Infekce URL:MAL
Napsal: 05 úno 2015 18:44
Dobrý den, na počítači mi začal avast co pár minut hlásit infekci URL:MAL. Počítač není můj, nevím jak se tam dostal. Prosím o pomoc s odstraněním, posílám log z RSIT. Děkuji za pomoc.
log z RSIT:
info.txt logfile of random's system information tool 1.10 2015-02-05 18:31:43
======MBR======
0x00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001E569E81000000000200EEFFFFFF010000002F60383A00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000055AA
======Uninstall list======
-->MsiExec /X{3F5C371F-8EA2-4F25-9D3D-D0B4526E3AEA}
Adobe Flash Player 16 NPAPI-->C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_16_0_0_305_Plugin.exe -maintain plugin
Adobe Reader XI (11.0.10) - Czech-->MsiExec.exe /I{AC76BA86-7AD7-1029-7B44-AB0000000001}
Adobe Refresh Manager-->MsiExec.exe /I{AC76BA86-0804-1033-1959-001802114130}
Adobe Shockwave Player 11.6-->"C:\windows\SysWOW64\Adobe\Shockwave 11\uninstaller.exe"
Avast Free Antivirus-->C:\Program Files\avast\Setup\Instup.exe /control_panel /instop:uninstall
Bonjour-->MsiExec.exe /X{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}
CCleaner-->"C:\Program Files\CCleaner\uninst.exe"
CyberLink YouCam-->"C:\Program Files (x86)\InstallShield Installation Information\{01FB4998-33C4-4431-85ED-079E3EEFE75D}\setup.exe" /z-uninstall
CyberLink YouCam-->"C:\Program Files (x86)\InstallShield Installation Information\{01FB4998-33C4-4431-85ED-079E3EEFE75D}\setup.exe" /z-uninstall
D3DX10-->MsiExec.exe /X{E09C4DB7-630C-4F06-A631-8EA7239923AF}
Energy Star-->MsiExec.exe /I{FC0ADA4D-8FA5-4452-8AFF-F0A0BAC97EF7}
Euro Truck Simulator 2-->"C:\Program Files (x86)\Euro Truck Simulator 2\unins001.exe"
Fotogaléria-->MsiExec.exe /X{9093B0D5-EA59-4C9E-A2E3-CC130138DFCD}
Fotogalerie-->MsiExec.exe /X{A1FBD2B3-6768-472D-BA46-C00EACBCE16C}
Hewlett-Packard ACLM.NET v1.2.1.1-->MsiExec.exe /I{6F340107-F9AA-47C6-B54C-C3A19F11553F}
HP 3D DriveGuard-->MsiExec.exe /X{04927A60-31CD-4614-A25C-055B1AD3A8CE}
HP Connected Music (Meridian - installer)-->"C:\Program Files (x86)\HPConnectedMusic\Uninstall.exe"
HP CoolSense-->MsiExec.exe /I{11AF9A96-6D83-4C3B-8DCB-16EA2A358E3F}
HP Customer Experience Enhancements-->MsiExec.exe /X{07FA4960-B038-49EB-891B-9F95930AA544}
HP Documentation-->MsiExec.exe /X{F2481209-98FE-4943-8903-90D19E1B7062}
HP Postscript Converter-->MsiExec.exe /I{6E14E6D6-3175-4E1A-B934-CAB5A86367CD}
HP Quick Start-->MsiExec.exe /X{C001689B-4EAD-4CB4-B5F7-4A85A32785DC}
HP Recovery Manager-->MsiExec.exe /I{1AE37508-089E-41AC-95BD-99FF06887C2F}
HP Registration Service-->MsiExec.exe /X{D1E8F2D7-7794-4245-B286-87ED86C1893C}
HP Support Assistant-->"C:\Program Files (x86)\InstallShield Installation Information\{EE202411-2C26-49E8-9784-1BC1DBF7DE96}\setup.exe" -runfromtemp -l0x0409 -removeonly
HP System Event Utility-->MsiExec.exe /I{C27D60E4-3132-45A3-A71A-E3BD1DA3F794}
HP Utility Center-->MsiExec.exe /I{73237EBB-B26F-4628-8754-4EFE563D72E9}
HP Wireless Button Driver-->MsiExec.exe /X{941DE69D-6CEE-4171-8F1F-3D7E352AA498}
Intel(R) Management Engine Components-->C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\Uninstall\setup.exe -uninstall
Intel(R) Processor Graphics-->C:\Program Files (x86)\Intel\Intel(R) Processor Graphics\Uninstall\setup.exe -uninstall
Intel(R) Rapid Storage Technology-->C:\ProgramData\Intel\Package Cache\{409CB30E-E457-4008-9B1A-ED1B9EA21140}\Setup.exe -uninstall
Intel(R) Rapid Storage Technology-->MsiExec.exe /I{9D859F0D-B405-4B1F-9084-13BBF5D3DB32}
Intel(R) SDK for OpenCL - CPU Only Runtime Package-->C:\Program Files (x86)\Intel\OpenCL SDK\3.0\Uninstall\setup.exe -uninstall
Intel® Trusted Connect Service Client-->MsiExec.exe /I{FA00A3CC-7440-4938-A271-F186F50DD40D}
istartsurf uninstall-->C:\Users\Jaroslava\AppData\Roaming\istartsurf\UninstallManager.exe -ptid=vtt
Java 8 Update 31-->MsiExec.exe /I{26A24AE4-039D-4CA4-87B4-2F83218031F0}
MC BP-Modpack 1.7.10-->C:\Users\Jaroslava\AppData\Roaming\.minecraft\uninst.exe
McAfee Security Scan Plus-->"C:\Program Files\McAfee Security Scan\uninstall.exe"
Microsoft App Update for microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe (x64)-->MsiExec.exe /I{E9F0BCD8-6BD5-1ED7-EDA3-9FCF2A478AA1}
Microsoft Primary Interoperability Assemblies 2005-->MsiExec.exe /X{D24DB8B9-BB6C-4334-9619-BA1C650E13D3}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
Microsoft Visual C++ 2005 Redistributable (x64)-->MsiExec.exe /X{071c9b48-7c32-4621-a0ac-3f809523288f}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{837b34e3-7c30-493c-8f6a-2b0f04e2912c}
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022-->MsiExec.exe /X{350AA351-21FA-3270-8B7A-835434E766AD}
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148-->MsiExec.exe /X{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022-->MsiExec.exe /X{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148-->MsiExec.exe /X{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219-->MsiExec.exe /X{1D8E6291-B0D5-35EC-8441-6616F567A0F7}
Mindspark MarineAquarium-->"C:\Program Files (x86)\Mindspark\MarineAquarium\Uninstall.exe" "/U:C:\Program Files (x86)\Mindspark\MarineAquarium\Uninstall\uninstall.xml"
Movie Maker-->MsiExec.exe /X{8E6E8CBB-8E58-493C-943F-4664F5F2FEDB}
Movie Maker-->MsiExec.exe /X{9EDF46F0-2D4E-4C00-B2B6-0660666E9F60}
Movie Maker-->MsiExec.exe /X{A035950F-15BA-41C0-9D8F-165FC0536012}
Movie Maker-->MsiExec.exe /X{ED6C77F9-4D7E-447C-9EC0-9A212D075535}
Mozilla Firefox 35.0.1 (x86 cs)-->"C:\Program Files (x86)\Mozilla Firefox\uninstall\helper.exe"
Mozilla Maintenance Service-->"C:\Program Files (x86)\Mozilla Maintenance Service\uninstall.exe"
MSVCRT-->MsiExec.exe /I{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}
MSVCRT110_amd64-->MsiExec.exe /I{E9FA781F-3E80-4399-825A-AD3E11C28C77}
MSVCRT110-->MsiExec.exe /I{8E14DDC8-EA60-4E18-B3E3-1937104D5BDA}
NVIDIA PhysX-->MsiExec.exe /X{3F5C371F-8EA2-4F25-9D3D-D0B4526E3AEA}
Opera Stable 27.0.1689.66-->"C:\Program Files (x86)\Opera\Launcher.exe" /uninstall
Photo Common-->MsiExec.exe /X{49110532-D289-4BFF-807C-45B782E66A7C}
Photo Common-->MsiExec.exe /X{C67BC332-A59A-4D40-977F-664F60AB21D8}
Photo Common-->MsiExec.exe /X{EB91007A-0110-42A6-B869-2709955A9B2A}
Photo Gallery-->MsiExec.exe /X{30F99474-EBE3-4134-A02B-F6CD38CFE243}
Photo Gallery-->MsiExec.exe /X{63824BC0-B747-43F3-9863-1066D64AD919}
Picasa 3-->"C:\Program Files (x86)\Google\Picasa3\Uninstall.exe"
Připojení ke vzdálené ploše-->MsiExec.exe /X{D81A311F-D26B-4BDA-8A44-0B608DF49BEF}
Ralink Bluetooth Stack64-->MsiExec.exe /X{8512497A-DF9B-3169-B290-2C18E9F976F1}
Ralink RT3290 802.11bgn Wi-Fi Adapter-->C:\Program Files (x86)\InstallShield Installation Information\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}\setup.exe -runfromtemp -l0x0009 -removeonly
Realtek Ethernet Controller Driver-->C:\Program Files (x86)\InstallShield Installation Information\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}\setup.exe -runfromtemp -removeonly
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -removeonly
Realtek PCIE Card Reader-->"C:\Program Files (x86)\InstallShield Installation Information\{BCDA54F6-C4B6-4519-A09E-FA064A6B4098}\setup.exe" -runfromtemp -removeonly
Search App by Ask-->MsiExec.exe /X{4F524A2D-5350-4500-76A7-A758B70C1801}
SecretSauce-->C:\Program Files (x86)\SecretSauce\SecretSauceuninstall.exe
SereneScreen Marine Aquarium 3-->"C:\Program Files (x86)\SereneScreen\Marine Aquarium 3\unins000.exe"
Settings Manager-->C:\Program Files (x86)\Settings Manager\smdmf\Uninstall.exe /browser=all
Skype Click to Call-->MsiExec.exe /X{6D1221A9-17BF-4EC0-81F2-27D30EC30701}
Skype™ 6.20-->MsiExec.exe /X{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}
swMSM-->MsiExec.exe /I{612C34C7-5E90-47D8-9B5C-0F717DD82726}
Synaptics Pointing Device Driver-->rundll32.exe "%ProgramFiles%\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
unIsales-->"C:\Program Files (x86)\unIsales\unIsales.exe" /s /n /i:"ExecuteCommands;UninstallCommands" ""
Windows Live Communications Platform-->MsiExec.exe /I{0454BB9A-2A7A-4214-BDFF-937F7A711A44}
Windows Live Essentials-->C:\Program Files (x86)\Windows Live\Installer\wlarp.exe
Windows Live Essentials-->MsiExec.exe /I{6CEA775F-E70A-4D72-A3B4-1EB3A5AD4B5C}
Windows Live Essentials-->MsiExec.exe /I{797DC296-ADC5-4A08-8CBC-AEB0D6F4B249}
Windows Live Essentials-->MsiExec.exe /I{C4D82144-B2D5-4A0E-A470-16F13EBC5BCB}
Windows Live Installer-->MsiExec.exe /I{C424CD5E-EA05-4D3E-B5DA-F9F149E1D3AC}
Windows Live Photo Common-->MsiExec.exe /X{C9B6EFD0-4F01-4BBA-8374-39AD99A3ED72}
Windows Live PIMT Platform-->MsiExec.exe /I{6A8DB215-7BCD-4377-B015-2E4541A3E7C6}
Windows Live SOXE Definitions-->MsiExec.exe /I{8A642ACD-CE3A-4A23-A8B1-A0F7EB12B214}
Windows Live SOXE-->MsiExec.exe /I{FE7C0B3D-50B9-4951-BE78-A321CBF86552}
Windows Live UX Platform Language Pack-->MsiExec.exe /I{56232E3D-7EA9-45E0-A371-26CD80510AF7}
Windows Live UX Platform Language Pack-->MsiExec.exe /I{E18F981B-401C-4D90-BC57-D8903564D558}
Windows Live UX Platform Language Pack-->MsiExec.exe /I{F21F0424-B2FF-40BF-A984-9E0D7FB4C97E}
Windows Live UX Platform-->MsiExec.exe /I{4CCBD1F4-CEEC-452A-9CB8-46564B501315}
WinRAR 5.01 (32-bit)-->C:\Program Files (x86)\WinRAR\uninstall.exe
======System event log======
Computer Name: WIN-SQRSSINIRE7
Event Code: 7040
Message: Režim spuštění služby Windows Search byl změněn z automatické spouštění na Zakázáno.
Record Number: 1024
Source Name: Service Control Manager
Time Written: 20130829115628.109874-000
Event Type: Informace
User: Pavilon\Administrator
Computer Name: WIN-SQRSSINIRE7
Event Code: 1014
Message: Překlad názvu ctldl.windowsupdate.com nebyl v požadované době dokončen. Žádný z nakonfigurovaných serverů DNS neodpověděl.
Record Number: 1023
Source Name: Microsoft-Windows-DNS-Client
Time Written: 20130829115614.952930-000
Event Type: Upozornění
User: NT AUTHORITY\NETWORK SERVICE
Computer Name: WIN-SQRSSINIRE7
Event Code: 104
Message: Byl vymazán soubor protokolu Setup.
Record Number: 1022
Source Name: Microsoft-Windows-Eventlog
Time Written: 20130829115614.406031-000
Event Type: Informace
User: Pavilon\Administrator
Computer Name: WIN-SQRSSINIRE7
Event Code: 104
Message: Byl vymazán soubor protokolu Application.
Record Number: 1021
Source Name: Microsoft-Windows-Eventlog
Time Written: 20130829115614.234155-000
Event Type: Informace
User: Pavilon\Administrator
Computer Name: WIN-SQRSSINIRE7
Event Code: 104
Message: Byl vymazán soubor protokolu System.
Record Number: 1020
Source Name: Microsoft-Windows-Eventlog
Time Written: 20130829115614.140389-000
Event Type: Informace
User: Pavilon\Administrator
=====Application event log=====
Computer Name: WIN-SQRSSINIRE7
Event Code: 1066
Message: Inicializační stav pro objekty služby
C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000
Record Number: 947
Source Name: Microsoft-Windows-Security-SPP
Time Written: 20130829115628.000000-000
Event Type: Informace
User:
Computer Name: WIN-SQRSSINIRE7
Event Code: 1003
Message: Služba Windows Search byla spuštěna.
Record Number: 946
Source Name: Microsoft-Windows-Search
Time Written: 20130829115619.000000-000
Event Type: Informace
User:
Computer Name: WIN-SQRSSINIRE7
Event Code: 326
Message: SearchIndexer (2128) Windows: Databázový stroj připojil databázi (1, C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb). (Čas=0 s)
Sekvence interního načasování: [1] 0.000, [2] 0.031, [3] 0.000, [4] 0.000, [5] 0.032, [6] 0.000, [7] 0.000, [8] 0.000, [9] 0.000, [10] 0.000, [11] 0.000, [12] 0.000.
Uložená mezipaměť: 1
Record Number: 945
Source Name: ESENT
Time Written: 20130829115618.000000-000
Event Type: Informace
User:
Computer Name: WIN-SQRSSINIRE7
Event Code: 105
Message: SearchIndexer (2128) Windows: Databázový stroj spustil novou instanci (0). (Čas=0 s)
Sekvence interního načasování: [1] 0.000, [2] 0.000, [3] 0.156, [4] 0.031, [5] 0.000, [6] 0.000, [7] 0.000, [8] 0.000, [9] 0.000, [10] 0.000.
Record Number: 944
Source Name: ESENT
Time Written: 20130829115618.000000-000
Event Type: Informace
User:
Computer Name: WIN-SQRSSINIRE7
Event Code: 102
Message: SearchIndexer (2128) Windows: Databázový stroj (6.02.9200.0000) spouští novou instanci (0).
Record Number: 943
Source Name: ESENT
Time Written: 20130829115618.000000-000
Event Type: Informace
User:
=====Security event log=====
Computer Name: Pavilon
Event Code: 4907
Message: Nastavení auditu objektu se změnila.
Předmět:
ID zabezpečení: S-1-5-21-3827288190-3897321577-2940346249-1001
Název účtu: Jaroslava
Doména účtu: Pavilon
ID přihlášení: 0x362DA1A
Objekt:
Server objektu: Security
Typ objektu: File
Název objektu: C:\$Windows.~BT\Sources\SafeOS\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_6.3.9600.16384_none_2c5177c069a919dd\API-MS-Win-Core-Kernel32-Private-L1-1-0.dll
ID popisovače: 0xa44
Informace o procesu:
ID procesu: 0x1ee8
Název procesu: C:\$Windows.~BT\Sources\SetupHost.exe
Nastavení auditu:
Původní popisovač zabezpečení:
Nový popisovač zabezpečení: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
Record Number: 28245
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20140609152945.036210-000
Event Type: Úspěšný audit
User:
Computer Name: Pavilon
Event Code: 4907
Message: Nastavení auditu objektu se změnila.
Předmět:
ID zabezpečení: S-1-5-21-3827288190-3897321577-2940346249-1001
Název účtu: Jaroslava
Doména účtu: Pavilon
ID přihlášení: 0x362DA1A
Objekt:
Server objektu: Security
Typ objektu: File
Název objektu: C:\$Windows.~BT\Sources\SafeOS\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_6.3.9600.16384_none_2c5177c069a919dd\api-ms-win-core-kernel32-legacy-l1-1-0.dll
ID popisovače: 0xa18
Informace o procesu:
ID procesu: 0x1ee8
Název procesu: C:\$Windows.~BT\Sources\SetupHost.exe
Nastavení auditu:
Původní popisovač zabezpečení:
Nový popisovač zabezpečení: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
Record Number: 28244
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20140609152944.973705-000
Event Type: Úspěšný audit
User:
Computer Name: Pavilon
Event Code: 4907
Message: Nastavení auditu objektu se změnila.
Předmět:
ID zabezpečení: S-1-5-21-3827288190-3897321577-2940346249-1001
Název účtu: Jaroslava
Doména účtu: Pavilon
ID přihlášení: 0x362DA1A
Objekt:
Server objektu: Security
Typ objektu: File
Název objektu: C:\$Windows.~BT\Sources\SafeOS\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_6.3.9600.16384_none_2c5177c069a919dd\api-ms-win-core-kernel32-legacy-l1-1-1.dll
ID popisovače: 0xa14
Informace o procesu:
ID procesu: 0x1ee8
Název procesu: C:\$Windows.~BT\Sources\SetupHost.exe
Nastavení auditu:
Původní popisovač zabezpečení:
Nový popisovač zabezpečení: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
Record Number: 28243
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20140609152944.958078-000
Event Type: Úspěšný audit
User:
Computer Name: Pavilon
Event Code: 4907
Message: Nastavení auditu objektu se změnila.
Předmět:
ID zabezpečení: S-1-5-21-3827288190-3897321577-2940346249-1001
Název účtu: Jaroslava
Doména účtu: Pavilon
ID přihlášení: 0x362DA1A
Objekt:
Server objektu: Security
Typ objektu: File
Název objektu: C:\$Windows.~BT\Sources\SafeOS\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_6.3.9600.16384_none_b8233abb5511544f\api-ms-win-core-io-l1-1-1.dll
ID popisovače: 0xa2c
Informace o procesu:
ID procesu: 0x1ee8
Název procesu: C:\$Windows.~BT\Sources\SetupHost.exe
Nastavení auditu:
Původní popisovač zabezpečení:
Nový popisovač zabezpečení: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
Record Number: 28242
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20140609152944.942456-000
Event Type: Úspěšný audit
User:
Computer Name: Pavilon
Event Code: 4907
Message: Nastavení auditu objektu se změnila.
Předmět:
ID zabezpečení: S-1-5-21-3827288190-3897321577-2940346249-1001
Název účtu: Jaroslava
Doména účtu: Pavilon
ID přihlášení: 0x362DA1A
Objekt:
Server objektu: Security
Typ objektu: File
Název objektu: C:\$Windows.~BT\Sources\SafeOS\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_6.3.9600.16384_none_b8233abb5511544f\api-ms-win-core-interlocked-l1-1-0.dll
ID popisovače: 0xa28
Informace o procesu:
ID procesu: 0x1ee8
Název procesu: C:\$Windows.~BT\Sources\SetupHost.exe
Nastavení auditu:
Původní popisovač zabezpečení:
Nový popisovač zabezpečení: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
Record Number: 28241
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20140609152944.926829-000
Event Type: Úspěšný audit
User:
======Environment variables======
"FP_NO_HOST_CHECK"=NO
"USERNAME"=SYSTEM
"Path"=C:\ProgramData\Oracle\Java\javapath;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Program Files (x86)\Intel\iCLS Client\;C:\Program Files\Intel\iCLS Client\;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\Windows Live\Shared;C:\Program Files (x86)\Intel\OpenCL SDK\3.0\bin\x86;C:\Program Files (x86)\Intel\OpenCL SDK\3.0\bin\x64;C:\Program Files\Intel\Intel(R) Management Engine Components\DAL;C:\Program Files\Intel\Intel(R) Management Engine Components\IPT;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT
"ComSpec"=%SystemRoot%\system32\cmd.exe
"TMP"=%SystemRoot%\TEMP
"OS"=Windows_NT
"windir"=%SystemRoot%
"PROCESSOR_ARCHITECTURE"=AMD64
"TEMP"=%SystemRoot%\TEMP
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PSModulePath"=%SystemRoot%\system32\WindowsPowerShell\v1.0\Modules\
"NUMBER_OF_PROCESSORS"=2
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=Intel64 Family 6 Model 58 Stepping 9, GenuineIntel
"PROCESSOR_REVISION"=3a09
"OnlineServices"=Online Services
"Platform"=MCD
"PCBRAND"=Pavilion
-----------------EOF-----------------
log z RSIT:
info.txt logfile of random's system information tool 1.10 2015-02-05 18:31:43
======MBR======
0x00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001E569E81000000000200EEFFFFFF010000002F60383A00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000055AA
======Uninstall list======
-->MsiExec /X{3F5C371F-8EA2-4F25-9D3D-D0B4526E3AEA}
Adobe Flash Player 16 NPAPI-->C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_16_0_0_305_Plugin.exe -maintain plugin
Adobe Reader XI (11.0.10) - Czech-->MsiExec.exe /I{AC76BA86-7AD7-1029-7B44-AB0000000001}
Adobe Refresh Manager-->MsiExec.exe /I{AC76BA86-0804-1033-1959-001802114130}
Adobe Shockwave Player 11.6-->"C:\windows\SysWOW64\Adobe\Shockwave 11\uninstaller.exe"
Avast Free Antivirus-->C:\Program Files\avast\Setup\Instup.exe /control_panel /instop:uninstall
Bonjour-->MsiExec.exe /X{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}
CCleaner-->"C:\Program Files\CCleaner\uninst.exe"
CyberLink YouCam-->"C:\Program Files (x86)\InstallShield Installation Information\{01FB4998-33C4-4431-85ED-079E3EEFE75D}\setup.exe" /z-uninstall
CyberLink YouCam-->"C:\Program Files (x86)\InstallShield Installation Information\{01FB4998-33C4-4431-85ED-079E3EEFE75D}\setup.exe" /z-uninstall
D3DX10-->MsiExec.exe /X{E09C4DB7-630C-4F06-A631-8EA7239923AF}
Energy Star-->MsiExec.exe /I{FC0ADA4D-8FA5-4452-8AFF-F0A0BAC97EF7}
Euro Truck Simulator 2-->"C:\Program Files (x86)\Euro Truck Simulator 2\unins001.exe"
Fotogaléria-->MsiExec.exe /X{9093B0D5-EA59-4C9E-A2E3-CC130138DFCD}
Fotogalerie-->MsiExec.exe /X{A1FBD2B3-6768-472D-BA46-C00EACBCE16C}
Hewlett-Packard ACLM.NET v1.2.1.1-->MsiExec.exe /I{6F340107-F9AA-47C6-B54C-C3A19F11553F}
HP 3D DriveGuard-->MsiExec.exe /X{04927A60-31CD-4614-A25C-055B1AD3A8CE}
HP Connected Music (Meridian - installer)-->"C:\Program Files (x86)\HPConnectedMusic\Uninstall.exe"
HP CoolSense-->MsiExec.exe /I{11AF9A96-6D83-4C3B-8DCB-16EA2A358E3F}
HP Customer Experience Enhancements-->MsiExec.exe /X{07FA4960-B038-49EB-891B-9F95930AA544}
HP Documentation-->MsiExec.exe /X{F2481209-98FE-4943-8903-90D19E1B7062}
HP Postscript Converter-->MsiExec.exe /I{6E14E6D6-3175-4E1A-B934-CAB5A86367CD}
HP Quick Start-->MsiExec.exe /X{C001689B-4EAD-4CB4-B5F7-4A85A32785DC}
HP Recovery Manager-->MsiExec.exe /I{1AE37508-089E-41AC-95BD-99FF06887C2F}
HP Registration Service-->MsiExec.exe /X{D1E8F2D7-7794-4245-B286-87ED86C1893C}
HP Support Assistant-->"C:\Program Files (x86)\InstallShield Installation Information\{EE202411-2C26-49E8-9784-1BC1DBF7DE96}\setup.exe" -runfromtemp -l0x0409 -removeonly
HP System Event Utility-->MsiExec.exe /I{C27D60E4-3132-45A3-A71A-E3BD1DA3F794}
HP Utility Center-->MsiExec.exe /I{73237EBB-B26F-4628-8754-4EFE563D72E9}
HP Wireless Button Driver-->MsiExec.exe /X{941DE69D-6CEE-4171-8F1F-3D7E352AA498}
Intel(R) Management Engine Components-->C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\Uninstall\setup.exe -uninstall
Intel(R) Processor Graphics-->C:\Program Files (x86)\Intel\Intel(R) Processor Graphics\Uninstall\setup.exe -uninstall
Intel(R) Rapid Storage Technology-->C:\ProgramData\Intel\Package Cache\{409CB30E-E457-4008-9B1A-ED1B9EA21140}\Setup.exe -uninstall
Intel(R) Rapid Storage Technology-->MsiExec.exe /I{9D859F0D-B405-4B1F-9084-13BBF5D3DB32}
Intel(R) SDK for OpenCL - CPU Only Runtime Package-->C:\Program Files (x86)\Intel\OpenCL SDK\3.0\Uninstall\setup.exe -uninstall
Intel® Trusted Connect Service Client-->MsiExec.exe /I{FA00A3CC-7440-4938-A271-F186F50DD40D}
istartsurf uninstall-->C:\Users\Jaroslava\AppData\Roaming\istartsurf\UninstallManager.exe -ptid=vtt
Java 8 Update 31-->MsiExec.exe /I{26A24AE4-039D-4CA4-87B4-2F83218031F0}
MC BP-Modpack 1.7.10-->C:\Users\Jaroslava\AppData\Roaming\.minecraft\uninst.exe
McAfee Security Scan Plus-->"C:\Program Files\McAfee Security Scan\uninstall.exe"
Microsoft App Update for microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe (x64)-->MsiExec.exe /I{E9F0BCD8-6BD5-1ED7-EDA3-9FCF2A478AA1}
Microsoft Primary Interoperability Assemblies 2005-->MsiExec.exe /X{D24DB8B9-BB6C-4334-9619-BA1C650E13D3}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
Microsoft Visual C++ 2005 Redistributable (x64)-->MsiExec.exe /X{071c9b48-7c32-4621-a0ac-3f809523288f}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{837b34e3-7c30-493c-8f6a-2b0f04e2912c}
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022-->MsiExec.exe /X{350AA351-21FA-3270-8B7A-835434E766AD}
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148-->MsiExec.exe /X{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022-->MsiExec.exe /X{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148-->MsiExec.exe /X{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219-->MsiExec.exe /X{1D8E6291-B0D5-35EC-8441-6616F567A0F7}
Mindspark MarineAquarium-->"C:\Program Files (x86)\Mindspark\MarineAquarium\Uninstall.exe" "/U:C:\Program Files (x86)\Mindspark\MarineAquarium\Uninstall\uninstall.xml"
Movie Maker-->MsiExec.exe /X{8E6E8CBB-8E58-493C-943F-4664F5F2FEDB}
Movie Maker-->MsiExec.exe /X{9EDF46F0-2D4E-4C00-B2B6-0660666E9F60}
Movie Maker-->MsiExec.exe /X{A035950F-15BA-41C0-9D8F-165FC0536012}
Movie Maker-->MsiExec.exe /X{ED6C77F9-4D7E-447C-9EC0-9A212D075535}
Mozilla Firefox 35.0.1 (x86 cs)-->"C:\Program Files (x86)\Mozilla Firefox\uninstall\helper.exe"
Mozilla Maintenance Service-->"C:\Program Files (x86)\Mozilla Maintenance Service\uninstall.exe"
MSVCRT-->MsiExec.exe /I{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}
MSVCRT110_amd64-->MsiExec.exe /I{E9FA781F-3E80-4399-825A-AD3E11C28C77}
MSVCRT110-->MsiExec.exe /I{8E14DDC8-EA60-4E18-B3E3-1937104D5BDA}
NVIDIA PhysX-->MsiExec.exe /X{3F5C371F-8EA2-4F25-9D3D-D0B4526E3AEA}
Opera Stable 27.0.1689.66-->"C:\Program Files (x86)\Opera\Launcher.exe" /uninstall
Photo Common-->MsiExec.exe /X{49110532-D289-4BFF-807C-45B782E66A7C}
Photo Common-->MsiExec.exe /X{C67BC332-A59A-4D40-977F-664F60AB21D8}
Photo Common-->MsiExec.exe /X{EB91007A-0110-42A6-B869-2709955A9B2A}
Photo Gallery-->MsiExec.exe /X{30F99474-EBE3-4134-A02B-F6CD38CFE243}
Photo Gallery-->MsiExec.exe /X{63824BC0-B747-43F3-9863-1066D64AD919}
Picasa 3-->"C:\Program Files (x86)\Google\Picasa3\Uninstall.exe"
Připojení ke vzdálené ploše-->MsiExec.exe /X{D81A311F-D26B-4BDA-8A44-0B608DF49BEF}
Ralink Bluetooth Stack64-->MsiExec.exe /X{8512497A-DF9B-3169-B290-2C18E9F976F1}
Ralink RT3290 802.11bgn Wi-Fi Adapter-->C:\Program Files (x86)\InstallShield Installation Information\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}\setup.exe -runfromtemp -l0x0009 -removeonly
Realtek Ethernet Controller Driver-->C:\Program Files (x86)\InstallShield Installation Information\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}\setup.exe -runfromtemp -removeonly
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -removeonly
Realtek PCIE Card Reader-->"C:\Program Files (x86)\InstallShield Installation Information\{BCDA54F6-C4B6-4519-A09E-FA064A6B4098}\setup.exe" -runfromtemp -removeonly
Search App by Ask-->MsiExec.exe /X{4F524A2D-5350-4500-76A7-A758B70C1801}
SecretSauce-->C:\Program Files (x86)\SecretSauce\SecretSauceuninstall.exe
SereneScreen Marine Aquarium 3-->"C:\Program Files (x86)\SereneScreen\Marine Aquarium 3\unins000.exe"
Settings Manager-->C:\Program Files (x86)\Settings Manager\smdmf\Uninstall.exe /browser=all
Skype Click to Call-->MsiExec.exe /X{6D1221A9-17BF-4EC0-81F2-27D30EC30701}
Skype™ 6.20-->MsiExec.exe /X{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}
swMSM-->MsiExec.exe /I{612C34C7-5E90-47D8-9B5C-0F717DD82726}
Synaptics Pointing Device Driver-->rundll32.exe "%ProgramFiles%\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
unIsales-->"C:\Program Files (x86)\unIsales\unIsales.exe" /s /n /i:"ExecuteCommands;UninstallCommands" ""
Windows Live Communications Platform-->MsiExec.exe /I{0454BB9A-2A7A-4214-BDFF-937F7A711A44}
Windows Live Essentials-->C:\Program Files (x86)\Windows Live\Installer\wlarp.exe
Windows Live Essentials-->MsiExec.exe /I{6CEA775F-E70A-4D72-A3B4-1EB3A5AD4B5C}
Windows Live Essentials-->MsiExec.exe /I{797DC296-ADC5-4A08-8CBC-AEB0D6F4B249}
Windows Live Essentials-->MsiExec.exe /I{C4D82144-B2D5-4A0E-A470-16F13EBC5BCB}
Windows Live Installer-->MsiExec.exe /I{C424CD5E-EA05-4D3E-B5DA-F9F149E1D3AC}
Windows Live Photo Common-->MsiExec.exe /X{C9B6EFD0-4F01-4BBA-8374-39AD99A3ED72}
Windows Live PIMT Platform-->MsiExec.exe /I{6A8DB215-7BCD-4377-B015-2E4541A3E7C6}
Windows Live SOXE Definitions-->MsiExec.exe /I{8A642ACD-CE3A-4A23-A8B1-A0F7EB12B214}
Windows Live SOXE-->MsiExec.exe /I{FE7C0B3D-50B9-4951-BE78-A321CBF86552}
Windows Live UX Platform Language Pack-->MsiExec.exe /I{56232E3D-7EA9-45E0-A371-26CD80510AF7}
Windows Live UX Platform Language Pack-->MsiExec.exe /I{E18F981B-401C-4D90-BC57-D8903564D558}
Windows Live UX Platform Language Pack-->MsiExec.exe /I{F21F0424-B2FF-40BF-A984-9E0D7FB4C97E}
Windows Live UX Platform-->MsiExec.exe /I{4CCBD1F4-CEEC-452A-9CB8-46564B501315}
WinRAR 5.01 (32-bit)-->C:\Program Files (x86)\WinRAR\uninstall.exe
======System event log======
Computer Name: WIN-SQRSSINIRE7
Event Code: 7040
Message: Režim spuštění služby Windows Search byl změněn z automatické spouštění na Zakázáno.
Record Number: 1024
Source Name: Service Control Manager
Time Written: 20130829115628.109874-000
Event Type: Informace
User: Pavilon\Administrator
Computer Name: WIN-SQRSSINIRE7
Event Code: 1014
Message: Překlad názvu ctldl.windowsupdate.com nebyl v požadované době dokončen. Žádný z nakonfigurovaných serverů DNS neodpověděl.
Record Number: 1023
Source Name: Microsoft-Windows-DNS-Client
Time Written: 20130829115614.952930-000
Event Type: Upozornění
User: NT AUTHORITY\NETWORK SERVICE
Computer Name: WIN-SQRSSINIRE7
Event Code: 104
Message: Byl vymazán soubor protokolu Setup.
Record Number: 1022
Source Name: Microsoft-Windows-Eventlog
Time Written: 20130829115614.406031-000
Event Type: Informace
User: Pavilon\Administrator
Computer Name: WIN-SQRSSINIRE7
Event Code: 104
Message: Byl vymazán soubor protokolu Application.
Record Number: 1021
Source Name: Microsoft-Windows-Eventlog
Time Written: 20130829115614.234155-000
Event Type: Informace
User: Pavilon\Administrator
Computer Name: WIN-SQRSSINIRE7
Event Code: 104
Message: Byl vymazán soubor protokolu System.
Record Number: 1020
Source Name: Microsoft-Windows-Eventlog
Time Written: 20130829115614.140389-000
Event Type: Informace
User: Pavilon\Administrator
=====Application event log=====
Computer Name: WIN-SQRSSINIRE7
Event Code: 1066
Message: Inicializační stav pro objekty služby
C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000
Record Number: 947
Source Name: Microsoft-Windows-Security-SPP
Time Written: 20130829115628.000000-000
Event Type: Informace
User:
Computer Name: WIN-SQRSSINIRE7
Event Code: 1003
Message: Služba Windows Search byla spuštěna.
Record Number: 946
Source Name: Microsoft-Windows-Search
Time Written: 20130829115619.000000-000
Event Type: Informace
User:
Computer Name: WIN-SQRSSINIRE7
Event Code: 326
Message: SearchIndexer (2128) Windows: Databázový stroj připojil databázi (1, C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb). (Čas=0 s)
Sekvence interního načasování: [1] 0.000, [2] 0.031, [3] 0.000, [4] 0.000, [5] 0.032, [6] 0.000, [7] 0.000, [8] 0.000, [9] 0.000, [10] 0.000, [11] 0.000, [12] 0.000.
Uložená mezipaměť: 1
Record Number: 945
Source Name: ESENT
Time Written: 20130829115618.000000-000
Event Type: Informace
User:
Computer Name: WIN-SQRSSINIRE7
Event Code: 105
Message: SearchIndexer (2128) Windows: Databázový stroj spustil novou instanci (0). (Čas=0 s)
Sekvence interního načasování: [1] 0.000, [2] 0.000, [3] 0.156, [4] 0.031, [5] 0.000, [6] 0.000, [7] 0.000, [8] 0.000, [9] 0.000, [10] 0.000.
Record Number: 944
Source Name: ESENT
Time Written: 20130829115618.000000-000
Event Type: Informace
User:
Computer Name: WIN-SQRSSINIRE7
Event Code: 102
Message: SearchIndexer (2128) Windows: Databázový stroj (6.02.9200.0000) spouští novou instanci (0).
Record Number: 943
Source Name: ESENT
Time Written: 20130829115618.000000-000
Event Type: Informace
User:
=====Security event log=====
Computer Name: Pavilon
Event Code: 4907
Message: Nastavení auditu objektu se změnila.
Předmět:
ID zabezpečení: S-1-5-21-3827288190-3897321577-2940346249-1001
Název účtu: Jaroslava
Doména účtu: Pavilon
ID přihlášení: 0x362DA1A
Objekt:
Server objektu: Security
Typ objektu: File
Název objektu: C:\$Windows.~BT\Sources\SafeOS\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_6.3.9600.16384_none_2c5177c069a919dd\API-MS-Win-Core-Kernel32-Private-L1-1-0.dll
ID popisovače: 0xa44
Informace o procesu:
ID procesu: 0x1ee8
Název procesu: C:\$Windows.~BT\Sources\SetupHost.exe
Nastavení auditu:
Původní popisovač zabezpečení:
Nový popisovač zabezpečení: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
Record Number: 28245
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20140609152945.036210-000
Event Type: Úspěšný audit
User:
Computer Name: Pavilon
Event Code: 4907
Message: Nastavení auditu objektu se změnila.
Předmět:
ID zabezpečení: S-1-5-21-3827288190-3897321577-2940346249-1001
Název účtu: Jaroslava
Doména účtu: Pavilon
ID přihlášení: 0x362DA1A
Objekt:
Server objektu: Security
Typ objektu: File
Název objektu: C:\$Windows.~BT\Sources\SafeOS\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_6.3.9600.16384_none_2c5177c069a919dd\api-ms-win-core-kernel32-legacy-l1-1-0.dll
ID popisovače: 0xa18
Informace o procesu:
ID procesu: 0x1ee8
Název procesu: C:\$Windows.~BT\Sources\SetupHost.exe
Nastavení auditu:
Původní popisovač zabezpečení:
Nový popisovač zabezpečení: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
Record Number: 28244
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20140609152944.973705-000
Event Type: Úspěšný audit
User:
Computer Name: Pavilon
Event Code: 4907
Message: Nastavení auditu objektu se změnila.
Předmět:
ID zabezpečení: S-1-5-21-3827288190-3897321577-2940346249-1001
Název účtu: Jaroslava
Doména účtu: Pavilon
ID přihlášení: 0x362DA1A
Objekt:
Server objektu: Security
Typ objektu: File
Název objektu: C:\$Windows.~BT\Sources\SafeOS\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_6.3.9600.16384_none_2c5177c069a919dd\api-ms-win-core-kernel32-legacy-l1-1-1.dll
ID popisovače: 0xa14
Informace o procesu:
ID procesu: 0x1ee8
Název procesu: C:\$Windows.~BT\Sources\SetupHost.exe
Nastavení auditu:
Původní popisovač zabezpečení:
Nový popisovač zabezpečení: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
Record Number: 28243
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20140609152944.958078-000
Event Type: Úspěšný audit
User:
Computer Name: Pavilon
Event Code: 4907
Message: Nastavení auditu objektu se změnila.
Předmět:
ID zabezpečení: S-1-5-21-3827288190-3897321577-2940346249-1001
Název účtu: Jaroslava
Doména účtu: Pavilon
ID přihlášení: 0x362DA1A
Objekt:
Server objektu: Security
Typ objektu: File
Název objektu: C:\$Windows.~BT\Sources\SafeOS\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_6.3.9600.16384_none_b8233abb5511544f\api-ms-win-core-io-l1-1-1.dll
ID popisovače: 0xa2c
Informace o procesu:
ID procesu: 0x1ee8
Název procesu: C:\$Windows.~BT\Sources\SetupHost.exe
Nastavení auditu:
Původní popisovač zabezpečení:
Nový popisovač zabezpečení: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
Record Number: 28242
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20140609152944.942456-000
Event Type: Úspěšný audit
User:
Computer Name: Pavilon
Event Code: 4907
Message: Nastavení auditu objektu se změnila.
Předmět:
ID zabezpečení: S-1-5-21-3827288190-3897321577-2940346249-1001
Název účtu: Jaroslava
Doména účtu: Pavilon
ID přihlášení: 0x362DA1A
Objekt:
Server objektu: Security
Typ objektu: File
Název objektu: C:\$Windows.~BT\Sources\SafeOS\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_6.3.9600.16384_none_b8233abb5511544f\api-ms-win-core-interlocked-l1-1-0.dll
ID popisovače: 0xa28
Informace o procesu:
ID procesu: 0x1ee8
Název procesu: C:\$Windows.~BT\Sources\SetupHost.exe
Nastavení auditu:
Původní popisovač zabezpečení:
Nový popisovač zabezpečení: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
Record Number: 28241
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20140609152944.926829-000
Event Type: Úspěšný audit
User:
======Environment variables======
"FP_NO_HOST_CHECK"=NO
"USERNAME"=SYSTEM
"Path"=C:\ProgramData\Oracle\Java\javapath;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Program Files (x86)\Intel\iCLS Client\;C:\Program Files\Intel\iCLS Client\;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\Windows Live\Shared;C:\Program Files (x86)\Intel\OpenCL SDK\3.0\bin\x86;C:\Program Files (x86)\Intel\OpenCL SDK\3.0\bin\x64;C:\Program Files\Intel\Intel(R) Management Engine Components\DAL;C:\Program Files\Intel\Intel(R) Management Engine Components\IPT;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT
"ComSpec"=%SystemRoot%\system32\cmd.exe
"TMP"=%SystemRoot%\TEMP
"OS"=Windows_NT
"windir"=%SystemRoot%
"PROCESSOR_ARCHITECTURE"=AMD64
"TEMP"=%SystemRoot%\TEMP
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PSModulePath"=%SystemRoot%\system32\WindowsPowerShell\v1.0\Modules\
"NUMBER_OF_PROCESSORS"=2
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=Intel64 Family 6 Model 58 Stepping 9, GenuineIntel
"PROCESSOR_REVISION"=3a09
"OnlineServices"=Online Services
"Platform"=MCD
"PCBRAND"=Pavilion
-----------------EOF-----------------