PC-HELP.CZ

Dobrý den. Prosím o kontrolu logu. Pc pravidelne cistim C Cleaner a ATF cleaner,Malware bytes nic nenasel. Cistil sem i RogueKiller presto je pc značně zasekany Posilam log z hijack a i z toho malware: Děkuji
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Verze: v2014.02.21.03

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Uzivatel :: LYNX-B0B027A692 [administrátor]

21.2.2014 8:55:09
mbam-log-2014-02-21 (08-55-09).txt

Typ: Rychlá kontrola
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 200170
Uplynulý čas: 1 hodin, 10 minut, 27 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené soubory: 0
(Žádné škodlivé položky nebyly zjištěny)

(konec)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:23:15, on 21.2.2014
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\WinFast\WFDTV\DTVSchdl.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WinFast\WFDTV\WFWIZ.exe
C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\Uzivatel\Plocha\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
O4 - HKLM\..\Run: [WinFastDTV] C:\Program Files\WinFast\WFDTV\DTVSchdl.exe
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFDTV\WFWIZ.exe
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: ICQ7M - {781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - C:\Program Files\ICQ7M\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7M - {781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - C:\Program Files\ICQ7M\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 6193 bytes

Stáhni AdwCleaner

Ulož si ho na svojí plochu
Ukonči všechny programy, okna a prohlížeče
Spusť program poklepáním a klikni na „Search“
Po skenu se objeví log (jinak je uložen systémovem disku jako AdwCleaner[R?].txt), jeho obsah sem celý vlož.

====================================================

Stáhni si Junkware Removal Tool

na svojí plochu.
Deaktivuj si svůj antivirový program.
Pravým tl. myši klikni na JRT.exe a vyber „spustit jako správce“. Pro pokračování budeš vyzván ke stisknutí jakékoliv klávesy. Na nějakou klikni.
Začne skenování programu. Skenování může trvat dloho , podle množství nákaz. Po ukončení skenu se objeví log (JRT.txt) , který se uloží na ploše.
Zkopíruj sem prosím celý jeho obsah.

Posílám oba logy děkuji
# AdwCleaner v3.019 - Report created 22/02/2014 at 22:42:54
# Updated 17/02/2014 by Xplode
# Operating System : Microsoft Windows XP Service Pack 3 (32 bits)
# Username : Uzivatel - LYNX-B0B027A692
# Running from : C:\Documents and Settings\Uzivatel\Plocha\adwcleaner.exe
# Option : Scan

***** [ Services ] *****


***** [ Files / Folders ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****


***** [ Browsers ] *****

-\\ Internet Explorer v8.0.6001.18702


-\\ Mozilla Firefox v27.0.1 (cs)

[ File : C:\Documents and Settings\Uzivatel\Data aplikací\Mozilla\Firefox\Profiles\a838jd4d.default\prefs.js ]


*************************

AdwCleaner[R0].txt - [1092 octets] - [26/11/2013 19:20:39]
AdwCleaner[R1].txt - [1153 octets] - [26/11/2013 20:15:50]
AdwCleaner[R2].txt - [994 octets] - [22/02/2014 19:03:43]
AdwCleaner[R3].txt - [855 octets] - [22/02/2014 22:42:54]
AdwCleaner[S0].txt - [1222 octets] - [26/11/2013 20:17:17]

########## EOF - C:\AdwCleaner\AdwCleaner[R3].txt - [974 octets] ##########

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.2 (02.20.2014:1)
OS: Microsoft Windows XP x86
Ran by Uzivatel on so 22.02.2014 at 22:33:57,67
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ FireFox

Emptied folder: C:\Documents and Settings\Uzivatel\Data aplikacˇ\mozilla\firefox\profiles\a838jd4d.default\minidumps [8 files]





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on so 22.02.2014 at 22:42:28,06
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Stáhni si RogueKiller by Adlice Software
32bit.:
http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe
64bit.:
http://www.sur-la-toile.com/RogueKiller ... lerX64.exe
na svojí plochu.
- Zavři všechny ostatní programy a prohlížeče.
- Pro OS Vista a win7 spusť program RogueKiller.exe jako správce , u XP poklepáním.
- počkej až skončí Prescan -vyhledávání škodlivých procesů.
- Zkontroluj , zda máš zaškrtnuto:
Kontrola MBR
Kontrola Faked
Antirootkit
-Potom klikni na „Prohledat“.
- Program skenuje procesy PC. Po proskenování klikni na „Zpráva“celý obsah logu sem zkopíruj.
Pokud je program blokován , zkus ho spustit několikrát. Pokud dále program nepůjde spustit a pracovat, přejmenuj ho na winlogon.exe.

Stáhni si TDSSKiller
Na svojí plochu.Ujisti se , že máš zavřeny všechny ostatní aplikace a prohlížeče. Rozbal soubor a spusť TDSSKiller.exe. Restartuj PC . Log z TDSSKilleru najdeš zde:
C:\TDSSKiller. 2.8.16.0_(datum)_log.txt , vlož sem prosím celý obsah logu.
-pokud bude mít log více než 60.000 znaků , rozděl ho a vlož do více příspěvků

RogueKiller V8.5.4 [Mar 18 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Podpora : http://www.geekstogo.com/forum/files/fi ... guekiller/
Webové stránky : http://tigzy.geekstogo.com/roguekiller.php
: http://tigzyrk.blogspot.com/

Operační systém : Windows XP (5.1.2600 Service Pack 3) 32 bits version
Spuštěno v : Normální režim
Uživatel : Uzivatel [Práva správce]
Mód : Kontrola -- Datum : 02/23/2014 16:52:43
| ARK || FAK || MBR |

¤¤¤ Škodlivé procesy: : 0 ¤¤¤

¤¤¤ ¤¤¤ Záznamy Registrů: : 2 ¤¤¤
[HJPOL] HKCU\[...]\System : DisableTaskMgr (0) -> NALEZENO
[HJPOL] HKCU\[...]\System : DisableRegistryTools (0) -> NALEZENO

¤¤¤ Zvláštní soubory / Složky: ¤¤¤

¤¤¤ Ovladač : [NAHRÁNO] ¤¤¤
IRP[IRP_MJ_INTERNAL_DEVICE_CONTROL] : atapi.sys -> HOOKED ([MAJOR] sfsync04.sys @ 0xF7336A6C)

¤¤¤ Soubor HOSTS: ¤¤¤
--> C:\WINDOWS\system32\drivers\etc\hosts

127.0.0.1 localhost


¤¤¤ Kontrola MBR: ¤¤¤

+++++ PhysicalDrive0: ST1000DM003-1CH162 +++++
--- User ---
[MBR] 17e098f5614d3c3b2def40371ea71216
[BSP] a7b30c9ce296dd664919007717bdd7f9 : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 953859 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Dokončeno : << RKreport[1]_S_02232014_02d1652.txt >>
RKreport[1]_S_02232014_02d1652.txt

16:53:28.0406 3336 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
16:53:30.0421 3336 ============================================================
16:53:30.0421 3336 Current date / time: 2014/02/23 16:53:30.0421
16:53:30.0421 3336 SystemInfo:
16:53:30.0421 3336
16:53:30.0421 3336 OS Version: 5.1.2600 ServicePack: 3.0
16:53:30.0421 3336 Product type: Workstation
16:53:30.0421 3336 ComputerName: LYNX-B0B027A692
16:53:30.0421 3336 UserName: Uzivatel
16:53:30.0421 3336 Windows directory: C:\WINDOWS
16:53:30.0421 3336 System windows directory: C:\WINDOWS
16:53:30.0421 3336 Processor architecture: Intel x86
16:53:30.0421 3336 Number of processors: 1
16:53:30.0421 3336 Page size: 0x1000
16:53:30.0421 3336 Boot type: Normal boot
16:53:30.0421 3336 ============================================================
16:53:33.0062 3336 Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
16:53:33.0078 3336 ============================================================
16:53:33.0078 3336 \Device\Harddisk0\DR0:
16:53:33.0078 3336 MBR partitions:
16:53:33.0078 3336 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x74701AC1
16:53:33.0078 3336 ============================================================
16:53:33.0109 3336 C: <-> \Device\Harddisk0\DR0\Partition1
16:53:33.0125 3336 ============================================================
16:53:33.0125 3336 Initialize success
16:53:33.0125 3336 ============================================================
16:53:50.0484 2212 ============================================================
16:53:50.0484 2212 Scan started
16:53:50.0484 2212 Mode: Manual;
16:53:50.0484 2212 ============================================================
16:53:50.0578 2212 ================ Scan system memory ========================
16:53:50.0578 2212 System memory - ok
16:53:50.0578 2212 ================ Scan services =============================
16:53:50.0656 2212 Abiosdsk - ok
16:53:50.0671 2212 abp480n5 - ok
16:53:50.0828 2212 [ ADC420616C501B45D26C0FD3EF1E54E4 ] ACDaemon C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
16:53:50.0828 2212 ACDaemon - ok
16:53:50.0875 2212 [ 4FE34F1F3126B61FCC6B2043AA8112C9 ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys
16:53:50.0890 2212 ACPI - ok
16:53:50.0937 2212 [ AFDFF022A01F0B11C776F0860C3B282F ] ACPIEC C:\WINDOWS\system32\drivers\ACPIEC.sys
16:53:50.0953 2212 ACPIEC - ok
16:53:51.0046 2212 [ F7AB315A4D400CA876381D1E188A2E20 ] AdobeFlashPlayerUpdateSvc C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
16:53:51.0062 2212 AdobeFlashPlayerUpdateSvc - ok
16:53:51.0078 2212 adpu160m - ok
16:53:51.0125 2212 [ 8BED39E3C35D6A489438B8141717A557 ] aec C:\WINDOWS\system32\drivers\aec.sys
16:53:51.0125 2212 aec - ok
16:53:51.0187 2212 [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD C:\WINDOWS\System32\drivers\afd.sys
16:53:51.0187 2212 AFD - ok
16:53:51.0203 2212 Aha154x - ok
16:53:51.0203 2212 aic78u2 - ok
16:53:51.0218 2212 aic78xx - ok
16:53:51.0250 2212 [ E0A6FA244B8624D78FE5FF6F56A33BAE ] Alerter C:\WINDOWS\system32\alrsvc.dll
16:53:51.0250 2212 Alerter - ok
16:53:51.0296 2212 [ 88842DE939A827577BF24243699AC80A ] ALG C:\WINDOWS\System32\alg.exe
16:53:51.0296 2212 ALG - ok
16:53:51.0312 2212 AliIde - ok
16:53:51.0390 2212 [ 267FC636801EDC5AB28E14036349E3BE ] Ambfilt C:\WINDOWS\system32\drivers\Ambfilt.sys
16:53:51.0421 2212 Ambfilt - ok
16:53:51.0437 2212 amsint - ok
16:53:51.0453 2212 AppMgmt - ok
16:53:51.0453 2212 asc - ok
16:53:51.0468 2212 asc3350p - ok
16:53:51.0484 2212 asc3550 - ok
16:53:51.0734 2212 [ 0E5E4957549056E2BF2C49F4F6B601AD ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
16:53:51.0750 2212 aspnet_state - ok
16:53:51.0781 2212 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys
16:53:51.0796 2212 AsyncMac - ok
16:53:51.0812 2212 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys
16:53:51.0812 2212 atapi - ok
16:53:51.0828 2212 Atdisk - ok
16:53:51.0859 2212 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys
16:53:51.0859 2212 Atmarpc - ok
16:53:51.0890 2212 [ DE31B88962A8645DBA5A37B993E7B0F1 ] AudioSrv C:\WINDOWS\System32\audiosrv.dll
16:53:51.0890 2212 AudioSrv - ok
16:53:51.0937 2212 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys
16:53:51.0953 2212 audstub - ok
16:53:52.0000 2212 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINDOWS\system32\drivers\Beep.sys
16:53:52.0000 2212 Beep - ok
16:53:52.0062 2212 [ 19395D092FD85DDC2D9C7729CF5A2AC8 ] BITS C:\WINDOWS\system32\qmgr.dll
16:53:52.0093 2212 BITS - ok
16:53:52.0125 2212 [ 89E739BBA5F636297EA5B5F811189E06 ] Browser C:\WINDOWS\System32\browser.dll
16:53:52.0125 2212 Browser - ok
16:53:52.0187 2212 [ DF863A3F97A8CBF9E7FBBC2A0854F582 ] BT848 C:\WINDOWS\system32\drivers\wf2kvcap.sys
16:53:52.0187 2212 BT848 - ok
16:53:52.0218 2212 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys
16:53:52.0234 2212 cbidf2k - ok
16:53:52.0250 2212 [ 0BE5AEF125BE881C4F854C554F2B025C ] CCDECODE C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
16:53:52.0250 2212 CCDECODE - ok
16:53:52.0265 2212 cd20xrnt - ok
16:53:52.0296 2212 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys
16:53:52.0296 2212 Cdaudio - ok
16:53:52.0328 2212 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys
16:53:52.0328 2212 Cdfs - ok
16:53:52.0375 2212 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys
16:53:52.0375 2212 Cdrom - ok
16:53:52.0390 2212 Changer - ok
16:53:52.0437 2212 [ E390DC1D7C461D7D56EC53402F329928 ] CiSvc C:\WINDOWS\system32\cisvc.exe
16:53:52.0437 2212 CiSvc - ok
16:53:52.0484 2212 [ 064507A8DFA8C5C7E2FFDDD3E6F424FA ] ClipSrv C:\WINDOWS\system32\clipsrv.exe
16:53:52.0484 2212 ClipSrv - ok
16:53:52.0515 2212 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
16:53:52.0578 2212 clr_optimization_v2.0.50727_32 - ok
16:53:52.0593 2212 CmdIde - ok
16:53:52.0593 2212 COMSysApp - ok
16:53:52.0625 2212 Cpqarray - ok
16:53:52.0671 2212 [ F3AB0933CBD166D271992F411C27CCAF ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll
16:53:52.0687 2212 CryptSvc - ok
16:53:52.0703 2212 dac2w2k - ok
16:53:52.0718 2212 dac960nt - ok
16:53:52.0765 2212 [ BE27674D1CBC3214AEC84B4336A38BBF ] DcomLaunch C:\WINDOWS\system32\rpcss.dll
16:53:52.0781 2212 DcomLaunch - ok
16:53:52.0828 2212 [ 8C9A53E285AC5E6704844D0459EC85BE ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll
16:53:52.0828 2212 Dhcp - ok
16:53:52.0843 2212 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys
16:53:52.0843 2212 Disk - ok
16:53:52.0859 2212 dmadmin - ok
16:53:52.0906 2212 [ DB5FD2BF5B07DC54BFCB3664FF05BD7C ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys
16:53:52.0921 2212 dmboot - ok
16:53:52.0937 2212 [ FFF1720AF51171F32F1EAD5CF71F2810 ] dmio C:\WINDOWS\system32\drivers\dmio.sys
16:53:52.0937 2212 dmio - ok
16:53:52.0953 2212 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINDOWS\system32\drivers\dmload.sys
16:53:52.0968 2212 dmload - ok
16:53:52.0984 2212 [ 2BFEFE9E865655A76982F050450B9591 ] dmserver C:\WINDOWS\System32\dmserver.dll
16:53:53.0000 2212 dmserver - ok
16:53:53.0031 2212 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys
16:53:53.0031 2212 DMusic - ok
16:53:53.0046 2212 [ DFAA406BF19F4EE806A6F8D4342137F7 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll
16:53:53.0062 2212 Dnscache - ok
16:53:53.0093 2212 [ 4A3E2BD20157A0946751229E92EB8621 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll
16:53:53.0093 2212 Dot3svc - ok
16:53:53.0109 2212 dpti2o - ok
16:53:53.0156 2212 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys
16:53:53.0156 2212 drmkaud - ok
16:53:53.0187 2212 [ 0887D9C2BE8D940778CAD1E3B85F2A41 ] EapHost C:\WINDOWS\System32\eapsvc.dll
16:53:53.0203 2212 EapHost - ok
16:53:53.0250 2212 [ A2A4912798F2BE706ABADD3D30800D16 ] ERSvc C:\WINDOWS\System32\ersvc.dll
16:53:53.0250 2212 ERSvc - ok
16:53:53.0265 2212 [ 9EF697AF07BB8DD82C3B02CA953A95B7 ] Eventlog C:\WINDOWS\system32\services.exe
16:53:53.0281 2212 Eventlog - ok
16:53:53.0328 2212 [ A371F11EF07653591C8DE26AFB13CE7F ] EventSystem C:\WINDOWS\system32\es.dll
16:53:53.0343 2212 EventSystem - ok
16:53:53.0390 2212 [ 38D332A6D56AF32635675F132548343E ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys
16:53:53.0406 2212 Fastfat - ok
16:53:53.0453 2212 [ EE9A2B9EA968A792A053C9D1A86BF870 ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll
16:53:53.0500 2212 FastUserSwitchingCompatibility - ok
16:53:53.0531 2212 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc C:\WINDOWS\system32\DRIVERS\fdc.sys
16:53:53.0531 2212 Fdc - ok
16:53:53.0593 2212 [ AC366695A0796560AA37215AD5762AAF ] Fips C:\WINDOWS\system32\drivers\Fips.sys
16:53:53.0593 2212 Fips - ok
16:53:53.0656 2212 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk C:\WINDOWS\system32\DRIVERS\flpydisk.sys
16:53:53.0656 2212 Flpydisk - ok
16:53:53.0703 2212 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr C:\WINDOWS\system32\DRIVERS\fltMgr.sys
16:53:53.0718 2212 FltMgr - ok
16:53:53.0765 2212 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
16:53:53.0781 2212 FontCache3.0.0.0 - ok
16:53:53.0796 2212 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys
16:53:53.0796 2212 Fs_Rec - ok
16:53:53.0812 2212 [ 4E664D8541DB4A66B73A24257E322E1F ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys
16:53:53.0812 2212 Ftdisk - ok
16:53:53.0843 2212 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys
16:53:53.0859 2212 Gpc - ok
16:53:53.0890 2212 [ 573C7D0A32852B48F3058CFD8026F511 ] HDAudBus C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
16:53:53.0906 2212 HDAudBus - ok
16:53:53.0953 2212 [ FCFE31FB75F8A6295B6B0AF87A626282 ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
16:53:53.0968 2212 helpsvc - ok
16:53:54.0015 2212 [ 00E25EE90166B3E1BE6E74AEBF858306 ] HidServ C:\WINDOWS\System32\hidserv.dll
16:53:54.0031 2212 HidServ - ok
16:53:54.0046 2212 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] hidusb C:\WINDOWS\system32\DRIVERS\hidusb.sys
16:53:54.0062 2212 hidusb - ok
16:53:54.0093 2212 [ 7A6B320928F86BC851530D63C82965D9 ] hkmsvc C:\WINDOWS\System32\kmsvc.dll
16:53:54.0093 2212 hkmsvc - ok
16:53:54.0109 2212 hpn - ok
16:53:54.0156 2212 [ 9F1D80908658EB7F1BF70809E0B51470 ] HPZid412 C:\WINDOWS\system32\DRIVERS\HPZid412.sys
16:53:54.0156 2212 HPZid412 - ok
16:53:54.0171 2212 [ F7E3E9D50F9CD3DE28085A8FDAA0A1C3 ] HPZipr12 C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
16:53:54.0171 2212 HPZipr12 - ok
16:53:54.0203 2212 [ CF1B7951B4EC8D13F3C93B74BB2B461B ] HPZius12 C:\WINDOWS\system32\DRIVERS\HPZius12.sys
16:53:54.0203 2212 HPZius12 - ok
16:53:54.0250 2212 [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys
16:53:54.0250 2212 HTTP - ok
16:53:54.0296 2212 [ 58FE2F2DA3BC5573F4A35B3760D3125F ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll
16:53:54.0296 2212 HTTPFilter - ok
16:53:54.0312 2212 i2omgmt - ok
16:53:54.0328 2212 i2omp - ok
16:53:54.0359 2212 [ C528E27945367191E7BAE364930B6932 ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys
16:53:54.0359 2212 i8042prt - ok
16:53:54.0437 2212 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
16:53:54.0453 2212 idsvc - ok
16:53:54.0468 2212 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys
16:53:54.0468 2212 Imapi - ok
16:53:54.0531 2212 [ F7B93AAFAD33B2320954C17E26C8D361 ] ImapiService C:\WINDOWS\system32\imapi.exe
16:53:54.0531 2212 ImapiService - ok
16:53:54.0546 2212 ini910u - ok
16:53:54.0703 2212 [ A5693BF4D705721581300BD7AF08C890 ] IntcAzAudAddService C:\WINDOWS\system32\drivers\RtkHDAud.sys
16:53:54.0812 2212 IntcAzAudAddService - ok
16:53:54.0828 2212 IntelIde - ok
16:53:54.0859 2212 [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
16:53:54.0875 2212 Ip6Fw - ok
16:53:54.0890 2212 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
16:53:54.0890 2212 IpFilterDriver - ok
16:53:54.0890 2212 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys
16:53:54.0890 2212 IpInIp - ok
16:53:54.0906 2212 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys
16:53:54.0921 2212 IpNat - ok
16:53:54.0937 2212 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys
16:53:54.0937 2212 IPSec - ok
16:53:54.0953 2212 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys
16:53:54.0953 2212 IRENUM - ok
16:53:54.0984 2212 [ CC9F8A2D60AED1A51A3AC34C59B987AE ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys
16:53:54.0984 2212 isapnp - ok
16:53:55.0015 2212 [ 1B6162FE7F66B1A71A4B70F941C4AA9B ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys
16:53:55.0015 2212 Kbdclass - ok
16:53:55.0031 2212 [ 86C8F23616C6C6E5B2776901C17B945B ] kbdhid C:\WINDOWS\system32\DRIVERS\kbdhid.sys
16:53:55.0031 2212 kbdhid - ok
16:53:55.0078 2212 [ 692BCF44383D056AED41B045A323D378 ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys
16:53:55.0078 2212 kmixer - ok
16:53:55.0109 2212 [ B467646C54CC746128904E1654C750C1 ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys
16:53:55.0109 2212 KSecDD - ok
16:53:55.0156 2212 [ 3428E8F86F8ADD36B42FB23542C7B3E4 ] LanmanServer C:\WINDOWS\System32\srvsvc.dll
16:53:55.0156 2212 LanmanServer - ok
16:53:55.0203 2212 [ 936C1D110232D23B621CB0196E4F80F0 ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll
16:53:55.0218 2212 lanmanworkstation - ok
16:53:55.0218 2212 lbrtfdc - ok
16:53:55.0281 2212 [ 0AB159F536E3E8F7F07113702A07CCA5 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll
16:53:55.0281 2212 LmHosts - ok
16:53:55.0328 2212 [ 0DB7527DB188C7D967A37BB51BBF3963 ] MBAMSwissArmy C:\WINDOWS\system32\drivers\mbamswissarmy.sys
16:53:55.0328 2212 MBAMSwissArmy - ok
16:53:55.0375 2212 [ 221CD1C815B8A6B79389C3F5D1018DE8 ] Messenger C:\WINDOWS\System32\msgsvc.dll
16:53:55.0390 2212 Messenger - ok
16:53:55.0421 2212 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys
16:53:55.0421 2212 mnmdd - ok
16:53:55.0437 2212 [ 9A57D046F88F4B69751B11FD40088A61 ] mnmsrvc C:\WINDOWS\system32\mnmsrvc.exe
16:53:55.0437 2212 mnmsrvc - ok
16:53:55.0453 2212 [ 44032B0C6D9954D3FD26438330B99EE7 ] Modem C:\WINDOWS\system32\drivers\Modem.sys
16:53:55.0468 2212 Modem - ok
16:53:55.0515 2212 [ C7D9F9717916B34C1B00DD4834AF485C ] Monfilt C:\WINDOWS\system32\drivers\Monfilt.sys
16:53:55.0546 2212 Monfilt - ok
16:53:55.0593 2212 [ 4CB582831DBDE63CE43B45D771218374 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys
16:53:55.0593 2212 Mouclass - ok
16:53:55.0640 2212 [ BB269EBA740737AB749B214D568B6812 ] mouhid C:\WINDOWS\system32\DRIVERS\mouhid.sys
16:53:55.0656 2212 mouhid - ok
16:53:55.0687 2212 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys
16:53:55.0687 2212 MountMgr - ok
16:53:55.0718 2212 [ 338037EFA0E8E8699B2667D57B751574 ] MozillaMaintenance C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
16:53:55.0718 2212 MozillaMaintenance - ok
16:53:55.0781 2212 [ E77DC03DD3C8E5A388BF9EED2A28F3D1 ] MpFilter C:\WINDOWS\system32\DRIVERS\MpFilter.sys
16:53:55.0796 2212 MpFilter - ok
16:53:55.0796 2212 mraid35x - ok
16:53:55.0812 2212 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys
16:53:55.0812 2212 MRxDAV - ok
16:53:55.0859 2212 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
16:53:55.0875 2212 MRxSmb - ok
16:53:55.0968 2212 [ B03E3F64B70F8031E65EB26DA23DE91A ] MSCamSvc C:\Program Files\Microsoft LifeCam\MSCamS32.exe
16:53:55.0968 2212 MSCamSvc - ok
16:53:56.0000 2212 [ 6DB4D1521CABA9A5FFAB54ADE0AE867D ] MSDTC C:\WINDOWS\system32\msdtc.exe
16:53:56.0000 2212 MSDTC - ok
16:53:56.0031 2212 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys
16:53:56.0031 2212 Msfs - ok
16:53:56.0062 2212 [ 7A0F9CBDBDB135113B9A3C138E20C85D ] MSHUSBVideo C:\WINDOWS\system32\Drivers\nx6000.sys
16:53:56.0078 2212 MSHUSBVideo - ok
16:53:56.0078 2212 MSIServer - ok
16:53:56.0109 2212 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys
16:53:56.0109 2212 MSKSSRV - ok
16:53:56.0187 2212 [ B0F49DA36F30922F5DDC3B623B778FCE ] MsMpSvc c:\Program Files\Microsoft Security Client\MsMpEng.exe
16:53:56.0203 2212 MsMpSvc - ok
16:53:56.0250 2212 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys
16:53:56.0250 2212 MSPCLOCK - ok
16:53:56.0328 2212 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys
16:53:56.0343 2212 MSPQM - ok
16:53:56.0390 2212 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys
16:53:56.0390 2212 mssmbios - ok
16:53:56.0406 2212 [ E53736A9E30C45FA9E7B5EAC55056D1D ] MSTEE C:\WINDOWS\system32\drivers\MSTEE.sys
16:53:56.0406 2212 MSTEE - ok
16:53:56.0437 2212 [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup C:\WINDOWS\system32\drivers\Mup.sys
16:53:56.0437 2212 Mup - ok
16:53:56.0453 2212 [ 5B50F1B2A2ED47D560577B221DA734DB ] NABTSFEC C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
16:53:56.0453 2212 NABTSFEC - ok
16:53:56.0484 2212 [ 6EA362E9DB03D44F6B996F4D8BE237E9 ] napagent C:\WINDOWS\System32\qagentrt.dll
16:53:56.0500 2212 napagent - ok
16:53:56.0531 2212 [ 1DF7F42665C94B825322FAE71721130D ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys
16:53:56.0531 2212 NDIS - ok
16:53:56.0546 2212 [ 7FF1F1FD8609C149AA432F95A8163D97 ] NdisIP C:\WINDOWS\system32\DRIVERS\NdisIP.sys
16:53:56.0546 2212 NdisIP - ok
16:53:56.0593 2212 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys
16:53:56.0609 2212 NdisTapi - ok
16:53:56.0640 2212 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys
16:53:56.0656 2212 Ndisuio - ok
16:53:56.0656 2212 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys
16:53:56.0671 2212 NdisWan - ok
16:53:56.0703 2212 [ 2F597BB467E05B1FE3830EABD821B8E0 ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys
16:53:56.0703 2212 NDProxy - ok
16:53:56.0718 2212 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys
16:53:56.0718 2212 NetBIOS - ok
16:53:56.0765 2212 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys
16:53:56.0765 2212 NetBT - ok
16:53:56.0796 2212 [ 933DE774986EC85E48210C44AB431DE6 ] NetDDE C:\WINDOWS\system32\netdde.exe
16:53:56.0796 2212 NetDDE - ok
16:53:56.0812 2212 [ 933DE774986EC85E48210C44AB431DE6 ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe
16:53:56.0812 2212 NetDDEdsdm - ok
16:53:56.0843 2212 [ ED0A176354487CEED65B80A7148AB739 ] Netlogon C:\WINDOWS\system32\lsass.exe
16:53:56.0859 2212 Netlogon - ok
16:53:56.0875 2212 [ 72E1E9E2977BE08BDEEDB6D8FD9D4D40 ] Netman C:\WINDOWS\System32\netman.dll
16:53:56.0890 2212 Netman - ok
16:53:56.0906 2212 [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
16:53:56.0921 2212 NetTcpPortSharing - ok
16:53:56.0937 2212 [ 39EE7C3BFBC64BA87CC8CF67386E814C ] Nla C:\WINDOWS\System32\mswsock.dll
16:53:56.0953 2212 Nla - ok
16:53:56.0968 2212 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys
16:53:56.0968 2212 Npfs - ok
16:53:57.0000 2212 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys
16:53:57.0015 2212 Ntfs - ok
16:53:57.0031 2212 [ ED0A176354487CEED65B80A7148AB739 ] NtLmSsp C:\WINDOWS\system32\lsass.exe
16:53:57.0031 2212 NtLmSsp - ok
16:53:57.0078 2212 [ 023DD70573D644F3D9C8B1258A7BFD08 ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll
16:53:57.0093 2212 NtmsSvc - ok
16:53:57.0125 2212 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINDOWS\system32\drivers\Null.sys
16:53:57.0125 2212 Null - ok
16:53:57.0484 2212 [ 7C56F3FD65B2BDB315CA3605A5392D7B ] nv C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
16:53:57.0750 2212 nv - ok
16:53:57.0812 2212 [ C61927D27B75ED56723F2508F1A6B1BE ] NVENETFD C:\WINDOWS\system32\DRIVERS\NVENETFD.sys
16:53:57.0812 2212 NVENETFD - ok
16:53:57.0890 2212 [ C529B614EF88BE0F62B886C67B516550 ] nvnetbus C:\WINDOWS\system32\DRIVERS\nvnetbus.sys
16:53:57.0890 2212 nvnetbus - ok
16:53:57.0921 2212 [ E48C1AA03B6519B51756E3232C093300 ] nvsvc C:\WINDOWS\system32\nvsvc32.exe
16:53:57.0921 2212 nvsvc - ok
16:53:57.0953 2212 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
16:53:57.0953 2212 NwlnkFlt - ok
16:53:57.0984 2212 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
16:53:57.0984 2212 NwlnkFwd - ok
16:53:58.0171 2212 [ 785F487A64950F3CB8E9F16253BA3B7B ] odserv C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
16:53:58.0187 2212 odserv - ok
16:53:58.0250 2212 [ 5A432A042DAE460ABE7199B758E8606C ] ose C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
16:53:58.0250 2212 ose - ok
16:53:58.0296 2212 [ 46F8DB73B4A53E543F8E371DC7C75BAE ] Parport C:\WINDOWS\system32\DRIVERS\parport.sys
16:53:58.0296 2212 Parport - ok
16:53:58.0359 2212 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys
16:53:58.0359 2212 PartMgr - ok
16:53:58.0406 2212 [ 1FAE19D0457176318BBA4A8795656EBC ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys
16:53:58.0421 2212 ParVdm - ok
16:53:58.0437 2212 [ 6CE351D149CB4BEFC702951E471E1730 ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys
16:53:58.0437 2212 PCI - ok
16:53:58.0453 2212 PCIDump - ok
16:53:58.0468 2212 [ 2DA4EC85E0EA7A45C6B2A05820492D5A ] PCIIde C:\WINDOWS\system32\DRIVERS\pciide.sys
16:53:58.0468 2212 PCIIde - ok
16:53:58.0515 2212 [ 4FC31E6C19A5CE5198B1ABFF94CAE758 ] Pcmcia C:\WINDOWS\system32\drivers\Pcmcia.sys
16:53:58.0515 2212 Pcmcia - ok
16:53:58.0531 2212 PDCOMP - ok
16:53:58.0531 2212 PDFRAME - ok
16:53:58.0546 2212 PDRELI - ok
16:53:58.0562 2212 PDRFRAME - ok
16:53:58.0562 2212 perc2 - ok
16:53:58.0578 2212 perc2hib - ok
16:53:58.0625 2212 [ 9EF697AF07BB8DD82C3B02CA953A95B7 ] PlugPlay C:\WINDOWS\system32\services.exe
16:53:58.0640 2212 PlugPlay - ok
16:53:58.0687 2212 [ 9D84376931440F3679BEEF2A414FA493 ] Pml Driver HPZ12 C:\WINDOWS\system32\HPZipm12.exe
16:53:58.0687 2212 Pml Driver HPZ12 - ok
16:53:58.0687 2212 [ ED0A176354487CEED65B80A7148AB739 ] PolicyAgent C:\WINDOWS\system32\lsass.exe
16:53:58.0703 2212 PolicyAgent - ok
16:53:58.0718 2212 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys
16:53:58.0718 2212 PptpMiniport - ok
16:53:58.0765 2212 [ 7EB15DCE4EC3A0220BD796A15C18186E ] Processor C:\WINDOWS\system32\DRIVERS\processr.sys
16:53:58.0781 2212 Processor - ok
16:53:58.0781 2212 [ ED0A176354487CEED65B80A7148AB739 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe
16:53:58.0781 2212 ProtectedStorage - ok
16:53:58.0796 2212 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys
16:53:58.0796 2212 PSched - ok
16:53:58.0812 2212 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys
16:53:58.0812 2212 Ptilink - ok
16:53:58.0828 2212 ql1080 - ok
16:53:58.0843 2212 Ql10wnt - ok
16:53:58.0843 2212 ql12160 - ok
16:53:58.0859 2212 ql1240 - ok
16:53:58.0875 2212 ql1280 - ok
16:53:58.0921 2212 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys
16:53:58.0937 2212 RasAcd - ok
16:53:58.0968 2212 [ 2B5E44EA009F2F374B980E1E9A70635D ] RasAuto C:\WINDOWS\System32\rasauto.dll
16:53:58.0984 2212 RasAuto - ok
16:53:59.0015 2212 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
16:53:59.0015 2212 Rasl2tp - ok
16:53:59.0093 2212 [ D57554C664B64604BD1EE13EA2C07E77 ] RasMan C:\WINDOWS\System32\rasmans.dll
16:53:59.0093 2212 RasMan - ok
16:53:59.0109 2212 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys
16:53:59.0109 2212 RasPppoe - ok
16:53:59.0125 2212 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys
16:53:59.0125 2212 Raspti - ok
16:53:59.0140 2212 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys
16:53:59.0140 2212 Rdbss - ok
16:53:59.0156 2212 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
16:53:59.0156 2212 RDPCDD - ok
16:53:59.0218 2212 [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys
16:53:59.0218 2212 RDPWD - ok
16:53:59.0250 2212 [ C0D9D9711CB74EE9BC66353D8CBDAB0E ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe
16:53:59.0265 2212 RDSessMgr - ok
16:53:59.0281 2212 [ 611BFD220305BE3A85AE876EA47D4AA5 ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys
16:53:59.0281 2212 redbook - ok
16:53:59.0328 2212 [ 127C26B5371651043450E52542099ABA ] RemoteAccess C:\WINDOWS\System32\mprdim.dll
16:53:59.0328 2212 RemoteAccess - ok
16:53:59.0343 2212 [ 718B3BDC0BC3C2F7D065A53D26202AF9 ] RpcLocator C:\WINDOWS\system32\locator.exe
16:53:59.0359 2212 RpcLocator - ok
16:53:59.0390 2212 [ BE27674D1CBC3214AEC84B4336A38BBF ] RpcSs C:\WINDOWS\system32\rpcss.dll
16:53:59.0406 2212 RpcSs - ok
16:53:59.0453 2212 [ 09AB2E71E58B078038E3BFDBA7FFC984 ] RSVP C:\WINDOWS\system32\rsvp.exe
16:53:59.0453 2212 RSVP - ok
16:53:59.0468 2212 [ ED0A176354487CEED65B80A7148AB739 ] SamSs C:\WINDOWS\system32\lsass.exe
16:53:59.0468 2212 SamSs - ok
16:53:59.0500 2212 [ 410046E401EB11E1E6749E9DEEA41D4A ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe
16:53:59.0500 2212 SCardSvr - ok
16:53:59.0546 2212 [ 3FF232A7731621B8902D81D42418C93C ] Schedule C:\WINDOWS\system32\schedsvc.dll
16:53:59.0546 2212 Schedule - ok
16:53:59.0593 2212 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys
16:53:59.0593 2212 Secdrv - ok
16:53:59.0640 2212 [ 477E2C3CC5E4A0D635BCB0EA8DCAC3C6 ] seclogon C:\WINDOWS\System32\seclogon.dll
16:53:59.0640 2212 seclogon - ok
16:53:59.0687 2212 [ A530B75C10C23C9AB28FDB6CE719E21F ] SENS C:\WINDOWS\system32\sens.dll
16:53:59.0687 2212 SENS - ok
16:53:59.0703 2212 [ 0F29512CCD6BEAD730039FB4BD2C85CE ] serenum C:\WINDOWS\system32\DRIVERS\serenum.sys
16:53:59.0703 2212 serenum - ok
16:53:59.0718 2212 [ B842729337C9B921615C40D3C1A1AF96 ] Serial C:\WINDOWS\system32\DRIVERS\serial.sys
16:53:59.0718 2212 Serial - ok
16:53:59.0796 2212 [ ADEB7DB47A6F3412283259176F408BE5 ] sfdrv01 C:\WINDOWS\system32\drivers\sfdrv01.sys
16:53:59.0796 2212 sfdrv01 - ok
16:53:59.0843 2212 [ C1376A954899D98488A19396EA3AAE2B ] sfhlp02 C:\WINDOWS\system32\drivers\sfhlp02.sys
16:53:59.0843 2212 sfhlp02 - ok
16:53:59.0859 2212 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINDOWS\system32\drivers\Sfloppy.sys
16:53:59.0859 2212 Sfloppy - ok
16:53:59.0921 2212 [ 7261F6191827134D249A6462D833AF8D ] sfsync04 C:\WINDOWS\system32\drivers\sfsync04.sys
16:53:59.0921 2212 sfsync04 - ok
16:53:59.0984 2212 [ F58FACA9621D2DB01BD0927D9A0A208E ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll
16:53:59.0984 2212 SharedAccess - ok
16:54:00.0015 2212 [ EE9A2B9EA968A792A053C9D1A86BF870 ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll
16:54:00.0015 2212 ShellHWDetection - ok
16:54:00.0031 2212 Simbad - ok
16:54:00.0093 2212 [ CA355B308AA537C6B9D67CD3A5485AF9 ] SkypeUpdate C:\Program Files\Skype\Updater\Updater.exe
16:54:00.0093 2212 SkypeUpdate - ok
16:54:00.0156 2212 [ 866D538EBE33709A5C9F5C62B73B7D14 ] SLIP C:\WINDOWS\system32\DRIVERS\SLIP.sys
16:54:00.0156 2212 SLIP - ok
16:54:00.0171 2212 Sparrow - ok
16:54:00.0218 2212 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINDOWS\system32\drivers\splitter.sys
16:54:00.0234 2212 splitter - ok
16:54:00.0281 2212 [ 60784F891563FB1B767F70117FC2428F ] Spooler C:\WINDOWS\system32\spoolsv.exe
16:54:00.0281 2212 Spooler - ok
16:54:00.0312 2212 [ 94610C8653635E4459316A0050D55CE7 ] sr C:\WINDOWS\system32\DRIVERS\sr.sys
16:54:00.0312 2212 sr - ok
16:54:00.0328 2212 [ 35B91147124F64AC8081A2EDB9EA4DEE ] srservice C:\WINDOWS\system32\srsvc.dll
16:54:00.0343 2212 srservice - ok
16:54:00.0406 2212 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys
16:54:00.0421 2212 Srv - ok
16:54:00.0468 2212 [ BECD5271DC4E3B7C3D035F790FCBC1E5 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll
16:54:00.0468 2212 SSDPSRV - ok
16:54:00.0531 2212 [ C1CDD9275F6A115BB0AE1D55D8D27BA6 ] stisvc C:\WINDOWS\system32\wiaservc.dll
16:54:00.0546 2212 stisvc - ok
16:54:00.0546 2212 [ 77813007BA6265C4B6098187E6ED79D2 ] streamip C:\WINDOWS\system32\DRIVERS\StreamIP.sys
16:54:00.0546 2212 streamip - ok
16:54:00.0578 2212 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys
16:54:00.0578 2212 swenum - ok
16:54:00.0593 2212 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys
16:54:00.0593 2212 swmidi - ok
16:54:00.0609 2212 SwPrv - ok
16:54:00.0609 2212 symc810 - ok
16:54:00.0625 2212 symc8xx - ok
16:54:00.0640 2212 sym_hi - ok
16:54:00.0656 2212 sym_u3 - ok
16:54:00.0687 2212 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys
16:54:00.0703 2212 sysaudio - ok
16:54:00.0750 2212 [ CE06F01B88ACE199A1BF460CAC29C110 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe
16:54:00.0765 2212 SysmonLog - ok
16:54:00.0812 2212 [ C2546CD7A398476F9DF5614B2AE160E8 ] TapiSrv C:\WINDOWS\System32\tapisrv.dll
16:54:00.0812 2212 TapiSrv - ok
16:54:00.0843 2212 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys
16:54:00.0843 2212 Tcpip - ok
16:54:00.0875 2212 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys
16:54:00.0890 2212 TDPIPE - ok
16:54:00.0906 2212 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys
16:54:00.0921 2212 TDTCP - ok
16:54:00.0937 2212 [ 88155247177638048422893737429D9E ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys
16:54:00.0937 2212 TermDD - ok
16:54:00.0984 2212 [ A75DD6FC3DBEE4FFF5EBC9F2C28BB66E ] TermService C:\WINDOWS\System32\termsrv.dll
16:54:00.0984 2212 TermService - ok
16:54:01.0000 2212 [ EE9A2B9EA968A792A053C9D1A86BF870 ] Themes C:\WINDOWS\System32\shsvcs.dll
16:54:01.0015 2212 Themes - ok
16:54:01.0078 2212 [ 0765EE4A7A0D6609BF91CA2E4700E885 ] TomTomHOMEService C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
16:54:01.0093 2212 TomTomHOMEService - ok
16:54:01.0093 2212 TosIde - ok
16:54:01.0109 2212 [ 38853304CCB938D30E0C4CDE8D2C2A8A ] TrkWks C:\WINDOWS\system32\trkwks.dll
16:54:01.0109 2212 TrkWks - ok
16:54:01.0156 2212 [ DEC0E131B20F36246549C0DB2B23A677 ] tv2ktunr C:\WINDOWS\system32\drivers\wf2ktunr.sys
16:54:01.0156 2212 tv2ktunr - ok
16:54:01.0171 2212 [ 53DB0D251B022C034A1EB0B8B7264CC5 ] Tv2kXbar C:\WINDOWS\system32\drivers\wf2kxbar.sys
16:54:01.0171 2212 Tv2kXbar - ok
16:54:01.0203 2212 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys
16:54:01.0218 2212 Udfs - ok
16:54:01.0234 2212 [ 332D341D92B933600D41953B08360DFB ] UleadBurningHelper C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
16:54:01.0250 2212 UleadBurningHelper - ok
16:54:01.0250 2212 ultra - ok
16:54:01.0312 2212 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update C:\WINDOWS\system32\DRIVERS\update.sys
16:54:01.0328 2212 Update - ok
16:54:01.0359 2212 [ 651BD90DCEE5B7BDC74A2EB7C9266F9E ] upnphost C:\WINDOWS\System32\upnphost.dll
16:54:01.0359 2212 upnphost - ok
16:54:01.0375 2212 [ 20A0F6A11959E92908717D09E87D670D ] UPS C:\WINDOWS\System32\ups.exe
16:54:01.0375 2212 UPS - ok
16:54:01.0453 2212 [ 65898A183FBF1D1F7759D5CCB364DCD4 ] usbaudio C:\WINDOWS\system32\drivers\usbaudio.sys
16:54:01.0453 2212 usbaudio - ok
16:54:01.0484 2212 [ 1B611611C28D2DF25BC057D79C6F13FC ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys
16:54:01.0484 2212 usbccgp - ok
16:54:01.0515 2212 [ 4BAC8DF07F1D8434FC640E677A62204E ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys
16:54:01.0515 2212 usbehci - ok
16:54:01.0546 2212 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys
16:54:01.0546 2212 usbhub - ok
16:54:01.0562 2212 [ 0DAECCE65366EA32B162F85F07C6753B ] usbohci C:\WINDOWS\system32\DRIVERS\usbohci.sys
16:54:01.0562 2212 usbohci - ok
16:54:01.0625 2212 [ A717C8721046828520C9EDF31288FC00 ] usbprint C:\WINDOWS\system32\DRIVERS\usbprint.sys
16:54:01.0640 2212 usbprint - ok
16:54:01.0656 2212 [ F8EDE2B6928970DCE3D5614C27D9E7F6 ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys
16:54:01.0656 2212 usbscan - ok
16:54:01.0671 2212 [ A32426D9B14A089EAA1D922E0C5801A9 ] USBSTOR C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
16:54:01.0671 2212 USBSTOR - ok
16:54:01.0687 2212 [ 813236B1183CFCF289E367BD5DE6E29E ] usbvideo C:\WINDOWS\system32\Drivers\usbvideo.sys
16:54:01.0687 2212 usbvideo - ok
16:54:01.0703 2212 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINDOWS\System32\drivers\vga.sys
16:54:01.0703 2212 VgaSave - ok
16:54:01.0718 2212 ViaIde - ok
16:54:01.0765 2212 [ 28A4B296B47782173C346E376CB374D1 ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys
16:54:01.0765 2212 VolSnap - ok
16:54:01.0812 2212 [ D6BA1A63D9E00933F1CD2A885573AFB2 ] VSS C:\WINDOWS\System32\vssvc.exe
16:54:01.0812 2212 VSS - ok
16:54:01.0859 2212 [ FA4E1CDBA256787F2149F4AAD07BC91F ] W32Time C:\WINDOWS\system32\w32time.dll
16:54:01.0859 2212 W32Time - ok
16:54:01.0890 2212 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys
16:54:01.0890 2212 Wanarp - ok
16:54:01.0890 2212 WDICA - ok
16:54:01.0921 2212 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys
16:54:01.0921 2212 wdmaud - ok
16:54:01.0937 2212 [ 47AE51048A82DFA1CD6B51D369F7E169 ] WebClient C:\WINDOWS\System32\webclnt.dll
16:54:01.0953 2212 WebClient - ok
16:54:02.0046 2212 [ E488332126E3B1182D2B8A0C35408EC6 ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll
16:54:02.0078 2212 winmgmt - ok
16:54:02.0171 2212 [ 6199B2AE3F9DB9CB6DB230471A1DC601 ] WmdmPmSN C:\WINDOWS\system32\mspmsnsv.dll
16:54:02.0171 2212 WmdmPmSN - ok
16:54:02.0218 2212 [ 23F6F03272F7E5679F1F050AED5ACEE6 ] WmiApSrv C:\WINDOWS\system32\wbem\wmiapsrv.exe
16:54:02.0218 2212 WmiApSrv - ok
16:54:02.0281 2212 [ 4C86D5FAF78194995AF9CC1075F65DD3 ] wscsvc C:\WINDOWS\system32\wscsvc.dll
16:54:02.0281 2212 wscsvc - ok
16:54:02.0328 2212 [ C98B39829C2BBD34E454150633C62C78 ] WSTCODEC C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
16:54:02.0343 2212 WSTCODEC - ok
16:54:02.0406 2212 [ C1364564800EE9784192145324A23308 ] wuauserv C:\WINDOWS\system32\wuauserv.dll
16:54:02.0406 2212 wuauserv - ok
16:54:02.0453 2212 [ A27D4BA7264C0BF52F32D10405BEA1D4 ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll
16:54:02.0468 2212 WZCSVC - ok
16:54:02.0515 2212 [ EAA4BB9EDB3FB10CF8979FE65E63658F ] xmlprov C:\WINDOWS\System32\xmlprov.dll
16:54:02.0531 2212 xmlprov - ok
16:54:02.0562 2212 ================ Scan global ===============================
16:54:02.0593 2212 [ F36278E42C8C5DF03CE17DAC8231C91C ] C:\WINDOWS\system32\basesrv.dll
16:54:02.0640 2212 [ 4C0AA4ABC4E21672B55D8A700AF2B2A6 ] C:\WINDOWS\system32\winsrv.dll
16:54:02.0656 2212 [ 4C0AA4ABC4E21672B55D8A700AF2B2A6 ] C:\WINDOWS\system32\winsrv.dll
16:54:02.0687 2212 [ 9EF697AF07BB8DD82C3B02CA953A95B7 ] C:\WINDOWS\system32\services.exe
16:54:02.0687 2212 [Global] - ok
16:54:02.0703 2212 ================ Scan MBR ==================================
16:54:02.0718 2212 [ 413FC2A0C716421B3158746D63736515 ] \Device\Harddisk0\DR0
16:54:03.0015 2212 \Device\Harddisk0\DR0 - ok
16:54:03.0015 2212 ================ Scan VBR ==================================
16:54:03.0031 2212 [ 4300CB6E4E0047B9D65BB90D146F8D17 ] \Device\Harddisk0\DR0\Partition1
16:54:03.0031 2212 \Device\Harddisk0\DR0\Partition1 - ok
16:54:03.0031 2212 ============================================================
16:54:03.0031 2212 Scan finished
16:54:03.0031 2212 ============================================================
16:54:03.0046 2400 Detected object count: 0
16:54:03.0046 2400 Actual detected object count: 0
16:54:09.0171 2932 Deinitialize success

Spusť RogueKiller ( Pro Windows Vista nebo Windows 7, klepni pravým a vyber "Spustit jako správce", ve Windows XP poklepej ke spuštění).
- Počkej, až Prescan dokončí práci...
- Počkej, dokud status okno zobrazuje "Prohledat "
- Klikni na "Smazat"
- Počkej, dokud Status box zobrazuje "Smazání- Finished "
- Klikni na "Zprávy " a zkopíruj a vlož obsah té zprávy prosím sem. Log je možno nalézt v RKreport [číslo]. txt na ploše.
- Zavři RogueKiller

Vypni rezidentní štít antiviru a antispywaru
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Pokud bude po kontrole problém spustit aplikace nebo bude vyskakovat hláška o pokusu použít neplatnou operaci na klíč registru, který je oznaèen pro odstranění, stačí restartovat počítač.

Dobrý večer. Omlouvám se za 14denní neúčast, ale musel sem pracovně na 14 dní odjet. Děkuji Vám a posílám oba logy
RogueKiller V8.5.4 [Mar 18 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Podpora : http://www.geekstogo.com/forum/files/fi ... guekiller/
Webové stránky : http://tigzy.geekstogo.com/roguekiller.php
: http://tigzyrk.blogspot.com/

Operační systém : Windows XP (5.1.2600 Service Pack 3) 32 bits version
Spuštěno v : Normální režim
Uživatel : Uzivatel [Práva správce]
Mód : Odebrat -- Datum : 03/07/2014 19:44:22
| ARK || FAK || MBR |

¤¤¤ Škodlivé procesy: : 0 ¤¤¤

¤¤¤ ¤¤¤ Záznamy Registrů: : 1 ¤¤¤
[HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> VYMAZÁNO

¤¤¤ Zvláštní soubory / Složky: ¤¤¤

¤¤¤ Ovladač : [NAHRÁNO] ¤¤¤
IRP[IRP_MJ_INTERNAL_DEVICE_CONTROL] : atapi.sys -> HOOKED ([MAJOR] sfsync04.sys @ 0xF7336A6C)

¤¤¤ Soubor HOSTS: ¤¤¤
--> C:\WINDOWS\system32\drivers\etc\hosts

127.0.0.1 localhost


¤¤¤ Kontrola MBR: ¤¤¤

+++++ PhysicalDrive0: ST1000DM003-1CH162 +++++
--- User ---
[MBR] 17e098f5614d3c3b2def40371ea71216
[BSP] a7b30c9ce296dd664919007717bdd7f9 : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 953859 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Dokončeno : << RKreport[2]_D_03072014_02d1944.txt >>
RKreport[1]_S_03072014_02d1943.txt ; RKreport[2]_D_03072014_02d1944.txt

ComboFix 14-03-05.01 - Uzivatel 07.03.2014 19:28:08.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.447.175 [GMT 1:00]
Spuštěný z: c:\documents and settings\Uzivatel\Plocha\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Uzivatel\WINDOWS
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
c:\windows\system32\NEW17.tmp
c:\windows\system32\NEW23.tmp
c:\windows\system32\NEW24.tmp
c:\windows\system32\NEW25.tmp
c:\windows\system32\NEW30.tmp
c:\windows\system32\NEW31.tmp
c:\windows\system32\NEW64.tmp
c:\windows\system32\NEW6A.tmp
c:\windows\system32\NEW6B.tmp
c:\windows\system32\SET4D.tmp
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2014-02-07 do 2014-03-07 )))))))))))))))))))))))))))))))
.
.
2014-03-07 17:55 . 2014-02-06 07:08 7947048 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{B8B49F53-6069-4B31-9B43-340BBE49E625}\mpengine.dll
2014-02-23 08:29 . 2014-02-06 07:08 7947048 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2014-02-21 07:49 . 2014-02-21 07:54 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2014-02-21 07:36 . 2014-02-21 07:36 -------- d-----w- C:\d53a56b163aae45e0cd453db98ac
2014-02-21 07:11 . 2014-02-21 07:15 -------- d-----w- C:\ad496383d00215e2020cb7021b1b
2014-02-09 12:00 . 2014-02-09 12:00 -------- d-----w- c:\windows\system32\config\systemprofile\Data aplikací\Softland
2014-02-08 20:12 . 2014-02-08 20:12 -------- d-----w- c:\documents and settings\LocalService\Data aplikací\Softland
2014-02-08 20:12 . 2014-02-08 20:12 -------- d-----w- c:\documents and settings\Uzivatel\Data aplikací\Softland
2014-02-08 20:12 . 2013-08-20 12:28 24384 ----a-w- c:\windows\system32\dopdfmn7.dll
2014-02-08 20:12 . 2013-08-20 12:28 21312 ----a-w- c:\windows\system32\dopdfmi7.dll
2014-02-08 20:12 . 2010-02-05 14:00 1700352 ----a-w- c:\windows\system32\GdiPlus.dll
2014-02-08 20:11 . 2014-02-08 20:11 -------- d-----w- c:\program files\Softland
2014-02-08 18:28 . 2006-10-26 18:56 33104 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\msonpppr.dll
2014-02-08 18:28 . 2009-02-27 02:42 31640 ----a-w- c:\windows\system32\msonpmon.dll
2014-02-08 18:17 . 2014-02-21 06:56 -------- d-----w- c:\program files\Microsoft Works
2014-02-08 18:13 . 2014-02-08 18:13 -------- d-----w- c:\program files\Microsoft.NET
2014-02-08 18:08 . 2014-02-08 18:09 -------- d-----w- c:\windows\SHELLNEW
2014-02-08 18:07 . 2014-02-08 18:07 -------- d-----w- c:\documents and settings\Uzivatel\Local Settings\Data aplikací\Microsoft Help
2014-02-08 18:06 . 2014-02-22 08:47 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Microsoft Help
2014-02-08 18:05 . 2014-02-08 18:05 -------- d-----r- C:\MSOCache
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-02-20 21:24 . 2013-05-03 18:14 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-02-20 21:24 . 2013-05-03 18:14 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-02-06 03:38 . 2008-04-14 12:00 920064 ----a-w- c:\windows\system32\wininet.dll
2014-02-05 23:08 . 2008-04-14 12:00 43520 ------w- c:\windows\system32\licmgr10.dll
2014-02-05 23:08 . 2008-04-14 12:00 18944 ----a-w- c:\windows\system32\corpol.dll
2014-02-05 23:08 . 2008-04-14 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2014-02-05 22:24 . 2008-04-14 12:00 385024 ------w- c:\windows\system32\html.iec
2014-01-19 07:32 . 2013-05-03 13:08 231584 ------w- c:\windows\system32\MpSigStub.exe
2014-01-04 03:12 . 2008-04-14 12:00 420864 ----a-w- c:\windows\system32\vbscript.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinFast Schedule"="c:\program files\WinFast\WFDTV\WFWIZ.exe" [2010-08-11 2920448]
"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2013-03-22 248208]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinFastDTV"="c:\program files\WinFast\WFDTV\DTVSchdl.exe" [2011-01-12 101888]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-27 207424]
"RTHDCPL"="RTHDCPL.EXE" [2013-01-10 20118088]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 49152]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2010-12-13 135536]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-10-23 948440]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-11 282624]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\ICQ7M\\ICQ.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeEnC2.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeTray.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
.
R2 BT848;WinFast TV2000 XP WDM Video Capture;c:\windows\system32\drivers\wf2kvcap.sys [3.5.2013 10:56 59776]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [22.3.2013 5:07 93072]
R2 tv2ktunr;WinFast TV2000 XP WDM TVTuner;c:\windows\system32\drivers\wf2ktunr.sys [3.5.2013 10:57 19456]
R2 Tv2kXbar;WinFast TV2000 XP WDM Crossbar;c:\windows\system32\drivers\wf2kXbar.sys [3.5.2013 10:56 9600]
S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [19.4.2013 14:14 161384]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [3.5.2013 11:07 1691480]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [21.2.2014 8:49 40776]
S3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\windows\system32\drivers\nx6000.sys [27.8.2013 14:31 30576]
.
Obsah adresáře 'Naplánované úlohy'
.
2014-02-23 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-05-03 21:24]
.
2014-03-07 c:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job
- c:\program files\Microsoft Security Client\MpCmdRun.exe [2013-10-23 14:01]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
IE: {{781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - c:\program files\ICQ7M\ICQ.exe
TCP: DhcpNameServer = 10.21.0.1 10.21.60.1
FF - ProfilePath - c:\documents and settings\Uzivatel\Data aplikací\Mozilla\Firefox\Profiles\a838jd4d.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - seznam.cz
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2014-03-07 19:37
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_12_0_0_70_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_12_0_0_70_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Celkový čas: 2014-03-07 19:40:25
ComboFix-quarantined-files.txt 2014-03-07 18:40
.
Před spuštěním: Volných bajtů: 981 684 441 088
Po spuštění: Volných bajtů: 981 909 606 400
.
WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
.
- - End Of File - - 791A3DB4A812096FD8529A90CDC98E83
413FC2A0C716421B3158746D63736515

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok).
Zkopíruj do něj následující celý text označený červeně:

ClearJavaCache::
KillAll::

File::
c:\windows\Tasks\Adobe Flash Player Updater.job
c:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job

Driver::
SkypeUpdate

RegLock::
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_12_0_0_70_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_12_0_0_70_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Celkový čas: 2014-03-07 19:40:25
ComboFix-quarantined-files.txt 2014-03-07 18:40
.
Před spuštěním: Volných bajtů: 981 684 441 088
Po spuštění: Volných bajtů: 981 909 606 400
.


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.


Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe
a když se oba soubory překryjí, skript upusť.


- Automaticky se spustí ComboFix, oprava může trvat i déle než 10 minut. ! Nech ComboFix dokončit svou práci !
- Vlož sem log, který vyběhne v závěru čistícího procesu

Upozornění : Může se stát, že po aplikaci skriptu a restartu počítače Windows nenaběhnou, pak znovu restartuj počítač, mačkej F8 a pak zvol poslední známou funkční konfiguraci.

Děkuji
ComboFix 14-03-05.01 - Uzivatel 09.03.2014 8:43.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.447.134 [GMT 1:00]
Spuštěný z: c:\documents and settings\Uzivatel\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Uzivatel\Plocha\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
* Vytvořen nový Bod Obnovení
.
FILE ::
"c:\windows\Tasks\Adobe Flash Player Updater.job"
"c:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_SKYPEUPDATE
-------\Service_SkypeUpdate
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2014-02-09 do 2014-03-09 )))))))))))))))))))))))))))))))
.
.
2014-03-07 17:55 . 2014-02-06 07:08 7947048 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{B8B49F53-6069-4B31-9B43-340BBE49E625}\mpengine.dll
2014-03-07 17:28 . 2014-02-26 23:28 13312 -c----w- c:\windows\system32\dllcache\xp_eos.exe
2014-03-07 17:28 . 2014-02-26 23:28 13312 ------w- c:\windows\system32\xp_eos.exe
2014-02-23 08:29 . 2014-02-06 07:08 7947048 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2014-02-21 07:49 . 2014-02-21 07:54 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2014-02-21 07:36 . 2014-02-21 07:36 -------- d-----w- C:\d53a56b163aae45e0cd453db98ac
2014-02-21 07:11 . 2014-02-21 07:15 -------- d-----w- C:\ad496383d00215e2020cb7021b1b
2014-02-09 12:00 . 2014-02-09 12:00 -------- d-----w- c:\windows\system32\config\systemprofile\Data aplikací\Softland
2014-02-08 20:12 . 2014-02-08 20:12 -------- d-----w- c:\documents and settings\LocalService\Data aplikací\Softland
2014-02-08 20:12 . 2014-02-08 20:12 -------- d-----w- c:\documents and settings\Uzivatel\Data aplikací\Softland
2014-02-08 20:12 . 2013-08-20 12:28 24384 ----a-w- c:\windows\system32\dopdfmn7.dll
2014-02-08 20:12 . 2013-08-20 12:28 21312 ----a-w- c:\windows\system32\dopdfmi7.dll
2014-02-08 20:12 . 2010-02-05 14:00 1700352 ----a-w- c:\windows\system32\GdiPlus.dll
2014-02-08 20:11 . 2014-02-08 20:11 -------- d-----w- c:\program files\Softland
2014-02-08 18:28 . 2006-10-26 18:56 33104 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\msonpppr.dll
2014-02-08 18:28 . 2009-02-27 02:42 31640 ----a-w- c:\windows\system32\msonpmon.dll
2014-02-08 18:17 . 2014-02-21 06:56 -------- d-----w- c:\program files\Microsoft Works
2014-02-08 18:13 . 2014-02-08 18:13 -------- d-----w- c:\program files\Microsoft.NET
2014-02-08 18:08 . 2014-02-08 18:09 -------- d-----w- c:\windows\SHELLNEW
2014-02-08 18:07 . 2014-02-08 18:07 -------- d-----w- c:\documents and settings\Uzivatel\Local Settings\Data aplikací\Microsoft Help
2014-02-08 18:06 . 2014-02-22 08:47 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Microsoft Help
2014-02-08 18:05 . 2014-02-08 18:05 -------- d-----r- C:\MSOCache
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-02-20 21:24 . 2013-05-03 18:14 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-02-20 21:24 . 2013-05-03 18:14 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-02-06 03:38 . 2008-04-14 12:00 920064 ----a-w- c:\windows\system32\wininet.dll
2014-02-05 23:08 . 2008-04-14 12:00 43520 ------w- c:\windows\system32\licmgr10.dll
2014-02-05 23:08 . 2008-04-14 12:00 18944 ----a-w- c:\windows\system32\corpol.dll
2014-02-05 23:08 . 2008-04-14 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2014-02-05 22:24 . 2008-04-14 12:00 385024 ------w- c:\windows\system32\html.iec
2014-01-19 07:32 . 2013-05-03 13:08 231584 ------w- c:\windows\system32\MpSigStub.exe
2014-01-04 03:12 . 2008-04-14 12:00 420864 ----a-w- c:\windows\system32\vbscript.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinFast Schedule"="c:\program files\WinFast\WFDTV\WFWIZ.exe" [2010-08-11 2920448]
"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2013-03-22 248208]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinFastDTV"="c:\program files\WinFast\WFDTV\DTVSchdl.exe" [2011-01-12 101888]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-27 207424]
"RTHDCPL"="RTHDCPL.EXE" [2013-01-10 20118088]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 49152]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2010-12-13 135536]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-10-23 948440]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-11 282624]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\ICQ7M\\ICQ.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeEnC2.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeTray.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R2 BT848;WinFast TV2000 XP WDM Video Capture;c:\windows\system32\drivers\wf2kvcap.sys [3.5.2013 10:56 59776]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [22.3.2013 5:07 93072]
R2 tv2ktunr;WinFast TV2000 XP WDM TVTuner;c:\windows\system32\drivers\wf2ktunr.sys [3.5.2013 10:57 19456]
R2 Tv2kXbar;WinFast TV2000 XP WDM Crossbar;c:\windows\system32\drivers\wf2kXbar.sys [3.5.2013 10:56 9600]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [3.5.2013 11:07 1691480]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [21.2.2014 8:49 40776]
S3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\windows\system32\drivers\nx6000.sys [27.8.2013 14:31 30576]
.
Obsah adresáře 'Naplánované úlohy'
.
2014-03-08 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-05-03 21:24]
.
2014-03-09 c:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job
- c:\program files\Microsoft Security Client\MpCmdRun.exe [2013-10-23 14:01]
.
2014-03-08 c:\windows\Tasks\Měsíční oznamování konce poskytování služeb pro Microsoft Windows XP.job
- c:\windows\system32\xp_eos.exe [2014-03-07 23:28]
.
2014-03-09 c:\windows\Tasks\Přihlášení k oznamování konce poskytování služeb pro Microsoft Windows XP.job
- c:\windows\system32\xp_eos.exe [2014-03-07 23:28]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
IE: {{781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - c:\program files\ICQ7M\ICQ.exe
TCP: DhcpNameServer = 10.21.0.1 10.21.60.1
FF - ProfilePath - c:\documents and settings\Uzivatel\Data aplikací\Mozilla\Firefox\Profiles\a838jd4d.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - seznam.cz
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2014-03-09 08:55
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'explorer.exe'(3872)
c:\windows\system32\webcheck.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files\Microsoft LifeCam\MSCamS32.exe
c:\windows\system32\HPZipm12.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\windows\system32\wscntfy.exe
c:\windows\RTHDCPL.EXE
c:\program files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
.
**************************************************************************
.
Celkový čas: 2014-03-09 08:59:09 - počítač byl restartován
ComboFix-quarantined-files.txt 2014-03-09 07:59
ComboFix2.txt 2014-03-07 18:40
.
Před spuštěním: Volných bajtů: 981 712 257 024
Po spuštění: Volných bajtů: 981 636 796 416
.
- - End Of File - - BB29294928C9521823A4B084A6CA20AD
413FC2A0C716421B3158746D63736515

ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix /Uninstall

====================================================

Vyčisti systém CCleanerem

====================================================

Stáhni si zde DelFix
http://general-changelog-team.fr/fr/dow ... e/9-delfix

ulož si soubor na plochu.
Poklepáním na ikonu spusť nástroj Delfix.exe
( Ve Windows Vista, Windows 7 a 8, musíš spustit soubor pravým tlačítkem myši -> Spustit jako správce .
V hlavním menu, zkontroluj tyto možnosti - Odstranění dezinfekce nástrojů (Remove desinfection tools) – Vyčistit body obnovy (Purge System Restore)
Poté klikněte na tlačítko Spustit (Run) a nech nástroj dělat svoji práci

Poté se zpráva se otevře (DelFix.txt). Vlož celý obsah zprávy sem. Jinak je zpráva zde:
v C: \ DelFix.txt

Co problémy? + nový log z HJT