prosím o kontrolu. nevím si rady s winlogon.exe

[fredik]

Pokud máš ještě problémy tak proveď následující postup:

#1. krok:
Jdi přes Start -> Spustit... a napiš do okna tento příkaz označený modře ComboFix /u (mezi comobofix a /u musí být mezera) a dej Ok.

#2. krok:
Stáhni si a spusť T-cleaner, odstraní zálohy a pozůstatky použitých programů.

#3. krok:
Stáhni si znovu ComboFix a dej sem z něho nový log.

[Reklama]

[ivo.hriso]

odinstaloval jsem Comba fix, použil T- cleaner, znuvu nainstaloval Combofix a posílám log.


ComboFix 08-03-14.4 - User 2008-03-17 15:55:15.12 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1029.18.1414 [GMT 1:00]
Running from: C:\Documents and Settings\User\Plocha\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-02-17 to 2008-03-17 )))))))))))))))))))))))))))))))
.

2008-03-17 15:44 . 2008-03-17 15:44 11,776 --a------ C:\WINDOWS\system32\WLCtrl32.dl_
2008-03-17 15:40 . 2008-03-17 15:40 241 --a------ C:\Documents and Settings\User\SR.vbs
2008-03-14 17:20 . 2008-03-14 18:10 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-03-14 17:20 . 2008-03-14 17:20 <DIR> d-------- C:\Documents and Settings\User\Data aplikací\SUPERAntiSpyware.com
2008-03-14 17:20 . 2008-03-14 17:20 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\SUPERAntiSpyware.com
2008-03-14 17:19 . 2008-03-14 17:19 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-03-13 22:41 . 2008-03-13 22:41 <DIR> d-------- C:\Program Files\VirusTotalUploader
2008-03-13 19:25 . 2008-03-17 14:25 11,776 --a------ C:\WINDOWS\system32\WLCtrl32.dll
2008-03-11 22:14 . 2008-03-11 22:20 <DIR> d-------- C:\Program Files\RegCleaner
2008-03-11 16:38 . 2008-03-11 16:38 <DIR> d-------- C:\Program Files\Alwil Software
2008-03-11 16:38 . 2007-12-04 14:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe
2008-03-11 16:38 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2008-03-11 16:38 . 2007-12-04 13:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2008-03-11 16:38 . 2007-12-04 15:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2008-03-11 16:38 . 2007-12-04 15:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2008-03-11 16:38 . 2007-12-04 15:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2008-03-11 16:38 . 2007-12-04 15:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2008-03-11 16:38 . 2007-12-04 15:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2008-03-10 17:47 . 2008-03-13 15:19 <DIR> d-------- C:\Documents and Settings\Administrator\Plocha
2008-03-10 17:47 . 2006-11-24 15:03 <DIR> d--h----- C:\Documents and Settings\Administrator\Okolní tiskárny
2008-03-10 17:47 . 2006-11-24 15:03 <DIR> d--h----- C:\Documents and Settings\Administrator\Okolní síť
2008-03-10 17:47 . 2006-11-24 15:03 <DIR> d-------- C:\Documents and Settings\Administrator\Oblíbené položky
2008-03-10 17:47 . 2006-11-24 14:13 <DIR> d--h----- C:\Documents and Settings\Administrator\Šablony
2008-03-10 17:47 . 2006-11-24 15:03 <DIR> dr------- C:\Documents and Settings\Administrator\Nabídka Start
2008-03-10 17:47 . 2006-11-24 15:03 <DIR> d-------- C:\Documents and Settings\Administrator\Dokumenty
2008-03-10 17:47 . 2006-11-24 15:03 <DIR> dr-h----- C:\Documents and Settings\Administrator\Data aplikací
2008-03-09 12:38 . 2008-03-10 22:22 <DIR> d-------- C:\Program Files\WinClamAVShield
2008-03-09 12:20 . 2008-03-09 12:20 <DIR> d-------- C:\searchplugins
2008-03-09 12:20 . 2008-03-09 12:20 <DIR> d-------- C:\Program Files\Crawler
2008-03-09 12:19 . 2008-03-10 05:29 <DIR> d-------- C:\Program Files\Spyware Terminator
2008-03-09 12:19 . 2008-03-11 23:20 <DIR> d-------- C:\Documents and Settings\User\Data aplikací\Spyware Terminator
2008-03-09 12:19 . 2008-03-10 04:48 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\Spyware Terminator
2008-03-09 12:19 . 2008-03-09 12:19 138,752 --a------ C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
2008-03-09 05:22 . 2008-03-09 05:22 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-03-09 05:22 . 2008-03-09 05:22 1,409 --a------ C:\WINDOWS\QTFont.for
2008-03-02 21:02 . 2008-03-02 21:02 <DIR> d-------- C:\Program Files\CCleaner
2008-03-02 19:21 . 2008-03-02 19:22 <DIR> d-------- C:\WINDOWS\ERUNT
2008-03-02 19:20 . 2008-03-15 19:32 135,486 --a------ C:\WINDOWS\system32\drivers\fwdrv.err
2008-03-02 18:48 . 2008-03-02 18:49 1,312,273 --a------ C:\default
2008-03-02 17:18 . 2008-03-02 17:18 <DIR> d-------- C:\Program Files\Sunbelt Software
2008-03-02 16:36 . 2008-03-17 15:44 26,624 --a------ C:\WINDOWS\system32\drivers\Fms64.sys
2008-03-02 16:19 . 2008-03-02 16:19 <DIR> d-------- C:\Program Files\Ashampoo
2008-03-01 14:16 . 2008-03-02 14:38 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-03-01 13:47 . 2008-03-01 13:47 <DIR> d-------- C:\Program Files\MagicISO
2008-02-27 15:52 . 2008-02-27 15:52 <DIR> d-------- C:\Documents and Settings\User\Data aplikací\DassaultSystemes
2008-02-27 15:52 . 2008-02-27 15:52 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\DassaultSystemes
2008-02-27 15:51 . 2008-02-27 15:51 <DIR> d-------- C:\Documents and Settings\User\Data aplikací\SolidWorks 2008
2008-02-27 15:48 . 2008-02-27 15:48 <DIR> d-------- C:\Documents and Settings\User\Data aplikací\SolidWorks
2008-02-27 15:45 . 2008-02-27 15:45 <DIR> d-------- C:\Documents and Settings\User\Data aplikací\DWGeditor
2008-02-27 15:45 . 2008-02-27 15:45 0 --a------ C:\WINDOWS\eDrawingOfficeAutomator.INI
2008-02-27 15:43 . 2008-02-27 15:58 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-02-27 15:39 . 2008-02-27 15:39 <DIR> d-------- C:\WINDOWS\system32\GroupPolicy
2008-02-27 15:39 . 2008-02-27 16:02 <DIR> d-------- C:\Program Files\Common Files\SolidWorks Shared
2008-02-27 15:39 . 2008-02-27 15:39 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\SolidWorks
2008-02-27 15:38 . 2008-02-27 15:38 <DIR> d-------- C:\Program Files\Windows Desktop Search
2008-02-27 15:13 . 2008-02-27 15:13 <DIR> d-------- C:\Program Files\MSBuild
2008-02-27 15:11 . 2008-02-27 15:11 <DIR> d-------- C:\WINDOWS\system32\XPSViewer
2008-02-27 15:10 . 2008-02-27 15:10 <DIR> d-------- C:\Program Files\Reference Assemblies
2008-02-27 15:09 . 2008-02-27 15:09 <DIR> d-------- C:\Program Files\MSECache
2008-02-27 14:55 . 2008-02-27 14:55 <DIR> d-------- C:\Program Files\PowerISO
2008-02-21 21:40 . 2008-03-02 17:53 <DIR> d-------- C:\Program Files\Opera

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-17 14:49 --------- d-----w C:\Documents and Settings\User\Data aplikací\Skype
2008-03-17 13:25 --------- d-----w C:\Documents and Settings\User\Data aplikací\uTorrent
2008-03-16 18:32 --------- d-----w C:\Documents and Settings\User\Data aplikací\temp
2008-03-13 14:20 --------- d-----w C:\Documents and Settings\User\Data aplikací\AVG7
2008-03-13 14:20 --------- d-----w C:\Documents and Settings\All Users\Data aplikací\avg7
2008-03-09 16:24 --------- d-----w C:\Program Files\ElcomSoft
2008-03-09 04:22 --------- d-----w C:\Program Files\QuickTime
2008-03-01 16:07 669,184 ----a-w C:\WINDOWS\system32\pbsvc.exe
2008-03-01 16:07 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-03-01 16:07 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-03-01 16:07 22,328 ----a-w C:\Documents and Settings\User\Data aplikací\PnkBstrK.sys
2008-03-01 16:07 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-02-27 15:03 --------- d-----w C:\Program Files\SpeedFan
2008-02-27 14:55 --------- d-----w C:\Program Files\Software2000
2008-02-17 22:53 --------- d-----w C:\Program Files\Cool CENZURA
2008-02-12 01:12 --------- d-----w C:\Documents and Settings\User\Data aplikací\CoolFlvMan
2008-02-12 00:09 --------- d-----w C:\Documents and Settings\User\Data aplikací\CoolYouTubeDownloader
2008-02-08 19:08 --------- d-----w C:\Documents and Settings\User\Data aplikací\gtk-2.0
2008-02-07 20:15 --------- d-----w C:\Program Files\EA SPORTS
2008-02-06 20:19 --------- d-----w C:\Program Files\Electronic Arts
2008-02-06 19:38 --------- d-----w C:\Program Files\totalcmd
2008-02-03 19:48 278,984 ----a-w C:\WINDOWS\system32\drivers\atksgt.sys
2008-02-03 19:48 --------- d-----w C:\Program Files\Zaklínač
2008-02-03 19:39 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-31 16:54 --------- d-----w C:\Program Files\THQ
2008-01-27 21:56 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-01-26 23:31 --------- d-----w C:\Program Files\uTorrent
2008-01-20 07:07 33,292 ----a-w C:\WINDOWS\system32\drivers\scdemu.sys
2008-01-16 16:20 52,736 ----a-w C:\WINDOWS\ipuninst.exe
2008-01-02 10:13 197,120 ----a-w C:\WINDOWS\system32\FHMcom_OxleyStrip.scr
2007-09-23 21:32 4,687,304 ----a-w C:\Program Files\paradisepoker_com_cs.exe
2007-01-14 21:00 1 ----a-w C:\Documents and Settings\User\SI.bin
2005-08-08 00:41 35,328 ----a-w C:\Program Files\usb_format.exe
2002-05-27 08:25 295,424 ----a-w C:\Program Files\SubtitleToolCZ.exe
.

((((((((((((((((((((((((((((( snapshot@2008-03-17_15.50.05,04 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-03-17 13:25:43 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_f0.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 13:00 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24 1694208]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2006-12-18 17:32 25365032]
"pdfSaver3"="c:\Program Files\PDF\pdfSaver\pdfSaver3.exe" [2004-05-19 14:29 385024]
"uTorrent"="C:\Program Files\uTorrent\utorrent.exe" [2008-01-26 18:02 219952]
"QIP2005"="C:\Program Files\QIP\qip.exe" [2007-11-16 14:17 3264512]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-21 14:06 1318912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SkyTel"="SkyTel.EXE" [2006-05-16 11:04 2879488 C:\WINDOWS\SkyTel.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-11 14:43 7630848]
"nwiz"="nwiz.exe" [2006-08-11 14:43 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-08-11 14:43 86016]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-28 07:54 16248320 C:\WINDOWS\RTHDCPL.exe]
"pdfSaver3"="" []
"602PC SUITE PDF Saver"="C:\Program Files\Common Files\602phs\pdfSaver.exe" [2005-08-31 16:00 49152]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2005-10-18 10:58 278528]
"tsnpstd3"="C:\WINDOWS\tsnpstd3.exe" [2006-07-07 15:04 262144]
"snpstd3"="C:\WINDOWS\vsnpstd3.exe" [2006-09-18 14:12 843776]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2008-01-20 08:05 217088]
"SpywareTerminator"="C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe" [2008-03-09 12:19 2957824]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 13:00 15360]

C:\Documents and Settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Mˇstnˇ vyhled v nˇ.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe [2007-02-05 15:40:46 118784]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2007-02-05 15:39 294400]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WLCtrl32]
WLCtrl32.dll 2008-03-17 14:25 11776 C:\WINDOWS\system32\WLCtrl32.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\uTorrent\\utorrent.exe"=
"C:\\Program Files\\QIP\\qip.exe"=
"C:\\Program Files\\Sunbelt Software\\Personal Firewall\\kpf4gui.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2007-02-20 13:34]
R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2007-02-20 13:34]
R1 sp_rsdrv2;Spyware Terminator Driver 2;C:\WINDOWS\system32\drivers\sp_rsdrv2.sys [2008-03-09 12:19]
R3 PSched;Plánovač paketů technologie QoS;C:\WINDOWS\system32\DRIVERS\psched.sys [2006-03-02 13:00]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB;C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 23:08]
R3 usbohci;Ovladač Miniport otevřeného hostitelského řadiče Microsoft USB;C:\WINDOWS\system32\DRIVERS\usbohci.sys [2006-03-02 13:00]
S3 hamachi_oem;PlayLinc Adapter;C:\WINDOWS\system32\DRIVERS\gan_adapter.sys [2006-08-28 23:54]
S3 SetupNTGLM7X;SetupNTGLM7X;D:\NTGLM7X.sys []
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{23146296-69c9-11dc-a3cc-001617ba045b}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-17 15:58:29
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\ASFWHide]
"ImagePath"="\??\C:\DOCUME~1\User\LOCALS~1\Temp\ASFWHide"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\WLCtrl32.dll
.
Completion time: 2008-03-17 16:00:07
ComboFix2.txt 2008-03-17 14:51:01
.
2008-03-11 22:22:05 --- E O F ---

[fredik]

Vytvoř si nový CFScript a tentokrát vlož do něho toto a použij ho stejným způsobem jak bylo napsáno:

Kód: Vybrat vše

Suspect::
C:\WINDOWS\system32\drivers\Fms64.sys

Po proběhnutí se ti objeví log, není potřeba ho sem vkládat, ale na ploše se ti vytvoří soubor Submit(Datum+Čas).zip, vlož ho jako přílohu ke svému dalšímu příspěvku.

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

Pošli ještě log z DSS:
Stáhni si Deckard's System Scanner (DSS) a ulož si ho na plochu
Jdi přes Start -> Spustit... a napiš do okna tento příkaz označený modře:
"%userprofile%\plocha\dss.exe" /config
- Otevře se ti okna kde v sekci Main Log zruš všechny zatržené položky a nech zatržené/zatrhni jen tyto dvě položky označené tučně (ostatní části nech jak jsou):

Drivers
Services

- Pak dole klikni na tlačítko Scan!
Za chvíli se ti objeví log main.txt tak sem vlož jeho obsah (jinak ho najdeš zde: C:\Deckard\System Scanner\main.txt)

[ivo.hriso]

Trošku jsem chyboval při postupu, kdy jsem Deckard spustil nechtěně z plochy. napodruhé, již dle návodu a posílám main.txt plus soubor submit.


Deckard's System Scanner v20071014.68
Run by User on 2008-03-20 15:34:52
Computer is in Normal Mode.
--------------------------------------------------------------------------------



-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R0 ACPI (Microsoft ACPI Driver) - c:\windows\system32\drivers\acpi.sys <Not Verified; Microsoft Corporation; Operační systém Microsoft® Windows®>
R0 atapi (Standardní řadič disku IDE/ESDI) - c:\windows\system32\drivers\atapi.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R0 Disk (Ovladač disku) - c:\windows\system32\drivers\disk.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R0 FltMgr - c:\windows\system32\drivers\fltmgr.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R0 Ftdisk (Ovladač správce svazků) - c:\windows\system32\drivers\ftdisk.sys <Not Verified; Microsoft Corporation; Operační systém Microsoft® Windows®>
R0 giveio - c:\windows\system32\giveio.sys
R0 isapnp (Řadič Plug and Play sběrnice ISA/EISA) - c:\windows\system32\drivers\isapnp.sys <Not Verified; Microsoft Corporation; Operační systém Microsoft® Windows®>
R0 KSecDD - c:\windows\system32\drivers\ksecdd.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R0 MountMgr - c:\windows\system32\drivers\mountmgr.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R0 Mup (Služba Multiple UNC Provider) - c:\windows\system32\drivers\mup.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R0 NDIS (Systémový ovladač NDIS) - c:\windows\system32\drivers\ndis.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R0 ohci1394 (Hostitelský řadič IEEE 1394 dle standardu OHCI VIA) - c:\windows\system32\drivers\ohci1394.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R0 PartMgr - c:\windows\system32\drivers\partmgr.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R0 PCI (Řadič sběrnice PCI) - c:\windows\system32\drivers\pci.sys <Not Verified; Microsoft Corporation; Operační systém Microsoft® Windows®>
R0 PCIIde - c:\windows\system32\drivers\pciide.sys <Not Verified; Microsoft Corporation; Operační systém Microsoft® Windows®>
R0 speedfan - c:\windows\system32\speedfan.sys <Not Verified; Windows (R) 2000 DDK provider; Windows (R) 2000 DDK driver>
R0 sr (Ovladač filtru Obnovy systému) - c:\windows\system32\drivers\sr.sys <Not Verified; Microsoft Corporation; Operační systém Microsoft® Windows®>
R0 VolSnap - c:\windows\system32\drivers\volsnap.sys <Not Verified; Microsoft Corporation; Operační systém Microsoft® Windows®>
R1 Aavmker4 (avast! Asynchronous Virus Monitor) - c:\windows\system32\drivers\aavmker4.sys <Not Verified; ALWIL Software; avast! Antivirus System>
R1 AFD - c:\windows\system32\drivers\afd.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R1 AmdK8 (AMD Processor Driver) - c:\windows\system32\drivers\amdk8.sys <Not Verified; Advanced Micro Devices; AMD Processor Driver>
R1 aswTdi (avast! Network Shield Support) - c:\windows\system32\drivers\aswtdi.sys <Not Verified; ALWIL Software; avast! Antivirus System>
R1 Beep - c:\windows\system32\drivers\beep.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R1 Cdrom (Ovladač jednotky CD-ROM) - c:\windows\system32\drivers\cdrom.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R1 Fips - c:\windows\system32\drivers\fips.sys <Not Verified; Microsoft Corporation; Operační systém Microsoft® Windows®>
R1 fwdrv (Firewall Driver) - c:\windows\system32\drivers\fwdrv.sys <Not Verified; Sunbelt Software; Sunbelt Firewall Engine>
R1 i8042prt (i8042 Keyboard and PS/2 Mouse Port Driver) - c:\windows\system32\drivers\i8042prt.sys <Not Verified; Microsoft Corporation; Operační systém Microsoft® Windows®>
R1 Imapi (CD-Burning Filter Driver) - c:\windows\system32\drivers\imapi.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R1 IPSec (Ovladač IPSEC) - c:\windows\system32\drivers\ipsec.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R1 Kbdclass (Ovladač třídy klávesnic) - c:\windows\system32\drivers\kbdclass.sys <Not Verified; Microsoft Corporation; Operační systém Microsoft® Windows®>
R1 kbdhid (Ovladač klávesnice standardu HID) - c:\windows\system32\drivers\kbdhid.sys <Not Verified; Microsoft Corporation; Operační systém Microsoft® Windows®>
R1 khips (Kerio HIPS Driver) - c:\windows\system32\drivers\khips.sys <Not Verified; Sunbelt Software; Sunbelt Firewall Engine>
R1 mnmdd - c:\windows\system32\drivers\mnmdd.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R1 Mouclass (Ovladač třídy myší) - c:\windows\system32\drivers\mouclass.sys <Not Verified; Microsoft Corporation; Operační systém Microsoft® Windows®>
R1 MRxSmb - c:\windows\system32\drivers\mrxsmb.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R1 Msfs - c:\windows\system32\drivers\msfs.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R1 NetBIOS (Rozhraní NetBIOS) - c:\windows\system32\drivers\netbios.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R1 NetBT (Rozhraní NetBios nad protokolem TCP/IP) - c:\windows\system32\drivers\netbt.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R1 Npfs - c:\windows\system32\drivers\npfs.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R1 Null - c:\windows\system32\drivers\null.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R1 RasAcd (Ovladač automatického připojení pomocí vzdáleného přístupu) - c:\windows\system32\drivers\rasacd.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R1 Rdbss - c:\windows\system32\drivers\rdbss.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R1 RDPCDD - c:\windows\system32\drivers\rdpcdd.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R1 redbook (Digital CD Audio Playback Filter Driver) - c:\windows\system32\drivers\redbook.sys <Not Verified; Microsoft Corporation; Operační systém Microsoft® Windows®>
R1 SASDIFSV - c:\program files\superantispyware\sasdifsv.sys
R1 SASKUTIL - c:\program files\superantispyware\saskutil.sys
R1 SCDEmu - c:\windows\system32\drivers\scdemu.sys <Not Verified; PowerISO Computing, Inc.; scdemu>
R1 Serial (Ovladač sériového portu) - c:\windows\system32\drivers\serial.sys <Not Verified; Microsoft Corporation; Operační systém Microsoft® Windows®>
R1 sp_rsdrv2 (Spyware Terminator Driver 2) - c:\windows\system32\drivers\sp_rsdrv2.sys
R1 Tcpip (Ovladač protokolu TCP/IP) - c:\windows\system32\drivers\tcpip.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R1 TermDD (Ovladač terminálového zařízení) - c:\windows\system32\drivers\termdd.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R1 VgaSave - c:\windows\system32\drivers\vga.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R2 aswMon2 (avast! Standard Shield Support) - c:\windows\system32\drivers\aswmon2.sys <Not Verified; ALWIL Software; avast! Antivirus System>
R2 atksgt - c:\windows\system32\drivers\atksgt.sys
R2 irda (Protokol IrDA) - c:\windows\system32\drivers\irda.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R2 lirsgt - c:\windows\system32\drivers\lirsgt.sys
R2 ParVdm - c:\windows\system32\drivers\parvdm.sys <Not Verified; Microsoft Corporation; Operační systém Microsoft® Windows®>
R2 Secdrv - c:\windows\system32\drivers\secdrv.sys <Not Verified; Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.; Macrovision SECURITY Driver>
R3 aswRdr - c:\windows\system32\drivers\aswrdr.sys <Not Verified; ALWIL Software; avast! Antivirus System>
R3 audstub (Prázdný zvukový ovladač) - c:\windows\system32\drivers\audstub.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R3 Fdc (Ovladač řadiče disketové jednotky) - c:\windows\system32\drivers\fdc.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R3 Flpydisk (Ovladač disketové jednotky) - c:\windows\system32\drivers\flpydisk.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R3 GEARAspiWDM - c:\windows\system32\drivers\gearaspiwdm.sys <Not Verified; GEAR Software Inc.; GEAR.wrks>
R3 Gpc (Obecné třídění paketů) - c:\windows\system32\drivers\msgpc.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R3 HDAudBus (Microsoft UAA Bus Driver for High Definition Audio) - c:\windows\system32\drivers\hdaudbus.sys <Not Verified; Windows (R) Server 2003 DDK provider; Microsoft® Windows® Operating System>
R3 HidUsb (Ovladač třídy standardu HID) - c:\windows\system32\drivers\hidusb.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R3 IntcAzAudAddService (Service for Realtek HD Audio (WDM)) - c:\windows\system32\drivers\rtkhdaud.sys <Not Verified; Realtek Semiconductor Corp.; Realtek(r) High Definition Audio Function Driver (HRTF data Copyright 1994 by MIT Media Lab)>
R3 IpNat (IP Network Address Translator) - c:\windows\system32\drivers\ipnat.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R3 IRENUM (Služba čítače výčtu IR) - c:\windows\system32\drivers\irenum.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R3 irsir (Microsoft Serial Infrared Driver) - c:\windows\system32\drivers\irsir.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R3 kmixer (Směšovač Microsoft Kernel Wave Audio Mixer) - c:\windows\system32\drivers\kmixer.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R3 kvpndev (Kerio VPN adapter) - c:\windows\system32\drivers\kvpndrv.sys <Not Verified; Kerio Technologies Inc.; Kerio VPN driver (x86)>
R3 kwflower (Kerio WinRoute Firewall Driver - Lower Layer) - c:\windows\system32\drivers\kwflower.sys <Not Verified; Kerio Technologies Inc.; Kerio WinRoute Firewall Driver - Lower Layer (x86)>
R3 mouhid (Ovladač myši standardu HID) - c:\windows\system32\drivers\mouhid.sys <Not Verified; Microsoft Corporation; Operační systém Microsoft® Windows®>
R3 MRxDAV (Přesměrovač klienta WebDav) - c:\windows\system32\drivers\mrxdav.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R3 mssmbios (Ovladač Microsoft System Management BIOS) - c:\windows\system32\drivers\mssmbios.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R3 NdisTapi (Ovladač Remote Access NDIS TAPI) - c:\windows\system32\drivers\ndistapi.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R3 Ndisuio (Protokol NDIS uživatelského režimu V/V) - c:\windows\system32\drivers\ndisuio.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R3 NdisWan (Ovladač Remote Access NDIS WAN) - c:\windows\system32\drivers\ndiswan.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R3 NDProxy (Služba NDIS Proxy) - c:\windows\system32\drivers\ndproxy.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R3 nv - c:\windows\system32\drivers\nv4_mini.sys <Not Verified; NVIDIA Corporation; NVIDIA Compatible Windows 2000 Miniport Driver, Version 91.47>
R3 NVENETFD (NVIDIA nForce Networking Controller Driver) - c:\windows\system32\drivers\nvenetfd.sys <Not Verified; NVIDIA Corporation; NVENETFD>
R3 nvnetbus (NVIDIA Network Bus Enumerator) - c:\windows\system32\drivers\nvnetbus.sys <Not Verified; NVIDIA Corporation; NVNETBUS>
R3 Parport (Ovladač paralelního portu) - c:\windows\system32\drivers\parport.sys <Not Verified; Microsoft Corporation; Operační systém Microsoft® Windows®>
R3 pfc (Padus ASPI Shell) - c:\windows\system32\drivers\pfc.sys <Not Verified; Padus, Inc.; Padus(R) ASPI Shell>
R3 PptpMiniport (WAN Miniport (PPTP)) - c:\windows\system32\drivers\raspptp.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R3 PSched (Plánovač paketů technologie QoS) - c:\windows\system32\drivers\psched.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R3 Ptilink (Direct Parallel Link Driver) - c:\windows\system32\drivers\ptilink.sys <Not Verified; Parallel Technologies, Inc.; Microsoft® Windows® Operating System>
R3 Rasirda (WAN Miniport (IrDA)) - c:\windows\system32\drivers\rasirda.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R3 Rasl2tp (WAN Miniport (L2TP)) - c:\windows\system32\drivers\rasl2tp.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R3 RasPppoe (Remote Access PPPOE Driver) - c:\windows\system32\drivers\raspppoe.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R3 Raspti (Přímé propojení paralelním kabelem) - c:\windows\system32\drivers\raspti.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R3 SASENUM - c:\program files\superantispyware\sasenum.sys <Not Verified; SuperAdBlocker, Inc.; SuperAntiSpyware>
R3 serenum (Ovladač filtru Serenum) - c:\windows\system32\drivers\serenum.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R3 SNPSTD3 (USB PC Camera (SNPSTD3)) - c:\windows\system32\drivers\snpstd3.sys <Not Verified; Sonix Co. Ltd.; USB PC Camera>
R3 Srv - c:\windows\system32\drivers\srv.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R3 swenum (Softwarový ovladač sběrnice) - c:\windows\system32\drivers\swenum.sys <Not Verified; Microsoft Corporation; Microsoft(R) Windows(R) Operating System>
R3 sysaudio (Microsoft Kernel System Audio Device) - c:\windows\system32\drivers\sysaudio.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R3 Update (Ovladač aktualizace mikrokódu) - c:\windows\system32\drivers\update.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R3 usbaudio (Ovladač zvukové karty USB (WDM)) - c:\windows\system32\drivers\usbaudio.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R3 usbccgp (Obecný nadřazený ovladač Microsoft USB) - c:\windows\system32\drivers\usbccgp.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R3 usbehci (Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0) - c:\windows\system32\drivers\usbehci.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R3 usbhub (Rozbočovač umožnující USB2) - c:\windows\system32\drivers\usbhub.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R3 usbohci (Ovladač Miniport otevřeného hostitelského řadiče Microsoft USB) - c:\windows\system32\drivers\usbohci.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R3 Wanarp (Ovladač Remote Access IP ARP) - c:\windows\system32\drivers\wanarp.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R3 wdmaud (Microsoft WINMM WDM Audio Compatibility Driver) - c:\windows\system32\drivers\wdmaud.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R4 Cdfs - c:\windows\system32\drivers\cdfs.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R4 Ntfs - c:\windows\system32\drivers\ntfs.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>

S0 sptd - c:\windows\system32\drivers\sptd.sys (file missing)
S1 Cdaudio - c:\windows\system32\drivers\cdaudio.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S1 Processor (Ovladač procesoru) - c:\windows\system32\drivers\processr.sys <Not Verified; Microsoft Corporation; Operační systém Microsoft® Windows®>
S1 Sfloppy - c:\windows\system32\drivers\sfloppy.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 aec (Microsoft Kernel Acoustic Echo Canceller) - c:\windows\system32\drivers\aec.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 Arp1394 (Protokol 1394 ARP Client) - c:\windows\system32\drivers\arp1394.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 ASFWHide - c:\docume~1\user\locals~1\temp\asfwhide (file missing)
S3 AsyncMac (Ovladač asynchronních médií připojení RAS) - c:\windows\system32\drivers\asyncmac.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 Atmarpc (Protokol ATM ARP Client) - c:\windows\system32\drivers\atmarpc.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 CCDECODE (Dekodér Closed Caption) - c:\windows\system32\drivers\ccdecode.sys <Not Verified; Microsoft Corporation; Microsoft(R) Windows(R) Operating System>
S3 DMusic (Syntezátor Microsoft Kernel DLS) - c:\windows\system32\drivers\dmusic.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 drmkaud (Microsoft Kernel DRM Audio Descrambler) - c:\windows\system32\drivers\drmkaud.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 GMSIPCI - d:\install\gmsipci.sys (file missing)
S3 hamachi_oem (PlayLinc Adapter) - c:\windows\system32\drivers\gan_adapter.sys <Not Verified; Applied Networking Inc.; Hamachi Virtual Network Interface Driver, OEM>
S3 HTTP - c:\windows\system32\drivers\http.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 Ip6Fw (Ovladač IPv6 brány firewall systému Windows) - c:\windows\system32\drivers\ip6fw.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 IpFilterDriver (IP Traffic Filter Driver) - c:\windows\system32\drivers\ipfltdrv.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 IpInIp (IP in IP Tunnel Driver) - c:\windows\system32\drivers\ipinip.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 kwfupper (Kerio WinRoute Firewall Driver - Upper Layer) - c:\windows\system32\drivers\kwfupper.sys <Not Verified; Kerio Technologies Inc.; Kerio WinRoute Firewall Driver - Upper Layer (x86)>
S3 Modem - c:\windows\system32\drivers\modem.sys <Not Verified; Microsoft Corporation; Operační systém Microsoft® Windows®>
S3 MSICPL - d:\install4\msicpl.sys (file missing)
S3 MSKSSRV (Microsoft Streaming Service Proxy) - c:\windows\system32\drivers\mskssrv.sys <Not Verified; Microsoft Corporation; Microsoft(R) Windows(R) Operating System>
S3 MSPCLOCK (Microsoft Streaming Clock Proxy) - c:\windows\system32\drivers\mspclock.sys <Not Verified; Microsoft Corporation; Microsoft(R) Windows(R) Operating System>
S3 MSPQM (Microsoft Streaming Quality Manager Proxy) - c:\windows\system32\drivers\mspqm.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 MSTEE (Microsoft Streaming Tee/Sink-to-Sink Converter) - c:\windows\system32\drivers\mstee.sys <Not Verified; Microsoft Corporation; Microsoft(R) Windows(R) Operating System>
S3 NABTSFEC (NABTS/FEC VBI Codec) - c:\windows\system32\drivers\nabtsfec.sys <Not Verified; Microsoft Corporation; Microsoft(R) Windows(R) Operating System>
S3 NdisIP (Microsoft TV/Video Connection) - c:\windows\system32\drivers\ndisip.sys <Not Verified; Microsoft Corporation; Microsoft(R) Windows(R) Operating System>
S3 NIC1394 (1394 Net Driver) - c:\windows\system32\drivers\nic1394.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 NTACCESS - d:\ntaccess.sys (file missing)
S3 NwlnkFlt (IPX Traffic Filter Driver) - c:\windows\system32\drivers\nwlnkflt.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 NwlnkFwd (IPX Traffic Forwarder Driver) - c:\windows\system32\drivers\nwlnkfwd.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 RDPWD - c:\windows\system32\drivers\rdpwd.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 ROOTMODEM (Microsoft Legacy Modem Driver) - c:\windows\system32\drivers\rootmdm.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 SetupNTGLM7X - d:\ntglm7x.sys (file missing)
S3 SLIP (BDA Slip De-Framer) - c:\windows\system32\drivers\slip.sys <Not Verified; Microsoft Corporation; Microsoft(R) Windows(R) Operating System>
S3 splitter (Microsoft Kernel Audio Splitter) - c:\windows\system32\drivers\splitter.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 streamip (BDA IPSink) - c:\windows\system32\drivers\streamip.sys <Not Verified; Microsoft Corporation; Microsoft(R) Windows(R) Operating System>
S3 swmidi (Microsoft Kernel GS Wavetable Synthesizer) - c:\windows\system32\drivers\swmidi.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 TDPIPE - c:\windows\system32\drivers\tdpipe.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 TDTCP - c:\windows\system32\drivers\tdtcp.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 USBSTOR (Ovladač velkokapacitního paměťového zařízení USB) - c:\windows\system32\drivers\usbstor.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 WSTCODEC (Dálnopisný kodek světového standardu) - c:\windows\system32\drivers\wstcodec.sys <Not Verified; Microsoft Corporation; Microsoft(R) Windows(R) Operating System>
S3 WudfPf (Windows Driver Foundation - User-mode Driver Framework Platform Driver) - c:\windows\system32\drivers\wudfpf.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 WudfRd (Windows Driver Foundation - User-mode Driver Framework Reflector) - c:\windows\system32\drivers\wudfrd.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S4 ACPIEC - c:\windows\system32\drivers\acpiec.sys <Not Verified; Microsoft Corporation; Operační systém Microsoft® Windows®>
S4 cbidf2k - c:\windows\system32\drivers\cbidf2k.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S4 dmboot - c:\windows\system32\drivers\dmboot.sys <Not Verified; Microsoft Corp., Veritas Software; VERITAS® NT Disk Manager>
S4 dmio - c:\windows\system32\drivers\dmio.sys <Not Verified; Microsoft Corp., Veritas Software; VERITAS® NT Disk Manager>
S4 dmload - c:\windows\system32\drivers\dmload.sys <Not Verified; Microsoft Corp., Veritas Software.; Logical Disk Manager for Windows NT>
S4 Fastfat - c:\windows\system32\drivers\fastfat.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S4 Pcmcia - c:\windows\system32\drivers\pcmcia.sys <Not Verified; Microsoft Corporation; Operační systém Microsoft® Windows®>
S4 Udfs - c:\windows\system32\drivers\udfs.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S4 WS2IFSL (Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS) - c:\windows\system32\drivers\ws2ifsl.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 aswUpdSv (avast! iAVS4 Control Service) - "c:\program files\alwil software\avast4\aswupdsv.exe" <Not Verified; ALWIL Software; avast! Antivirus>
R2 AudioSrv (Zvuk systému Windows) - c:\windows\system32\svchost.exe -k netsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R2 avast! Antivirus - "c:\program files\alwil software\avast4\ashserv.exe" <Not Verified; ALWIL Software; avast! Antivirus>
R2 BITS (Služba inteligentního přenosu na pozadí) - c:\windows\system32\svchost.exe -k netsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R2 Browser (Prohledávání počítačů) - c:\windows\system32\svchost.exe -k netsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R2 CryptSvc (Šifrování) - c:\windows\system32\svchost.exe -k netsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R2 DcomLaunch (Spouštěč procesů serveru DCOM) - c:\windows\system32\svchost -k dcomlaunch <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R2 Dhcp (Klient DHCP) - c:\windows\system32\svchost.exe -k netsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R2 Dnscache (Klient DNS) - c:\windows\system32\svchost.exe -k networkservice <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R2 ERSvc (Error Reporting Service) - c:\windows\system32\svchost.exe -k netsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R2 Eventlog (Protokol událostí) - c:\windows\system32\services.exe <Not Verified; Microsoft Corporation; Operační systém Microsoft® Windows®>
R2 helpsvc (Nápověda a odborná pomoc) - c:\windows\system32\svchost.exe -k netsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R2 Irmon (Sledování infračerveného přenosu) - c:\windows\system32\svchost.exe -k netsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R2 KPF4 (Sunbelt Kerio Personal Firewall 4) - "c:\program files\sunbelt software\personal firewall\kpf4ss.exe" <Not Verified; Sunbelt Software; Sunbelt Kerio Personal Firewall>
R2 lanmanserver (Server) - c:\windows\system32\svchost.exe -k netsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R2 lanmanworkstation (Pracovní stanice) - c:\windows\system32\svchost.exe -k netsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R2 LmHosts (Podpora rozhraní NetBIOS nad protokolem TCP/IP) - c:\windows\system32\svchost.exe -k localservice <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R2 NVSvc (NVIDIA Display Driver Service) - c:\windows\system32\nvsvc32.exe <Not Verified; NVIDIA Corporation; NVIDIA Driver Helper Service, Version 91.47>
R2 PlugPlay (Plug and Play) - c:\windows\system32\services.exe <Not Verified; Microsoft Corporation; Operační systém Microsoft® Windows®>
R2 PnkBstrA - c:\windows\system32\pnkbstra.exe
R2 PolicyAgent (Služby IPSEC) - c:\windows\system32\lsass.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R2 ProtectedStorage (Chráněné úložiště) - c:\windows\system32\lsass.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R2 RpcSs (Vzdálené volání procedur (RPC)) - c:\windows\system32\svchost -k rpcss <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R2 SamSs (Správce zabezpečení účtů) - c:\windows\system32\lsass.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R2 seclogon (Sekundární přihlašování) - c:\windows\system32\svchost.exe -k netsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R2 SENS (Oznamování systémových událostí) - c:\windows\system32\svchost.exe -k netsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R2 SharedAccess (Brána Firewall / Sdílení připojení k Internetu (ICS)) - c:\windows\system32\svchost.exe -k netsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R2 ShellHWDetection (Rozpoznávání hardwaru) - c:\windows\system32\svchost.exe -k netsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R2 Schedule (Plánovač úloh) - c:\windows\system32\svchost.exe -k netsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R2 sp_rssrv (Spyware Terminator Realtime Shield Service) - "c:\program files\spyware terminator\sp_rsser.exe" <Not Verified; Crawler.com; Crawler Spyware Terminator>
R2 Spooler (Zařazování tisku) - c:\windows\system32\spoolsv.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R2 srservice (Služba obnovení systému) - c:\windows\system32\svchost.exe -k netsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R2 stisvc (Načítání obrázků (WIA)) - c:\windows\system32\svchost.exe -k imgsvc <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R2 Themes (Motivy) - c:\windows\system32\svchost.exe -k netsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R2 TrkWks (Klient služby sledování distribuovaných propojení) - c:\windows\system32\svchost.exe -k netsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R2 W32Time (Systémový čas) - c:\windows\system32\svchost.exe -k netsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R2 WebClient (Webový klient) - c:\windows\system32\svchost.exe -k localservice <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R2 winmgmt (Služba WMI) - c:\windows\system32\svchost.exe -k netsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R2 wscsvc (Centrum zabezpečení) - c:\windows\system32\svchost.exe -k netsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R2 WSearch (Vyhledávání systému Windows) - c:\windows\system32\searchindexer.exe /embedding <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R2 wuauserv (Automatické aktualizace) - c:\windows\system32\svchost.exe -k netsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R2 WZCSVC (Automatická konfigurace bezdrátových zařízení) - c:\windows\system32\svchost.exe -k netsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R3 avast! Mail Scanner - "c:\program files\alwil software\avast4\ashmaisv.exe" /service <Not Verified; ALWIL Software; avast! Antivirus>
R3 avast! Web Scanner - "c:\program files\alwil software\avast4\ashwebsv.exe" /service <Not Verified; ALWIL Software; avast! Antivirus>
R3 EventSystem (Systém událostí modelu COM+) - c:\windows\system32\svchost.exe -k netsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R3 iPodService - c:\program files\ipod\bin\ipodservice.exe <Not Verified; Apple Computer, Inc.; iTunes>
R3 Netman (Síťová připojení) - c:\windows\system32\svchost.exe -k netsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R3 Nla (Sledování umístění v síti (NLA)) - c:\windows\system32\svchost.exe -k netsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R3 NtLmSsp (Zprostředkovatel zabezpečení NT LM) - c:\windows\system32\lsass.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R3 RasAuto (Správce automatického připojení pomocí vzdáleného přístupu) - c:\windows\system32\svchost.exe -k netsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R3 RasMan (Správce vzdáleného přístupu) - c:\windows\system32\svchost.exe -k netsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R3 TapiSrv (Telefonní subsystém) - c:\windows\system32\svchost.exe -k netsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R3 TermService (Terminálová služba) - c:\windows\system32\svchost -k dcomlaunch <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>

S2 WinRoute (Kerio WinRoute Firewall) - "c:\program files\kerio\winroute firewall\winroute.exe" <Not Verified; Kerio Technologies; Kerio WinRoute Firewall>
S3 ALG (Služba brány aplikačního rozhraní) - c:\windows\system32\alg.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 AppMgmt (Správa aplikací) - c:\windows\system32\svchost.exe -k netsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 aspnet_state (ASP.NET State Service) - c:\windows\microsoft.net\framework\v2.0.50727\aspnet_state.exe <Not Verified; Microsoft Corporation; Microsoft® .NET Framework>
S3 CiSvc (Indexing Service) - c:\windows\system32\cisvc.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 clr_optimization_v2.0.50727_32 (.NET Runtime Optimization Service v2.0.50727_X86) - c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe <Not Verified; Microsoft Corporation; Microsoft® .NET Framework>
S3 COMSysApp (Systémové aplikace modelu COM+) - c:\windows\system32\dllhost.exe /processid:{02d4b3f1-fd88-11d1-960d-00805fc79235} <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 dmadmin (Služba správy pro Správce logických disků) - c:\windows\system32\dmadmin.exe /com <Not Verified; Microsoft Corp., Veritas Software; Logical Disk Manager for Windows NT>
S3 dmserver (Správce logických disků) - c:\windows\system32\svchost.exe -k netsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 FastUserSwitchingCompatibility (Kompatibilita pro rychlé přepínání uživatelů) - c:\windows\system32\svchost.exe -k netsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 FontCache3.0.0.0 (Windows Presentation Foundation Font Cache 3.0.0.0) - c:\windows\microsoft.net\framework\v3.0\wpf\presentationfontcache.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 gusvc (Google Updater Service) - "c:\program files\google\common\google updater\googleupdaterservice.exe" <Not Verified; Google; Google Updater>
S3 HTTPFilter (HTTP SSL) - c:\windows\system32\svchost.exe -k httpfilter <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 IDriverT (InstallDriver Table Manager) - "c:\program files\common files\installshield\driver\11\intel 32\idrivert.exe" <Not Verified; Macrovision Corporation; InstallShield (R)>
S3 idsvc (Windows CardSpace) - "c:\windows\microsoft.net\framework\v3.0\windows communication foundation\infocard.exe" <Not Verified; Microsoft Corporation; Microsoft® .NET Framework>
S3 ImapiService (Služba modelu COM pro zápis na disk CD (IMAPI)) - c:\windows\system32\imapi.exe <Not Verified; Microsoft Corporation; Operační systém Microsoft® Windows®>
S3 mnmsrvc (NetMeeting - Vzdálené sdílení plochy) - c:\windows\system32\mnmsrvc.exe <Not Verified; Microsoft Corporation; Windows® NetMeeting®>
S3 MSDTC (Koordinátor DTC) - c:\windows\system32\msdtc.exe <Not Verified; Microsoft Corporation; Microsoft Distributed Transaction Coordinator>
S3 MSIServer (Windows Installer) - c:\windows\system32\msiexec.exe /v <Not Verified; Microsoft Corporation; Windows Installer - Unicode>
S3 Netlogon (Přihlašování k síti) - c:\windows\system32\lsass.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 NtmsSvc (Vyměnitelné úložiště) - c:\windows\system32\svchost.exe -k netsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 RDSessMgr (Správce relací nápovědy ke vzdálené ploše) - c:\windows\system32\sessmgr.exe <Not Verified; Microsoft Corporation; Operační systém Microsoft® Windows®>
S3 RpcLocator (Lokátor vzdáleného volání procedur (RPC)) - c:\windows\system32\locator.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 RSVP (QoS RSVP) - c:\windows\system32\rsvp.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 SCardSvr (Smart Card) - c:\windows\system32\scardsvr.exe <Not Verified; Microsoft Corporation; Operační systém Microsoft® Windows®>
S3 SolidWorks Licensing Service - "c:\program files\common files\solidworks shared\service\solidworkslicensing.exe" <Not Verified; SolidWorks; SolidWorks Licensing Service>
S3 SwPrv (MS Software Shadow Copy Provider) - c:\windows\system32\dllhost.exe /processid:{3bfc6f38-7e05-4f8a-85c0-a640fbe1bb9c} <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 SysmonLog (Výstrahy a protokolování výkonu) - c:\windows\system32\smlogsvc.exe <Not Verified; Microsoft Corporation; Operační systém Microsoft® Windows®>
S3 UPS (Uninterruptible Power Supply) - c:\windows\system32\ups.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 VSS (Stínová kopie svazku) - c:\windows\system32\vssvc.exe <Not Verified; Microsoft Corporation; Operační systém Microsoft® Windows®>
S3 WmdmPmSN (Služba sériového čísla přenosného zařízení) - c:\windows\system32\svchost.exe -k netsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 WmiApSrv (Adaptér výkonu služby WMI) - c:\windows\system32\wbem\wmiapsrv.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 WMPNetworkSvc (Služba Windows Media Player Network Sharing) - "c:\program files\windows media player\wmpnetwk.exe" <Not Verified; Microsoft Corporation; Operační systém Microsoft® Windows®>
S3 WudfSvc (Windows Driver Foundation - User-mode Driver Framework) - c:\windows\system32\svchost.exe -k wudfservicegroup <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 xmlprov (Služba pro síťová ustanovení) - c:\windows\system32\svchost.exe -k netsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S4 Alerter (Výstrahy) - c:\windows\system32\svchost.exe -k localservice <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S4 ClipSrv (Síťová schránka) - c:\windows\system32\clipsrv.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S4 HidServ (Přístup k zařízením standardu HID) - c:\windows\system32\svchost.exe -k netsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S4 Messenger (Kurýrní služba) - c:\windows\system32\svchost.exe -k netsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S4 NetDDE (Služba DDE v síti) - c:\windows\system32\netdde.exe <Not Verified; Microsoft Corporation; Operační systém Microsoft® Windows®>
S4 NetDDEdsdm (Správce DSDM služby DDE v síti) - c:\windows\system32\netdde.exe <Not Verified; Microsoft Corporation; Operační systém Microsoft® Windows®>
S4 NetTcpPortSharing (Net.Tcp Port Sharing Service) - "c:\windows\microsoft.net\framework\v3.0\windows communication foundation\smsvchost.exe" <Not Verified; Microsoft Corporation; Microsoft® .NET Framework>
S4 RemoteAccess (Směrování a vzdálený přístup) - c:\windows\system32\svchost.exe -k netsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S4 SSDPSRV (Služba rozpoznávání pomocí protokolu SSDP) - c:\windows\system32\svchost.exe -k localservice <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S4 upnphost (Hostitel zařízení UPnP) - c:\windows\system32\svchost.exe -k localservice <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>


-- End of Deckard's System Scanner: finished at 2008-03-20 15:34:56 ------------

//dík za nahráni souboru
fredik

[ivo.hriso]

nějak se mi to v system 32 množí. mimo již zabydlených wlctrl32.dll a wlctrl32.dl_ tam nyní pozoruji ještě wlctrl32.dll.ren. v drivers pak onen fms64.sys Ach jo.

[fredik]

Vytvoř si nový CFScript a tentokrát vlož do něho toto a použij ho stejným způsobem jak bylo napsáno:

Kód: Vybrat vše

Driver::
Fms64

File::
C:\WINDOWS\system32\WLCtrl32.dl_
C:\WINDOWS\system32\WLCtrl32.dll
C:\WINDOWS\system32\drivers\Fms64.sys

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WLCtrl32]

Po proběhnutí se ti objeví log, tak ho vlož sem.

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

Proveď kontrolu a vlož sem log z Kaspersky Online Scanner! (potřeba spustit v IE)
- klikni na tlačítko Accept
- budeš vyzván k nainstalovaní ActiveX komponenty od Kasperského, tak to povol
- program si stáhne potřebnou databázi
- po stažení klikni na volbu:
Po té klikni na tlačítko: Scan Settings
- dostaneš se do okna Scan settings a tam zvol následující možnosti vyber následující:

Pod položkou: Scan using the following antivirus database:

standard - detect viruses, worms, Trojans, rootkits

Pod položkou: Scan Options: - nech zvlolené obě možnosti:

Scan Archives - scan files inside archives
Scan Mail Bases - scan e-mails/attachments inside mail base files

Pak klikni na tlačítko OK

Nyní pak pod položkou Please select a target to scan zvol možnost:

- spustí se kontrola systému
- po jejím proběhnutí se ti zobrazí seznam co našel
Klikni na tlačítko Save Report As...
- ulož si ho třeba na plochu a zvol tyto parametry:
- Název souboru: zde napiš: Kavlog
- Uložit jako typ: tak tam vyber: Text file (*.txt)

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

V následujícím příspěvku sem vlož tyto logy/výsledky:
- log z ComboFix po použití skriptu
- log z Kasperaku

[ivo.hriso]

omlouvám se za delší neúčast. Odmítali mi nabíhat windows ( moje vina) a po neúspěšných pokusech o záchranu v konzoli pro zotavení, jsem byl nucen přeinstalovat a riskovat ztrátu dat . Po tom, co jsem to tak nějak dal dohromady, se již složka wlctrl32.dll neobjevuje. Takže děkuji za pomoc a ochotu a já se jdu věnovat zdlouhavému nastavování systému, k obrazu svému.
Ještě jednou děkuji Ivo.