Prosím o pomoc

[screenname]

Nevím, jak se to stalo, ale celkem znenadání se mi zpomalyl výkon počítače na nulu. Když ale pustím procesy, tak ani jedno jádro neběží víc než na 10%. Prosím o kontrolu logu.


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:10:53, on 23.4.2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v8.00 (8.00.7601.17514)
Boot mode: Normal

Running processes:
C:\Windows\System32\spool\drivers\x64\3\CNAP2LAK.EXE
C:\Users\Jirka.Jirka-PC\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Users\Jirka.Jirka-PC\AppData\Local\Google\Update\1.3.21.111\GoogleCrashHandler.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files (x86)\Contour Shuttle\ShuttleHelper.exe
C:\Users\Jirka.Jirka-PC\AppData\Local\Akamai\netsession_win.exe
C:\Users\Jirka.Jirka-PC\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Jirka.Jirka-PC\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Jirka.Jirka-PC\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Jirka.Jirka-PC\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Users\Jirka.Jirka-PC\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Jirka.Jirka-PC\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Jirka.Jirka-PC\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Jirka.Jirka-PC\Downloads\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://companyweb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://companyweb
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1:9421;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O1 - Hosts: ::1 localhost127.0.0.1 artisteer.com
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe_ID0ENQBO] C:\PROGRA~2\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [AdobeCS5.5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [Contour Shuttle Device Helper] C:\Program Files (x86)\Contour Shuttle\ShuttleHelper.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [Akamai NetSession Interface] "C:\Users\Jirka.Jirka-PC\AppData\Local\Akamai\netsession_win.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Users\Jirka.Jirka-PC\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - Global Startup: Canon LBP2900 Status Window.lnk = C:\Windows\System32\spool\drivers\x64\3\CNAB4LAD.EXE
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~1\MICROS~1\Office14\ONBttnIE.dll/105
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = fibox.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = fibox.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = fibox.local
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = fibox.local
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe Version Cue CS4 - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Ati External Event Utility - Unknown owner - C:\Windows\system32\Ati2evxx.exe (file missing)
O23 - Service: Dragon Age: Origins - Content Updater (DAUpdaterSvc) - BioWare - H:\Games\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe
O23 - Service: Device Error Recovery Service (dgdersvc) - Devguru Co., Ltd. - C:\Windows\system32\dgdersvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: FLEXnet Licensing Service 64 - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: mental ray 3.7 Satellite for Autodesk 3ds Max 2010 64-bit 64-bit (mi-raysat_3dsmax2010_64) - Unknown owner - D:\Program Files\Autodesk\3ds Max 2010\mentalray\satellite\raysat_3dsmax2010_64server.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe (file missing)
O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Contour Shuttle Device Engine (ShuttleEngine) - Contour Design, Inc. - C:\Program Files (x86)\Contour Shuttle\ShuttleEngine.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: SQL Server VSS Writer (SQLWriter) - Unknown owner - c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (file missing)
O23 - Service: Audio Service (STacSV) - IDT, Inc. - c:\program files\idt\wdm\STacSV64.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 12413 bytes

[Reklama]

[jaro3]

Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:
Návod

Kód: Vybrat vše

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://companyweb
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://companyweb
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1:9421;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O1 - Hosts: ::1 localhost127.0.0.1 artisteer.com
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Users\Jirka.Jirka-PC\AppData\Local\Google\Update\GoogleUpdate.exe" /c


O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = fibox.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = fibox.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = fibox.local
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = fibox.local
Pokud to neznáš ,. taky fix.

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected. Poté klikni na Main (hlavní stránku ) a klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

Pokud budou problémy , spusť v nouz. režimu.

[screenname]

Díky. V Jackovi jsem smazal všechny věci, kromě prvních dvou, protože to je místní nástěnka ve firemní síti.

A tady je log z Malwarebytes:
Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Verze databáze: v2012.04.23.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 8.0.7601.17514
Jirka :: JIRKA-PC [administrátor]

23.4.2012 20:52:08
mbam-log-2012-04-23 (21-03-43).txt

Typ: Rychlá kontrola
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 327950
Uplynulý čas: 11 minut, 13 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené soubory: 2
c:\windows\system32\drivers\etc\keygen.exe (Malware.Packer.Gen) -> Žádná instrukce nebyla provedena.
C:\Users\Jirka.Jirka-PC\Downloads\GotClip_Setup.exe (PUP.Adware.Gotclip.ScamLotto) -> Žádná instrukce nebyla provedena.

[screenname]

Ještě bych se chtěl prosím zeptat jestli jde nějak vrátit (povolit) zpátky smazání O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" v hijackthis? nejde spustit aplikace Adobe Premiere. Nebo je nutný reinstall?

[Žbeky]

Toto spolu nijak nesouvisí. Zkus jen restartovat pc

[screenname]

Děkuji moc! Vypadá to, že je to rychlejší, ale pořád se to trochu zasekává.. A procesor i paměť se pořád tváří jako nevytížené při těch zásecích

[Žbeky]

Znovu spusť MbAM a dej Scan
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Show Results
- ujistit se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Remove Selected
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Exit

Vypni rezidentní štít antiviru a antispywaru
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Pokud bude po kontrole problém spustit aplikace nebo bude vyskakovat hláška o pokusu použít neplatnou operaci na klíč registru, který je označen pro odstranění, stačí restartovat počítač.

[screenname]

V MbAMu jsem to bohužel už smazal ale log jsem zapoměl zkopírovat, snad to moc nevadí.. Tady je log z ComboFixu:


ComboFix 12-04-23.02 - Jirka 23.04.2012 22:29:10.1.4 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.4085.2545 [GMT 2:00]
Spuštěný z: c:\users\Jirka.Jirka-PC\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Jirka.Jirka-PC\Documents\~WRL0003.tmp
c:\users\Jirka\AppData\Local\assembly\tmp
c:\users\Jirka\AppData\Local\lame_enc.dll
c:\users\Jirka\AppData\Local\no23xwrapper.dll
c:\users\Jirka\AppData\Local\ogg.dll
c:\users\Jirka\AppData\Local\vorbis.dll
c:\users\Jirka\AppData\Local\vorbisenc.dll
c:\users\Jirka\AppData\Local\vorbisfile.dll
G:\install.exe
H:\install.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-03-23 do 2012-04-23 )))))))))))))))))))))))))))))))
.
.
2012-04-23 20:43 . 2012-04-23 20:43 -------- d-----w- c:\users\Jirka\AppData\Local\temp
2012-04-23 20:43 . 2012-04-23 20:43 -------- d-----w- c:\users\Jirka.000\AppData\Local\temp
2012-04-23 20:43 . 2012-04-23 20:43 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-04-23 20:42 . 2012-04-23 20:42 -------- d-----w- c:\users\Hana\AppData\Local\temp
2012-04-23 20:42 . 2012-04-23 20:42 -------- d-----w- c:\users\Franta\AppData\Local\temp
2012-04-23 20:42 . 2012-04-23 20:42 -------- d-----w- c:\users\Bara\AppData\Local\temp
2012-04-23 20:42 . 2012-04-23 20:42 -------- d-----w- c:\users\Bara.FIBOX\AppData\Local\temp
2012-04-23 14:57 . 2012-04-23 14:57 -------- d-----w- c:\program files (x86)\ESET
2012-04-23 14:56 . 2012-04-23 14:56 -------- d-----w- c:\program files (x86)\Common Files\Java
2012-04-23 14:45 . 2012-04-13 08:46 8917360 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B50419F0-D9B2-4B58-9E47-87B18F2D6062}\mpengine.dll
2012-04-22 14:37 . 2012-04-22 14:41 -------- d-----w- c:\program files (x86)\Microsoft Games for Windows - LIVE
2012-04-22 14:37 . 2012-04-22 14:37 -------- d-----w- c:\windows\SysWow64\xlive
2012-04-22 11:20 . 2012-04-22 11:20 -------- d-----w- c:\users\Jirka.Jirka-PC\AppData\Roaming\HDRsoft
2012-04-16 11:29 . 2012-04-16 11:29 -------- d-----w- c:\programdata\BioWare
2012-04-16 11:08 . 2012-04-16 11:08 -------- d-----w- c:\windows\1C4551A64743409391E41477CD655043.TMP
2012-04-16 11:08 . 2012-04-16 11:08 -------- d-----w- c:\programdata\Media Center Programs
2012-04-16 10:55 . 2012-04-16 11:08 -------- d-----w- c:\program files (x86)\Common Files\BioWare
2012-04-10 19:39 . 2012-04-10 19:39 -------- d-----w- c:\users\Jirka.Jirka-PC\AppData\Local\Windows Live
2012-04-10 19:39 . 2012-04-10 19:39 -------- d-----w- c:\program files (x86)\Common Files\Windows Live
2012-04-10 18:26 . 2012-04-10 20:14 -------- d-----w- c:\users\Jirka.Jirka-PC\AppData\Local\WMTools Downloaded Files
2012-04-10 06:19 . 2012-04-23 14:58 -------- d-----w- c:\programdata\RegCure
2012-04-07 14:33 . 2012-04-07 14:33 -------- d-----w- c:\programdata\EA Core
2012-04-07 14:33 . 2012-04-07 14:33 -------- d-----w- c:\programdata\Electronic Arts
2012-04-07 14:33 . 2012-04-07 14:33 -------- d-----w- c:\programdata\EA Logs
2012-04-06 09:08 . 2006-11-01 10:05 154424 ----a-w- C:\ChVID.exe
2012-04-04 21:57 . 2012-04-04 21:59 -------- d-----w- c:\users\Jirka.Jirka-PC\AppData\Roaming\GetRightToGo
2012-03-26 13:17 . 2012-03-26 13:16 750488 ----a-w- c:\windows\system32\npdeployJava1.dll
2012-03-26 13:17 . 2012-03-26 13:16 660368 ----a-w- c:\windows\system32\deployJava1.dll
2012-03-26 13:16 . 2012-03-26 13:16 -------- d-----w- c:\program files\Java
2012-03-26 13:13 . 2012-03-26 13:13 -------- d-----w- c:\users\Jirka.Jirka-PC\AppData\Roaming\.minecraft
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-04-23 14:50 . 2011-01-16 11:34 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll
2012-04-13 08:46 . 2011-06-30 07:12 8917360 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-04-04 13:56 . 2011-06-05 11:32 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-03-14 06:12 . 2010-09-08 16:07 2379552 ----a-w- c:\programdata\Microsoft\VisualStudio\10.0\1033\ResourceCache.dll
2012-03-12 21:25 . 2011-08-14 10:06 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-02-15 04:46 . 2012-03-15 13:34 23552 ----a-w- c:\windows\system32\drivers\tdtcp.sys
2012-02-10 13:42 . 2012-02-10 13:42 927800 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{82BA21DF-58C5-4F17-A46D-52CEA483E1D0}\gapaengine.dll
2012-01-31 12:44 . 2010-09-06 14:53 279656 ------w- c:\windows\system32\MpSigStub.exe
2012-01-25 06:27 . 2012-03-15 13:35 76288 ----a-w- c:\windows\system32\rdpwsx.dll
2012-01-25 06:27 . 2012-03-15 13:35 149504 ----a-w- c:\windows\system32\rdpcorekmts.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Akamai NetSession Interface"="c:\users\Jirka.Jirka-PC\AppData\Local\Akamai\netsession_win.exe" [2012-03-13 3331872]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AdobeCS4ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"AdobeCS5.5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]
"AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-07-22 402432]
"Contour Shuttle Device Helper"="c:\program files (x86)\Contour Shuttle\ShuttleHelper.exe" [2009-07-23 118784]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-02-10 61440]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"Malwarebytes' Anti-Malware"="d:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Canon LBP2900 Status Window.lnk - c:\windows\System32\spool\drivers\x64\3\CNAB4LAD.EXE [2010-9-23 60384]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Služba Google Update (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-11-28 136176]
R3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [2008-08-15 284016]
R3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;h:\games\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe [2009-07-26 25832]
R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2010-09-29 1038088]
R3 GGSAFERDriver;GGSAFER Driver;c:\program files (x86)\Garena Plus\Room\safedrv.sys [x]
R3 gupdatem;Služba Google Update (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-11-28 136176]
R3 mi-raysat_3dsmax2010_64;mental ray 3.7 Satellite for Autodesk 3ds Max 2010 64-bit 64-bit;d:\program files\Autodesk\3ds Max 2010\mentalray\satellite\raysat_3dsmax2010_64server.exe [2009-03-12 86016]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 51740536]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 282616]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\DRIVERS\ss_bbus.sys [x]
R3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\DRIVERS\ss_bmdfl.sys [x]
R3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\DRIVERS\ss_bmdm.sys [x]
R3 ss_bserd;SAMSUNG USB Mobile Logging Driver;c:\windows\system32\DRIVERS\ss_bserd.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TFsExDisk;TFsExDisk;c:\windows\System32\Drivers\TFsExDisk.sys [2010-09-15 16392]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [x]
R4 RsFx0105;RsFx0105 Driver;c:\windows\system32\DRIVERS\RsFx0105.sys [x]
R4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 27136]
S2 dgdersvc;Device Error Recovery Service;c:\windows\system32\dgdersvc.exe [2010-09-15 119632]
S2 MBAMService;MBAMService;d:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408]
S3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [2010-09-15 20552]
S3 e1yexpress;Ovladač gigabitových síťových připojení Intel(R);c:\windows\system32\DRIVERS\e1y60x64.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 wbondir;Winbond CIR Transceiver;c:\windows\system32\DRIVERS\wbondir.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
iissvcs REG_MULTI_SZ w3svc was
apphost REG_MULTI_SZ apphostsvc
.
Obsah adresáře 'Naplánované úlohy'
.
2012-04-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-11-28 12:11]
.
2012-04-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-11-28 12:11]
.
2010-10-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3351475916-1720942700-161379336-1148Core.job
- c:\users\Jirka\AppData\Local\Google\Update\GoogleUpdate.exe [2010-09-06 14:41]
.
2012-03-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3545919743-1017386175-2234930996-1157Core1cd09cce3064402.job
- c:\users\Jirka.Jirka-PC\AppData\Local\Google\Update\GoogleUpdate.exe [2010-11-29 12:11]
.
2012-04-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-448369136-326095957-3992491985-1000Core.job
- c:\users\Jirka\AppData\Local\Google\Update\GoogleUpdate.exe [2010-09-06 14:41]
.
2012-04-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-448369136-326095957-3992491985-1000UA.job
- c:\users\Jirka\AppData\Local\Google\Update\GoogleUpdate.exe [2010-09-06 14:41]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-03-15 499608]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 112512]
"CNAP2 Launcher"="c:\windows\system32\spool\DRIVERS\x64\3\CNAP2LAK.EXE" [2007-09-05 406944]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 1436224]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://companyweb
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <local>
IE: Append Link Target to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~1\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~1\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 10.0.0.100
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Wow6432Node-HKCU-Run-AdobeBridge - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKLM-Run-SysTrayApp - c:\program files (x86)\IDT\WDM\sttray64.exe
AddRemove-Mafia Game - c:\windows\system32\MafiaSetup.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\services\Akamai]
"ServiceDll"="c:\program files (x86)\common files\akamai/netsession_win_6c825ce.dll"
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\services\MySQL]
"ImagePath"="\"c:\program files\MySQL\MySQL Server 5.1\bin\mysqld\" --defaults-file=\"c:\program files\MySQL\MySQL Server 5.1\my.ini\" MySQL"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-3545919743-1017386175-2234930996-1157\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{1522A09C-7AEA-18AD-7205-E9B69E750664}*]
"dalhkbel"=hex:64,62,67,69,64,68,6e,6e,68,67,61,70,70,69,67,63,6b,6f,66,68,66,
6e,69,6d,70,64,6f,6f,69,6f,67,63,61,6b,70,67,65,66,70,6e,00,3c
.
[HKEY_USERS\S-1-5-21-3545919743-1017386175-2234930996-1157\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{405F331F-14B6-541B-9195-D64EA2C8689B}*]
@Allowed: (Read) (RestrictedCode)
"ialfalfdcdobpmmefb"=hex:6a,61,6c,69,67,70,6f,62,6d,6c,67,65,64,6b,70,66,67,62,
68,6f,00,f7
"habggmoibpinlflp"=hex:6a,61,6c,69,67,70,6f,62,6d,6c,67,65,64,6b,70,66,67,62,
68,6f,00,00
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11g_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11g_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11g.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11g.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11g.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11g.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files (x86)\Contour Shuttle\ShuttleEngine.exe
c:\program files (x86)\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
.
Celkový čas: 2012-04-23 23:06:35 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-04-23 21:06
.
Před spuštěním: Volných bajtů: 26 973 638 656
Po spuštění: Volných bajtů: 36 751 765 504
.
- - End Of File - - 48BDAF0253573BF4EE449827DE756A17

[jaro3]

Pokud nepoužíváš , odinstaluj:
Akamai NetSession Interface

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:

Kód: Vybrat vše

KillAll::
File::
c:\program files (x86)\Google\Update\GoogleUpdate.exe
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3351475916-1720942700-161379336-1148Core.job
c:\users\Jirka\AppData\Local\Google\Update\GoogleUpdate.exe
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3545919743-1017386175-2234930996-1157Core1cd09cce3064402.job
c:\users\Jirka.Jirka-PC\AppData\Local\Google\Update\GoogleUpdate.exe
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-448369136-326095957-3992491985-1000Core.job
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-448369136-326095957-3992491985-1000UA.job

Folder::
c:\program files (x86)\ESET
c:\windows\1C4551A64743409391E41477CD655043.TMP

Driver::
gupdate
gupdatem

DDS::
uInternet Settings,ProxyOverride = <local>

RegNull::
[HKEY_USERS\S-1-5-21-3545919743-1017386175-2234930996-1157\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{1522A09C-7AEA-18AD-7205-E9B69E750664}*]
[HKEY_USERS\S-1-5-21-3545919743-1017386175-2234930996-1157\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{405F331F-14B6-541B-9195-D64EA2C8689B}*]
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

RegLock::
[HKEY_USERS\S-1-5-21-3545919743-1017386175-2234930996-1157\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{1522A09C-7AEA-18AD-7205-E9B69E750664}*]
[HKEY_USERS\S-1-5-21-3545919743-1017386175-2234930996-1157\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{405F331F-14B6-541B-9195-D64EA2C8689B}*]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\PCW\Security]


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

Upozornění : Může se stát, že po aplikaci Combofixu a restartu počítače, Windows nenaběhnou , nebo nenajede plocha , budou problémy s připojením, pak znovu restartuj počítač, pokud to nepomůže , po restartu mačkej klávesu F8 a pak zvol poslední známou funkční konfiguraci. , či použij bod obnovy.

C:\ChVID.exe--si stahoval? Odkud , z bezpečných stránek?

Stáhni si aswMBR
na svojí plochu. Uzavři všechna okna , programy a prohlížeče. Poklepej na aswMBR.exe. Pokud se objeví hláška o možnosti stáhnutí databáze Avastu , klikni na NE. Poté klikni na „Scan“ . Po skenu klikni na „Save Log“ a ulož si log na plochu .Zkopíruj sem celý obsah toho logu. Pak klikni na „Exit“ k zavření programu.

[screenname]

Provedl jsem. Logy:


ComboFix 12-04-23.02 - Jirka 24.04.2012 12:15:05.2.4 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.4085.3025 [GMT 2:00]
Spuštěný z: c:\users\Jirka.Jirka-PC\Desktop\Novß slo×ka (3)\ComboFix.exe
Použité ovládací přepínače :: c:\users\Jirka.Jirka-PC\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\program files (x86)\Google\Update\GoogleUpdate.exe"
"c:\users\Jirka.Jirka-PC\AppData\Local\Google\Update\GoogleUpdate.exe"
"c:\users\Jirka\AppData\Local\Google\Update\GoogleUpdate.exe"
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
"c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3351475916-1720942700-161379336-1148Core.job"
"c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3545919743-1017386175-2234930996-1157Core1cd09cce3064402.job"
"c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-448369136-326095957-3992491985-1000Core.job"
"c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-448369136-326095957-3992491985-1000UA.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\ESET
c:\program files (x86)\ESET\ESET Online Scanner\esets_apiA.dll
c:\program files (x86)\ESET\ESET Online Scanner\esets_apiW.dll
c:\program files (x86)\ESET\ESET Online Scanner\esets_apiW_a.dll
c:\program files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe
c:\program files (x86)\ESET\ESET Online Scanner\log.txt
c:\program files (x86)\ESET\ESET Online Scanner\Modules\data\updfiles\http_update.eset.com\update.ver
c:\program files (x86)\ESET\ESET Online Scanner\Modules\data\updfiles\lastupd.ver
c:\program files (x86)\ESET\ESET Online Scanner\Modules\data\updfiles\nod0105.nup
c:\program files (x86)\ESET\ESET Online Scanner\Modules\data\updfiles\nod018B.nup
c:\program files (x86)\ESET\ESET Online Scanner\Modules\data\updfiles\nod0370.nup
c:\program files (x86)\ESET\ESET Online Scanner\Modules\data\updfiles\nod0AFE.nup
c:\program files (x86)\ESET\ESET Online Scanner\Modules\data\updfiles\nod1040.nup
c:\program files (x86)\ESET\ESET Online Scanner\Modules\data\updfiles\nod1721.nup
c:\program files (x86)\ESET\ESET Online Scanner\Modules\data\updfiles\nod219A.nup
c:\program files (x86)\ESET\ESET Online Scanner\Modules\data\updfiles\nod2C1F.nup
c:\program files (x86)\ESET\ESET Online Scanner\Modules\data\updfiles\nod2CD3.nup
c:\program files (x86)\ESET\ESET Online Scanner\Modules\data\updfiles\nod2E0B.nup
c:\program files (x86)\ESET\ESET Online Scanner\Modules\data\updfiles\nod3811.nup
c:\program files (x86)\ESET\ESET Online Scanner\Modules\data\updfiles\nod3910.nup
c:\program files (x86)\ESET\ESET Online Scanner\Modules\data\updfiles\nod402E.nup
c:\program files (x86)\ESET\ESET Online Scanner\Modules\data\updfiles\nod4490.nup
c:\program files (x86)\ESET\ESET Online Scanner\Modules\data\updfiles\nod4BD5.nup
c:\program files (x86)\ESET\ESET Online Scanner\Modules\data\updfiles\nod5DAC.nup
c:\program files (x86)\ESET\ESET Online Scanner\Modules\data\updfiles\nod61A2.nup
c:\program files (x86)\ESET\ESET Online Scanner\Modules\data\updfiles\nod634B.nup
c:\program files (x86)\ESET\ESET Online Scanner\Modules\data\updfiles\nod7059.nup
c:\program files (x86)\ESET\ESET Online Scanner\Modules\data\updfiles\nod76C2.nup
c:\program files (x86)\ESET\ESET Online Scanner\Modules\data\updfiles\nod7786.nup
c:\program files (x86)\ESET\ESET Online Scanner\Modules\data\updfiles\nod792C.nup
c:\program files (x86)\ESET\ESET Online Scanner\Modules\data\updfiles\nod7E74.nup
c:\program files (x86)\ESET\ESET Online Scanner\Modules\data\updfiles\temp\em000_32.dat
c:\program files (x86)\ESET\ESET Online Scanner\Modules\data\updfiles\temp\em000_64.dat
c:\program files (x86)\ESET\ESET Online Scanner\Modules\data\updfiles\temp\em001_32.dat
c:\program files (x86)\ESET\ESET Online Scanner\Modules\data\updfiles\temp\em002_32.dat
c:\program files (x86)\ESET\ESET Online Scanner\Modules\data\updfiles\temp\em003_32.dat
c:\program files (x86)\ESET\ESET Online Scanner\Modules\data\updfiles\temp\em004_32.dat
c:\program files (x86)\ESET\ESET Online Scanner\Modules\data\updfiles\temp\em005_32.dat
c:\program files (x86)\ESET\ESET Online Scanner\Modules\data\updfiles\temp\em006_32.dat
c:\program files (x86)\ESET\ESET Online Scanner\Modules\data\updfiles\temp\em006_64.dat
c:\program files (x86)\ESET\ESET Online Scanner\Modules\data\updfiles\temp\em023_32.dat
c:\program files (x86)\ESET\ESET Online Scanner\Modules\data\updfiles\upd.ver
c:\program files (x86)\ESET\ESET Online Scanner\Modules\em000_32.dat
c:\program files (x86)\ESET\ESET Online Scanner\Modules\em000_64.dat
c:\program files (x86)\ESET\ESET Online Scanner\Modules\em001_32.dat
c:\program files (x86)\ESET\ESET Online Scanner\Modules\em002_32.dat
c:\program files (x86)\ESET\ESET Online Scanner\Modules\em003_32.dat
c:\program files (x86)\ESET\ESET Online Scanner\Modules\em004_32.dat
c:\program files (x86)\ESET\ESET Online Scanner\Modules\em005_32.dat
c:\program files (x86)\ESET\ESET Online Scanner\Modules\em006_32.dat
c:\program files (x86)\ESET\ESET Online Scanner\Modules\em006_64.dat
c:\program files (x86)\ESET\ESET Online Scanner\Modules\em023_32.dat
c:\program files (x86)\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe
c:\program files (x86)\ESET\ESET Online Scanner\OnlineCmdLineScannerA.exe
c:\program files (x86)\ESET\ESET Online Scanner\OnlineScanner.cab
c:\program files (x86)\ESET\ESET Online Scanner\OnlineScanner.inf
c:\program files (x86)\ESET\ESET Online Scanner\OnlineScanner.ocx
c:\program files (x86)\ESET\ESET Online Scanner\OnlineScanner64.ocx
c:\program files (x86)\ESET\ESET Online Scanner\OnlineScannerApp.exe
c:\program files (x86)\ESET\ESET Online Scanner\OnlineScannerLang.dll
c:\program files (x86)\ESET\ESET Online Scanner\OnlineScannerUninstaller.exe
c:\program files (x86)\ESET\ESET Online Scanner\unicows.dll
c:\windows\1C4551A64743409391E41477CD655043.TMP
c:\windows\1C4551A64743409391E41477CD655043.TMP\WiseCustomCalla.dll
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_gupdate
-------\Service_gupdatem
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-03-24 do 2012-04-24 )))))))))))))))))))))))))))))))
.
.
2012-04-24 10:30 . 2012-04-24 10:30 -------- d-----w- c:\users\Jirka\AppData\Local\temp
2012-04-24 10:30 . 2012-04-24 10:30 -------- d-----w- c:\users\Jirka.000\AppData\Local\temp
2012-04-24 10:30 . 2012-04-24 10:30 -------- d-----w- c:\users\Hana\AppData\Local\temp
2012-04-24 10:30 . 2012-04-24 10:30 -------- d-----w- c:\users\Franta\AppData\Local\temp
2012-04-24 10:30 . 2012-04-24 10:30 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-04-24 10:30 . 2012-04-24 10:30 -------- d-----w- c:\users\Bara\AppData\Local\temp
2012-04-24 10:30 . 2012-04-24 10:30 -------- d-----w- c:\users\Bara.FIBOX\AppData\Local\temp
2012-04-23 21:17 . 2012-04-13 08:46 8917360 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{AD1D7244-AFA1-421F-86CB-11C3BE51BB48}\mpengine.dll
2012-04-23 14:56 . 2012-04-23 14:56 -------- d-----w- c:\program files (x86)\Common Files\Java
2012-04-22 14:37 . 2012-04-22 14:41 -------- d-----w- c:\program files (x86)\Microsoft Games for Windows - LIVE
2012-04-22 14:37 . 2012-04-22 14:37 -------- d-----w- c:\windows\SysWow64\xlive
2012-04-22 11:20 . 2012-04-22 11:20 -------- d-----w- c:\users\Jirka.Jirka-PC\AppData\Roaming\HDRsoft
2012-04-16 11:29 . 2012-04-16 11:29 -------- d-----w- c:\programdata\BioWare
2012-04-16 11:08 . 2012-04-16 11:08 -------- d-----w- c:\programdata\Media Center Programs
2012-04-16 10:55 . 2012-04-16 11:08 -------- d-----w- c:\program files (x86)\Common Files\BioWare
2012-04-10 19:39 . 2012-04-10 19:39 -------- d-----w- c:\users\Jirka.Jirka-PC\AppData\Local\Windows Live
2012-04-10 19:39 . 2012-04-10 19:39 -------- d-----w- c:\program files (x86)\Common Files\Windows Live
2012-04-10 18:26 . 2012-04-10 20:14 -------- d-----w- c:\users\Jirka.Jirka-PC\AppData\Local\WMTools Downloaded Files
2012-04-10 06:19 . 2012-04-23 14:58 -------- d-----w- c:\programdata\RegCure
2012-04-07 14:33 . 2012-04-07 14:33 -------- d-----w- c:\programdata\EA Core
2012-04-07 14:33 . 2012-04-07 14:33 -------- d-----w- c:\programdata\Electronic Arts
2012-04-07 14:33 . 2012-04-07 14:33 -------- d-----w- c:\programdata\EA Logs
2012-04-06 09:08 . 2006-11-01 10:05 154424 ----a-w- C:\ChVID.exe
2012-04-04 21:57 . 2012-04-04 21:59 -------- d-----w- c:\users\Jirka.Jirka-PC\AppData\Roaming\GetRightToGo
2012-03-26 13:17 . 2012-03-26 13:16 750488 ----a-w- c:\windows\system32\npdeployJava1.dll
2012-03-26 13:17 . 2012-03-26 13:16 660368 ----a-w- c:\windows\system32\deployJava1.dll
2012-03-26 13:16 . 2012-03-26 13:16 -------- d-----w- c:\program files\Java
2012-03-26 13:13 . 2012-03-26 13:13 -------- d-----w- c:\users\Jirka.Jirka-PC\AppData\Roaming\.minecraft
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-04-23 14:50 . 2011-01-16 11:34 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll
2012-04-13 08:46 . 2011-06-30 07:12 8917360 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-04-04 13:56 . 2011-06-05 11:32 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-03-14 06:12 . 2010-09-08 16:07 2379552 ----a-w- c:\programdata\Microsoft\VisualStudio\10.0\1033\ResourceCache.dll
2012-03-12 21:25 . 2011-08-14 10:06 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-02-15 04:46 . 2012-03-15 13:34 23552 ----a-w- c:\windows\system32\drivers\tdtcp.sys
2012-02-10 13:42 . 2012-02-10 13:42 927800 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{82BA21DF-58C5-4F17-A46D-52CEA483E1D0}\gapaengine.dll
2012-01-31 12:44 . 2010-09-06 14:53 279656 ------w- c:\windows\system32\MpSigStub.exe
.
.
((((((((((((((((((((((((((((( SnapShot@2012-04-23_20.49.08 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-09-06 18:06 . 2012-04-23 21:13 59720 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2012-04-24 10:50 31398 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2010-11-29 15:41 . 2012-04-24 05:09 17570 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3545919743-1017386175-2234930996-1157_UserData.bin
+ 2010-09-06 14:34 . 2012-04-24 10:00 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-09-06 14:34 . 2012-04-23 20:32 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-09-06 14:34 . 2012-04-23 20:32 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-09-06 14:34 . 2012-04-24 10:00 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2012-04-24 10:00 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:54 . 2012-04-23 20:32 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-09-06 19:03 . 2012-04-23 20:10 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-09-06 19:03 . 2012-04-24 10:14 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-09-06 19:03 . 2012-04-23 20:10 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-09-06 19:03 . 2012-04-24 10:14 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-09-07 12:39 . 2012-03-15 13:35 34144 c:\windows\Installer\{91140000-0011-0000-1000-0000000FF1CE}\oisicon.exe
+ 2010-09-07 12:39 . 2012-04-24 05:07 34144 c:\windows\Installer\{91140000-0011-0000-1000-0000000FF1CE}\oisicon.exe
- 2010-09-07 12:39 . 2012-03-15 13:35 42848 c:\windows\Installer\{91140000-0011-0000-1000-0000000FF1CE}\msouc.exe
+ 2010-09-07 12:39 . 2012-04-24 05:07 42848 c:\windows\Installer\{91140000-0011-0000-1000-0000000FF1CE}\msouc.exe
+ 2010-09-07 12:39 . 2012-04-24 05:07 19296 c:\windows\Installer\{91140000-0011-0000-1000-0000000FF1CE}\cagicon.exe
- 2010-09-07 12:39 . 2012-03-15 13:35 19296 c:\windows\Installer\{91140000-0011-0000-1000-0000000FF1CE}\cagicon.exe
- 2010-11-15 15:23 . 2012-04-23 20:44 4378 c:\windows\system32\wdi\ERCQueuedResolutions.dat
+ 2010-11-15 15:23 . 2012-04-24 10:46 4378 c:\windows\system32\wdi\ERCQueuedResolutions.dat
- 2012-04-23 20:45 . 2012-04-23 20:45 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-04-24 10:47 . 2012-04-24 10:47 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2012-04-23 20:45 . 2012-04-23 20:45 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2012-04-24 10:47 . 2012-04-24 10:47 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2012-02-15 21:28 . 2011-12-16 08:02 132096 c:\windows\SysWOW64\url.dll
+ 2012-04-23 21:24 . 2012-02-28 05:40 132096 c:\windows\SysWOW64\url.dll
+ 2010-10-05 14:16 . 2012-04-24 09:50 448972 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_FastS4.bin
- 2012-02-15 21:28 . 2011-12-16 08:45 134144 c:\windows\system32\url.dll
+ 2012-04-23 21:24 . 2012-02-28 06:35 134144 c:\windows\system32\url.dll
+ 2009-07-14 02:36 . 2012-04-24 10:02 686004 c:\windows\system32\perfh009.dat
- 2009-07-14 02:36 . 2012-04-23 20:12 686004 c:\windows\system32\perfh009.dat
+ 2009-07-14 15:18 . 2012-04-24 10:02 702862 c:\windows\system32\perfh005.dat
- 2009-07-14 15:18 . 2012-04-23 20:12 702862 c:\windows\system32\perfh005.dat
+ 2009-07-14 02:36 . 2012-04-24 10:02 130790 c:\windows\system32\perfc009.dat
- 2009-07-14 02:36 . 2012-04-23 20:12 130790 c:\windows\system32\perfc009.dat
+ 2009-07-14 15:18 . 2012-04-24 10:02 152266 c:\windows\system32\perfc005.dat
- 2009-07-14 15:18 . 2012-04-23 20:12 152266 c:\windows\system32\perfc005.dat
+ 2009-07-14 05:12 . 2012-04-24 09:58 262144 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
- 2009-07-14 05:12 . 2012-03-25 14:32 262144 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2009-07-14 04:46 . 2012-04-24 05:01 104488 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat
- 2009-07-14 05:01 . 2012-04-23 20:44 496792 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2012-04-24 10:46 496792 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2012-03-21 03:30 . 2012-03-21 03:30 138240 c:\windows\Installer\1829e2.msp
+ 2012-02-09 05:27 . 2012-02-09 05:27 231424 c:\windows\Installer\1829b9.msp
+ 2010-09-07 12:39 . 2012-04-24 05:07 415584 c:\windows\Installer\{91140000-0011-0000-1000-0000000FF1CE}\pubs.exe
- 2010-09-07 12:39 . 2012-03-15 13:35 415584 c:\windows\Installer\{91140000-0011-0000-1000-0000000FF1CE}\pubs.exe
+ 2010-09-07 12:39 . 2012-04-24 05:07 303456 c:\windows\Installer\{91140000-0011-0000-1000-0000000FF1CE}\outicon.exe
- 2010-09-07 12:39 . 2012-03-15 13:35 303456 c:\windows\Installer\{91140000-0011-0000-1000-0000000FF1CE}\outicon.exe
- 2010-09-07 12:39 . 2012-03-15 13:35 571232 c:\windows\Installer\{91140000-0011-0000-1000-0000000FF1CE}\misc.exe
+ 2010-09-07 12:39 . 2012-04-24 05:07 571232 c:\windows\Installer\{91140000-0011-0000-1000-0000000FF1CE}\misc.exe
- 2010-09-07 12:39 . 2012-03-15 13:35 326496 c:\windows\Installer\{91140000-0011-0000-1000-0000000FF1CE}\joticon.exe
+ 2010-09-07 12:39 . 2012-04-24 05:07 326496 c:\windows\Installer\{91140000-0011-0000-1000-0000000FF1CE}\joticon.exe
- 2010-09-07 12:39 . 2012-03-15 13:35 469856 c:\windows\Installer\{91140000-0011-0000-1000-0000000FF1CE}\inficon.exe
+ 2010-09-07 12:39 . 2012-04-24 05:07 469856 c:\windows\Installer\{91140000-0011-0000-1000-0000000FF1CE}\inficon.exe
- 2010-09-07 12:39 . 2012-03-15 13:35 178528 c:\windows\Installer\{91140000-0011-0000-1000-0000000FF1CE}\grvicons.exe
+ 2010-09-07 12:39 . 2012-04-24 05:07 178528 c:\windows\Installer\{91140000-0011-0000-1000-0000000FF1CE}\grvicons.exe
- 2009-07-14 04:45 . 2012-04-23 14:29 7384311 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat
+ 2009-07-14 04:45 . 2012-04-24 05:01 7384311 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat
+ 2012-03-07 13:02 . 2012-03-07 13:02 1940480 c:\windows\Installer\5d2c8.msp
+ 2012-03-21 03:30 . 2012-03-21 03:30 1868288 c:\windows\Installer\1829d6.msp
+ 2010-09-07 12:39 . 2012-04-24 05:07 1479520 c:\windows\Installer\{91140000-0011-0000-1000-0000000FF1CE}\xlicons.exe
- 2010-09-07 12:39 . 2012-03-15 13:35 1479520 c:\windows\Installer\{91140000-0011-0000-1000-0000000FF1CE}\xlicons.exe
+ 2010-09-07 12:39 . 2012-04-24 05:07 1858400 c:\windows\Installer\{91140000-0011-0000-1000-0000000FF1CE}\wordicon.exe
- 2010-09-07 12:39 . 2012-03-15 13:35 1858400 c:\windows\Installer\{91140000-0011-0000-1000-0000000FF1CE}\wordicon.exe
+ 2010-09-07 12:39 . 2012-04-24 05:07 3792736 c:\windows\Installer\{91140000-0011-0000-1000-0000000FF1CE}\pptico.exe
- 2010-09-07 12:39 . 2012-03-15 13:35 3792736 c:\windows\Installer\{91140000-0011-0000-1000-0000000FF1CE}\pptico.exe
- 2010-09-07 12:39 . 2012-03-15 13:35 1449312 c:\windows\Installer\{91140000-0011-0000-1000-0000000FF1CE}\accicons.exe
+ 2010-09-07 12:39 . 2012-04-24 05:07 1449312 c:\windows\Installer\{91140000-0011-0000-1000-0000000FF1CE}\accicons.exe
+ 2012-03-07 13:03 . 2012-03-07 13:03 26386944 c:\windows\Installer\5d2ba.msp
.
-- Snímek resetován k současnému datu --
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Akamai NetSession Interface"="c:\users\Jirka.Jirka-PC\AppData\Local\Akamai\netsession_win.exe" [2012-03-13 3331872]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AdobeCS4ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"AdobeCS5.5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]
"AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-07-22 402432]
"Contour Shuttle Device Helper"="c:\program files (x86)\Contour Shuttle\ShuttleHelper.exe" [2009-07-23 118784]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-02-10 61440]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"Malwarebytes' Anti-Malware"="d:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Canon LBP2900 Status Window.lnk - c:\windows\System32\spool\drivers\x64\3\CNAB4LAD.EXE [2010-9-23 60384]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [2008-08-15 284016]
R3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;h:\games\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe [2009-07-26 25832]
R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2010-09-29 1038088]
R3 GGSAFERDriver;GGSAFER Driver;c:\program files (x86)\Garena Plus\Room\safedrv.sys [x]
R3 mi-raysat_3dsmax2010_64;mental ray 3.7 Satellite for Autodesk 3ds Max 2010 64-bit 64-bit;d:\program files\Autodesk\3ds Max 2010\mentalray\satellite\raysat_3dsmax2010_64server.exe [2009-03-12 86016]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 51740536]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 282616]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\DRIVERS\ss_bbus.sys [x]
R3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\DRIVERS\ss_bmdfl.sys [x]
R3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\DRIVERS\ss_bmdm.sys [x]
R3 ss_bserd;SAMSUNG USB Mobile Logging Driver;c:\windows\system32\DRIVERS\ss_bserd.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TFsExDisk;TFsExDisk;c:\windows\System32\Drivers\TFsExDisk.sys [2010-09-15 16392]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [x]
R4 RsFx0105;RsFx0105 Driver;c:\windows\system32\DRIVERS\RsFx0105.sys [x]
R4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 27136]
S2 dgdersvc;Device Error Recovery Service;c:\windows\system32\dgdersvc.exe [2010-09-15 119632]
S2 MBAMService;MBAMService;d:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408]
S3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [2010-09-15 20552]
S3 e1yexpress;Ovladač gigabitových síťových připojení Intel(R);c:\windows\system32\DRIVERS\e1y60x64.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 wbondir;Winbond CIR Transceiver;c:\windows\system32\DRIVERS\wbondir.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
iissvcs REG_MULTI_SZ w3svc was
apphost REG_MULTI_SZ apphostsvc
.
Obsah adresáře 'Naplánované úlohy'
.
2012-04-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-11-28 12:11]
.
2012-04-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-11-28 12:11]
.
2010-10-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3351475916-1720942700-161379336-1148Core.job
- c:\users\Jirka\AppData\Local\Google\Update\GoogleUpdate.exe [2010-09-06 14:41]
.
2012-03-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3545919743-1017386175-2234930996-1157Core1cd09cce3064402.job
- c:\users\Jirka.Jirka-PC\AppData\Local\Google\Update\GoogleUpdate.exe [2010-11-29 12:11]
.
2012-04-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-448369136-326095957-3992491985-1000Core.job
- c:\users\Jirka\AppData\Local\Google\Update\GoogleUpdate.exe [2010-09-06 14:41]
.
2012-04-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-448369136-326095957-3992491985-1000UA.job
- c:\users\Jirka\AppData\Local\Google\Update\GoogleUpdate.exe [2010-09-06 14:41]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-03-15 499608]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 112512]
"CNAP2 Launcher"="c:\windows\system32\spool\DRIVERS\x64\3\CNAP2LAK.EXE" [2007-09-05 406944]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 1436224]
"SysTrayApp"="c:\program files (x86)\IDT\WDM\sttray64.exe" [BU]
"combofix"="c:\combofix\CF30885.3XE" [2010-11-20 345088]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://companyweb
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Append Link Target to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~1\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~1\Office14\ONBttnIE.dll/105
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
AddRemove-ESET Online Scanner - c:\program files (x86)\ESET\ESET Online Scanner\OnlineScannerUninstaller.exe
AddRemove-Čeština Dragon Age Origins 1.00 - c:\users\Jirka.Jirka-PC\Desktop\Nová složka\Dragon Age\Uninstall.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\services\Akamai]
"ServiceDll"="c:\program files (x86)\common files\akamai/netsession_win_6c825ce.dll"
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\services\MySQL]
"ImagePath"="\"c:\program files\MySQL\MySQL Server 5.1\bin\mysqld\" --defaults-file=\"c:\program files\MySQL\MySQL Server 5.1\my.ini\" MySQL"
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files (x86)\Contour Shuttle\ShuttleEngine.exe
.
**************************************************************************
.
Celkový čas: 2012-04-24 13:06:12 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-04-24 11:06
ComboFix2.txt 2012-04-23 21:06
.
Před spuštěním: Volných bajtů: 35 825 786 880
Po spuštění: Volných bajtů: 35 028 717 568
.
- - End Of File - - 5A855197D20870DD5E8CD187BF290256



Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:12:55, on 24.4.2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v8.00 (8.00.7601.17514)
Boot mode: Normal

Running processes:
C:\Windows\System32\spool\drivers\x64\3\CNAP2LAK.EXE
C:\Users\Jirka.Jirka-PC\AppData\Local\Akamai\netsession_win.exe
C:\Windows\system32\spool\DRIVERS\x64\3\CNAP2RPK.EXE
C:\Windows\system32\spool\DRIVERS\x64\3\CNAC8SWK.EXE
C:\Users\Jirka.Jirka-PC\AppData\Local\Akamai\netsession_win.exe
C:\Program Files (x86)\Contour Shuttle\ShuttleHelper.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Users\Jirka.Jirka-PC\Downloads\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://companyweb
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Adobe_ID0ENQBO] C:\PROGRA~2\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [AdobeCS5.5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [Contour Shuttle Device Helper] C:\Program Files (x86)\Contour Shuttle\ShuttleHelper.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKCU\..\Run: [Akamai NetSession Interface] "C:\Users\Jirka.Jirka-PC\AppData\Local\Akamai\netsession_win.exe"
O4 - Global Startup: Canon LBP2900 Status Window.lnk = C:\Windows\System32\spool\drivers\x64\3\CNAB4LAD.EXE
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~1\MICROS~1\Office14\ONBttnIE.dll/105
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = fibox.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = fibox.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = fibox.local
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = fibox.local
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe Version Cue CS4 - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Ati External Event Utility - Unknown owner - C:\Windows\system32\Ati2evxx.exe (file missing)
O23 - Service: Dragon Age: Origins - Content Updater (DAUpdaterSvc) - BioWare - H:\Games\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe
O23 - Service: Device Error Recovery Service (dgdersvc) - Devguru Co., Ltd. - C:\Windows\system32\dgdersvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: FLEXnet Licensing Service 64 - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: MBAMService - Malwarebytes Corporation - D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: mental ray 3.7 Satellite for Autodesk 3ds Max 2010 64-bit 64-bit (mi-raysat_3dsmax2010_64) - Unknown owner - D:\Program Files\Autodesk\3ds Max 2010\mentalray\satellite\raysat_3dsmax2010_64server.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe (file missing)
O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Contour Shuttle Device Engine (ShuttleEngine) - Contour Design, Inc. - C:\Program Files (x86)\Contour Shuttle\ShuttleEngine.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: SQL Server VSS Writer (SQLWriter) - Unknown owner - c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (file missing)
O23 - Service: Audio Service (STacSV) - IDT, Inc. - c:\program files\idt\wdm\STacSV64.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 10821 bytes



aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-04-24 13:13:32
-----------------------------
13:13:32.248 OS Version: Windows x64 6.1.7601 Service Pack 1
13:13:32.248 Number of processors: 4 586 0xF0B
13:13:32.249 ComputerName: JIRKA-PC UserName: Jirka
13:13:32.784 Initialize success
13:13:46.092 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
13:13:46.094 Disk 0 Vendor: WDC_WD2500KS-00MJB0 02.01C03 Size: 238475MB BusType: 3
13:13:46.096 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP0T1L0-2
13:13:46.098 Disk 1 Vendor: Maxtor_6B200M0 BANC1BY0 Size: 194481MB BusType: 3
13:13:46.100 Disk 2 \Device\Harddisk2\DR2 -> \Device\Ide\IdeDeviceP3T0L0-4
13:13:46.103 Disk 2 Vendor: ST3320620AS 3.AAE Size: 305245MB BusType: 3
13:13:46.105 Disk 3 \Device\Harddisk3\DR3 -> \Device\Ide\IdeDeviceP1T0L0-1
13:13:46.108 Disk 3 Vendor: Maxtor_6L200M0 BANC1G10 Size: 194481MB BusType: 3
13:13:46.164 Disk 0 MBR read successfully
13:13:46.169 Disk 0 MBR scan
13:13:46.174 Disk 0 Windows 7 default MBR code
13:13:46.201 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048
13:13:46.250 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 110840 MB offset 206848
13:13:46.287 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 127531 MB offset 227207295
13:13:46.375 Disk 0 scanning C:\Windows\system32\drivers
13:14:10.844 Service scanning
13:14:30.901 Service MpNWMon C:\Windows\system32\DRIVERS\MpNWMon.sys **LOCKED** 32
13:14:35.778 Service sptd C:\Windows\System32\Drivers\sptd.sys **LOCKED** 32
13:14:40.314 Modules scanning
13:14:40.322 Disk 0 trace - called modules:
13:14:40.350 ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0xfffffa80046e12c0]<<spls.sys ataport.SYS pciide.sys
13:14:40.357 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004ae3060]
13:14:40.363 3 CLASSPNP.SYS[fffff8800181743f] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa8004853060]
13:14:40.369 \Driver\atapi[0xfffffa800483c960] -> IRP_MJ_CREATE -> 0xfffffa80046e12c0
13:14:40.376 Scan finished successfully
13:15:00.271 Disk 0 MBR has been saved successfully to "C:\MBR.dat"
13:15:00.723 The log file has been saved successfully to "C:\aswMBR.txt"



Chvid.exe jsem stahoval. Bohužel nevím přesně odkud, ale je možné že jsem ho používal nedávno a mohl by se na tom sekání podílet. Antivir při stahování ale nic nehlásil.

[jaro3]

Stáhni si TDSSKiller

Na svojí plochu.Ujisti se , že máš zavřeny všechny ostatní aplikace a prohlížeče. Rozbal soubor a spusť TDSSKiller.exe. Restartuj PC . Log z TDSSKilleru najdeš zde:
C:\TDSSKiller.2.2.7.1._(datum)_log.txt , vlož sem prosím celý obsah logu.

Stáhni si RootRepeal

Rozbal si archív třeba do C:\RootRepeal
Poklepej na RootRepeal.exe ke startu programu ( ve vistě pravým a vybrat spustit jako administrátor).
Klikni v dolní části na Files a potom na Scan .
Objeví se dialog.okno, dej zatržítko na disk, který chceš skenovat( nejčastěji na C:\) , a potom na OK.
Program začne skenovat zatržený disk. Když sken skončí , budou tam vypsané soubory, ale ne všechny musí být legitimní. Klikni na Save Report a ulož si log do dokumentů. Vlož sem prosím celý jeho obsah.

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = fibox.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = fibox.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = fibox.local
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = fibox.local
Pokud to neznáš ,. taky fix.

[screenname]

Log z TDSSKilleru:


15:37:57.0042 3944 TDSS rootkit removing tool 2.7.32.0 Apr 23 2012 19:12:34
15:37:57.0201 3944 ============================================================
15:37:57.0201 3944 Current date / time: 2012/04/24 15:37:57.0201
15:37:57.0201 3944 SystemInfo:
15:37:57.0201 3944
15:37:57.0201 3944 OS Version: 6.1.7601 ServicePack: 1.0
15:37:57.0201 3944 Product type: Workstation
15:37:57.0202 3944 ComputerName: JIRKA-PC
15:37:57.0202 3944 UserName: Jirka
15:37:57.0202 3944 Windows directory: C:\Windows
15:37:57.0202 3944 System windows directory: C:\Windows
15:37:57.0202 3944 Running under WOW64
15:37:57.0202 3944 Processor architecture: Intel x64
15:37:57.0202 3944 Number of processors: 4
15:37:57.0202 3944 Page size: 0x1000
15:37:57.0202 3944 Boot type: Normal boot
15:37:57.0202 3944 ============================================================
15:37:58.0901 3944 Drive \Device\Harddisk0\DR0 - Size: 0x3A38B2E000 (232.89 Gb), SectorSize: 0x200, Cylinders: 0x76C1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
15:37:58.0931 3944 Drive \Device\Harddisk1\DR1 - Size: 0x2F7B100000 (189.92 Gb), SectorSize: 0x200, Cylinders: 0x60D8, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
15:37:58.0963 3944 Drive \Device\Harddisk3\DR3 - Size: 0x2F7B100000 (189.92 Gb), SectorSize: 0x200, Cylinders: 0x66E6, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xF0, Type 'K0', Flags 0x00000040
15:37:58.0980 3944 Drive \Device\Harddisk2\DR2 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
15:37:59.0211 3944 ============================================================
15:37:59.0211 3944 \Device\Harddisk0\DR0:
15:37:59.0211 3944 MBR partitions:
15:37:59.0211 3944 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
15:37:59.0211 3944 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0xD87C000
15:37:59.0211 3944 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0xD8AE87F, BlocksNum 0xF915D02
15:37:59.0211 3944 \Device\Harddisk1\DR1:
15:37:59.0211 3944 MBR partitions:
15:37:59.0211 3944 \Device\Harddisk1\DR1\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0xC34F800
15:37:59.0211 3944 \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0xC350800, BlocksNum 0x5C43800
15:37:59.0211 3944 \Device\Harddisk1\DR1\Partition2: MBR, Type 0x7, StartLBA 0x11F94000, BlocksNum 0x5C43800
15:37:59.0211 3944 \Device\Harddisk3\DR3:
15:37:59.0212 3944 MBR partitions:
15:37:59.0212 3944 \Device\Harddisk3\DR3\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x17BD7000
15:37:59.0212 3944 \Device\Harddisk2\DR2:
15:37:59.0214 3944 MBR partitions:
15:37:59.0214 3944 \Device\Harddisk2\DR2\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x2542D800
15:37:59.0214 3944 ============================================================
15:37:59.0215 3944 C: <-> \Device\Harddisk0\DR0\Partition1
15:37:59.0389 3944 D: <-> \Device\Harddisk0\DR0\Partition2
15:37:59.0470 3944 F: <-> \Device\Harddisk1\DR1\Partition0
15:37:59.0489 3944 H: <-> \Device\Harddisk2\DR2\Partition0
15:37:59.0522 3944 G: <-> \Device\Harddisk3\DR3\Partition0
15:38:00.0078 3944 I: <-> \Device\Harddisk1\DR1\Partition1
15:38:00.0151 3944 O: <-> \Device\Harddisk1\DR1\Partition2
15:38:00.0151 3944 ============================================================
15:38:00.0151 3944 Initialize success
15:38:00.0151 3944 ============================================================
15:38:18.0612 1444 ============================================================
15:38:18.0612 1444 Scan started
15:38:18.0612 1444 Mode: Manual;
15:38:18.0612 1444 ============================================================
15:40:32.0925 1444 1394ohci (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
15:40:32.0963 1444 1394ohci - ok
15:40:33.0029 1444 61883 (e0a8525a951addb4655bc2068566407d) C:\Windows\system32\DRIVERS\61883.sys
15:40:33.0031 1444 61883 - ok
15:40:33.0090 1444 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
15:40:33.0102 1444 ACPI - ok
15:40:33.0128 1444 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
15:40:33.0129 1444 AcpiPmi - ok
15:40:33.0182 1444 adfs (2f0683fd2df1d92e891caca14b45a8c1) C:\Windows\system32\drivers\adfs.sys
15:40:33.0183 1444 adfs - ok
15:40:33.0359 1444 Adobe Version Cue CS4 (57a3b9a69f14414ace12afd6ba701773) C:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe
15:40:33.0396 1444 Adobe Version Cue CS4 - ok
15:40:33.0468 1444 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
15:40:33.0555 1444 adp94xx - ok
15:40:33.0632 1444 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
15:40:33.0637 1444 adpahci - ok
15:40:33.0647 1444 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
15:40:33.0655 1444 adpu320 - ok
15:40:33.0726 1444 AeLookupSvc (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll
15:40:33.0727 1444 AeLookupSvc - ok
15:40:33.0890 1444 AFD (d31dc7a16dea4a9baf179f3d6fbdb38c) C:\Windows\system32\drivers\afd.sys
15:40:33.0896 1444 AFD - ok
15:40:34.0162 1444 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
15:40:34.0174 1444 agp440 - ok
15:40:34.0676 1444 Akamai (1125c7d9fb8898015829c387c1bc87c7) c:\program files (x86)\common files\akamai/netsession_win_6c825ce.dll
15:40:34.0676 1444 Suspicious file (Hidden): c:\program files (x86)\common files\akamai/netsession_win_6c825ce.dll. md5: 1125c7d9fb8898015829c387c1bc87c7
15:40:34.0683 1444 Akamai ( HiddenFile.Multi.Generic ) - warning
15:40:34.0683 1444 Akamai - detected HiddenFile.Multi.Generic (1)
15:40:34.0760 1444 ALG (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe
15:40:34.0777 1444 ALG - ok
15:40:34.0827 1444 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
15:40:34.0828 1444 aliide - ok
15:40:34.0851 1444 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
15:40:34.0852 1444 amdide - ok
15:40:34.0873 1444 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
15:40:34.0875 1444 AmdK8 - ok
15:40:34.0893 1444 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
15:40:34.0895 1444 AmdPPM - ok
15:40:34.0949 1444 amdsata (6ec6d772eae38dc17c14aed9b178d24b) C:\Windows\system32\drivers\amdsata.sys
15:40:34.0960 1444 amdsata - ok
15:40:35.0034 1444 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
15:40:35.0037 1444 amdsbs - ok
15:40:36.0257 1444 amdxata (1142a21db581a84ea5597b03a26ebaa0) C:\Windows\system32\drivers\amdxata.sys
15:40:36.0264 1444 amdxata - ok
15:40:36.0376 1444 AppHostSvc (59d01fa91962c9c1e9b4022b2d3b46db) C:\Windows\system32\inetsrv\apphostsvc.dll
15:40:36.0378 1444 AppHostSvc - ok
15:40:36.0429 1444 AppID (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
15:40:36.0430 1444 AppID - ok
15:40:36.0486 1444 AppIDSvc (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll
15:40:36.0487 1444 AppIDSvc - ok
15:40:36.0496 1444 Appinfo (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll
15:40:36.0497 1444 Appinfo - ok
15:40:36.0572 1444 AppMgmt (4aba3e75a76195a3e38ed2766c962899) C:\Windows\System32\appmgmts.dll
15:40:36.0575 1444 AppMgmt - ok
15:40:36.0596 1444 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
15:40:36.0598 1444 arc - ok
15:40:36.0608 1444 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
15:40:36.0610 1444 arcsas - ok
15:40:36.0766 1444 aspnet_state (9217d874131ae6ff8f642f124f00a555) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
15:40:36.0767 1444 aspnet_state - ok
15:40:36.0809 1444 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
15:40:36.0810 1444 AsyncMac - ok
15:40:36.0829 1444 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
15:40:36.0829 1444 atapi - ok
15:40:36.0976 1444 Ati External Event Utility (ca4a0176fa380efd45de9d0acb9e1f86) C:\Windows\system32\Ati2evxx.exe
15:40:36.0986 1444 Ati External Event Utility - ok
15:40:39.0422 1444 atikmdag (aeae4abe6419923c037a0b2a157e1fc6) C:\Windows\system32\DRIVERS\atikmdag.sys
15:40:39.0699 1444 atikmdag - ok
15:40:39.0939 1444 atksgt (fc0e8778c000291caf60eb88c011e931) C:\Windows\system32\DRIVERS\atksgt.sys
15:40:39.0944 1444 atksgt - ok
15:40:40.0008 1444 AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
15:40:40.0032 1444 AudioEndpointBuilder - ok
15:40:40.0039 1444 AudioSrv (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
15:40:40.0043 1444 AudioSrv - ok
15:40:40.0091 1444 Avc (16fabe84916623d0607e4a975544032c) C:\Windows\system32\DRIVERS\avc.sys
15:40:40.0093 1444 Avc - ok
15:40:40.0154 1444 AxInstSV (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll
15:40:40.0157 1444 AxInstSV - ok
15:40:40.0196 1444 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
15:40:40.0248 1444 b06bdrv - ok
15:40:40.0282 1444 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
15:40:40.0320 1444 b57nd60a - ok
15:40:40.0355 1444 BDESVC (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll
15:40:40.0357 1444 BDESVC - ok
15:40:40.0409 1444 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
15:40:40.0409 1444 Beep - ok
15:40:40.0496 1444 BFE (82974d6a2fd19445cc5171fc378668a4) C:\Windows\System32\bfe.dll
15:40:40.0526 1444 BFE - ok
15:40:40.0716 1444 BITS (1ea7969e3271cbc59e1730697dc74682) C:\Windows\system32\qmgr.dll
15:40:40.0729 1444 BITS - ok
15:40:40.0785 1444 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
15:40:40.0786 1444 blbdrive - ok
15:40:40.0864 1444 bowser (19d20159708e152267e53b66677a4995) C:\Windows\system32\DRIVERS\bowser.sys
15:40:40.0866 1444 bowser - ok
15:40:40.0882 1444 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
15:40:40.0883 1444 BrFiltLo - ok
15:40:40.0886 1444 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
15:40:40.0887 1444 BrFiltUp - ok
15:40:40.0918 1444 BridgeMP (5c2f352a4e961d72518261257aae204b) C:\Windows\system32\DRIVERS\bridge.sys
15:40:40.0919 1444 BridgeMP - ok
15:40:40.0973 1444 Browser (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll
15:40:40.0975 1444 Browser - ok
15:40:41.0007 1444 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
15:40:41.0045 1444 Brserid - ok
15:40:41.0050 1444 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
15:40:41.0052 1444 BrSerWdm - ok
15:40:41.0055 1444 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
15:40:41.0056 1444 BrUsbMdm - ok
15:40:41.0060 1444 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
15:40:41.0061 1444 BrUsbSer - ok
15:40:41.0074 1444 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
15:40:41.0075 1444 BTHMODEM - ok
15:40:41.0090 1444 bthserv (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll
15:40:41.0092 1444 bthserv - ok
15:40:41.0124 1444 catchme - ok
15:40:41.0157 1444 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
15:40:41.0159 1444 cdfs - ok
15:40:41.0207 1444 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys
15:40:41.0213 1444 cdrom - ok
15:40:41.0223 1444 CertPropSvc (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
15:40:41.0225 1444 CertPropSvc - ok
15:40:41.0238 1444 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
15:40:41.0240 1444 circlass - ok
15:40:41.0262 1444 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
15:40:41.0308 1444 CLFS - ok
15:40:41.0406 1444 clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
15:40:41.0408 1444 clr_optimization_v2.0.50727_32 - ok
15:40:41.0486 1444 clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
15:40:41.0488 1444 clr_optimization_v2.0.50727_64 - ok
15:40:41.0791 1444 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
15:40:41.0835 1444 clr_optimization_v4.0.30319_32 - ok
15:40:41.0866 1444 clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
15:40:41.0906 1444 clr_optimization_v4.0.30319_64 - ok
15:40:41.0925 1444 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
15:40:41.0926 1444 CmBatt - ok
15:40:41.0944 1444 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
15:40:41.0945 1444 cmdide - ok
15:40:42.0016 1444 CNG (d5fea92400f12412b3922087c09da6a5) C:\Windows\system32\Drivers\cng.sys
15:40:42.0072 1444 CNG - ok
15:40:42.0132 1444 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
15:40:42.0133 1444 Compbatt - ok
15:40:42.0181 1444 CompositeBus (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
15:40:42.0182 1444 CompositeBus - ok
15:40:42.0185 1444 COMSysApp - ok
15:40:42.0210 1444 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
15:40:42.0211 1444 crcdisk - ok
15:40:42.0261 1444 CryptSvc (15597883fbe9b056f276ada3ad87d9af) C:\Windows\system32\cryptsvc.dll
15:40:42.0268 1444 CryptSvc - ok
15:40:42.0350 1444 CSC (54da3dfd29ed9f1619b6f53f3ce55e49) C:\Windows\system32\drivers\csc.sys
15:40:42.0376 1444 CSC - ok
15:40:42.0493 1444 CscService (3ab183ab4d2c79dcf459cd2c1266b043) C:\Windows\System32\cscsvc.dll
15:40:42.0501 1444 CscService - ok
15:40:42.0585 1444 DAUpdaterSvc (80861969541971176e005d2c09dae851) H:\Games\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe
15:40:42.0636 1444 DAUpdaterSvc - ok
15:40:42.0736 1444 DcomLaunch (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
15:40:42.0745 1444 DcomLaunch - ok
15:40:42.0775 1444 defragsvc (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll
15:40:42.0813 1444 defragsvc - ok
15:40:42.0927 1444 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
15:40:42.0929 1444 DfsC - ok
15:40:43.0056 1444 dgderdrv (def365f0f6e017888c4b869d3ba4b8e0) C:\Windows\system32\drivers\dgderdrv.sys
15:40:43.0099 1444 dgderdrv - ok
15:40:43.0418 1444 dgdersvc (bc3c53000adcd440f1b23e46dac302ef) C:\Windows\system32\dgdersvc.exe
15:40:43.0420 1444 dgdersvc - ok
15:40:43.0436 1444 Dhcp (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll
15:40:43.0474 1444 Dhcp - ok
15:40:43.0532 1444 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
15:40:43.0533 1444 discache - ok
15:40:43.0573 1444 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
15:40:43.0574 1444 Disk - ok
15:40:43.0635 1444 Dnscache (cd55f5355d8f55d44c9f4ed875705bd6) C:\Windows\System32\dnsrslvr.dll
15:40:43.0639 1444 Dnscache - ok
15:40:43.0688 1444 dot3svc (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll
15:40:43.0726 1444 dot3svc - ok
15:40:43.0905 1444 DPS (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll
15:40:43.0909 1444 DPS - ok
15:40:43.0956 1444 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
15:40:43.0957 1444 drmkaud - ok
15:40:44.0058 1444 DXGKrnl (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
15:40:44.0085 1444 DXGKrnl - ok
15:40:44.0240 1444 e1yexpress (50ad8fc1dc800ff36087994c8f7fdff2) C:\Windows\system32\DRIVERS\e1y60x64.sys
15:40:44.0277 1444 e1yexpress - ok
15:40:44.0686 1444 EapHost (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll
15:40:44.0755 1444 EapHost - ok
15:40:45.0067 1444 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
15:40:45.0162 1444 ebdrv - ok
15:40:45.0267 1444 EFS (0793f40b9b8a1bdd266296409dbd91ea) C:\Windows\System32\lsass.exe
15:40:45.0273 1444 EFS - ok
15:40:45.0447 1444 ehRecvr (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe
15:40:45.0497 1444 ehRecvr - ok
15:40:45.0530 1444 ehSched (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe
15:40:45.0536 1444 ehSched - ok
15:40:45.0623 1444 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
15:40:45.0630 1444 elxstor - ok
15:40:45.0692 1444 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
15:40:45.0693 1444 ErrDev - ok
15:40:45.0744 1444 EventSystem (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll
15:40:45.0805 1444 EventSystem - ok
15:40:45.0816 1444 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
15:40:45.0819 1444 exfat - ok
15:40:45.0908 1444 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
15:40:45.0922 1444 fastfat - ok
15:40:46.0000 1444 Fax (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe
15:40:46.0024 1444 Fax - ok
15:40:46.0086 1444 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
15:40:46.0087 1444 fdc - ok
15:40:46.0104 1444 fdPHost (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll
15:40:46.0105 1444 fdPHost - ok
15:40:46.0117 1444 FDResPub (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll
15:40:46.0119 1444 FDResPub - ok
15:40:46.0168 1444 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
15:40:46.0170 1444 FileInfo - ok
15:40:46.0180 1444 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
15:40:46.0181 1444 Filetrace - ok
15:40:46.0403 1444 FLEXnet Licensing Service (1f63900e2eb00101b9aca2b7a870704e) C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
15:40:46.0453 1444 FLEXnet Licensing Service - ok
15:40:46.0645 1444 FLEXnet Licensing Service 64 (1c3fb052a0bb72edaed90785c34d6eed) C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
15:40:46.0684 1444 FLEXnet Licensing Service 64 - ok
15:40:46.0914 1444 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
15:40:46.0915 1444 flpydisk - ok
15:40:46.0967 1444 FltMgr (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
15:40:46.0981 1444 FltMgr - ok
15:40:47.0090 1444 FontCache (b4447f606bb19fd8ad0bafb59b90f5d9) C:\Windows\system32\FntCache.dll
15:40:47.0143 1444 FontCache - ok
15:40:47.0322 1444 FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
15:40:47.0329 1444 FontCache3.0.0.0 - ok
15:40:47.0461 1444 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
15:40:47.0463 1444 FsDepends - ok
15:40:47.0516 1444 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys
15:40:47.0517 1444 Fs_Rec - ok
15:40:47.0557 1444 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
15:40:47.0563 1444 fvevol - ok
15:40:47.0585 1444 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
15:40:47.0595 1444 gagp30kx - ok
15:40:47.0760 1444 GGSAFERDriver - ok
15:40:47.0850 1444 gpsvc (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll
15:40:47.0873 1444 gpsvc - ok
15:40:48.0015 1444 gusvc (cc839e8d766cc31a7710c9f38cf3e375) C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
15:40:48.0018 1444 gusvc - ok
15:40:48.0073 1444 hamachi (1e6438d4ea6e1174a3b3b1edc4de660b) C:\Windows\system32\DRIVERS\hamachi.sys
15:40:48.0074 1444 hamachi - ok
15:40:48.0087 1444 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
15:40:48.0088 1444 hcw85cir - ok
15:40:48.0120 1444 HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
15:40:48.0157 1444 HdAudAddService - ok
15:40:48.0215 1444 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
15:40:48.0217 1444 HDAudBus - ok
15:40:48.0239 1444 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
15:40:48.0240 1444 HidBatt - ok
15:40:48.0254 1444 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
15:40:48.0256 1444 HidBth - ok
15:40:48.0270 1444 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
15:40:48.0272 1444 HidIr - ok
15:40:48.0293 1444 hidserv (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\System32\hidserv.dll
15:40:48.0294 1444 hidserv - ok
15:40:48.0326 1444 HidUsb (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys
15:40:48.0327 1444 HidUsb - ok
15:40:48.0433 1444 hkmsvc (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll
15:40:48.0435 1444 hkmsvc - ok
15:40:48.0517 1444 HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll
15:40:48.0555 1444 HomeGroupListener - ok
15:40:48.0602 1444 HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll
15:40:48.0641 1444 HomeGroupProvider - ok
15:40:48.0665 1444 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
15:40:48.0666 1444 HpSAMD - ok
15:40:48.0832 1444 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
15:40:48.0882 1444 HTTP - ok
15:40:48.0954 1444 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
15:40:48.0955 1444 hwpolicy - ok
15:40:49.0001 1444 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
15:40:49.0003 1444 i8042prt - ok
15:40:49.0048 1444 iaStorV (3df4395a7cf8b7a72a5f4606366b8c2d) C:\Windows\system32\drivers\iaStorV.sys
15:40:49.0100 1444 iaStorV - ok
15:40:49.0403 1444 idsvc (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
15:40:49.0432 1444 idsvc - ok
15:40:49.0500 1444 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
15:40:49.0501 1444 iirsp - ok
15:40:49.0682 1444 IKEEXT (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll
15:40:49.0724 1444 IKEEXT - ok
15:40:49.0740 1444 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
15:40:49.0741 1444 intelide - ok
15:40:49.0758 1444 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
15:40:49.0759 1444 intelppm - ok
15:40:49.0870 1444 IPBusEnum (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll
15:40:49.0873 1444 IPBusEnum - ok
15:40:49.0894 1444 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
15:40:49.0896 1444 IpFilterDriver - ok
15:40:51.0861 1444 iphlpsvc (a34a587fffd45fa649fba6d03784d257) C:\Windows\System32\iphlpsvc.dll
15:40:51.0869 1444 iphlpsvc - ok
15:40:51.0898 1444 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
15:40:51.0900 1444 IPMIDRV - ok
15:40:51.0924 1444 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
15:40:51.0926 1444 IPNAT - ok
15:40:51.0943 1444 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
15:40:51.0944 1444 IRENUM - ok
15:40:51.0969 1444 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
15:40:51.0970 1444 isapnp - ok
15:40:51.0990 1444 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
15:40:52.0004 1444 iScsiPrt - ok
15:40:52.0023 1444 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys
15:40:52.0024 1444 kbdclass - ok
15:40:52.0045 1444 kbdhid (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\DRIVERS\kbdhid.sys
15:40:52.0047 1444 kbdhid - ok
15:40:52.0074 1444 KeyIso (0793f40b9b8a1bdd266296409dbd91ea) C:\Windows\system32\lsass.exe
15:40:52.0076 1444 KeyIso - ok
15:40:52.0131 1444 KSecDD (ccd53b5bd33ce0c889e830d839c8b66e) C:\Windows\system32\Drivers\ksecdd.sys
15:40:52.0133 1444 KSecDD - ok
15:40:52.0178 1444 KSecPkg (9ff918a261752c12639e8ad4208d2c2f) C:\Windows\system32\Drivers\ksecpkg.sys
15:40:52.0184 1444 KSecPkg - ok
15:40:52.0195 1444 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
15:40:52.0196 1444 ksthunk - ok
15:40:52.0220 1444 KtmRm (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll
15:40:52.0268 1444 KtmRm - ok
15:40:52.0449 1444 LanmanServer (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\System32\srvsvc.dll
15:40:52.0455 1444 LanmanServer - ok
15:40:52.0496 1444 LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll
15:40:52.0503 1444 LanmanWorkstation - ok
15:40:52.0551 1444 lirsgt (156ab2e56dc3ca0b582e3362e07cded7) C:\Windows\system32\DRIVERS\lirsgt.sys
15:40:52.0553 1444 lirsgt - ok
15:40:52.0579 1444 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
15:40:52.0581 1444 lltdio - ok
15:40:52.0601 1444 lltdsvc (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll
15:40:52.0639 1444 lltdsvc - ok
15:40:52.0659 1444 lmhosts (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll
15:40:52.0661 1444 lmhosts - ok
15:40:52.0682 1444 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
15:40:52.0685 1444 LSI_FC - ok
15:40:52.0704 1444 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
15:40:52.0706 1444 LSI_SAS - ok
15:40:52.0712 1444 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
15:40:52.0713 1444 LSI_SAS2 - ok
15:40:52.0727 1444 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
15:40:52.0734 1444 LSI_SCSI - ok
15:40:52.0749 1444 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
15:40:52.0756 1444 luafv - ok
15:40:52.0873 1444 MBAMProtector (dbc08862a71459e74f7538b432c114cc) C:\Windows\system32\drivers\mbam.sys
15:40:52.0882 1444 MBAMProtector - ok
15:40:53.0312 1444 MBAMService (ba400ed640bca1eae5c727ae17c10207) D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
15:40:53.0410 1444 MBAMService - ok
15:40:54.0596 1444 Mcx2Svc (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll
15:40:54.0599 1444 Mcx2Svc - ok
15:40:54.0632 1444 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
15:40:54.0633 1444 megasas - ok
15:40:54.0660 1444 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
15:40:54.0713 1444 MegaSR - ok
15:40:54.0876 1444 mi-raysat_3dsmax2010_64 (0af89452a8ce3928168f4e5b2208c68b) D:\Program Files\Autodesk\3ds Max 2010\mentalray\satellite\raysat_3dsmax2010_64server.exe
15:40:54.0907 1444 mi-raysat_3dsmax2010_64 - ok
15:40:55.0029 1444 Microsoft SharePoint Workspace Audit Service - ok
15:40:55.0064 1444 MMCSS (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
15:40:55.0066 1444 MMCSS - ok
15:40:55.0117 1444 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
15:40:55.0118 1444 Modem - ok
15:40:55.0159 1444 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
15:40:55.0160 1444 monitor - ok
15:40:55.0228 1444 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
15:40:55.0229 1444 mouclass - ok
15:40:55.0278 1444 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
15:40:55.0280 1444 mouhid - ok
15:40:55.0342 1444 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
15:40:55.0344 1444 mountmgr - ok
15:40:55.0406 1444 MpFilter (e6ba8e5a4a871899e23d64573ef58ee9) C:\Windows\system32\DRIVERS\MpFilter.sys
15:40:55.0412 1444 MpFilter - ok
15:40:55.0437 1444 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
15:40:55.0444 1444 mpio - ok
15:40:55.0462 1444 MpNWMon (98b09a4f2c462441030b83a80a3f6fb3) C:\Windows\system32\DRIVERS\MpNWMon.sys
15:40:55.0463 1444 MpNWMon - ok
15:40:55.0502 1444 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
15:40:55.0504 1444 mpsdrv - ok
15:40:55.0827 1444 MpsSvc (54ffc9c8898113ace189d4aa7199d2c1) C:\Windows\system32\mpssvc.dll
15:40:55.0840 1444 MpsSvc - ok
15:40:56.0115 1444 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
15:40:56.0124 1444 MRxDAV - ok
15:41:30.0586 1444 mrxsmb (faf015b07e3a2874a790a39b7d2c579f) C:\Windows\system32\DRIVERS\mrxsmb.sys
15:41:30.0611 1444 mrxsmb - ok
15:41:30.0751 1444 mrxsmb10 (08e2345df129082bcdffdc1440f9c00d) C:\Windows\system32\DRIVERS\mrxsmb10.sys
15:41:30.0756 1444 mrxsmb10 - ok
15:41:30.0936 1444 mrxsmb20 (108d87409c5812ef47d81e22843e8c9d) C:\Windows\system32\DRIVERS\mrxsmb20.sys
15:41:30.0938 1444 mrxsmb20 - ok
15:41:30.0959 1444 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
15:41:30.0961 1444 msahci - ok
15:41:30.0994 1444 msdsm (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
15:41:30.0996 1444 msdsm - ok
15:41:31.0030 1444 MSDTC (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe
15:41:31.0037 1444 MSDTC - ok
15:41:31.0122 1444 MSDV (72949a24d37a20a54b3d4d3dadbb55e9) C:\Windows\system32\DRIVERS\msdv.sys
15:41:31.0124 1444 MSDV - ok
15:41:31.0174 1444 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
15:41:31.0175 1444 Msfs - ok
15:41:31.0183 1444 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
15:41:31.0184 1444 mshidkmdf - ok
15:41:31.0202 1444 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
15:41:31.0203 1444 msisadrv - ok
15:41:31.0230 1444 MSiSCSI (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll
15:41:31.0236 1444 MSiSCSI - ok
15:41:31.0239 1444 msiserver - ok
15:41:31.0358 1444 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
15:41:31.0359 1444 MSKSSRV - ok
15:41:31.0578 1444 MsMpSvc (64e69a217d861776ca848b453fb96d71) C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
15:41:31.0579 1444 MsMpSvc - ok
15:41:31.0608 1444 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
15:41:31.0609 1444 MSPCLOCK - ok
15:41:31.0630 1444 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
15:41:31.0631 1444 MSPQM - ok
15:41:31.0685 1444 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
15:41:31.0698 1444 MsRPC - ok
15:41:31.0774 1444 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
15:41:31.0775 1444 mssmbios - ok
15:41:31.0892 1444 MSSQL$SQLEXPRESS - ok
15:41:31.0972 1444 MSSQLServerADHelper100 - ok
15:41:31.0987 1444 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
15:41:31.0988 1444 MSTEE - ok
15:41:32.0007 1444 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
15:41:32.0008 1444 MTConfig - ok
15:41:32.0027 1444 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
15:41:32.0029 1444 Mup - ok
15:41:32.0049 1444 MySQL - ok
15:41:32.0108 1444 napagent (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll
15:41:32.0115 1444 napagent - ok
15:41:32.0200 1444 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
15:41:32.0204 1444 NativeWifiP - ok
15:41:32.0323 1444 NDIS (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
15:41:32.0376 1444 NDIS - ok
15:41:32.0421 1444 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
15:41:32.0422 1444 NdisCap - ok
15:41:32.0454 1444 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
15:41:32.0455 1444 NdisTapi - ok
15:41:32.0469 1444 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
15:41:32.0471 1444 Ndisuio - ok
15:41:32.0504 1444 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
15:41:32.0510 1444 NdisWan - ok
15:41:32.0566 1444 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
15:41:32.0567 1444 NDProxy - ok
15:41:32.0616 1444 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
15:41:32.0617 1444 NetBIOS - ok
15:41:32.0735 1444 NetBT (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
15:41:32.0738 1444 NetBT - ok
15:41:32.0836 1444 Netlogon (0793f40b9b8a1bdd266296409dbd91ea) C:\Windows\system32\lsass.exe
15:41:32.0837 1444 Netlogon - ok
15:41:32.0873 1444 Netman (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll
15:41:32.0935 1444 Netman - ok
15:41:33.0062 1444 NetMsmqActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
15:41:33.0070 1444 NetMsmqActivator - ok
15:41:33.0072 1444 NetPipeActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
15:41:33.0073 1444 NetPipeActivator - ok
15:41:33.0181 1444 netprofm (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll
15:41:33.0209 1444 netprofm - ok
15:41:33.0212 1444 NetTcpActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
15:41:33.0214 1444 NetTcpActivator - ok
15:41:33.0217 1444 NetTcpPortSharing (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
15:41:33.0218 1444 NetTcpPortSharing - ok
15:41:33.0293 1444 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
15:41:33.0294 1444 nfrd960 - ok
15:41:33.0348 1444 NisDrv (3713e8452b88d3e0be095e06b6fbc776) C:\Windows\system32\DRIVERS\NisDrvWFP.sys
15:41:33.0349 1444 NisDrv - ok
15:41:33.0571 1444 NisSrv (c67e39d2968400b38f54a10822e6eacf) C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe
15:41:33.0574 1444 NisSrv - ok
15:41:33.0626 1444 NlaSvc (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll
15:41:33.0664 1444 NlaSvc - ok
15:41:33.0696 1444 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
15:41:33.0697 1444 Npfs - ok
15:41:33.0717 1444 nsi (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll
15:41:33.0720 1444 nsi - ok
15:41:33.0770 1444 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
15:41:33.0771 1444 nsiproxy - ok
15:41:33.0914 1444 Ntfs (05d78aa5cb5f3f5c31160bdb955d0b7c) C:\Windows\system32\drivers\Ntfs.sys
15:41:33.0985 1444 Ntfs - ok
15:41:34.0200 1444 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
15:41:34.0201 1444 Null - ok
15:41:34.0228 1444 nvraid (5d9fd91f3d38dc9da01e3cb5fa89cd48) C:\Windows\system32\drivers\nvraid.sys
15:41:34.0235 1444 nvraid - ok
15:41:34.0257 1444 nvstor (f7cd50fe7139f07e77da8ac8033d1832) C:\Windows\system32\drivers\nvstor.sys
15:41:34.0263 1444 nvstor - ok
15:41:34.0294 1444 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
15:41:34.0296 1444 nv_agp - ok
15:41:34.0312 1444 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
15:41:34.0314 1444 ohci1394 - ok
15:41:34.0440 1444 ose64 (4965b005492cba7719e82b71e3245495) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
15:41:34.0446 1444 ose64 - ok
15:41:34.0828 1444 osppsvc (61bffb5f57ad12f83ab64b7181829b34) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
15:41:34.0963 1444 osppsvc - ok
15:41:35.0166 1444 p2pimsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
15:41:35.0203 1444 p2pimsvc - ok
15:41:35.0237 1444 p2psvc (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll
15:41:35.0298 1444 p2psvc - ok
15:41:35.0339 1444 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
15:41:35.0341 1444 Parport - ok
15:41:35.0417 1444 partmgr (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys
15:41:35.0419 1444 partmgr - ok
15:41:35.0442 1444 PcaSvc (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll
15:41:35.0455 1444 PcaSvc - ok
15:41:35.0482 1444 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
15:41:35.0489 1444 pci - ok
15:41:35.0514 1444 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
15:41:35.0515 1444 pciide - ok
15:41:35.0543 1444 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
15:41:35.0549 1444 pcmcia - ok
15:41:50.0475 1444 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
15:41:50.0477 1444 pcw - ok
15:41:50.0758 1444 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
15:41:50.0766 1444 PEAUTH - ok
15:41:50.0892 1444 PeerDistSvc (b9b0a4299dd2d76a4243f75fd54dc680) C:\Windows\system32\peerdistsvc.dll
15:41:50.0936 1444 PeerDistSvc - ok
15:41:51.0050 1444 PerfHost (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe
15:41:51.0052 1444 PerfHost - ok
15:41:51.0258 1444 pla (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll
15:41:51.0362 1444 pla - ok
15:41:53.0232 1444 PlugPlay (b806e50427511bcf4ad8e8239c3e25fa) C:\Windows\system32\umpnpmgr.dll
15:41:53.0285 1444 PlugPlay - ok
15:41:53.0319 1444 PnkBstrA - ok
15:41:53.0353 1444 PNRPAutoReg (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll
15:41:53.0356 1444 PNRPAutoReg - ok
15:41:53.0381 1444 PNRPsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
15:41:53.0385 1444 PNRPsvc - ok
15:41:53.0464 1444 PolicyAgent (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll
15:41:53.0470 1444 PolicyAgent - ok
15:41:53.0636 1444 Power (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll
15:41:53.0640 1444 Power - ok
15:41:53.0704 1444 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
15:41:53.0706 1444 PptpMiniport - ok
15:41:53.0726 1444 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
15:41:53.0727 1444 Processor - ok
15:41:53.0795 1444 ProfSvc (5c78838b4d166d1a27db3a8a820c799a) C:\Windows\system32\profsvc.dll
15:41:53.0799 1444 ProfSvc - ok
15:41:53.0828 1444 ProtectedStorage (0793f40b9b8a1bdd266296409dbd91ea) C:\Windows\system32\lsass.exe
15:41:53.0830 1444 ProtectedStorage - ok
15:41:53.0894 1444 Psched (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
15:41:53.0899 1444 Psched - ok
15:41:54.0055 1444 PSI_SVC_2 (543a4ef0923bf70d126625b034ef25af) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
15:41:54.0096 1444 PSI_SVC_2 - ok
15:41:57.0247 1444 PxHlpa64 (4712cc14e720ecccc0aa16949d18aaf1) C:\Windows\system32\Drivers\PxHlpa64.sys
15:41:57.0324 1444 PxHlpa64 - ok
15:41:57.0680 1444 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
15:41:57.0753 1444 ql2300 - ok
15:41:57.0889 1444 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
15:41:57.0891 1444 ql40xx - ok
15:41:57.0945 1444 QWAVE (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll
15:41:57.0950 1444 QWAVE - ok
15:41:57.0959 1444 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
15:41:57.0961 1444 QWAVEdrv - ok
15:41:57.0965 1444 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
15:41:57.0966 1444 RasAcd - ok
15:41:58.0056 1444 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
15:41:58.0058 1444 RasAgileVpn - ok
15:41:58.0084 1444 RasAuto (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll
15:41:58.0091 1444 RasAuto - ok
15:41:58.0142 1444 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
15:41:58.0144 1444 Rasl2tp - ok
15:41:58.0162 1444 RasMan (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll
15:41:58.0209 1444 RasMan - ok
15:41:58.0239 1444 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
15:41:58.0241 1444 RasPppoe - ok
15:41:58.0253 1444 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
15:41:58.0254 1444 RasSstp - ok
15:41:58.0303 1444 rdbss (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
15:41:58.0324 1444 rdbss - ok
15:41:58.0365 1444 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
15:41:58.0367 1444 rdpbus - ok
15:41:58.0380 1444 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
15:41:58.0381 1444 RDPCDD - ok
15:41:58.0448 1444 RDPDR (1b6163c503398b23ff8b939c67747683) C:\Windows\system32\drivers\rdpdr.sys
15:41:58.0454 1444 RDPDR - ok
15:41:58.0473 1444 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
15:41:58.0474 1444 RDPENCDD - ok
15:41:58.0486 1444 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
15:41:58.0487 1444 RDPREFMP - ok
15:41:58.0529 1444 RDPWD (15b66c206b5cb095bab980553f38ed23) C:\Windows\system32\drivers\RDPWD.sys
15:41:58.0567 1444 RDPWD - ok
15:41:58.0675 1444 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
15:41:58.0722 1444 rdyboost - ok
15:41:58.0747 1444 RemoteAccess (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll
15:41:58.0750 1444 RemoteAccess - ok
15:41:58.0764 1444 RemoteRegistry (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll
15:41:58.0779 1444 RemoteRegistry - ok
15:41:58.0937 1444 RpcEptMapper (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll
15:41:58.0940 1444 RpcEptMapper - ok
15:41:58.0969 1444 RpcLocator (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe
15:41:58.0971 1444 RpcLocator - ok
15:41:59.0021 1444 RpcSs (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
15:41:59.0025 1444 RpcSs - ok
15:41:59.0065 1444 RsFx0105 - ok
15:41:59.0085 1444 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
15:41:59.0087 1444 rspndr - ok
15:41:59.0132 1444 s3cap (e60c0a09f997826c7627b244195ab581) C:\Windows\system32\drivers\vms3cap.sys
15:41:59.0133 1444 s3cap - ok
15:41:59.0150 1444 SamSs (0793f40b9b8a1bdd266296409dbd91ea) C:\Windows\system32\lsass.exe
15:41:59.0152 1444 SamSs - ok
15:41:59.0222 1444 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
15:41:59.0224 1444 sbp2port - ok
15:41:59.0248 1444 SCardSvr (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll
15:41:59.0288 1444 SCardSvr - ok
15:41:59.0393 1444 SCDEmu (6ce6f98ea3d07a9c2ce3cd0a5a86352d) C:\Windows\system32\drivers\SCDEmu.sys
15:41:59.0433 1444 SCDEmu - ok
15:41:59.0509 1444 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
15:41:59.0511 1444 scfilter - ok
15:41:59.0670 1444 Schedule (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll
15:41:59.0829 1444 Schedule - ok
15:42:00.0175 1444 SCPolicySvc (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
15:42:00.0176 1444 SCPolicySvc - ok
15:42:00.0205 1444 SDRSVC (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll
15:42:00.0236 1444 SDRSVC - ok
15:42:01.0222 1444 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
15:42:01.0223 1444 secdrv - ok
15:42:01.0232 1444 seclogon (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll
15:42:01.0234 1444 seclogon - ok
15:42:01.0248 1444 SENS (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\system32\sens.dll
15:42:01.0250 1444 SENS - ok
15:42:01.0267 1444 SensrSvc (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll
15:42:01.0270 1444 SensrSvc - ok
15:42:01.0276 1444 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
15:42:01.0277 1444 Serenum - ok
15:42:01.0288 1444 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
15:42:01.0290 1444 Serial - ok
15:42:01.0311 1444 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
15:42:01.0312 1444 sermouse - ok
15:42:01.0416 1444 SessionEnv (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll
15:42:01.0420 1444 SessionEnv - ok
15:42:01.0444 1444 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
15:42:01.0445 1444 sffdisk - ok
15:42:01.0463 1444 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
15:42:01.0464 1444 sffp_mmc - ok
15:42:01.0479 1444 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
15:42:01.0480 1444 sffp_sd - ok
15:42:01.0518 1444 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
15:42:01.0519 1444 sfloppy - ok
15:42:01.0575 1444 SharedAccess (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll
15:42:01.0595 1444 SharedAccess - ok
15:42:01.0713 1444 ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll
15:42:01.0721 1444 ShellHWDetection - ok
15:42:01.0907 1444 ShuttleEngine (0711f1b4a078ff2c49b468f1cb126825) C:\Program Files (x86)\Contour Shuttle\ShuttleEngine.exe
15:42:01.0934 1444 ShuttleEngine - ok
15:42:01.0958 1444 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
15:42:01.0959 1444 SiSRaid2 - ok
15:42:01.0976 1444 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
15:42:01.0977 1444 SiSRaid4 - ok
15:42:01.0991 1444 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
15:42:01.0993 1444 Smb - ok
15:42:02.0041 1444 SNMPTRAP (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe
15:42:02.0044 1444 SNMPTRAP - ok
15:42:02.0087 1444 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
15:42:02.0089 1444 spldr - ok
15:42:02.0148 1444 Spooler (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe
15:42:02.0175 1444 Spooler - ok
15:42:03.0133 1444 sppsvc (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe
15:42:03.0274 1444 sppsvc - ok
15:42:03.0414 1444 sppuinotify (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll
15:42:03.0416 1444 sppuinotify - ok
15:42:03.0571 1444 sptd (602884696850c86434530790b110e8eb) C:\Windows\system32\Drivers\sptd.sys
15:42:03.0572 1444 Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: 602884696850c86434530790b110e8eb
15:42:03.0621 1444 sptd ( LockedFile.Multi.Generic ) - warning
15:42:03.0621 1444 sptd - detected LockedFile.Multi.Generic (1)
15:42:03.0731 1444 SQLAgent$SQLEXPRESS - ok
15:42:03.0787 1444 SQLBrowser - ok
15:42:03.0836 1444 SQLWriter - ok
15:42:03.0892 1444 srv (2098b8556d1cec2aca9a29cd479e3692) C:\Windows\system32\DRIVERS\srv.sys
15:42:03.0902 1444 srv - ok
15:42:04.0041 1444 srv2 (d0f73a42040f21f92fd314b42ac5c9e7) C:\Windows\system32\DRIVERS\srv2.sys
15:42:04.0054 1444 srv2 - ok
15:42:04.0167 1444 srvnet (2ba8f3250828ccdb4204ecf2c6f40b6a) C:\Windows\system32\DRIVERS\srvnet.sys
15:42:04.0173 1444 srvnet - ok
15:42:04.0222 1444 SSDPSRV (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll
15:42:04.0236 1444 SSDPSRV - ok
15:42:04.0296 1444 SstpSvc (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll
15:42:04.0299 1444 SstpSvc - ok
15:42:04.0348 1444 ss_bbus (ef806d212d34b0e173baeb3564d53e37) C:\Windows\system32\DRIVERS\ss_bbus.sys
15:42:04.0355 1444 ss_bbus - ok
15:42:04.0399 1444 ss_bmdfl (08b1b34abebeb6ac2dea06900c56411e) C:\Windows\system32\DRIVERS\ss_bmdfl.sys
15:42:04.0400 1444 ss_bmdfl - ok
15:42:04.0435 1444 ss_bmdm (71a9da6beaa4cb54dfb827fb78600a5d) C:\Windows\system32\DRIVERS\ss_bmdm.sys
15:42:04.0441 1444 ss_bmdm - ok
15:42:04.0495 1444 ss_bserd (677cdc98f8363accaae783fde1599c2a) C:\Windows\system32\DRIVERS\ss_bserd.sys
15:42:04.0498 1444 ss_bserd - ok
15:42:04.0633 1444 STacSV (c15e5df1f7f4d0748242c6f2df2915a4) c:\program files\idt\wdm\STacSV64.exe
15:42:04.0648 1444 STacSV - ok
15:42:04.0669 1444 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
15:42:04.0671 1444 stexstor - ok
15:42:04.0735 1444 STHDA (40226663652a2fdc90652f0173e04d21) C:\Windows\system32\DRIVERS\stwrt64.sys
15:42:04.0754 1444 STHDA - ok
15:42:04.0865 1444 stisvc (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll
15:42:04.0875 1444 stisvc - ok
15:42:05.0188 1444 storflt (7785dc213270d2fc066538daf94087e7) C:\Windows\system32\drivers\vmstorfl.sys
15:42:05.0190 1444 storflt - ok
15:42:05.0249 1444 StorSvc (c40841817ef57d491f22eb103da587cc) C:\Windows\system32\storsvc.dll
15:42:05.0252 1444 StorSvc - ok
15:42:05.0271 1444 storvsc (d34e4943d5ac096c8edeebfd80d76e23) C:\Windows\system32\drivers\storvsc.sys
15:42:05.0273 1444 storvsc - ok
15:42:05.0324 1444 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
15:42:05.0326 1444 swenum - ok
15:42:05.0488 1444 SwitchBoard (f577910a133a592234ebaad3f3afa258) C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
15:42:05.0579 1444 SwitchBoard - ok
15:42:05.0627 1444 swprv (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll
15:42:05.0645 1444 swprv - ok
15:42:05.0872 1444 SysMain (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll
15:42:05.0906 1444 SysMain - ok
15:42:06.0116 1444 TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll
15:42:06.0119 1444 TabletInputService - ok
15:42:06.0215 1444 TapiSrv (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll
15:42:06.0240 1444 TapiSrv - ok
15:42:06.0271 1444 TBS (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll
15:42:06.0274 1444 TBS - ok
15:42:06.0457 1444 Tcpip (509383e505c973ed7534a06b3d19688d) C:\Windows\system32\drivers\tcpip.sys
15:42:06.0515 1444 Tcpip - ok
15:42:06.0949 1444 TCPIP6 (509383e505c973ed7534a06b3d19688d) C:\Windows\system32\DRIVERS\tcpip.sys
15:42:06.0959 1444 TCPIP6 - ok
15:42:07.0182 1444 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
15:42:07.0183 1444 tcpipreg - ok
15:42:07.0209 1444 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
15:42:07.0210 1444 TDPIPE - ok
15:42:07.0274 1444 TDTCP (7518f7bcfd4b308abc9192bacaf6c970) C:\Windows\system32\drivers\tdtcp.sys
15:42:07.0275 1444 TDTCP - ok
15:42:07.0312 1444 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
15:42:07.0319 1444 tdx - ok
15:42:07.0372 1444 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
15:42:07.0373 1444 TermDD - ok
15:42:07.0475 1444 TermService (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll
15:42:07.0505 1444 TermService - ok
15:42:07.0679 1444 TFsExDisk (ce4b6956e4e12492715a53076e58761f) C:\Windows\System32\Drivers\TFsExDisk.sys
15:42:07.0690 1444 TFsExDisk - ok
15:42:07.0712 1444 Themes (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll
15:42:07.0714 1444 Themes - ok
15:42:07.0736 1444 THREADORDER (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
15:42:07.0738 1444 THREADORDER - ok
15:42:07.0754 1444 TrkWks (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll
15:42:07.0761 1444 TrkWks - ok
15:42:07.0794 1444 TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe
15:42:07.0801 1444 TrustedInstaller - ok
15:42:07.0879 1444 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
15:42:07.0880 1444 tssecsrv - ok
15:42:07.0956 1444 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
15:42:07.0958 1444 TsUsbFlt - ok
15:42:07.0999 1444 tunnel (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
15:42:08.0001 1444 tunnel - ok
15:42:08.0021 1444 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
15:42:08.0023 1444 uagp35 - ok
15:42:08.0130 1444 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
15:42:08.0135 1444 udfs - ok
15:42:08.0191 1444 UI0Detect (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe
15:42:08.0194 1444 UI0Detect - ok
15:42:08.0221 1444 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
15:42:08.0241 1444 uliagpkx - ok
15:42:08.0294 1444 umbus (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys
15:42:08.0296 1444 umbus - ok