
12:04:38.0984 1280 SynTP - ok
12:04:39.0015 1280 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys
12:04:39.0015 1280 sysaudio - ok
12:04:39.0078 1280 [ CE06F01B88ACE199A1BF460CAC29C110 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe
12:04:39.0078 1280 SysmonLog - ok
12:04:39.0125 1280 [ C2546CD7A398476F9DF5614B2AE160E8 ] TapiSrv C:\WINDOWS\System32\tapisrv.dll
12:04:39.0125 1280 TapiSrv - ok
12:04:39.0187 1280 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys
12:04:39.0187 1280 Tcpip - ok
12:04:39.0234 1280 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys
12:04:39.0234 1280 TDPIPE - ok
12:04:39.0281 1280 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys
12:04:39.0281 1280 TDTCP - ok
12:04:39.0328 1280 [ 88155247177638048422893737429D9E ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys
12:04:39.0328 1280 TermDD - ok
12:04:39.0375 1280 [ A75DD6FC3DBEE4FFF5EBC9F2C28BB66E ] TermService C:\WINDOWS\System32\termsrv.dll
12:04:39.0390 1280 TermService - ok
12:04:39.0421 1280 [ EE9A2B9EA968A792A053C9D1A86BF870 ] Themes C:\WINDOWS\System32\shsvcs.dll
12:04:39.0421 1280 Themes - ok
12:04:39.0500 1280 [ CD0CC7B167D78043A41C98D4921EFB54 ] TlntSvr C:\WINDOWS\System32\tlntsvr.exe
12:04:39.0500 1280 TlntSvr - ok
12:04:39.0515 1280 TosIde - ok
12:04:39.0578 1280 [ 38853304CCB938D30E0C4CDE8D2C2A8A ] TrkWks C:\WINDOWS\system32\trkwks.dll
12:04:39.0578 1280 TrkWks - ok
12:04:39.0640 1280 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys
12:04:39.0640 1280 Udfs - ok
12:04:39.0671 1280 ultra - ok
12:04:39.0734 1280 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update C:\WINDOWS\system32\DRIVERS\update.sys
12:04:39.0734 1280 Update - ok
12:04:39.0781 1280 [ 651BD90DCEE5B7BDC74A2EB7C9266F9E ] upnphost C:\WINDOWS\System32\upnphost.dll
12:04:39.0796 1280 upnphost - ok
12:04:39.0859 1280 [ 20A0F6A11959E92908717D09E87D670D ] UPS C:\WINDOWS\System32\ups.exe
12:04:39.0859 1280 UPS - ok
12:04:39.0953 1280 [ E919708DB44ED8543A7C017953148330 ] usbaudio C:\WINDOWS\system32\drivers\usbaudio.sys
12:04:39.0953 1280 usbaudio - ok
12:04:39.0984 1280 [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys
12:04:40.0000 1280 usbccgp - ok
12:04:40.0031 1280 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys
12:04:40.0031 1280 usbehci - ok
12:04:40.0078 1280 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys
12:04:40.0078 1280 usbhub - ok
12:04:40.0156 1280 [ A717C8721046828520C9EDF31288FC00 ] usbprint C:\WINDOWS\system32\DRIVERS\usbprint.sys
12:04:40.0156 1280 usbprint - ok
12:04:40.0218 1280 [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys
12:04:40.0218 1280 usbscan - ok
12:04:40.0234 1280 [ A32426D9B14A089EAA1D922E0C5801A9 ] USBSTOR C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
12:04:40.0234 1280 USBSTOR - ok
12:04:40.0265 1280 [ 26496F9DEE2D787FC3E61AD54821FFE6 ] usbuhci C:\WINDOWS\system32\DRIVERS\usbuhci.sys
12:04:40.0265 1280 usbuhci - ok
12:04:40.0312 1280 [ 63BBFCA7F390F4C49ED4B96BFB1633E0 ] usbvideo C:\WINDOWS\system32\Drivers\usbvideo.sys
12:04:40.0328 1280 usbvideo - ok
12:04:40.0343 1280 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINDOWS\System32\drivers\vga.sys
12:04:40.0359 1280 VgaSave - ok
12:04:40.0375 1280 ViaIde - ok
12:04:40.0421 1280 [ 28A4B296B47782173C346E376CB374D1 ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys
12:04:40.0421 1280 VolSnap - ok
12:04:40.0468 1280 [ D6BA1A63D9E00933F1CD2A885573AFB2 ] VSS C:\WINDOWS\System32\vssvc.exe
12:04:40.0468 1280 VSS - ok
12:04:40.0531 1280 [ FA4E1CDBA256787F2149F4AAD07BC91F ] W32Time C:\WINDOWS\System32\w32time.dll
12:04:40.0546 1280 W32Time - ok
12:04:40.0578 1280 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys
12:04:40.0578 1280 Wanarp - ok
12:04:40.0593 1280 WDICA - ok
12:04:40.0640 1280 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys
12:04:40.0640 1280 wdmaud - ok
12:04:40.0656 1280 [ 47AE51048A82DFA1CD6B51D369F7E169 ] WebClient C:\WINDOWS\System32\webclnt.dll
12:04:40.0656 1280 WebClient - ok
12:04:40.0750 1280 [ E488332126E3B1182D2B8A0C35408EC6 ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll
12:04:40.0750 1280 winmgmt - ok
12:04:40.0843 1280 [ C51B4A5C05A5475708E3C81C7765B71D ] WmdmPmSN C:\WINDOWS\system32\MsPMSNSv.dll
12:04:40.0843 1280 WmdmPmSN - ok
12:04:40.0921 1280 [ 0171CFF34BBA8C5977F18C48D8AEF8C6 ] Wmi C:\WINDOWS\System32\advapi32.dll
12:04:40.0937 1280 Wmi - ok
12:04:40.0968 1280 [ C42584FD66CE9E17403AEBCA199F7BDB ] WmiAcpi C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
12:04:40.0968 1280 WmiAcpi - ok
12:04:41.0031 1280 [ 23F6F03272F7E5679F1F050AED5ACEE6 ] WmiApSrv C:\WINDOWS\System32\wbem\wmiapsrv.exe
12:04:41.0031 1280 WmiApSrv - ok
12:04:41.0140 1280 [ 3739866D20ABD42F26A7B85F9E2560AF ] WMPNetworkSvc C:\Program Files\Windows Media Player\WMPNetwk.exe
12:04:41.0171 1280 WMPNetworkSvc - ok
12:04:41.0218 1280 [ CF4DEF1BF66F06964DC0D91844239104 ] WpdUsb C:\WINDOWS\system32\DRIVERS\wpdusb.sys
12:04:41.0218 1280 WpdUsb - ok
12:04:41.0265 1280 [ 4C86D5FAF78194995AF9CC1075F65DD3 ] wscsvc C:\WINDOWS\system32\wscsvc.dll
12:04:41.0281 1280 wscsvc - ok
12:04:41.0359 1280 [ C98B39829C2BBD34E454150633C62C78 ] WSTCODEC C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
12:04:41.0359 1280 WSTCODEC - ok
12:04:41.0390 1280 [ C1364564800EE9784192145324A23308 ] wuauserv C:\WINDOWS\system32\wuauserv.dll
12:04:41.0390 1280 wuauserv - ok
12:04:41.0453 1280 [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf C:\WINDOWS\system32\DRIVERS\WudfPf.sys
12:04:41.0453 1280 WudfPf - ok
12:04:41.0500 1280 [ 28B524262BCE6DE1F7EF9F510BA3985B ] WudfRd C:\WINDOWS\system32\DRIVERS\wudfrd.sys
12:04:41.0500 1280 WudfRd - ok
12:04:41.0546 1280 [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc C:\WINDOWS\System32\WUDFSvc.dll
12:04:41.0546 1280 WudfSvc - ok
12:04:41.0609 1280 [ A27D4BA7264C0BF52F32D10405BEA1D4 ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll
12:04:41.0625 1280 WZCSVC - ok
12:04:41.0671 1280 [ EAA4BB9EDB3FB10CF8979FE65E63658F ] xmlprov C:\WINDOWS\System32\xmlprov.dll
12:04:41.0671 1280 xmlprov - ok
12:04:41.0750 1280 ================ Scan global ===============================
12:04:41.0796 1280 [ F36278E42C8C5DF03CE17DAC8231C91C ] C:\WINDOWS\system32\basesrv.dll
12:04:41.0843 1280 [ 4C0AA4ABC4E21672B55D8A700AF2B2A6 ] C:\WINDOWS\system32\winsrv.dll
12:04:41.0875 1280 [ 4C0AA4ABC4E21672B55D8A700AF2B2A6 ] C:\WINDOWS\system32\winsrv.dll
12:04:41.0890 1280 [ 9EF697AF07BB8DD82C3B02CA953A95B7 ] C:\WINDOWS\system32\services.exe
12:04:41.0906 1280 [Global] - ok
12:04:41.0906 1280 ================ Scan MBR ==================================
12:04:41.0937 1280 [ 413FC2A0C716421B3158746D63736515 ] \Device\Harddisk0\DR0
12:04:42.0171 1280 \Device\Harddisk0\DR0 - ok
12:04:42.0171 1280 ================ Scan VBR ==================================
12:04:42.0187 1280 [ D55229638076EAD9DADA2D045716D04C ] \Device\Harddisk0\DR0\Partition1
12:04:42.0187 1280 \Device\Harddisk0\DR0\Partition1 - ok
12:04:42.0187 1280 ============================================================
12:04:42.0187 1280 Scan finished
12:04:42.0187 1280 ============================================================
12:04:42.0250 1272 Detected object count: 0
12:04:42.0250 1272 Actual detected object count: 0
12:05:48.0828 0528 Deinitialize success
Postupoval jsem postupně podle tohoto návodu http://malwaretips.com/blogs/remove-trcrypt-xpack-gen
12:04:14.0250 1176 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
12:04:14.0515 1176 ============================================================
12:04:14.0515 1176 Current date / time: 2013/07/01 12:04:14.0515
12:04:14.0515 1176 SystemInfo:
12:04:14.0515 1176
12:04:14.0515 1176 OS Version: 5.1.2600 ServicePack: 3.0
12:04:14.0515 1176 Product type: Workstation
12:04:14.0515 1176 ComputerName: XX-5WI2T6TYBCMW
12:04:14.0515 1176 UserName: katka
12:04:14.0515 1176 Windows directory: C:\WINDOWS
12:04:14.0515 1176 System windows directory: C:\WINDOWS
12:04:14.0515 1176 Processor architecture: Intel x86
12:04:14.0515 1176 Number of processors: 1
12:04:14.0515 1176 Page size: 0x1000
12:04:14.0515 1176 Boot type: Safe boot with network
12:04:14.0515 1176 ============================================================
12:04:15.0796 1176 Drive \Device\Harddisk0\DR0 - Size: 0x12A1F16000 (74.53 Gb), SectorSize: 0x200, Cylinders: 0x2861, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xF0, Type 'K0', Flags 0x00000050
12:04:15.0796 1176 ============================================================
12:04:15.0796 1176 \Device\Harddisk0\DR0:
12:04:15.0796 1176 MBR partitions:
12:04:15.0796 1176 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x950A5C1
12:04:15.0796 1176 ============================================================
12:04:15.0812 1176 C: <-> \Device\Harddisk0\DR0\Partition1
12:04:15.0828 1176 ============================================================
12:04:15.0828 1176 Initialize success
12:04:15.0828 1176 ============================================================
12:04:23.0593 1280 ============================================================
12:04:23.0593 1280 Scan started
12:04:23.0593 1280 Mode: Manual;
12:04:23.0593 1280 ============================================================
12:04:24.0937 1280 ================ Scan system memory ========================
12:04:24.0937 1280 System memory - ok
12:04:24.0937 1280 ================ Scan services =============================
12:04:25.0156 1280 Abiosdsk - ok
12:04:25.0187 1280 abp480n5 - ok
12:04:25.0250 1280 [ 4FE34F1F3126B61FCC6B2043AA8112C9 ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys
12:04:25.0250 1280 ACPI - ok
12:04:25.0296 1280 [ AFDFF022A01F0B11C776F0860C3B282F ] ACPIEC C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
12:04:25.0296 1280 ACPIEC - ok
12:04:25.0359 1280 [ 761D5BBDB6A5867C9F8EBBB545AF7B34 ] ADIHdAudAddService C:\WINDOWS\system32\drivers\ADIHdAud.sys
12:04:25.0359 1280 ADIHdAudAddService - ok
12:04:25.0453 1280 [ 9915504F602D277EE47FD843A677FD15 ] AdobeFlashPlayerUpdateSvc C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
12:04:25.0453 1280 AdobeFlashPlayerUpdateSvc - ok
12:04:25.0484 1280 adpu160m - ok
12:04:25.0515 1280 [ C984DE22ED71414ABC42C1E03D412E33 ] AEAudioService C:\WINDOWS\system32\drivers\AEAudio.sys
12:04:25.0515 1280 AEAudioService - ok
12:04:25.0562 1280 [ 8BED39E3C35D6A489438B8141717A557 ] aec C:\WINDOWS\system32\drivers\aec.sys
12:04:25.0562 1280 aec - ok
12:04:25.0640 1280 [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD C:\WINDOWS\System32\drivers\afd.sys
12:04:25.0640 1280 AFD - ok
12:04:25.0734 1280 [ 90456051C422E09BC36E6340DD891F0C ] AgereSoftModem C:\WINDOWS\system32\DRIVERS\AGRSM.sys
12:04:25.0765 1280 AgereSoftModem - ok
12:04:25.0796 1280 Aha154x - ok
12:04:25.0812 1280 aic78u2 - ok
12:04:25.0859 1280 aic78xx - ok
12:04:25.0890 1280 [ E0A6FA244B8624D78FE5FF6F56A33BAE ] Alerter C:\WINDOWS\system32\alrsvc.dll
12:04:25.0890 1280 Alerter - ok
12:04:25.0937 1280 [ 88842DE939A827577BF24243699AC80A ] ALG C:\WINDOWS\System32\alg.exe
12:04:25.0937 1280 ALG - ok
12:04:25.0953 1280 AliIde - ok
12:04:25.0984 1280 amsint - ok
12:04:26.0078 1280 [ 9015BC03F62940527EC92D45EE89E46F ] AntiVirSchedulerService C:\Program Files\Avira\AntiVir Desktop\sched.exe
12:04:26.0078 1280 AntiVirSchedulerService - ok
12:04:26.0156 1280 [ B8720A787C1223492E6F319465E996CE ] AntiVirService C:\Program Files\Avira\AntiVir Desktop\avguard.exe
12:04:26.0171 1280 AntiVirService - ok
12:04:26.0218 1280 [ 6B8E7A90E576D4FE308F97C69060A171 ] AppMgmt C:\WINDOWS\System32\appmgmts.dll
12:04:26.0218 1280 AppMgmt - ok
12:04:26.0281 1280 [ B5B8A80875C1DEDEDA8B02765642C32F ] Arp1394 C:\WINDOWS\system32\DRIVERS\arp1394.sys
12:04:26.0281 1280 Arp1394 - ok
12:04:26.0312 1280 asc - ok
12:04:26.0328 1280 asc3350p - ok
12:04:26.0359 1280 asc3550 - ok
12:04:26.0484 1280 [ 0E5E4957549056E2BF2C49F4F6B601AD ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
12:04:26.0484 1280 aspnet_state - ok
12:04:26.0531 1280 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys
12:04:26.0531 1280 AsyncMac - ok
12:04:26.0578 1280 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys
12:04:26.0578 1280 atapi - ok
12:04:26.0625 1280 Atdisk - ok
12:04:26.0656 1280 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys
12:04:26.0656 1280 Atmarpc - ok
12:04:26.0718 1280 [ DE31B88962A8645DBA5A37B993E7B0F1 ] AudioSrv C:\WINDOWS\System32\audiosrv.dll
12:04:26.0718 1280 AudioSrv - ok
12:04:26.0750 1280 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys
12:04:26.0750 1280 audstub - ok
12:04:26.0796 1280 [ 6A646C46B9415E13095AA9B352040A7A ] avgio C:\Program Files\Avira\AntiVir Desktop\avgio.sys
12:04:26.0796 1280 avgio - ok
12:04:26.0843 1280 [ 14FE36D8F2C6A2435275338D061A0B66 ] avgntflt C:\WINDOWS\system32\DRIVERS\avgntflt.sys
12:04:26.0843 1280 avgntflt - ok
12:04:26.0921 1280 [ 452E382340BB0C5E694ED9D3625356D0 ] avipbb C:\WINDOWS\system32\DRIVERS\avipbb.sys
12:04:26.0921 1280 avipbb - ok
12:04:27.0015 1280 [ B89BCF0A25AEB3B47030AC83287F894A ] BCM43XX C:\WINDOWS\system32\DRIVERS\bcmwl5.sys
12:04:27.0031 1280 BCM43XX - ok
12:04:27.0062 1280 [ C768C8A463D32C219CE291645A0621A4 ] bcm4sbxp C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys
12:04:27.0062 1280 bcm4sbxp - ok
12:04:27.0109 1280 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINDOWS\system32\drivers\Beep.sys
12:04:27.0109 1280 Beep - ok
12:04:27.0171 1280 [ 19395D092FD85DDC2D9C7729CF5A2AC8 ] BITS C:\WINDOWS\system32\qmgr.dll
12:04:27.0187 1280 BITS - ok
12:04:27.0234 1280 bjhwjesr - ok
12:04:27.0296 1280 [ 89E739BBA5F636297EA5B5F811189E06 ] Browser C:\WINDOWS\System32\browser.dll
12:04:27.0296 1280 Browser - ok
12:04:27.0343 1280 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys
12:04:27.0343 1280 cbidf2k - ok
12:04:27.0437 1280 [ 0BE5AEF125BE881C4F854C554F2B025C ] CCDECODE C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
12:04:27.0437 1280 CCDECODE - ok
12:04:27.0468 1280 cd20xrnt - ok
12:04:27.0500 1280 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys
12:04:27.0500 1280 Cdaudio - ok
12:04:27.0531 1280 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys
12:04:27.0531 1280 Cdfs - ok
12:04:27.0562 1280 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys
12:04:27.0562 1280 Cdrom - ok
12:04:27.0593 1280 Changer - ok
12:04:27.0640 1280 [ E390DC1D7C461D7D56EC53402F329928 ] CiSvc C:\WINDOWS\system32\cisvc.exe
12:04:27.0640 1280 CiSvc - ok
12:04:27.0687 1280 [ 064507A8DFA8C5C7E2FFDDD3E6F424FA ] ClipSrv C:\WINDOWS\system32\clipsrv.exe
12:04:27.0687 1280 ClipSrv - ok
12:04:27.0734 1280 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
12:04:27.0765 1280 clr_optimization_v2.0.50727_32 - ok
12:04:27.0796 1280 [ 0F6C187D38D98F8DF904589A5F94D411 ] CmBatt C:\WINDOWS\system32\DRIVERS\CmBatt.sys
12:04:27.0796 1280 CmBatt - ok
12:04:27.0812 1280 CmdIde - ok
12:04:27.0875 1280 [ 6E4C9F21F0FAE8940661144F41B13203 ] Compbatt C:\WINDOWS\system32\DRIVERS\compbatt.sys
12:04:27.0875 1280 Compbatt - ok
12:04:27.0890 1280 COMSysApp - ok
12:04:27.0937 1280 Cpqarray - ok
12:04:28.0000 1280 [ F3AB0933CBD166D271992F411C27CCAF ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll
12:04:28.0000 1280 CryptSvc - ok
12:04:28.0015 1280 dac2w2k - ok
12:04:28.0046 1280 dac960nt - ok
12:04:28.0109 1280 [ BE27674D1CBC3214AEC84B4336A38BBF ] DcomLaunch C:\WINDOWS\system32\rpcss.dll
12:04:28.0109 1280 DcomLaunch - ok
12:04:28.0125 1280 dgderdrv - ok
12:04:28.0171 1280 [ 8C9A53E285AC5E6704844D0459EC85BE ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll
12:04:28.0171 1280 Dhcp - ok
12:04:28.0187 1280 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys
12:04:28.0187 1280 Disk - ok
12:04:28.0218 1280 dmadmin - ok
12:04:28.0265 1280 [ DB5FD2BF5B07DC54BFCB3664FF05BD7C ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys
12:04:28.0296 1280 dmboot - ok
12:04:28.0343 1280 [ FFF1720AF51171F32F1EAD5CF71F2810 ] dmio C:\WINDOWS\system32\drivers\dmio.sys
12:04:28.0343 1280 dmio - ok
12:04:28.0375 1280 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINDOWS\system32\drivers\dmload.sys
12:04:28.0375 1280 dmload - ok
12:04:28.0421 1280 [ 2BFEFE9E865655A76982F050450B9591 ] dmserver C:\WINDOWS\System32\dmserver.dll
12:04:28.0421 1280 dmserver - ok
12:04:28.0453 1280 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys
12:04:28.0468 1280 DMusic - ok
12:04:28.0546 1280 [ DFAA406BF19F4EE806A6F8D4342137F7 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll
12:04:28.0546 1280 Dnscache - ok
12:04:28.0593 1280 [ 4A3E2BD20157A0946751229E92EB8621 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll
12:04:28.0593 1280 Dot3svc - ok
12:04:28.0609 1280 dpti2o - ok
12:04:28.0687 1280 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys
12:04:28.0687 1280 drmkaud - ok
12:04:28.0734 1280 [ 0887D9C2BE8D940778CAD1E3B85F2A41 ] EapHost C:\WINDOWS\System32\eapsvc.dll
12:04:28.0734 1280 EapHost - ok
12:04:28.0781 1280 [ A2A4912798F2BE706ABADD3D30800D16 ] ERSvc C:\WINDOWS\System32\ersvc.dll
12:04:28.0781 1280 ERSvc - ok
12:04:28.0828 1280 [ 9EF697AF07BB8DD82C3B02CA953A95B7 ] Eventlog C:\WINDOWS\system32\services.exe
12:04:28.0828 1280 Eventlog - ok
12:04:28.0890 1280 [ A371F11EF07653591C8DE26AFB13CE7F ] EventSystem C:\WINDOWS\System32\es.dll
12:04:28.0906 1280 EventSystem - ok
12:04:28.0937 1280 [ 38D332A6D56AF32635675F132548343E ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys
12:04:28.0937 1280 Fastfat - ok
12:04:29.0015 1280 [ EE9A2B9EA968A792A053C9D1A86BF870 ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll
12:04:29.0015 1280 FastUserSwitchingCompatibility - ok
12:04:29.0046 1280 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc C:\WINDOWS\system32\drivers\Fdc.sys
12:04:29.0062 1280 Fdc - ok
12:04:29.0078 1280 [ AC366695A0796560AA37215AD5762AAF ] Fips C:\WINDOWS\system32\drivers\Fips.sys
12:04:29.0078 1280 Fips - ok
12:04:29.0109 1280 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk C:\WINDOWS\system32\drivers\Flpydisk.sys
12:04:29.0109 1280 Flpydisk - ok
12:04:29.0140 1280 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr C:\WINDOWS\system32\drivers\fltmgr.sys
12:04:29.0140 1280 FltMgr - ok
12:04:29.0218 1280 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
12:04:29.0218 1280 FontCache3.0.0.0 - ok
12:04:29.0296 1280 [ CBE5F69A5E5B918225F420BA748F3742 ] FsUsbExDisk C:\WINDOWS\system32\FsUsbExDisk.SYS
12:04:29.0296 1280 FsUsbExDisk - ok
12:04:29.0328 1280 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys
12:04:29.0343 1280 Fs_Rec - ok
12:04:29.0390 1280 [ 4E664D8541DB4A66B73A24257E322E1F ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys
12:04:29.0390 1280 Ftdisk - ok
12:04:29.0437 1280 [ FBF9A126F8F027AC4A35BBEC7BD3275B ] getPlus(R) Helper C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
12:04:29.0437 1280 getPlus(R) Helper - ok
12:04:29.0500 1280 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys
12:04:29.0500 1280 Gpc - ok
12:04:29.0593 1280 [ 8F0DE4FEF8201E306F9938B0905AC96A ] gupdate C:\Program Files\Google\Update\GoogleUpdate.exe
12:04:29.0593 1280 gupdate - ok
12:04:29.0656 1280 [ 8F0DE4FEF8201E306F9938B0905AC96A ] gupdatem C:\Program Files\Google\Update\GoogleUpdate.exe
12:04:29.0656 1280 gupdatem - ok
12:04:29.0718 1280 [ 5D4BC124FAAE6730AC002CDB67BF1A1C ] gusvc C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
12:04:29.0718 1280 gusvc - ok
12:04:29.0765 1280 [ 573C7D0A32852B48F3058CFD8026F511 ] HDAudBus C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
12:04:29.0765 1280 HDAudBus - ok
12:04:29.0843 1280 [ FCFE31FB75F8A6295B6B0AF87A626282 ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
12:04:29.0843 1280 helpsvc - ok
12:04:29.0921 1280 [ 00E25EE90166B3E1BE6E74AEBF858306 ] HidServ C:\WINDOWS\System32\hidserv.dll
12:04:29.0921 1280 HidServ - ok
12:04:29.0968 1280 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] HidUsb C:\WINDOWS\system32\DRIVERS\hidusb.sys
12:04:29.0968 1280 HidUsb - ok
12:04:30.0046 1280 [ 7A6B320928F86BC851530D63C82965D9 ] hkmsvc C:\WINDOWS\System32\kmsvc.dll
12:04:30.0046 1280 hkmsvc - ok
12:04:30.0062 1280 hpn - ok
12:04:30.0187 1280 [ CC8A7D8A8DC9F357B57796583CF8B85F ] hpqcxs08 C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll
12:04:30.0187 1280 hpqcxs08 - ok
12:04:30.0218 1280 [ 4C2CA71CAAFD2CF1A673FC8DBFD219C4 ] hpqddsvc C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll
12:04:30.0234 1280 hpqddsvc - ok
12:04:30.0296 1280 [ D03D10F7DED688FECF50F8FBF1EA9B8A ] HPZid412 C:\WINDOWS\system32\DRIVERS\HPZid412.sys
12:04:30.0296 1280 HPZid412 - ok
12:04:30.0328 1280 [ 89F41658929393487B6B7D13C8528CE3 ] HPZipr12 C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
12:04:30.0328 1280 HPZipr12 - ok
12:04:30.0359 1280 [ ABCB05CCDBF03000354B9553820E39F8 ] HPZius12 C:\WINDOWS\system32\DRIVERS\HPZius12.sys
12:04:30.0359 1280 HPZius12 - ok
12:04:30.0421 1280 [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys
12:04:30.0421 1280 HTTP - ok
12:04:30.0484 1280 [ 58FE2F2DA3BC5573F4A35B3760D3125F ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll
12:04:30.0484 1280 HTTPFilter - ok
12:04:30.0515 1280 i2omgmt - ok
12:04:30.0546 1280 i2omp - ok
12:04:30.0578 1280 [ C528E27945367191E7BAE364930B6932 ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys
12:04:30.0578 1280 i8042prt - ok
12:04:30.0656 1280 [ 0B66A9A2137213075F753579E7D573A5 ] IAANTMon C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
12:04:30.0671 1280 IAANTMon - ok
12:04:30.0890 1280 [ 28423512370705AEDA6A652FEDB25468 ] ialm C:\WINDOWS\system32\DRIVERS\igxpmp32.sys
12:04:31.0046 1280 ialm - ok
12:04:31.0109 1280 [ 309C4D86D989FB1FCF64BD30DC81C51B ] iaStor C:\WINDOWS\system32\DRIVERS\iaStor.sys
12:04:31.0125 1280 iaStor - ok
12:04:31.0203 1280 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
12:04:31.0250 1280 idsvc - ok
12:04:31.0296 1280 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys
12:04:31.0296 1280 Imapi - ok
12:04:31.0359 1280 [ F7B93AAFAD33B2320954C17E26C8D361 ] ImapiService C:\WINDOWS\System32\imapi.exe
12:04:31.0359 1280 ImapiService - ok
12:04:31.0390 1280 ini910u - ok
12:04:31.0468 1280 [ 57D928E548B38502ABBA7A77A6EB7312 ] IntelIde C:\WINDOWS\system32\DRIVERS\intelide.sys
12:04:31.0468 1280 IntelIde - ok
12:04:31.0531 1280 [ 27B290D632AF2CF3CF40BFDDB7370985 ] intelppm C:\WINDOWS\system32\DRIVERS\intelppm.sys
12:04:31.0531 1280 intelppm - ok
12:04:31.0562 1280 [ 3BB22519A194418D5FEC05D800A19AD0 ] ip6fw C:\WINDOWS\system32\drivers\ip6fw.sys
12:04:31.0562 1280 ip6fw - ok
12:04:31.0625 1280 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
12:04:31.0625 1280 IpFilterDriver - ok
12:04:31.0671 1280 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys
12:04:31.0671 1280 IpInIp - ok
12:04:31.0718 1280 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys
12:04:31.0718 1280 IpNat - ok
12:04:31.0750 1280 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys
12:04:31.0750 1280 IPSec - ok
12:04:31.0796 1280 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys
12:04:31.0796 1280 IRENUM - ok
12:04:31.0843 1280 [ CC9F8A2D60AED1A51A3AC34C59B987AE ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys
12:04:31.0843 1280 isapnp - ok
12:04:31.0937 1280 [ 9DBA73C2F1E76EC4CB837E67C5743596 ] JavaQuickStarterService C:\Program Files\Java\jre6\bin\jqs.exe
12:04:31.0953 1280 JavaQuickStarterService - ok
12:04:31.0968 1280 [ 1B6162FE7F66B1A71A4B70F941C4AA9B ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys
12:04:31.0968 1280 Kbdclass - ok
12:04:32.0015 1280 [ 86C8F23616C6C6E5B2776901C17B945B ] kbdhid C:\WINDOWS\system32\DRIVERS\kbdhid.sys
12:04:32.0015 1280 kbdhid - ok
12:04:32.0046 1280 kcfbp - ok
12:04:32.0093 1280 [ 692BCF44383D056AED41B045A323D378 ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys
12:04:32.0093 1280 kmixer - ok
12:04:32.0140 1280 [ B467646C54CC746128904E1654C750C1 ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys
12:04:32.0140 1280 KSecDD - ok
12:04:32.0234 1280 [ 3428E8F86F8ADD36B42FB23542C7B3E4 ] lanmanserver C:\WINDOWS\System32\srvsvc.dll
12:04:32.0234 1280 lanmanserver - ok
12:04:32.0281 1280 [ 936C1D110232D23B621CB0196E4F80F0 ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll
12:04:32.0281 1280 lanmanworkstation - ok
12:04:32.0312 1280 lbrtfdc - ok
12:04:32.0375 1280 [ 0AB159F536E3E8F7F07113702A07CCA5 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll
12:04:32.0375 1280 LmHosts - ok
12:04:32.0437 1280 [ 221CD1C815B8A6B79389C3F5D1018DE8 ] Messenger C:\WINDOWS\System32\msgsvc.dll
12:04:32.0437 1280 Messenger - ok
12:04:32.0546 1280 [ 123271BD5237AB991DC5C21FDF8835EB ] Microsoft Office Groove Audit Service C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe
12:04:32.0546 1280 Microsoft Office Groove Audit Service - ok
12:04:32.0609 1280 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys
12:04:32.0609 1280 mnmdd - ok
12:04:32.0656 1280 [ 9A57D046F88F4B69751B11FD40088A61 ] mnmsrvc C:\WINDOWS\System32\mnmsrvc.exe
12:04:32.0656 1280 mnmsrvc - ok
12:04:32.0718 1280 [ 44032B0C6D9954D3FD26438330B99EE7 ] Modem C:\WINDOWS\system32\drivers\Modem.sys
12:04:32.0718 1280 Modem - ok
12:04:32.0765 1280 [ 4CB582831DBDE63CE43B45D771218374 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys
12:04:32.0765 1280 Mouclass - ok
12:04:32.0828 1280 [ BB269EBA740737AB749B214D568B6812 ] mouhid C:\WINDOWS\system32\DRIVERS\mouhid.sys
12:04:32.0828 1280 mouhid - ok
12:04:32.0859 1280 [ 65653F3B4477F3C63E68A9659F85EE2E ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys
12:04:32.0859 1280 MountMgr - ok
12:04:32.0921 1280 [ 825BF0E46B4470A463AEB641480C5FCA ] MozillaMaintenance C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
12:04:32.0937 1280 MozillaMaintenance - ok
12:04:32.0953 1280 mraid35x - ok
12:04:33.0000 1280 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys
12:04:33.0000 1280 MRxDAV - ok
12:04:33.0078 1280 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
12:04:33.0078 1280 MRxSmb - ok
12:04:33.0125 1280 [ 6DB4D1521CABA9A5FFAB54ADE0AE867D ] MSDTC C:\WINDOWS\System32\msdtc.exe
12:04:33.0125 1280 MSDTC - ok
12:04:33.0187 1280 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys
12:04:33.0187 1280 Msfs - ok
12:04:33.0203 1280 MSIServer - ok
12:04:33.0250 1280 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys
12:04:33.0250 1280 MSKSSRV - ok
12:04:33.0296 1280 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys
12:04:33.0296 1280 MSPCLOCK - ok
12:04:33.0359 1280 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys
12:04:33.0359 1280 MSPQM - ok
12:04:33.0390 1280 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys
12:04:33.0390 1280 mssmbios - ok
12:04:33.0468 1280 [ E53736A9E30C45FA9E7B5EAC55056D1D ] MSTEE C:\WINDOWS\system32\drivers\MSTEE.sys
12:04:33.0468 1280 MSTEE - ok
12:04:33.0515 1280 [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup C:\WINDOWS\system32\drivers\Mup.sys
12:04:33.0515 1280 Mup - ok
12:04:33.0593 1280 [ 5B50F1B2A2ED47D560577B221DA734DB ] NABTSFEC C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
12:04:33.0593 1280 NABTSFEC - ok
12:04:33.0671 1280 [ 6EA362E9DB03D44F6B996F4D8BE237E9 ] napagent C:\WINDOWS\System32\qagentrt.dll
12:04:33.0671 1280 napagent - ok
12:04:33.0703 1280 [ 1DF7F42665C94B825322FAE71721130D ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys
12:04:33.0703 1280 NDIS - ok
12:04:33.0750 1280 [ 7FF1F1FD8609C149AA432F95A8163D97 ] NdisIP C:\WINDOWS\system32\DRIVERS\NdisIP.sys
12:04:33.0750 1280 NdisIP - ok
12:04:33.0796 1280 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys
12:04:33.0796 1280 NdisTapi - ok
12:04:33.0828 1280 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys
12:04:33.0828 1280 Ndisuio - ok
12:04:33.0890 1280 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys
12:04:33.0890 1280 NdisWan - ok
12:04:33.0953 1280 [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys
12:04:33.0953 1280 NDProxy - ok
12:04:34.0015 1280 [ A081CB6FB9A12668F233EB5414BE3A0E ] Net Driver HPZ12 C:\WINDOWS\system32\HPZinw12.dll
12:04:34.0015 1280 Net Driver HPZ12 - ok
12:04:34.0062 1280 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys
12:04:34.0062 1280 NetBIOS - ok
12:04:34.0125 1280 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys
12:04:34.0125 1280 NetBT - ok
12:04:34.0187 1280 [ 933DE774986EC85E48210C44AB431DE6 ] NetDDE C:\WINDOWS\system32\netdde.exe
12:04:34.0187 1280 NetDDE - ok
12:04:34.0203 1280 [ 933DE774986EC85E48210C44AB431DE6 ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe
12:04:34.0218 1280 NetDDEdsdm - ok
12:04:34.0250 1280 [ ED0A176354487CEED65B80A7148AB739 ] Netlogon C:\WINDOWS\System32\lsass.exe
12:04:34.0250 1280 Netlogon - ok
12:04:34.0296 1280 [ 72E1E9E2977BE08BDEEDB6D8FD9D4D40 ] Netman C:\WINDOWS\System32\netman.dll
12:04:34.0296 1280 Netman - ok
12:04:34.0343 1280 [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
12:04:34.0343 1280 NetTcpPortSharing - ok
12:04:34.0390 1280 [ E9E47CFB2D461FA0FC75B7A74C6383EA ] NIC1394 C:\WINDOWS\system32\DRIVERS\nic1394.sys
12:04:34.0390 1280 NIC1394 - ok
12:04:34.0453 1280 [ 39EE7C3BFBC64BA87CC8CF67386E814C ] Nla C:\WINDOWS\System32\mswsock.dll
12:04:34.0453 1280 Nla - ok
12:04:34.0500 1280 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys
12:04:34.0500 1280 Npfs - ok
12:04:34.0562 1280 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys
12:04:34.0578 1280 Ntfs - ok
12:04:34.0593 1280 [ ED0A176354487CEED65B80A7148AB739 ] NtLmSsp C:\WINDOWS\System32\lsass.exe
12:04:34.0593 1280 NtLmSsp - ok
12:04:34.0656 1280 [ 023DD70573D644F3D9C8B1258A7BFD08 ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll
12:04:34.0656 1280 NtmsSvc - ok
12:04:34.0687 1280 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINDOWS\system32\drivers\Null.sys
12:04:34.0687 1280 Null - ok
12:04:34.0750 1280 [ ADB82FBC435AE7504082B3C714C3885D ] NWCWorkstation C:\WINDOWS\System32\nwwks.dll
12:04:34.0750 1280 NWCWorkstation - ok
12:04:34.0796 1280 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
12:04:34.0796 1280 NwlnkFlt - ok
12:04:34.0828 1280 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
12:04:34.0828 1280 NwlnkFwd - ok
12:04:34.0859 1280 [ 8B8B1BE2DBA4025DA6786C645F77F123 ] NwlnkIpx C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys
12:04:34.0859 1280 NwlnkIpx - ok
12:04:34.0906 1280 [ 56D34A67C05E94E16377C60609741FF8 ] NwlnkNb C:\WINDOWS\system32\DRIVERS\nwlnknb.sys
12:04:34.0906 1280 NwlnkNb - ok
12:04:34.0968 1280 [ C0BB7D1615E1ACBDC99757F6CEAF8CF0 ] NwlnkSpx C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys
12:04:34.0968 1280 NwlnkSpx - ok
12:04:35.0031 1280 [ 36B9B950E3D2E100970A48D8BAD86740 ] NWRDR C:\WINDOWS\system32\DRIVERS\nwrdr.sys
12:04:35.0031 1280 NWRDR - ok
12:04:35.0156 1280 [ 785F487A64950F3CB8E9F16253BA3B7B ] odserv C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
12:04:35.0156 1280 odserv - ok
12:04:35.0187 1280 [ CA33832DF41AFB202EE7AEB05145922F ] ohci1394 C:\WINDOWS\system32\DRIVERS\ohci1394.sys
12:04:35.0187 1280 ohci1394 - ok
12:04:35.0250 1280 [ 5A432A042DAE460ABE7199B758E8606C ] ose C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
12:04:35.0265 1280 ose - ok
12:04:35.0312 1280 ovt519 - ok
12:04:35.0390 1280 [ 3F24EAEB165328E00D687BF3B60A448A ] PAC207 C:\WINDOWS\system32\DRIVERS\pfc027.sys
12:04:35.0390 1280 PAC207 - ok
12:04:35.0437 1280 [ 46F8DB73B4A53E543F8E371DC7C75BAE ] Parport C:\WINDOWS\system32\drivers\Parport.sys
12:04:35.0437 1280 Parport - ok
12:04:35.0468 1280 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys
12:04:35.0468 1280 PartMgr - ok
12:04:35.0515 1280 [ 1FAE19D0457176318BBA4A8795656EBC ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys
12:04:35.0531 1280 ParVdm - ok
12:04:35.0531 1280 pccsmcfd - ok
12:04:35.0578 1280 [ 6CE351D149CB4BEFC702951E471E1730 ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys
12:04:35.0578 1280 PCI - ok
12:04:35.0625 1280 PCIDump - ok
12:04:35.0656 1280 [ 2DA4EC85E0EA7A45C6B2A05820492D5A ] PCIIde C:\WINDOWS\system32\DRIVERS\pciide.sys
12:04:35.0656 1280 PCIIde - ok
12:04:35.0687 1280 [ 4FC31E6C19A5CE5198B1ABFF94CAE758 ] Pcmcia C:\WINDOWS\system32\DRIVERS\pcmcia.sys
12:04:35.0687 1280 Pcmcia - ok
12:04:35.0718 1280 PDCOMP - ok
12:04:35.0750 1280 PDFRAME - ok
12:04:35.0781 1280 PDRELI - ok
12:04:35.0812 1280 PDRFRAME - ok
12:04:35.0828 1280 perc2 - ok
12:04:35.0859 1280 perc2hib - ok
12:04:35.0968 1280 [ 9EF697AF07BB8DD82C3B02CA953A95B7 ] PlugPlay C:\WINDOWS\system32\services.exe
12:04:35.0984 1280 PlugPlay - ok
12:04:36.0031 1280 [ 65BC271F337637731D3C71455AE1F476 ] Pml Driver HPZ12 C:\WINDOWS\system32\HPZipm12.dll
12:04:36.0031 1280 Pml Driver HPZ12 - ok
12:04:36.0062 1280 [ ED0A176354487CEED65B80A7148AB739 ] PolicyAgent C:\WINDOWS\System32\lsass.exe
12:04:36.0062 1280 PolicyAgent - ok
12:04:36.0109 1280 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys
12:04:36.0109 1280 PptpMiniport - ok
12:04:36.0125 1280 [ 7EB15DCE4EC3A0220BD796A15C18186E ] Processor C:\WINDOWS\system32\DRIVERS\processr.sys
12:04:36.0125 1280 Processor - ok
12:04:36.0140 1280 [ ED0A176354487CEED65B80A7148AB739 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe
12:04:36.0140 1280 ProtectedStorage - ok
12:04:36.0187 1280 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys
12:04:36.0187 1280 PSched - ok
12:04:36.0234 1280 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys
12:04:36.0234 1280 Ptilink - ok
12:04:36.0250 1280 ql1080 - ok
12:04:36.0265 1280 Ql10wnt - ok
12:04:36.0296 1280 ql12160 - ok
12:04:36.0312 1280 ql1240 - ok
12:04:36.0343 1280 ql1280 - ok
12:04:36.0390 1280 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys
12:04:36.0390 1280 RasAcd - ok
12:04:36.0421 1280 [ 2B5E44EA009F2F374B980E1E9A70635D ] RasAuto C:\WINDOWS\System32\rasauto.dll
12:04:36.0437 1280 RasAuto - ok
12:04:36.0484 1280 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
12:04:36.0484 1280 Rasl2tp - ok
12:04:36.0546 1280 [ D57554C664B64604BD1EE13EA2C07E77 ] RasMan C:\WINDOWS\System32\rasmans.dll
12:04:36.0546 1280 RasMan - ok
12:04:36.0578 1280 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys
12:04:36.0578 1280 RasPppoe - ok
12:04:36.0625 1280 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys
12:04:36.0625 1280 Raspti - ok
12:04:36.0656 1280 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys
12:04:36.0656 1280 Rdbss - ok
12:04:36.0687 1280 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
12:04:36.0687 1280 RDPCDD - ok
12:04:36.0750 1280 [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr C:\WINDOWS\system32\DRIVERS\rdpdr.sys
12:04:36.0750 1280 rdpdr - ok
12:04:36.0828 1280 [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys
12:04:36.0828 1280 RDPWD - ok
12:04:36.0875 1280 [ C0D9D9711CB74EE9BC66353D8CBDAB0E ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe
12:04:36.0875 1280 RDSessMgr - ok
12:04:36.0906 1280 [ 611BFD220305BE3A85AE876EA47D4AA5 ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys
12:04:36.0906 1280 redbook - ok
12:04:36.0968 1280 [ 127C26B5371651043450E52542099ABA ] RemoteAccess C:\WINDOWS\System32\mprdim.dll
12:04:36.0968 1280 RemoteAccess - ok
12:04:37.0000 1280 [ 8F31505484A190D5B22274708799F4EC ] RemoteRegistry C:\WINDOWS\system32\regsvc.dll
12:04:37.0015 1280 RemoteRegistry - ok
12:04:37.0078 1280 [ 718B3BDC0BC3C2F7D065A53D26202AF9 ] RpcLocator C:\WINDOWS\System32\locator.exe
12:04:37.0078 1280 RpcLocator - ok
12:04:37.0109 1280 [ BE27674D1CBC3214AEC84B4336A38BBF ] RpcSs C:\WINDOWS\system32\rpcss.dll
12:04:37.0125 1280 RpcSs - ok
12:04:37.0171 1280 [ 09AB2E71E58B078038E3BFDBA7FFC984 ] RSVP C:\WINDOWS\System32\rsvp.exe
12:04:37.0187 1280 RSVP - ok
12:04:37.0218 1280 [ ED0A176354487CEED65B80A7148AB739 ] SamSs C:\WINDOWS\system32\lsass.exe
12:04:37.0218 1280 SamSs - ok
12:04:37.0265 1280 [ 410046E401EB11E1E6749E9DEEA41D4A ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe
12:04:37.0265 1280 SCardSvr - ok
12:04:37.0312 1280 [ 3FF232A7731621B8902D81D42418C93C ] Schedule C:\WINDOWS\system32\schedsvc.dll
12:04:37.0312 1280 Schedule - ok
12:04:37.0390 1280 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys
12:04:37.0390 1280 Secdrv - ok
12:04:37.0453 1280 [ 477E2C3CC5E4A0D635BCB0EA8DCAC3C6 ] seclogon C:\WINDOWS\System32\seclogon.dll
12:04:37.0453 1280 seclogon - ok
12:04:37.0468 1280 [ A530B75C10C23C9AB28FDB6CE719E21F ] SENS C:\WINDOWS\system32\sens.dll
12:04:37.0468 1280 SENS - ok
12:04:37.0515 1280 [ B842729337C9B921615C40D3C1A1AF96 ] Serial C:\WINDOWS\system32\drivers\Serial.sys
12:04:37.0515 1280 Serial - ok
12:04:37.0593 1280 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINDOWS\system32\drivers\Sfloppy.sys
12:04:37.0593 1280 Sfloppy - ok
12:04:37.0640 1280 [ F58FACA9621D2DB01BD0927D9A0A208E ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll
12:04:37.0656 1280 SharedAccess - ok
12:04:37.0687 1280 [ EE9A2B9EA968A792A053C9D1A86BF870 ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll
12:04:37.0687 1280 ShellHWDetection - ok
12:04:37.0718 1280 Simbad - ok
12:04:37.0796 1280 [ A4FAB5F7818A69DA6E740943CB8F7CA9 ] SkypeUpdate C:\Program Files\Skype\Updater\Updater.exe
12:04:37.0796 1280 SkypeUpdate - ok
12:04:37.0875 1280 [ 866D538EBE33709A5C9F5C62B73B7D14 ] SLIP C:\WINDOWS\system32\DRIVERS\SLIP.sys
12:04:37.0875 1280 SLIP - ok
12:04:37.0921 1280 Sparrow - ok
12:04:37.0984 1280 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINDOWS\system32\drivers\splitter.sys
12:04:37.0984 1280 splitter - ok
12:04:38.0046 1280 [ 60784F891563FB1B767F70117FC2428F ] Spooler C:\WINDOWS\system32\spoolsv.exe
12:04:38.0046 1280 Spooler - ok
12:04:38.0140 1280 [ CDDDEC541BC3C96F91ECB48759673505 ] sptd C:\WINDOWS\system32\Drivers\sptd.sys
12:04:38.0156 1280 sptd - ok
12:04:38.0203 1280 [ 94610C8653635E4459316A0050D55CE7 ] sr C:\WINDOWS\System32\DRIVERS\sr.sys
12:04:38.0203 1280 sr - ok
12:04:38.0265 1280 [ 35B91147124F64AC8081A2EDB9EA4DEE ] srservice C:\WINDOWS\System32\srsvc.dll
12:04:38.0265 1280 srservice - ok
12:04:38.0343 1280 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys
12:04:38.0343 1280 Srv - ok
12:04:38.0390 1280 [ BECD5271DC4E3B7C3D035F790FCBC1E5 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll
12:04:38.0390 1280 SSDPSRV - ok
12:04:38.0453 1280 [ 654DFEA96BC82B4ACDA4F37E5E4A3BBF ] ssmdrv C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
12:04:38.0453 1280 ssmdrv - ok
12:04:38.0531 1280 [ ED78DFAD8EFCDFBC89500492C4D14645 ] STI Simulator C:\WINDOWS\System32\PAStiSvc.exe
12:04:38.0531 1280 STI Simulator - ok
12:04:38.0593 1280 [ C1CDD9275F6A115BB0AE1D55D8D27BA6 ] stisvc C:\WINDOWS\system32\wiaservc.dll
12:04:38.0593 1280 stisvc - ok
12:04:38.0656 1280 [ 77813007BA6265C4B6098187E6ED79D2 ] streamip C:\WINDOWS\system32\DRIVERS\StreamIP.sys
12:04:38.0656 1280 streamip - ok
12:04:38.0703 1280 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys
12:04:38.0703 1280 swenum - ok
12:04:38.0750 1280 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys
12:04:38.0750 1280 swmidi - ok
12:04:38.0765 1280 SwPrv - ok
12:04:38.0828 1280 symc810 - ok
12:04:38.0843 1280 symc8xx - ok
12:04:38.0875 1280 sym_hi - ok
12:04:38.0906 1280 sym_u3 - ok
12:04:38.0984 1280 [ 6F9CFF60129569EC39EFC490F4BCDE0E ] SynTP C:\WINDOWS\system32\DRIVERS\SynTP.sys
12:04:38.0984 1280 SynTP - ok
12:04:39.0015 1280 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys
12:04:39.0015 1280 sysaudio - ok
12:04:39.0078 1280 [ CE06F01B88ACE199A1BF460CAC29C110 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe
12:04:39.0078 1280 SysmonLog - ok
12:04:39.0125 1280 [ C2546CD7A398476F9DF5614B2AE160E8 ] TapiSrv C:\WINDOWS\System32\tapisrv.dll
12:04:39.0125 1280 TapiSrv - ok
12:04:39.0187 1280 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys
12:04:39.0187 1280 Tcpip - ok
12:04:39.0234 1280 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys
12:04:39.0234 1280 TDPIPE - ok
12:04:39.0281 1280 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys
12:04:39.0281 1280 TDTCP - ok
12:04:39.0328 1280 [ 88155247177638048422893737429D9E ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys
12:04:39.0328 1280 TermDD - ok
12:04:39.0375 1280 [ A75DD6FC3DBEE4FFF5EBC9F2C28BB66E ] TermService C:\WINDOWS\System32\termsrv.dll
12:04:39.0390 1280 TermService - ok
12:04:39.0421 1280 [ EE9A2B9EA968A792A053C9D1A86BF870 ] Themes C:\WINDOWS\System32\shsvcs.dll
12:04:39.0421 1280 Themes - ok
12:04:39.0500 1280 [ CD0CC7B167D78043A41C98D4921EFB54 ] TlntSvr C:\WINDOWS\System32\tlntsvr.exe
12:04:39.0500 1280 TlntSvr - ok
12:04:39.0515 1280 TosIde - ok
12:04:39.0578 1280 [ 38853304CCB938D30E0C4CDE8D2C2A8A ] TrkWks C:\WINDOWS\system32\trkwks.dll
12:04:39.0578 1280 TrkWks - ok
12:04:39.0640 1280 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys
12:04:39.0640 1280 Udfs - ok
12:04:39.0671 1280 ultra - ok
12:04:39.0734 1280 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update C:\WINDOWS\system32\DRIVERS\update.sys
12:04:39.0734 1280 Update - ok
12:04:39.0781 1280 [ 651BD90DCEE5B7BDC74A2EB7C9266F9E ] upnphost C:\WINDOWS\System32\upnphost.dll
12:04:39.0796 1280 upnphost - ok
12:04:39.0859 1280 [ 20A0F6A11959E92908717D09E87D670D ] UPS C:\WINDOWS\System32\ups.exe
12:04:39.0859 1280 UPS - ok
12:04:39.0953 1280 [ E919708DB44ED8543A7C017953148330 ] usbaudio C:\WINDOWS\system32\drivers\usbaudio.sys
12:04:39.0953 1280 usbaudio - ok
12:04:39.0984 1280 [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys
12:04:40.0000 1280 usbccgp - ok
12:04:40.0031 1280 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys
12:04:40.0031 1280 usbehci - ok
12:04:40.0078 1280 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys
12:04:40.0078 1280 usbhub - ok
12:04:40.0156 1280 [ A717C8721046828520C9EDF31288FC00 ] usbprint C:\WINDOWS\system32\DRIVERS\usbprint.sys
12:04:40.0156 1280 usbprint - ok
12:04:40.0218 1280 [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys
12:04:40.0218 1280 usbscan - ok
12:04:40.0234 1280 [ A32426D9B14A089EAA1D922E0C5801A9 ] USBSTOR C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
12:04:40.0234 1280 USBSTOR - ok
12:04:40.0265 1280 [ 26496F9DEE2D787FC3E61AD54821FFE6 ] usbuhci C:\WINDOWS\system32\DRIVERS\usbuhci.sys
12:04:40.0265 1280 usbuhci - ok
12:04:40.0312 1280 [ 63BBFCA7F390F4C49ED4B96BFB1633E0 ] usbvideo C:\WINDOWS\system32\Drivers\usbvideo.sys
12:04:40.0328 1280 usbvideo - ok
12:04:40.0343 1280 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINDOWS\System32\drivers\vga.sys
12:04:40.0359 1280 VgaSave - ok
12:04:40.0375 1280 ViaIde - ok
12:04:40.0421 1280 [ 28A4B296B47782173C346E376CB374D1 ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys
12:04:40.0421 1280 VolSnap - ok
12:04:40.0468 1280 [ D6BA1A63D9E00933F1CD2A885573AFB2 ] VSS C:\WINDOWS\System32\vssvc.exe
12:04:40.0468 1280 VSS - ok
12:04:40.0531 1280 [ FA4E1CDBA256787F2149F4AAD07BC91F ] W32Time C:\WINDOWS\System32\w32time.dll
12:04:40.0546 1280 W32Time - ok
12:04:40.0578 1280 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys
12:04:40.0578 1280 Wanarp - ok
12:04:40.0593 1280 WDICA - ok
12:04:40.0640 1280 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys
12:04:40.0640 1280 wdmaud - ok
12:04:40.0656 1280 [ 47AE51048A82DFA1CD6B51D369F7E169 ] WebClient C:\WINDOWS\System32\webclnt.dll
12:04:40.0656 1280 WebClient - ok
12:04:40.0750 1280 [ E488332126E3B1182D2B8A0C35408EC6 ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll
12:04:40.0750 1280 winmgmt - ok
12:04:40.0843 1280 [ C51B4A5C05A5475708E3C81C7765B71D ] WmdmPmSN C:\WINDOWS\system32\MsPMSNSv.dll
12:04:40.0843 1280 WmdmPmSN - ok
12:04:40.0921 1280 [ 0171CFF34BBA8C5977F18C48D8AEF8C6 ] Wmi C:\WINDOWS\System32\advapi32.dll
12:04:40.0937 1280 Wmi - ok
12:04:40.0968 1280 [ C42584FD66CE9E17403AEBCA199F7BDB ] WmiAcpi C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
12:04:40.0968 1280 WmiAcpi - ok
12:04:41.0031 1280 [ 23F6F03272F7E5679F1F050AED5ACEE6 ] WmiApSrv C:\WINDOWS\System32\wbem\wmiapsrv.exe
12:04:41.0031 1280 WmiApSrv - ok
12:04:41.0140 1280 [ 3739866D20ABD42F26A7B85F9E2560AF ] WMPNetworkSvc C:\Program Files\Windows Media Player\WMPNetwk.exe
12:04:41.0171 1280 WMPNetworkSvc - ok
12:04:41.0218 1280 [ CF4DEF1BF66F06964DC0D91844239104 ] WpdUsb C:\WINDOWS\system32\DRIVERS\wpdusb.sys
12:04:41.0218 1280 WpdUsb - ok
12:04:41.0265 1280 [ 4C86D5FAF78194995AF9CC1075F65DD3 ] wscsvc C:\WINDOWS\system32\wscsvc.dll
12:04:41.0281 1280 wscsvc - ok
12:04:41.0359 1280 [ C98B39829C2BBD34E454150633C62C78 ] WSTCODEC C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
12:04:41.0359 1280 WSTCODEC - ok
12:04:41.0390 1280 [ C1364564800EE9784192145324A23308 ] wuauserv C:\WINDOWS\system32\wuauserv.dll
12:04:41.0390 1280 wuauserv - ok
12:04:41.0453 1280 [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf C:\WINDOWS\system32\DRIVERS\WudfPf.sys
12:04:41.0453 1280 WudfPf - ok
12:04:41.0500 1280 [ 28B524262BCE6DE1F7EF9F510BA3985B ] WudfRd C:\WINDOWS\system32\DRIVERS\wudfrd.sys
12:04:41.0500 1280 WudfRd - ok
12:04:41.0546 1280 [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc C:\WINDOWS\System32\WUDFSvc.dll
12:04:41.0546 1280 WudfSvc - ok
12:04:41.0609 1280 [ A27D4BA7264C0BF52F32D10405BEA1D4 ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll
12:04:41.0625 1280 WZCSVC - ok
12:04:41.0671 1280 [ EAA4BB9EDB3FB10CF8979FE65E63658F ] xmlprov C:\WINDOWS\System32\xmlprov.dll
12:04:41.0671 1280 xmlprov - ok
12:04:41.0750 1280 ================ Scan global ===============================
12:04:41.0796 1280 [ F36278E42C8C5DF03CE17DAC8231C91C ] C:\WINDOWS\system32\basesrv.dll
12:04:41.0843 1280 [ 4C0AA4ABC4E21672B55D8A700AF2B2A6 ] C:\WINDOWS\system32\winsrv.dll
12:04:41.0875 1280 [ 4C0AA4ABC4E21672B55D8A700AF2B2A6 ] C:\WINDOWS\system32\winsrv.dll
12:04:41.0890 1280 [ 9EF697AF07BB8DD82C3B02CA953A95B7 ] C:\WINDOWS\system32\services.exe
12:04:41.0906 1280 [Global] - ok
12:04:41.0906 1280 ================ Scan MBR ==================================
12:04:41.0937 1280 [ 413FC2A0C716421B3158746D63736515 ] \Device\Harddisk0\DR0
12:04:42.0171 1280 \Device\Harddisk0\DR0 - ok
12:04:42.0171 1280 ================ Scan VBR ==================================
12:04:42.0187 1280 [ D55229638076EAD9DADA2D045716D04C ] \Device\Harddisk0\DR0\Partition1
12:04:42.0187 1280 \Device\Harddisk0\DR0\Partition1 - ok
12:04:42.0187 1280 ============================================================
12:04:42.0187 1280 Scan finished
12:04:42.0187 1280 ============================================================
12:04:42.0250 1272 Detected object count: 0
12:04:42.0250 1272 Actual detected object count: 0
12:05:48.0828 0528 Deinitialize success
Re: Zavirovaný počítač
Stahnete RKill http://download.bleepingcomputer.com/grinler/rkill.com
- Pokud ho havet blokuje, pouzijte jeden z nasledujicich - i ty prejmenovane
Rkill EXE:
http://download.bleepingcomputer.com/grinler/rkill.exe
Rkill iExplore.exe:
http://download.bleepingcomputer.com/gr ... xplore.exe
Rkill uSeRiNiT.exe:
http://download.bleepingcomputer.com/gr ... eRiNiT.exe
Rkill WiNlOgOn.exe:
http://download.bleepingcomputer.com/gr ... NlOgOn.exe - Ulozte nejlepena plochu a ukoncete vsechny aplikace (jinak to udela RKill za Vas)
- Spustte tradicne dvojklikem - program probehne do par sekund a ukonci i svou cinnost
- RKill ukonci vsechny ne-systemove procesy - tedy i procesy, pod kterymi bezi havet
- Na plose vznikne log Rkill.txt ten mi sem vlozte
- Ted nerestartujte PC - prisli byste o ucinek RKillu
Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe
- Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
- Pokud mate Win XP spustte pod uctem Spravce\Administratora
- Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
- Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
- Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
- Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
- Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
- Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
- Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen od 1. února 2011.
Člen
od 1. února 2011.Re: Zavirovaný počítač
log z Rkill:
Rkill 2.5.3 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2013 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html
Program started at: 07/01/2013 09:22:52 PM in x86 mode.
Windows Version: Microsoft Windows XP Service Pack 3
Checking for Windows services to stop:
* No malware services found to stop.
Checking for processes to terminate:
* C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe (PID: 436) [WD-HEUR]
* C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe (PID: 684) [WD-HEUR]
* C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe (PID: 692) [WD-HEUR]
3 proccesses terminated!
Checking Registry for malware related settings:
* No issues found in the Registry.
Resetting .EXE, .COM, & .BAT associations in the Windows Registry.
Performing miscellaneous checks:
* Windows Firewall Disabled
[HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = dword:00000000
Checking Windows Service Integrity:
* Služba obnovení systému (srservice) is not Running.
Startup Type set to: Automatic
* Ovladač filtru Obnovy systému (sr) is not Running.
Startup Type set to: Disabled
Searching for Missing Digital Signatures:
* C:\WINDOWS\System32\drivers\mqac.sys [NoSig]
+-> C:\WINDOWS\$hf_mig$\KB937894\SP2QFE\mqac.sys : 72 960 : 07/06/2007 00:52 AM : d92fce6729ee150a15a7cdbc433f390e [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB971032\SP2QFE\mqac.sys : 91 776 : 06/22/2009 01:30 PM : 9229e191fe206628be17d1e67a5faed9 [Pos Repl]
+-> C:\WINDOWS\$NtServicePackUninstall$\mqac.sys : 72 960 : 08/03/2004 10:58 PM : db07b0088cdfd20c2a22e675120ede34 [Pos Repl]
+-> C:\WINDOWS\$NtUninstallKB937894$\mqac.sys : 72 960 : 08/03/2004 10:58 PM : db07b0088cdfd20c2a22e675120ede34 [Pos Repl]
+-> C:\WINDOWS\$NtUninstallKB971032$\mqac.sys : 72 960 : 07/06/2007 10:05 AM : 157a32ddc6a019a4e31b19d604d2f127 [Pos Repl]
+-> C:\WINDOWS\ServicePackFiles\i386\mqac.sys : 92 544 : 04/13/2008 08:39 PM : 70c14f5cca5cf73f8a645c73a01d8726 [Pos Repl]
+-> C:\WINDOWS\system32\dllcache\mqac.sys : 91 776 : 06/22/2009 01:48 PM : eee50bf24caeedb515a8f3b22756d3bb [Pos Repl]
* C:\WINDOWS\System32\UxTheme.dll [NoSig]
+-> C:\WINDOWS\$NtServicePackUninstall$\uxtheme.dll : 219 648 : 08/17/2004 03:49 PM : 0d3c98f2d11978d67dd4102471cfbfac [Pos Repl]
+-> C:\WINDOWS\ServicePackFiles\i386\uxtheme.dll : 219 648 : 12/09/2010 01:06 AM : 7f2621e34bdaf1087a13cba77e0f5547 [Pos Repl]
* C:\WINDOWS\explorer.exe [NoSig]
+-> C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe : 1 033 728 : 06/13/2007 03:11 PM : 9b32416bd5988c97b6397ce0b02caf97 [Pos Repl]
+-> C:\WINDOWS\$NtServicePackUninstall$\explorer.exe : 1 033 728 : 06/13/2007 03:23 PM : ed7b460b142a32097b8a8f6ecc941815 [Pos Repl]
+-> C:\WINDOWS\$NtUninstallKB938828$\explorer.exe : 1 032 704 : 08/17/2004 03:49 PM : 53114d57ab73a406ac7f602227781a99 [Pos Repl]
+-> C:\WINDOWS\ServicePackFiles\i386\explorer.exe : 976 384 : 04/14/2008 01:22 AM : 13e794e5591776cbc71055a7b3cc1d5f [Pos Repl]
Checking HOSTS File:
* HOSTS file entries found:
127.0.0.1 localhost
Program finished at: 07/01/2013 09:23:59 PM
Execution time: 0 hours(s), 1 minute(s), and 6 seconds(s)
_______________________________________________________________________________________________________
log z Combofix:
ComboFix 13-06-30.01 - katka 01.07.2013 21:33:01.1.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1527.837 [GMT 2:00]
Spuštěný z: c:\documents and settings\katka\Plocha\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
c:\windows\msmqinst.log
c:\windows\system32\SETDC.tmp
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-06-01 do 2013-07-01 )))))))))))))))))))))))))))))))
.
.
2013-07-01 17:30 . 2013-07-01 17:30 -------- d-----w- c:\documents and settings\katka\Data aplikací\Avira
2013-07-01 17:26 . 2013-07-01 17:26 -------- d-sh--w- c:\documents and settings\LocalService\PrivacIE
2013-07-01 17:26 . 2013-07-01 17:26 -------- d-----w- c:\documents and settings\LocalService\Data aplikací\LangSoft
2013-07-01 17:23 . 2013-07-01 16:16 37352 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2013-07-01 17:23 . 2013-07-01 16:16 135136 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-07-01 17:23 . 2013-07-01 17:24 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Avira
2013-07-01 17:23 . 2013-07-01 17:23 -------- d-----w- c:\program files\Avira
2013-07-01 15:33 . 2013-07-01 15:34 -------- d-----w- C:\rsit
2013-07-01 15:33 . 2013-07-01 15:33 -------- d-----w- c:\program files\trend micro
2013-07-01 13:47 . 2013-07-01 13:51 -------- d-----w- c:\program files\Common Files\Adobe
2013-07-01 11:07 . 2013-07-01 11:07 -------- d-----w- c:\program files\ESET
2013-07-01 10:49 . 2013-07-01 11:07 -------- d-----w- c:\documents and settings\All Users\Data aplikací\HitmanPro
2013-07-01 10:08 . 2013-07-01 10:08 -------- d-----w- c:\documents and settings\katka\Data aplikací\Malwarebytes
2013-07-01 10:08 . 2013-07-01 10:08 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2013-07-01 10:08 . 2013-04-04 12:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-07-01 10:08 . 2013-07-01 10:08 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-07-01 10:08 . 2013-07-01 10:08 35144 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2013-06-24 18:40 . 2013-06-24 18:40 -------- d-----w- c:\documents and settings\katka\Data aplikací\Printer Info Cache
2013-06-24 18:40 . 2013-06-24 18:40 -------- d-----w- c:\documents and settings\katka\Data aplikací\Image Zone Express
2013-06-24 16:18 . 2013-07-01 19:25 -------- d-----w- c:\documents and settings\katka\Data aplikací\stickies
2013-06-24 16:18 . 2013-06-24 17:34 599 ----a-w- c:\windows\uninstallstickies.bat
2013-06-24 16:18 . 2013-06-24 16:18 -------- d-----w- c:\program files\Stickies
2013-06-24 16:14 . 2005-09-28 17:04 57344 ----a-w- c:\windows\system32\DreamPopUpMenu.dll
2013-06-24 16:14 . 2005-09-07 17:53 65536 ----a-w- c:\windows\system32\WNCalendar.ocx
2013-06-24 16:14 . 2005-07-31 14:58 921600 ----a-w- c:\windows\system32\xpstylelib.ocx
2013-06-24 16:14 . 1998-06-23 23:00 203576 ----a-w- c:\windows\system32\RichTx32.ocx
2013-06-24 16:14 . 1998-06-23 22:00 82744 ----a-w- c:\windows\system32\PicClp32.ocx
2013-06-24 16:14 . 2013-06-28 04:47 -------- d-----w- c:\program files\GooferToDo
2013-06-24 16:14 . 2006-05-30 20:44 64000 ----a-w- c:\windows\system32\RICHTX32.oca
2013-06-24 16:14 . 2006-05-29 23:10 240128 ----a-w- c:\windows\system32\COMCTL32.oca
2013-06-24 16:14 . 2006-05-29 22:51 18944 ----a-w- c:\windows\system32\PICCLP32.oca
2013-06-24 16:14 . 2006-05-29 22:51 35840 ----a-w- c:\windows\system32\COMDLG32.oca
2013-06-24 16:14 . 2006-05-29 22:51 265728 ----a-w- c:\windows\system32\mscomctl.oca
2013-06-24 16:14 . 2003-03-20 05:33 20992 ----a-w- c:\windows\system32\WNCalendar.oca
2013-06-12 11:33 . 2013-06-12 11:33 9089416 ----a-w- c:\windows\system32\FlashPlayerInstaller.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-07-01 16:16 . 2009-03-23 19:37 84744 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-06-12 11:33 . 2012-05-03 12:33 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-06-12 11:33 . 2011-05-27 09:16 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-05-07 22:27 . 2002-09-23 12:00 920064 ----a-w- c:\windows\system32\wininet.dll
2013-05-07 22:27 . 2002-09-23 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2013-05-07 22:27 . 2002-09-23 12:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2013-05-07 21:53 . 2007-09-22 11:40 385024 ----a-w- c:\windows\system32\html.iec
2013-05-03 05:39 . 2002-09-23 12:00 2195712 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-05-03 05:39 . 2002-09-20 17:12 2072320 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-04-12 14:01 . 2002-09-23 12:00 1876352 ----a-w- c:\windows\system32\win32k.sys
2012-07-12 20:09 . 2012-07-12 20:09 0 ----a-w- c:\program files\GUM6F.tmp
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2008-04-14 . 13E794E5591776CBC71055A7B3CC1D5F . 976384 . . [6.00.2900.5512] . . c:\windows\explorer.exe
[-] 2008-04-14 . 13E794E5591776CBC71055A7B3CC1D5F . 976384 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\explorer.exe
[-] 2007-06-13 . ED7B460B142A32097B8A8F6ECC941815 . 1033728 . . [6.00.2900.3156] . . c:\windows\$NtServicePackUninstall$\explorer.exe
[-] 2007-06-13 . 9B32416BD5988C97B6397CE0B02CAF97 . 1033728 . . [6.00.2900.3156] . . c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[7] 2004-08-17 . 53114D57AB73A406AC7F602227781A99 . 1032704 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB938828$\explorer.exe
.
[-] 2008-04-14 . ED69B3B6CD23D1D00815D5F70D517E01 . 225792 . . [5.1.2600.5512] . . c:\windows\regedit.exe
[-] 2008-04-14 . ED69B3B6CD23D1D00815D5F70D517E01 . 225792 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\regedit.exe
[7] 2004-08-17 . CB5A91928D94224E7E30EE277B45E8A3 . 147968 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\regedit.exe
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-05-16 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2005-10-12 139264]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-08-08 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-08-08 162328]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-08-08 137752]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-06-07 827392]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-02-14 454656]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]
"SafeQ Client"="c:\program files\Y Soft\SafeQ Client\Client\SafeQ Client.exe" [2012-07-20 259072]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-18 946352]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2013-07-01 345144]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\katka\Nabídka Start\Programy\Po spuštění\
Stickies.lnk - c:\program files\Stickies\stickies.exe [2013-6-24 1122304]
TransBar.lnk - c:\windows\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe /s [2005-6-1 65536]
UberIcon.lnk - c:\windows\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe [2006-5-21 180224]
Y'z Shadow.lnk - c:\windows\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe [2006-5-21 155648]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520]
Stickies.lnk - c:\program files\Stickies\stickies.exe [2013-6-24 1122304]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\windows\system32\logonuix.exe"
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
@=""
.
[HKLM\~\startupfolder\C:^Documents and Settings^katka^Nabídka Start^Programy^Po spuštění^OpenOffice.org 2.3.lnk]
path=c:\documents and settings\katka\Nabídka Start\Programy\Po spuštění\OpenOffice.org 2.3.lnk
backup=c:\windows\pss\OpenOffice.org 2.3.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2012-11-09 10:27 17877168 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\WINWORD.EXE"=
"c:\\Documents and Settings\\katka\\Local Settings\\Temp\\jivexviewer\\jre\\bin\\JiveX[dv] light"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Documents and Settings\\katka\\Plocha\\DC\\StrongDC.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R1 A2DDA;A2 Direct Disk Access Support Driver;c:\documents and settings\katka\Plocha\Emisoft\Run\a2ddax86.sys [1.7.2013 14:57 22056]
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [1.7.2013 19:23 37352]
R2 AntiVirSchedulerService;Avira Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [1.7.2013 19:23 84024]
R2 AntiVirWebService;Avira Web Protection;c:\program files\Avira\AntiVir Desktop\avwebgrd.exe [1.7.2013 19:23 589368]
S0 sptd;sptd;c:\windows\system32\Drivers\sptd.sys --> c:\windows\system32\Drivers\sptd.sys [?]
S2 bjhwjesr;apucfhg;c:\windows\system32\svchost.exe -k netsvcs [23.9.2002 14:00 14336]
S2 kcfbp;Center Driver;c:\windows\system32\svchost.exe -k netsvcs [23.9.2002 14:00 14336]
S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [9.11.2012 12:21 160944]
S3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys --> c:\windows\system32\drivers\dgderdrv.sys [?]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [19.9.2010 18:17 36608]
S3 mbamchameleon;mbamchameleon;c:\windows\system32\drivers\mbamchameleon.sys [1.7.2013 12:08 35144]
S3 PAC207;Trust WB-1400T Webcam;c:\windows\system32\drivers\PFC027.sys [24.2.2005 13:29 162176]
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - ANTIVIRSCHEDULERSERVICE
*NewlyCreated* - ANTIVIRSERVICE
*NewlyCreated* - ANTIVIRWEBSERVICE
*NewlyCreated* - AVGNTFLT
*NewlyCreated* - AVIPBB
*NewlyCreated* - AVKMGR
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
bjhwjesr
kcfbp
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-06-19 08:30 1165776 ----a-w- c:\program files\Google\Chrome\Application\27.0.1453.116\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2013-07-01 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-03 11:33]
.
2013-07-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-10 10:11]
.
2013-07-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-10 10:11]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://search.babylon.com/?affID=111881&tt=220512_53ctrl&babsrc=HP_ss&mntrId=1885c8fd000000000000001a738abb82
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&s ... f8&oe=utf8
mStart Page = hxxp://search.myheritage.com
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
LSP: c:\program files\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 10.0.0.138
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\katka\Data aplikací\Mozilla\Firefox\Profiles\w11n10ul.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?affID=111881&tt=220512_53ctrl&babsrc=KW_ss&mntrId=1885c8fd000000000000001a738abb82&q=
FF - ExtSQL: !HIDDEN! 2009-08-18 03:00; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=111881&tt=220512_53ctrl
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.id - 1885c8fd000000000000001a738abb82
FF - user.js: extensions.BabylonToolbar_i.hardId - 1885c8fd000000000000001a738abb82
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15491
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.179:34
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
HKCU-Run-OEXPRESS - (no file)
HKCU-Run-RocketDock - c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
c:\documents and settings\katka\Nabídka Start\Programy\Po spuštění\RocketDock.lnk - c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
SafeBoot-mbamchameleon
MSConfigStartUp-DAEMON Tools Lite - c:\program files\DAEMON Tools Lite\daemon.exe
MSConfigStartUp-ICQ - c:\program files\ICQ6\ICQ.exe
MSConfigStartUp-JustVoip - c:\program files\JustVoip.com\JustVoip\JustVoip.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-07-01 21:38
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a3,58,7e,9a,b7,9a,04,42,9d,db,d0,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a3,58,7e,9a,b7,9a,04,42,9d,db,d0,\
.
Celkový čas: 2013-07-01 21:40:57
ComboFix-quarantined-files.txt 2013-07-01 19:40
.
Před spuštěním: Volných bajtů: 14 428 311 552
Po spuštění: Volných bajtů: 15 530 467 328
.
WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[Boot Loader]
Timeout=2
Default=c:\$win_nt$.~bt\BOOTSECT.DAT
[Operating Systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn
c:\$win_nt$.~bt\BOOTSECT.DAT="Microsoft Windows XP Professional - instalace"
.
- - End Of File - - 0B88AB98AF40B544E2BF64AEB9B79DD5
413FC2A0C716421B3158746D63736515
Rkill 2.5.3 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2013 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html
Program started at: 07/01/2013 09:22:52 PM in x86 mode.
Windows Version: Microsoft Windows XP Service Pack 3
Checking for Windows services to stop:
* No malware services found to stop.
Checking for processes to terminate:
* C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe (PID: 436) [WD-HEUR]
* C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe (PID: 684) [WD-HEUR]
* C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe (PID: 692) [WD-HEUR]
3 proccesses terminated!
Checking Registry for malware related settings:
* No issues found in the Registry.
Resetting .EXE, .COM, & .BAT associations in the Windows Registry.
Performing miscellaneous checks:
* Windows Firewall Disabled
[HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = dword:00000000
Checking Windows Service Integrity:
* Služba obnovení systému (srservice) is not Running.
Startup Type set to: Automatic
* Ovladač filtru Obnovy systému (sr) is not Running.
Startup Type set to: Disabled
Searching for Missing Digital Signatures:
* C:\WINDOWS\System32\drivers\mqac.sys [NoSig]
+-> C:\WINDOWS\$hf_mig$\KB937894\SP2QFE\mqac.sys : 72 960 : 07/06/2007 00:52 AM : d92fce6729ee150a15a7cdbc433f390e [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB971032\SP2QFE\mqac.sys : 91 776 : 06/22/2009 01:30 PM : 9229e191fe206628be17d1e67a5faed9 [Pos Repl]
+-> C:\WINDOWS\$NtServicePackUninstall$\mqac.sys : 72 960 : 08/03/2004 10:58 PM : db07b0088cdfd20c2a22e675120ede34 [Pos Repl]
+-> C:\WINDOWS\$NtUninstallKB937894$\mqac.sys : 72 960 : 08/03/2004 10:58 PM : db07b0088cdfd20c2a22e675120ede34 [Pos Repl]
+-> C:\WINDOWS\$NtUninstallKB971032$\mqac.sys : 72 960 : 07/06/2007 10:05 AM : 157a32ddc6a019a4e31b19d604d2f127 [Pos Repl]
+-> C:\WINDOWS\ServicePackFiles\i386\mqac.sys : 92 544 : 04/13/2008 08:39 PM : 70c14f5cca5cf73f8a645c73a01d8726 [Pos Repl]
+-> C:\WINDOWS\system32\dllcache\mqac.sys : 91 776 : 06/22/2009 01:48 PM : eee50bf24caeedb515a8f3b22756d3bb [Pos Repl]
* C:\WINDOWS\System32\UxTheme.dll [NoSig]
+-> C:\WINDOWS\$NtServicePackUninstall$\uxtheme.dll : 219 648 : 08/17/2004 03:49 PM : 0d3c98f2d11978d67dd4102471cfbfac [Pos Repl]
+-> C:\WINDOWS\ServicePackFiles\i386\uxtheme.dll : 219 648 : 12/09/2010 01:06 AM : 7f2621e34bdaf1087a13cba77e0f5547 [Pos Repl]
* C:\WINDOWS\explorer.exe [NoSig]
+-> C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe : 1 033 728 : 06/13/2007 03:11 PM : 9b32416bd5988c97b6397ce0b02caf97 [Pos Repl]
+-> C:\WINDOWS\$NtServicePackUninstall$\explorer.exe : 1 033 728 : 06/13/2007 03:23 PM : ed7b460b142a32097b8a8f6ecc941815 [Pos Repl]
+-> C:\WINDOWS\$NtUninstallKB938828$\explorer.exe : 1 032 704 : 08/17/2004 03:49 PM : 53114d57ab73a406ac7f602227781a99 [Pos Repl]
+-> C:\WINDOWS\ServicePackFiles\i386\explorer.exe : 976 384 : 04/14/2008 01:22 AM : 13e794e5591776cbc71055a7b3cc1d5f [Pos Repl]
Checking HOSTS File:
* HOSTS file entries found:
127.0.0.1 localhost
Program finished at: 07/01/2013 09:23:59 PM
Execution time: 0 hours(s), 1 minute(s), and 6 seconds(s)
_______________________________________________________________________________________________________
log z Combofix:
ComboFix 13-06-30.01 - katka 01.07.2013 21:33:01.1.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1527.837 [GMT 2:00]
Spuštěný z: c:\documents and settings\katka\Plocha\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
c:\windows\msmqinst.log
c:\windows\system32\SETDC.tmp
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-06-01 do 2013-07-01 )))))))))))))))))))))))))))))))
.
.
2013-07-01 17:30 . 2013-07-01 17:30 -------- d-----w- c:\documents and settings\katka\Data aplikací\Avira
2013-07-01 17:26 . 2013-07-01 17:26 -------- d-sh--w- c:\documents and settings\LocalService\PrivacIE
2013-07-01 17:26 . 2013-07-01 17:26 -------- d-----w- c:\documents and settings\LocalService\Data aplikací\LangSoft
2013-07-01 17:23 . 2013-07-01 16:16 37352 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2013-07-01 17:23 . 2013-07-01 16:16 135136 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-07-01 17:23 . 2013-07-01 17:24 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Avira
2013-07-01 17:23 . 2013-07-01 17:23 -------- d-----w- c:\program files\Avira
2013-07-01 15:33 . 2013-07-01 15:34 -------- d-----w- C:\rsit
2013-07-01 15:33 . 2013-07-01 15:33 -------- d-----w- c:\program files\trend micro
2013-07-01 13:47 . 2013-07-01 13:51 -------- d-----w- c:\program files\Common Files\Adobe
2013-07-01 11:07 . 2013-07-01 11:07 -------- d-----w- c:\program files\ESET
2013-07-01 10:49 . 2013-07-01 11:07 -------- d-----w- c:\documents and settings\All Users\Data aplikací\HitmanPro
2013-07-01 10:08 . 2013-07-01 10:08 -------- d-----w- c:\documents and settings\katka\Data aplikací\Malwarebytes
2013-07-01 10:08 . 2013-07-01 10:08 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2013-07-01 10:08 . 2013-04-04 12:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-07-01 10:08 . 2013-07-01 10:08 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-07-01 10:08 . 2013-07-01 10:08 35144 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2013-06-24 18:40 . 2013-06-24 18:40 -------- d-----w- c:\documents and settings\katka\Data aplikací\Printer Info Cache
2013-06-24 18:40 . 2013-06-24 18:40 -------- d-----w- c:\documents and settings\katka\Data aplikací\Image Zone Express
2013-06-24 16:18 . 2013-07-01 19:25 -------- d-----w- c:\documents and settings\katka\Data aplikací\stickies
2013-06-24 16:18 . 2013-06-24 17:34 599 ----a-w- c:\windows\uninstallstickies.bat
2013-06-24 16:18 . 2013-06-24 16:18 -------- d-----w- c:\program files\Stickies
2013-06-24 16:14 . 2005-09-28 17:04 57344 ----a-w- c:\windows\system32\DreamPopUpMenu.dll
2013-06-24 16:14 . 2005-09-07 17:53 65536 ----a-w- c:\windows\system32\WNCalendar.ocx
2013-06-24 16:14 . 2005-07-31 14:58 921600 ----a-w- c:\windows\system32\xpstylelib.ocx
2013-06-24 16:14 . 1998-06-23 23:00 203576 ----a-w- c:\windows\system32\RichTx32.ocx
2013-06-24 16:14 . 1998-06-23 22:00 82744 ----a-w- c:\windows\system32\PicClp32.ocx
2013-06-24 16:14 . 2013-06-28 04:47 -------- d-----w- c:\program files\GooferToDo
2013-06-24 16:14 . 2006-05-30 20:44 64000 ----a-w- c:\windows\system32\RICHTX32.oca
2013-06-24 16:14 . 2006-05-29 23:10 240128 ----a-w- c:\windows\system32\COMCTL32.oca
2013-06-24 16:14 . 2006-05-29 22:51 18944 ----a-w- c:\windows\system32\PICCLP32.oca
2013-06-24 16:14 . 2006-05-29 22:51 35840 ----a-w- c:\windows\system32\COMDLG32.oca
2013-06-24 16:14 . 2006-05-29 22:51 265728 ----a-w- c:\windows\system32\mscomctl.oca
2013-06-24 16:14 . 2003-03-20 05:33 20992 ----a-w- c:\windows\system32\WNCalendar.oca
2013-06-12 11:33 . 2013-06-12 11:33 9089416 ----a-w- c:\windows\system32\FlashPlayerInstaller.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-07-01 16:16 . 2009-03-23 19:37 84744 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-06-12 11:33 . 2012-05-03 12:33 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-06-12 11:33 . 2011-05-27 09:16 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-05-07 22:27 . 2002-09-23 12:00 920064 ----a-w- c:\windows\system32\wininet.dll
2013-05-07 22:27 . 2002-09-23 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2013-05-07 22:27 . 2002-09-23 12:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2013-05-07 21:53 . 2007-09-22 11:40 385024 ----a-w- c:\windows\system32\html.iec
2013-05-03 05:39 . 2002-09-23 12:00 2195712 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-05-03 05:39 . 2002-09-20 17:12 2072320 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-04-12 14:01 . 2002-09-23 12:00 1876352 ----a-w- c:\windows\system32\win32k.sys
2012-07-12 20:09 . 2012-07-12 20:09 0 ----a-w- c:\program files\GUM6F.tmp
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2008-04-14 . 13E794E5591776CBC71055A7B3CC1D5F . 976384 . . [6.00.2900.5512] . . c:\windows\explorer.exe
[-] 2008-04-14 . 13E794E5591776CBC71055A7B3CC1D5F . 976384 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\explorer.exe
[-] 2007-06-13 . ED7B460B142A32097B8A8F6ECC941815 . 1033728 . . [6.00.2900.3156] . . c:\windows\$NtServicePackUninstall$\explorer.exe
[-] 2007-06-13 . 9B32416BD5988C97B6397CE0B02CAF97 . 1033728 . . [6.00.2900.3156] . . c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[7] 2004-08-17 . 53114D57AB73A406AC7F602227781A99 . 1032704 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB938828$\explorer.exe
.
[-] 2008-04-14 . ED69B3B6CD23D1D00815D5F70D517E01 . 225792 . . [5.1.2600.5512] . . c:\windows\regedit.exe
[-] 2008-04-14 . ED69B3B6CD23D1D00815D5F70D517E01 . 225792 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\regedit.exe
[7] 2004-08-17 . CB5A91928D94224E7E30EE277B45E8A3 . 147968 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\regedit.exe
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-05-16 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2005-10-12 139264]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-08-08 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-08-08 162328]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-08-08 137752]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-06-07 827392]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-02-14 454656]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]
"SafeQ Client"="c:\program files\Y Soft\SafeQ Client\Client\SafeQ Client.exe" [2012-07-20 259072]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-18 946352]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2013-07-01 345144]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\katka\Nabídka Start\Programy\Po spuštění\
Stickies.lnk - c:\program files\Stickies\stickies.exe [2013-6-24 1122304]
TransBar.lnk - c:\windows\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe /s [2005-6-1 65536]
UberIcon.lnk - c:\windows\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe [2006-5-21 180224]
Y'z Shadow.lnk - c:\windows\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe [2006-5-21 155648]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520]
Stickies.lnk - c:\program files\Stickies\stickies.exe [2013-6-24 1122304]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\windows\system32\logonuix.exe"
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
@=""
.
[HKLM\~\startupfolder\C:^Documents and Settings^katka^Nabídka Start^Programy^Po spuštění^OpenOffice.org 2.3.lnk]
path=c:\documents and settings\katka\Nabídka Start\Programy\Po spuštění\OpenOffice.org 2.3.lnk
backup=c:\windows\pss\OpenOffice.org 2.3.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2012-11-09 10:27 17877168 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\WINWORD.EXE"=
"c:\\Documents and Settings\\katka\\Local Settings\\Temp\\jivexviewer\\jre\\bin\\JiveX[dv] light"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Documents and Settings\\katka\\Plocha\\DC\\StrongDC.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R1 A2DDA;A2 Direct Disk Access Support Driver;c:\documents and settings\katka\Plocha\Emisoft\Run\a2ddax86.sys [1.7.2013 14:57 22056]
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [1.7.2013 19:23 37352]
R2 AntiVirSchedulerService;Avira Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [1.7.2013 19:23 84024]
R2 AntiVirWebService;Avira Web Protection;c:\program files\Avira\AntiVir Desktop\avwebgrd.exe [1.7.2013 19:23 589368]
S0 sptd;sptd;c:\windows\system32\Drivers\sptd.sys --> c:\windows\system32\Drivers\sptd.sys [?]
S2 bjhwjesr;apucfhg;c:\windows\system32\svchost.exe -k netsvcs [23.9.2002 14:00 14336]
S2 kcfbp;Center Driver;c:\windows\system32\svchost.exe -k netsvcs [23.9.2002 14:00 14336]
S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [9.11.2012 12:21 160944]
S3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys --> c:\windows\system32\drivers\dgderdrv.sys [?]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [19.9.2010 18:17 36608]
S3 mbamchameleon;mbamchameleon;c:\windows\system32\drivers\mbamchameleon.sys [1.7.2013 12:08 35144]
S3 PAC207;Trust WB-1400T Webcam;c:\windows\system32\drivers\PFC027.sys [24.2.2005 13:29 162176]
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - ANTIVIRSCHEDULERSERVICE
*NewlyCreated* - ANTIVIRSERVICE
*NewlyCreated* - ANTIVIRWEBSERVICE
*NewlyCreated* - AVGNTFLT
*NewlyCreated* - AVIPBB
*NewlyCreated* - AVKMGR
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
bjhwjesr
kcfbp
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-06-19 08:30 1165776 ----a-w- c:\program files\Google\Chrome\Application\27.0.1453.116\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2013-07-01 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-03 11:33]
.
2013-07-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-10 10:11]
.
2013-07-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-10 10:11]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://search.babylon.com/?affID=111881&tt=220512_53ctrl&babsrc=HP_ss&mntrId=1885c8fd000000000000001a738abb82
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&s ... f8&oe=utf8
mStart Page = hxxp://search.myheritage.com
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
LSP: c:\program files\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 10.0.0.138
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\katka\Data aplikací\Mozilla\Firefox\Profiles\w11n10ul.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?affID=111881&tt=220512_53ctrl&babsrc=KW_ss&mntrId=1885c8fd000000000000001a738abb82&q=
FF - ExtSQL: !HIDDEN! 2009-08-18 03:00; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=111881&tt=220512_53ctrl
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.id - 1885c8fd000000000000001a738abb82
FF - user.js: extensions.BabylonToolbar_i.hardId - 1885c8fd000000000000001a738abb82
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15491
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.179:34
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
HKCU-Run-OEXPRESS - (no file)
HKCU-Run-RocketDock - c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
c:\documents and settings\katka\Nabídka Start\Programy\Po spuštění\RocketDock.lnk - c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
SafeBoot-mbamchameleon
MSConfigStartUp-DAEMON Tools Lite - c:\program files\DAEMON Tools Lite\daemon.exe
MSConfigStartUp-ICQ - c:\program files\ICQ6\ICQ.exe
MSConfigStartUp-JustVoip - c:\program files\JustVoip.com\JustVoip\JustVoip.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-07-01 21:38
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a3,58,7e,9a,b7,9a,04,42,9d,db,d0,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a3,58,7e,9a,b7,9a,04,42,9d,db,d0,\
.
Celkový čas: 2013-07-01 21:40:57
ComboFix-quarantined-files.txt 2013-07-01 19:40
.
Před spuštěním: Volných bajtů: 14 428 311 552
Po spuštění: Volných bajtů: 15 530 467 328
.
WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[Boot Loader]
Timeout=2
Default=c:\$win_nt$.~bt\BOOTSECT.DAT
[Operating Systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn
c:\$win_nt$.~bt\BOOTSECT.DAT="Microsoft Windows XP Professional - instalace"
.
- - End Of File - - 0B88AB98AF40B544E2BF64AEB9B79DD5
413FC2A0C716421B3158746D63736515
Re: Zavirovaný počítač
Pokud nemate, tak presunte Combofix na plochu
- Spustte poznamkovy blok (Start-spustit-notepad)
- Zkopirujte skript nize
Kód: Vybrat vše
KillAll:: FCopy:: C:\WINDOWS\ServicePackFiles\i386\mqac.sys | C:\WINDOWS\System32\drivers\mqac.sys C:\WINDOWS\$NtServicePackUninstall$\uxtheme.dll | C:\WINDOWS\System32\UxTheme.dll Registry:: [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DAEMON Tools Lite"=- "swg"=- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"=- "GrooveMonitor"=- "SunJavaUpdateSched"=- "HP Software Update"=- "Adobe ARM"=- Driver:: bjhwjesr kcfbp NetSvc:: bjhwjesr kcfbp File:: c:\windows\Tasks\Adobe Flash Player Updater.job c:\windows\Tasks\GoogleUpdateTaskMachineCore.job c:\windows\Tasks\GoogleUpdateTaskMachineUA.job DDS:: uStart Page = hxxp://search.babylon.com/?affID=111881 ... 1a738abb82 uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 mStart Page = hxxp://search.myheritage.com uSearchURL,(Default) = hxxp://www.google.com/search?q=%s Firefox:: FF - ProfilePath - c:\documents and settings\katka\Data aplikací\Mozilla\Firefox\Profiles\w11n10ul.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/ FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?affID=111881 ... 38abb82&q= FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=111881&tt=220512_53ctrl FF - user.js: extensions.BabylonToolbar_i.babExt - FF - user.js: extensions.BabylonToolbar_i.srcExt - ss FF - user.js: extensions.BabylonToolbar_i.id - 1885c8fd000000000000001a738abb82 FF - user.js: extensions.BabylonToolbar_i.hardId - 1885c8fd000000000000001a738abb82 FF - user.js: extensions.BabylonToolbar_i.instlDay - 15491 FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17 FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17 FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.179:34 FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar FF - user.js: extensions.BabylonToolbar_i.aflt - babsst FF - user.js: extensions.BabylonToolbar_i.smplGrp - none FF - user.js: extensions.BabylonToolbar_i.tlbrId - base FF - user.js: extensions.BabylonToolbar_i.instlRef - sst RegLock:: [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences] ClearJavaCache:: Reboot::- Ulozte vytvoreny TXT jako CFScript.txt
- Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
- Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte
Pokud vyskoci hlaska "Pokus pouzit neplatnou operaci na klic registru, ktery je oznacen pro odstraneni", tak jen restartujte PC - registr se da do kupy - jedna se o vnitrni chybu, kterou zpusobuje CF a autor ji zatim neumi bohuzel opravit Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen od 1. února 2011.
Člen
od 1. února 2011.Re: Zavirovaný počítač
Počítač se zdá být v pořádku.
log po restartu:
ComboFix 13-06-30.01 - katka 01.07.2013 22:47:44.1.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1527.801 [GMT 2:00]
Spuštěný z: c:\documents and settings\katka\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\katka\Plocha\CFScript.txt
AV: Avira Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
FILE ::
"c:\windows\Tasks\Adobe Flash Player Updater.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
--------------- FCopy ---------------
.
c:\windows\ServicePackFiles\i386\mqac.sys --> c:\windows\System32\drivers\mqac.sys
c:\windows\$NtServicePackUninstall$\uxtheme.dll --> c:\windows\System32\UxTheme.dll
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-06-01 do 2013-07-01 )))))))))))))))))))))))))))))))
.
.
2013-07-01 17:30 . 2013-07-01 17:30 -------- d-----w- c:\documents and settings\katka\Data aplikací\Avira
2013-07-01 17:26 . 2013-07-01 17:26 -------- d-sh--w- c:\documents and settings\LocalService\PrivacIE
2013-07-01 17:26 . 2013-07-01 17:26 -------- d-----w- c:\documents and settings\LocalService\Data aplikací\LangSoft
2013-07-01 17:23 . 2013-07-01 16:16 37352 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2013-07-01 17:23 . 2013-07-01 16:16 135136 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-07-01 17:23 . 2013-07-01 17:24 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Avira
2013-07-01 17:23 . 2013-07-01 17:23 -------- d-----w- c:\program files\Avira
2013-07-01 15:33 . 2013-07-01 15:34 -------- d-----w- C:\rsit
2013-07-01 15:33 . 2013-07-01 15:33 -------- d-----w- c:\program files\trend micro
2013-07-01 13:47 . 2013-07-01 13:51 -------- d-----w- c:\program files\Common Files\Adobe
2013-07-01 11:07 . 2013-07-01 11:07 -------- d-----w- c:\program files\ESET
2013-07-01 10:49 . 2013-07-01 11:07 -------- d-----w- c:\documents and settings\All Users\Data aplikací\HitmanPro
2013-07-01 10:08 . 2013-07-01 10:08 -------- d-----w- c:\documents and settings\katka\Data aplikací\Malwarebytes
2013-07-01 10:08 . 2013-07-01 10:08 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2013-07-01 10:08 . 2013-04-04 12:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-07-01 10:08 . 2013-07-01 10:08 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-07-01 10:08 . 2013-07-01 10:08 35144 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2013-06-24 18:40 . 2013-06-24 18:40 -------- d-----w- c:\documents and settings\katka\Data aplikací\Printer Info Cache
2013-06-24 18:40 . 2013-06-24 18:40 -------- d-----w- c:\documents and settings\katka\Data aplikací\Image Zone Express
2013-06-24 16:18 . 2013-07-01 20:59 -------- d-----w- c:\documents and settings\katka\Data aplikací\stickies
2013-06-24 16:18 . 2013-06-24 17:34 599 ----a-w- c:\windows\uninstallstickies.bat
2013-06-24 16:18 . 2013-06-24 16:18 -------- d-----w- c:\program files\Stickies
2013-06-24 16:14 . 2005-09-28 17:04 57344 ----a-w- c:\windows\system32\DreamPopUpMenu.dll
2013-06-24 16:14 . 2005-09-07 17:53 65536 ----a-w- c:\windows\system32\WNCalendar.ocx
2013-06-24 16:14 . 2005-07-31 14:58 921600 ----a-w- c:\windows\system32\xpstylelib.ocx
2013-06-24 16:14 . 1998-06-23 23:00 203576 ----a-w- c:\windows\system32\RichTx32.ocx
2013-06-24 16:14 . 1998-06-23 22:00 82744 ----a-w- c:\windows\system32\PicClp32.ocx
2013-06-24 16:14 . 2013-06-28 04:47 -------- d-----w- c:\program files\GooferToDo
2013-06-24 16:14 . 2006-05-30 20:44 64000 ----a-w- c:\windows\system32\RICHTX32.oca
2013-06-24 16:14 . 2006-05-29 23:10 240128 ----a-w- c:\windows\system32\COMCTL32.oca
2013-06-24 16:14 . 2006-05-29 22:51 18944 ----a-w- c:\windows\system32\PICCLP32.oca
2013-06-24 16:14 . 2006-05-29 22:51 35840 ----a-w- c:\windows\system32\COMDLG32.oca
2013-06-24 16:14 . 2006-05-29 22:51 265728 ----a-w- c:\windows\system32\mscomctl.oca
2013-06-24 16:14 . 2003-03-20 05:33 20992 ----a-w- c:\windows\system32\WNCalendar.oca
2013-06-12 11:33 . 2013-06-12 11:33 9089416 ----a-w- c:\windows\system32\FlashPlayerInstaller.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-07-01 16:16 . 2009-03-23 19:37 84744 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-06-12 11:33 . 2012-05-03 12:33 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-06-12 11:33 . 2011-05-27 09:16 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-05-07 22:27 . 2002-09-23 12:00 920064 ----a-w- c:\windows\system32\wininet.dll
2013-05-07 22:27 . 2002-09-23 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2013-05-07 22:27 . 2002-09-23 12:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2013-05-07 21:53 . 2007-09-22 11:40 385024 ----a-w- c:\windows\system32\html.iec
2013-05-03 05:39 . 2002-09-23 12:00 2195712 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-05-03 05:39 . 2002-09-20 17:12 2072320 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-04-12 14:01 . 2002-09-23 12:00 1876352 ----a-w- c:\windows\system32\win32k.sys
2012-07-12 20:09 . 2012-07-12 20:09 0 ----a-w- c:\program files\GUM6F.tmp
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2008-04-14 . 13E794E5591776CBC71055A7B3CC1D5F . 976384 . . [6.00.2900.5512] . . c:\windows\explorer.exe
[-] 2008-04-14 . 13E794E5591776CBC71055A7B3CC1D5F . 976384 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\explorer.exe
[-] 2007-06-13 . ED7B460B142A32097B8A8F6ECC941815 . 1033728 . . [6.00.2900.3156] . . c:\windows\$NtServicePackUninstall$\explorer.exe
[-] 2007-06-13 . 9B32416BD5988C97B6397CE0B02CAF97 . 1033728 . . [6.00.2900.3156] . . c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[7] 2004-08-17 . 53114D57AB73A406AC7F602227781A99 . 1032704 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB938828$\explorer.exe
.
[-] 2008-04-14 . ED69B3B6CD23D1D00815D5F70D517E01 . 225792 . . [5.1.2600.5512] . . c:\windows\regedit.exe
[-] 2008-04-14 . ED69B3B6CD23D1D00815D5F70D517E01 . 225792 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\regedit.exe
[7] 2004-08-17 . CB5A91928D94224E7E30EE277B45E8A3 . 147968 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\regedit.exe
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2005-10-12 139264]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-08-08 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-08-08 162328]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-08-08 137752]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-06-07 827392]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-02-14 454656]
"SafeQ Client"="c:\program files\Y Soft\SafeQ Client\Client\SafeQ Client.exe" [2012-07-20 259072]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2013-07-01 345144]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\katka\Nabídka Start\Programy\Po spuštění\
Stickies.lnk - c:\program files\Stickies\stickies.exe [2013-6-24 1122304]
TransBar.lnk - c:\windows\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe /s [2005-6-1 65536]
UberIcon.lnk - c:\windows\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe [2006-5-21 180224]
Y'z Shadow.lnk - c:\windows\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe [2006-5-21 155648]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520]
Stickies.lnk - c:\program files\Stickies\stickies.exe [2013-6-24 1122304]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\windows\system32\logonuix.exe"
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
@=""
.
[HKLM\~\startupfolder\C:^Documents and Settings^katka^Nabídka Start^Programy^Po spuštění^OpenOffice.org 2.3.lnk]
path=c:\documents and settings\katka\Nabídka Start\Programy\Po spuštění\OpenOffice.org 2.3.lnk
backup=c:\windows\pss\OpenOffice.org 2.3.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2012-11-09 10:27 17877168 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\WINWORD.EXE"=
"c:\\Documents and Settings\\katka\\Local Settings\\Temp\\jivexviewer\\jre\\bin\\JiveX[dv] light"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Documents and Settings\\katka\\Plocha\\DC\\StrongDC.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R1 A2DDA;A2 Direct Disk Access Support Driver;c:\documents and settings\katka\Plocha\Emisoft\Run\a2ddax86.sys [1.7.2013 14:57 22056]
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [1.7.2013 19:23 37352]
R2 AntiVirSchedulerService;Avira Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [1.7.2013 19:23 84024]
R2 AntiVirWebService;Avira Web Protection;c:\program files\Avira\AntiVir Desktop\avwebgrd.exe [1.7.2013 19:23 589368]
S0 sptd;sptd;c:\windows\system32\Drivers\sptd.sys --> c:\windows\system32\Drivers\sptd.sys [?]
S2 bjhwjesr;apucfhg;c:\windows\system32\svchost.exe -k netsvcs [23.9.2002 14:00 14336]
S2 kcfbp;Center Driver;c:\windows\system32\svchost.exe -k netsvcs [23.9.2002 14:00 14336]
S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [9.11.2012 12:21 160944]
S3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys --> c:\windows\system32\drivers\dgderdrv.sys [?]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [19.9.2010 18:17 36608]
S3 mbamchameleon;mbamchameleon;c:\windows\system32\drivers\mbamchameleon.sys [1.7.2013 12:08 35144]
S3 PAC207;Trust WB-1400T Webcam;c:\windows\system32\drivers\PFC027.sys [24.2.2005 13:29 162176]
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - SSMDRV
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-06-19 08:30 1165776 ----a-w- c:\program files\Google\Chrome\Application\27.0.1453.116\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2013-07-01 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-03 11:33]
.
2013-07-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-10 10:11]
.
2013-07-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-10 10:11]
.
.
------- Doplňkový sken -------
.
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
LSP: c:\program files\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 10.0.0.138
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\katka\Data aplikací\Mozilla\Firefox\Profiles\w11n10ul.default\
FF - ExtSQL: !HIDDEN! 2009-08-18 03:00; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-07-01 23:00
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'lsass.exe'(944)
c:\program files\Avira\AntiVir Desktop\avsda.dll
.
- - - - - - - > 'explorer.exe'(2836)
c:\windows\system32\SHDOCVW.dll
c:\windows\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\msls31.dll
c:\windows\system32\netshell.dll
c:\windows\system32\credui.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\igfxsrvc.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Intel\Intel Matrix Storage Manager\iaantmon.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\System32\PAStiSvc.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\windows\System32\wbem\wmiapsrv.exe
c:\progra~1\hpq\Shared\HPQTOA~1.EXE
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2013-07-01 23:05:43 - počítač byl restartován
ComboFix-quarantined-files.txt 2013-07-01 21:05
ComboFix2.txt 2013-07-01 19:40
.
Před spuštěním: Volných bajtů: 15 862 779 904
Po spuštění: Volných bajtů: 15 851 991 040
.
- - End Of File - - 994C53193130532C228ACA09EF9BCBD8
413FC2A0C716421B3158746D63736515
log po restartu:
ComboFix 13-06-30.01 - katka 01.07.2013 22:47:44.1.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1527.801 [GMT 2:00]
Spuštěný z: c:\documents and settings\katka\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\katka\Plocha\CFScript.txt
AV: Avira Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
FILE ::
"c:\windows\Tasks\Adobe Flash Player Updater.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
--------------- FCopy ---------------
.
c:\windows\ServicePackFiles\i386\mqac.sys --> c:\windows\System32\drivers\mqac.sys
c:\windows\$NtServicePackUninstall$\uxtheme.dll --> c:\windows\System32\UxTheme.dll
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-06-01 do 2013-07-01 )))))))))))))))))))))))))))))))
.
.
2013-07-01 17:30 . 2013-07-01 17:30 -------- d-----w- c:\documents and settings\katka\Data aplikací\Avira
2013-07-01 17:26 . 2013-07-01 17:26 -------- d-sh--w- c:\documents and settings\LocalService\PrivacIE
2013-07-01 17:26 . 2013-07-01 17:26 -------- d-----w- c:\documents and settings\LocalService\Data aplikací\LangSoft
2013-07-01 17:23 . 2013-07-01 16:16 37352 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2013-07-01 17:23 . 2013-07-01 16:16 135136 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-07-01 17:23 . 2013-07-01 17:24 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Avira
2013-07-01 17:23 . 2013-07-01 17:23 -------- d-----w- c:\program files\Avira
2013-07-01 15:33 . 2013-07-01 15:34 -------- d-----w- C:\rsit
2013-07-01 15:33 . 2013-07-01 15:33 -------- d-----w- c:\program files\trend micro
2013-07-01 13:47 . 2013-07-01 13:51 -------- d-----w- c:\program files\Common Files\Adobe
2013-07-01 11:07 . 2013-07-01 11:07 -------- d-----w- c:\program files\ESET
2013-07-01 10:49 . 2013-07-01 11:07 -------- d-----w- c:\documents and settings\All Users\Data aplikací\HitmanPro
2013-07-01 10:08 . 2013-07-01 10:08 -------- d-----w- c:\documents and settings\katka\Data aplikací\Malwarebytes
2013-07-01 10:08 . 2013-07-01 10:08 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2013-07-01 10:08 . 2013-04-04 12:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-07-01 10:08 . 2013-07-01 10:08 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-07-01 10:08 . 2013-07-01 10:08 35144 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2013-06-24 18:40 . 2013-06-24 18:40 -------- d-----w- c:\documents and settings\katka\Data aplikací\Printer Info Cache
2013-06-24 18:40 . 2013-06-24 18:40 -------- d-----w- c:\documents and settings\katka\Data aplikací\Image Zone Express
2013-06-24 16:18 . 2013-07-01 20:59 -------- d-----w- c:\documents and settings\katka\Data aplikací\stickies
2013-06-24 16:18 . 2013-06-24 17:34 599 ----a-w- c:\windows\uninstallstickies.bat
2013-06-24 16:18 . 2013-06-24 16:18 -------- d-----w- c:\program files\Stickies
2013-06-24 16:14 . 2005-09-28 17:04 57344 ----a-w- c:\windows\system32\DreamPopUpMenu.dll
2013-06-24 16:14 . 2005-09-07 17:53 65536 ----a-w- c:\windows\system32\WNCalendar.ocx
2013-06-24 16:14 . 2005-07-31 14:58 921600 ----a-w- c:\windows\system32\xpstylelib.ocx
2013-06-24 16:14 . 1998-06-23 23:00 203576 ----a-w- c:\windows\system32\RichTx32.ocx
2013-06-24 16:14 . 1998-06-23 22:00 82744 ----a-w- c:\windows\system32\PicClp32.ocx
2013-06-24 16:14 . 2013-06-28 04:47 -------- d-----w- c:\program files\GooferToDo
2013-06-24 16:14 . 2006-05-30 20:44 64000 ----a-w- c:\windows\system32\RICHTX32.oca
2013-06-24 16:14 . 2006-05-29 23:10 240128 ----a-w- c:\windows\system32\COMCTL32.oca
2013-06-24 16:14 . 2006-05-29 22:51 18944 ----a-w- c:\windows\system32\PICCLP32.oca
2013-06-24 16:14 . 2006-05-29 22:51 35840 ----a-w- c:\windows\system32\COMDLG32.oca
2013-06-24 16:14 . 2006-05-29 22:51 265728 ----a-w- c:\windows\system32\mscomctl.oca
2013-06-24 16:14 . 2003-03-20 05:33 20992 ----a-w- c:\windows\system32\WNCalendar.oca
2013-06-12 11:33 . 2013-06-12 11:33 9089416 ----a-w- c:\windows\system32\FlashPlayerInstaller.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-07-01 16:16 . 2009-03-23 19:37 84744 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-06-12 11:33 . 2012-05-03 12:33 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-06-12 11:33 . 2011-05-27 09:16 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-05-07 22:27 . 2002-09-23 12:00 920064 ----a-w- c:\windows\system32\wininet.dll
2013-05-07 22:27 . 2002-09-23 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2013-05-07 22:27 . 2002-09-23 12:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2013-05-07 21:53 . 2007-09-22 11:40 385024 ----a-w- c:\windows\system32\html.iec
2013-05-03 05:39 . 2002-09-23 12:00 2195712 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-05-03 05:39 . 2002-09-20 17:12 2072320 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-04-12 14:01 . 2002-09-23 12:00 1876352 ----a-w- c:\windows\system32\win32k.sys
2012-07-12 20:09 . 2012-07-12 20:09 0 ----a-w- c:\program files\GUM6F.tmp
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2008-04-14 . 13E794E5591776CBC71055A7B3CC1D5F . 976384 . . [6.00.2900.5512] . . c:\windows\explorer.exe
[-] 2008-04-14 . 13E794E5591776CBC71055A7B3CC1D5F . 976384 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\explorer.exe
[-] 2007-06-13 . ED7B460B142A32097B8A8F6ECC941815 . 1033728 . . [6.00.2900.3156] . . c:\windows\$NtServicePackUninstall$\explorer.exe
[-] 2007-06-13 . 9B32416BD5988C97B6397CE0B02CAF97 . 1033728 . . [6.00.2900.3156] . . c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[7] 2004-08-17 . 53114D57AB73A406AC7F602227781A99 . 1032704 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB938828$\explorer.exe
.
[-] 2008-04-14 . ED69B3B6CD23D1D00815D5F70D517E01 . 225792 . . [5.1.2600.5512] . . c:\windows\regedit.exe
[-] 2008-04-14 . ED69B3B6CD23D1D00815D5F70D517E01 . 225792 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\regedit.exe
[7] 2004-08-17 . CB5A91928D94224E7E30EE277B45E8A3 . 147968 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\regedit.exe
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2005-10-12 139264]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-08-08 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-08-08 162328]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-08-08 137752]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-06-07 827392]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-02-14 454656]
"SafeQ Client"="c:\program files\Y Soft\SafeQ Client\Client\SafeQ Client.exe" [2012-07-20 259072]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2013-07-01 345144]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\katka\Nabídka Start\Programy\Po spuštění\
Stickies.lnk - c:\program files\Stickies\stickies.exe [2013-6-24 1122304]
TransBar.lnk - c:\windows\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe /s [2005-6-1 65536]
UberIcon.lnk - c:\windows\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe [2006-5-21 180224]
Y'z Shadow.lnk - c:\windows\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe [2006-5-21 155648]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520]
Stickies.lnk - c:\program files\Stickies\stickies.exe [2013-6-24 1122304]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\windows\system32\logonuix.exe"
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
@=""
.
[HKLM\~\startupfolder\C:^Documents and Settings^katka^Nabídka Start^Programy^Po spuštění^OpenOffice.org 2.3.lnk]
path=c:\documents and settings\katka\Nabídka Start\Programy\Po spuštění\OpenOffice.org 2.3.lnk
backup=c:\windows\pss\OpenOffice.org 2.3.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2012-11-09 10:27 17877168 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\WINWORD.EXE"=
"c:\\Documents and Settings\\katka\\Local Settings\\Temp\\jivexviewer\\jre\\bin\\JiveX[dv] light"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Documents and Settings\\katka\\Plocha\\DC\\StrongDC.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R1 A2DDA;A2 Direct Disk Access Support Driver;c:\documents and settings\katka\Plocha\Emisoft\Run\a2ddax86.sys [1.7.2013 14:57 22056]
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [1.7.2013 19:23 37352]
R2 AntiVirSchedulerService;Avira Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [1.7.2013 19:23 84024]
R2 AntiVirWebService;Avira Web Protection;c:\program files\Avira\AntiVir Desktop\avwebgrd.exe [1.7.2013 19:23 589368]
S0 sptd;sptd;c:\windows\system32\Drivers\sptd.sys --> c:\windows\system32\Drivers\sptd.sys [?]
S2 bjhwjesr;apucfhg;c:\windows\system32\svchost.exe -k netsvcs [23.9.2002 14:00 14336]
S2 kcfbp;Center Driver;c:\windows\system32\svchost.exe -k netsvcs [23.9.2002 14:00 14336]
S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [9.11.2012 12:21 160944]
S3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys --> c:\windows\system32\drivers\dgderdrv.sys [?]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [19.9.2010 18:17 36608]
S3 mbamchameleon;mbamchameleon;c:\windows\system32\drivers\mbamchameleon.sys [1.7.2013 12:08 35144]
S3 PAC207;Trust WB-1400T Webcam;c:\windows\system32\drivers\PFC027.sys [24.2.2005 13:29 162176]
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - SSMDRV
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-06-19 08:30 1165776 ----a-w- c:\program files\Google\Chrome\Application\27.0.1453.116\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2013-07-01 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-03 11:33]
.
2013-07-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-10 10:11]
.
2013-07-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-10 10:11]
.
.
------- Doplňkový sken -------
.
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
LSP: c:\program files\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 10.0.0.138
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\katka\Data aplikací\Mozilla\Firefox\Profiles\w11n10ul.default\
FF - ExtSQL: !HIDDEN! 2009-08-18 03:00; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-07-01 23:00
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'lsass.exe'(944)
c:\program files\Avira\AntiVir Desktop\avsda.dll
.
- - - - - - - > 'explorer.exe'(2836)
c:\windows\system32\SHDOCVW.dll
c:\windows\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\msls31.dll
c:\windows\system32\netshell.dll
c:\windows\system32\credui.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\igfxsrvc.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Intel\Intel Matrix Storage Manager\iaantmon.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\System32\PAStiSvc.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\windows\System32\wbem\wmiapsrv.exe
c:\progra~1\hpq\Shared\HPQTOA~1.EXE
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2013-07-01 23:05:43 - počítač byl restartován
ComboFix-quarantined-files.txt 2013-07-01 21:05
ComboFix2.txt 2013-07-01 19:40
.
Před spuštěním: Volných bajtů: 15 862 779 904
Po spuštění: Volných bajtů: 15 851 991 040
.
- - End Of File - - 994C53193130532C228ACA09EF9BCBD8
413FC2A0C716421B3158746D63736515
Re: Zavirovaný počítač
Stale se mi tam ale nelibi nektere polozky 
Stahnete AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner
- Ulozte nejlepe na plochu
- Ukoncete vsechny programy
- Kliknete na Prohledat
- Probehne skenovani a pak se objevi log, pripadne bude ulozen na systemovem disku jako AdwCleaner[R?].txt, ten sem vlozte
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen od 1. února 2011.
Člen
od 1. února 2011.
Přispějete na provoz fóra?