PC-HELP.CZ

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:46:33, on 3.12.2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17114)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\vVX3000.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\OSCAR Editor X7\OscarEditor.exe
C:\Corel\Graphics8\Programs\MFIndexer.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Xfire\Xfire.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Application Updater\ApplicationUpdater.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Documents and Settings\All Users\Data aplikací\Skype\Toolbars\Skype C2C Service\c2c_service.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\TeamSpeak 3 Client\ts3client_win32.exe
C:\Program Files\Activision\Call of Duty 2\GamePark\GamePark2\gpcl.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatche ... p=aus&qkw=%s&tbid=60341
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = About:Blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60341
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60341
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: YTD Toolbar - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files\YTD Toolbar\IE\6.5\ytdToolbarIE.dll (file missing)
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: Increase performance and video formats for your HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (file missing)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfre1.dll (file missing)
O2 - BHO: YTD Toolbar - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files\YTD Toolbar\IE\6.5\ytdToolbarIE.dll (file missing)
O3 - Toolbar: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfre1.dll (file missing)
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (file missing)
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll (file missing)
O3 - Toolbar: YTD Toolbar - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files\YTD Toolbar\IE\6.5\ytdToolbarIE.dll (file missing)
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [EasyTuneVI] C:\Program Files\GIGABYTE\ET6\ETcall.exe
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MSC] "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [SearchSettings] "C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent
O4 - HKCU\..\Run: [OscarEditor] "C:\Program Files\OSCAR Editor X7\OscarEditor.exe" Minimum
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ7.2\ICQ.exe" silent loginmode=4
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Uzivatel\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
O4 - Global Startup: Corel MEDIA FOLDERS INDEXER 8.LNK = C:\Corel\Graphics8\Programs\MFIndexer.exe
O4 - Global Startup: GamePark klient 2.lnk = C:\Program Files\Activision\Call of Duty 2\GamePark\GamePark2\gpcl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Data aplikací\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files\ICQ7.4\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files\ICQ7.4\ICQ.exe
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 5396068625
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Application Updater - Spigot, Inc. - C:\Program Files\Application Updater\ApplicationUpdater.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Skype C2C Service - Skype Technologies S.A. - C:\Documents and Settings\All Users\Data aplikací\Skype\Toolbars\Skype C2C Service\c2c_service.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: Airytec Switch Off - Task Scheduler (SwOffScheduler) - Airytec - C:\Program Files\Airytec\Switch Off\swoff.exe
O23 - Service: Airytec Switch Off - Web Interface (SwOffWeb) - Airytec - C:\Program Files\Airytec\Switch Off\swoff.exe

--
End of file - 14534 bytes

Problémy?

Odinstaluj:
Spybot - Search & Destroy
YTD Toolbar
Winamp Toolbar
Ask Toolbar
free-downloads.net Toolbar
DAEMON Tools Toolbar
Spigot

Fixni:


Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected. Poté klikni na Main (hlavní stránku ) a klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

===================================================

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

Problém mám takový, že se mi pomalu načítá windows.

Tak pokračuj v návodu

www.malwarebytes.org

Verze databáze: v2012.12.04.09

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 7.0.5730.13
Uzivatel :: PC [administrátor]

4.12.2012 19:59:13
mbam-log-2012-12-04 (20-12-57).txt

Typ: Rychlá kontrola
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 206834
Uplynulý čas: 12 minut, 19 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 6
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127AD2-394B-70F5-C650-B97867BAA1F7} (Backdoor.Bot) -> Žádná instrukce nebyla provedena.
HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127AD2-394B-70F5-C650-B97867BAA1F7} (Backdoor.Bot) -> Žádná instrukce nebyla provedena.
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43BF8CD1-C5D5-2230-7BB2-98F22C2B7DC6} (Backdoor.Bot) -> Žádná instrukce nebyla provedena.
HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43BF8CD1-C5D5-2230-7BB2-98F22C2B7DC6} (Backdoor.Bot) -> Žádná instrukce nebyla provedena.
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{494E6CEC-7483-A4EE-0938-895519A84BC7} (Backdoor.Bot) -> Žádná instrukce nebyla provedena.
HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{494E6CEC-7483-A4EE-0938-895519A84BC7} (Backdoor.Bot) -> Žádná instrukce nebyla provedena.

Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 1
C:\WINDOWS\system32\lowsec (Stolen.data) -> Žádná instrukce nebyla provedena.

Nalezené soubory: 0
(Žádné škodlivé položky nebyly zjištěny)

(konec)

Znovu spusť MbAM a dej Scan
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Show Results
- ujistit se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Remove Selected
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Exit

Stáhni si TDSSKiller

Na svojí plochu. Ujisti se , že máš zavřeny všechny ostatní aplikace a prohlížeče. Rozbal soubor a spusť TDSSKiller.exe. Restartuj PC . Log z TDSSKilleru najdeš zde:
C:\TDSSKiller.2.2.7.1._(datum)_log.txt , vlož sem prosím celý obsah logu.

Vypni rezidentní štít antiviru a antispywaru
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Pokud bude po kontrole problém spustit aplikace nebo bude vyskakovat hláška o pokusu použít neplatnou operaci na klíč registru, který je označen pro odstranění, stačí restartovat počítač.

Malwarebytes Anti-Malware 1.65.1.1000
www.malwarebytes.org

Verze databáze: v2012.12.04.09

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 7.0.5730.13
Uzivatel :: PC [administrátor]

4.12.2012 21:55:56
mbam-log-2012-12-04 (21-55-56).txt

Typ: Rychlá kontrola
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 206851
Uplynulý čas: 7 minut, 30 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 6
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127AD2-394B-70F5-C650-B97867BAA1F7} (Backdoor.Bot) -> Umístnění do karantény a smazání se zdařilo.
HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127AD2-394B-70F5-C650-B97867BAA1F7} (Backdoor.Bot) -> Umístnění do karantény a smazání se zdařilo.
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43BF8CD1-C5D5-2230-7BB2-98F22C2B7DC6} (Backdoor.Bot) -> Umístnění do karantény a smazání se zdařilo.
HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43BF8CD1-C5D5-2230-7BB2-98F22C2B7DC6} (Backdoor.Bot) -> Umístnění do karantény a smazání se zdařilo.
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{494E6CEC-7483-A4EE-0938-895519A84BC7} (Backdoor.Bot) -> Umístnění do karantény a smazání se zdařilo.
HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{494E6CEC-7483-A4EE-0938-895519A84BC7} (Backdoor.Bot) -> Umístnění do karantény a smazání se zdařilo.

Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 1
C:\WINDOWS\system32\lowsec (Stolen.data) -> Umístnění do karantény a smazání se zdařilo.

Nalezené soubory: 0
(Žádné škodlivé položky nebyly zjištěny)

(konec)

Ještě TDSS a Combofix

22:39:46.0531 1608 TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35
22:39:46.0734 1608 ============================================================
22:39:46.0734 1608 Current date / time: 2012/12/04 22:39:46.0734
22:39:46.0734 1608 SystemInfo:
22:39:46.0734 1608
22:39:46.0734 1608 OS Version: 5.1.2600 ServicePack: 3.0
22:39:46.0734 1608 Product type: Workstation
22:39:46.0734 1608 ComputerName: PC
22:39:46.0734 1608 UserName: Uzivatel
22:39:46.0734 1608 Windows directory: C:\WINDOWS
22:39:46.0734 1608 System windows directory: C:\WINDOWS
22:39:46.0734 1608 Processor architecture: Intel x86
22:39:46.0734 1608 Number of processors: 2
22:39:46.0734 1608 Page size: 0x1000
22:39:46.0734 1608 Boot type: Normal boot
22:39:46.0734 1608 ============================================================
22:39:50.0109 1608 Drive \Device\Harddisk0\DR0 - Size: 0x25432CDE00 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
22:39:50.0109 1608 ============================================================
22:39:50.0109 1608 \Device\Harddisk0\DR0:
22:39:50.0109 1608 MBR partitions:
22:39:50.0109 1608 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0xFDE943E
22:39:50.0140 1608 \Device\Harddisk0\DR0\Partition2: MBR, Type 0xB, StartLBA 0xFDE94BC, BlocksNum 0x2C2B744
22:39:50.0140 1608 ============================================================
22:39:50.0187 1608 C: <-> \Device\Harddisk0\DR0\Partition1
22:39:50.0187 1608 E: <-> \Device\Harddisk0\DR0\Partition2
22:39:50.0187 1608 ============================================================
22:39:50.0187 1608 Initialize success
22:39:50.0187 1608 ============================================================
22:39:53.0250 5052 ============================================================
22:39:53.0250 5052 Scan started
22:39:53.0250 5052 Mode: Manual;
22:39:53.0250 5052 ============================================================
22:39:54.0328 5052 ================ Scan system memory ========================
22:39:54.0328 5052 System memory - ok
22:39:54.0343 5052 ================ Scan services =============================
22:39:54.0500 5052 [ 914A9709FC3BF419AD2F85547F2A4832 ] 61883 C:\WINDOWS\system32\DRIVERS\61883.sys
22:39:54.0500 5052 61883 - ok
22:39:54.0687 5052 [ 17067069B9A7865028C1F2E6971D0CCC ] aawservice C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
22:39:54.0796 5052 aawservice - ok
22:39:54.0796 5052 Abiosdsk - ok
22:39:54.0796 5052 abp480n5 - ok
22:39:54.0859 5052 [ 4FE34F1F3126B61FCC6B2043AA8112C9 ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys
22:39:54.0859 5052 ACPI - ok
22:39:54.0906 5052 [ AFDFF022A01F0B11C776F0860C3B282F ] ACPIEC C:\WINDOWS\system32\drivers\ACPIEC.sys
22:39:54.0906 5052 ACPIEC - ok
22:39:54.0968 5052 [ 8B46D5A1D3EF08232C04D0EAFB871FB2 ] Adobe LM Service C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
22:39:54.0984 5052 Adobe LM Service - ok
22:39:55.0078 5052 [ 44C00A385CA9DBC1D5CF3781F8C26AEA ] AdobeFlashPlayerUpdateSvc C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
22:39:55.0109 5052 AdobeFlashPlayerUpdateSvc - ok
22:39:55.0109 5052 adpu160m - ok
22:39:55.0140 5052 [ 8BED39E3C35D6A489438B8141717A557 ] aec C:\WINDOWS\system32\drivers\aec.sys
22:39:55.0140 5052 aec - ok
22:39:55.0203 5052 [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD C:\WINDOWS\System32\drivers\afd.sys
22:39:55.0203 5052 AFD - ok
22:39:55.0203 5052 Aha154x - ok
22:39:55.0203 5052 aic78u2 - ok
22:39:55.0218 5052 aic78xx - ok
22:39:55.0250 5052 [ E0A6FA244B8624D78FE5FF6F56A33BAE ] Alerter C:\WINDOWS\system32\alrsvc.dll
22:39:55.0250 5052 Alerter - ok
22:39:55.0281 5052 [ 88842DE939A827577BF24243699AC80A ] ALG C:\WINDOWS\System32\alg.exe
22:39:55.0281 5052 ALG - ok
22:39:55.0281 5052 AliIde - ok
22:39:55.0328 5052 [ F6F5E047369784E607F3A636AC576148 ] AmdK8 C:\WINDOWS\system32\DRIVERS\AmdK8.sys
22:39:55.0328 5052 AmdK8 - ok
22:39:55.0343 5052 amsint - ok
22:39:55.0437 5052 [ 21CA6A013A75FCF6F930D4B08803973A ] AODDriver C:\Program Files\GIGABYTE\ET6\i386\AODDriver.sys
22:39:55.0437 5052 AODDriver - ok
22:39:55.0484 5052 [ A5299D04ED225D64CF07A568A3E1BF8C ] Apple Mobile Device C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
22:39:55.0500 5052 Apple Mobile Device - ok
22:39:55.0500 5052 AppMgmt - ok
22:39:55.0546 5052 [ B5B8A80875C1DEDEDA8B02765642C32F ] Arp1394 C:\WINDOWS\system32\DRIVERS\arp1394.sys
22:39:55.0562 5052 Arp1394 - ok
22:39:55.0562 5052 asc - ok
22:39:55.0562 5052 asc3350p - ok
22:39:55.0562 5052 asc3550 - ok
22:39:55.0671 5052 [ 0E5E4957549056E2BF2C49F4F6B601AD ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
22:39:55.0671 5052 aspnet_state - ok
22:39:55.0687 5052 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys
22:39:55.0687 5052 AsyncMac - ok
22:39:55.0718 5052 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys
22:39:55.0718 5052 atapi - ok
22:39:55.0718 5052 Atdisk - ok
22:39:55.0812 5052 [ C49A64D70DD96F1A511F2D2BADFB924F ] Ati HotKey Poller C:\WINDOWS\system32\Ati2evxx.exe
22:39:55.0812 5052 Ati HotKey Poller - ok
22:39:55.0890 5052 [ FDC4B0D5E8D477C75D962F395C3A25F0 ] ATI Smart C:\WINDOWS\system32\ati2sgag.exe
22:39:55.0890 5052 ATI Smart - ok
22:39:56.0203 5052 [ 4F1D98C5FAA232D89F479AA2F6EF4196 ] ati2mtag C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
22:39:56.0218 5052 ati2mtag - ok
22:39:56.0281 5052 [ DC6957811FF95F2DD3004361B20D8D3F ] AtiHdmiService C:\WINDOWS\system32\drivers\AtiHdmi.sys
22:39:56.0281 5052 AtiHdmiService - ok
22:39:56.0312 5052 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys
22:39:56.0312 5052 Atmarpc - ok
22:39:56.0359 5052 [ DE31B88962A8645DBA5A37B993E7B0F1 ] AudioSrv C:\WINDOWS\System32\audiosrv.dll
22:39:56.0359 5052 AudioSrv - ok
22:39:56.0406 5052 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys
22:39:56.0406 5052 audstub - ok
22:39:56.0453 5052 [ F8E6956A614F15A0860474C5E2A7DE6B ] Avc C:\WINDOWS\system32\DRIVERS\avc.sys
22:39:56.0453 5052 Avc - ok
22:39:56.0468 5052 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINDOWS\system32\drivers\Beep.sys
22:39:56.0468 5052 Beep - ok
22:39:56.0531 5052 [ 19395D092FD85DDC2D9C7729CF5A2AC8 ] BITS C:\WINDOWS\system32\qmgr.dll
22:39:56.0546 5052 BITS - ok
22:39:56.0656 5052 [ DB5BEA73EDAF19AC68B2C0FAD0F92B1A ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
22:39:56.0703 5052 Bonjour Service - ok
22:39:56.0750 5052 [ 89E739BBA5F636297EA5B5F811189E06 ] Browser C:\WINDOWS\System32\browser.dll
22:39:56.0750 5052 Browser - ok
22:39:56.0765 5052 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys
22:39:56.0765 5052 cbidf2k - ok
22:39:56.0781 5052 [ 0BE5AEF125BE881C4F854C554F2B025C ] CCDECODE C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
22:39:56.0781 5052 CCDECODE - ok
22:39:56.0781 5052 cd20xrnt - ok
22:39:56.0812 5052 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys
22:39:56.0812 5052 Cdaudio - ok
22:39:56.0828 5052 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys
22:39:56.0828 5052 Cdfs - ok
22:39:56.0843 5052 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys
22:39:56.0843 5052 Cdrom - ok
22:39:56.0859 5052 Changer - ok
22:39:56.0890 5052 [ E390DC1D7C461D7D56EC53402F329928 ] CiSvc C:\WINDOWS\system32\cisvc.exe
22:39:56.0890 5052 CiSvc - ok
22:39:56.0906 5052 [ 064507A8DFA8C5C7E2FFDDD3E6F424FA ] ClipSrv C:\WINDOWS\system32\clipsrv.exe
22:39:56.0906 5052 ClipSrv - ok
22:39:56.0937 5052 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
22:39:56.0953 5052 clr_optimization_v2.0.50727_32 - ok
22:39:57.0062 5052 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
22:39:57.0078 5052 clr_optimization_v4.0.30319_32 - ok
22:39:57.0078 5052 CmdIde - ok
22:39:57.0078 5052 COMSysApp - ok
22:39:57.0093 5052 Cpqarray - ok
22:39:57.0156 5052 [ F3AB0933CBD166D271992F411C27CCAF ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll
22:39:57.0156 5052 CryptSvc - ok
22:39:57.0156 5052 dac2w2k - ok
22:39:57.0171 5052 dac960nt - ok
22:39:57.0250 5052 [ BE27674D1CBC3214AEC84B4336A38BBF ] DcomLaunch C:\WINDOWS\system32\rpcss.dll
22:39:57.0250 5052 DcomLaunch - ok
22:39:57.0312 5052 [ 8C9A53E285AC5E6704844D0459EC85BE ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll
22:39:57.0312 5052 Dhcp - ok
22:39:57.0328 5052 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys
22:39:57.0328 5052 Disk - ok
22:39:57.0328 5052 dmadmin - ok
22:39:57.0421 5052 [ DB5FD2BF5B07DC54BFCB3664FF05BD7C ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys
22:39:57.0437 5052 dmboot - ok
22:39:57.0468 5052 [ FFF1720AF51171F32F1EAD5CF71F2810 ] dmio C:\WINDOWS\system32\drivers\dmio.sys
22:39:57.0468 5052 dmio - ok
22:39:57.0484 5052 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINDOWS\system32\drivers\dmload.sys
22:39:57.0484 5052 dmload - ok
22:39:57.0515 5052 [ 2BFEFE9E865655A76982F050450B9591 ] dmserver C:\WINDOWS\System32\dmserver.dll
22:39:57.0515 5052 dmserver - ok
22:39:57.0546 5052 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys
22:39:57.0546 5052 DMusic - ok
22:39:57.0593 5052 [ DFAA406BF19F4EE806A6F8D4342137F7 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll
22:39:57.0593 5052 Dnscache - ok
22:39:57.0640 5052 [ 4A3E2BD20157A0946751229E92EB8621 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll
22:39:57.0640 5052 Dot3svc - ok
22:39:57.0656 5052 dpti2o - ok
22:39:57.0687 5052 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys
22:39:57.0687 5052 drmkaud - ok
22:39:57.0718 5052 [ 0887D9C2BE8D940778CAD1E3B85F2A41 ] EapHost C:\WINDOWS\System32\eapsvc.dll
22:39:57.0718 5052 EapHost - ok
22:39:57.0765 5052 [ A2A4912798F2BE706ABADD3D30800D16 ] ERSvc C:\WINDOWS\System32\ersvc.dll
22:39:57.0765 5052 ERSvc - ok
22:39:57.0796 5052 [ 3AF0AE042AFE486B22644CD3FBEBF2E2 ] etdrv C:\WINDOWS\etdrv.sys
22:39:58.0015 5052 etdrv - ok
22:39:58.0062 5052 [ 9EF697AF07BB8DD82C3B02CA953A95B7 ] Eventlog C:\WINDOWS\system32\services.exe
22:39:58.0062 5052 Eventlog - ok
22:39:58.0125 5052 [ A371F11EF07653591C8DE26AFB13CE7F ] EventSystem C:\WINDOWS\system32\es.dll
22:39:58.0140 5052 EventSystem - ok
22:39:58.0203 5052 [ 38D332A6D56AF32635675F132548343E ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys
22:39:58.0203 5052 Fastfat - ok
22:39:58.0265 5052 [ EE9A2B9EA968A792A053C9D1A86BF870 ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll
22:39:58.0265 5052 FastUserSwitchingCompatibility - ok
22:39:58.0312 5052 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc C:\WINDOWS\system32\drivers\Fdc.sys
22:39:58.0312 5052 Fdc - ok
22:39:58.0359 5052 [ 50104C5F1EE1E295781CAF9521CA2E56 ] FilterService C:\WINDOWS\system32\DRIVERS\lvuvcflt.sys
22:39:58.0359 5052 FilterService - ok
22:39:58.0375 5052 [ AC366695A0796560AA37215AD5762AAF ] Fips C:\WINDOWS\system32\drivers\Fips.sys
22:39:58.0375 5052 Fips - ok
22:39:58.0375 5052 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk C:\WINDOWS\system32\drivers\Flpydisk.sys
22:39:58.0375 5052 Flpydisk - ok
22:39:58.0421 5052 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr C:\WINDOWS\system32\drivers\fltmgr.sys
22:39:58.0421 5052 FltMgr - ok
22:39:58.0546 5052 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
22:39:58.0562 5052 FontCache3.0.0.0 - ok
22:39:58.0578 5052 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys
22:39:58.0578 5052 Fs_Rec - ok
22:39:58.0593 5052 [ 4E664D8541DB4A66B73A24257E322E1F ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys
22:39:58.0593 5052 Ftdisk - ok
22:39:58.0625 5052 [ D556CB79967E92B5CC69686D16C1D846 ] gdrv C:\WINDOWS\gdrv.sys
22:39:58.0625 5052 gdrv - ok
22:39:58.0671 5052 [ 185ADA973B5020655CEE342059A86CBB ] GEARAspiWDM C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys
22:39:58.0671 5052 GEARAspiWDM - ok
22:39:58.0718 5052 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys
22:39:58.0718 5052 Gpc - ok
22:39:58.0765 5052 [ 56BF27D7A539F9E6BBC1DE201ABA0EDF ] HdAudAddService C:\WINDOWS\system32\drivers\AtiHdAud.sys
22:39:58.0765 5052 HdAudAddService - ok
22:39:58.0796 5052 [ 573C7D0A32852B48F3058CFD8026F511 ] HDAudBus C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
22:39:58.0812 5052 HDAudBus - ok
22:39:58.0906 5052 [ FCFE31FB75F8A6295B6B0AF87A626282 ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
22:39:58.0906 5052 helpsvc - ok
22:39:58.0953 5052 [ 00E25EE90166B3E1BE6E74AEBF858306 ] HidServ C:\WINDOWS\System32\hidserv.dll
22:39:58.0953 5052 HidServ - ok
22:39:58.0968 5052 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] HidUsb C:\WINDOWS\system32\DRIVERS\hidusb.sys
22:39:58.0968 5052 HidUsb - ok
22:39:59.0000 5052 [ 7A6B320928F86BC851530D63C82965D9 ] hkmsvc C:\WINDOWS\System32\kmsvc.dll
22:39:59.0000 5052 hkmsvc - ok
22:39:59.0000 5052 hpn - ok
22:39:59.0062 5052 [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys
22:39:59.0062 5052 HTTP - ok
22:39:59.0093 5052 [ 58FE2F2DA3BC5573F4A35B3760D3125F ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll
22:39:59.0140 5052 HTTPFilter - ok
22:39:59.0140 5052 i2omgmt - ok
22:39:59.0140 5052 i2omp - ok
22:39:59.0203 5052 [ C528E27945367191E7BAE364930B6932 ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys
22:39:59.0203 5052 i8042prt - ok
22:39:59.0359 5052 [ 1CF03C69B49ACB70C722DF92755C0C8C ] IDriverT C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
22:39:59.0421 5052 IDriverT - ok
22:39:59.0671 5052 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
22:39:59.0875 5052 idsvc - ok
22:39:59.0921 5052 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys
22:39:59.0921 5052 Imapi - ok
22:40:00.0031 5052 [ F7B93AAFAD33B2320954C17E26C8D361 ] ImapiService C:\WINDOWS\system32\imapi.exe
22:40:00.0031 5052 ImapiService - ok
22:40:00.0046 5052 ini910u - ok
22:40:00.0531 5052 [ 8C65FCF7AB3389E7C224EA2EC4456F2D ] IntcAzAudAddService C:\WINDOWS\system32\drivers\RtkHDAud.sys
22:40:00.0562 5052 IntcAzAudAddService - ok
22:40:00.0562 5052 IntelIde - ok
22:40:00.0593 5052 [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw C:\WINDOWS\system32\drivers\ip6fw.sys
22:40:00.0593 5052 Ip6Fw - ok
22:40:00.0625 5052 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
22:40:00.0625 5052 IpFilterDriver - ok
22:40:00.0640 5052 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys
22:40:00.0640 5052 IpInIp - ok
22:40:00.0671 5052 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys
22:40:00.0687 5052 IpNat - ok
22:40:00.0796 5052 [ BC0EA61246F8D940FBC5F652D337D6BD ] iPod Service C:\Program Files\iPod\bin\iPodService.exe
22:40:00.0890 5052 iPod Service - ok
22:40:00.0937 5052 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys
22:40:00.0937 5052 IPSec - ok
22:40:00.0953 5052 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys
22:40:00.0968 5052 IRENUM - ok
22:40:00.0984 5052 [ CC9F8A2D60AED1A51A3AC34C59B987AE ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys
22:40:00.0984 5052 isapnp - ok
22:40:01.0140 5052 [ 691B9B7C0CC1653732717D292D6B305D ] JavaQuickStarterService C:\Program Files\Java\jre6\bin\jqs.exe
22:40:01.0156 5052 JavaQuickStarterService - ok
22:40:01.0187 5052 [ FE8300320281D658A7854D5CFC02A63F ] k750bus C:\WINDOWS\system32\DRIVERS\k750bus.sys
22:40:01.0187 5052 k750bus - ok
22:40:01.0218 5052 [ F44521F63C0C00364FA3D59DB980DE6A ] k750mdfl C:\WINDOWS\system32\DRIVERS\k750mdfl.sys
22:40:01.0218 5052 k750mdfl - ok
22:40:01.0234 5052 [ E93323C3ED5E8923A177740A973C27B2 ] k750mdm C:\WINDOWS\system32\DRIVERS\k750mdm.sys
22:40:01.0234 5052 k750mdm - ok
22:40:01.0265 5052 [ 9D5F5A70CA0B7C428EFCD73DB50E6AC7 ] k750mgmt C:\WINDOWS\system32\DRIVERS\k750mgmt.sys
22:40:01.0265 5052 k750mgmt - ok
22:40:01.0281 5052 [ 81CA2D57B2C14F76F4BA80846784BB3D ] k750obex C:\WINDOWS\system32\DRIVERS\k750obex.sys
22:40:01.0281 5052 k750obex - ok
22:40:01.0312 5052 [ 1B6162FE7F66B1A71A4B70F941C4AA9B ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys
22:40:01.0312 5052 Kbdclass - ok
22:40:01.0343 5052 [ 86C8F23616C6C6E5B2776901C17B945B ] kbdhid C:\WINDOWS\system32\DRIVERS\kbdhid.sys
22:40:01.0343 5052 kbdhid - ok
22:40:01.0390 5052 [ 692BCF44383D056AED41B045A323D378 ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys
22:40:01.0390 5052 kmixer - ok
22:40:01.0437 5052 [ B467646C54CC746128904E1654C750C1 ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys
22:40:01.0437 5052 KSecDD - ok
22:40:01.0484 5052 [ 3428E8F86F8ADD36B42FB23542C7B3E4 ] lanmanserver C:\WINDOWS\System32\srvsvc.dll
22:40:01.0500 5052 lanmanserver - ok
22:40:01.0546 5052 [ 936C1D110232D23B621CB0196E4F80F0 ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll
22:40:01.0562 5052 lanmanworkstation - ok
22:40:01.0578 5052 lbrtfdc - ok
22:40:01.0625 5052 [ 0AB159F536E3E8F7F07113702A07CCA5 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll
22:40:01.0625 5052 LmHosts - ok
22:40:01.0734 5052 [ 38440FE1A65B1FE3D246C5C4CAD22F53 ] LVCOMSer C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
22:40:01.0750 5052 LVCOMSer - ok
22:40:01.0796 5052 [ A6919138F29AE45E90E99FA94737E04C ] LVPr2Mon C:\WINDOWS\system32\DRIVERS\LVPr2Mon.sys
22:40:01.0796 5052 LVPr2Mon - ok
22:40:01.0875 5052 [ 28BD0E4B6C050B591B8CB35B9AD284E6 ] LVPrcSrv C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
22:40:01.0890 5052 LVPrcSrv - ok
22:40:02.0000 5052 [ B895839B8743E400D7C7DAE156F74E7E ] LVRS C:\WINDOWS\system32\DRIVERS\lvrs.sys
22:40:02.0000 5052 LVRS - ok
22:40:02.0046 5052 [ 23F8EF78BB9553E465A476F3CEE5CA18 ] LVUSBSta C:\WINDOWS\system32\drivers\LVUSBSta.sys
22:40:02.0046 5052 LVUSBSta - ok
22:40:02.0515 5052 [ 8BC0D5F6E3898F465A94C6D03AFB5A20 ] LVUVC C:\WINDOWS\system32\DRIVERS\lvuvc.sys
22:40:02.0546 5052 LVUVC - ok
22:40:02.0609 5052 [ A3E700D78EEC390F1208098CDCA5C6B6 ] MarvinBus C:\WINDOWS\system32\DRIVERS\MarvinBus.sys
22:40:02.0609 5052 MarvinBus - ok
22:40:02.0656 5052 [ 221CD1C815B8A6B79389C3F5D1018DE8 ] Messenger C:\WINDOWS\System32\msgsvc.dll
22:40:02.0656 5052 Messenger - ok
22:40:02.0687 5052 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys
22:40:02.0687 5052 mnmdd - ok
22:40:02.0718 5052 [ 9A57D046F88F4B69751B11FD40088A61 ] mnmsrvc C:\WINDOWS\system32\mnmsrvc.exe
22:40:02.0718 5052 mnmsrvc - ok
22:40:02.0734 5052 [ 44032B0C6D9954D3FD26438330B99EE7 ] Modem C:\WINDOWS\system32\drivers\Modem.sys
22:40:02.0734 5052 Modem - ok
22:40:02.0765 5052 [ 4CB582831DBDE63CE43B45D771218374 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys
22:40:02.0781 5052 Mouclass - ok
22:40:02.0796 5052 [ BB269EBA740737AB749B214D568B6812 ] mouhid C:\WINDOWS\system32\DRIVERS\mouhid.sys
22:40:02.0796 5052 mouhid - ok
22:40:02.0828 5052 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys
22:40:02.0828 5052 MountMgr - ok
22:40:02.0875 5052 [ EE728AF83850DDAD9A3FCAC0AAB3AD97 ] MpFilter C:\WINDOWS\system32\DRIVERS\MpFilter.sys
22:40:02.0875 5052 MpFilter - ok
22:40:02.0875 5052 mraid35x - ok
22:40:02.0906 5052 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys
22:40:02.0906 5052 MRxDAV - ok
22:40:02.0984 5052 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
22:40:02.0984 5052 MRxSmb - ok
22:40:03.0031 5052 [ 6DB4D1521CABA9A5FFAB54ADE0AE867D ] MSDTC C:\WINDOWS\system32\msdtc.exe
22:40:03.0031 5052 MSDTC - ok
22:40:03.0046 5052 [ 1477849772712BAC69C144DCF2C9CE81 ] MSDV C:\WINDOWS\system32\DRIVERS\msdv.sys
22:40:03.0062 5052 MSDV - ok
22:40:03.0078 5052 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys
22:40:03.0078 5052 Msfs - ok
22:40:03.0078 5052 MSIServer - ok
22:40:03.0109 5052 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys
22:40:03.0109 5052 MSKSSRV - ok
22:40:03.0187 5052 [ E077FCA2A7E79FB9BF67D3E30B5CE593 ] MsMpSvc c:\Program Files\Microsoft Security Client\MsMpEng.exe
22:40:03.0187 5052 MsMpSvc - ok
22:40:03.0234 5052 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys
22:40:03.0234 5052 MSPCLOCK - ok
22:40:03.0250 5052 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys
22:40:03.0250 5052 MSPQM - ok
22:40:03.0265 5052 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys
22:40:03.0265 5052 mssmbios - ok
22:40:03.0296 5052 [ E53736A9E30C45FA9E7B5EAC55056D1D ] MSTEE C:\WINDOWS\system32\drivers\MSTEE.sys
22:40:03.0296 5052 MSTEE - ok
22:40:03.0343 5052 [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup C:\WINDOWS\system32\drivers\Mup.sys
22:40:03.0343 5052 Mup - ok
22:40:03.0375 5052 [ 5B50F1B2A2ED47D560577B221DA734DB ] NABTSFEC C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
22:40:03.0375 5052 NABTSFEC - ok
22:40:03.0437 5052 [ 6EA362E9DB03D44F6B996F4D8BE237E9 ] napagent C:\WINDOWS\System32\qagentrt.dll
22:40:03.0437 5052 napagent - ok
22:40:03.0578 5052 [ 6D8FCDD5BB3B676EF58FA234073492C6 ] NBService C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
22:40:03.0656 5052 NBService - ok
22:40:03.0687 5052 [ 1DF7F42665C94B825322FAE71721130D ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys
22:40:03.0687 5052 NDIS - ok
22:40:03.0718 5052 [ 7FF1F1FD8609C149AA432F95A8163D97 ] NdisIP C:\WINDOWS\system32\DRIVERS\NdisIP.sys
22:40:03.0718 5052 NdisIP - ok
22:40:03.0750 5052 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys
22:40:03.0750 5052 NdisTapi - ok
22:40:03.0765 5052 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys
22:40:03.0765 5052 Ndisuio - ok
22:40:03.0781 5052 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys
22:40:03.0781 5052 NdisWan - ok
22:40:03.0828 5052 [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys
22:40:03.0828 5052 NDProxy - ok
22:40:03.0843 5052 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys
22:40:03.0843 5052 NetBIOS - ok
22:40:03.0890 5052 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys
22:40:03.0890 5052 NetBT - ok
22:40:03.0937 5052 [ 933DE774986EC85E48210C44AB431DE6 ] NetDDE C:\WINDOWS\system32\netdde.exe
22:40:03.0937 5052 NetDDE - ok
22:40:03.0953 5052 [ 933DE774986EC85E48210C44AB431DE6 ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe
22:40:03.0953 5052 NetDDEdsdm - ok
22:40:03.0968 5052 [ ED0A176354487CEED65B80A7148AB739 ] Netlogon C:\WINDOWS\system32\lsass.exe
22:40:03.0968 5052 Netlogon - ok
22:40:04.0015 5052 [ 72E1E9E2977BE08BDEEDB6D8FD9D4D40 ] Netman C:\WINDOWS\System32\netman.dll
22:40:04.0031 5052 Netman - ok
22:40:04.0078 5052 [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
22:40:04.0078 5052 NetTcpPortSharing - ok
22:40:04.0093 5052 [ E9E47CFB2D461FA0FC75B7A74C6383EA ] NIC1394 C:\WINDOWS\system32\DRIVERS\nic1394.sys
22:40:04.0093 5052 NIC1394 - ok
22:40:04.0156 5052 [ 39EE7C3BFBC64BA87CC8CF67386E814C ] Nla C:\WINDOWS\System32\mswsock.dll
22:40:04.0156 5052 Nla - ok
22:40:04.0281 5052 [ 060DAF68493AD7ADF104413E5A62AFA8 ] NMIndexingService C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
22:40:04.0312 5052 NMIndexingService - ok
22:40:04.0359 5052 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys
22:40:04.0359 5052 Npfs - ok
22:40:04.0421 5052 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys
22:40:04.0421 5052 Ntfs - ok
22:40:04.0437 5052 [ ED0A176354487CEED65B80A7148AB739 ] NtLmSsp C:\WINDOWS\system32\lsass.exe
22:40:04.0437 5052 NtLmSsp - ok
22:40:04.0515 5052 [ 023DD70573D644F3D9C8B1258A7BFD08 ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll
22:40:04.0515 5052 NtmsSvc - ok
22:40:04.0546 5052 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINDOWS\system32\drivers\Null.sys
22:40:04.0546 5052 Null - ok
22:40:04.0609 5052 [ 982702A22349C2B31F7DCEF62241058F ] NVENETFD C:\WINDOWS\system32\DRIVERS\NVENETFD.sys
22:40:04.0609 5052 NVENETFD - ok
22:40:04.0609 5052 [ BC0F2C4ED9D6DA9A2519C55AF7D4FC60 ] nvnetbus C:\WINDOWS\system32\DRIVERS\nvnetbus.sys
22:40:04.0609 5052 nvnetbus - ok
22:40:04.0640 5052 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
22:40:04.0640 5052 NwlnkFlt - ok
22:40:04.0656 5052 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
22:40:04.0656 5052 NwlnkFwd - ok
22:40:04.0687 5052 [ CA33832DF41AFB202EE7AEB05145922F ] ohci1394 C:\WINDOWS\system32\DRIVERS\ohci1394.sys
22:40:04.0687 5052 ohci1394 - ok
22:40:04.0765 5052 [ 7A56CF3E3F12E8AF599963B16F50FB6A ] ose C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
22:40:04.0765 5052 ose - ok
22:40:04.0812 5052 [ 46F8DB73B4A53E543F8E371DC7C75BAE ] Parport C:\WINDOWS\system32\DRIVERS\parport.sys
22:40:04.0828 5052 Parport - ok
22:40:04.0828 5052 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys
22:40:04.0828 5052 PartMgr - ok
22:40:04.0875 5052 [ 1FAE19D0457176318BBA4A8795656EBC ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys
22:40:04.0875 5052 ParVdm - ok
22:40:04.0906 5052 [ 6CE351D149CB4BEFC702951E471E1730 ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys
22:40:04.0906 5052 PCI - ok
22:40:04.0921 5052 PCIDump - ok
22:40:04.0921 5052 [ 2DA4EC85E0EA7A45C6B2A05820492D5A ] PCIIde C:\WINDOWS\system32\DRIVERS\pciide.sys
22:40:04.0921 5052 PCIIde - ok
22:40:04.0953 5052 [ 4FC31E6C19A5CE5198B1ABFF94CAE758 ] Pcmcia C:\WINDOWS\system32\drivers\Pcmcia.sys
22:40:04.0953 5052 Pcmcia - ok
22:40:05.0000 5052 [ 5B6C11DE7E839C05248CED8825470FEF ] pcouffin C:\WINDOWS\system32\Drivers\pcouffin.sys
22:40:05.0000 5052 pcouffin - ok
22:40:05.0000 5052 PDCOMP - ok
22:40:05.0000 5052 PDFRAME - ok
22:40:05.0015 5052 PDRELI - ok
22:40:05.0015 5052 PDRFRAME - ok
22:40:05.0015 5052 perc2 - ok
22:40:05.0031 5052 perc2hib - ok
22:40:05.0062 5052 [ 9EF697AF07BB8DD82C3B02CA953A95B7 ] PlugPlay C:\WINDOWS\system32\services.exe
22:40:05.0062 5052 PlugPlay - ok
22:40:05.0109 5052 [ A1DD33D16F277CE34124EE52AB2C0F14 ] PnkBstrA C:\WINDOWS\system32\PnkBstrA.exe
22:40:05.0125 5052 PnkBstrA - ok
22:40:05.0156 5052 [ 7C01817ADF3207FB65A4B56E6D5AD833 ] PnkBstrB C:\WINDOWS\system32\PnkBstrB.exe
22:40:05.0187 5052 PnkBstrB - ok
22:40:05.0234 5052 [ F4BA8E3E515A3DD9DD29A031D6F94E02 ] PnkBstrK C:\WINDOWS\system32\drivers\PnkBstrK.sys
22:40:05.0234 5052 PnkBstrK - ok
22:40:05.0265 5052 [ ED0A176354487CEED65B80A7148AB739 ] PolicyAgent C:\WINDOWS\system32\lsass.exe
22:40:05.0265 5052 PolicyAgent - ok
22:40:05.0312 5052 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys
22:40:05.0328 5052 PptpMiniport - ok
22:40:05.0343 5052 [ 7EB15DCE4EC3A0220BD796A15C18186E ] Processor C:\WINDOWS\system32\DRIVERS\processr.sys
22:40:05.0343 5052 Processor - ok
22:40:05.0343 5052 [ ED0A176354487CEED65B80A7148AB739 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe
22:40:05.0343 5052 ProtectedStorage - ok
22:40:05.0359 5052 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys
22:40:05.0359 5052 PSched - ok
22:40:05.0406 5052 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys
22:40:05.0406 5052 Ptilink - ok
22:40:05.0468 5052 [ E42E3433DBB4CFFE8FDD91EAB29AEA8E ] PxHelp20 C:\WINDOWS\system32\Drivers\PxHelp20.sys
22:40:05.0468 5052 PxHelp20 - ok
22:40:05.0468 5052 ql1080 - ok
22:40:05.0468 5052 Ql10wnt - ok
22:40:05.0484 5052 ql12160 - ok
22:40:05.0484 5052 ql1240 - ok
22:40:05.0484 5052 ql1280 - ok
22:40:05.0500 5052 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys
22:40:05.0500 5052 RasAcd - ok
22:40:05.0546 5052 [ 2B5E44EA009F2F374B980E1E9A70635D ] RasAuto C:\WINDOWS\System32\rasauto.dll
22:40:05.0546 5052 RasAuto - ok
22:40:05.0578 5052 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
22:40:05.0578 5052 Rasl2tp - ok
22:40:05.0640 5052 [ D57554C664B64604BD1EE13EA2C07E77 ] RasMan C:\WINDOWS\System32\rasmans.dll
22:40:05.0671 5052 RasMan - ok
22:40:05.0671 5052 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys
22:40:05.0671 5052 RasPppoe - ok
22:40:05.0687 5052 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys
22:40:05.0687 5052 Raspti - ok
22:40:05.0718 5052 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys
22:40:05.0718 5052 Rdbss - ok
22:40:05.0734 5052 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
22:40:05.0734 5052 RDPCDD - ok
22:40:05.0781 5052 [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys
22:40:05.0781 5052 RDPWD - ok
22:40:05.0812 5052 [ C0D9D9711CB74EE9BC66353D8CBDAB0E ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe
22:40:05.0828 5052 RDSessMgr - ok
22:40:05.0859 5052 [ 611BFD220305BE3A85AE876EA47D4AA5 ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys
22:40:05.0859 5052 redbook - ok
22:40:05.0906 5052 [ 127C26B5371651043450E52542099ABA ] RemoteAccess C:\WINDOWS\System32\mprdim.dll
22:40:05.0906 5052 RemoteAccess - ok
22:40:05.0953 5052 [ 718B3BDC0BC3C2F7D065A53D26202AF9 ] RpcLocator C:\WINDOWS\system32\locator.exe
22:40:05.0953 5052 RpcLocator - ok
22:40:06.0015 5052 [ BE27674D1CBC3214AEC84B4336A38BBF ] RpcSs C:\WINDOWS\system32\rpcss.dll
22:40:06.0015 5052 RpcSs - ok
22:40:06.0078 5052 [ 09AB2E71E58B078038E3BFDBA7FFC984 ] RSVP C:\WINDOWS\system32\rsvp.exe
22:40:06.0093 5052 RSVP - ok
22:40:06.0109 5052 [ ED0A176354487CEED65B80A7148AB739 ] SamSs C:\WINDOWS\system32\lsass.exe
22:40:06.0109 5052 SamSs - ok
22:40:06.0140 5052 [ 410046E401EB11E1E6749E9DEEA41D4A ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe
22:40:06.0140 5052 SCardSvr - ok
22:40:06.0203 5052 [ 3FF232A7731621B8902D81D42418C93C ] Schedule C:\WINDOWS\system32\schedsvc.dll
22:40:06.0203 5052 Schedule - ok
22:40:06.0281 5052 [ 07F7F501AD50DE2BA2D5842D9B6D6155 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys
22:40:06.0281 5052 Secdrv - ok
22:40:06.0281 5052 [ 477E2C3CC5E4A0D635BCB0EA8DCAC3C6 ] seclogon C:\WINDOWS\System32\seclogon.dll
22:40:06.0296 5052 seclogon - ok
22:40:06.0312 5052 [ A530B75C10C23C9AB28FDB6CE719E21F ] SENS C:\WINDOWS\system32\sens.dll
22:40:06.0312 5052 SENS - ok
22:40:06.0359 5052 [ 0F29512CCD6BEAD730039FB4BD2C85CE ] serenum C:\WINDOWS\system32\DRIVERS\serenum.sys
22:40:06.0359 5052 serenum - ok
22:40:06.0375 5052 [ B842729337C9B921615C40D3C1A1AF96 ] Serial C:\WINDOWS\system32\DRIVERS\serial.sys
22:40:06.0375 5052 Serial - ok
22:40:06.0453 5052 [ AAD95FE3E005489C7156FA111F744EAF ] sfdrv01 C:\WINDOWS\system32\drivers\sfdrv01.sys
22:40:06.0453 5052 sfdrv01 - ok
22:40:06.0453 5052 [ DAAD4C099EBF5094D32C373AC1AC0F3C ] sfhlp02 C:\WINDOWS\system32\drivers\sfhlp02.sys
22:40:06.0453 5052 sfhlp02 - ok
22:40:06.0468 5052 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINDOWS\system32\drivers\Sfloppy.sys
22:40:06.0468 5052 Sfloppy - ok
22:40:06.0500 5052 [ 197CEF62EB4BC043E1578529FA2B9A48 ] sfvfs02 C:\WINDOWS\system32\drivers\sfvfs02.sys
22:40:06.0500 5052 sfvfs02 - ok
22:40:06.0593 5052 [ F58FACA9621D2DB01BD0927D9A0A208E ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll
22:40:06.0593 5052 SharedAccess - ok
22:40:06.0609 5052 [ EE9A2B9EA968A792A053C9D1A86BF870 ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll
22:40:06.0609 5052 ShellHWDetection - ok
22:40:06.0625 5052 Simbad - ok
22:40:07.0093 5052 [ 3740B83AEC21D981065D7E819BD7E878 ] Skype C2C Service C:\Documents and Settings\All Users\Data aplikací\Skype\Toolbars\Skype C2C Service\c2c_service.exe
22:40:07.0421 5052 Skype C2C Service - ok
22:40:07.0500 5052 [ A4FAB5F7818A69DA6E740943CB8F7CA9 ] SkypeUpdate C:\Program Files\Skype\Updater\Updater.exe
22:40:07.0515 5052 SkypeUpdate - ok
22:40:07.0562 5052 [ 866D538EBE33709A5C9F5C62B73B7D14 ] SLIP C:\WINDOWS\system32\DRIVERS\SLIP.sys
22:40:07.0562 5052 SLIP - ok
22:40:07.0562 5052 Sparrow - ok
22:40:07.0593 5052 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINDOWS\system32\drivers\splitter.sys
22:40:07.0593 5052 splitter - ok
22:40:07.0640 5052 [ 60784F891563FB1B767F70117FC2428F ] Spooler C:\WINDOWS\system32\spoolsv.exe
22:40:07.0640 5052 Spooler - ok
22:40:07.0734 5052 [ 68103A2B441BBF3908EBB587F0704D6C ] sptd C:\WINDOWS\System32\Drivers\sptd.sys
22:40:07.0734 5052 sptd - ok
22:40:07.0750 5052 [ 94610C8653635E4459316A0050D55CE7 ] sr C:\WINDOWS\system32\DRIVERS\sr.sys
22:40:07.0750 5052 sr - ok
22:40:07.0812 5052 [ 35B91147124F64AC8081A2EDB9EA4DEE ] srservice C:\WINDOWS\system32\srsvc.dll
22:40:07.0843 5052 srservice - ok
22:40:07.0906 5052 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys
22:40:07.0906 5052 Srv - ok
22:40:07.0968 5052 [ BECD5271DC4E3B7C3D035F790FCBC1E5 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll
22:40:07.0968 5052 SSDPSRV - ok
22:40:08.0015 5052 [ C1CDD9275F6A115BB0AE1D55D8D27BA6 ] stisvc C:\WINDOWS\system32\wiaservc.dll
22:40:08.0046 5052 stisvc - ok
22:40:08.0093 5052 [ 77813007BA6265C4B6098187E6ED79D2 ] streamip C:\WINDOWS\system32\DRIVERS\StreamIP.sys
22:40:08.0093 5052 streamip - ok
22:40:08.0109 5052 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys
22:40:08.0109 5052 swenum - ok
22:40:08.0140 5052 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys
22:40:08.0140 5052 swmidi - ok
22:40:08.0156 5052 SwOffScheduler - ok
22:40:08.0156 5052 SwOffWeb - ok
22:40:08.0171 5052 SwPrv - ok
22:40:08.0171 5052 symc810 - ok
22:40:08.0171 5052 symc8xx - ok
22:40:08.0203 5052 sym_hi - ok
22:40:08.0203 5052 sym_u3 - ok
22:40:08.0218 5052 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys
22:40:08.0218 5052 sysaudio - ok
22:40:08.0265 5052 [ CE06F01B88ACE199A1BF460CAC29C110 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe
22:40:08.0265 5052 SysmonLog - ok
22:40:08.0343 5052 [ C2546CD7A398476F9DF5614B2AE160E8 ] TapiSrv C:\WINDOWS\System32\tapisrv.dll
22:40:08.0375 5052 TapiSrv - ok
22:40:08.0453 5052 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys
22:40:08.0468 5052 Tcpip - ok
22:40:08.0500 5052 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys
22:40:08.0500 5052 TDPIPE - ok
22:40:08.0515 5052 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys
22:40:08.0515 5052 TDTCP - ok
22:40:08.0546 5052 [ 88155247177638048422893737429D9E ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys
22:40:08.0546 5052 TermDD - ok
22:40:08.0625 5052 [ A75DD6FC3DBEE4FFF5EBC9F2C28BB66E ] TermService C:\WINDOWS\System32\termsrv.dll
22:40:08.0625 5052 TermService - ok
22:40:08.0640 5052 [ EE9A2B9EA968A792A053C9D1A86BF870 ] Themes C:\WINDOWS\System32\shsvcs.dll
22:40:08.0656 5052 Themes - ok
22:40:08.0812 5052 [ 9C8C9D187D9A8960F89C38A2EC1A36A9 ] tizekdrv C:\Documents and Settings\Uzivatel\Data aplikací\TZAC\tizek32.sys
22:40:08.0828 5052 tizekdrv - ok
22:40:08.0875 5052 [ 5F048C5B946D5B03627CFCE23721E330 ] tizeqdrv C:\Documents and Settings\Uzivatel\Data aplikací\TZAC2\tizeq32.sys
22:40:08.0890 5052 tizeqdrv - ok
22:40:08.0890 5052 TosIde - ok
22:40:08.0953 5052 [ 38853304CCB938D30E0C4CDE8D2C2A8A ] TrkWks C:\WINDOWS\system32\trkwks.dll
22:40:08.0968 5052 TrkWks - ok
22:40:09.0015 5052 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys
22:40:09.0015 5052 Udfs - ok
22:40:09.0031 5052 ultra - ok
22:40:09.0109 5052 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update C:\WINDOWS\system32\DRIVERS\update.sys
22:40:09.0109 5052 Update - ok
22:40:09.0140 5052 [ 651BD90DCEE5B7BDC74A2EB7C9266F9E ] upnphost C:\WINDOWS\System32\upnphost.dll
22:40:09.0156 5052 upnphost - ok
22:40:09.0187 5052 [ 20A0F6A11959E92908717D09E87D670D ] UPS C:\WINDOWS\System32\ups.exe
22:40:09.0203 5052 UPS - ok
22:40:09.0234 5052 [ E919708DB44ED8543A7C017953148330 ] usbaudio C:\WINDOWS\system32\drivers\usbaudio.sys
22:40:09.0234 5052 usbaudio - ok
22:40:09.0234 5052 [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys
22:40:09.0234 5052 usbccgp - ok
22:40:09.0250 5052 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys
22:40:09.0250 5052 usbehci - ok
22:40:09.0265 5052 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys
22:40:09.0281 5052 usbhub - ok
22:40:09.0281 5052 [ 0DAECCE65366EA32B162F85F07C6753B ] usbohci C:\WINDOWS\system32\DRIVERS\usbohci.sys
22:40:09.0281 5052 usbohci - ok
22:40:09.0312 5052 [ A32426D9B14A089EAA1D922E0C5801A9 ] USBSTOR C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
22:40:09.0312 5052 USBSTOR - ok
22:40:09.0328 5052 [ 63BBFCA7F390F4C49ED4B96BFB1633E0 ] usbvideo C:\WINDOWS\system32\Drivers\usbvideo.sys
22:40:09.0328 5052 usbvideo - ok
22:40:09.0390 5052 [ 92CEBC2BC7BE2C8D49391B365569F306 ] vaxscsi C:\WINDOWS\System32\Drivers\vaxscsi.sys
22:40:09.0390 5052 vaxscsi - ok
22:40:09.0421 5052 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINDOWS\System32\drivers\vga.sys
22:40:09.0421 5052 VgaSave - ok
22:40:09.0421 5052 ViaIde - ok
22:40:09.0437 5052 [ 28A4B296B47782173C346E376CB374D1 ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys
22:40:09.0437 5052 VolSnap - ok
22:40:09.0515 5052 [ D6BA1A63D9E00933F1CD2A885573AFB2 ] VSS C:\WINDOWS\System32\vssvc.exe
22:40:09.0515 5052 VSS - ok
22:40:09.0515 5052 VX3000 - ok
22:40:09.0562 5052 [ FA4E1CDBA256787F2149F4AAD07BC91F ] W32Time C:\WINDOWS\system32\w32time.dll
22:40:09.0562 5052 W32Time - ok
22:40:09.0578 5052 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys
22:40:09.0578 5052 Wanarp - ok
22:40:09.0578 5052 WDICA - ok
22:40:09.0640 5052 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys
22:40:09.0640 5052 wdmaud - ok
22:40:09.0656 5052 [ 47AE51048A82DFA1CD6B51D369F7E169 ] WebClient C:\WINDOWS\System32\webclnt.dll
22:40:09.0656 5052 WebClient - ok
22:40:09.0765 5052 [ E488332126E3B1182D2B8A0C35408EC6 ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll
22:40:09.0781 5052 winmgmt - ok
22:40:09.0812 5052 [ C51B4A5C05A5475708E3C81C7765B71D ] WmdmPmSN C:\WINDOWS\system32\MsPMSNSv.dll
22:40:09.0812 5052 WmdmPmSN - ok
22:40:09.0859 5052 [ 23F6F03272F7E5679F1F050AED5ACEE6 ] WmiApSrv C:\WINDOWS\system32\wbem\wmiapsrv.exe
22:40:09.0859 5052 WmiApSrv - ok
22:40:10.0031 5052 [ 3739866D20ABD42F26A7B85F9E2560AF ] WMPNetworkSvc C:\Program Files\Windows Media Player\WMPNetwk.exe
22:40:10.0156 5052 WMPNetworkSvc - ok
22:40:10.0171 5052 [ CF4DEF1BF66F06964DC0D91844239104 ] WpdUsb C:\WINDOWS\system32\DRIVERS\wpdusb.sys
22:40:10.0171 5052 WpdUsb - ok
22:40:10.0312 5052 [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
22:40:10.0390 5052 WPFFontCache_v0400 - ok
22:40:10.0437 5052 [ 4C86D5FAF78194995AF9CC1075F65DD3 ] wscsvc C:\WINDOWS\system32\wscsvc.dll
22:40:10.0453 5052 wscsvc - ok
22:40:10.0484 5052 [ C98B39829C2BBD34E454150633C62C78 ] WSTCODEC C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
22:40:10.0484 5052 WSTCODEC - ok
22:40:10.0515 5052 [ C1364564800EE9784192145324A23308 ] wuauserv C:\WINDOWS\system32\wuauserv.dll
22:40:10.0515 5052 wuauserv - ok
22:40:10.0562 5052 [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf C:\WINDOWS\system32\DRIVERS\WudfPf.sys
22:40:10.0562 5052 WudfPf - ok
22:40:10.0593 5052 [ 28B524262BCE6DE1F7EF9F510BA3985B ] WudfRd C:\WINDOWS\system32\DRIVERS\wudfrd.sys
22:40:10.0593 5052 WudfRd - ok
22:40:10.0625 5052 [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc C:\WINDOWS\System32\WUDFSvc.dll
22:40:10.0625 5052 WudfSvc - ok
22:40:10.0718 5052 [ A27D4BA7264C0BF52F32D10405BEA1D4 ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll
22:40:10.0734 5052 WZCSVC - ok
22:40:10.0781 5052 [ EAA4BB9EDB3FB10CF8979FE65E63658F ] xmlprov C:\WINDOWS\System32\xmlprov.dll
22:40:10.0781 5052 xmlprov - ok
22:40:10.0781 5052 ================ Scan global ===============================
22:40:10.0828 5052 [ F36278E42C8C5DF03CE17DAC8231C91C ] C:\WINDOWS\system32\basesrv.dll
22:40:10.0890 5052 [ F3FA14A297BC687D0B51289D034033C9 ] C:\WINDOWS\system32\winsrv.dll
22:40:10.0937 5052 [ F3FA14A297BC687D0B51289D034033C9 ] C:\WINDOWS\system32\winsrv.dll
22:40:10.0984 5052 [ 9EF697AF07BB8DD82C3B02CA953A95B7 ] C:\WINDOWS\system32\services.exe
22:40:10.0984 5052 [Global] - ok
22:40:10.0984 5052 ================ Scan MBR ==================================
22:40:11.0015 5052 [ 413FC2A0C716421B3158746D63736515 ] \Device\Harddisk0\DR0
22:40:11.0203 5052 \Device\Harddisk0\DR0 - ok
22:40:11.0203 5052 ================ Scan VBR ==================================
22:40:11.0218 5052 [ 48375F4637C4312C9188233CEAA22CB7 ] \Device\Harddisk0\DR0\Partition1
22:40:11.0218 5052 \Device\Harddisk0\DR0\Partition1 - ok
22:40:11.0234 5052 [ 1A530FC46FEFD1FFFFFA5BEFB9413C55 ] \Device\Harddisk0\DR0\Partition2
22:40:11.0234 5052 \Device\Harddisk0\DR0\Partition2 - ok
22:40:11.0234 5052 ============================================================
22:40:11.0234 5052 Scan finished
22:40:11.0234 5052 ============================================================
22:40:11.0250 4668 Detected object count: 0
22:40:11.0250 4668 Actual detected object count: 0
22:40:47.0875 6016 Deinitialize success

ComboFix 12-12-04.01 - Uzivatel 04.12.2012 22:57:45.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.2046.1281 [GMT 1:00]
Spuštěný z: c:\documents and settings\Uzivatel\Plocha\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Uzivatel\WINDOWS
c:\windows\system32\SET4DF.tmp
c:\windows\system32\SET4E4.tmp
c:\windows\system32\SET4EB.tmp
c:\windows\system32\SET532.tmp
c:\windows\system32\tmp1D3.tmp
c:\windows\system32\tmpA61.tmp
c:\windows\system32\tmpA62.tmp
c:\windows\TEMP\logishrd\LVPrcInj01.dll
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-11-04 do 2012-12-04 )))))))))))))))))))))))))))))))
.
.
2012-12-04 18:56 . 2012-12-04 18:56 -------- d-----w- c:\documents and settings\Uzivatel\Data aplikací\Malwarebytes
2012-12-04 18:54 . 2012-12-04 18:54 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2012-12-04 18:54 . 2012-12-04 18:54 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-12-04 18:54 . 2012-09-29 18:54 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-12-04 15:25 . 2012-11-08 18:00 6812136 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{961C029F-6B93-422F-BDB7-4B36BF8990A0}\mpengine.dll
2012-12-03 16:45 . 2012-12-03 16:45 388096 ----a-r- c:\documents and settings\Uzivatel\Data aplikací\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2012-12-03 16:45 . 2012-12-03 16:45 -------- d-----w- c:\program files\Trend Micro
2012-12-03 14:06 . 2012-11-08 18:00 6812136 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-11-29 21:20 . 2012-11-29 21:20 -------- d-----w- c:\program files\NuGardt Software
2012-11-22 17:19 . 2012-11-22 17:19 -------- d-----w- c:\program files\Common Files\Skype
2012-11-22 09:34 . 2012-11-22 09:34 5885632 ----a-w- c:\program files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components\SkypeFfComponent.dll
2012-11-06 16:13 . 2012-11-06 16:13 -------- d-----w- c:\program files\TZAC2
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-12-04 22:06 . 2010-01-10 18:06 24944 ----a-w- c:\windows\system32\drivers\GVTDrv.sys
2012-12-04 22:06 . 2008-03-13 07:12 17488 ----a-w- c:\windows\gdrv.sys
2012-12-04 20:29 . 2008-05-11 18:48 137464 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2012-12-04 20:28 . 2009-03-03 14:58 214520 ----a-w- c:\windows\system32\PnkBstrB.xtr
2012-12-04 20:28 . 2008-05-11 18:48 214520 ----a-w- c:\windows\system32\PnkBstrB.exe
2012-11-29 14:55 . 2008-03-19 20:42 466008 ----a-w- c:\windows\system32\drivers\sptd.sys
2012-10-24 04:27 . 2012-10-24 04:27 42440 ----a-w- c:\windows\system32\xfcodec.dll
2012-10-22 19:57 . 2006-03-02 12:00 1866368 ------w- c:\windows\system32\win32k.sys
2012-10-09 19:42 . 2012-04-16 13:59 696760 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-10-09 19:42 . 2011-05-21 09:18 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-10-02 18:04 . 2006-03-02 12:00 58368 ------w- c:\windows\system32\synceng.dll
2012-09-24 13:32 . 2012-06-18 14:35 477168 ----a-w- c:\windows\system32\npdeployJava1.dll
2012-09-24 13:32 . 2010-04-18 13:37 473072 ----a-w- c:\windows\system32\deployJava1.dll
2012-09-24 11:51 . 2012-06-18 14:35 73728 ----a-w- c:\windows\system32\javacpl.cpl
2012-09-10 11:43 . 2010-01-10 18:07 17488 ----a-w- c:\windows\etdrv.sys
2011-11-26 16:22 . 2011-08-31 19:49 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2008-01-22 152872]
"OscarEditor"="c:\program files\OSCAR Editor X7\OscarEditor.exe" [2010-07-22 2636800]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2007-09-03 16841216]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"VX3000"="c:\windows\vVX3000.exe" [2009-04-10 721936]
"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2008-08-14 565008]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2008-08-14 2407184]
"EasyTuneVI"="c:\program files\GIGABYTE\ET6\ETcall.exe" [2007-07-26 20480]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-08-27 59280]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-12 947176]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-09-17 254896]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-09-09 421776]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
.
c:\documents and settings\Uzivatel\Nabídka Start\Programy\Po spuštění\
Xfire.lnk - c:\program files\Xfire\Xfire.exe [2012-10-24 3558856]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
Corel MEDIA FOLDERS INDEXER 8.LNK - c:\corel\Graphics8\Programs\MFIndexer.exe [2008-5-5 83456]
GamePark klient 2.lnk - c:\program files\Activision\Call of Duty 2\GamePark\GamePark2\gpcl.exe [2012-3-26 409088]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2009-5-4 66864]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe"=
"c:\\Program Files\\HLSW\\hlsw.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\Studio.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\umi.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=
"c:\\Program Files\\Xfire\\Xfire.exe"=
"c:\\Program Files\\ICQ7.4\\ICQ.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R0 sptd;sptd;\SystemRoot\\SystemRoot\System32\Drivers\sptd.sys --> \SystemRoot\\SystemRoot\System32\Drivers\sptd.sys [?]
R2 Skype C2C Service;Skype C2C Service;c:\documents and settings\All Users\Data aplikací\Skype\Toolbars\Skype C2C Service\c2c_service.exe [22.11.2012 10:29 3290304]
R3 AODDriver;AODDriver;c:\program files\GIGABYTE\ET6\i386\AODDriver.sys [23.2.2009 0:16 7168]
R3 pcouffin;VSO Software pcouffin;c:\windows\system32\drivers\pcouffin.sys [13.3.2008 17:22 47360]
S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [9.11.2012 11:21 160944]
S2 SwOffScheduler;Airytec Switch Off - Task Scheduler;c:\program files\Airytec\Switch Off\swoff.exe -service --> c:\program files\Airytec\Switch Off\swoff.exe -service [?]
S2 SwOffWeb;Airytec Switch Off - Web Interface;c:\program files\Airytec\Switch Off\swoff.exe -service --> c:\program files\Airytec\Switch Off\swoff.exe -service [?]
S3 etdrv;etdrv;c:\windows\etdrv.sys [10.1.2010 19:07 17488]
S3 tizekdrv;tizekdrv;c:\documents and settings\Uzivatel\Data aplikací\TZAC\tizek32.sys [24.9.2011 11:56 190976]
S3 tizeqdrv;tizeqdrv;c:\documents and settings\Uzivatel\Data aplikací\TZAC2\tizeq32.sys [5.5.2012 11:22 134328]
S3 vaxscsi;vaxscsi;c:\windows\system32\drivers\vaxscsi.sys [22.4.2008 20:53 223128]
SUnknown GVTDrv;GVTDrv; [x]
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - WS2IFSL
.
Obsah adresáře 'Naplánované úlohy'
.
2012-12-04 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-16 19:42]
.
2012-12-01 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 15:57]
.
.
------- Doplňkový sken -------
.
uStart Page = About:Blank
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - c:\program files\ICQ7.4\ICQ.exe
TCP: DhcpNameServer = 192.168.2.1
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
FF - ProfilePath - c:\documents and settings\Uzivatel\Data aplikací\Mozilla\Firefox\Profiles\4qm4l62b.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=green ... =937811&p=
FF - ExtSQL: 2012-10-21 11:59; {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}; c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
FF - ExtSQL: !HIDDEN! 2009-03-12 16:41; {800b5000-a755-47e1-992b-48a1c1357f07}; c:\program files\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
FF - ExtSQL: !HIDDEN! 2009-08-16 02:39; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
WebBrowser-{ECDEE021-0D17-467F-A1FF-C7A115230949} - (no file)
HKCU-Run-EA Core - c:\program files\Electronic Arts\EADM\Core.exe
HKCU-Run-ICQ - c:\program files\ICQ7.2\ICQ.exe
AddRemove-FreePascal_is1 - c:\fpc\2.4.4\unins000.exe
AddRemove-Totalcmd - c:\totalcmd\tcuninst.exe
AddRemove-{121F184B-05AD-43F1-9F20-6075B9E6DFCA}_is1 - c:\program files\HYL\MountBlueKlient\unins000.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-12-04 23:06
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
.
c:\windows\system32\GVTunner.ref 4 bytes
.
sken byl úspešně dokončen
skryté soubory: 1
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(776)
c:\windows\system32\Ati2evxx.dll
.
- - - - - - - > 'explorer.exe'(11580)
c:\program files\OSCAR Editor X7\DLL\DLL_Wheel4D.dll
c:\windows\system32\WPDShServiceObj.dll
c:\corel\Graphics8\programs\CMFFld80.dll
c:\windows\system32\msi.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\windows\RTHDCPL.EXE
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
c:\windows\system32\wscntfy.exe
c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Common Files\Logishrd\LQCVFX\COCIManager.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
.
**************************************************************************
.
Celkový čas: 2012-12-04 23:16:50 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-12-04 22:16
.
Před spuštěním: Volných bajtů: 37 929 914 368
Po spuštění: Volných bajtů: 38 267 412 480
.
WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect /usepmtimer
.
- - End Of File - - 639D3B465FC376CBC37AFC8AD03C09B1

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:



Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

Upozornění : Může se stát, že po aplikaci Combofixu a restartu počítače, Windows nenaběhnou , nebo nenajede plocha , budou problémy s připojením, pak znovu restartuj počítač, pokud to nepomůže , po restartu mačkej klávesu F8 a pak zvol poslední známou funkční konfiguraci. , či použij bod obnovy.

Stáhni si aswMBR
na svojí plochu. Uzavři všechna okna , programy a prohlížeče. Poklepej na aswMBR.exe. Pokud se objeví hláška o možnosti stáhnutí databáze Avastu , klikni na NE. Poté klikni na „Scan“ . Po skenu klikni na „Save Log“ a ulož si log na plochu .Zkopíruj sem celý obsah toho logu. Pak klikni na „Exit“ k zavření programu.

ComboFix 12-12-04.01 - Uzivatel 05.12.2012 16:05:44.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.2046.1227 [GMT 1:00]
Spuštěný z: c:\documents and settings\Uzivatel\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Uzivatel\Plocha\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Skype\Updater
c:\program files\Skype\Updater\Updater.dll
c:\program files\Skype\Updater\Updater.exe
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_SKYPEUPDATE
-------\Legacy_SPTD
-------\Legacy_SWOFFSCHEDULER
-------\Legacy_SWOFFWEB
-------\Service_SkypeUpdate
-------\Service_sptd
-------\Service_SwOffScheduler
-------\Service_SwOffWeb
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-11-05 do 2012-12-05 )))))))))))))))))))))))))))))))
.
.
2012-12-05 14:35 . 2012-12-05 14:35 29904 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{4D5A3A64-9814-4889-A8B0-A95F50358DFD}\MpKsl748dfbd7.sys
2012-12-04 22:22 . 2012-11-08 18:00 6812136 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{4D5A3A64-9814-4889-A8B0-A95F50358DFD}\mpengine.dll
2012-12-04 18:56 . 2012-12-04 18:56 -------- d-----w- c:\documents and settings\Uzivatel\Data aplikací\Malwarebytes
2012-12-04 18:54 . 2012-12-04 18:54 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2012-12-04 18:54 . 2012-12-04 18:54 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-12-04 18:54 . 2012-09-29 18:54 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-12-03 16:45 . 2012-12-03 16:45 388096 ----a-r- c:\documents and settings\Uzivatel\Data aplikací\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2012-12-03 16:45 . 2012-12-03 16:45 -------- d-----w- c:\program files\Trend Micro
2012-12-03 14:06 . 2012-11-08 18:00 6812136 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-11-29 21:20 . 2012-11-29 21:20 -------- d-----w- c:\program files\NuGardt Software
2012-11-22 17:19 . 2012-11-22 17:19 -------- d-----w- c:\program files\Common Files\Skype
2012-11-22 09:34 . 2012-11-22 09:34 5885632 ----a-w- c:\program files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components\SkypeFfComponent.dll
2012-11-06 16:13 . 2012-11-06 16:13 -------- d-----w- c:\program files\TZAC2
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-12-05 15:15 . 2010-01-10 18:06 24944 ----a-w- c:\windows\system32\drivers\GVTDrv.sys
2012-12-05 15:15 . 2008-03-13 07:12 17488 ----a-w- c:\windows\gdrv.sys
2012-12-04 20:29 . 2008-05-11 18:48 137464 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2012-12-04 20:28 . 2009-03-03 14:58 214520 ----a-w- c:\windows\system32\PnkBstrB.xtr
2012-12-04 20:28 . 2008-05-11 18:48 214520 ----a-w- c:\windows\system32\PnkBstrB.exe
2012-11-29 14:55 . 2008-03-19 20:42 466008 ----a-w- c:\windows\system32\drivers\sptd.sys
2012-10-24 04:27 . 2012-10-24 04:27 42440 ----a-w- c:\windows\system32\xfcodec.dll
2012-10-22 19:57 . 2006-03-02 12:00 1866368 ------w- c:\windows\system32\win32k.sys
2012-10-09 19:42 . 2012-04-16 13:59 696760 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-10-09 19:42 . 2011-05-21 09:18 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-10-02 18:04 . 2006-03-02 12:00 58368 ------w- c:\windows\system32\synceng.dll
2012-09-24 13:32 . 2012-06-18 14:35 477168 ----a-w- c:\windows\system32\npdeployJava1.dll
2012-09-24 13:32 . 2010-04-18 13:37 473072 ----a-w- c:\windows\system32\deployJava1.dll
2012-09-24 11:51 . 2012-06-18 14:35 73728 ----a-w- c:\windows\system32\javacpl.cpl
2012-09-10 11:43 . 2010-01-10 18:07 17488 ----a-w- c:\windows\etdrv.sys
2011-11-26 16:22 . 2011-08-31 19:49 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2008-01-22 152872]
"OscarEditor"="c:\program files\OSCAR Editor X7\OscarEditor.exe" [2010-07-22 2636800]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2007-09-03 16841216]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"VX3000"="c:\windows\vVX3000.exe" [2009-04-10 721936]
"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2008-08-14 565008]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2008-08-14 2407184]
"EasyTuneVI"="c:\program files\GIGABYTE\ET6\ETcall.exe" [2007-07-26 20480]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-08-27 59280]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-12 947176]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-09-17 254896]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-09-09 421776]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
.
c:\documents and settings\Uzivatel\Nabídka Start\Programy\Po spuštění\
Xfire.lnk - c:\program files\Xfire\Xfire.exe [2012-10-24 3558856]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
Corel MEDIA FOLDERS INDEXER 8.LNK - c:\corel\Graphics8\Programs\MFIndexer.exe [2008-5-5 83456]
GamePark klient 2.lnk - c:\program files\Activision\Call of Duty 2\GamePark\GamePark2\gpcl.exe [2012-3-26 409088]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2009-5-4 66864]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe"=
"c:\\Program Files\\HLSW\\hlsw.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\Studio.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\umi.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=
"c:\\Program Files\\Xfire\\Xfire.exe"=
"c:\\Program Files\\ICQ7.4\\ICQ.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R1 MpKsl748dfbd7;MpKsl748dfbd7;c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{4D5A3A64-9814-4889-A8B0-A95F50358DFD}\MpKsl748dfbd7.sys [5.12.2012 15:35 29904]
R2 Skype C2C Service;Skype C2C Service;c:\documents and settings\All Users\Data aplikací\Skype\Toolbars\Skype C2C Service\c2c_service.exe [22.11.2012 10:29 3290304]
R3 AODDriver;AODDriver;c:\program files\GIGABYTE\ET6\i386\AODDriver.sys [23.2.2009 0:16 7168]
R3 pcouffin;VSO Software pcouffin;c:\windows\system32\drivers\pcouffin.sys [13.3.2008 17:22 47360]
S3 etdrv;etdrv;c:\windows\etdrv.sys [10.1.2010 19:07 17488]
S3 tizekdrv;tizekdrv;c:\documents and settings\Uzivatel\Data aplikací\TZAC\tizek32.sys [24.9.2011 11:56 190976]
S3 tizeqdrv;tizeqdrv;c:\documents and settings\Uzivatel\Data aplikací\TZAC2\tizeq32.sys [5.5.2012 11:22 134328]
S3 vaxscsi;vaxscsi;c:\windows\system32\drivers\vaxscsi.sys [22.4.2008 20:53 223128]
SUnknown GVTDrv;GVTDrv; [x]
.
Obsah adresáře 'Naplánované úlohy'
.
2012-12-05 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-16 19:42]
.
2012-12-01 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 15:57]
.
.
------- Doplňkový sken -------
.
uStart Page = About:Blank
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - c:\program files\ICQ7.4\ICQ.exe
TCP: DhcpNameServer = 192.168.2.1
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
FF - ProfilePath - c:\documents and settings\Uzivatel\Data aplikací\Mozilla\Firefox\Profiles\4qm4l62b.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=green ... =937811&p=
FF - ExtSQL: 2012-10-21 11:59; {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}; c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
FF - ExtSQL: !HIDDEN! 2009-03-12 16:41; {800b5000-a755-47e1-992b-48a1c1357f07}; c:\program files\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
FF - ExtSQL: !HIDDEN! 2009-08-16 02:39; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-12-05 16:15
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
.
c:\windows\system32\GVTunner.ref 4 bytes
.
sken byl úspešně dokončen
skryté soubory: 1
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(764)
c:\windows\system32\Ati2evxx.dll
.
- - - - - - - > 'explorer.exe'(9776)
c:\windows\TEMP\logishrd\LVPrcInj01.dll
c:\program files\OSCAR Editor X7\DLL\DLL_Wheel4D.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\msi.dll
c:\corel\Graphics8\programs\CMFFld80.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\wscntfy.exe
c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
c:\windows\RTHDCPL.EXE
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Common Files\Logishrd\LQCVFX\COCIManager.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
.
**************************************************************************
.
Celkový čas: 2012-12-05 16:22:24 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-12-05 15:22
ComboFix2.txt 2012-12-04 22:16
.
Před spuštěním: Volných bajtů: 38 249 832 448
Po spuštění: Volných bajtů: 38 186 258 432
.
- - End Of File - - BC1ADAF46127C8AF8906B7D161B74B30