PC-HELP.CZ

Prosím o kontrolu logu. Najednou se mi hrozně zpomalil PC.
Děkuji


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 8:54:51, on 1.10.2013
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\Rainlendar2\Rainlendar2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\DOCUME~1\BOHOU~1\LOCALS~1\Temp\Rar$EX00.671\HotkeyP.exe
C:\WINDOWS\system32\FsUsbExService.Exe
C:\Program Files\Java\jre7\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Opera\opera.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\msiexec.exe
D:\Plánovače\čištění\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: FastestTube BHO - {3E532CE8-C6D9-4A10-8ACE-4348C96E8B6A} - C:\Program Files\FastestTube\1.3.7\WombatBHO.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [MSC] "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [HotkeyP] C:\DOCUME~1\BOHOU~1\LOCALS~1\Temp\Rar$EX00.671\HotkeyP.exe 0
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: FsUsbExService - Teruten - C:\WINDOWS\system32\FsUsbExService.Exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Program Files\Java\jre7\bin\jqs.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Sony PC Companion - Avanquest Software - C:\Program Files\Sony\Sony PC Companion\PCCService.exe
O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/BOHOU~1/LOCALS~1/Temp/msohtml1/01/clip_image002.jpg

--
End of file - 6503 bytes

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected. Poté klikni na Main (hlavní stránku ) a klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.


Stáhni si TFC
Otevři soubor a zavři všechny ostatní okna, Klikni na Start k zahájení procesu. Program by neměl trvat dlouho.
Poté by se měl PC restartovat, pokud ne , proveď sám.

Stáhni AdwCleaner

Ulož si ho na svojí plochu
Ukonči všechny programy , okna a prohlížeče
Spusť program poklepáním a klikni na „Prohledat-Scan“
Po skenu se objeví log ( jinak je uložen systémovem disku jako AdwCleaner[R?].txt), jeho obsah sem celý vlož.

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

Pokud budou problémy , spusť v nouz. režimu.

# AdwCleaner v3.006 - Report created 01/10/2013 at 10:22:52
# Updated 01/10/2013 by Xplode
# Operating System : Microsoft Windows XP Service Pack 3 (32 bits)
# Username : bohouš - BOHOU-040C629BC
# Running from : C:\Documents and Settings\bohouš\Plocha\adwcleaner.exe
# Option : Scan

***** [ Services ] *****


***** [ Files / Folders ] *****

File Found : C:\Documents and Settings\bohouš\Data aplikací\Mozilla\Firefox\Profiles\48r3549l.default\bProtector_extensions.rdf
File Found : C:\Documents and Settings\bohouš\Data aplikací\Mozilla\Firefox\Profiles\48r3549l.default\searchplugins\avg-secure-search.xml
File Found : C:\Documents and Settings\bohouš\Data aplikací\Mozilla\Firefox\Profiles\48r3549l.default\searchplugins\SweetIm.xml
File Found : C:\Documents and Settings\bohouš\Data aplikací\Mozilla\Firefox\Profiles\48r3549l.default\user.js
File Found : C:\Documents and Settings\bohouš\Data aplikací\speedanalysis.ico
File Found : C:\WINDOWS\system32\dmwu.exe
File Found : C:\WINDOWS\system32\ImhxxpComm.dll
Folder Found : C:\Documents and Settings\bohouš\Data aplikací\Mozilla\Firefox\Profiles\48r3549l.default\Extensions\ffxtlbr@babylon.com
Folder Found : C:\Documents and Settings\bohouš\Data aplikací\Mozilla\Firefox\Profiles\48r3549l.default\Extensions\plugin@yontoo.com
Folder Found C:\Documents and Settings\bohouš\Data aplikací\Systweak
Folder Found C:\Program Files\Common Files\spigot
Folder Found C:\Program Files\driver-soft
Folder Found C:\WINDOWS\system32\ARFC
Folder Found C:\WINDOWS\system32\jmdp

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Found : HKCU\Software\AppDataLow\Software\Search Settings
Key Found : HKCU\Software\AppDataLow\Software\simplytech
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CD10120B-C165-4F8D-8C74-639629E238FF}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{03EB0E9C-7A91-4381-A220-9B52B641CDB1}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{03EB0E9C-7A91-4381-A220-9B52B641CDB1}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Found : HKCU\Software\performersoft llc
Key Found : HKCU\Software\systweak
Key Found : HKCU\Software\wnlt
Key Found : HKLM\SOFTWARE\Classes\driverscanner
Key Found : HKLM\Software\ICQ\ICQToolbar
Key Found : HKLM\Software\Uniblue\SpeedUpMyPC
Value Found : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
Value Found : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List [C:\WINDOWS\system32\ARFC\wrtc.exe]

***** [ Browsers ] *****

-\\ Internet Explorer v8.0.6001.18702

Setting Found : HKCU\Software\Microsoft\Internet Explorer\SearchUrl [(Default)] - hxxp://search.certified-toolbar.com?si= ... tid=592&q=%s

-\\ Mozilla Firefox v

[ File : C:\Documents and Settings\bohouš\Data aplikací\Mozilla\Firefox\Profiles\48r3549l.default\prefs.js ]

Line Found : user_pref("icqtoolbar.installsource", "1");
Line Found : user_pref("browser.startup.homepage", "hxxp://home.sweetim.com/?crg=3.1010000.10002&barid={0873E805-6152-11E2-8152-001A4D686711}");
Line Found : user_pref("icqtoolbar.installsource", "1");
Line Found : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "www.google.cz");
Line Found : user_pref("sweetim.toolbar.urls.homepage", "hxxp://home.sweetim.com/?crg=3.1010000.10002&barid={0873E805-6152-11E2-8152-001A4D686711}");
Line Found : user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "Yahoo");
Line Found : user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "Yahoo");
Line Found : user_pref("sweetim.toolbar.previous.keyword.URL", "hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=685749&ilc=12&p=");

*************************

AdwCleaner[R0].txt - [4007 octets] - [01/10/2013 10:22:52]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [4067 octets] ##########


Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Verze: v2013.10.01.02

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
bohouš :: BOHOU-040C629BC [administrátor]

1.10.2013 10:33:36
MBAM-log-2013-10-01 (10-50-41).txt

Typ: Rychlá kontrola
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 232895
Uplynulý čas: 16 minut, 18 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené soubory: 2
C:\WINDOWS\Installer\1e46b0.msi (PUP.Optional.SweetIM) -> Nebyla provedena žádná instrukce.
C:\WINDOWS\Installer\1e46bc.msi (PUP.Optional.SweetIM) -> Nebyla provedena žádná instrukce.

(konec)

V obou nech vše smazat a dodej log po smazání

Stáhni si RogueKiller
32bit.:
http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe
64bit.:
http://www.sur-la-toile.com/RogueKiller ... lerX64.exe
na svojí plochu.
- Zavři všechny ostatní programy a prohlížeče.
- Pro OS Vista a win7 spusť program RogueKiller.exe jako správce , u XP poklepáním.
- počkej až skončí Prescan -vyhledávání škodlivých procesů.
- Zkontroluj , zda máš zaškrtnuto:
Kontrola MBR
Kontrola Faked
Antirootkit
-Potom klikni na „Prohledat“.
- Program skenuje procesy PC. Po proskenování klikni na „Zpráva“celý obsah logu sem zkopíruj.
Pokud je program blokován , zkus ho spustit několikrát. Pokud dále program nepůjde spustit a pracovat, přejmenuj ho na winlogon.exe.

Stáhni si Junkware Removal Tool

na svojí plochu.
Deaktivuj si svůj antivirový program.
Pravým tl. myši klikni na JRT.exe a vyber „spustit jako správce“. Pro pokračování budeš vyzván ke stisknutí jakékoliv klávesy. Na nějakou klikni.
Začne skenování programu. Skenování může trvat dloho , podle množství nákaz. Po ukončení skenu se objeví log (JRT.txt) , který se uloží na ploše.
Zkopíruj sem prosím celý jeho obsah.

# AdwCleaner v3.006 - Report created 01/10/2013 at 19:34:08
# Updated 01/10/2013 by Xplode
# Operating System : Microsoft Windows XP Service Pack 3 (32 bits)
# Username : bohouš - BOHOU-040C629BC
# Running from : C:\Documents and Settings\bohouš\Plocha\adwcleaner.exe
# Option : Scan

***** [ Services ] *****


***** [ Files / Folders ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****


***** [ Browsers ] *****

-\\ Internet Explorer v8.0.6001.18702


-\\ Mozilla Firefox v

[ File : C:\Documents and Settings\bohouš\Data aplikací\Mozilla\Firefox\Profiles\48r3549l.default\prefs.js ]


*************************
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Verze: v2013.10.01.02

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
bohouš :: BOHOU-040C629BC [administrátor]

1.10.2013 19:51:37
mbam-log-2013-10-01 (19-51-37).txt

Typ: Rychlá kontrola
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 232885
Uplynulý čas: 11 minut, 18 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené soubory: 0
(Žádné škodlivé položky nebyly zjištěny)

(konec)



AdwCleaner[R0].txt - [4147 octets] - [01/10/2013 10:22:52]
AdwCleaner[R1].txt - [917 octets] - [01/10/2013 19:28:05]
AdwCleaner[R2].txt - [778 octets] - [01/10/2013 19:34:08]
AdwCleaner[S0].txt - [4227 octets] - [01/10/2013 10:25:06]
AdwCleaner[S1].txt - [977 octets] - [01/10/2013 19:29:25]

########## EOF - C:\AdwCleaner\AdwCleaner[R2].txt - [956 octets] ##########


RogueKiller V8.7.0 [Sep 30 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Podpora : http://www.adlice.com/forum/
Webové stránky : http://www.adlice.com/softwares/roguekiller/
: http://tigzyrk.blogspot.com/

Operační systém : Windows XP (5.1.2600 Service Pack 3) 32 bits version
Spuštěno v : Normální režim
Uživatel : bohouš [Práva správce]
Mód : Kontrola -- Datum : 10/01/2013 20:09:27
| ARK || FAK || MBR |

¤¤¤ Škodlivé procesy: : 0 ¤¤¤

¤¤¤ ¤¤¤ Záznamy Registrů: : 3 ¤¤¤
[RUN][SUSP UNIC] HKCU\[...]\Run : HotkeyP (C:\DOCUME~1\BOHOU~1\LOCALS~1\Temp\Rar$EX00.671\HotkeyP.exe 0 [x]) -> NALEZENO
[RUN][SUSP UNIC] HKUS\S-1-5-21-515967899-507921405-725345543-1003\[...]\Run : HotkeyP (C:\DOCUME~1\BOHOU~1\LOCALS~1\Temp\Rar$EX00.671\HotkeyP.exe 0 [x]) -> NALEZENO
[HJ POL][PUM] HKLM\[...]\System : DisableRegistryTools (0) -> NALEZENO

¤¤¤ naplánované úlohy : 0 ¤¤¤

¤¤¤ spuštění položky : 0 ¤¤¤

¤¤¤ Webové prohlížeče : 1 ¤¤¤
[FF][PROXY] 48r3549l.default : user_pref("network.proxy.type", 2); -> NALEZENO

¤¤¤ Zvláštní soubory / Složky: ¤¤¤

¤¤¤ Ovladač : [NAHRÁNO] ¤¤¤
[Inline] EAT @explorer.exe (?_Ptr_wcout@std@@3PAV?$basic_ostream@GU?$char_traits@G@std@@@1@A) : MSVCP90.dll -> HOOKED (Unknown @ 0x28C8C016)
[Inline] EAT @explorer.exe (??_7?$basic_ostringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@6B@) : MSVCP60.dll -> HOOKED (Unknown @ 0x76817FA1)
[Inline] EAT @explorer.exe (??_7?$basic_streambuf@GU?$char_traits@G@std@@@std@@6B@) : MSVCP100.dll -> HOOKED (Unknown @ 0x4B7D2083)

¤¤¤ Externí včelstvo: ¤¤¤

¤¤¤ Nákaza : ¤¤¤

¤¤¤ Soubor HOSTS: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts


127.0.0.1 08sr.combineads.info # hosts anti-adware / pups
127.0.0.1 08srvr.combineads.info # hosts anti-adware / pups
127.0.0.1 12srvr.combineads.info # hosts anti-adware / pups
127.0.0.1 2010-fr.com # hosts anti-adware / pups
127.0.0.1 2012-new.biz # hosts anti-adware / pups
127.0.0.1 2319825.ourtoolbar.com # hosts anti-adware / pups
127.0.0.1 24h00business.com # hosts anti-adware / pups
127.0.0.1 a.daasafterdusk.com # hosts anti-adware / pups
127.0.0.1 ad.adn360.com # hosts anti-adware / pups
127.0.0.1 adeartss.eu # hosts anti-adware / pups
127.0.0.1 adesoeasy.eu # hosts anti-adware / pups
127.0.0.1 adf.girldatesforfree.net # hosts anti-adware / pups
127.0.0.1 adm.soft365.com # hosts anti-adware / pups
127.0.0.1 adomicileavail.googlepages.com # hosts anti-adware / pups
127.0.0.1 ads7.complexadveising.com # hosts anti-adware / pups
127.0.0.1 ads.aff.co # hosts anti-adware / pups
127.0.0.1 ads.alpha00001.com # hosts anti-adware / pups
127.0.0.1 ads.cloud4ads.com # hosts anti-adware / pups
127.0.0.1 ads.eorezo.com # hosts anti-adware / pups
127.0.0.1 ads.hooqy.com # hosts anti-adware / pups
[...]


¤¤¤ Kontrola MBR: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) (Standardní diskové jednotky) - ST340014A +++++
--- User ---
[MBR] 86ae9682c857c92f8c7782a4a5278cfe
[BSP] 5e808192d8b35d7ed5e916822a2e9007 : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 38162 Mo
User = LL1 ... OK!
User = LL2 ... OK!

+++++ PhysicalDrive1: (\\.\PHYSICALDRIVE1 @ IDE) (Standardní diskové jednotky) - WDC WD5000AVDS-63U7B1 +++++
--- User ---
[MBR] b4dd07df154ef37bcc0d73bbec167488
[BSP] 6a52188395639a4256825024f288b9ff : Windows Vista MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 476937 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Dokončeno : << RKreport[0]_S_10012013_200927.txt >>



~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.3 (09.27.2013:1)
OS: Microsoft Windows XP x86
Ran by bohouš on út 01.10.2013 at 20:16:58,85
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\\DisplayName
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\\URL



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\torch
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\torch
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{70BA3E6B-1059-2266-0B2C-40E4A85231B8}



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Documents and Settings\bohouš\Data aplikací\goforfiles"
Successfully deleted: [Folder] "C:\Program Files\goforfiles"
Successfully deleted: [Folder] "C:\Program Files\openapp"
Successfully deleted: [Folder] "C:\Program Files\speeditup free"





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on út 01.10.2013 at 20:21:57,85
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Zavři všechny programy a prohlížeče.
Odpoj všechny USB nebo externí disky z počítače před spuštěním tohoto programu.
Spusť RogueKiller (Pro Windows Vista nebo WIN7 klepni pravým a vyber "Spustit jako správce", ve Windows XP poklepej ke spuštění).
- Počkej, až Prescan dokončí práci...
- Počkej, dokud status box zobrazuje "Scan" "
- Klikni na "Delete"
- Počkej, dokud status box zobrazuje "Smazání - Finished"
- Klikni na "Zprávy", zkopíruj a vlož obsah té zprávy prosím sem. Log je možno nalézt v RKreport [1].txt na ploše.
- Zavři RogueKiller

Stáhni si TDSSKiller

Na svojí plochu. Ujisti se , že máš zavřeny všechny ostatní aplikace a prohlížeče. Rozbal soubor a spusť TDSSKiller.exe. Restartuj PC . Log z TDSSKilleru najdeš zde:
C:\TDSSKiller.2.2.7.1._(datum)_log.txt , vlož sem prosím celý obsah logu.

RogueKiller V8.7.0 [Sep 30 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Podpora : http://www.adlice.com/forum/
Webové stránky : http://www.adlice.com/softwares/roguekiller/
: http://tigzyrk.blogspot.com/

Operační systém : Windows XP (5.1.2600 Service Pack 3) 32 bits version
Spuštěno v : Normální režim
Uživatel : bohouš [Práva správce]
Mód : Odebrat -- Datum : 10/01/2013 21:48:17
| ARK || FAK || MBR |

¤¤¤ Škodlivé procesy: : 0 ¤¤¤

¤¤¤ ¤¤¤ Záznamy Registrů: : 5 ¤¤¤
[RUN][SUSP UNIC] HKCU\[...]\Run : HotkeyP (C:\DOCUME~1\BOHOU~1\LOCALS~1\Temp\Rar$EX00.671\HotkeyP.exe 0 [x]) -> VYMAZÁNO
[RUN][SUSP UNIC] HKUS\S-1-5-21-515967899-507921405-725345543-1003\[...]\Run : HotkeyP (C:\DOCUME~1\BOHOU~1\LOCALS~1\Temp\Rar$EX00.671\HotkeyP.exe 0 [x]) -> [0x2] Systém nemůže nalézt uvedený soubor.
[HJ POL][PUM] HKCU\[...]\System : DisableTaskMgr (0) -> VYMAZÁNO
[HJ POL][PUM] HKCU\[...]\System : DisableRegistryTools (0) -> VYMAZÁNO
[HJ POL][PUM] HKLM\[...]\System : DisableRegistryTools (0) -> VYMAZÁNO

¤¤¤ naplánované úlohy : 0 ¤¤¤

¤¤¤ spuštění položky : 0 ¤¤¤

¤¤¤ Webové prohlížeče : 1 ¤¤¤

¤¤¤ Zvláštní soubory / Složky: ¤¤¤

¤¤¤ Ovladač : [NAHRÁNO] ¤¤¤
[Inline] EAT @explorer.exe (?_Ptr_wcout@std@@3PAV?$basic_ostream@GU?$char_traits@G@std@@@1@A) : MSVCP90.dll -> HOOKED (Unknown @ 0x28C8C016)
[Inline] EAT @explorer.exe (??_7?$basic_ostringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@6B@) : MSVCP60.dll -> HOOKED (Unknown @ 0x76817FA1)

¤¤¤ Externí včelstvo: ¤¤¤

¤¤¤ Nákaza : ¤¤¤

¤¤¤ Soubor HOSTS: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts


127.0.0.1 08sr.combineads.info # hosts anti-adware / pups
127.0.0.1 08srvr.combineads.info # hosts anti-adware / pups
127.0.0.1 12srvr.combineads.info # hosts anti-adware / pups
127.0.0.1 2010-fr.com # hosts anti-adware / pups
127.0.0.1 2012-new.biz # hosts anti-adware / pups
127.0.0.1 2319825.ourtoolbar.com # hosts anti-adware / pups
127.0.0.1 24h00business.com # hosts anti-adware / pups
127.0.0.1 a.daasafterdusk.com # hosts anti-adware / pups
127.0.0.1 ad.adn360.com # hosts anti-adware / pups
127.0.0.1 adeartss.eu # hosts anti-adware / pups
127.0.0.1 adesoeasy.eu # hosts anti-adware / pups
127.0.0.1 adf.girldatesforfree.net # hosts anti-adware / pups
127.0.0.1 adm.soft365.com # hosts anti-adware / pups
127.0.0.1 adomicileavail.googlepages.com # hosts anti-adware / pups
127.0.0.1 ads7.complexadveising.com # hosts anti-adware / pups
127.0.0.1 ads.aff.co # hosts anti-adware / pups
127.0.0.1 ads.alpha00001.com # hosts anti-adware / pups
127.0.0.1 ads.cloud4ads.com # hosts anti-adware / pups
127.0.0.1 ads.eorezo.com # hosts anti-adware / pups
127.0.0.1 ads.hooqy.com # hosts anti-adware / pups
[...]


¤¤¤ Kontrola MBR: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) (Standardní diskové jednotky) - ST340014A +++++
--- User ---
[MBR] 86ae9682c857c92f8c7782a4a5278cfe
[BSP] 5e808192d8b35d7ed5e916822a2e9007 : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 38162 Mo
User = LL1 ... OK!
User = LL2 ... OK!

+++++ PhysicalDrive1: (\\.\PHYSICALDRIVE1 @ IDE) (Standardní diskové jednotky) - WDC WD5000AVDS-63U7B1 +++++
--- User ---
[MBR] b4dd07df154ef37bcc0d73bbec167488
[BSP] 6a52188395639a4256825024f288b9ff : Windows Vista MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 476937 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Dokončeno : << RKreport[0]_D_10012013_214817.txt >>
RKreport[0]_S_10012013_200927.txt;RKreport[0]_S_10012013_214745.txt







21:51:08.0640 4748 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
21:51:09.0140 4748 ============================================================
21:51:09.0140 4748 Current date / time: 2013/10/01 21:51:09.0140
21:51:09.0140 4748 SystemInfo:
21:51:09.0140 4748
21:51:09.0140 4748 OS Version: 5.1.2600 ServicePack: 3.0
21:51:09.0140 4748 Product type: Workstation
21:51:09.0156 4748 ComputerName: BOHOU-040C629BC
21:51:09.0156 4748 UserName: bohouš
21:51:09.0156 4748 Windows directory: C:\WINDOWS
21:51:09.0156 4748 System windows directory: C:\WINDOWS
21:51:09.0156 4748 Processor architecture: Intel x86
21:51:09.0156 4748 Number of processors: 2
21:51:09.0156 4748 Page size: 0x1000
21:51:09.0156 4748 Boot type: Normal boot
21:51:09.0156 4748 ============================================================
21:51:12.0046 4748 Drive \Device\Harddisk0\DR0 - Size: 0x9515A5E00 (37.27 Gb), SectorSize: 0x200, Cylinders: 0x1301, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
21:51:12.0046 4748 Drive \Device\Harddisk1\DR1 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
21:51:12.0046 4748 ============================================================
21:51:12.0046 4748 \Device\Harddisk0\DR0:
21:51:12.0046 4748 MBR partitions:
21:51:12.0046 4748 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x4A89182
21:51:12.0046 4748 \Device\Harddisk1\DR1:
21:51:12.0046 4748 MBR partitions:
21:51:12.0046 4748 \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x3A384C02
21:51:12.0046 4748 ============================================================
21:51:12.0078 4748 C: <-> \Device\Harddisk0\DR0\Partition1
21:51:12.0125 4748 D: <-> \Device\Harddisk1\DR1\Partition1
21:51:12.0125 4748 ============================================================
21:51:12.0125 4748 Initialize success
21:51:12.0125 4748 ============================================================
21:51:20.0812 28368 ============================================================
21:51:20.0812 28368 Scan started
21:51:20.0812 28368 Mode: Manual;
21:51:20.0812 28368 ============================================================
21:51:22.0718 28368 ================ Scan system memory ========================
21:51:22.0718 28368 System memory - ok
21:51:22.0718 28368 ================ Scan services =============================
21:51:22.0828 28368 Abiosdsk - ok
21:51:22.0828 28368 abp480n5 - ok
21:51:22.0890 28368 [ 4FE34F1F3126B61FCC6B2043AA8112C9 ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys
21:51:22.0890 28368 ACPI - ok
21:51:22.0937 28368 [ AFDFF022A01F0B11C776F0860C3B282F ] ACPIEC C:\WINDOWS\system32\drivers\ACPIEC.sys
21:51:22.0937 28368 ACPIEC - ok
21:51:23.0015 28368 [ 3109B16A0939BA11696EEB04F345D099 ] AdobeFlashPlayerUpdateSvc C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
21:51:23.0015 28368 AdobeFlashPlayerUpdateSvc - ok
21:51:23.0031 28368 adpu160m - ok
21:51:23.0062 28368 [ 8BED39E3C35D6A489438B8141717A557 ] aec C:\WINDOWS\system32\drivers\aec.sys
21:51:23.0062 28368 aec - ok
21:51:23.0109 28368 [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD C:\WINDOWS\System32\drivers\afd.sys
21:51:23.0125 28368 AFD - ok
21:51:23.0171 28368 [ 08FD04AA961BDC77FB983F328334E3D7 ] agp440 C:\WINDOWS\system32\DRIVERS\agp440.sys
21:51:23.0171 28368 agp440 - ok
21:51:23.0171 28368 Aha154x - ok
21:51:23.0187 28368 aic78u2 - ok
21:51:23.0203 28368 aic78xx - ok
21:51:23.0406 28368 [ DD8520280304B6145A6BE31008748C7C ] ALCXWDM C:\WINDOWS\system32\drivers\ALCXWDM.SYS
21:51:23.0437 28368 ALCXWDM - ok
21:51:23.0468 28368 [ E0A6FA244B8624D78FE5FF6F56A33BAE ] Alerter C:\WINDOWS\system32\alrsvc.dll
21:51:23.0468 28368 Alerter - ok
21:51:23.0500 28368 [ 88842DE939A827577BF24243699AC80A ] ALG C:\WINDOWS\System32\alg.exe
21:51:23.0500 28368 ALG - ok
21:51:23.0515 28368 AliIde - ok
21:51:23.0562 28368 [ 81EF334CDA7A222CE88F41B7697B86F4 ] AmgHips C:\WINDOWS\system32\Drivers\AmgHips.sys
21:51:23.0562 28368 AmgHips - ok
21:51:23.0578 28368 amsint - ok
21:51:23.0609 28368 [ 3E59DF4984FBD6800D6621480B38A34E ] Andbus C:\WINDOWS\system32\DRIVERS\lgandbus.sys
21:51:23.0609 28368 Andbus - ok
21:51:23.0640 28368 [ 8E0BF6F3B2C9C292BC7CE0DE727CDD56 ] AndDiag C:\WINDOWS\system32\DRIVERS\lganddiag.sys
21:51:23.0640 28368 AndDiag - ok
21:51:23.0656 28368 [ 1D2C90E25483363D54B652898BBC8F2A ] AndGps C:\WINDOWS\system32\DRIVERS\lgandgps.sys
21:51:23.0656 28368 AndGps - ok
21:51:23.0671 28368 [ B1B06A95DA2CAC7FA19832C60C348C85 ] ANDModem C:\WINDOWS\system32\DRIVERS\lgandmodem.sys
21:51:23.0671 28368 ANDModem - ok
21:51:23.0718 28368 [ 6B8E7A90E576D4FE308F97C69060A171 ] AppMgmt C:\WINDOWS\System32\appmgmts.dll
21:51:23.0718 28368 AppMgmt - ok
21:51:23.0734 28368 asc - ok
21:51:23.0750 28368 asc3350p - ok
21:51:23.0750 28368 asc3550 - ok
21:51:23.0890 28368 [ 776ACEFA0CA9DF0FAA51A5FB2F435705 ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
21:51:23.0890 28368 aspnet_state - ok
21:51:23.0953 28368 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys
21:51:23.0953 28368 AsyncMac - ok
21:51:23.0984 28368 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys
21:51:23.0984 28368 atapi - ok
21:51:23.0984 28368 Atdisk - ok
21:51:24.0062 28368 [ 471087B5E1E01CC82604E81EA14781D8 ] Ati HotKey Poller C:\WINDOWS\system32\Ati2evxx.exe
21:51:24.0531 28368 Ati HotKey Poller - ok
21:51:24.0609 28368 [ B979BA0120B6DB757196A8E2E873FE3C ] ATI Smart C:\WINDOWS\system32\ati2sgag.exe
21:51:24.0609 28368 ATI Smart - ok
21:51:24.0812 28368 [ C0B86ECB324E50F6BBD529F9D5C6B24B ] ati2mtag C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
21:51:24.0828 28368 ati2mtag - ok
21:51:24.0859 28368 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys
21:51:24.0859 28368 Atmarpc - ok
21:51:24.0890 28368 [ DE31B88962A8645DBA5A37B993E7B0F1 ] AudioSrv C:\WINDOWS\System32\audiosrv.dll
21:51:24.0890 28368 AudioSrv - ok
21:51:24.0953 28368 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys
21:51:24.0953 28368 audstub - ok
21:51:25.0000 28368 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINDOWS\system32\drivers\Beep.sys
21:51:25.0000 28368 Beep - ok
21:51:25.0078 28368 [ 19395D092FD85DDC2D9C7729CF5A2AC8 ] BITS C:\WINDOWS\system32\qmgr.dll
21:51:25.0109 28368 BITS - ok
21:51:25.0140 28368 [ 89E739BBA5F636297EA5B5F811189E06 ] Browser C:\WINDOWS\System32\browser.dll
21:51:25.0187 28368 Browser - ok
21:51:25.0218 28368 [ B279426E3C0C344893ED78A613A73BDE ] BthEnum C:\WINDOWS\system32\DRIVERS\BthEnum.sys
21:51:25.0234 28368 BthEnum - ok
21:51:25.0234 28368 [ FCA6F069597B62D42495191ACE3FC6C1 ] BTHMODEM C:\WINDOWS\system32\DRIVERS\bthmodem.sys
21:51:25.0250 28368 BTHMODEM - ok
21:51:25.0265 28368 [ 80602B8746D3738F5886CE3D67EF06B6 ] BthPan C:\WINDOWS\system32\DRIVERS\bthpan.sys
21:51:25.0265 28368 BthPan - ok
21:51:25.0312 28368 [ F338662A6C1FC11DD9508F6DFF2C06A2 ] BTHPORT C:\WINDOWS\system32\Drivers\BTHport.sys
21:51:25.0312 28368 BTHPORT - ok
21:51:25.0359 28368 [ 70CA4B3F634C9DCA200832F8DA76E009 ] BthServ C:\WINDOWS\System32\bthserv.dll
21:51:25.0359 28368 BthServ - ok
21:51:25.0406 28368 [ 61364CD71EF63B0F038B7E9DF00F1EFA ] BTHUSB C:\WINDOWS\system32\Drivers\BTHUSB.sys
21:51:25.0406 28368 BTHUSB - ok
21:51:25.0421 28368 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys
21:51:25.0421 28368 cbidf2k - ok
21:51:25.0453 28368 [ 0BE5AEF125BE881C4F854C554F2B025C ] CCDECODE C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
21:51:25.0453 28368 CCDECODE - ok
21:51:25.0468 28368 cd20xrnt - ok
21:51:25.0515 28368 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys
21:51:25.0515 28368 Cdaudio - ok
21:51:25.0562 28368 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys
21:51:25.0562 28368 Cdfs - ok
21:51:25.0578 28368 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys
21:51:25.0578 28368 Cdrom - ok
21:51:25.0625 28368 [ E390DC1D7C461D7D56EC53402F329928 ] CiSvc C:\WINDOWS\system32\cisvc.exe
21:51:25.0625 28368 CiSvc - ok
21:51:25.0656 28368 [ 064507A8DFA8C5C7E2FFDDD3E6F424FA ] ClipSrv C:\WINDOWS\system32\clipsrv.exe
21:51:25.0656 28368 ClipSrv - ok
21:51:25.0750 28368 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
21:51:25.0750 28368 clr_optimization_v2.0.50727_32 - ok
21:51:25.0796 28368 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
21:51:25.0812 28368 clr_optimization_v4.0.30319_32 - ok
21:51:25.0812 28368 CmdIde - ok
21:51:25.0828 28368 COMSysApp - ok
21:51:25.0843 28368 Cpqarray - ok
21:51:25.0843 28368 cpuz135 - ok
21:51:25.0859 28368 cpuz136 - ok
21:51:25.0906 28368 [ F3AB0933CBD166D271992F411C27CCAF ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll
21:51:25.0906 28368 CryptSvc - ok
21:51:25.0906 28368 dac2w2k - ok
21:51:25.0921 28368 dac960nt - ok
21:51:25.0968 28368 [ CA812B19C0E2BC044214AD3F6436E730 ] dc3d C:\WINDOWS\system32\DRIVERS\dc3d.sys
21:51:25.0968 28368 dc3d - ok
21:51:26.0046 28368 [ BE27674D1CBC3214AEC84B4336A38BBF ] DcomLaunch C:\WINDOWS\system32\rpcss.dll
21:51:26.0062 28368 DcomLaunch - ok
21:51:26.0125 28368 [ A5034F77B278F07E224FE07CF98A8B76 ] DgiVecp C:\WINDOWS\system32\Drivers\DgiVecp.sys
21:51:26.0125 28368 DgiVecp - ok
21:51:26.0156 28368 [ 919F338FD36F47D860775368D0748780 ] dg_ssudbus C:\WINDOWS\system32\DRIVERS\ssudbus.sys
21:51:26.0156 28368 dg_ssudbus - ok
21:51:26.0203 28368 [ 8C9A53E285AC5E6704844D0459EC85BE ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll
21:51:26.0203 28368 Dhcp - ok
21:51:26.0218 28368 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys
21:51:26.0218 28368 Disk - ok
21:51:26.0234 28368 dmadmin - ok
21:51:26.0281 28368 [ DB5FD2BF5B07DC54BFCB3664FF05BD7C ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys
21:51:26.0281 28368 dmboot - ok
21:51:26.0312 28368 [ FFF1720AF51171F32F1EAD5CF71F2810 ] dmio C:\WINDOWS\system32\drivers\dmio.sys
21:51:26.0312 28368 dmio - ok
21:51:26.0343 28368 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINDOWS\system32\drivers\dmload.sys
21:51:26.0343 28368 dmload - ok
21:51:26.0359 28368 [ 2BFEFE9E865655A76982F050450B9591 ] dmserver C:\WINDOWS\System32\dmserver.dll
21:51:26.0375 28368 dmserver - ok
21:51:26.0406 28368 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys
21:51:26.0406 28368 DMusic - ok
21:51:26.0453 28368 [ DFAA406BF19F4EE806A6F8D4342137F7 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll
21:51:26.0453 28368 Dnscache - ok
21:51:26.0500 28368 [ 4A3E2BD20157A0946751229E92EB8621 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll
21:51:26.0500 28368 Dot3svc - ok
21:51:26.0500 28368 dpti2o - ok
21:51:26.0546 28368 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys
21:51:26.0546 28368 drmkaud - ok
21:51:26.0562 28368 dwshd - ok
21:51:26.0625 28368 [ 98B46B331404A951CABAD8B4877E1276 ] E100B C:\WINDOWS\system32\DRIVERS\e100b325.sys
21:51:26.0625 28368 E100B - ok
21:51:26.0671 28368 [ 0887D9C2BE8D940778CAD1E3B85F2A41 ] EapHost C:\WINDOWS\System32\eapsvc.dll
21:51:26.0671 28368 EapHost - ok
21:51:26.0703 28368 [ A2A4912798F2BE706ABADD3D30800D16 ] ERSvc C:\WINDOWS\System32\ersvc.dll
21:51:26.0703 28368 ERSvc - ok
21:51:26.0765 28368 [ 9EF697AF07BB8DD82C3B02CA953A95B7 ] Eventlog C:\WINDOWS\system32\services.exe
21:51:26.0765 28368 Eventlog - ok
21:51:26.0828 28368 [ A371F11EF07653591C8DE26AFB13CE7F ] EventSystem C:\WINDOWS\system32\es.dll
21:51:26.0828 28368 EventSystem - ok
21:51:26.0875 28368 [ 38D332A6D56AF32635675F132548343E ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys
21:51:26.0875 28368 Fastfat - ok
21:51:26.0937 28368 [ EE9A2B9EA968A792A053C9D1A86BF870 ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll
21:51:26.0937 28368 FastUserSwitchingCompatibility - ok
21:51:26.0968 28368 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc C:\WINDOWS\system32\DRIVERS\fdc.sys
21:51:26.0968 28368 Fdc - ok
21:51:27.0015 28368 [ AC366695A0796560AA37215AD5762AAF ] Fips C:\WINDOWS\system32\drivers\Fips.sys
21:51:27.0015 28368 Fips - ok
21:51:27.0046 28368 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk C:\WINDOWS\system32\DRIVERS\flpydisk.sys
21:51:27.0046 28368 Flpydisk - ok
21:51:27.0093 28368 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr C:\WINDOWS\system32\drivers\fltmgr.sys
21:51:27.0093 28368 FltMgr - ok
21:51:27.0187 28368 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
21:51:27.0187 28368 FontCache3.0.0.0 - ok
21:51:27.0234 28368 [ CBE5F69A5E5B918225F420BA748F3742 ] FsUsbExDisk C:\WINDOWS\system32\FsUsbExDisk.SYS
21:51:27.0234 28368 FsUsbExDisk - ok
21:51:27.0250 28368 [ 96633419F4A1E37ACB89B45EBCCFE001 ] FsUsbExService C:\WINDOWS\system32\FsUsbExService.Exe
21:51:27.0265 28368 FsUsbExService - ok
21:51:27.0265 28368 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys
21:51:27.0281 28368 Fs_Rec - ok
21:51:27.0296 28368 [ 4E664D8541DB4A66B73A24257E322E1F ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys
21:51:27.0296 28368 Ftdisk - ok
21:51:27.0343 28368 [ 93CA4D9A0433BE0EDD0B9F2F26D5E54C ] ggflt C:\WINDOWS\system32\DRIVERS\ggflt.sys
21:51:27.0343 28368 ggflt - ok
21:51:27.0375 28368 [ 17E678AAB82CCDFB80E7614504933895 ] ggsemc C:\WINDOWS\system32\DRIVERS\ggsemc.sys
21:51:27.0375 28368 ggsemc - ok
21:51:27.0421 28368 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys
21:51:27.0421 28368 Gpc - ok
21:51:27.0531 28368 [ CC839E8D766CC31A7710C9F38CF3E375 ] gusvc C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
21:51:27.0546 28368 gusvc - ok
21:51:27.0578 28368 [ F22BF7F345DF95C09942951246AAA28D ] GVCplDrv C:\WINDOWS\system32\drivers\GVCplDrv.sys
21:51:27.0578 28368 GVCplDrv - ok
21:51:27.0640 28368 [ B956F9F0AF900CDD6E515F88074035CE ] Hardlock C:\WINDOWS\system32\drivers\HARDLOCK.SYS
21:51:27.0640 28368 Hardlock - ok
21:51:27.0734 28368 [ FCFE31FB75F8A6295B6B0AF87A626282 ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
21:51:27.0765 28368 helpsvc - ok
21:51:27.0828 28368 [ 00E25EE90166B3E1BE6E74AEBF858306 ] HidServ C:\WINDOWS\System32\hidserv.dll
21:51:27.0828 28368 HidServ - ok
21:51:27.0875 28368 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] HidUsb C:\WINDOWS\system32\DRIVERS\hidusb.sys
21:51:27.0875 28368 HidUsb - ok
21:51:27.0921 28368 [ 7A6B320928F86BC851530D63C82965D9 ] hkmsvc C:\WINDOWS\System32\kmsvc.dll
21:51:27.0921 28368 hkmsvc - ok
21:51:27.0937 28368 HOSTS Anti-PUPs - ok
21:51:27.0953 28368 hpn - ok
21:51:28.0000 28368 [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys
21:51:28.0000 28368 HTTP - ok
21:51:28.0031 28368 [ 58FE2F2DA3BC5573F4A35B3760D3125F ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll
21:51:28.0046 28368 HTTPFilter - ok
21:51:28.0046 28368 i2omp - ok
21:51:28.0093 28368 [ C528E27945367191E7BAE364930B6932 ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys
21:51:28.0093 28368 i8042prt - ok
21:51:28.0156 28368 [ 510A5E1CB84E82D4E89DFF3D96752048 ] ialm C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
21:51:28.0171 28368 ialm - ok
21:51:28.0234 28368 [ 1CF03C69B49ACB70C722DF92755C0C8C ] IDriverT C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
21:51:28.0281 28368 IDriverT - ok
21:51:28.0375 28368 [ 79BAFEF1D1CA97102EB585F829105062 ] idsvc c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
21:51:28.0593 28368 idsvc - ok
21:51:28.0656 28368 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys
21:51:28.0656 28368 Imapi - ok
21:51:28.0703 28368 [ F7B93AAFAD33B2320954C17E26C8D361 ] ImapiService C:\WINDOWS\system32\imapi.exe
21:51:28.0703 28368 ImapiService - ok
21:51:28.0718 28368 ini910u - ok
21:51:28.0765 28368 [ 57D928E548B38502ABBA7A77A6EB7312 ] IntelIde C:\WINDOWS\system32\DRIVERS\intelide.sys
21:51:28.0765 28368 IntelIde - ok
21:51:28.0812 28368 [ 27B290D632AF2CF3CF40BFDDB7370985 ] intelppm C:\WINDOWS\system32\DRIVERS\intelppm.sys
21:51:28.0812 28368 intelppm - ok
21:51:28.0843 28368 [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw C:\WINDOWS\system32\drivers\ip6fw.sys
21:51:28.0843 28368 Ip6Fw - ok
21:51:28.0875 28368 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
21:51:28.0875 28368 IpFilterDriver - ok
21:51:28.0890 28368 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys
21:51:28.0890 28368 IpInIp - ok
21:51:28.0937 28368 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys
21:51:28.0937 28368 IpNat - ok
21:51:28.0953 28368 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys
21:51:28.0953 28368 IPSec - ok
21:51:28.0968 28368 [ ACA5E7B54409F9CB5EED97ED0C81120E ] irda C:\WINDOWS\system32\DRIVERS\irda.sys
21:51:28.0968 28368 irda - ok
21:51:29.0000 28368 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys
21:51:29.0000 28368 IRENUM - ok
21:51:29.0046 28368 [ 8024EA8C5B2D2A4D201F418B0AADB804 ] Irmon C:\WINDOWS\System32\irmon.dll
21:51:29.0046 28368 Irmon - ok
21:51:29.0109 28368 [ CC9F8A2D60AED1A51A3AC34C59B987AE ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys
21:51:29.0109 28368 isapnp - ok
21:51:29.0281 28368 [ 9ECF00E19736054E019C532AED8228FC ] JavaQuickStarterService C:\Program Files\Java\jre7\bin\jqs.exe
21:51:29.0281 28368 JavaQuickStarterService - ok
21:51:29.0343 28368 [ 1B6162FE7F66B1A71A4B70F941C4AA9B ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys
21:51:29.0343 28368 Kbdclass - ok
21:51:29.0343 28368 [ 86C8F23616C6C6E5B2776901C17B945B ] kbdhid C:\WINDOWS\system32\DRIVERS\kbdhid.sys
21:51:29.0343 28368 kbdhid - ok
21:51:29.0375 28368 [ 692BCF44383D056AED41B045A323D378 ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys
21:51:29.0375 28368 kmixer - ok
21:51:29.0437 28368 [ B467646C54CC746128904E1654C750C1 ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys
21:51:29.0437 28368 KSecDD - ok
21:51:29.0484 28368 [ 3428E8F86F8ADD36B42FB23542C7B3E4 ] lanmanserver C:\WINDOWS\System32\srvsvc.dll
21:51:29.0500 28368 lanmanserver - ok
21:51:29.0546 28368 [ 936C1D110232D23B621CB0196E4F80F0 ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll
21:51:29.0562 28368 lanmanworkstation - ok
21:51:29.0609 28368 [ 0AB159F536E3E8F7F07113702A07CCA5 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll
21:51:29.0609 28368 LmHosts - ok
21:51:29.0656 28368 [ 221CD1C815B8A6B79389C3F5D1018DE8 ] Messenger C:\WINDOWS\System32\msgsvc.dll
21:51:29.0656 28368 Messenger - ok
21:51:29.0750 28368 Microsoft SharePoint Workspace Audit Service - ok
21:51:29.0796 28368 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys
21:51:29.0796 28368 mnmdd - ok
21:51:29.0843 28368 [ 9A57D046F88F4B69751B11FD40088A61 ] mnmsrvc C:\WINDOWS\system32\mnmsrvc.exe
21:51:29.0859 28368 mnmsrvc - ok
21:51:29.0890 28368 [ 44032B0C6D9954D3FD26438330B99EE7 ] Modem C:\WINDOWS\system32\drivers\Modem.sys
21:51:29.0890 28368 Modem - ok
21:51:29.0937 28368 [ 4CB582831DBDE63CE43B45D771218374 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys
21:51:29.0937 28368 Mouclass - ok
21:51:29.0953 28368 [ BB269EBA740737AB749B214D568B6812 ] mouhid C:\WINDOWS\system32\DRIVERS\mouhid.sys
21:51:29.0953 28368 mouhid - ok
21:51:29.0968 28368 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys
21:51:29.0968 28368 MountMgr - ok
21:51:30.0031 28368 [ 24406D75B40F0F6B3C1AC7031D734565 ] MpFilter C:\WINDOWS\system32\DRIVERS\MpFilter.sys
21:51:30.0031 28368 MpFilter - ok
21:51:30.0218 28368 [ 06D4F934E09C359B0EFBFB3146F1D910 ] MpKsl2c255dca C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{7C314158-3D22-4AAF-81C8-D44113C2D099}\MpKsl2c255dca.sys
21:51:30.0218 28368 MpKsl2c255dca - ok
21:51:30.0234 28368 mraid35x - ok
21:51:30.0250 28368 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys
21:51:30.0250 28368 MRxDAV - ok
21:51:30.0312 28368 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
21:51:30.0312 28368 MRxSmb - ok
21:51:30.0359 28368 [ 6DB4D1521CABA9A5FFAB54ADE0AE867D ] MSDTC C:\WINDOWS\system32\msdtc.exe
21:51:30.0359 28368 MSDTC - ok
21:51:30.0390 28368 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys
21:51:30.0406 28368 Msfs - ok
21:51:30.0453 28368 [ 95C6432151CCFF8617352F8E616A1AA4 ] MSIRCOMM C:\WINDOWS\system32\DRIVERS\MSIRCOMM.sys
21:51:30.0453 28368 MSIRCOMM - ok
21:51:30.0453 28368 MSIServer - ok
21:51:30.0484 28368 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys
21:51:30.0484 28368 MSKSSRV - ok
21:51:30.0546 28368 [ 37F77AEBFF23A99D1BFB4F34CD2D07F2 ] MsMpSvc C:\Program Files\Microsoft Security Client\MsMpEng.exe
21:51:30.0546 28368 MsMpSvc - ok
21:51:30.0578 28368 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys
21:51:30.0578 28368 MSPCLOCK - ok
21:51:30.0625 28368 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys
21:51:30.0625 28368 MSPQM - ok
21:51:30.0687 28368 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys
21:51:30.0687 28368 mssmbios - ok
21:51:30.0718 28368 [ E53736A9E30C45FA9E7B5EAC55056D1D ] MSTEE C:\WINDOWS\system32\drivers\MSTEE.sys
21:51:30.0734 28368 MSTEE - ok
21:51:30.0750 28368 [ AE4CF88BBCE4D4D2AC7889A80C01B117 ] MTK C:\WINDOWS\system32\Drivers\mtk.sys
21:51:30.0750 28368 MTK - ok
21:51:30.0796 28368 [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup C:\WINDOWS\system32\drivers\Mup.sys
21:51:30.0796 28368 Mup - ok
21:51:30.0859 28368 [ 5B50F1B2A2ED47D560577B221DA734DB ] NABTSFEC C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
21:51:30.0859 28368 NABTSFEC - ok
21:51:30.0906 28368 [ 6EA362E9DB03D44F6B996F4D8BE237E9 ] napagent C:\WINDOWS\System32\qagentrt.dll
21:51:30.0921 28368 napagent - ok
21:51:30.0953 28368 [ 1DF7F42665C94B825322FAE71721130D ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys
21:51:30.0953 28368 NDIS - ok
21:51:31.0000 28368 [ 7FF1F1FD8609C149AA432F95A8163D97 ] NdisIP C:\WINDOWS\system32\DRIVERS\NdisIP.sys
21:51:31.0000 28368 NdisIP - ok
21:51:31.0046 28368 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys
21:51:31.0046 28368 NdisTapi - ok
21:51:31.0093 28368 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys
21:51:31.0093 28368 Ndisuio - ok
21:51:31.0125 28368 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys
21:51:31.0125 28368 NdisWan - ok
21:51:31.0171 28368 [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys
21:51:31.0171 28368 NDProxy - ok
21:51:31.0203 28368 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys
21:51:31.0203 28368 NetBIOS - ok
21:51:31.0250 28368 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys
21:51:31.0250 28368 NetBT - ok
21:51:31.0312 28368 [ 933DE774986EC85E48210C44AB431DE6 ] NetDDE C:\WINDOWS\system32\netdde.exe
21:51:31.0312 28368 NetDDE - ok
21:51:31.0312 28368 [ 933DE774986EC85E48210C44AB431DE6 ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe
21:51:31.0328 28368 NetDDEdsdm - ok
21:51:31.0375 28368 [ ED0A176354487CEED65B80A7148AB739 ] Netlogon C:\WINDOWS\system32\lsass.exe
21:51:31.0375 28368 Netlogon - ok
21:51:31.0390 28368 [ 72E1E9E2977BE08BDEEDB6D8FD9D4D40 ] Netman C:\WINDOWS\System32\netman.dll
21:51:31.0390 28368 Netman - ok
21:51:31.0468 28368 [ 737351F39FEF765234037770ABDD72BD ] NetSvc C:\Program Files\Intel\NCS\Sync\NetSvc.exe
21:51:31.0578 28368 NetSvc - ok
21:51:31.0625 28368 [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
21:51:31.0625 28368 NetTcpPortSharing - ok
21:51:31.0671 28368 [ 39EE7C3BFBC64BA87CC8CF67386E814C ] Nla C:\WINDOWS\System32\mswsock.dll
21:51:31.0687 28368 Nla - ok
21:51:31.0734 28368 [ F6C40E0A565EE3CE5AEEB325E10054F2 ] nmwcd C:\WINDOWS\system32\drivers\ccdcmb.sys
21:51:31.0734 28368 nmwcd - ok
21:51:31.0781 28368 [ 2A394E9E1FA3565E4B2FEA470FFE4D6B ] nmwcdc C:\WINDOWS\system32\drivers\ccdcmbo.sys
21:51:31.0781 28368 nmwcdc - ok
21:51:31.0828 28368 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys
21:51:31.0828 28368 Npfs - ok
21:51:31.0843 28368 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys
21:51:31.0859 28368 Ntfs - ok
21:51:31.0875 28368 [ ED0A176354487CEED65B80A7148AB739 ] NtLmSsp C:\WINDOWS\system32\lsass.exe
21:51:31.0875 28368 NtLmSsp - ok
21:51:31.0921 28368 [ 023DD70573D644F3D9C8B1258A7BFD08 ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll
21:51:31.0937 28368 NtmsSvc - ok
21:51:31.0984 28368 [ 9620A1D8160A550F064BBAF48D0F97CC ] NuidFltr C:\WINDOWS\system32\DRIVERS\NuidFltr.sys
21:51:31.0984 28368 NuidFltr - ok
21:51:32.0000 28368 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINDOWS\system32\drivers\Null.sys
21:51:32.0000 28368 Null - ok
21:51:32.0031 28368 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
21:51:32.0031 28368 NwlnkFlt - ok
21:51:32.0062 28368 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
21:51:32.0062 28368 NwlnkFwd - ok
21:51:32.0140 28368 [ 9D10F99A6712E28F8ACD5641E3A7EA6B ] ose C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
21:51:32.0140 28368 ose - ok
21:51:32.0421 28368 [ 358A9CCA612C68EB2F07DDAD4CE1D8D7 ] osppsvc C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
21:51:32.0609 28368 osppsvc - ok
21:51:32.0671 28368 [ 46F8DB73B4A53E543F8E371DC7C75BAE ] Parport C:\WINDOWS\system32\DRIVERS\parport.sys
21:51:32.0671 28368 Parport - ok
21:51:32.0687 28368 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys
21:51:32.0687 28368 PartMgr - ok
21:51:32.0750 28368 [ 1FAE19D0457176318BBA4A8795656EBC ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys
21:51:32.0750 28368 ParVdm - ok
21:51:32.0750 28368 pccsmcfd - ok
21:51:32.0796 28368 [ 6CE351D149CB4BEFC702951E471E1730 ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys
21:51:32.0796 28368 PCI - ok
21:51:32.0812 28368 PCIDump - ok
21:51:32.0859 28368 [ 2DA4EC85E0EA7A45C6B2A05820492D5A ] PCIIde C:\WINDOWS\system32\DRIVERS\pciide.sys
21:51:32.0859 28368 PCIIde - ok
21:51:32.0906 28368 [ 4FC31E6C19A5CE5198B1ABFF94CAE758 ] Pcmcia C:\WINDOWS\system32\drivers\Pcmcia.sys
21:51:32.0906 28368 Pcmcia - ok
21:51:32.0921 28368 PdiPorts - ok
21:51:32.0937 28368 perc2 - ok
21:51:32.0937 28368 perc2hib - ok
21:51:33.0000 28368 [ DE603A51D5C8831B240F805F699C12F1 ] pivot C:\WINDOWS\system32\drivers\pivot.sys
21:51:33.0000 28368 pivot - ok
21:51:33.0031 28368 [ D26FEE534399CAB4B42EF2F87679402B ] pivotmou C:\WINDOWS\system32\drivers\pivotmou.sys
21:51:33.0031 28368 pivotmou - ok
21:51:33.0062 28368 [ 9EF697AF07BB8DD82C3B02CA953A95B7 ] PlugPlay C:\WINDOWS\system32\services.exe
21:51:33.0062 28368 PlugPlay - ok
21:51:33.0109 28368 [ 896D916DE06F5502D301E8C4DC442AE8 ] Point32 C:\WINDOWS\system32\DRIVERS\point32.sys
21:51:33.0109 28368 Point32 - ok
21:51:33.0125 28368 [ ED0A176354487CEED65B80A7148AB739 ] PolicyAgent C:\WINDOWS\system32\lsass.exe
21:51:33.0125 28368 PolicyAgent - ok
21:51:33.0187 28368 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys
21:51:33.0187 28368 PptpMiniport - ok
21:51:33.0218 28368 [ 65937A34C9A5741E3030A86905400D91 ] PRODIGY C:\WINDOWS\system32\Drivers\PRODIGY.SYS
21:51:33.0234 28368 PRODIGY - ok
21:51:33.0250 28368 [ ED0A176354487CEED65B80A7148AB739 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe
21:51:33.0250 28368 ProtectedStorage - ok
21:51:33.0312 28368 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys
21:51:33.0312 28368 PSched - ok
21:51:33.0359 28368 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys
21:51:33.0359 28368 Ptilink - ok
21:51:33.0406 28368 [ 49452BFCEC22F36A7A9B9C2181BC3042 ] PxHelp20 C:\WINDOWS\system32\Drivers\PxHelp20.sys
21:51:33.0406 28368 PxHelp20 - ok
21:51:33.0421 28368 ql1080 - ok
21:51:33.0421 28368 Ql10wnt - ok
21:51:33.0437 28368 ql12160 - ok
21:51:33.0453 28368 ql1240 - ok
21:51:33.0453 28368 ql1280 - ok
21:51:33.0500 28368 [ 0087F01D35A65B32393CC8BBA46EE4A6 ] QV2KUX C:\WINDOWS\system32\DRIVERS\qv2kux.sys
21:51:33.0500 28368 QV2KUX - ok
21:51:33.0531 28368 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys
21:51:33.0531 28368 RasAcd - ok
21:51:33.0578 28368 [ 2B5E44EA009F2F374B980E1E9A70635D ] RasAuto C:\WINDOWS\System32\rasauto.dll
21:51:33.0578 28368 RasAuto - ok
21:51:33.0625 28368 [ 0207D26DDF796A193CCD9F83047BB5FC ] Rasirda C:\WINDOWS\system32\DRIVERS\rasirda.sys
21:51:33.0625 28368 Rasirda - ok
21:51:33.0671 28368 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
21:51:33.0687 28368 Rasl2tp - ok
21:51:33.0734 28368 [ D57554C664B64604BD1EE13EA2C07E77 ] RasMan C:\WINDOWS\System32\rasmans.dll
21:51:33.0750 28368 RasMan - ok
21:51:33.0750 28368 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys
21:51:33.0750 28368 RasPppoe - ok
21:51:33.0765 28368 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys
21:51:33.0765 28368 Raspti - ok
21:51:33.0828 28368 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys
21:51:33.0828 28368 Rdbss - ok
21:51:33.0843 28368 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
21:51:33.0843 28368 RDPCDD - ok
21:51:33.0906 28368 [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr C:\WINDOWS\system32\DRIVERS\rdpdr.sys
21:51:33.0906 28368 rdpdr - ok
21:51:33.0953 28368 [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys
21:51:33.0953 28368 RDPWD - ok
21:51:33.0984 28368 [ C0D9D9711CB74EE9BC66353D8CBDAB0E ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe
21:51:33.0984 28368 RDSessMgr - ok
21:51:34.0031 28368 [ 611BFD220305BE3A85AE876EA47D4AA5 ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys
21:51:34.0031 28368 redbook - ok
21:51:34.0093 28368 [ 127C26B5371651043450E52542099ABA ] RemoteAccess C:\WINDOWS\System32\mprdim.dll
21:51:34.0093 28368 RemoteAccess - ok
21:51:34.0140 28368 [ 8F31505484A190D5B22274708799F4EC ] RemoteRegistry C:\WINDOWS\system32\regsvc.dll
21:51:34.0140 28368 RemoteRegistry - ok
21:51:34.0156 28368 [ 851C30DF2807FCFA21E4C681A7D6440E ] RFCOMM C:\WINDOWS\system32\DRIVERS\rfcomm.sys
21:51:34.0156 28368 RFCOMM - ok
21:51:34.0187 28368 [ D8B0B4ADE32574B2D9C5CC34DC0DBBE7 ] ROOTMODEM C:\WINDOWS\system32\Drivers\RootMdm.sys
21:51:34.0187 28368 ROOTMODEM - ok
21:51:34.0234 28368 [ 718B3BDC0BC3C2F7D065A53D26202AF9 ] RpcLocator C:\WINDOWS\system32\locator.exe
21:51:34.0234 28368 RpcLocator - ok
21:51:34.0265 28368 [ BE27674D1CBC3214AEC84B4336A38BBF ] RpcSs C:\WINDOWS\System32\rpcss.dll
21:51:34.0265 28368 RpcSs - ok
21:51:34.0312 28368 [ 09AB2E71E58B078038E3BFDBA7FFC984 ] RSVP C:\WINDOWS\system32\rsvp.exe
21:51:34.0312 28368 RSVP - ok
21:51:34.0343 28368 [ ED0A176354487CEED65B80A7148AB739 ] SamSs C:\WINDOWS\system32\lsass.exe
21:51:34.0343 28368 SamSs - ok
21:51:34.0343 28368 SANDRA - ok
21:51:34.0390 28368 [ 410046E401EB11E1E6749E9DEEA41D4A ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe
21:51:34.0406 28368 SCardSvr - ok
21:51:34.0453 28368 [ 3FF232A7731621B8902D81D42418C93C ] Schedule C:\WINDOWS\system32\schedsvc.dll
21:51:34.0453 28368 Schedule - ok
21:51:34.0500 28368 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys
21:51:34.0515 28368 Secdrv - ok
21:51:34.0531 28368 [ 477E2C3CC5E4A0D635BCB0EA8DCAC3C6 ] seclogon C:\WINDOWS\System32\seclogon.dll
21:51:34.0531 28368 seclogon - ok
21:51:34.0546 28368 [ A530B75C10C23C9AB28FDB6CE719E21F ] SENS C:\WINDOWS\system32\sens.dll
21:51:34.0562 28368 SENS - ok
21:51:34.0609 28368 [ 0F29512CCD6BEAD730039FB4BD2C85CE ] serenum C:\WINDOWS\system32\DRIVERS\serenum.sys
21:51:34.0609 28368 serenum - ok
21:51:34.0656 28368 [ B842729337C9B921615C40D3C1A1AF96 ] Serial C:\WINDOWS\system32\DRIVERS\serial.sys
21:51:34.0656 28368 Serial - ok
21:51:34.0687 28368 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINDOWS\system32\drivers\Sfloppy.sys
21:51:34.0687 28368 Sfloppy - ok
21:51:34.0750 28368 [ F58FACA9621D2DB01BD0927D9A0A208E ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll
21:51:34.0765 28368 SharedAccess - ok
21:51:34.0781 28368 [ EE9A2B9EA968A792A053C9D1A86BF870 ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll
21:51:34.0781 28368 ShellHWDetection - ok
21:51:34.0796 28368 Simbad - ok
21:51:34.0828 28368 [ 866D538EBE33709A5C9F5C62B73B7D14 ] SLIP C:\WINDOWS\system32\DRIVERS\SLIP.sys
21:51:34.0828 28368 SLIP - ok
21:51:34.0921 28368 [ 3A4F2C0BB87A0895ABEBA341AA1E341B ] Sony PC Companion C:\Program Files\Sony\Sony PC Companion\PCCService.exe
21:51:35.0015 28368 Sony PC Companion - ok
21:51:35.0031 28368 Sparrow - ok
21:51:35.0078 28368 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINDOWS\system32\drivers\splitter.sys
21:51:35.0078 28368 splitter - ok
21:51:35.0125 28368 [ 60784F891563FB1B767F70117FC2428F ] Spooler C:\WINDOWS\system32\spoolsv.exe
21:51:35.0140 28368 Spooler - ok
21:51:35.0156 28368 [ 94610C8653635E4459316A0050D55CE7 ] sr C:\WINDOWS\system32\DRIVERS\sr.sys
21:51:35.0156 28368 sr - ok
21:51:35.0203 28368 [ 35B91147124F64AC8081A2EDB9EA4DEE ] srservice C:\WINDOWS\system32\srsvc.dll
21:51:35.0218 28368 srservice - ok
21:51:35.0265 28368 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys
21:51:35.0281 28368 Srv - ok
21:51:35.0328 28368 [ 069351A1D7D291013177A90AE6EDCCBC ] sscdbus C:\WINDOWS\system32\DRIVERS\sscdbus.sys
21:51:35.0328 28368 sscdbus - ok
21:51:35.0359 28368 [ 1C925BE223A5C0F9F469252292A48DF6 ] sscdmdfl C:\WINDOWS\system32\DRIVERS\sscdmdfl.sys
21:51:35.0359 28368 sscdmdfl - ok
21:51:35.0390 28368 [ AE3E77AE0FBDB07EB1AC3FED74A0695E ] sscdmdm C:\WINDOWS\system32\DRIVERS\sscdmdm.sys
21:51:35.0390 28368 sscdmdm - ok
21:51:35.0421 28368 [ BECD5271DC4E3B7C3D035F790FCBC1E5 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll
21:51:35.0437 28368 SSDPSRV - ok
21:51:35.0468 28368 [ 8F299012EF58246F1C98DE7B7E48DBF0 ] ssudmdm C:\WINDOWS\system32\DRIVERS\ssudmdm.sys
21:51:35.0468 28368 ssudmdm - ok
21:51:35.0500 28368 [ 54946449A0EB74915A4BB34F7EE51A5A ] ss_bus C:\WINDOWS\system32\DRIVERS\ss_bus.sys
21:51:35.0515 28368 ss_bus - ok
21:51:35.0531 28368 [ 4450BC0B2E9D7D9B90E3C3DE4EA00A78 ] ss_mdfl C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys
21:51:35.0531 28368 ss_mdfl - ok
21:51:35.0562 28368 [ 30B8D0DD01EAD1243F329CAF7D7D1517 ] ss_mdm C:\WINDOWS\system32\DRIVERS\ss_mdm.sys
21:51:35.0562 28368 ss_mdm - ok
21:51:35.0593 28368 [ A1A16662C6B1A665D965D61B9EECC5A7 ] STIrUsb C:\WINDOWS\system32\DRIVERS\irstusb.sys
21:51:35.0593 28368 STIrUsb - ok
21:51:35.0656 28368 [ C1CDD9275F6A115BB0AE1D55D8D27BA6 ] stisvc C:\WINDOWS\system32\wiaservc.dll
21:51:35.0703 28368 stisvc - ok
21:51:35.0750 28368 [ 77813007BA6265C4B6098187E6ED79D2 ] streamip C:\WINDOWS\system32\DRIVERS\StreamIP.sys
21:51:35.0750 28368 streamip - ok
21:51:35.0796 28368 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys
21:51:35.0796 28368 swenum - ok
21:51:35.0812 28368 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys
21:51:35.0812 28368 swmidi - ok
21:51:35.0828 28368 SwPrv - ok
21:51:35.0843 28368 symc810 - ok
21:51:35.0843 28368 symc8xx - ok
21:51:35.0859 28368 sym_hi - ok
21:51:35.0859 28368 sym_u3 - ok
21:51:35.0875 28368 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys
21:51:35.0875 28368 sysaudio - ok
21:51:35.0921 28368 [ CE06F01B88ACE199A1BF460CAC29C110 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe
21:51:35.0921 28368 SysmonLog - ok
21:51:35.0968 28368 [ C2546CD7A398476F9DF5614B2AE160E8 ] TapiSrv C:\WINDOWS\System32\tapisrv.dll
21:51:35.0984 28368 TapiSrv - ok
21:51:36.0046 28368 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys
21:51:36.0046 28368 Tcpip - ok
21:51:36.0093 28368 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys
21:51:36.0093 28368 TDPIPE - ok
21:51:36.0109 28368 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys
21:51:36.0109 28368 TDTCP - ok
21:51:36.0140 28368 [ 88155247177638048422893737429D9E ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys
21:51:36.0140 28368 TermDD - ok
21:51:36.0203 28368 [ A75DD6FC3DBEE4FFF5EBC9F2C28BB66E ] TermService C:\WINDOWS\System32\termsrv.dll
21:51:36.0203 28368 TermService - ok
21:51:36.0234 28368 [ EE9A2B9EA968A792A053C9D1A86BF870 ] Themes C:\WINDOWS\System32\shsvcs.dll
21:51:36.0234 28368 Themes - ok
21:51:36.0281 28368 [ CD0CC7B167D78043A41C98D4921EFB54 ] TlntSvr C:\WINDOWS\system32\tlntsvr.exe
21:51:36.0281 28368 TlntSvr - ok
21:51:36.0296 28368 TosIde - ok
21:51:36.0328 28368 [ 38853304CCB938D30E0C4CDE8D2C2A8A ] TrkWks C:\WINDOWS\system32\trkwks.dll
21:51:36.0343 28368 TrkWks - ok
21:51:36.0359 28368 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys
21:51:36.0359 28368 Udfs - ok
21:51:36.0375 28368 ultra - ok
21:51:36.0437 28368 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update C:\WINDOWS\system32\DRIVERS\update.sys
21:51:36.0437 28368 Update - ok
21:51:36.0484 28368 [ 651BD90DCEE5B7BDC74A2EB7C9266F9E ] upnphost C:\WINDOWS\System32\upnphost.dll
21:51:36.0500 28368 upnphost - ok
21:51:36.0531 28368 [ 47F5F9D837D80FFD5882A14DB9DA0A67 ] upperdev C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys
21:51:36.0531 28368 upperdev - ok
21:51:36.0546 28368 [ 20A0F6A11959E92908717D09E87D670D ] UPS C:\WINDOWS\System32\ups.exe
21:51:36.0546 28368 UPS - ok
21:51:36.0578 28368 [ E919708DB44ED8543A7C017953148330 ] usbaudio C:\WINDOWS\system32\drivers\usbaudio.sys
21:51:36.0593 28368 usbaudio - ok
21:51:36.0640 28368 [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys
21:51:36.0640 28368 usbccgp - ok
21:51:36.0703 28368 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys
21:51:36.0703 28368 usbehci - ok
21:51:36.0750 28368 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys
21:51:36.0750 28368 usbhub - ok
21:51:36.0812 28368 [ A717C8721046828520C9EDF31288FC00 ] usbprint C:\WINDOWS\system32\DRIVERS\usbprint.sys
21:51:36.0812 28368 usbprint - ok
21:51:36.0859 28368 [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys
21:51:36.0859 28368 usbscan - ok
21:51:36.0906 28368 [ E44F0D17BE0908B58DCC99CCB99C6C32 ] UsbserFilt C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys
21:51:36.0921 28368 UsbserFilt - ok
21:51:36.0968 28368 [ A32426D9B14A089EAA1D922E0C5801A9 ] USBSTOR C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
21:51:36.0968 28368 USBSTOR - ok
21:51:36.0968 28368 [ 26496F9DEE2D787FC3E61AD54821FFE6 ] usbuhci C:\WINDOWS\system32\DRIVERS\usbuhci.sys
21:51:36.0968 28368 usbuhci - ok
21:51:37.0031 28368 [ 63BBFCA7F390F4C49ED4B96BFB1633E0 ] usbvideo C:\WINDOWS\system32\Drivers\usbvideo.sys
21:51:37.0031 28368 usbvideo - ok
21:51:37.0078 28368 [ B4D7B7AD8A9F7C063C5CC3E2C1A0724E ] usb_rndisx C:\WINDOWS\system32\DRIVERS\usb8023x.sys
21:51:37.0078 28368 usb_rndisx - ok
21:51:37.0093 28368 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINDOWS\System32\drivers\vga.sys
21:51:37.0093 28368 VgaSave - ok
21:51:37.0109 28368 ViaIde - ok
21:51:37.0156 28368 [ 28A4B296B47782173C346E376CB374D1 ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys
21:51:37.0171 28368 VolSnap - ok
21:51:37.0218 28368 [ D6BA1A63D9E00933F1CD2A885573AFB2 ] VSS C:\WINDOWS\System32\vssvc.exe
21:51:37.0218 28368 VSS - ok
21:51:37.0250 28368 [ FA4E1CDBA256787F2149F4AAD07BC91F ] W32Time C:\WINDOWS\system32\w32time.dll
21:51:37.0265 28368 W32Time - ok
21:51:37.0281 28368 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys
21:51:37.0281 28368 Wanarp - ok
21:51:37.0343 28368 [ D918617B46457B9AC28027722E30F647 ] Wdf01000 C:\WINDOWS\system32\Drivers\wdf01000.sys
21:51:37.0359 28368 Wdf01000 - ok
21:51:37.0375 28368 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys
21:51:37.0375 28368 wdmaud - ok
21:51:37.0421 28368 [ 47AE51048A82DFA1CD6B51D369F7E169 ] WebClient C:\WINDOWS\System32\webclnt.dll
21:51:37.0421 28368 WebClient - ok
21:51:37.0515 28368 [ E488332126E3B1182D2B8A0C35408EC6 ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll
21:51:37.0531 28368 winmgmt - ok
21:51:37.0609 28368 [ 4D34CEDD74BDBF2B6A935EAE3BF80543 ] WinRM C:\WINDOWS\system32\WsmSvc.dll
21:51:37.0671 28368 WinRM - ok
21:51:37.0734 28368 [ 30FC6E5448D0CBAAA95280EEEF7FEDAE ] WinUSB C:\WINDOWS\system32\DRIVERS\WinUSB.sys
21:51:37.0750 28368 WinUSB - ok
21:51:37.0796 28368 [ 051B1BDECD6DEE18C771B5D5EC7F044D ] WmdmPmSN C:\WINDOWS\system32\MsPMSNSv.dll
21:51:37.0796 28368 WmdmPmSN - ok
21:51:37.0859 28368 [ 0171CFF34BBA8C5977F18C48D8AEF8C6 ] Wmi C:\WINDOWS\System32\advapi32.dll
21:51:37.0890 28368 Wmi - ok
21:51:37.0937 28368 [ 23F6F03272F7E5679F1F050AED5ACEE6 ] WmiApSrv C:\WINDOWS\system32\wbem\wmiapsrv.exe
21:51:38.0015 28368 WmiApSrv - ok
21:51:38.0125 28368 [ 0DCC3A79329F0FDE9B1B5283CACD3F50 ] WMPNetworkSvc C:\Program Files\Windows Media Player\WMPNetwk.exe
21:51:38.0156 28368 WMPNetworkSvc - ok
21:51:38.0203 28368 [ C60DC16D4E406810FAD54B98DC92D5EC ] WpdUsb C:\WINDOWS\system32\DRIVERS\wpdusb.sys
21:51:38.0203 28368 WpdUsb - ok
21:51:38.0421 28368 [ B800EEC15851597405784126C407188C ] WPFFontCache_v0400 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
21:51:38.0500 28368 WPFFontCache_v0400 - ok
21:51:38.0562 28368 [ 6ABE6E225ADB5A751622A9CC3BC19CE8 ] WS2IFSL C:\WINDOWS\System32\drivers\ws2ifsl.sys
21:51:38.0562 28368 WS2IFSL - ok
21:51:38.0609 28368 [ 4C86D5FAF78194995AF9CC1075F65DD3 ] wscsvc C:\WINDOWS\system32\wscsvc.dll
21:51:38.0609 28368 wscsvc - ok
21:51:38.0671 28368 [ C98B39829C2BBD34E454150633C62C78 ] WSTCODEC C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
21:51:38.0671 28368 WSTCODEC - ok
21:51:38.0703 28368 [ C1364564800EE9784192145324A23308 ] wuauserv C:\WINDOWS\system32\wuauserv.dll
21:51:38.0703 28368 wuauserv - ok
21:51:38.0765 28368 [ EAA6324F51214D2F6718977EC9CE0DEF ] WudfPf C:\WINDOWS\system32\DRIVERS\WudfPf.sys
21:51:38.0765 28368 WudfPf - ok
21:51:38.0781 28368 [ F91FF1E51FCA30B3C3981DB7D5924252 ] WudfRd C:\WINDOWS\system32\DRIVERS\wudfrd.sys
21:51:38.0781 28368 WudfRd - ok
21:51:38.0796 28368 [ DDEE3682FE97037C45F4D7AB467CB8B6 ] WudfSvc C:\WINDOWS\System32\WUDFSvc.dll
21:51:38.0796 28368 WudfSvc - ok
21:51:38.0875 28368 [ A27D4BA7264C0BF52F32D10405BEA1D4 ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll
21:51:38.0875 28368 WZCSVC - ok
21:51:38.0906 28368 [ EAA4BB9EDB3FB10CF8979FE65E63658F ] xmlprov C:\WINDOWS\System32\xmlprov.dll
21:51:38.0921 28368 xmlprov - ok
21:51:38.0953 28368 ================ Scan global ===============================
21:51:39.0000 28368 [ F36278E42C8C5DF03CE17DAC8231C91C ] C:\WINDOWS\system32\basesrv.dll
21:51:39.0046 28368 [ 4C0AA4ABC4E21672B55D8A700AF2B2A6 ] C:\WINDOWS\system32\winsrv.dll
21:51:39.0125 28368 [ 4C0AA4ABC4E21672B55D8A700AF2B2A6 ] C:\WINDOWS\system32\winsrv.dll
21:51:39.0125 28368 [ 9EF697AF07BB8DD82C3B02CA953A95B7 ] C:\WINDOWS\system32\services.exe
21:51:39.0140 28368 [Global] - ok
21:51:39.0140 28368 ================ Scan MBR ==================================
21:51:39.0156 28368 [ 413FC2A0C716421B3158746D63736515 ] \Device\Harddisk0\DR0
21:51:40.0000 28368 \Device\Harddisk0\DR0 - ok
21:51:40.0031 28368 [ 5C616939100B85E558DA92B899A0FC36 ] \Device\Harddisk1\DR1
21:51:40.0031 28368 \Device\Harddisk1\DR1 - ok
21:51:40.0031 28368 ================ Scan VBR ==================================
21:51:40.0031 28368 [ 0F267107CA7D8EA710CA33CA7D1D05DF ] \Device\Harddisk0\DR0\Partition1
21:51:40.0046 28368 \Device\Harddisk0\DR0\Partition1 - ok
21:51:40.0046 28368 [ 7E22CC4DC916E2D23010F0CF89C4A395 ] \Device\Harddisk1\DR1\Partition1
21:51:40.0046 28368 \Device\Harddisk1\DR1\Partition1 - ok
21:51:40.0046 28368 ============================================================
21:51:40.0046 28368 Scan finished
21:51:40.0046 28368 ============================================================
21:51:40.0062 28300 Detected object count: 0
21:51:40.0062 28300 Actual detected object count: 0

Dej ještě jednou Rogue a akci FIXHOST a pak zase log z Rogue

Vypni rezidentní štít antiviru a antispywaru
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Pokud bude po kontrole problém spustit aplikace nebo bude vyskakovat hláška o pokusu použít neplatnou operaci na klíč registru, který je oznaèen pro odstranění, stačí restartovat počítač.

Combo mi žádný log nevytvořil ani není pod danou adresou. Našel jsem tam ale tento tex. dokument. Tak nevím jestli je to ono:


ComboFix 13-10-01.03 - bohouš 01.10.2013 22:33:43.23.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2047.1417 [GMT 2:00]
Spuštěný z: C:\Documents and Settings\bohouš\Plocha\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}


((((((((((((((((((((((((( Soubory vytvořené od 2013-09-01 do 2013-10-01 )))))))))))))))))))))))))))))))


2013-10-01 19:51:09 . 2013-10-01 19:51:10 177496 ----a-w- C:\WINDOWS\system32\drivers\30918476.sys
2013-10-01 19:45:39 . 2013-10-01 19:45:39 40392 ----a-w- C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{7C314158-3D22-4AAF-81C8-D44113C2D099}\MpKsl2c255dca.sys
2013-10-01 18:22:52 . 2013-09-05 05:02:37 7328304 ----a-w- C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{7C314158-3D22-4AAF-81C8-D44113C2D099}\mpengine.dll
2013-10-01 18:16:54 . 2013-10-01 18:16:54 -------- d-----w- C:\WINDOWS\ERUNT
2013-10-01 17:27:42 . 2013-10-01 17:28:34 -------- d-----w- C:\Program Files\Hosts_Anti_Adwares_PUPs
2013-10-01 08:32:22 . 2013-04-04 12:50:32 22856 ----a-w- C:\WINDOWS\system32\drivers\mbam.sys
2013-10-01 08:22:39 . 2013-10-01 17:34:46 -------- d-----w- C:\AdwCleaner
2013-10-01 06:53:52 . 2013-10-01 06:53:53 388096 ----a-r- C:\Documents and Settings\bohouš\Data aplikací\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2013-09-29 06:54:47 . 2013-09-05 05:02:37 7328304 ----a-w- C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
.


(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))

2013-09-29 17:48:47 . 2012-03-30 06:41:31 692616 ----a-w- C:\WINDOWS\system32\FlashPlayerApp.exe
2013-09-29 17:48:46 . 2011-06-16 09:46:39 71048 ----a-w- C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
2013-08-09 01:56:34 . 2004-08-17 15:49:20 386560 ----a-w- C:\WINDOWS\system32\themeui.dll
2013-08-08 06:09:49 . 2004-08-17 15:44:44 1877760 ----a-w- C:\WINDOWS\system32\win32k.sys
2013-08-08 06:05:47 . 2004-08-17 15:49:22 920064 ----a-w- C:\WINDOWS\system32\wininet.dll
2013-08-08 06:05:46 . 2004-08-17 15:49:30 1469440 ------w- C:\WINDOWS\system32\inetcpl.cpl
2013-08-08 06:05:46 . 2004-08-17 15:49:10 43520 ----a-w- C:\WINDOWS\system32\licmgr10.dll
2013-08-08 06:05:45 . 2004-08-17 15:49:04 18944 ----a-w- C:\WINDOWS\system32\corpol.dll
2013-08-08 00:02:34 . 2004-08-17 15:44:08 385024 ----a-w- C:\WINDOWS\system32\html.iec
2013-08-05 13:30:13 . 2004-08-17 15:49:16 1289216 ----a-w- C:\WINDOWS\system32\ole32.dll
2013-08-02 23:48:38 . 2009-01-30 18:35:52 1543680 ------w- C:\WINDOWS\system32\wmvdecod.dll
2013-07-10 10:37:49 . 2004-08-17 15:49:20 406016 ----a-w- C:\WINDOWS\system32\usp10.dll
2013-07-04 07:34:00 . 2004-08-17 15:45:30 2151936 ----a-w- C:\WINDOWS\system32\ntoskrnl.exe
2013-07-04 07:33:59 . 2004-08-17 15:45:32 2030592 ----a-w- C:\WINDOWS\system32\ntkrnlpa.exe
2010-02-15 13:48:39 . 2010-02-15 13:43:09 26665984 ------w- C:\Program Files\AdbeRdr930_cs_CZ.exe
2010-02-15 13:41:49 . 2010-02-15 13:41:48 1697792 ----a-w- C:\Program Files\AdbeRdrUpd913_all_incr.msp
2010-01-18 13:54:27 . 2010-01-18 13:51:59 77003400 ------w- C:\Program Files\BusinessCardsMX-setup.exe
2009-08-28 20:17:47 . 2009-08-28 20:17:46 1410632 ----a-w- C:\Program Files\setup_dm_paradies_foto_2.exe
2008-08-05 13:37:27 . 2008-08-05 13:30:06 6104632 ----a-w- C:\Program Files\picasaweb-current-setup.exe


(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))


*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="C:\Program Files\RocketDock\RocketDock.exe" [2007-09-02 11:58:52 495616]
"Rainlendar2"="C:\Program Files\Rainlendar2\Rainlendar2.exe" [2012-07-02 07:11:14 2498048]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PRONoMgr.exe"="C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe" [2003-03-11 15:24:40 86016]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2011-08-01 13:56:42 1821576]
"itype"="C:\Program Files\Microsoft IntelliType Pro\itype.exe" [2011-08-01 13:57:34 1313672]
"MSC"="C:\Program Files\Microsoft Security Client\msseces.exe" [2013-06-20 15:25:44 995176]
"HOSTS Anti-Adware_PUPs"="C:\Program Files\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware_main.exe" [2013-10-01 17:28:34 302961]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 07:52:18 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="C:\WINDOWS\system32\logonui.exe"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2013-04-04 21:06:36 958576 ----a-w- C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCSSync]
2010-03-13 13:54:26 91520 ----a-w- C:\Program Files\Microsoft Office\Office14\BCSSync.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
2008-04-14 07:52:56 110592 ----a-w- C:\WINDOWS\system32\bthprops.cpl

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CreativeMouse ]
2004-06-27 13:38:58 503808 ----a-w- C:\Program Files\Mouse Driver\MouseDrv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelliPoint]
2011-08-01 13:56:42 1821576 ----a-w- c:\Program Files\Microsoft IntelliPoint\ipoint.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MagicKey]
2004-03-15 12:27:24 45056 ----a-w- C:\PROGRA~1\MEDIAK~1\MagicKey.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OfficeSyncProcess]
2013-04-22 08:05:32 720064 ----a-w- C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2007-04-16 14:28:22 577536 ----a-w- C:\WINDOWS\soundman.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2010-02-10 22:32:54 61440 ----a-w- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2013-03-12 05:32:50 253816 ----a-w- C:\Program Files\Common Files\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Opera\\opera.exe"=
"C:\\Program Files\\ICQ7.2\\ICQ.exe"=
"C:\\Program Files\\ICQ7.2\\aolload.exe"=
"C:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"D:\\Plánovače\\čištění\\solutoinstaller.exe"=
"C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE"=
"C:\\WINDOWS\\system32\\msiexec.exe"=
"C:\\Documents and Settings\\bohouš\\Local Settings\\Data aplikací\\Google\\Google Talk Plugin\\googletalkplugin.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3306:TCP"= 3306:TCP:MySQL
"5985:TCP"= 5985:TCP:*:Disabled:Vzdálená správa systému Windows

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R1 AmgHips;AmgHips;C:\WINDOWS\system32\drivers\AmgHips.sys [2.3.2012 12:03:26 25248]
R1 MpKsl2c255dca;MpKsl2c255dca;C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{7C314158-3D22-4AAF-81C8-D44113C2D099}\MpKsl2c255dca.sys [1.10.2013 21:45:39 40392]
R2 FsUsbExService;FsUsbExService;C:\WINDOWS\system32\FsUsbExService.Exe [31.3.2012 19:40:54 238952]
R3 dc3d;MS Hardware Device Detection Driver;C:\WINDOWS\system32\drivers\dc3d.sys [12.6.2011 9:48:48 45288]
R3 FsUsbExDisk;FsUsbExDisk;C:\WINDOWS\system32\FsUsbExDisk.Sys [3.1.2011 11:22:09 36608]
S2 HOSTS Anti-PUPs;HOSTS Anti-PUPs;C:\Program Files\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware.exe -update --> C:\Program Files\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware.exe -update [?]
S3 Andbus;LGE Android Platform Composite USB Device;C:\WINDOWS\system32\drivers\lgandbus.sys [30.3.2012 17:33:07 14336]
S3 AndDiag;LGE Android Platform USB Serial Port;C:\WINDOWS\system32\drivers\lganddiag.sys [30.3.2012 17:33:08 20736]
S3 AndGps;LGE Android Platform USB GPS NMEA Port;C:\WINDOWS\system32\drivers\lgandgps.sys [30.3.2012 17:33:08 20096]
S3 ANDModem;LGE Android Platform USB Modem;C:\WINDOWS\system32\drivers\lgandmodem.sys [30.3.2012 17:33:09 25088]
S3 cpuz135;cpuz135; [x]
S3 cpuz136;cpuz136; [x]
S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);C:\WINDOWS\system32\drivers\ssudbus.sys [31.3.2012 20:13:20 80184]
S3 ggflt;SEMC USB Flash Driver Filter;C:\WINDOWS\system32\drivers\ggflt.sys [26.10.2012 9:53:26 12400]
S3 MTK;Media Technology Kernel Driver;C:\WINDOWS\system32\drivers\MTK.SYS [28.3.2007 10:33:44 15670]
S3 PRODIGY;PRODIGY;C:\WINDOWS\system32\drivers\prodigy.sys [26.4.2010 9:40:27 32377]
S3 Sony PC Companion;Sony PC Companion;C:\Program Files\Sony\Sony PC Companion\PCCService.exe [4.8.2013 18:10:56 155824]
S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);C:\WINDOWS\system32\drivers\ssudmdm.sys [31.3.2012 20:13:20 181432]

--- Ostatní služby/ovladače v paměti ---

*NewlyCreated* - 16462379
*NewlyCreated* - FSUSBEXDISK
*NewlyCreated* - HOSTS_ANTI-PUPS
*NewlyCreated* - MPKSL2C255DCA
*NewlyCreated* - MPKSL42E90CDB
*Deregistered* - 16462379
*Deregistered* - MpKsl42e90cdb
*Deregistered* - TrueSight

Obsah adresáře 'Naplánované úlohy'

2013-10-01 C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-30 06:41:31 . 2013-09-29 17:48:48]

2013-10-01 C:\WINDOWS\Tasks\Microsoft Antimalware Scheduled Scan.job
- C:\Program Files\Microsoft Security Client\MpCmdRun.exe [2013-06-20 16:05:14 . 2013-06-20 16:05:14]

2013-10-01 C:\WINDOWS\Tasks\MpIdleTask.job
- C:\Program Files\Microsoft Security Client\MpCmdRun.exe [2013-06-20 16:05:14 . 2013-06-20 16:05:14]


------- Doplňkový sken -------

uStart Page = hxxp://www.google.com
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uDefault_Search_URL = hxxp://www.google.com
mStart Page = hxxp://www.google.com
mSearch Bar = hxxp://www.google.com
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - C:\WINDOWS\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Excel - C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 192.168.1.1

- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

AddRemove-vfd-ob - C:\Program Files\OpenApp\vfd-ob_uninstall.exe
AddRemove-GoforFiles - C:\Program Files\GoforFiles\uninstall.exe


RogueKiller V8.7.0 [Sep 30 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Podpora : http://www.adlice.com/forum/
Webové stránky : http://www.adlice.com/softwares/roguekiller/
: http://tigzyrk.blogspot.com/

Operační systém : Windows XP (5.1.2600 Service Pack 3) 32 bits version
Spuštěno v : Normální režim
Uživatel : bohouš [Práva správce]
Mód : Oprava HOSTS -- Datum : 10/01/2013 22:26:25
| ARK || FAK || MBR |

¤¤¤ Škodlivé procesy: : 1 ¤¤¤
[SUSP UNIC] TDSSKiller.exe -- C:\Documents and Settings\bohouš\Local Settings\temp\Rar$EX00.750\TDSSKiller.exe [7] -> SMAZÁNO [TermProc]

¤¤¤ ¤¤¤ Záznamy Registrů: : 0 ¤¤¤

¤¤¤ Ovladač : [NAHRÁNO] ¤¤¤

¤¤¤ Externí včelstvo: ¤¤¤

¤¤¤ Nákaza : ¤¤¤

¤¤¤ Soubor HOSTS: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts


127.0.0.1 08sr.combineads.info # hosts anti-adware / pups
127.0.0.1 08srvr.combineads.info # hosts anti-adware / pups
127.0.0.1 12srvr.combineads.info # hosts anti-adware / pups
127.0.0.1 2010-fr.com # hosts anti-adware / pups
127.0.0.1 2012-new.biz # hosts anti-adware / pups
127.0.0.1 2319825.ourtoolbar.com # hosts anti-adware / pups
127.0.0.1 24h00business.com # hosts anti-adware / pups
127.0.0.1 a.daasafterdusk.com # hosts anti-adware / pups
127.0.0.1 ad.adn360.com # hosts anti-adware / pups
127.0.0.1 adeartss.eu # hosts anti-adware / pups
127.0.0.1 adesoeasy.eu # hosts anti-adware / pups
127.0.0.1 adf.girldatesforfree.net # hosts anti-adware / pups
127.0.0.1 adm.soft365.com # hosts anti-adware / pups
127.0.0.1 adomicileavail.googlepages.com # hosts anti-adware / pups
127.0.0.1 ads7.complexadveising.com # hosts anti-adware / pups
127.0.0.1 ads.aff.co # hosts anti-adware / pups
127.0.0.1 ads.alpha00001.com # hosts anti-adware / pups
127.0.0.1 ads.cloud4ads.com # hosts anti-adware / pups
127.0.0.1 ads.eorezo.com # hosts anti-adware / pups
127.0.0.1 ads.hooqy.com # hosts anti-adware / pups
[...]


¤¤¤ Resetovaný HOSTS: ¤¤¤
127.0.0.1 localhost


Dokončeno : << RKreport[0]_H_10012013_222625.txt >>
RKreport[0]_D_10012013_214817.txt;RKreport[0]_S_10012013_200927.txt;RKreport[0]_S_10012013_214745.txt
RKreport[0]_S_10012013_222616.txt

Odinstaluj:
Hosts_Anti_Adwares_PUPs


Spusť znovu RogueKiller
Pokud používáš Win Vista či W7, klikni na RogueKiller pravým a dej spustit jako správce.
Pak klikni na Oprava Host a Zpráva - otevře se log, ten sem vlož.


Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

Upozornění : Může se stát, že po aplikaci Combofixu a restartu počítače, Windows nenaběhnou , nebo nenajede plocha , budou problémy s připojením, pak znovu restartuj počítač, pokud to nepomůže , po restartu mačkej klávesu F8 a pak zvol poslední známou funkční konfiguraci. , či použij bod obnovy.

Stáhni si aswMBR
http://files.avast.com/files/rootkit-scanner/aswmbr.exe
na svojí plochu. Uzavři všechna okna , programy a prohlížeče. Poklepej na aswMBR.exe. Pokud se objeví hláška o možnosti stáhnutí databáze Avastu , klikni na NE. Poté klikni na „Scan“ . Po skenu klikni na „Save Log“ a ulož si log na plochu .Zkopíruj sem celý obsah toho logu. Pak klikni na „Exit“ k zavření programu.

aswMBR version 0.9.9.1771 Copyright(c) 2011 AVAST Software
Run date: 2013-10-02 11:10:03
-----------------------------
11:10:03.328 OS Version: Windows 5.1.2600 Service Pack 3
11:10:03.328 Number of processors: 2 586 0x409
11:10:03.328 ComputerName: BOHOU-040C629BC UserName: bohouš
11:10:03.734 Initialize success
11:10:17.875 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T1L0-3
11:10:17.875 Disk 0 Vendor: ST340014A 3.06 Size: 38165MB BusType: 3
11:10:17.875 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP2T0L0-e
11:10:17.875 Disk 1 Vendor: WDC_WD5000AVDS-63U7B1 01.00A01 Size: 476940MB BusType: 3
11:10:18.031 Disk 0 MBR read successfully
11:10:18.031 Disk 0 MBR scan
11:10:18.031 Disk 0 Windows XP default MBR code
11:10:18.031 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 38162 MB offset 63
11:10:18.031 Disk 0 scanning sectors +78156225
11:10:18.218 Disk 0 scanning C:\WINDOWS\system32\drivers
11:10:28.734 Service scanning
11:10:52.281 Modules scanning
11:11:14.484 Disk 0 trace - called modules:
11:11:14.500 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
11:11:14.515 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a689ab8]

11:11:14.515 3 CLASSPNP.SYS[ba0e8fd7] -> nt!IofCallDriver -> \Device\00000068[0x8a69cf18]
11:11:14.515 5 ACPI.sys[b9f7f620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T1L0-3[0x8a680d98]
11:11:14.515 Scan finished successfully
11:11:29.921 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\bohouš\Plocha\MBR.dat"
11:11:29.937 The log file has been saved successfully to "C:\Documents and Settings\bohouš\Plocha\aswMBR.txt"

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:08:18, on 2.10.2013
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\Rainlendar2\Rainlendar2.exe
C:\WINDOWS\system32\FsUsbExService.Exe
C:\Program Files\Java\jre7\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
D:\Plánovače\čištění\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: FastestTube BHO - {3E532CE8-C6D9-4A10-8ACE-4348C96E8B6A} - C:\Program Files\FastestTube\1.3.7\WombatBHO.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [MSC] "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: FsUsbExService - Teruten - C:\WINDOWS\system32\FsUsbExService.Exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Program Files\Java\jre7\bin\jqs.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Sony PC Companion - Avanquest Software - C:\Program Files\Sony\Sony PC Companion\PCCService.exe
O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/BOHOU~1/LOCALS~1/Temp/msohtml1/01/clip_image002.jpg

--
End of file - 6298 bytes

ComboFix 13-10-01.03 - bohouš 02.10.2013 10:53:13.24.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2047.1425 [GMT 2:00]
Spuštěný z: C:\Documents and Settings\bohouš\Plocha\ComboFix.exe
Použité ovládací přepínače :: C:\Documents and Settings\bohouš\Plocha\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}


((((((((((((((((((((((((( Soubory vytvořené od 2013-09-02 do 2013-10-02 )))))))))))))))))))))))))))))))


2013-10-02 06:50:33 . 2013-10-02 06:50:33 60872 ----a-w- C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{5E3F2EFD-6EAF-403B-9C11-495FD8F16C24}\offreg.dll
2013-10-02 06:50:33 . 2013-10-02 06:50:33 40392 ----a-w- C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{5E3F2EFD-6EAF-403B-9C11-495FD8F16C24}\MpKslba6da0fa.sys
2013-10-02 06:47:38 . 2013-09-05 05:02:37 7328304 ----a-w- C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{5E3F2EFD-6EAF-403B-9C11-495FD8F16C24}\mpengine.dll
2013-10-01 21:20:52 . 2013-09-05 05:02:37 7328304 ----a-w- C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-10-01 19:51:09 . 2013-10-01 19:51:10 177496 ----a-w- C:\WINDOWS\system32\drivers\30918476.sys
2013-10-01 18:16:54 . 2013-10-01 18:16:54 -------- d-----w- C:\WINDOWS\ERUNT
2013-10-01 08:32:22 . 2013-04-04 12:50:32 22856 ----a-w- C:\WINDOWS\system32\drivers\mbam.sys
2013-10-01 06:53:52 . 2013-10-01 06:53:53 388096 ----a-r- C:\Documents and Settings\bohouš\Data aplikací\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
.


(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))

2013-09-29 17:48:47 . 2012-03-30 06:41:31 692616 ----a-w- C:\WINDOWS\system32\FlashPlayerApp.exe
2013-09-29 17:48:46 . 2011-06-16 09:46:39 71048 ----a-w- C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
2013-08-09 01:56:34 . 2004-08-17 15:49:20 386560 ----a-w- C:\WINDOWS\system32\themeui.dll
2013-08-08 06:09:49 . 2004-08-17 15:44:44 1877760 ----a-w- C:\WINDOWS\system32\win32k.sys
2013-08-08 06:05:47 . 2004-08-17 15:49:22 920064 ----a-w- C:\WINDOWS\system32\wininet.dll
2013-08-08 06:05:46 . 2004-08-17 15:49:30 1469440 ------w- C:\WINDOWS\system32\inetcpl.cpl
2013-08-08 06:05:46 . 2004-08-17 15:49:10 43520 ----a-w- C:\WINDOWS\system32\licmgr10.dll
2013-08-08 06:05:45 . 2004-08-17 15:49:04 18944 ----a-w- C:\WINDOWS\system32\corpol.dll
2013-08-08 00:02:34 . 2004-08-17 15:44:08 385024 ----a-w- C:\WINDOWS\system32\html.iec
2013-08-05 13:30:13 . 2004-08-17 15:49:16 1289216 ----a-w- C:\WINDOWS\system32\ole32.dll
2013-08-02 23:48:38 . 2009-01-30 18:35:52 1543680 ------w- C:\WINDOWS\system32\wmvdecod.dll
2013-07-10 10:37:49 . 2004-08-17 15:49:20 406016 ----a-w- C:\WINDOWS\system32\usp10.dll
2010-02-15 13:48:39 . 2010-02-15 13:43:09 26665984 ------w- C:\Program Files\AdbeRdr930_cs_CZ.exe
2010-02-15 13:41:49 . 2010-02-15 13:41:48 1697792 ----a-w- C:\Program Files\AdbeRdrUpd913_all_incr.msp
2010-01-18 13:54:27 . 2010-01-18 13:51:59 77003400 ------w- C:\Program Files\BusinessCardsMX-setup.exe
2009-08-28 20:17:47 . 2009-08-28 20:17:46 1410632 ----a-w- C:\Program Files\setup_dm_paradies_foto_2.exe
2008-08-05 13:37:27 . 2008-08-05 13:30:06 6104632 ----a-w- C:\Program Files\picasaweb-current-setup.exe


(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))


*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="C:\Program Files\RocketDock\RocketDock.exe" [2007-09-02 11:58:52 495616]
"Rainlendar2"="C:\Program Files\Rainlendar2\Rainlendar2.exe" [2012-07-02 07:11:14 2498048]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PRONoMgr.exe"="C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe" [2003-03-11 15:24:40 86016]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2011-08-01 13:56:42 1821576]
"itype"="C:\Program Files\Microsoft IntelliType Pro\itype.exe" [2011-08-01 13:57:34 1313672]
"MSC"="C:\Program Files\Microsoft Security Client\msseces.exe" [2013-06-20 15:25:44 995176]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 07:52:18 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="C:\WINDOWS\system32\logonui.exe"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2013-04-04 21:06:36 958576 ----a-w- C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCSSync]
2010-03-13 13:54:26 91520 ----a-w- C:\Program Files\Microsoft Office\Office14\BCSSync.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
2008-04-14 07:52:56 110592 ----a-w- C:\WINDOWS\system32\bthprops.cpl

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CreativeMouse ]
2004-06-27 13:38:58 503808 ----a-w- C:\Program Files\Mouse Driver\MouseDrv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelliPoint]
2011-08-01 13:56:42 1821576 ----a-w- c:\Program Files\Microsoft IntelliPoint\ipoint.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MagicKey]
2004-03-15 12:27:24 45056 ----a-w- C:\PROGRA~1\MEDIAK~1\MagicKey.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OfficeSyncProcess]
2013-04-22 08:05:32 720064 ----a-w- C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2007-04-16 14:28:22 577536 ----a-w- C:\WINDOWS\soundman.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2010-02-10 22:32:54 61440 ----a-w- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2013-03-12 05:32:50 253816 ----a-w- C:\Program Files\Common Files\Java\Java Update\jusched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Opera\\opera.exe"=
"C:\\Program Files\\ICQ7.2\\ICQ.exe"=
"C:\\Program Files\\ICQ7.2\\aolload.exe"=
"C:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"D:\\Plánovače\\čištění\\solutoinstaller.exe"=
"C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE"=
"C:\\WINDOWS\\system32\\msiexec.exe"=
"C:\\Documents and Settings\\bohouš\\Local Settings\\Data aplikací\\Google\\Google Talk Plugin\\googletalkplugin.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3306:TCP"= 3306:TCP:MySQL
"5985:TCP"= 5985:TCP:*:Disabled:Vzdálená správa systému Windows

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R1 AmgHips;AmgHips;C:\WINDOWS\system32\drivers\AmgHips.sys [2.3.2012 12:03:26 25248]
R1 MpKslba6da0fa;MpKslba6da0fa;C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{5E3F2EFD-6EAF-403B-9C11-495FD8F16C24}\MpKslba6da0fa.sys [2.10.2013 8:50:33 40392]
R2 FsUsbExService;FsUsbExService;C:\WINDOWS\system32\FsUsbExService.Exe [31.3.2012 19:40:54 238952]
R3 dc3d;MS Hardware Device Detection Driver;C:\WINDOWS\system32\drivers\dc3d.sys [12.6.2011 9:48:48 45288]
R3 FsUsbExDisk;FsUsbExDisk;C:\WINDOWS\system32\FsUsbExDisk.Sys [3.1.2011 11:22:09 36608]
S3 Andbus;LGE Android Platform Composite USB Device;C:\WINDOWS\system32\drivers\lgandbus.sys [30.3.2012 17:33:07 14336]
S3 AndDiag;LGE Android Platform USB Serial Port;C:\WINDOWS\system32\drivers\lganddiag.sys [30.3.2012 17:33:08 20736]
S3 AndGps;LGE Android Platform USB GPS NMEA Port;C:\WINDOWS\system32\drivers\lgandgps.sys [30.3.2012 17:33:08 20096]
S3 ANDModem;LGE Android Platform USB Modem;C:\WINDOWS\system32\drivers\lgandmodem.sys [30.3.2012 17:33:09 25088]
S3 cpuz135;cpuz135; [x]
S3 cpuz136;cpuz136; [x]
S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);C:\WINDOWS\system32\drivers\ssudbus.sys [31.3.2012 20:13:20 80184]
S3 ggflt;SEMC USB Flash Driver Filter;C:\WINDOWS\system32\drivers\ggflt.sys [26.10.2012 9:53:26 12400]
S3 MTK;Media Technology Kernel Driver;C:\WINDOWS\system32\drivers\MTK.SYS [28.3.2007 10:33:44 15670]
S3 PRODIGY;PRODIGY;C:\WINDOWS\system32\drivers\prodigy.sys [26.4.2010 9:40:27 32377]
S3 Sony PC Companion;Sony PC Companion;C:\Program Files\Sony\Sony PC Companion\PCCService.exe [4.8.2013 18:10:56 155824]
S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);C:\WINDOWS\system32\drivers\ssudmdm.sys [31.3.2012 20:13:20 181432]

--- Ostatní služby/ovladače v paměti ---

*NewlyCreated* - FSUSBEXDISK
*NewlyCreated* - MPKSLBA6DA0FA
*Deregistered* - TrueSight

Obsah adresáře 'Naplánované úlohy'

2013-10-02 C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-30 06:41:31 . 2013-09-29 17:48:48]

2013-10-02 C:\WINDOWS\Tasks\Microsoft Antimalware Scheduled Scan.job
- C:\Program Files\Microsoft Security Client\MpCmdRun.exe [2013-06-20 16:05:14 . 2013-06-20 16:05:14]

2013-10-02 C:\WINDOWS\Tasks\MpIdleTask.job
- C:\Program Files\Microsoft Security Client\MpCmdRun.exe [2013-06-20 16:05:14 . 2013-06-20 16:05:14]


------- Doplňkový sken -------

uStart Page = hxxp://www.google.com
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uDefault_Search_URL = hxxp://www.google.com
mStart Page = hxxp://www.google.com
mSearch Bar = hxxp://www.google.com
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - C:\WINDOWS\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Excel - C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 192.168.1.1

RogueKiller V8.7.0 [Sep 30 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Podpora : http://www.adlice.com/forum/
Webové stránky : http://www.adlice.com/softwares/roguekiller/
: http://tigzyrk.blogspot.com/

Operační systém : Windows XP (5.1.2600 Service Pack 3) 32 bits version
Spuštěno v : Normální režim
Uživatel : bohouš [Práva správce]
Mód : Kontrola -- Datum : 10/02/2013 10:42:16
| ARK || FAK || MBR |

¤¤¤ Škodlivé procesy: : 1 ¤¤¤
[SUSP UNIC][DLL] explorer.exe -- D:\Plánovače\čištění\Malwarebytes' Anti-Malware\mbamext.dll [x] -> ODEBRÁNO

¤¤¤ ¤¤¤ Záznamy Registrů: : 1 ¤¤¤
[HJ POL][PUM] HKLM\[...]\System : DisableRegistryTools (0) -> NALEZENO

¤¤¤ naplánované úlohy : 0 ¤¤¤

¤¤¤ spuštění položky : 0 ¤¤¤

¤¤¤ Webové prohlížeče : 1 ¤¤¤
[FF][PROXY] 48r3549l.default : user_pref("network.proxy.type", 2); -> NALEZENO

¤¤¤ Zvláštní soubory / Složky: ¤¤¤

¤¤¤ Ovladač : [NAHRÁNO] ¤¤¤
[Inline] EAT @explorer.exe (?_Ptr_wcout@std@@3PAV?$basic_ostream@GU?$char_traits@G@std@@@1@A) : MSVCP90.dll -> HOOKED (Unknown @ 0x28C8C016)
[Inline] EAT @explorer.exe (??_7?$basic_ostringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@6B@) : MSVCP60.dll -> HOOKED (Unknown @ 0x76817FA1)
[Inline] EAT @explorer.exe (_pctype) : MSVCR80.dll -> HOOKED (Unknown @ 0x62943435)
[Inline] EAT @explorer.exe (??_7?$basic_streambuf@GU?$char_traits@G@std@@@std@@6B@) : MSVCP100.dll -> HOOKED (Unknown @ 0x4B7D2083)

¤¤¤ Externí včelstvo: ¤¤¤

¤¤¤ Nákaza : ¤¤¤

¤¤¤ Soubor HOSTS: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts


127.0.0.1 08sr.combineads.info # hosts anti-adware / pups
127.0.0.1 08srvr.combineads.info # hosts anti-adware / pups
127.0.0.1 12srvr.combineads.info # hosts anti-adware / pups
127.0.0.1 2010-fr.com # hosts anti-adware / pups
127.0.0.1 2012-new.biz # hosts anti-adware / pups
127.0.0.1 2319825.ourtoolbar.com # hosts anti-adware / pups
127.0.0.1 24h00business.com # hosts anti-adware / pups
127.0.0.1 a.daasafterdusk.com # hosts anti-adware / pups
127.0.0.1 ad.adn360.com # hosts anti-adware / pups
127.0.0.1 adeartss.eu # hosts anti-adware / pups
127.0.0.1 adesoeasy.eu # hosts anti-adware / pups
127.0.0.1 adf.girldatesforfree.net # hosts anti-adware / pups
127.0.0.1 adm.soft365.com # hosts anti-adware / pups
127.0.0.1 adomicileavail.googlepages.com # hosts anti-adware / pups
127.0.0.1 ads7.complexadveising.com # hosts anti-adware / pups
127.0.0.1 ads.aff.co # hosts anti-adware / pups
127.0.0.1 ads.alpha00001.com # hosts anti-adware / pups
127.0.0.1 ads.cloud4ads.com # hosts anti-adware / pups
127.0.0.1 ads.eorezo.com # hosts anti-adware / pups
127.0.0.1 ads.hooqy.com # hosts anti-adware / pups
[...]


¤¤¤ Kontrola MBR: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) (Standardní diskové jednotky) - ST340014A +++++
--- User ---
[MBR] 86ae9682c857c92f8c7782a4a5278cfe
[BSP] 5e808192d8b35d7ed5e916822a2e9007 : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 38162 Mo
User = LL1 ... OK!
User = LL2 ... OK!

+++++ PhysicalDrive1: (\\.\PHYSICALDRIVE1 @ IDE) (Standardní diskové jednotky) - WDC WD5000AVDS-63U7B1 +++++
--- User ---
[MBR] b4dd07df154ef37bcc0d73bbec167488
[BSP] 6a52188395639a4256825024f288b9ff : Windows Vista MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 476937 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Dokončeno : << RKreport[0]_S_10022013_104216.txt >>
RKreport[0]_S_10012013_222616.txt

Ten Combofix není celý... Kousek mu tam chybí na konci