Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz

prosím o kontolu Logu, Win32/Rootkit.Kryptik.AF trojský kůň

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Odpovědět
Zpráva
Autor
olegunar
Návštěvník
Návštěvník
Příspěvky: 18
Registrován: 21 črc 2008 13:15

prosím o kontolu Logu, Win32/Rootkit.Kryptik.AF trojský kůň

#1 Příspěvek od olegunar »

Zdravím, prosím o kontrolu logu, včera večer, při návštěvě jednoho webu, který jsem v podstatě již dříve navštívil bez problémů několikrát, mi rezidentní štít Eset smart security začal detekovat napadení počítače viry. Současně se i v tray oblasti zobrazila hláška s požadavkem na update Javy. Možná je to všechno jen náhoda, ale je možné, že to všechno spolu souvisí.



Počítač se prozatím chová zcela korektně, přesto jsem tedy začal pátrat, kde je problém, ale Spybot - Search & Destroy nedetekuje nic, SUPERAntiSpyware Free Edition taky nic.

Přikládám tedy log z RSIT a proím o pomoc při řešení mých problémů.


Logfile of random's system information tool 1.06 (written by random/random)
Run by Pavel at 2010-02-18 09:34:22
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 42 GB (28%) free of 146 GB
Total RAM: 2046 MB (45% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:34:34, on 18.2.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
C:\WINDOWS\system32\IPSSVC.EXE
C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files\ThinkPad\Utilities\DOZESVC.EXE
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Autodesk\3ds Max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe
C:\Program Files\Autodesk\VIZ2008\mentalray\satellite\raysat_VIZ2008_32server.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
C:\WINDOWS\system32\TpKmpSVC.exe
C:\Program Files\Lenovo\Client Security Solution\tvttcsd.exe
C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe
C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
c:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exe
C:\Program Files\Autodesk\3ds Max 2009\vrayspawner2009.exe
C:\Program Files\Autodesk\3ds Max 2009\3dsmax.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\TEMP\AdskCleanup.0001
C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE
c:\program files\lenovo\system update\suservice.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Lenovo\Logger\logmon.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Lenovo\NPDIRECT\TPFNF7SP.exe
C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\WINDOWS\system32\TpShocks.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Lenovo\AwayTask\AwaySch.EXE
C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
C:\PROGRA~1\THINKV~1\PrdCtr\LPMGR.exe
C:\Program Files\Lenovo\Zoom\TpScrex.exe
C:\PROGRA~1\THINKV~1\AMSG\Amsg.exe
C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
C:\Program Files\Lenovo\Client Security Solution\cssauth.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Lenovo\HOTKEY\TPFNF6R.exe
C:\PROGRA~1\THINKV~1\PrdCtr\LPMLCHK.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\RocketDock\RocketDock.exe
C:\Documents and Settings\Pavel\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Lenovo\Client Security Solution\tvtpwm_tray.exe
C:\Program Files\Common Files\Autodesk Shared\WSCommCntr1.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\system32\SearchFilterHost.exe
C:\Documents and Settings\Pavel\Plocha\RSIT.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\HiJackThis\Pavel.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\TRANSLAT\WEBIE.DLL
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: ThinkVantage Password Manager - {F040E541-A427-4CF7-85D8-75E3E0F476C5} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\TRANSLAT\WEBIE.DLL
O3 - Toolbar: Lenovo ThinkVantage Toolbox - {86B9B5DD-FB75-4035-BD52-3C94F7849CAF} - C:\Program Files\PC-Doctor\ATLPcdToolbar544928.dll
O4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog
O4 - HKLM\..\Run: [TPFNF7] C:\PROGRA~1\Lenovo\NPDIRECT\TPFNF7SP.exe /r
O4 - HKLM\..\Run: [TPHOTKEY] C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [TVT Scheduler Proxy] C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [AwaySch] C:\Program Files\Lenovo\AwayTask\AwaySch.EXE
O4 - HKLM\..\Run: [LPManager] C:\PROGRA~1\THINKV~1\PrdCtr\LPMGR.exe
O4 - HKLM\..\Run: [AMSG] C:\PROGRA~1\THINKV~1\AMSG\Amsg.exe /startup
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [ACTray] C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
O4 - HKLM\..\Run: [ACWLIcon] C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
O4 - HKLM\..\Run: [cssauth] "C:\Program Files\Lenovo\Client Security Solution\cssauth.exe" silent
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [LENOVO.TPFNF6R] C:\Program Files\Lenovo\HOTKEY\TPFNF6R.exe
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [LPMailChecker] C:\PROGRA~1\THINKV~1\PrdCtr\LPMLCHK.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Pavel\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: monnid32.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Akcelerátor spuštění AutoCADu.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart17.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {0045D4BC-5189-4b67-969C-83BB1906C421} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll
O9 - Extra 'Tools' menuitem: ThinkVantage Password Manager... - {0045D4BC-5189-4b67-969C-83BB1906C421} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\TRANSLAT\WEBIE.DLL
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\TRANSLAT\WEBIE.DLL
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\TRANSLAT\WEBIE.DLL
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\TRANSLAT\WEBIE.DLL
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\TRANSLAT\WEBIE.DLL
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\TRANSLAT\WEBIE.DLL
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\TRANSLAT\WEBIE.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos-be ... canner.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: ACNotify - ACNotify.dll (file missing)
O23 - Service: Ac Profile Manager Service (AcPrfMgrSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
O23 - Service: Access Connections Main Service (AcSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: Lenovo Doze Mode Service (DozeSvc) - Lenovo. - C:\Program Files\ThinkPad\Utilities\DOZESVC.EXE
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Služba Google Update (gupdate1ca315e9abd1410) (gupdate1ca315e9abd1410) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Lenovo - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: IPS Core Service (IPSSVC) - Lenovo Group Limited - C:\WINDOWS\system32\IPSSVC.EXE
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lenovo Microphone Mute (LENOVO.MICMUTE) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe
O23 - Service: mental ray 3.6 Satellite for Autodesk 3ds Max Design 2009 32-bit 32-bit (mi-raysat_3dsMax2009_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe
O23 - Service: mental ray 3.5 Satellite for Autodesk VIZ 2008 (mi-raysat_VIZ2008_32) - Unknown owner - C:\Program Files\Autodesk\VIZ2008\mentalray\satellite\raysat_VIZ2008_32server.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Power Manager DBC Service - Unknown owner - C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: System Update (SUService) - Lenovo Group Limited - c:\program files\lenovo\system update\suservice.exe
O23 - Service: ThinkVantage Registry Monitor Service - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINDOWS\System32\TPHDEXLG.exe
O23 - Service: On Screen Display (TPHKSVC) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe
O23 - Service: TSS Core Service (TSSCoreService) - IBM - C:\Program Files\Lenovo\Client Security Solution\tvttcsd.exe
O23 - Service: TVT Backup Protection Service - Unknown owner - C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe
O23 - Service: TVT Backup Service - Lenovo Group Limited - C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
O23 - Service: TVT Scheduler - Lenovo Group Limited - c:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
O23 - Service: tvtnetwk - Unknown owner - C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exe
O23 - Service: VRaySpawner 2009 - Unknown owner - C:\Program Files\Autodesk\3ds Max 2009\vrayspawner2009.exe

--
End of file - 17470 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Check Updates for Windows Live Toolbar.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\PCDoctorBackgroundMonitorTask.job
C:\WINDOWS\tasks\PMTask.job
C:\WINDOWS\tasks\SystemToolsDailyTest.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2005-09-24 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2DB66063-BB98-466A-AA0D-3E7ACF5ED853}]
WebTransBHO Class - C:\TRANSLAT\WEBIE.DLL [2008-04-10 360448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5CA3D70E-1895-11CF-8E15-001234567890}]
DriveLetterAccess - C:\WINDOWS\System32\DLA\DLASHX_W.DLL [2006-02-02 110652]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}]
Windows Live Toolbar Helper - C:\Program Files\Windows Live Toolbar\msntb.dll [2007-02-12 546672]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-01-11 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-01-11 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F040E541-A427-4CF7-85D8-75E3E0F476C5}]
CPwmIEBrowserHelper Object - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll [2007-08-03 795960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - Windows Live Toolbar - C:\Program Files\Windows Live Toolbar\msntb.dll [2007-02-12 546672]
{BFC32E1D-EE75-4A48-BC60-104E11EE2431} - WebTranslator - C:\TRANSLAT\WEBIE.DLL [2008-04-10 360448]
{86B9B5DD-FB75-4035-BD52-3C94F7849CAF} - Lenovo ThinkVantage Toolbox - C:\Program Files\PC-Doctor\ATLPcdToolbar544928.dll [2009-11-22 137712]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"PWRMGRTR"=rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor []
"BLOG"=rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog []
"TPFNF7"=C:\PROGRA~1\Lenovo\NPDIRECT\TPFNF7SP.exe [2009-08-03 62240]
"TPHOTKEY"=C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe [2009-03-13 68976]
"Apoint"=C:\Program Files\Apoint2K\Apoint.exe [2009-09-09 176128]
"TpShocks"=C:\WINDOWS\system32\TpShocks.exe [2009-12-11 337256]
"EZEJMNAP"=C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe [2008-10-08 256576]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2009-01-14 13549568]
"nwiz"=nwiz.exe /installquiet /keeploaded /nodetect []
"TVT Scheduler Proxy"=C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe [2008-03-04 487424]
"DLA"=C:\WINDOWS\System32\DLA\DLACTRLW.EXE [2006-02-02 122940]
"ISUSPM Startup"=C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe [2004-07-27 221184]
"ISUSScheduler"=C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe [2004-07-27 81920]
"AwaySch"=C:\Program Files\Lenovo\AwayTask\AwaySch.EXE [2006-11-07 91688]
"LPManager"=C:\PROGRA~1\THINKV~1\PrdCtr\LPMGR.exe [2009-07-23 185688]
"AMSG"=C:\PROGRA~1\THINKV~1\AMSG\Amsg.exe [2009-09-03 436800]
"DiskeeperSystray"=C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe [2006-05-18 196696]
"ACTray"=C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe [2009-12-10 431464]
"ACWLIcon"=C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe [2009-12-10 181608]
"cssauth"=C:\Program Files\Lenovo\Client Security Solution\cssauth.exe [2007-08-03 2630968]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2007-02-16 282624]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2009-02-06 2021400]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-01-11 246504]
"SoundMAXPnP"=C:\Program Files\Analog Devices\Core\smax4pnp.exe [2008-04-24 1036288]
"LENOVO.TPFNF6R"=C:\Program Files\Lenovo\HOTKEY\TPFNF6R.exe [2009-08-20 62752]
"TPKMAPHELPER"=C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe [2007-01-09 868352]
"LPMailChecker"=C:\PROGRA~1\THINKV~1\PrdCtr\LPMLCHK.exe [2009-07-23 124248]
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2009-01-15 86016]
""= []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"=C:\Program Files\RocketDock\RocketDock.exe [2007-09-02 495616]
"Google Update"=C:\Documents and Settings\Pavel\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe [2009-11-03 135664]
"WEBTRAN"= []
"OEXPRESS"= []
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2007-01-05 204288]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
Akcelerátor spuštění AutoCADu.lnk - C:\Program Files\Common Files\Autodesk Shared\acstart17.exe
Bluetooth.lnk - C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe
Windows Search.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe

C:\Documents and Settings\Pavel\Nabídka Start\Programy\Po spuštění
monnid32.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [2007-04-19 294912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ACNotify]
C:\Program Files\ThinkPad\ConnectUtilities\ACNotify.dll [2009-12-10 32768]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\psfus]
C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll [2009-12-01 100104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\tpfnf2]
C:\Program Files\Lenovo\HOTKEY\notifyf2.dll [2006-09-06 34344]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 77824]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"=C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2009-05-24 304128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"notification packages"=scecli
C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll
ACGina

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDrives"=0
"NoDriveAutoRun"=67108863

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\QIP\qip.exe"="C:\Program Files\QIP\qip.exe:*:Enabled:Quiet Internet Pager"
"C:\Program Files\ICQ6\ICQ.exe"="C:\Program Files\ICQ6\ICQ.exe:*:Enabled:ICQ6"
"C:\Program Files\Autodesk\Backburner\monitor.exe"="C:\Program Files\Autodesk\Backburner\monitor.exe:*:Enabled:backburner 2.3 monitor"
"C:\Program Files\Autodesk\Backburner\manager.exe"="C:\Program Files\Autodesk\Backburner\manager.exe:*:Enabled:backburner 2.3 manager"
"C:\Program Files\Autodesk\Backburner\server.exe"="C:\Program Files\Autodesk\Backburner\server.exe:*:Enabled:backburner 2.3 server"
"C:\Program Files\Autodesk\VIZ2008\3dsviz.exe"="C:\Program Files\Autodesk\VIZ2008\3dsviz.exe:*:Enabled:Autodesk VIZ 2008"
"C:\Program Files\Autodesk\3ds Max 2009\3dsmax.exe"="C:\Program Files\Autodesk\3ds Max 2009\3dsmax.exe:*:Enabled:Autodesk 3ds Max Design 2009 32-bit"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\Electronic Arts\Burnout(TM) Paradise The Ultimate Box\BurnoutLauncher.exe"="C:\Program Files\Electronic Arts\Burnout(TM) Paradise The Ultimate Box\BurnoutLauncher.exe:*:Enabled:Burnout(TM) Paradise The Ultimate Box"
"C:\Program Files\Electronic Arts\Burnout(TM) Paradise The Ultimate Box\BurnoutConfigTool.exe"="C:\Program Files\Electronic Arts\Burnout(TM) Paradise The Ultimate Box\BurnoutConfigTool.exe:*:Enabled:Burnout(TM) Paradise The Ultimate Box"
"C:\Program Files\Electronic Arts\Burnout(TM) Paradise The Ultimate Box\BurnoutParadise.exe"="C:\Program Files\Electronic Arts\Burnout(TM) Paradise The Ultimate Box\BurnoutParadise.exe:*:Enabled:Burnout(TM) Paradise The Ultimate Box"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
shell\AutoRun\command - E:\HPLauncher.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{16db0de6-dd89-11de-bf4a-001f3b274d93}]
shell\AutoRun\command - E:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1863ee7e-f8d6-11dd-be50-001f3b274d93}]
shell\AutoRun\command - E:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8f5233a5-f075-11de-9a7f-001e4cd9b1a0}]
shell\AutoRun\command - E:\HPLauncher.exe


======File associations======

.scr - open - "C:\WINDOWS\system32\NOTEPAD.EXE" "%1"
.scr - install -
.scr - config -

======List of files/folders created in the last 1 months======

2010-02-18 09:34:22 ----D---- C:\rsit
2010-02-10 17:29:39 ----HDC---- C:\WINDOWS\$NtUninstallKB978262$
2010-02-10 17:29:28 ----HDC---- C:\WINDOWS\$NtUninstallKB971468$
2010-02-10 17:27:05 ----HDC---- C:\WINDOWS\$NtUninstallKB978037$
2010-02-10 17:26:58 ----HDC---- C:\WINDOWS\$NtUninstallKB975713$
2010-02-10 17:26:49 ----HDC---- C:\WINDOWS\$NtUninstallKB978251$
2010-02-10 17:26:42 ----HDC---- C:\WINDOWS\$NtUninstallKB975560$
2010-02-10 17:26:30 ----HDC---- C:\WINDOWS\$NtUninstallKB977914$
2010-02-10 17:26:18 ----HDC---- C:\WINDOWS\$NtUninstallKB978706$
2010-02-10 17:26:03 ----HDC---- C:\WINDOWS\$NtUninstallKB977165$
2010-02-09 17:15:37 ----D---- C:\Program Files\Common Files\SPBA
2010-02-03 18:09:42 ----A---- C:\WINDOWS\Burnout(TM) Paradise The Ultimate Box Patch Log.txt
2010-02-03 18:07:02 ----D---- C:\Documents and Settings\All Users\Data aplikací\Electronic Arts
2010-02-03 17:53:38 ----D---- C:\Program Files\Electronic Arts
2010-02-03 17:53:32 ----A---- C:\WINDOWS\system32\d3dx10_40.dll
2010-02-03 17:53:32 ----A---- C:\WINDOWS\system32\D3DCompiler_40.dll
2010-02-03 17:53:31 ----A---- C:\WINDOWS\system32\D3DX9_40.dll
2010-02-03 17:53:29 ----A---- C:\WINDOWS\system32\XAudio2_3.dll
2010-02-03 17:53:29 ----A---- C:\WINDOWS\system32\XAPOFX1_2.dll
2010-02-03 17:53:28 ----A---- C:\WINDOWS\system32\xactengine3_3.dll
2010-02-03 17:53:26 ----A---- C:\WINDOWS\system32\X3DAudio1_5.dll
2010-02-03 17:53:25 ----A---- C:\WINDOWS\system32\XAudio2_2.dll
2010-02-03 17:53:25 ----A---- C:\WINDOWS\system32\XAPOFX1_1.dll
2010-02-03 17:53:23 ----A---- C:\WINDOWS\system32\xactengine3_2.dll
2010-02-03 17:53:22 ----A---- C:\WINDOWS\system32\d3dx10_39.dll
2010-02-03 17:53:22 ----A---- C:\WINDOWS\system32\D3DCompiler_39.dll
2010-02-03 17:53:20 ----A---- C:\WINDOWS\system32\D3DX9_39.dll
2010-02-03 17:53:19 ----A---- C:\WINDOWS\system32\XAudio2_1.dll
2010-02-03 17:53:19 ----A---- C:\WINDOWS\system32\XAPOFX1_0.dll
2010-02-03 17:53:17 ----A---- C:\WINDOWS\system32\xactengine3_1.dll
2010-02-03 17:53:16 ----A---- C:\WINDOWS\system32\X3DAudio1_4.dll
2010-02-03 17:53:15 ----A---- C:\WINDOWS\system32\d3dx10_38.dll
2010-02-03 17:53:15 ----A---- C:\WINDOWS\system32\D3DCompiler_38.dll
2010-02-03 17:53:13 ----A---- C:\WINDOWS\system32\D3DX9_38.dll
2010-02-03 17:53:12 ----A---- C:\WINDOWS\system32\XAudio2_0.dll
2010-02-03 17:53:10 ----A---- C:\WINDOWS\system32\xactengine3_0.dll
2010-02-03 17:53:09 ----A---- C:\WINDOWS\system32\X3DAudio1_3.dll
2010-02-03 17:53:08 ----A---- C:\WINDOWS\system32\d3dx10_37.dll
2010-02-03 17:53:08 ----A---- C:\WINDOWS\system32\D3DCompiler_37.dll
2010-02-03 17:53:06 ----A---- C:\WINDOWS\system32\D3DX9_37.dll
2010-02-03 17:53:05 ----A---- C:\WINDOWS\system32\xactengine2_10.dll
2010-02-03 17:53:02 ----A---- C:\WINDOWS\system32\d3dx10_36.dll
2010-02-03 17:53:02 ----A---- C:\WINDOWS\system32\D3DCompiler_36.dll
2010-02-03 17:53:01 ----A---- C:\WINDOWS\system32\d3dx9_36.dll
2010-02-03 17:52:59 ----A---- C:\WINDOWS\system32\xactengine2_9.dll
2010-02-03 17:52:58 ----A---- C:\WINDOWS\system32\d3dx10_35.dll
2010-02-03 17:52:58 ----A---- C:\WINDOWS\system32\D3DCompiler_35.dll
2010-02-03 17:52:57 ----A---- C:\WINDOWS\system32\d3dx9_35.dll
2010-02-03 17:52:55 ----A---- C:\WINDOWS\system32\xactengine2_8.dll
2010-02-03 17:52:55 ----A---- C:\WINDOWS\system32\X3DAudio1_2.dll
2010-02-03 17:52:48 ----A---- C:\WINDOWS\system32\xinput1_3.dll
2010-02-03 17:52:46 ----A---- C:\WINDOWS\system32\xactengine2_7.dll
2010-02-03 17:52:43 ----A---- C:\WINDOWS\system32\d3dx10_33.dll
2010-02-03 17:52:43 ----A---- C:\WINDOWS\system32\D3DCompiler_33.dll
2010-02-03 17:52:39 ----A---- C:\WINDOWS\system32\d3dx9_33.dll
2010-02-03 17:52:38 ----A---- C:\WINDOWS\system32\xactengine2_6.dll
2010-02-03 17:52:38 ----A---- C:\WINDOWS\system32\xactengine2_5.dll
2010-02-03 17:52:37 ----A---- C:\WINDOWS\system32\xactengine2_4.dll
2010-02-03 17:52:37 ----A---- C:\WINDOWS\system32\x3daudio1_1.dll
2010-02-03 17:52:36 ----A---- C:\WINDOWS\system32\xinput1_2.dll
2010-02-03 17:52:36 ----A---- C:\WINDOWS\system32\xactengine2_3.dll
2010-02-03 17:52:36 ----A---- C:\WINDOWS\system32\xactengine2_2.dll
2010-02-03 17:52:35 ----A---- C:\WINDOWS\system32\xinput1_1.dll
2010-02-03 17:52:35 ----A---- C:\WINDOWS\system32\xactengine2_1.dll
2010-02-03 17:52:24 ----A---- C:\WINDOWS\system32\xactengine2_0.dll
2010-02-03 17:52:24 ----A---- C:\WINDOWS\system32\x3daudio1_0.dll
2010-02-03 17:52:24 ----A---- C:\WINDOWS\system32\d3dx9_30.dll
2010-02-03 17:52:23 ----A---- C:\WINDOWS\system32\xinput9_1_0.dll
2010-02-03 17:52:23 ----A---- C:\WINDOWS\system32\d3dx9_29.dll
2010-02-03 17:52:23 ----A---- C:\WINDOWS\system32\d3dx9_28.dll
2010-02-03 17:52:21 ----A---- C:\WINDOWS\system32\d3dx9_25.dll
2010-02-03 17:52:19 ----A---- C:\WINDOWS\system32\d3dx9_24.dll
2010-02-03 17:52:03 ----D---- C:\WINDOWS\Logs
2010-02-01 15:04:54 ----D---- C:\Documents and Settings\All Users\Data aplikací\Sun
2010-02-01 15:04:32 ----A---- C:\WINDOWS\system32\javaws.exe
2010-02-01 15:04:32 ----A---- C:\WINDOWS\system32\javaw.exe
2010-02-01 15:04:32 ----A---- C:\WINDOWS\system32\java.exe
2010-02-01 15:00:15 ----D---- C:\Documents and Settings\All Users\Data aplikací\NOS
2010-01-22 00:40:23 ----A---- C:\WINDOWS\imsins.BAK

======List of files/folders modified in the last 1 months======

2010-02-18 09:34:29 ----D---- C:\Program Files\HiJackThis
2010-02-18 09:33:44 ----D---- C:\WINDOWS\temp
2010-02-18 09:01:37 ----D---- C:\WINDOWS
2010-02-18 09:01:37 ----A---- C:\WINDOWS\TRNCOM.INI
2010-02-18 07:19:20 ----A---- C:\vraylog.txt
2010-02-18 07:16:01 ----A---- C:\WINDOWS\system32\PROCDB.INI
2010-02-18 07:15:33 ----AD---- C:\WINDOWS\system32
2010-02-18 07:15:33 ----A---- C:\WINDOWS\system32\IPSCtrl.INI
2010-02-18 07:14:29 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-02-18 07:06:18 ----D---- C:\WINDOWS\system32\CatRoot2
2010-02-17 22:13:42 ----D---- C:\WINDOWS\Prefetch
2010-02-17 18:14:14 ----D---- C:\WINDOWS\system32\drivers
2010-02-17 18:14:14 ----ASHD---- C:\WINDOWS\system32\dllcache
2010-02-17 18:13:44 ----SD---- C:\ComboFix
2010-02-17 16:00:01 ----SHD---- C:\WINDOWS\Installer
2010-02-17 15:59:11 ----SD---- C:\Documents and Settings\Pavel\Data aplikací\Microsoft
2010-02-16 21:02:03 ----A---- C:\WINDOWS\WDICT32.INI
2010-02-16 20:58:23 ----A---- C:\WINDOWS\WTRAN32.INI
2010-02-14 14:49:00 ----D---- C:\SWSHARE
2010-02-10 17:57:10 ----HD---- C:\WINDOWS\inf
2010-02-10 17:29:38 ----HD---- C:\WINDOWS\$hf_mig$
2010-02-10 17:27:26 ----D---- C:\WINDOWS\Debug
2010-02-10 15:10:36 ----D---- C:\WINDOWS\system32\CatRoot
2010-02-09 17:19:36 ----RSD---- C:\WINDOWS\assembly
2010-02-09 17:19:21 ----SD---- C:\WINDOWS\Tasks
2010-02-09 17:19:05 ----D---- C:\WINDOWS\Media
2010-02-09 17:16:24 ----D---- C:\Program Files\ThinkVantage Fingerprint Software
2010-02-09 17:16:24 ----D---- C:\Program Files\Common Files
2010-02-09 17:15:48 ----D---- C:\WINDOWS\system32\ReinstallBackups
2010-02-09 17:14:28 ----D---- C:\Documents and Settings\All Users\Data aplikací\UIB
2010-02-07 15:32:21 ----D---- C:\Program Files\Google
2010-02-03 18:02:40 ----SD---- C:\Documents and Settings\All Users\Data aplikací\Microsoft
2010-02-03 17:53:38 ----D---- C:\WINDOWS\system32\DirectX
2010-02-03 17:53:38 ----D---- C:\Program Files
2010-02-01 20:26:20 ----A---- C:\WINDOWS\system32\MRT.exe
2010-02-01 15:04:53 ----D---- C:\Program Files\Common Files\Java
2010-02-01 15:04:29 ----D---- C:\Program Files\Java
2010-01-28 22:30:39 ----HD---- C:\Program Files\InstallShield Installation Information
2010-01-26 23:12:18 ----D---- C:\Program Files\Mozilla Firefox
2010-01-25 20:29:26 ----A---- C:\WINDOWS\MAILTRAN.INI
2010-01-22 00:59:33 ----D---- C:\Program Files\Internet Explorer
2010-01-22 00:40:01 ----D---- C:\WINDOWS\ie8updates
2010-01-21 16:54:39 ----D---- C:\Program Files\CCleaner
2010-01-21 11:53:56 ----D---- C:\Program Files\FMA 2

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 ANC;ANC; C:\WINDOWS\System32\drivers\ANC.SYS [2009-11-17 11520]
R1 DLACDBHM;DLACDBHM; C:\WINDOWS\System32\Drivers\DLACDBHM.SYS [2005-11-18 5660]
R1 DLARTL_N;DLARTL_N; C:\WINDOWS\System32\Drivers\DLARTL_N.SYS [2005-11-18 22684]
R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2009-02-06 106208]
R1 epfwtdi;epfwtdi; C:\WINDOWS\system32\DRIVERS\epfwtdi.sys [2009-02-06 56280]
R1 IBMTPCHK;IBMTPCHK; \??\C:\WINDOWS\system32\Drivers\IBMBLDID.sys []
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 SASDIFSV;SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS []
R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys []
R1 TPHKDRV;TPHKDRV; C:\WINDOWS\system32\DRIVERS\TPHKDRV.sys [2008-05-12 17844]
R1 TPPWRIF;TPPWRIF; C:\WINDOWS\System32\drivers\Tppwrif.sys [2009-12-16 4442]
R1 TSMAPIP;TSMAPIP; C:\WINDOWS\System32\drivers\TSMAPIP.SYS [2009-08-03 4608]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-13 8832]
R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.7.4.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2008-03-08 21393]
R2 DLABOIOM;DLABOIOM; C:\WINDOWS\System32\DLA\DLABOIOM.SYS [2006-02-02 25628]
R2 DLADResN;DLADResN; C:\WINDOWS\System32\DLA\DLADResN.SYS [2006-02-02 2496]
R2 DLAIFS_M;DLAIFS_M; C:\WINDOWS\System32\DLA\DLAIFS_M.SYS [2006-02-02 86652]
R2 DLAOPIOM;DLAOPIOM; C:\WINDOWS\System32\DLA\DLAOPIOM.SYS [2006-02-02 14684]
R2 DLAPoolM;DLAPoolM; C:\WINDOWS\System32\DLA\DLAPoolM.SYS [2006-02-02 6364]
R2 DLAUDF_M;DLAUDF_M; C:\WINDOWS\System32\DLA\DLAUDF_M.SYS [2006-02-02 87036]
R2 DLAUDFAM;DLAUDFAM; C:\WINDOWS\System32\DLA\DLAUDFAM.SYS [2006-02-02 94332]
R2 DRVNDDM;DRVNDDM; C:\WINDOWS\System32\Drivers\DRVNDDM.SYS [2005-11-18 40544]
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2009-02-06 113448]
R2 epfw;epfw; C:\WINDOWS\system32\DRIVERS\epfw.sys [2009-02-06 130952]
R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2006-06-19 12672]
R2 pmem;pmem; \??\C:\WINDOWS\System32\drivers\pmemnt.sys []
R2 PROCDD;IPS Helper Driver; C:\WINDOWS\system32\DRIVERS\PROCDD.SYS [2006-11-06 12080]
R2 rimmptsk;rimmptsk; C:\WINDOWS\system32\DRIVERS\rimmptsk.sys [2008-02-15 46592]
R2 rimsptsk;rimsptsk; C:\WINDOWS\system32\DRIVERS\rimsptsk.sys [2007-07-30 43008]
R2 rismxdp;Ricoh xD-Picture Card Driver; C:\WINDOWS\system32\DRIVERS\rixdptsk.sys [2007-07-30 38400]
R2 s24trans;WLAN Transport; C:\WINDOWS\system32\DRIVERS\s24trans.sys [2007-03-29 12416]
R2 smihlp2;SMI Helper Driver (smihlp2); \??\C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys []
R2 tvtfilter;tvtfilter; C:\WINDOWS\system32\DRIVERS\tvtfilter.sys [2009-11-28 33536]
R2 WIBUKEY;WIBU-KEY Kernel Driver; C:\WINDOWS\SYSTEM32\DRIVERS\WibuKey.sys [2006-11-22 72704]
R3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\ADIHdAud.sys [2008-04-24 308736]
R3 AEAudio;AE Audio Service; C:\WINDOWS\system32\drivers\AEAudio.sys [2008-04-24 103424]
R3 ApfiltrService;Alps Pointing-device Filter Driver; C:\WINDOWS\system32\DRIVERS\Apfiltr.sys [2009-09-09 154672]
R3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 atmeltpm;atmeltpm; C:\WINDOWS\system32\DRIVERS\atmeltpm.sys [2005-05-17 15872]
R3 btaudio;Bluetooth Audio Device; C:\WINDOWS\system32\drivers\btaudio.sys [2007-01-24 530861]
R3 BTDriver;Bluetooth Virtual Communications Driver; C:\WINDOWS\system32\DRIVERS\btport.sys [2006-10-09 30459]
R3 BTKRNL;Bluetooth Bus Enumerator; C:\WINDOWS\system32\DRIVERS\btkrnl.sys [2007-02-27 868042]
R3 CmBatt;Microsoft AC Adapter Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-13 13952]
R3 e1express;Intel(R) PRO/1000 PCI Express Network Connection Driver; C:\WINDOWS\system32\DRIVERS\e1e5132.sys [2007-05-11 252312]
R3 Epfwndis;Eset Personal Firewall; C:\WINDOWS\system32\DRIVERS\Epfwndis.sys [2009-02-06 33096]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HSF_DPV;HSF_DPV; C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys [2007-11-01 989696]
R3 HSFHWAZL;HSFHWAZL; C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys [2007-11-01 211456]
R3 IBMPMDRV;IBMPMDRV; C:\WINDOWS\system32\DRIVERS\ibmpmdrv.sys [2009-08-24 24872]
R3 Iviaspi;IVI ASPI Shell; C:\WINDOWS\system32\drivers\iviaspi.sys [2003-09-10 21060]
R3 NETw4x32;Ovladač adaptéru Intel(R) Wireless WiFi Link pro systém Windows XP 32 Bit; C:\WINDOWS\system32\DRIVERS\NETw4x32.sys [2007-04-30 2206976]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-01-14 6620064]
R3 psadd;Lenovo Parties Service Access Device Driver; C:\WINDOWS\system32\DRIVERS\psadd.sys [2007-05-22 21376]
R3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2008-04-13 79232]
R3 TcUsb;TC USB Kernel Driver; C:\WINDOWS\System32\Drivers\tcusb.sys [2008-12-09 50832]
R3 TVTI2C;Lenovo SM bus driver; C:\WINDOWS\system32\DRIVERS\Tvti2c.sys [2007-05-22 30336]
R3 TVTPktFilter;TVT Packet Filter Service; C:\WINDOWS\system32\DRIVERS\tvtpktfilter.sys [2007-02-08 17664]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Ovladač standardního rozbočovače USB; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2008-03-27 503008]
R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys [2007-11-01 731520]
S1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
S3 ac97intc;Služba instalace zvukového ovladače Intel(r) (WDM); C:\WINDOWS\system32\drivers\ac97intc.sys [2001-08-17 96256]
S3 BTWDNDIS;Bluetooth LAN Access Server; C:\WINDOWS\system32\DRIVERS\btwdndis.sys [2006-10-15 149123]
S3 btwhid;btwhid; C:\WINDOWS\system32\DRIVERS\btwhid.sys [2006-11-28 47907]
S3 btwmodem;Bluetooth Fax Modem; C:\WINDOWS\system32\DRIVERS\btwmodem.sys [2006-10-15 30285]
S3 BTWUSB;WIDCOMM USB Bluetooth Driver; C:\WINDOWS\System32\Drivers\btwusb.sys [2007-01-24 67960]
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 E100B;Intel(R) PRO Adapter Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2001-10-24 117760]
S3 GMSIPCI;GMSIPCI; \??\D:\INSTALL\GMSIPCI.SYS []
S3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\WINDOWS\system32\DRIVERS\ewusbmdm.sys [2008-09-26 101376]
S3 ICDUSB;Sony IC Recorder; C:\WINDOWS\System32\Drivers\ICDUSB.sys [2000-08-31 26301]
S3 KMWDFilter;KMWDFilter; \??\C:\WINDOWS\System32\Drivers\KMWDFilter.SYS []
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
S3 PcdrNdisuio;PCDRNDISUIO Usermode I/O Protocol; C:\WINDOWS\system32\DRIVERS\pcdrndisuio.sys []
S3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-03 20992]
S3 SASENUM;SASENUM; \??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS []
S3 sffdisk;Ovladač třídy úložiště SFF; C:\WINDOWS\system32\DRIVERS\sffdisk.sys [2008-04-13 11904]
S3 sffp_sd;Ovladač protokolu úložiště SFF pro paměť sběrnici SDBus; C:\WINDOWS\system32\DRIVERS\sffp_sd.sys [2008-04-13 11008]
S3 UIUSys;Conexant Setup API; C:\WINDOWS\system32\DRIVERS\UIUSYS.SYS []
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 agp440;Filtr Intel sběrnice AGP; C:\WINDOWS\system32\DRIVERS\agp440.sys [2008-04-13 42368]
S4 agpCPQ;Filtr Compaq sběrnice AGP; C:\WINDOWS\system32\DRIVERS\agpCPQ.sys [2008-04-13 44928]
S4 alim1541;Filtr ALI sběrnice AGP; C:\WINDOWS\system32\DRIVERS\alim1541.sys [2008-04-13 42752]
S4 amdagp;Ovladač filtru AMD portu AGP; C:\WINDOWS\system32\DRIVERS\amdagp.sys [2008-04-13 43008]
S4 cbidf;cbidf; C:\WINDOWS\system32\DRIVERS\cbidf2k.sys [2001-08-17 13952]
S4 dwshd;dwshd; C:\WINDOWS\System32\drivers\dwshd.sys []
S4 IntelIde;IntelIde; C:\WINDOWS\system32\DRIVERS\intelide.sys [2008-04-14 5504]
S4 sisagp;Filtr SIS sběrnice AGP ; C:\WINDOWS\system32\DRIVERS\sisagp.sys [2008-04-13 40960]
S4 viaagp;Filtr VIA sběrnice AGP ; C:\WINDOWS\system32\DRIVERS\viaagp.sys [2008-04-13 42240]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AcPrfMgrSvc;Ac Profile Manager Service; C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe [2009-12-10 103784]
R2 AcSvc;Access Connections Main Service; C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe [2009-12-10 230760]
R2 Autodesk Licensing Service;Autodesk Licensing Service; C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe [2009-04-07 79360]
R2 btwdins;Bluetooth Service; C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe [2007-02-27 266295]
R2 C-DillaSrv;C-DillaSrv; C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE [2001-12-12 32256]
R2 Diskeeper;Diskeeper; C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe [2006-05-23 622700]
R2 DozeSvc;Lenovo Doze Mode Service; C:\Program Files\ThinkPad\Utilities\DOZESVC.EXE [2009-12-16 132456]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2009-02-06 727720]
R2 EvtEng;Intel(R) PROSet/Wireless Event Log; C:\Program Files\Intel\Wireless\Bin\EvtEng.exe [2007-04-16 647168]
R2 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
R2 IBMPMSVC;ThinkPad PM Service; C:\WINDOWS\system32\ibmpmsvc.exe [2009-08-24 38176]
R2 IPSSVC;IPS Core Service; C:\WINDOWS\system32\IPSSVC.EXE [2007-01-30 108080]
R2 IviRegMgr;IviRegMgr; C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe [2007-01-04 112152]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-12-17 153376]
R2 mi-raysat_3dsMax2009_32;mental ray 3.6 Satellite for Autodesk 3ds Max Design 2009 32-bit 32-bit; C:\Program Files\Autodesk\3ds Max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe [2008-03-09 65536]
R2 mi-raysat_VIZ2008_32;mental ray 3.5 Satellite for Autodesk VIZ 2008; C:\Program Files\Autodesk\VIZ2008\mentalray\satellite\raysat_VIZ2008_32server.exe [2007-03-07 65536]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2009-01-14 168004]
R2 Power Manager DBC Service;Power Manager DBC Service; C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE [2009-12-16 53248]
R2 RegSrvc;Intel(R) PROSet/Wireless Registry Service; C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe [2007-04-16 327680]
R2 S24EventMonitor;Intel(R) PROSet/Wireless Service; C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe [2007-04-16 983040]
R2 SUService;System Update; c:\program files\lenovo\system update\suservice.exe [2009-06-12 28672]
R2 ThinkVantage Registry Monitor Service;ThinkVantage Registry Monitor Service; C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe [2007-08-03 644408]
R2 TPHKSVC;On Screen Display; C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe [2009-07-15 62320]
R2 TpKmpSVC;IBM KCU Service; C:\WINDOWS\system32\TpKmpSVC.exe [2006-06-29 32768]
R2 TSSCoreService;TSS Core Service; C:\Program Files\Lenovo\Client Security Solution\tvttcsd.exe [2007-08-03 722232]
R2 TVT Backup Protection Service;TVT Backup Protection Service; C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe [2007-07-12 569344]
R2 TVT Backup Service;TVT Backup Service; C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe [2007-07-12 950272]
R2 TVT Scheduler;TVT Scheduler; c:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe [2008-03-04 1122304]
R2 tvtnetwk;tvtnetwk; C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exe [2007-02-08 45056]
R2 VRaySpawner 2009;VRaySpawner 2009; C:\Program Files\Autodesk\3ds Max 2009\vrayspawner2009.exe [2009-11-03 159744]
R2 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
R2 WSearch;Windows Search; C:\WINDOWS\system32\SearchIndexer.exe [2008-05-26 439808]
S2 gupdate1ca315e9abd1410;Služba Google Update (gupdate1ca315e9abd1410); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-09-09 133104]
S2 LENOVO.MICMUTE;Lenovo Microphone Mute; C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe [2009-07-03 45424]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2009-02-06 20680]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-04 136120]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 SQLWriter;SQL Server VSS Writer; c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe [2006-04-14 87840]
S3 TPHDEXLGSVC;ThinkPad HDD APS Logging Service; C:\WINDOWS\System32\TPHDEXLG.exe [2009-10-09 39976]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------



Předem mnohokrát díky za váš čas, Olegunar :)
Naposledy upravil(a) olegunar dne 18 úno 2010 15:07, celkem upraveno 2 x.
Nahoru
olegunar
Návštěvník
Návštěvník
Příspěvky: 18
Registrován: 21 črc 2008 13:15

Re: prosím o kontolu Logu, Win32/Rootkit.Kryptik.AF trojský kůň

#2 Příspěvek od olegunar »

Ještě dodávám výpis nakažených souborů zachycených rezidentním štítem:

17.2.2010 18:14:14 Rezidentní ochrana soubor C:\WINDOWS\system32\drivers\PDCOMP.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň vyléčen smazáním - uložen do karantény NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna na nově vytvořeném souboru.
17.2.2010 18:14:08 Rezidentní ochrana soubor C:\WINDOWS\system32\drivers\PCIDump.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň vyléčen smazáním - uložen do karantény NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna na nově vytvořeném souboru.
17.2.2010 18:14:04 Rezidentní ochrana soubor C:\WINDOWS\system32\drivers\pcdrndisuio.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň vyléčen smazáním - uložen do karantény NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna na nově vytvořeném souboru.
17.2.2010 18:14:02 Rezidentní ochrana soubor C:\WINDOWS\system32\DRIVERS\parport.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň nelze léčit NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna při pokusu o spuštění souboru.
17.2.2010 18:14:02 Rezidentní ochrana soubor C:\WINDOWS\system32\drivers\parport.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň nelze léčit NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna na nově vytvořeném souboru.
17.2.2010 18:14:02 Rezidentní ochrana soubor C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň nelze léčit NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna při pokusu o spuštění souboru.
17.2.2010 18:14:01 Rezidentní ochrana soubor C:\WINDOWS\system32\drivers\nwlnkfwd.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň nelze léčit NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna na nově vytvořeném souboru.
17.2.2010 18:14:01 Rezidentní ochrana soubor C:\WINDOWS\system32\drivers\nwlnkflt.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň nelze léčit NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna na nově vytvořeném souboru.
17.2.2010 18:14:01 Rezidentní ochrana soubor C:\WINDOWS\system32\drivers\MSPQM.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň nelze léčit NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna při pokusu o spuštění souboru.
17.2.2010 18:14:00 Rezidentní ochrana soubor C:\WINDOWS\system32\drivers\mspqm.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň nelze léčit NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna na nově vytvořeném souboru.
17.2.2010 18:14:00 Rezidentní ochrana soubor C:\WINDOWS\system32\drivers\MSPCLOCK.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň nelze léčit NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna při pokusu o spuštění souboru.
17.2.2010 18:13:59 Rezidentní ochrana soubor C:\WINDOWS\system32\drivers\mspclock.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň nelze léčit NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna na nově vytvořeném souboru.
17.2.2010 18:13:59 Rezidentní ochrana soubor C:\WINDOWS\system32\drivers\MSKSSRV.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň nelze léčit NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna při pokusu o spuštění souboru.
17.2.2010 18:13:58 Rezidentní ochrana soubor C:\WINDOWS\system32\drivers\mskssrv.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň nelze léčit NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna na nově vytvořeném souboru.
17.2.2010 18:13:58 Rezidentní ochrana soubor C:\WINDOWS\System32\Drivers\lbrtfdc.SYS varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň nelze léčit NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna při pokusu o spuštění souboru.
17.2.2010 18:13:58 Rezidentní ochrana soubor C:\WINDOWS\system32\drivers\lbrtfdc.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň nelze léčit NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna na nově vytvořeném souboru.
17.2.2010 18:13:57 Rezidentní ochrana soubor C:\WINDOWS\system32\drivers\kmwdfilter.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň vyléčen smazáním - uložen do karantény NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna na nově vytvořeném souboru.
17.2.2010 18:13:56 Rezidentní ochrana soubor C:\WINDOWS\system32\DRIVERS\irenum.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň nelze léčit NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna při pokusu o spuštění souboru.
17.2.2010 18:13:56 Rezidentní ochrana soubor C:\WINDOWS\system32\drivers\irenum.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň nelze léčit NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna na nově vytvořeném souboru.
17.2.2010 18:13:55 Rezidentní ochrana soubor C:\WINDOWS\system32\DRIVERS\ipinip.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň nelze léčit NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna při pokusu o spuštění souboru.
17.2.2010 18:13:55 Rezidentní ochrana soubor C:\WINDOWS\system32\drivers\ipinip.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň nelze léčit NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna na nově vytvořeném souboru.
17.2.2010 18:13:54 Rezidentní ochrana soubor C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň nelze léčit NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna při pokusu o spuštění souboru.
17.2.2010 18:13:53 Rezidentní ochrana soubor C:\WINDOWS\system32\drivers\ipfltdrv.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň nelze léčit NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna na nově vytvořeném souboru.
17.2.2010 18:13:53 Rezidentní ochrana soubor C:\WINDOWS\system32\drivers\ip6fw.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň nelze léčit NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna při pokusu o spuštění souboru.
17.2.2010 18:13:52 Rezidentní ochrana soubor C:\WINDOWS\system32\drivers\ip6fw.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň nelze léčit NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna na nově vytvořeném souboru.
17.2.2010 18:13:52 Rezidentní ochrana soubor C:\WINDOWS\system32\drivers\icdusb.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň vyléčen smazáním - uložen do karantény NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna na nově vytvořeném souboru.
17.2.2010 18:13:51 Rezidentní ochrana soubor C:\WINDOWS\system32\drivers\ewusbmdm.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň vyléčen smazáním - uložen do karantény NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna na nově vytvořeném souboru.
17.2.2010 18:13:49 Rezidentní ochrana soubor C:\WINDOWS\system32\DRIVERS\flpydisk.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň nelze léčit NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna při pokusu o spuštění souboru.
17.2.2010 18:13:49 Rezidentní ochrana soubor C:\WINDOWS\system32\drivers\flpydisk.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň nelze léčit NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna na nově vytvořeném souboru.
17.2.2010 18:13:49 Rezidentní ochrana soubor C:\WINDOWS\system32\DRIVERS\fdc.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň nelze léčit NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna při pokusu o spuštění souboru.
17.2.2010 18:13:48 Rezidentní ochrana soubor C:\WINDOWS\system32\drivers\fdc.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň nelze léčit NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna na nově vytvořeném souboru.
17.2.2010 18:13:48 Rezidentní ochrana soubor C:\WINDOWS\system32\DRIVERS\e100b325.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň nelze léčit NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna při pokusu o spuštění souboru.
17.2.2010 18:13:47 Rezidentní ochrana soubor C:\WINDOWS\system32\drivers\e100b325.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň nelze léčit NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna na nově vytvořeném souboru.
17.2.2010 18:13:47 Rezidentní ochrana soubor C:\WINDOWS\system32\drivers\drmkaud.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň nelze léčit NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna při pokusu o spuštění souboru.
17.2.2010 18:13:47 Rezidentní ochrana soubor C:\WINDOWS\system32\drivers\drmkaud.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň nelze léčit NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna na nově vytvořeném souboru.
17.2.2010 18:13:46 Rezidentní ochrana soubor C:\WINDOWS\system32\drivers\DMusic.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň nelze léčit NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna při pokusu o spuštění souboru.
17.2.2010 18:13:46 Rezidentní ochrana soubor C:\WINDOWS\system32\drivers\dmusic.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň nelze léčit NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna na nově vytvořeném souboru.
17.2.2010 18:13:46 Rezidentní ochrana soubor C:\WINDOWS\System32\Drivers\Changer.SYS varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň nelze léčit NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna při pokusu o spuštění souboru.
17.2.2010 18:13:45 Rezidentní ochrana soubor C:\WINDOWS\system32\drivers\Changer.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň nelze léčit NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna na nově vytvořeném souboru.
17.2.2010 18:13:45 Rezidentní ochrana soubor C:\WINDOWS\System32\Drivers\Cdaudio.SYS varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň nelze léčit NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna při pokusu o spuštění souboru.
17.2.2010 18:13:45 Rezidentní ochrana soubor C:\WINDOWS\system32\drivers\Cdaudio.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň nelze léčit NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna na nově vytvořeném souboru.
17.2.2010 18:13:44 Rezidentní ochrana soubor C:\combofix\catchme.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň vyléčen smazáním - uložen do karantény LENOVO-D3E214EE\Pavel Tato skutečnost byla zjištěna na nově vytvořeném souboru aplikací: C:\WINDOWS\system32\svchost.exe.
17.2.2010 18:13:43 Rezidentní ochrana soubor C:\WINDOWS\system32\drivers\btwusb.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň vyléčen smazáním - uložen do karantény NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna na nově vytvořeném souboru.
17.2.2010 18:13:42 Rezidentní ochrana soubor C:\WINDOWS\system32\drivers\btwmodem.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň vyléčen smazáním - uložen do karantény NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna na nově vytvořeném souboru.
17.2.2010 18:13:41 Rezidentní ochrana soubor C:\WINDOWS\system32\drivers\btwhid.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň vyléčen smazáním - uložen do karantény NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna na nově vytvořeném souboru.
17.2.2010 18:13:40 Rezidentní ochrana soubor C:\WINDOWS\system32\drivers\btwdndis.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň vyléčen smazáním - uložen do karantény NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna na nově vytvořeném souboru.
17.2.2010 18:13:38 Rezidentní ochrana soubor C:\WINDOWS\system32\DRIVERS\atmarpc.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň nelze léčit NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna při pokusu o spuštění souboru.
17.2.2010 18:13:38 Rezidentní ochrana soubor C:\WINDOWS\system32\drivers\atmarpc.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň nelze léčit NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna na nově vytvořeném souboru.
17.2.2010 18:13:37 Rezidentní ochrana soubor C:\WINDOWS\system32\DRIVERS\asyncmac.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň nelze léčit NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna při pokusu o spuštění souboru.
17.2.2010 18:13:37 Rezidentní ochrana soubor C:\WINDOWS\system32\drivers\asyncmac.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň nelze léčit NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna na nově vytvořeném souboru.
17.2.2010 18:13:36 Rezidentní ochrana soubor C:\WINDOWS\system32\drivers\aec.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň nelze léčit NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna při pokusu o spuštění souboru.
17.2.2010 18:13:36 Rezidentní ochrana soubor C:\WINDOWS\system32\drivers\aec.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň nelze léčit NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna na nově vytvořeném souboru.
17.2.2010 18:13:35 Rezidentní ochrana soubor C:\WINDOWS\system32\drivers\ac97intc.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň nelze léčit NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna při pokusu o spuštění souboru.
17.2.2010 18:13:34 Rezidentní ochrana soubor C:\WINDOWS\system32\drivers\ac97intc.sys varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň nelze léčit NT AUTHORITY\SYSTEM Tato skutečnost byla zjištěna na nově vytvořeném souboru.
17.2.2010 18:13:28 Rezidentní ochrana soubor C:\WINDOWS\system32\fjhdyfhsn.bat BAT/Agent.NFC trojský kůň vyléčen smazáním - uložen do karantény LENOVO-D3E214EE\Pavel Tato skutečnost byla zjištěna na souboru, který byl modifikován aplikací: C:\WINDOWS\system32\cmd.exe.

Olegunar
Nahoru
Uživatelský avatar
JaRon
Moderátor
Moderátor
Příspěvky: 15691
Registrován: 29 bře 2005 13:39
Bydliště: BB-SK

Re: prosím o kontolu Logu, Win32/Rootkit.Kryptik.AF trojský kůň

#3 Příspěvek od JaRon »

Presun ComboFix
na plochu (ak tam este nie je)

otvor si Poznamkovy blok - notepad

do neho zkopiruj skript z nasledujiceho okna:

Kód: Vybrat vše

File::
C:\WINDOWS\system32\fjhdyfhsn.bat 
C:\Documents and Settings\Pavel\Nabídka Start\Programy\Po spuštění\monnid32.exe
uloz vytvoreny textovy soubor ako CFScript.txt na plochu

po ulozeni uchop vytvoreny skript lavym tlacitkom mysi a presun ho nad ikonu Combofixu, nad nim skript upust:

Obrázek

po aplikacii by mal vzniknut dalsi log, ten vloz sem :)
FRST |ADWCleaner |MBAM |CCleaner |AVPTool

V prípade spokojnosti je možné podporiť fórum https://platba.viry.cz/payment/
Nahoru
olegunar
Návštěvník
Návštěvník
Příspěvky: 18
Registrován: 21 črc 2008 13:15

Re: prosím o kontolu Logu, Win32/Rootkit.Kryptik.AF trojský kůň

#4 Příspěvek od olegunar »

nastaly komplikace...CF pracoval v jednotlivých fázích, zobrazil co maže, nastal restart, po restartu mě upozornil ať nic nedělám a počkám až dokončím akci...čekal jsem, ale na dokončení akce ani nedošlo, nastala BSOD - mbr.sys :( Protože tedy nedošlo ke korektnímu ukončení činnosti CF, nevytvořil se ani Log, který bych sem případně vložil. Jen dodám, že s BSOD problémy nemívám, poslední tak před rokem a půl (způsobovalo Kerio) - to se tu taky řešilo.

Je možný nějaký jiný postup?

Díky, Olegunar
Nahoru
Uživatelský avatar
JaRon
Moderátor
Moderátor
Příspěvky: 15691
Registrován: 29 bře 2005 13:39
Bydliště: BB-SK

Re: prosím o kontolu Logu, Win32/Rootkit.Kryptik.AF trojský kůň

#5 Příspěvek od JaRon »

prescanuj PC s MBAM
FRST |ADWCleaner |MBAM |CCleaner |AVPTool

V prípade spokojnosti je možné podporiť fórum https://platba.viry.cz/payment/
Nahoru
olegunar
Návštěvník
Návštěvník
Příspěvky: 18
Registrován: 21 črc 2008 13:15

Re: prosím o kontolu Logu, Win32/Rootkit.Kryptik.AF trojský kůň

#6 Příspěvek od olegunar »

log po rychlém skenu pomocí MBAM:


Malwarebytes' Anti-Malware 1.44
Verze databáze: 3754
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

18.2.2010 13:10:40
mbam-log-2010-02-18 (13-10-37).txt

Typ kontroly: Rychlá kontrola
Zkontrolované objekty: 128707
Uplynulý čas: 7 minute(s), 10 second(s)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované adresáře: 0
Infikované soubory: 2

Infikované procesy v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované moduly v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované klíče registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované hodnoty registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované datové položky registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované adresáře:
(Nebyly nalezeny žádné škodlivé položky)

Infikované soubory:
C:\WINDOWS\system32\drivers\gaaqat.sys (Rootkit.Agent) -> No action taken.
C:\Documents and Settings\Pavel\Data aplikací\avdrn.dat (Malware.Trace) -> No action taken.




Když otevřu karanténu Eset smart security tak jsou v ní dva nové soubory:

18.2.2010 12:26:38 Rezidentní ochrana soubor C:\ComboFix\N_\testme varianta infiltrace Win32/Rootkit.Kryptik.AF trojský kůň vyléčen smazáním - uložen do karantény LENOVO-D3E214EE\Pavel Tato skutečnost byla zjištěna na nově vytvořeném souboru aplikací: C:\ComboFix\catchme.cfxxe.
18.2.2010 12:26:03 Rezidentní ochrana soubor C:\DOCUME~1\Pavel\LOCALS~1\Temp\Av-test.txt Eicar testovací soubor vyléčen smazáním - uložen do karantény LENOVO-D3E214EE\Pavel Tato skutečnost byla zjištěna na nově vytvořeném souboru aplikací: C:\ComboFix\CF24489.cfxxe.

ten uvedený čas je pravděpodobně okamžikem kdy jsem spustil CF, vím měl jsem Smart security vypnout, ale mám vždy problém s tím, že můžu odpálit jen běžící proces egui.exe, ekrn.exe mi vypnout nejde a už dříve mi zde bylo řečeno, že mám CF aplikovat a za tohoto stavu... Díky
Naposledy upravil(a) olegunar dne 18 úno 2010 23:19, celkem upraveno 1 x.
Nahoru
Uživatelský avatar
JaRon
Moderátor
Moderátor
Příspěvky: 15691
Registrován: 29 bře 2005 13:39
Bydliště: BB-SK

Re: prosím o kontolu Logu, Win32/Rootkit.Kryptik.AF trojský kůň

#7 Příspěvek od JaRon »

s NOD-om sa netrap :) odstran najdene v MBAM - restart - a vloz novy log RSIT
FRST |ADWCleaner |MBAM |CCleaner |AVPTool

V prípade spokojnosti je možné podporiť fórum https://platba.viry.cz/payment/
Nahoru
olegunar
Návštěvník
Návštěvník
Příspěvky: 18
Registrován: 21 črc 2008 13:15

Re: prosím o kontolu Logu, Win32/Rootkit.Kryptik.AF trojský kůň

#8 Příspěvek od olegunar »

takže provedeno, nový log z RSIT:

Logfile of random's system information tool 1.06 (written by random/random)
Run by Pavel at 2010-02-18 13:29:13
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 41 GB (28%) free of 146 GB
Total RAM: 2046 MB (47% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:29:28, on 18.2.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
C:\WINDOWS\system32\IPSSVC.EXE
C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files\ThinkPad\Utilities\DOZESVC.EXE
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Autodesk\3ds Max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe
C:\Program Files\Autodesk\VIZ2008\mentalray\satellite\raysat_VIZ2008_32server.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
C:\WINDOWS\system32\TpKmpSVC.exe
C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe
C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
c:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exe
C:\Program Files\Autodesk\3ds Max 2009\vrayspawner2009.exe
C:\Program Files\Autodesk\3ds Max 2009\3dsmax.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\TEMP\AdskCleanup.0001
C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE
C:\WINDOWS\system32\wuauclt.exe
c:\program files\lenovo\system update\suservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Lenovo\Logger\logmon.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Lenovo\NPDIRECT\TPFNF7SP.exe
C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\WINDOWS\system32\TpShocks.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
C:\Program Files\Lenovo\Zoom\TpScrex.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Lenovo\AwayTask\AwaySch.EXE
C:\PROGRA~1\THINKV~1\PrdCtr\LPMGR.exe
C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
C:\PROGRA~1\THINKV~1\AMSG\Amsg.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
C:\Program Files\Lenovo\Client Security Solution\cssauth.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Lenovo\HOTKEY\TPFNF6R.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\PROGRA~1\THINKV~1\PrdCtr\LPMLCHK.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\RocketDock\RocketDock.exe
C:\Documents and Settings\Pavel\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\Lenovo\Client Security Solution\tvtpwm_tray.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe
C:\rsit\RSIT.exe
C:\Program Files\HiJackThis\Pavel.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\TRANSLAT\WEBIE.DLL
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: ThinkVantage Password Manager - {F040E541-A427-4CF7-85D8-75E3E0F476C5} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\TRANSLAT\WEBIE.DLL
O3 - Toolbar: Lenovo ThinkVantage Toolbox - {86B9B5DD-FB75-4035-BD52-3C94F7849CAF} - C:\Program Files\PC-Doctor\ATLPcdToolbar544928.dll
O4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog
O4 - HKLM\..\Run: [TPFNF7] C:\PROGRA~1\Lenovo\NPDIRECT\TPFNF7SP.exe /r
O4 - HKLM\..\Run: [TPHOTKEY] C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [TVT Scheduler Proxy] C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [AwaySch] C:\Program Files\Lenovo\AwayTask\AwaySch.EXE
O4 - HKLM\..\Run: [LPManager] C:\PROGRA~1\THINKV~1\PrdCtr\LPMGR.exe
O4 - HKLM\..\Run: [AMSG] C:\PROGRA~1\THINKV~1\AMSG\Amsg.exe /startup
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [ACTray] C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
O4 - HKLM\..\Run: [ACWLIcon] C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
O4 - HKLM\..\Run: [cssauth] "C:\Program Files\Lenovo\Client Security Solution\cssauth.exe" silent
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [LENOVO.TPFNF6R] C:\Program Files\Lenovo\HOTKEY\TPFNF6R.exe
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [LPMailChecker] C:\PROGRA~1\THINKV~1\PrdCtr\LPMLCHK.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Pavel\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Akcelerátor spuštění AutoCADu.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart17.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {0045D4BC-5189-4b67-969C-83BB1906C421} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll
O9 - Extra 'Tools' menuitem: ThinkVantage Password Manager... - {0045D4BC-5189-4b67-969C-83BB1906C421} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\TRANSLAT\WEBIE.DLL
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\TRANSLAT\WEBIE.DLL
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\TRANSLAT\WEBIE.DLL
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\TRANSLAT\WEBIE.DLL
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\TRANSLAT\WEBIE.DLL
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\TRANSLAT\WEBIE.DLL
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\TRANSLAT\WEBIE.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos-be ... canner.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: ACNotify - ACNotify.dll (file missing)
O23 - Service: Ac Profile Manager Service (AcPrfMgrSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
O23 - Service: Access Connections Main Service (AcSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: Lenovo Doze Mode Service (DozeSvc) - Lenovo. - C:\Program Files\ThinkPad\Utilities\DOZESVC.EXE
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Služba Google Update (gupdate1ca315e9abd1410) (gupdate1ca315e9abd1410) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Lenovo - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: IPS Core Service (IPSSVC) - Lenovo Group Limited - C:\WINDOWS\system32\IPSSVC.EXE
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lenovo Microphone Mute (LENOVO.MICMUTE) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe
O23 - Service: mental ray 3.6 Satellite for Autodesk 3ds Max Design 2009 32-bit 32-bit (mi-raysat_3dsMax2009_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe
O23 - Service: mental ray 3.5 Satellite for Autodesk VIZ 2008 (mi-raysat_VIZ2008_32) - Unknown owner - C:\Program Files\Autodesk\VIZ2008\mentalray\satellite\raysat_VIZ2008_32server.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Power Manager DBC Service - Unknown owner - C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: System Update (SUService) - Lenovo Group Limited - c:\program files\lenovo\system update\suservice.exe
O23 - Service: ThinkVantage Registry Monitor Service - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINDOWS\System32\TPHDEXLG.exe
O23 - Service: On Screen Display (TPHKSVC) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe
O23 - Service: TSS Core Service (TSSCoreService) - IBM - C:\Program Files\Lenovo\Client Security Solution\tvttcsd.exe
O23 - Service: TVT Backup Protection Service - Unknown owner - C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe
O23 - Service: TVT Backup Service - Lenovo Group Limited - C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
O23 - Service: TVT Scheduler - Lenovo Group Limited - c:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
O23 - Service: tvtnetwk - Unknown owner - C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exe
O23 - Service: VRaySpawner 2009 - Unknown owner - C:\Program Files\Autodesk\3ds Max 2009\vrayspawner2009.exe

--
End of file - 16840 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Check Updates for Windows Live Toolbar.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\PCDoctorBackgroundMonitorTask.job
C:\WINDOWS\tasks\PMTask.job
C:\WINDOWS\tasks\SystemToolsDailyTest.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2005-09-24 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2DB66063-BB98-466A-AA0D-3E7ACF5ED853}]
WebTransBHO Class - C:\TRANSLAT\WEBIE.DLL [2008-04-10 360448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5CA3D70E-1895-11CF-8E15-001234567890}]
DriveLetterAccess - C:\WINDOWS\System32\DLA\DLASHX_W.DLL [2006-02-02 110652]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}]
Windows Live Toolbar Helper - C:\Program Files\Windows Live Toolbar\msntb.dll [2007-02-12 546672]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-01-11 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-01-11 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F040E541-A427-4CF7-85D8-75E3E0F476C5}]
CPwmIEBrowserHelper Object - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll [2007-08-03 795960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - Windows Live Toolbar - C:\Program Files\Windows Live Toolbar\msntb.dll [2007-02-12 546672]
{BFC32E1D-EE75-4A48-BC60-104E11EE2431} - WebTranslator - C:\TRANSLAT\WEBIE.DLL [2008-04-10 360448]
{86B9B5DD-FB75-4035-BD52-3C94F7849CAF} - Lenovo ThinkVantage Toolbox - C:\Program Files\PC-Doctor\ATLPcdToolbar544928.dll [2009-11-22 137712]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"PWRMGRTR"=rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor []
"BLOG"=rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog []
"TPFNF7"=C:\PROGRA~1\Lenovo\NPDIRECT\TPFNF7SP.exe [2009-08-03 62240]
"TPHOTKEY"=C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe [2009-03-13 68976]
"Apoint"=C:\Program Files\Apoint2K\Apoint.exe [2009-09-09 176128]
"TpShocks"=C:\WINDOWS\system32\TpShocks.exe [2009-12-11 337256]
"EZEJMNAP"=C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe [2008-10-08 256576]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2009-01-14 13549568]
"nwiz"=nwiz.exe /installquiet /keeploaded /nodetect []
"TVT Scheduler Proxy"=C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe [2008-03-04 487424]
"DLA"=C:\WINDOWS\System32\DLA\DLACTRLW.EXE [2006-02-02 122940]
"ISUSPM Startup"=C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe [2004-07-27 221184]
"ISUSScheduler"=C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe [2004-07-27 81920]
"AwaySch"=C:\Program Files\Lenovo\AwayTask\AwaySch.EXE [2006-11-07 91688]
"LPManager"=C:\PROGRA~1\THINKV~1\PrdCtr\LPMGR.exe [2009-07-23 185688]
"AMSG"=C:\PROGRA~1\THINKV~1\AMSG\Amsg.exe [2009-09-03 436800]
"DiskeeperSystray"=C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe [2006-05-18 196696]
"ACTray"=C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe [2009-12-10 431464]
"ACWLIcon"=C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe [2009-12-10 181608]
"cssauth"=C:\Program Files\Lenovo\Client Security Solution\cssauth.exe [2007-08-03 2630968]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2007-02-16 282624]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2009-02-06 2021400]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-01-11 246504]
"SoundMAXPnP"=C:\Program Files\Analog Devices\Core\smax4pnp.exe [2008-04-24 1036288]
"LENOVO.TPFNF6R"=C:\Program Files\Lenovo\HOTKEY\TPFNF6R.exe [2009-08-20 62752]
"TPKMAPHELPER"=C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe [2007-01-09 868352]
"LPMailChecker"=C:\PROGRA~1\THINKV~1\PrdCtr\LPMLCHK.exe [2009-07-23 124248]
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2009-01-15 86016]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"=C:\Program Files\RocketDock\RocketDock.exe [2007-09-02 495616]
"Google Update"=C:\Documents and Settings\Pavel\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe [2009-11-03 135664]
"WEBTRAN"= []
"OEXPRESS"= []
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2007-01-05 204288]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
Akcelerátor spuštění AutoCADu.lnk - C:\Program Files\Common Files\Autodesk Shared\acstart17.exe
Bluetooth.lnk - C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe
Windows Search.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [2007-04-19 294912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ACNotify]
C:\Program Files\ThinkPad\ConnectUtilities\ACNotify.dll [2009-12-10 32768]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\psfus]
C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll [2009-12-01 100104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\tpfnf2]
C:\Program Files\Lenovo\HOTKEY\notifyf2.dll [2006-09-06 34344]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 77824]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"=C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2009-05-24 304128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDrives"=0
"NoDriveAutoRun"=67108863

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\QIP\qip.exe"="C:\Program Files\QIP\qip.exe:*:Enabled:Quiet Internet Pager"
"C:\Program Files\ICQ6\ICQ.exe"="C:\Program Files\ICQ6\ICQ.exe:*:Enabled:ICQ6"
"C:\Program Files\Autodesk\Backburner\monitor.exe"="C:\Program Files\Autodesk\Backburner\monitor.exe:*:Enabled:backburner 2.3 monitor"
"C:\Program Files\Autodesk\Backburner\manager.exe"="C:\Program Files\Autodesk\Backburner\manager.exe:*:Enabled:backburner 2.3 manager"
"C:\Program Files\Autodesk\Backburner\server.exe"="C:\Program Files\Autodesk\Backburner\server.exe:*:Enabled:backburner 2.3 server"
"C:\Program Files\Autodesk\VIZ2008\3dsviz.exe"="C:\Program Files\Autodesk\VIZ2008\3dsviz.exe:*:Enabled:Autodesk VIZ 2008"
"C:\Program Files\Autodesk\3ds Max 2009\3dsmax.exe"="C:\Program Files\Autodesk\3ds Max 2009\3dsmax.exe:*:Enabled:Autodesk 3ds Max Design 2009 32-bit"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\Electronic Arts\Burnout(TM) Paradise The Ultimate Box\BurnoutLauncher.exe"="C:\Program Files\Electronic Arts\Burnout(TM) Paradise The Ultimate Box\BurnoutLauncher.exe:*:Enabled:Burnout(TM) Paradise The Ultimate Box"
"C:\Program Files\Electronic Arts\Burnout(TM) Paradise The Ultimate Box\BurnoutConfigTool.exe"="C:\Program Files\Electronic Arts\Burnout(TM) Paradise The Ultimate Box\BurnoutConfigTool.exe:*:Enabled:Burnout(TM) Paradise The Ultimate Box"
"C:\Program Files\Electronic Arts\Burnout(TM) Paradise The Ultimate Box\BurnoutParadise.exe"="C:\Program Files\Electronic Arts\Burnout(TM) Paradise The Ultimate Box\BurnoutParadise.exe:*:Enabled:Burnout(TM) Paradise The Ultimate Box"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======File associations======

.scr - open - "C:\WINDOWS\system32\NOTEPAD.EXE" "%1"
.scr - install -
.scr - config -

======List of files/folders created in the last 1 months======

2010-02-18 13:01:54 ----D---- C:\Documents and Settings\Pavel\Data aplikací\Malwarebytes
2010-02-18 13:01:47 ----D---- C:\Documents and Settings\All Users\Data aplikací\Malwarebytes
2010-02-18 13:01:45 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-02-18 12:39:59 ----SHD---- C:\RECYCLER
2010-02-18 12:25:06 ----A---- C:\WINDOWS\NIRCMD.exe
2010-02-18 12:25:06 ----A---- C:\WINDOWS\MBR.exe
2010-02-18 12:25:04 ----A---- C:\WINDOWS\PEV.exe
2010-02-18 12:25:03 ----A---- C:\WINDOWS\zip.exe
2010-02-18 12:25:03 ----A---- C:\WINDOWS\SWREG.exe
2010-02-18 12:25:03 ----A---- C:\WINDOWS\sed.exe
2010-02-18 12:25:03 ----A---- C:\WINDOWS\grep.exe
2010-02-18 12:25:02 ----A---- C:\WINDOWS\SWXCACLS.exe
2010-02-18 12:25:02 ----A---- C:\WINDOWS\SWSC.exe
2010-02-18 12:24:30 ----SD---- C:\ComboFix
2010-02-18 12:22:53 ----D---- C:\Qoobox
2010-02-18 09:34:22 ----D---- C:\rsit
2010-02-10 17:29:39 ----HDC---- C:\WINDOWS\$NtUninstallKB978262$
2010-02-10 17:29:28 ----HDC---- C:\WINDOWS\$NtUninstallKB971468$
2010-02-10 17:27:05 ----HDC---- C:\WINDOWS\$NtUninstallKB978037$
2010-02-10 17:26:58 ----HDC---- C:\WINDOWS\$NtUninstallKB975713$
2010-02-10 17:26:49 ----HDC---- C:\WINDOWS\$NtUninstallKB978251$
2010-02-10 17:26:42 ----HDC---- C:\WINDOWS\$NtUninstallKB975560$
2010-02-10 17:26:30 ----HDC---- C:\WINDOWS\$NtUninstallKB977914$
2010-02-10 17:26:18 ----HDC---- C:\WINDOWS\$NtUninstallKB978706$
2010-02-10 17:26:03 ----HDC---- C:\WINDOWS\$NtUninstallKB977165$
2010-02-09 17:15:37 ----D---- C:\Program Files\Common Files\SPBA
2010-02-03 18:09:42 ----A---- C:\WINDOWS\Burnout(TM) Paradise The Ultimate Box Patch Log.txt
2010-02-03 18:07:02 ----D---- C:\Documents and Settings\All Users\Data aplikací\Electronic Arts
2010-02-03 17:53:38 ----D---- C:\Program Files\Electronic Arts
2010-02-03 17:53:32 ----A---- C:\WINDOWS\system32\d3dx10_40.dll
2010-02-03 17:53:32 ----A---- C:\WINDOWS\system32\D3DCompiler_40.dll
2010-02-03 17:53:31 ----A---- C:\WINDOWS\system32\D3DX9_40.dll
2010-02-03 17:53:29 ----A---- C:\WINDOWS\system32\XAudio2_3.dll
2010-02-03 17:53:29 ----A---- C:\WINDOWS\system32\XAPOFX1_2.dll
2010-02-03 17:53:28 ----A---- C:\WINDOWS\system32\xactengine3_3.dll
2010-02-03 17:53:26 ----A---- C:\WINDOWS\system32\X3DAudio1_5.dll
2010-02-03 17:53:25 ----A---- C:\WINDOWS\system32\XAudio2_2.dll
2010-02-03 17:53:25 ----A---- C:\WINDOWS\system32\XAPOFX1_1.dll
2010-02-03 17:53:23 ----A---- C:\WINDOWS\system32\xactengine3_2.dll
2010-02-03 17:53:22 ----A---- C:\WINDOWS\system32\d3dx10_39.dll
2010-02-03 17:53:22 ----A---- C:\WINDOWS\system32\D3DCompiler_39.dll
2010-02-03 17:53:20 ----A---- C:\WINDOWS\system32\D3DX9_39.dll
2010-02-03 17:53:19 ----A---- C:\WINDOWS\system32\XAudio2_1.dll
2010-02-03 17:53:19 ----A---- C:\WINDOWS\system32\XAPOFX1_0.dll
2010-02-03 17:53:17 ----A---- C:\WINDOWS\system32\xactengine3_1.dll
2010-02-03 17:53:16 ----A---- C:\WINDOWS\system32\X3DAudio1_4.dll
2010-02-03 17:53:15 ----A---- C:\WINDOWS\system32\d3dx10_38.dll
2010-02-03 17:53:15 ----A---- C:\WINDOWS\system32\D3DCompiler_38.dll
2010-02-03 17:53:13 ----A---- C:\WINDOWS\system32\D3DX9_38.dll
2010-02-03 17:53:12 ----A---- C:\WINDOWS\system32\XAudio2_0.dll
2010-02-03 17:53:10 ----A---- C:\WINDOWS\system32\xactengine3_0.dll
2010-02-03 17:53:09 ----A---- C:\WINDOWS\system32\X3DAudio1_3.dll
2010-02-03 17:53:08 ----A---- C:\WINDOWS\system32\d3dx10_37.dll
2010-02-03 17:53:08 ----A---- C:\WINDOWS\system32\D3DCompiler_37.dll
2010-02-03 17:53:06 ----A---- C:\WINDOWS\system32\D3DX9_37.dll
2010-02-03 17:53:05 ----A---- C:\WINDOWS\system32\xactengine2_10.dll
2010-02-03 17:53:02 ----A---- C:\WINDOWS\system32\d3dx10_36.dll
2010-02-03 17:53:02 ----A---- C:\WINDOWS\system32\D3DCompiler_36.dll
2010-02-03 17:53:01 ----A---- C:\WINDOWS\system32\d3dx9_36.dll
2010-02-03 17:52:59 ----A---- C:\WINDOWS\system32\xactengine2_9.dll
2010-02-03 17:52:58 ----A---- C:\WINDOWS\system32\d3dx10_35.dll
2010-02-03 17:52:58 ----A---- C:\WINDOWS\system32\D3DCompiler_35.dll
2010-02-03 17:52:57 ----A---- C:\WINDOWS\system32\d3dx9_35.dll
2010-02-03 17:52:55 ----A---- C:\WINDOWS\system32\xactengine2_8.dll
2010-02-03 17:52:55 ----A---- C:\WINDOWS\system32\X3DAudio1_2.dll
2010-02-03 17:52:48 ----A---- C:\WINDOWS\system32\xinput1_3.dll
2010-02-03 17:52:46 ----A---- C:\WINDOWS\system32\xactengine2_7.dll
2010-02-03 17:52:43 ----A---- C:\WINDOWS\system32\d3dx10_33.dll
2010-02-03 17:52:43 ----A---- C:\WINDOWS\system32\D3DCompiler_33.dll
2010-02-03 17:52:39 ----A---- C:\WINDOWS\system32\d3dx9_33.dll
2010-02-03 17:52:38 ----A---- C:\WINDOWS\system32\xactengine2_6.dll
2010-02-03 17:52:38 ----A---- C:\WINDOWS\system32\xactengine2_5.dll
2010-02-03 17:52:37 ----A---- C:\WINDOWS\system32\xactengine2_4.dll
2010-02-03 17:52:37 ----A---- C:\WINDOWS\system32\x3daudio1_1.dll
2010-02-03 17:52:36 ----A---- C:\WINDOWS\system32\xinput1_2.dll
2010-02-03 17:52:36 ----A---- C:\WINDOWS\system32\xactengine2_3.dll
2010-02-03 17:52:36 ----A---- C:\WINDOWS\system32\xactengine2_2.dll
2010-02-03 17:52:35 ----A---- C:\WINDOWS\system32\xinput1_1.dll
2010-02-03 17:52:35 ----A---- C:\WINDOWS\system32\xactengine2_1.dll
2010-02-03 17:52:24 ----A---- C:\WINDOWS\system32\xactengine2_0.dll
2010-02-03 17:52:24 ----A---- C:\WINDOWS\system32\x3daudio1_0.dll
2010-02-03 17:52:24 ----A---- C:\WINDOWS\system32\d3dx9_30.dll
2010-02-03 17:52:23 ----A---- C:\WINDOWS\system32\xinput9_1_0.dll
2010-02-03 17:52:23 ----A---- C:\WINDOWS\system32\d3dx9_29.dll
2010-02-03 17:52:23 ----A---- C:\WINDOWS\system32\d3dx9_28.dll
2010-02-03 17:52:21 ----A---- C:\WINDOWS\system32\d3dx9_25.dll
2010-02-03 17:52:19 ----A---- C:\WINDOWS\system32\d3dx9_24.dll
2010-02-03 17:52:03 ----D---- C:\WINDOWS\Logs
2010-02-01 15:04:54 ----D---- C:\Documents and Settings\All Users\Data aplikací\Sun
2010-02-01 15:04:32 ----A---- C:\WINDOWS\system32\javaws.exe
2010-02-01 15:04:32 ----A---- C:\WINDOWS\system32\javaw.exe
2010-02-01 15:04:32 ----A---- C:\WINDOWS\system32\java.exe
2010-02-01 15:00:15 ----D---- C:\Documents and Settings\All Users\Data aplikací\NOS
2010-01-22 00:40:23 ----A---- C:\WINDOWS\imsins.BAK

======List of files/folders modified in the last 1 months======

2010-02-18 13:29:18 ----D---- C:\Program Files\HiJackThis
2010-02-18 13:29:17 ----A---- C:\vraylog.txt
2010-02-18 13:29:14 ----D---- C:\WINDOWS\temp
2010-02-18 13:28:57 ----D---- C:\WINDOWS
2010-02-18 13:28:57 ----A---- C:\WINDOWS\TRNCOM.INI
2010-02-18 13:26:10 ----A---- C:\WINDOWS\system32\PROCDB.INI
2010-02-18 13:25:32 ----AD---- C:\WINDOWS\system32
2010-02-18 13:25:32 ----A---- C:\WINDOWS\system32\IPSCtrl.INI
2010-02-18 13:25:02 ----D---- C:\WINDOWS\system32\drivers
2010-02-18 13:24:25 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-02-18 13:01:45 ----D---- C:\Program Files
2010-02-18 12:37:50 ----D---- C:\WINDOWS\Minidump
2010-02-18 12:32:49 ----D---- C:\WINDOWS\system32\config
2010-02-18 12:32:29 ----D---- C:\WINDOWS\erdnt
2010-02-18 12:29:54 ----D---- C:\WINDOWS\AppPatch
2010-02-18 12:29:51 ----D---- C:\Program Files\Common Files
2010-02-18 12:25:33 ----D---- C:\WINDOWS\system32\CatRoot2
2010-02-17 22:13:42 ----D---- C:\WINDOWS\Prefetch
2010-02-17 18:14:14 ----ASHD---- C:\WINDOWS\system32\dllcache
2010-02-17 16:00:01 ----SHD---- C:\WINDOWS\Installer
2010-02-17 15:59:11 ----SD---- C:\Documents and Settings\Pavel\Data aplikací\Microsoft
2010-02-16 21:02:03 ----A---- C:\WINDOWS\WDICT32.INI
2010-02-16 20:58:23 ----A---- C:\WINDOWS\WTRAN32.INI
2010-02-14 14:49:00 ----D---- C:\SWSHARE
2010-02-10 17:57:10 ----HD---- C:\WINDOWS\inf
2010-02-10 17:29:38 ----HD---- C:\WINDOWS\$hf_mig$
2010-02-10 17:27:26 ----D---- C:\WINDOWS\Debug
2010-02-10 15:10:36 ----D---- C:\WINDOWS\system32\CatRoot
2010-02-09 17:19:36 ----RSD---- C:\WINDOWS\assembly
2010-02-09 17:19:21 ----SD---- C:\WINDOWS\Tasks
2010-02-09 17:19:05 ----D---- C:\WINDOWS\Media
2010-02-09 17:16:24 ----D---- C:\Program Files\ThinkVantage Fingerprint Software
2010-02-09 17:15:48 ----D---- C:\WINDOWS\system32\ReinstallBackups
2010-02-09 17:14:28 ----D---- C:\Documents and Settings\All Users\Data aplikací\UIB
2010-02-07 15:32:21 ----D---- C:\Program Files\Google
2010-02-03 18:02:40 ----SD---- C:\Documents and Settings\All Users\Data aplikací\Microsoft
2010-02-03 17:53:38 ----D---- C:\WINDOWS\system32\DirectX
2010-02-01 20:26:20 ----A---- C:\WINDOWS\system32\MRT.exe
2010-02-01 15:04:53 ----D---- C:\Program Files\Common Files\Java
2010-02-01 15:04:29 ----D---- C:\Program Files\Java
2010-01-28 22:30:39 ----HD---- C:\Program Files\InstallShield Installation Information
2010-01-26 23:12:18 ----D---- C:\Program Files\Mozilla Firefox
2010-01-25 20:29:26 ----A---- C:\WINDOWS\MAILTRAN.INI
2010-01-22 00:59:33 ----D---- C:\Program Files\Internet Explorer
2010-01-22 00:40:01 ----D---- C:\WINDOWS\ie8updates
2010-01-21 16:54:39 ----D---- C:\Program Files\CCleaner
2010-01-21 11:53:56 ----D---- C:\Program Files\FMA 2

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 ANC;ANC; C:\WINDOWS\System32\drivers\ANC.SYS [2009-11-17 11520]
R1 DLACDBHM;DLACDBHM; C:\WINDOWS\System32\Drivers\DLACDBHM.SYS [2005-11-18 5660]
R1 DLARTL_N;DLARTL_N; C:\WINDOWS\System32\Drivers\DLARTL_N.SYS [2005-11-18 22684]
R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2009-02-06 106208]
R1 epfwtdi;epfwtdi; C:\WINDOWS\system32\DRIVERS\epfwtdi.sys [2009-02-06 56280]
R1 IBMTPCHK;IBMTPCHK; \??\C:\WINDOWS\system32\Drivers\IBMBLDID.sys []
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 SASDIFSV;SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS []
R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys []
R1 TPHKDRV;TPHKDRV; C:\WINDOWS\system32\DRIVERS\TPHKDRV.sys [2008-05-12 17844]
R1 TPPWRIF;TPPWRIF; C:\WINDOWS\System32\drivers\Tppwrif.sys [2009-12-16 4442]
R1 TSMAPIP;TSMAPIP; C:\WINDOWS\System32\drivers\TSMAPIP.SYS [2009-08-03 4608]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-13 8832]
R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.7.4.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2008-03-08 21393]
R2 DLABOIOM;DLABOIOM; C:\WINDOWS\System32\DLA\DLABOIOM.SYS [2006-02-02 25628]
R2 DLADResN;DLADResN; C:\WINDOWS\System32\DLA\DLADResN.SYS [2006-02-02 2496]
R2 DLAIFS_M;DLAIFS_M; C:\WINDOWS\System32\DLA\DLAIFS_M.SYS [2006-02-02 86652]
R2 DLAOPIOM;DLAOPIOM; C:\WINDOWS\System32\DLA\DLAOPIOM.SYS [2006-02-02 14684]
R2 DLAPoolM;DLAPoolM; C:\WINDOWS\System32\DLA\DLAPoolM.SYS [2006-02-02 6364]
R2 DLAUDF_M;DLAUDF_M; C:\WINDOWS\System32\DLA\DLAUDF_M.SYS [2006-02-02 87036]
R2 DLAUDFAM;DLAUDFAM; C:\WINDOWS\System32\DLA\DLAUDFAM.SYS [2006-02-02 94332]
R2 DRVNDDM;DRVNDDM; C:\WINDOWS\System32\Drivers\DRVNDDM.SYS [2005-11-18 40544]
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2009-02-06 113448]
R2 epfw;epfw; C:\WINDOWS\system32\DRIVERS\epfw.sys [2009-02-06 130952]
R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2006-06-19 12672]
R2 pmem;pmem; \??\C:\WINDOWS\System32\drivers\pmemnt.sys []
R2 PROCDD;IPS Helper Driver; C:\WINDOWS\system32\DRIVERS\PROCDD.SYS [2006-11-06 12080]
R2 rimmptsk;rimmptsk; C:\WINDOWS\system32\DRIVERS\rimmptsk.sys [2008-02-15 46592]
R2 rimsptsk;rimsptsk; C:\WINDOWS\system32\DRIVERS\rimsptsk.sys [2007-07-30 43008]
R2 rismxdp;Ricoh xD-Picture Card Driver; C:\WINDOWS\system32\DRIVERS\rixdptsk.sys [2007-07-30 38400]
R2 s24trans;WLAN Transport; C:\WINDOWS\system32\DRIVERS\s24trans.sys [2007-03-29 12416]
R2 smihlp2;SMI Helper Driver (smihlp2); \??\C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys []
R2 tvtfilter;tvtfilter; C:\WINDOWS\system32\DRIVERS\tvtfilter.sys [2009-11-28 33536]
R2 WIBUKEY;WIBU-KEY Kernel Driver; C:\WINDOWS\SYSTEM32\DRIVERS\WibuKey.sys [2006-11-22 72704]
R3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\ADIHdAud.sys [2008-04-24 308736]
R3 AEAudio;AE Audio Service; C:\WINDOWS\system32\drivers\AEAudio.sys [2008-04-24 103424]
R3 ApfiltrService;Alps Pointing-device Filter Driver; C:\WINDOWS\system32\DRIVERS\Apfiltr.sys [2009-09-09 154672]
R3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 atmeltpm;atmeltpm; C:\WINDOWS\system32\DRIVERS\atmeltpm.sys [2005-05-17 15872]
R3 btaudio;Bluetooth Audio Device; C:\WINDOWS\system32\drivers\btaudio.sys [2007-01-24 530861]
R3 BTDriver;Bluetooth Virtual Communications Driver; C:\WINDOWS\system32\DRIVERS\btport.sys [2006-10-09 30459]
R3 BTKRNL;Bluetooth Bus Enumerator; C:\WINDOWS\system32\DRIVERS\btkrnl.sys [2007-02-27 868042]
R3 CmBatt;Microsoft AC Adapter Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-13 13952]
R3 e1express;Intel(R) PRO/1000 PCI Express Network Connection Driver; C:\WINDOWS\system32\DRIVERS\e1e5132.sys [2007-05-11 252312]
R3 Epfwndis;Eset Personal Firewall; C:\WINDOWS\system32\DRIVERS\Epfwndis.sys [2009-02-06 33096]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 HSF_DPV;HSF_DPV; C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys [2007-11-01 989696]
R3 HSFHWAZL;HSFHWAZL; C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys [2007-11-01 211456]
R3 IBMPMDRV;IBMPMDRV; C:\WINDOWS\system32\DRIVERS\ibmpmdrv.sys [2009-08-24 24872]
R3 Iviaspi;IVI ASPI Shell; C:\WINDOWS\system32\drivers\iviaspi.sys [2003-09-10 21060]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 NETw4x32;Ovladač adaptéru Intel(R) Wireless WiFi Link pro systém Windows XP 32 Bit; C:\WINDOWS\system32\DRIVERS\NETw4x32.sys [2007-04-30 2206976]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-01-14 6620064]
R3 psadd;Lenovo Parties Service Access Device Driver; C:\WINDOWS\system32\DRIVERS\psadd.sys [2007-05-22 21376]
R3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2008-04-13 79232]
R3 TcUsb;TC USB Kernel Driver; C:\WINDOWS\System32\Drivers\tcusb.sys [2008-12-09 50832]
R3 TVTI2C;Lenovo SM bus driver; C:\WINDOWS\system32\DRIVERS\Tvti2c.sys [2007-05-22 30336]
R3 TVTPktFilter;TVT Packet Filter Service; C:\WINDOWS\system32\DRIVERS\tvtpktfilter.sys [2007-02-08 17664]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Ovladač standardního rozbočovače USB; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2008-03-27 503008]
R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys [2007-11-01 731520]
S1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
S3 ac97intc;Služba instalace zvukového ovladače Intel(r) (WDM); C:\WINDOWS\system32\drivers\ac97intc.sys [2001-08-17 96256]
S3 BTWDNDIS;Bluetooth LAN Access Server; C:\WINDOWS\system32\DRIVERS\btwdndis.sys [2006-10-15 149123]
S3 btwhid;btwhid; C:\WINDOWS\system32\DRIVERS\btwhid.sys [2006-11-28 47907]
S3 btwmodem;Bluetooth Fax Modem; C:\WINDOWS\system32\DRIVERS\btwmodem.sys [2006-10-15 30285]
S3 BTWUSB;WIDCOMM USB Bluetooth Driver; C:\WINDOWS\System32\Drivers\btwusb.sys [2007-01-24 67960]
S3 catchme;catchme; \??\C:\DOCUME~1\Pavel\LOCALS~1\Temp\catchme.sys []
S3 E100B;Intel(R) PRO Adapter Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2001-10-24 117760]
S3 GMSIPCI;GMSIPCI; \??\D:\INSTALL\GMSIPCI.SYS []
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\WINDOWS\system32\DRIVERS\ewusbmdm.sys [2008-09-26 101376]
S3 ICDUSB;Sony IC Recorder; C:\WINDOWS\System32\Drivers\ICDUSB.sys [2000-08-31 26301]
S3 KMWDFilter;KMWDFilter; \??\C:\WINDOWS\System32\Drivers\KMWDFilter.SYS []
S3 PcdrNdisuio;PCDRNDISUIO Usermode I/O Protocol; C:\WINDOWS\system32\DRIVERS\pcdrndisuio.sys []
S3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-03 20992]
S3 SASENUM;SASENUM; \??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS []
S3 sffdisk;Ovladač třídy úložiště SFF; C:\WINDOWS\system32\DRIVERS\sffdisk.sys [2008-04-13 11904]
S3 sffp_sd;Ovladač protokolu úložiště SFF pro paměť sběrnici SDBus; C:\WINDOWS\system32\DRIVERS\sffp_sd.sys [2008-04-13 11008]
S3 UIUSys;Conexant Setup API; C:\WINDOWS\system32\DRIVERS\UIUSYS.SYS []
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 agp440;Filtr Intel sběrnice AGP; C:\WINDOWS\system32\DRIVERS\agp440.sys [2008-04-13 42368]
S4 agpCPQ;Filtr Compaq sběrnice AGP; C:\WINDOWS\system32\DRIVERS\agpCPQ.sys [2008-04-13 44928]
S4 alim1541;Filtr ALI sběrnice AGP; C:\WINDOWS\system32\DRIVERS\alim1541.sys [2008-04-13 42752]
S4 amdagp;Ovladač filtru AMD portu AGP; C:\WINDOWS\system32\DRIVERS\amdagp.sys [2008-04-13 43008]
S4 cbidf;cbidf; C:\WINDOWS\system32\DRIVERS\cbidf2k.sys [2001-08-17 13952]
S4 dwshd;dwshd; C:\WINDOWS\System32\drivers\dwshd.sys []
S4 IntelIde;IntelIde; C:\WINDOWS\system32\DRIVERS\intelide.sys [2008-04-14 5504]
S4 sisagp;Filtr SIS sběrnice AGP ; C:\WINDOWS\system32\DRIVERS\sisagp.sys [2008-04-13 40960]
S4 viaagp;Filtr VIA sběrnice AGP ; C:\WINDOWS\system32\DRIVERS\viaagp.sys [2008-04-13 42240]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AcPrfMgrSvc;Ac Profile Manager Service; C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe [2009-12-10 103784]
R2 AcSvc;Access Connections Main Service; C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe [2009-12-10 230760]
R2 Autodesk Licensing Service;Autodesk Licensing Service; C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe [2009-04-07 79360]
R2 btwdins;Bluetooth Service; C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe [2007-02-27 266295]
R2 C-DillaSrv;C-DillaSrv; C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE [2001-12-12 32256]
R2 Diskeeper;Diskeeper; C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe [2006-05-23 622700]
R2 DozeSvc;Lenovo Doze Mode Service; C:\Program Files\ThinkPad\Utilities\DOZESVC.EXE [2009-12-16 132456]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2009-02-06 727720]
R2 EvtEng;Intel(R) PROSet/Wireless Event Log; C:\Program Files\Intel\Wireless\Bin\EvtEng.exe [2007-04-16 647168]
R2 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
R2 IBMPMSVC;ThinkPad PM Service; C:\WINDOWS\system32\ibmpmsvc.exe [2009-08-24 38176]
R2 IPSSVC;IPS Core Service; C:\WINDOWS\system32\IPSSVC.EXE [2007-01-30 108080]
R2 IviRegMgr;IviRegMgr; C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe [2007-01-04 112152]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-12-17 153376]
R2 mi-raysat_3dsMax2009_32;mental ray 3.6 Satellite for Autodesk 3ds Max Design 2009 32-bit 32-bit; C:\Program Files\Autodesk\3ds Max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe [2008-03-09 65536]
R2 mi-raysat_VIZ2008_32;mental ray 3.5 Satellite for Autodesk VIZ 2008; C:\Program Files\Autodesk\VIZ2008\mentalray\satellite\raysat_VIZ2008_32server.exe [2007-03-07 65536]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2009-01-14 168004]
R2 Power Manager DBC Service;Power Manager DBC Service; C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE [2009-12-16 53248]
R2 RegSrvc;Intel(R) PROSet/Wireless Registry Service; C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe [2007-04-16 327680]
R2 S24EventMonitor;Intel(R) PROSet/Wireless Service; C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe [2007-04-16 983040]
R2 SUService;System Update; c:\program files\lenovo\system update\suservice.exe [2009-06-12 28672]
R2 ThinkVantage Registry Monitor Service;ThinkVantage Registry Monitor Service; C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe [2007-08-03 644408]
R2 TPHKSVC;On Screen Display; C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe [2009-07-15 62320]
R2 TpKmpSVC;IBM KCU Service; C:\WINDOWS\system32\TpKmpSVC.exe [2006-06-29 32768]
R2 TSSCoreService;TSS Core Service; C:\Program Files\Lenovo\Client Security Solution\tvttcsd.exe [2007-08-03 722232]
R2 TVT Backup Protection Service;TVT Backup Protection Service; C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe [2007-07-12 569344]
R2 TVT Backup Service;TVT Backup Service; C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe [2007-07-12 950272]
R2 TVT Scheduler;TVT Scheduler; c:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe [2008-03-04 1122304]
R2 tvtnetwk;tvtnetwk; C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exe [2007-02-08 45056]
R2 VRaySpawner 2009;VRaySpawner 2009; C:\Program Files\Autodesk\3ds Max 2009\vrayspawner2009.exe [2009-11-03 159744]
R2 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
R2 WSearch;Windows Search; C:\WINDOWS\system32\SearchIndexer.exe [2008-05-26 439808]
S2 gupdate1ca315e9abd1410;Služba Google Update (gupdate1ca315e9abd1410); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-09-09 133104]
S2 LENOVO.MICMUTE;Lenovo Microphone Mute; C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe [2009-07-03 45424]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2009-02-06 20680]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-04 136120]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 SQLWriter;SQL Server VSS Writer; c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe [2006-04-14 87840]
S3 TPHDEXLGSVC;ThinkPad HDD APS Logging Service; C:\WINDOWS\System32\TPHDEXLG.exe [2009-10-09 39976]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------


a log, který vytvořil MBAM po odstranění infikovaných souborů:

Malwarebytes' Anti-Malware 1.44
Verze databáze: 3754
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

18.2.2010 13:21:38
mbam-log-2010-02-18 (13-21-38).txt

Typ kontroly: Rychlá kontrola
Zkontrolované objekty: 128707
Uplynulý čas: 7 minute(s), 10 second(s)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované adresáře: 0
Infikované soubory: 2

Infikované procesy v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované moduly v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované klíče registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované hodnoty registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované datové položky registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované adresáře:
(Nebyly nalezeny žádné škodlivé položky)

Infikované soubory:
C:\WINDOWS\system32\drivers\gaaqat.sys (Rootkit.Agent) -> Delete on reboot.
C:\Documents and Settings\Pavel\Data aplikací\avdrn.dat (Malware.Trace) -> Quarantined and deleted successfully.

Proběhl restart, když mrknu sem: C:\WINDOWS\system32\drivers tak soubor gaaqat.sys tam pořád je :shock:

vyčkám na vaše další instrukce :)
Nahoru
Uživatelský avatar
JaRon
Moderátor
Moderátor
Příspěvky: 15691
Registrován: 29 bře 2005 13:39
Bydliště: BB-SK

Re: prosím o kontolu Logu, Win32/Rootkit.Kryptik.AF trojský kůň

#9 Příspěvek od JaRon »

nuz pouzi CFScript podla navodu vyssie - len obsah je iny :

Kód: Vybrat vše

File::
C:\WINDOWS\system32\drivers\gaaqat.sys 

Driver::
gaaqat
FRST |ADWCleaner |MBAM |CCleaner |AVPTool

V prípade spokojnosti je možné podporiť fórum https://platba.viry.cz/payment/
Nahoru
olegunar
Návštěvník
Návštěvník
Příspěvky: 18
Registrován: 21 črc 2008 13:15

Re: prosím o kontolu Logu, Win32/Rootkit.Kryptik.AF trojský kůň

#10 Příspěvek od olegunar »

CFScript aplikován, tentokrát to proběhlo v pořádku, jen to trvalo hodně dlouho, log je tady:


ComboFix 10-02-17.01 - Pavel 18.02.2010 14:29:11.9.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2046.1105 [GMT 1:00]
Spuštěný z: c:\documents and settings\Pavel\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Pavel\Plocha\CFScript.txt
AV: ESET Smart Security 4.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
* Rezidentní štít AV je zapnutý


FILE ::
"c:\windows\system32\drivers\gaaqat.sys"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\gaaqat.sys
c:\windows\TEMP\AdskCleanup.0001.dir.0002\~de153b.tmp
c:\windows\TEMP\AdskCleanup.0001.dir.0002\~df394b.tmp
.
---- Předchozí spuštění -------
.
c:\documents and settings\Pavel\Nabídka Start\Programy\Po spuštění\monnid32.exe
c:\windows\system32\Thumbs.db
c:\windows\TEMP\AdskCleanup.0001.dir.0020\~de153b.tmp
c:\windows\TEMP\AdskCleanup.0001.dir.0020\~df394b.tmp

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_GAAQAT
-------\Service_gaaqat


((((((((((((((((((((((((( Soubory vytvořené od 2010-01-18 do 2010-02-18 )))))))))))))))))))))))))))))))
.

2010-02-18 12:01 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-18 12:01 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-18 12:01 . 2010-02-18 12:43 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-18 08:34 . 2010-02-18 08:49 -------- d-----w- C:\rsit
2010-02-17 17:13 . 2008-04-13 19:40 34688 ----a-w- c:\windows\system32\drivers\lbrtfdc.sys
2010-02-17 17:13 . 2008-04-13 19:40 34688 ----a-w- c:\windows\system32\dllcache\lbrtfdc.sys
2010-02-17 17:13 . 2008-04-13 19:40 8192 ----a-w- c:\windows\system32\drivers\changer.sys
2010-02-17 17:13 . 2008-04-13 19:40 8192 ----a-w- c:\windows\system32\dllcache\changer.sys
2010-02-09 16:19 . 2009-12-16 00:12 24304 ------w- c:\windows\system32\drivers\DOZEHDD.SYS
2010-02-09 16:15 . 2010-02-09 16:15 -------- d-----w- c:\program files\Common Files\SPBA
2010-02-06 07:50 . 2010-02-14 13:48 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-02-03 17:05 . 2010-02-03 17:05 1196 ----a-w- c:\windows\system32\ealregsnapshot1.reg
2010-02-03 16:52 . 2007-07-19 23:57 267112 ----a-w- c:\windows\system32\xactengine2_9.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-16 09:28 . 2009-04-26 08:18 67595 ----a-w- c:\windows\system32\nvModes.dat
2010-02-09 16:16 . 2008-03-08 12:33 -------- d-----w- c:\program files\ThinkVantage Fingerprint Software
2010-02-07 14:32 . 2008-03-08 12:26 -------- d-----w- c:\program files\Google
2010-02-03 16:53 . 2010-02-03 16:53 -------- d-----w- c:\program files\Electronic Arts
2010-02-01 14:04 . 2008-03-08 12:16 -------- d-----w- c:\program files\Common Files\Java
2010-02-01 14:04 . 2008-03-08 12:16 -------- d-----w- c:\program files\Java
2010-01-28 21:30 . 2008-03-08 12:02 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-21 15:54 . 2008-07-21 16:12 -------- d-----w- c:\program files\CCleaner
2010-01-21 10:53 . 2008-09-18 19:08 -------- d-----w- c:\program files\FMA 2
2010-01-04 22:40 . 2008-04-11 08:50 -------- d-----w- c:\program files\Codec Pack - All In 1
2010-01-04 22:40 . 2008-04-11 08:50 737280 ----a-w- c:\windows\iun6002.exe
2009-12-31 16:50 . 2008-03-08 19:36 353792 ------w- c:\windows\system32\drivers\srv.sys
2009-12-25 22:23 . 2009-12-25 22:21 1124 ----a-w- c:\windows\unins000.dat
2009-12-25 22:22 . 2009-12-25 22:21 673546 ----a-w- c:\windows\unins000.exe
2009-12-21 19:08 . 2008-03-08 19:35 916480 ----a-w- c:\windows\system32\wininet.dll
2009-12-17 16:14 . 2009-03-08 17:05 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-12-17 07:42 . 2008-03-08 19:36 343552 ------w- c:\windows\system32\mspaint.exe
2009-12-16 00:12 . 2008-03-08 12:02 196608 ------w- c:\windows\PWMBTHLP.EXE
2009-12-16 00:12 . 2008-03-08 12:02 4442 ------w- c:\windows\system32\drivers\TPPWRIF.SYS
2009-12-15 15:39 . 2008-03-08 19:34 92114 ------w- c:\windows\system32\perfc005.dat
2009-12-15 15:39 . 2008-03-08 19:34 462136 ------w- c:\windows\system32\perfh005.dat
2009-12-14 07:10 . 2008-03-08 19:35 33280 ------w- c:\windows\system32\csrsrv.dll
2009-12-11 11:19 . 2009-12-11 11:19 337256 ----a-w- c:\windows\system32\TpShocks.exe
2009-12-11 11:19 . 2009-12-11 11:19 279912 ----a-w- c:\windows\system32\TpShEvUI.exe
2009-12-11 11:18 . 2009-12-11 11:18 492904 ----a-w- c:\windows\system32\TpShCPL.dll
2009-12-09 10:11 . 2008-03-08 19:36 2147328 ------w- c:\windows\system32\ntoskrnl.exe
2009-12-09 10:11 . 2008-03-08 19:36 2025984 ------w- c:\windows\system32\ntkrnlpa.exe
2009-12-04 18:22 . 2008-03-08 19:36 455424 ------w- c:\windows\system32\drivers\mrxsmb.sys
2009-12-01 12:44 . 2009-12-01 12:44 910088 ----a-w- c:\windows\system32\vrlogon.dll
2009-11-28 15:21 . 2008-03-08 12:27 33536 ------w- c:\windows\system32\drivers\tvtfilter.sys
2009-11-28 15:20 . 2008-03-08 12:27 129784 ------w- c:\windows\system32\pxafs.dll
2009-11-28 15:20 . 2008-03-08 12:27 118520 ------w- c:\windows\system32\pxinsi64.exe
2009-11-28 15:20 . 2008-03-08 12:27 116472 ------w- c:\windows\system32\pxcpyi64.exe
2009-11-27 17:14 . 2008-03-08 19:35 1294336 ------w- c:\windows\system32\quartz.dll
2009-11-27 17:14 . 2008-03-08 19:35 17920 ------w- c:\windows\system32\msyuv.dll
2009-11-27 16:09 . 2008-03-08 19:35 8704 ------w- c:\windows\system32\tsbyuv.dll
2009-11-27 16:09 . 2008-03-08 19:35 28672 ------w- c:\windows\system32\msvidc32.dll
2009-11-27 16:09 . 2008-03-08 19:35 11264 ------w- c:\windows\system32\msrle32.dll
2009-11-27 16:09 . 2008-03-08 19:35 48128 ------w- c:\windows\system32\iyuv_32.dll
2009-11-27 16:09 . 2008-03-08 19:35 84992 ----a-w- c:\windows\system32\avifil32.dll
2009-11-26 15:48 . 2009-11-26 15:48 77224 ---h--w- c:\windows\system32\mlfcache.dat
2009-11-21 16:03 . 2008-03-08 19:35 471552 ------w- c:\windows\AppPatch\aclayers.dll
2006-05-03 10:06 . 2008-04-05 18:51 163328 --sh--r- c:\windows\system32\flvDX.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"Google Update"="c:\documents and settings\Pavel\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" [2009-11-03 135664]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2007-01-05 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PWRMGRTR"="c:\progra~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL" [2009-12-16 513384]
"BLOG"="c:\progra~1\ThinkPad\UTILIT~1\BatLogEx.DLL" [2009-12-16 208896]
"TPFNF7"="c:\progra~1\Lenovo\NPDIRECT\TPFNF7SP.exe" [2009-08-03 62240]
"TPHOTKEY"="c:\program files\Lenovo\HOTKEY\TPOSDSVC.exe" [2009-03-13 68976]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2009-09-09 176128]
"TpShocks"="TpShocks.exe" [2009-12-11 337256]
"EZEJMNAP"="c:\progra~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2008-10-08 256576]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-14 13549568]
"nwiz"="nwiz.exe" [2009-01-14 1630208]
"TVT Scheduler Proxy"="c:\program files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe" [2008-03-04 487424]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2006-02-02 122940]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"AwaySch"="c:\program files\Lenovo\AwayTask\AwaySch.EXE" [2006-11-07 91688]
"LPManager"="c:\progra~1\THINKV~1\PrdCtr\LPMGR.exe" [2009-07-23 185688]
"AMSG"="c:\progra~1\THINKV~1\AMSG\Amsg.exe" [2009-09-03 436800]
"DiskeeperSystray"="c:\program files\Diskeeper Corporation\Diskeeper\DkIcon.exe" [2006-05-18 196696]
"ACTray"="c:\program files\ThinkPad\ConnectUtilities\ACTray.exe" [2009-12-10 431464]
"ACWLIcon"="c:\program files\ThinkPad\ConnectUtilities\ACWLIcon.exe" [2009-12-10 181608]
"cssauth"="c:\program files\Lenovo\Client Security Solution\cssauth.exe" [2007-08-03 2630968]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-02-16 282624]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-02-06 2021400]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2008-04-24 1036288]
"LENOVO.TPFNF6R"="c:\program files\Lenovo\HOTKEY\TPFNF6R.exe" [2009-08-20 62752]
"TPKMAPHELPER"="c:\program files\ThinkPad\Utilities\TpKmapAp.exe" [2007-01-09 868352]
"LPMailChecker"="c:\progra~1\THINKV~1\PrdCtr\LPMLCHK.exe" [2009-07-23 124248]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-01-14 86016]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-4-5 113664]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-24 29696]
Akceler tor spuçtŘnˇ AutoCADu.lnk - c:\program files\Common Files\Autodesk Shared\acstart17.exe [2006-3-5 11000]
Bluetooth.lnk - c:\program files\ThinkPad\Bluetooth Software\BTTray.exe [2007-2-27 561213]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2009-11-28 50688]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2006-12-20 77824]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 10:41 294912 ------w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
2009-12-01 12:41 100104 ----a-w- c:\program files\ThinkVantage Fingerprint Software\psqlpwd.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2]
2006-09-06 07:37 34344 ------w- c:\program files\Lenovo\HOTKEY\notifyf2.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"c:\\Program Files\\ICQ6\\ICQ.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\monitor.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\manager.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\server.exe"=
"c:\\Program Files\\Autodesk\\VIZ2008\\3dsviz.exe"=
"c:\\Program Files\\Autodesk\\3ds Max 2009\\3dsmax.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutLauncher.exe"=
"c:\\Program Files\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutConfigTool.exe"=
"c:\\Program Files\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutParadise.exe"=

R0 DozeHDD;DozeHDD;c:\windows\system32\drivers\DOZEHDD.SYS [9.2.2010 17:19 24304]
R0 TPDIGIMN;TPDIGIMN;c:\windows\system32\drivers\ApsHM86.sys [9.10.2009 12:10 20520]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [6.2.2009 14:23 106208]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [29.2.2008 15:03 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [29.2.2008 15:03 51440]
R2 DozeSvc;Lenovo Doze Mode Service;c:\program files\ThinkPad\Utilities\DOZESVC.EXE [9.2.2010 17:19 132456]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [6.2.2009 14:23 727720]
R2 mi-raysat_3dsMax2009_32;mental ray 3.6 Satellite for Autodesk 3ds Max Design 2009 32-bit 32-bit;c:\program files\Autodesk\3ds Max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe [9.3.2008 23:04 65536]
R2 mi-raysat_VIZ2008_32;mental ray 3.5 Satellite for Autodesk VIZ 2008;c:\program files\Autodesk\VIZ2008\mentalray\satellite\raysat_VIZ2008_32server.exe [7.3.2007 14:32 65536]
R2 Power Manager DBC Service;Power Manager DBC Service;c:\program files\ThinkPad\Utilities\PWMDBSVC.exe [28.11.2009 16:09 53248]
R2 smihlp2;SMI Helper Driver (smihlp2);c:\program files\ThinkVantage Fingerprint Software\smihlp.sys [13.3.2009 13:47 12560]
R2 TPHKSVC;On Screen Display;c:\program files\Lenovo\HOTKEY\TPHKSVC.exe [9.7.2007 7:23 62320]
R2 TVT Backup Protection Service;TVT Backup Protection Service;c:\program files\Lenovo\Rescue and Recovery\rrpservice.exe [12.7.2007 1:38 569344]
R2 VRaySpawner 2009;VRaySpawner 2009;c:\program files\Autodesk\3ds Max 2009\vrayspawner2009.exe [3.11.2009 13:44 159744]
R3 TVTI2C;Lenovo SM bus driver;c:\windows\system32\drivers\tvti2c.sys [22.5.2007 15:59 30336]
S2 gupdate1ca315e9abd1410;Služba Google Update (gupdate1ca315e9abd1410);c:\program files\Google\Update\GoogleUpdate.exe [9.9.2009 16:02 133104]
S2 LENOVO.MICMUTE;Lenovo Microphone Mute;c:\program files\Lenovo\HOTKEY\micmute.exe [28.11.2009 16:02 45424]
S3 ICDUSB;Sony IC Recorder;c:\windows\system32\drivers\icdusb.sys [20.2.2009 18:01 26301]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [16.2.2006 15:51 4096]
.
Obsah adresáře 'Naplánované úlohy'

2010-02-18 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-02-12 13:54]

2010-02-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-09 15:02]

2010-02-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-09 15:02]

2009-12-04 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job
- c:\program files\PC-Doctor\pcdlauncher.exe [2009-11-20 10:12]

2010-02-18 c:\windows\Tasks\PMTask.job
- c:\progra~1\ThinkPad\UTILIT~1\PWMIDTSK.EXE [2008-03-08 00:12]

2010-02-17 c:\windows\Tasks\SystemToolsDailyTest.job
- c:\program files\PC-Doctor\pcdr5cuiw32.exe [2009-11-22 09:14]
.
.
------- Doplňkový sken -------
.
uStart Page = www.seznam.cz
uSearchURL,(Default) = hxxp://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\translat\WEBIE.DLL
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\translat\WEBIE.DLL
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\translat\WEBIE.DLL
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\translat\WEBIE.DLL
FF - ProfilePath - c:\documents and settings\Pavel\Data aplikací\Mozilla\Firefox\Profiles\4mei9fl9.default\
FF - prefs.js: browser.startup.homepage - www.seznam.cz
FF - prefs.js: network.proxy.type - 4
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Picasa2\npPicasa3.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

HKCU-Run-WEBTRAN - (no file)
HKCU-Run-OEXPRESS - (no file)
Notify-ACNotify - ACNotify.dll



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-18 14:41
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(1580)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\program files\ThinkPad\ConnectUtilities\ACNotify.dll
c:\program files\ThinkPad\ConnectUtilities\AcSvcStub.dll
c:\program files\ThinkPad\ConnectUtilities\AcLocSettings.dll
c:\program files\ThinkPad\ConnectUtilities\ACHelper.dll
c:\program files\ThinkVantage Fingerprint Software\psqlpwd.dll
c:\program files\ThinkVantage Fingerprint Software\homefus2.dll
c:\program files\ThinkVantage Fingerprint Software\infql2.dll
c:\program files\ThinkVantage Fingerprint Software\homepass.dll
c:\program files\ThinkVantage Fingerprint Software\bio.dll
c:\program files\ThinkVantage Fingerprint Software\qlbase.dll
c:\program files\ThinkVantage Fingerprint Software\ps2css.dll

- - - - - - - > 'explorer.exe'(3840)
c:\program files\RocketDock\RocketDock.dll
c:\program files\Lenovo\Client Security Solution\tvtpwm_windows_hook.dll
c:\program files\Lenovo\Client Security Solution\tvt_passwordmanager.dll
c:\program files\Lenovo\Client Security Solution\css_banner.dll
c:\program files\Lenovo\Client Security Solution\csswait.dll
c:\windows\system32\cssuserdatadispatcher.dll
c:\program files\Lenovo\Client Security Solution\css_dlgcustompolicy.dll
c:\windows\system32\tvttsp.dll
c:\windows\system32\tcsrpc.dll
c:\program files\Common Files\Lenovo\tvt_think_res.dll
c:\program files\Lenovo\Client Security Solution\css_think_res.dll
c:\windows\system32\btmmhook.dll
c:\progra~1\WINDOW~1\wmpband.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\ibmpmsvc.exe
c:\program files\ThinkPad\Bluetooth Software\bin\btwdins.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\windows\system32\IPSSVC.EXE
c:\program files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
c:\program files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
c:\windows\system32\DRIVERS\CDANTSRV.EXE
c:\program files\Diskeeper Corporation\Diskeeper\DkService.exe
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
c:\windows\system32\TpKmpSVC.exe
c:\program files\Lenovo\Client Security Solution\tvttcsd.exe
c:\program files\Lenovo\Rescue and Recovery\rrservice.exe
c:\program files\Common Files\Lenovo\Scheduler\tvtsched.exe
c:\program files\Lenovo\Rescue and Recovery\ADM\IUService.exe
c:\windows\system32\SearchIndexer.exe
c:\program files\Autodesk\3ds Max 2009\3dsmax.exe
c:\program files\ThinkPad\ConnectUtilities\AcSvc.exe
c:\program files\lenovo\system update\suservice.exe
c:\windows\TEMP\AdskCleanup.0001
c:\program files\Windows Media Player\WMPNetwk.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\Common Files\Lenovo\Logger\logmon.exe
c:\program files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\TpShocks.exe
c:\program files\Lenovo\HOTKEY\TPONSCR.exe
c:\program files\Lenovo\Zoom\TpScrex.exe
c:\program files\Apoint2K\ApMsgFwd.exe
c:\program files\Apoint2K\Apntex.exe
c:\program files\Intel\Wireless\Bin\Dot1XCfg.exe
c:\windows\system32\RUNDLL32.EXE
c:\program files\Lenovo\Client Security Solution\tvtpwm_tray.exe
c:\program files\Common Files\Autodesk Shared\WSCommCntr1.exe
c:\windows\system32\SearchProtocolHost.exe
c:\windows\system32\SearchFilterHost.exe
.
**************************************************************************
.
Celkový čas: 2010-02-18 14:51:44 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-02-18 13:51
ComboFix2.txt 2009-11-28 18:04

Před spuštěním: Volných bajtů: 43 100 483 584
Po spuštění: Volných bajtů: 43 055 828 992

- - End Of File - - DE38A7BD350529B151D485D47BAFB497
Nahoru
Uživatelský avatar
mahajana
Vzorný návštěvník
Vzorný návštěvník
Příspěvky: 308
Registrován: 15 led 2010 16:08

Re: prosím o kontolu Logu, Win32/Rootkit.Kryptik.AF trojský kůň

#11 Příspěvek od mahajana »

Zdravím, prosím o kontrolu logu, včera večer, při návštěvě webu http://www.********.com/**********/index.php mi rezidentní štít Eset smart security začal detekovat napadení počítače viry. Současně se i v tray oblasti zobrazila hláška s požadavkem na update Javy. Možná je to všechno jen náhoda, ale je možné, že to všechno spolu souvisí.

já jenom nahoda to není :) tu adresu radeji smazte bo se najde par cvocku co na to klikne :lol: :) je tam trojsky brutalni koníček :turned:
Naposledy upravil(a) mahajana dne 18 úno 2010 15:01, celkem upraveno 2 x.
Nahoru
Uživatelský avatar
JaRon
Moderátor
Moderátor
Příspěvky: 15691
Registrován: 29 bře 2005 13:39
Bydliště: BB-SK

Re: prosím o kontolu Logu, Win32/Rootkit.Kryptik.AF trojský kůň

#12 Příspěvek od JaRon »

teoreticky OK, ale preventivne prescanuj PC s CureIT
FRST |ADWCleaner |MBAM |CCleaner |AVPTool

V prípade spokojnosti je možné podporiť fórum https://platba.viry.cz/payment/
Nahoru
olegunar
Návštěvník
Návštěvník
Příspěvky: 18
Registrován: 21 črc 2008 13:15

Re: prosím o kontolu Logu, Win32/Rootkit.Kryptik.AF trojský kůň

#13 Příspěvek od olegunar »

jasan mažu ;)
Nahoru
olegunar
Návštěvník
Návštěvník
Příspěvky: 18
Registrován: 21 črc 2008 13:15

Re: prosím o kontolu Logu, Win32/Rootkit.Kryptik.AF trojský kůň

#14 Příspěvek od olegunar »

to JaRon:

OK, jdu na to, ale trvá to hooodně dlouho...potom se ozvu s výsledkama ;) Prozatím opravdu díky, hlavně za Vaši rychlost!! :)

Btw: není potřeba ještě mimo jiné odstranit Combofix??
Nahoru
olegunar
Návštěvník
Návštěvník
Příspěvky: 18
Registrován: 21 črc 2008 13:15

Re: prosím o kontolu Logu, Win32/Rootkit.Kryptik.AF trojský kůň

#15 Příspěvek od olegunar »

takže pomocí CurelT spuštěno expres skenování - bez nalezené infiltrace. Nyní probíhá kompletní skenování, zatím taky čisto. Vypadá to už vcelku slibně ;)

Bude teda ještě následovat nějaký postup, třeba ten uninstal CF? :)
Nahoru
Odpovědět

Zpět na „Řešení problémů, logy“