Skocz do zawartości
Zaloguj się, aby obserwować  
logimen

Prośba o analize logow

Polecane posty

Witam,

 

 

 

 

Na laptopie rodzicow jest cala zgraja roznego badziewia. Doszlo nawet do tego, ze ze 3 przelewy elektroniczne "poszly w kosmos" z matki firmowego konta bo ojciec tak dbal o kompa.

 

Dlatego przeskanowalem sobie desktopa i prosze o sprawdzenie dwoch logow. Pozniej wrzuce jeszcze logi z laptopa.

 

P.S. co teraz zrobic w takiej sytuacji ? Zmieniac PIN do konta czy wogole konto cale zmienic ? pierwszy raz mamy taka sytuacje przez ojca niedbalstwo bo klika we wszystko co wyskoczy, a na laptopie byl i nadal jest legalny KAV 9.x z bazamia uaktualnianymi co godzine. Wszystkie zapory i moduly wlaczone 8O

 

 

Log z GMer'a

 

 

 

 

GMER 1.0.15.15570 - GMER - Rootkit Detector and Remover

Rootkit scan 2011-04-23 09:44:06

Windows 6.1.7600 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 WDC_WD2500JS-00NCB1 rev.10.02E02

Running: kfgrpwpp.exe; Driver: C:\Users\logimen\AppData\Local\Temp\axliafod.sys

 

 

---- Kernel code sections - GMER 1.0.15 ----

 

.text ntkrnlpa.exe!ZwSaveKeyEx + 13BD 82C809A9 1 Byte [06]

.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 82CBA212 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}

? System32\Drivers\spns.sys System nie może odnaleźć określonej ścieżki. !

.text USBPORT.SYS!DllUnload 91FAACA0 5 Bytes JMP 8688C4E0

.text apq22qzy.SYS 90D45000 12 Bytes [44, C8, C0, 82, EE, C6, C0, ...]

.text apq22qzy.SYS 90D4500D 9 Bytes [A7, C0, 82, 48, CB, C0, 82, ...]

.text apq22qzy.SYS 90D45017 20 Bytes [00, DE, C7, B8, 8B, E6, C5, ...]

.text apq22qzy.SYS 90D4502C 149 Bytes [00, 00, 00, 00, F0, B5, C7, ...]

.text apq22qzy.SYS 90D450C3 8 Bytes [00, 00, 00, 00, 00, 00, 00, ...] {ADD [EAX], AL; ADD [EAX], AL; ADD [EAX], AL; ADD [EAX], AL}

.text ...

? C:\Users\logimen\AppData\Local\Temp\ALSysIO.sys Nie można odnaleźć określonego pliku. !

 

---- User code sections - GMER 1.0.15 ----

 

.text C:\Windows\notepad.exe[1660] ole32.dll!CoCreateInstance 7686590C 5 Bytes JMP 0012A390 C:\Windows\system\HsSrv.dll (HsSrv Dynamic Link Library/C-Media Electronics Inc.)

.text C:\Windows\notepad.exe[1660] ole32.dll!CoCreateInstanceEx 7686594F 5 Bytes JMP 0012A4F0 C:\Windows\system\HsSrv.dll (HsSrv Dynamic Link Library/C-Media Electronics Inc.)

.text C:\Windows\system32\taskeng.exe[1752] ole32.dll!CoCreateInstance 7686590C 5 Bytes JMP 0094A390 C:\Windows\system\HsSrv.dll (HsSrv Dynamic Link Library/C-Media Electronics Inc.)

.text C:\Windows\system32\taskeng.exe[1752] ole32.dll!CoCreateInstanceEx 7686594F 5 Bytes JMP 0094A4F0 C:\Windows\system\HsSrv.dll (HsSrv Dynamic Link Library/C-Media Electronics Inc.)

.text C:\Program Files\ESET\ESET Smart Security\ekrn.exe[1840] kernel32.dll!SetUnhandledExceptionFilter 76FE3162 4 Bytes [C2, 04, 00, 00]

.text C:\Program Files\MSI Afterburner\MSIAfterburner.exe[1920] ole32.dll!CoCreateInstance 7686590C 5 Bytes JMP 01E5A390 C:\Windows\system\HsSrv.dll (HsSrv Dynamic Link Library/C-Media Electronics Inc.)

.text C:\Program Files\MSI Afterburner\MSIAfterburner.exe[1920] ole32.dll!CoCreateInstanceEx 7686594F 5 Bytes JMP 01E5A4F0 C:\Windows\system\HsSrv.dll (HsSrv Dynamic Link Library/C-Media Electronics Inc.)

.text C:\Users\logimen\Desktop\Inne\CoreTemp\Core Temp.exe[1932] ole32.dll!CoCreateInstance 7686590C 5 Bytes JMP 018DA390 C:\Windows\system\HsSrv.dll (HsSrv Dynamic Link Library/C-Media Electronics Inc.)

.text C:\Users\logimen\Desktop\Inne\CoreTemp\Core Temp.exe[1932] ole32.dll!CoCreateInstanceEx 7686594F 5 Bytes JMP 018DA4F0 C:\Windows\system\HsSrv.dll (HsSrv Dynamic Link Library/C-Media Electronics Inc.)

.text C:\Windows\system32\taskhost.exe[2012] ole32.dll!CoCreateInstance 7686590C 5 Bytes JMP 01C7A390 C:\Windows\system\HsSrv.dll (HsSrv Dynamic Link Library/C-Media Electronics Inc.)

.text C:\Windows\system32\taskhost.exe[2012] ole32.dll!CoCreateInstanceEx 7686594F 5 Bytes JMP 01C7A4F0 C:\Windows\system\HsSrv.dll (HsSrv Dynamic Link Library/C-Media Electronics Inc.)

.text C:\Program Files\ESET\ESET Smart Security\egui.exe[2200] ole32.dll!CoCreateInstance 7686590C 5 Bytes JMP 1000A390 C:\Windows\system\HsSrv.dll (HsSrv Dynamic Link Library/C-Media Electronics Inc.)

.text C:\Program Files\ESET\ESET Smart Security\egui.exe[2200] ole32.dll!CoCreateInstanceEx 7686594F 5 Bytes JMP 1000A4F0 C:\Windows\system\HsSrv.dll (HsSrv Dynamic Link Library/C-Media Electronics Inc.)

.text C:\Windows\system\HsMgr.exe[2216] ole32.dll!CoCreateInstance 7686590C 5 Bytes JMP 1000A390 C:\Windows\system\HsSrv.dll (HsSrv Dynamic Link Library/C-Media Electronics Inc.)

.text C:\Windows\system\HsMgr.exe[2216] ole32.dll!CoCreateInstanceEx 7686594F 5 Bytes JMP 1000A4F0 C:\Windows\system\HsSrv.dll (HsSrv Dynamic Link Library/C-Media Electronics Inc.)

.text C:\Program Files\Windows Sidebar\sidebar.exe[2236] ole32.dll!CoCreateInstance 7686590C 5 Bytes JMP 1000A390 C:\Windows\system\HsSrv.dll (HsSrv Dynamic Link Library/C-Media Electronics Inc.)

.text C:\Program Files\Windows Sidebar\sidebar.exe[2236] ole32.dll!CoCreateInstanceEx 7686594F 5 Bytes JMP 1000A4F0 C:\Windows\system\HsSrv.dll (HsSrv Dynamic Link Library/C-Media Electronics Inc.)

.text C:\Program Files\DAEMON Tools Lite\DTLite.exe[2256] ole32.dll!CoCreateInstance 7686590C 5 Bytes JMP 01D4A390 C:\Windows\system\HsSrv.dll (HsSrv Dynamic Link Library/C-Media Electronics Inc.)

.text C:\Program Files\DAEMON Tools Lite\DTLite.exe[2256] ole32.dll!CoCreateInstanceEx 7686594F 5 Bytes JMP 01D4A4F0 C:\Windows\system\HsSrv.dll (HsSrv Dynamic Link Library/C-Media Electronics Inc.)

.text C:\Users\logimen\Desktop\AVS\kfgrpwpp.exe[2524] ole32.dll!CoCreateInstance 7686590C 5 Bytes JMP 002EA390 C:\Windows\system\HsSrv.dll (HsSrv Dynamic Link Library/C-Media Electronics Inc.)

.text C:\Users\logimen\Desktop\AVS\kfgrpwpp.exe[2524] ole32.dll!CoCreateInstanceEx 7686594F 5 Bytes JMP 002EA4F0 C:\Windows\system\HsSrv.dll (HsSrv Dynamic Link Library/C-Media Electronics Inc.)

.text C:\Program Files\MSI Afterburner\Bundle\OSDServer\RTSS.exe[2620] ole32.dll!CoCreateInstance 7686590C 5 Bytes JMP 003CA390 C:\Windows\system\HsSrv.dll (HsSrv Dynamic Link Library/C-Media Electronics Inc.)

.text C:\Program Files\MSI Afterburner\Bundle\OSDServer\RTSS.exe[2620] ole32.dll!CoCreateInstanceEx 7686594F 5 Bytes JMP 003CA4F0 C:\Windows\system\HsSrv.dll (HsSrv Dynamic Link Library/C-Media Electronics Inc.)

 

---- Kernel IAT/EAT - GMER 1.0.15 ----

 

IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUchar] [8BA90042] \SystemRoot\System32\Drivers\spns.sys

IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortUchar] [8BA906D6] \SystemRoot\System32\Drivers\spns.sys

IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortBufferUshort] [8BA90800] \SystemRoot\System32\Drivers\spns.sys

IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortBufferUshort] [8BA9013E] \SystemRoot\System32\Drivers\spns.sys

IAT \SystemRoot\System32\Drivers\apq22qzy.SYS[ataport.SYS!AtaPortNotification] 00147880

IAT \SystemRoot\System32\Drivers\apq22qzy.SYS[ataport.SYS!AtaPortQuerySystemTime] 78800C75

IAT \SystemRoot\System32\Drivers\apq22qzy.SYS[ataport.SYS!AtaPortReadPortUchar] 06750015

IAT \SystemRoot\System32\Drivers\apq22qzy.SYS[ataport.SYS!AtaPortStallExecution] C25DC033

IAT \SystemRoot\System32\Drivers\apq22qzy.SYS[ataport.SYS!AtaPortWritePortUchar] 458B0008

IAT \SystemRoot\System32\Drivers\apq22qzy.SYS[ataport.SYS!AtaPortWritePortUlong] 6A006A08

IAT \SystemRoot\System32\Drivers\apq22qzy.SYS[ataport.SYS!AtaPortGetPhysicalAddress] 50056A24

IAT \SystemRoot\System32\Drivers\apq22qzy.SYS[ataport.SYS!AtaPortConvertPhysicalAddressToUlong] 005AB7E8

IAT \SystemRoot\System32\Drivers\apq22qzy.SYS[ataport.SYS!AtaPortGetScatterGatherList] 0001B800

IAT \SystemRoot\System32\Drivers\apq22qzy.SYS[ataport.SYS!AtaPortGetParentBusType] C25D0000

IAT \SystemRoot\System32\Drivers\apq22qzy.SYS[ataport.SYS!AtaPortRequestCallback] CCCC0008

IAT \SystemRoot\System32\Drivers\apq22qzy.SYS[ataport.SYS!AtaPortWritePortBufferUshort] CCCCCCCC

IAT \SystemRoot\System32\Drivers\apq22qzy.SYS[ataport.SYS!AtaPortGetUnCachedExtension] CCCCCCCC

IAT \SystemRoot\System32\Drivers\apq22qzy.SYS[ataport.SYS!AtaPortCompleteRequest] CCCCCCCC

IAT \SystemRoot\System32\Drivers\apq22qzy.SYS[ataport.SYS!AtaPortCopyMemory] 53EC8B55

IAT \SystemRoot\System32\Drivers\apq22qzy.SYS[ataport.SYS!AtaPortEtwTraceLog] 800C5D8B

IAT \SystemRoot\System32\Drivers\apq22qzy.SYS[ataport.SYS!AtaPortCompleteAllActiveRequests] 7500117B

IAT \SystemRoot\System32\Drivers\apq22qzy.SYS[ataport.SYS!AtaPortReleaseRequestSenseIrb] 127B806A

IAT \SystemRoot\System32\Drivers\apq22qzy.SYS[ataport.SYS!AtaPortBuildRequestSenseIrb] 80647500

IAT \SystemRoot\System32\Drivers\apq22qzy.SYS[ataport.SYS!AtaPortReadPortBufferUshort] 7500137B

IAT \SystemRoot\System32\Drivers\apq22qzy.SYS[ataport.SYS!AtaPortInitialize] 157B805E

IAT \SystemRoot\System32\Drivers\apq22qzy.SYS[ataport.SYS!AtaPortGetDeviceBase] 56587500

IAT \SystemRoot\System32\Drivers\apq22qzy.SYS[ataport.SYS!AtaPortDeviceStateChange] 8008758B

 

---- Devices - GMER 1.0.15 ----

 

Device \FileSystem\Ntfs \Ntfs 8575D1F8

 

AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys (Amon monitor/ESET)

 

Device \FileSystem\fastfat \FatCdrom 879BE1F8

Device \FileSystem\udfs \UdfsCdRom 87EBF1F8

Device \FileSystem\udfs \UdfsDisk 87EBF1F8

Device \Driver\volmgr \Device\VolMgrControl 857591F8

Device \Driver\usbuhci \Device\USBPDO-0 86889500

Device \Driver\sptd \Device\1298531199 spns.sys

Device \Driver\ACPI_HAL \Device\00000051 halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

Device \Driver\usbuhci \Device\USBPDO-1 86889500

Device \Driver\NetBT \Device\NetBT_Tcpip_{DDC7405D-72C8-4606-A2F9-47A6549C934E} 868031F8

Device \Driver\usbuhci \Device\USBPDO-2 86889500

Device \Driver\usbehci \Device\USBPDO-3 86867500

Device \Driver\usbuhci \Device\USBPDO-4 86889500

Device \Driver\usbuhci \Device\USBPDO-5 86889500

Device \Driver\usbuhci \Device\USBPDO-6 86889500

Device \Driver\volmgr \Device\HarddiskVolume1 857591F8

 

AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

 

Device \Driver\usbehci \Device\USBPDO-7 86867500

Device \Driver\volmgr \Device\HarddiskVolume2 857591F8

 

AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

 

Device \Driver\cdrom \Device\CdRom0 867941F8

Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-0 8575B1F8

Device \Driver\atapi \Device\Ide\IdePort0 8575B1F8

Device \Driver\atapi \Device\Ide\IdePort1 8575B1F8

Device \Driver\atapi \Device\Ide\IdePort2 8575B1F8

Device \Driver\atapi \Device\Ide\IdePort3 8575B1F8

Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-1 8575B1F8

Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-2 8575B1F8

Device \Driver\volmgr \Device\HarddiskVolume3 857591F8

 

AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

 

Device \Driver\cdrom \Device\CdRom1 867941F8

Device \Driver\volmgr \Device\HarddiskVolume4 857591F8

 

AttachedDevice \Driver\volmgr \Device\HarddiskVolume4 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

 

Device \Driver\cdrom \Device\CdRom2 867941F8

Device \Driver\volmgr \Device\HarddiskVolume5 857591F8

 

AttachedDevice \Driver\volmgr \Device\HarddiskVolume5 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

 

Device \Driver\volmgr \Device\HarddiskVolume6 857591F8

 

AttachedDevice \Driver\volmgr \Device\HarddiskVolume6 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

 

Device \Driver\volmgr \Device\HarddiskVolume7 857591F8

 

AttachedDevice \Driver\volmgr \Device\HarddiskVolume7 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

 

Device \Driver\NetBT \Device\NetBt_Wins_Export 868031F8

Device \Driver\volmgr \Device\HarddiskVolume8 857591F8

 

AttachedDevice \Driver\volmgr \Device\HarddiskVolume8 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

 

Device \Driver\volmgr \Device\HarddiskVolume9 857591F8

 

AttachedDevice \Driver\volmgr \Device\HarddiskVolume9 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

 

Device \Driver\PCI_PNP3198 \Device\0000005b spns.sys

Device \Driver\usbuhci \Device\USBFDO-0 86889500

Device \Driver\usbuhci \Device\USBFDO-1 86889500

Device \Driver\usbuhci \Device\USBFDO-2 86889500

Device \Driver\usbehci \Device\USBFDO-3 86867500

Device \Driver\usbuhci \Device\USBFDO-4 86889500

Device \Driver\usbuhci \Device\USBFDO-5 86889500

Device \Driver\usbuhci \Device\USBFDO-6 86889500

Device \Driver\usbehci \Device\USBFDO-7 86867500

Device \Driver\apq22qzy \Device\Scsi\apq22qzy1Port4Path0Target1Lun0 86A941F8

Device \Driver\apq22qzy \Device\Scsi\apq22qzy1 86A941F8

Device \Driver\apq22qzy \Device\Scsi\apq22qzy1Port4Path0Target0Lun0 86A941F8

Device \FileSystem\fastfat \Fat 879BE1F8

 

AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Menedżer filtrów systemu plików firmy Microsoft/Microsoft Corporation)

AttachedDevice \FileSystem\fastfat \Fat eamon.sys (Amon monitor/ESET)

 

---- Registry - GMER 1.0.15 ----

 

Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00134600683c

Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s1 771343423

Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s2 285507792

Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@h0 1

Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC

Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\

Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ...

Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0

Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xCA 0xAB 0xC8 0x47 ...

Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001

Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...

Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x14 0xA5 0x72 0x28 ...

Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0

Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xE6 0x77 0xD4 0xDB ...

Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1

Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12 0x29 0xE4 0x12 0x43 ...

Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System

Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OODEFRAG14.00.00.01PROFESSIONAL FBD067C00BD895B05FC90878FA1A9120949C2EA603FB894FFCD53C2417126901B84C7BA17D8A21FC3011DAF2DE0128852BA936B160230E20F2A0322FD9A320AD8EDD272F0A0317D506D49A026D1FDEBD3880CA5B1A1DE60E443247082B978351FCA99E6FC4A86294EF0615DE1F390A677F7E72AFA3AB71A00373DA33A14C1D768546B8790415D46802883AD629C4E377C3F6D652B742EF2EC6C5EE499652D5FAAFC172786397A0D3D3B69F4B086E8835CE2DC677528A88E5267BAB72A8EE7F10859B6C3042B3E0AE815DFC327D157A3C6CDE32ECB5DF4746415AD970B91DCB3D96476871439D1122A93CB0948C4D9F7CECB6308DE6D29825371F6A1670FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B98089DB7CE019D40AA5CA2D97226D213B555A2D97226D213B5552A0DDEA8C492D778112C7252E6D6DD6D950CC2D6963238AABF0F429D660660E7F840F1AE18856AE2316AA9DA9E13F0075137B4F504A4DD33056233140FC3F182C7FDD8E6C395ACAF4EC0F3A42FF678013CED437A00A52BC3A444A196FA78D963DE017CBAB0AFF4FCB0731D688ACABD983A1F4111AAF381DD406C056218FCAD6AC06D97973665AEACD3AF466498F7A151641FD46898F55543AFF628B6C6CE96BC204639EC24ECD6626A82E259B30E976F09A4F

Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32

Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ThreadingModel Apartment

Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ C:\Windows\system32\OLE32.DLL

Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@cd042efbbd7f7af1647644e76e06692b 0xE2 0x63 0x26 0xF1 ...

Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32

Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ThreadingModel Apartment

Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ C:\Windows\system32\OLE32.DLL

Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@bca643cdc5c2726b20d2ecedcc62c59b 0x71 0x3B 0x04 0x66 ...

Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32

Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ThreadingModel Apartment

Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ C:\Windows\system32\OLE32.DLL

Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@2c81e34222e8052573023a60d06dd016 0x25 0xDA 0xEC 0x7E ...

Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32

Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ThreadingModel Apartment

Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ C:\Windows\system32\OLE32.DLL

Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@2582ae41fb52324423be06337561aa48 0x86 0x8C 0x21 0x01 ...

Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32

Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ThreadingModel Apartment

Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ C:\Windows\system32\OLE32.DLL

Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@caaeda5fd7a9ed7697d9686d4b818472 0xF5 0x1D 0x4D 0x73 ...

Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32

Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ThreadingModel Apartment

Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ C:\Windows\system32\OLE32.DLL

Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@a4a1bcf2cc2b8bc3716b74b2b4522f5d 0xB0 0x18 0xED 0xA7 ...

Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32

Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ThreadingModel Apartment

Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ C:\Windows\system32\OLE32.DLL

Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@4d370831d2c43cd13623e232fed27b7b 0xFB 0xA7 0x78 0xE6 ...

Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32

Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ThreadingModel Apartment

Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ C:\Windows\system32\OLE32.DLL

Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@1d68fe701cdea33e477eb204b76f993d 0x01 0x3A 0x48 0xFC ...

Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32

Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ThreadingModel Apartment

Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ C:\Windows\system32\OLE32.DLL

Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@1fac81b91d8e3c5aa4b0a51804d844a3 0x51 0xFA 0x6E 0x91 ...

Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32

Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ThreadingModel Apartment

Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ C:\Windows\system32\OLE32.DLL

Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@f5f62a6129303efb32fbe080bb27835b 0xB1 0xCD 0x45 0x5A ...

Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32

Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ThreadingModel Apartment

Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ C:\Windows\system32\OLE32.DLL

Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@fd4e2e1a3940b94dceb5a6a021f2e3c6 0xF8 0x31 0x0F 0xA9 ...

Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32

Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ThreadingModel Apartment

Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ C:\Windows\system32\OLE32.DLL

Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@8a8aec57dd6508a385616fbc86791ec2 0x6C 0x43 0x2D 0x1E ...

 

---- EOF - GMER 1.0.15 ----

 

 

 

 

 

 

Log z OTL'a

 

 

 

 

 

OTL logfile created on: 2011-04-23 09:25:47 - Run 1

OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\logimen\Desktop\AVS

Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd

 

3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 66,00% Memory free

6,00 Gb Paging File | 6,00 Gb Available in Paging File | 85,00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 37,57 Gb Total Space | 10,47 Gb Free Space | 27,86% Space Free | Partition Type: NTFS

Drive D: | 150,00 Gb Total Space | 24,31 Gb Free Space | 16,21% Space Free | Partition Type: NTFS

Drive E: | 269,96 Gb Total Space | 40,39 Gb Free Space | 14,96% Space Free | Partition Type: NTFS

Drive F: | 69,09 Gb Total Space | 50,96 Gb Free Space | 73,76% Space Free | Partition Type: FAT32

Drive G: | 19,53 Gb Total Space | 19,44 Gb Free Space | 99,52% Space Free | Partition Type: NTFS

Drive H: | 19,52 Gb Total Space | 10,32 Gb Free Space | 52,86% Space Free | Partition Type: FAT32

Drive I: | 67,07 Gb Total Space | 47,54 Gb Free Space | 70,88% Space Free | Partition Type: NTFS

Drive J: | 20,06 Gb Total Space | 12,91 Gb Free Space | 64,37% Space Free | Partition Type: FAT32

Drive Z: | 7,76 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF

 

Computer Name: LOGIMEN-PC | User Name: logimen | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 

========== Processes (SafeList) ==========

 

PRC - [2011-04-23 08:55:52 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\logimen\Desktop\AVS\OTL.exe

PRC - [2011-04-07 22:44:48 | 000,841,832 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe

PRC - [2011-03-25 09:51:30 | 000,143,360 | ---- | M] () -- C:\Program Files\MSI Afterburner\Bundle\OSDServer\RTSS.exe

PRC - [2011-03-18 11:17:22 | 000,368,640 | ---- | M] () -- C:\Program Files\MSI Afterburner\MSIAfterburner.exe

PRC - [2010-10-03 02:13:42 | 000,470,544 | ---- | M] () -- C:\Users\logimen\Desktop\Inne\CoreTemp\Core Temp.exe

PRC - [2009-11-11 10:55:36 | 001,257,472 | ---- | M] (CMedia) -- C:\Program Files\ASUS Xonar DX Audio\Customapp\AsusAudioCenter.exe

PRC - [2009-11-02 20:19:13 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe

PRC - [2009-10-31 07:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2009-10-30 13:57:08 | 000,369,200 | ---- | M] (DT Soft Ltd) -- C:\Program Files\DAEMON Tools Lite\DTLite.exe

PRC - [2009-10-30 13:57:00 | 000,229,936 | ---- | M] (DT Soft Ltd) -- C:\Program Files\DAEMON Tools Lite\DTLiteShellHlp.exe

PRC - [2009-03-19 12:44:50 | 000,731,840 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET Smart Security\ekrn.exe

PRC - [2009-03-19 12:44:28 | 002,029,640 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET Smart Security\egui.exe

PRC - [2008-07-11 15:04:22 | 000,200,704 | ---- | M] () -- C:\Windows\system\HsMgr.exe

 

 

========== Modules (SafeList) ==========

 

MOD - [2011-04-23 08:55:52 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\logimen\Desktop\AVS\OTL.exe

MOD - [2011-03-25 09:51:24 | 000,081,920 | ---- | M] () -- C:\Program Files\MSI Afterburner\Bundle\OSDServer\RTSSHooks.dll

MOD - [2010-08-21 07:21:32 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll

MOD - [2009-09-03 15:56:35 | 000,208,896 | ---- | M] (C-Media Electronics Inc.) -- C:\Windows\system\HsSrv.dll

MOD - [2009-07-14 03:16:12 | 000,145,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\powrprof.dll

MOD - [2009-07-14 03:15:13 | 000,453,632 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dsound.dll

 

 

========== Win32 Services (SafeList) ==========

 

SRV - [2011-01-25 12:41:12 | 002,398,536 | ---- | M] (O&O Software GmbH) [On_Demand | Stopped] -- C:\Program Files\OO Software\Defrag\oodag.exe -- (OODefragAgent)

SRV - [2010-08-04 17:25:02 | 000,061,440 | ---- | M] (Nalpeiron Ltd.) [On_Demand | Stopped] -- C:\Windows\System32\nlssrv32.exe -- (nlsX86cc)

SRV - [2010-08-04 17:25:00 | 000,057,344 | ---- | M] (Nalpeiron Ltd.) [Disabled | Stopped] -- C:\Windows\System32\ASTSRV.EXE -- (astcc)

SRV - [2010-02-19 14:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [Disabled | Stopped] -- C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)

SRV - [2009-09-06 09:08:06 | 000,071,096 | ---- | M] () [Disabled | Stopped] -- C:\Program Files\CDBurnerXP\NMSAccessU.exe -- (NMSAccessU)

SRV - [2009-07-16 18:04:16 | 000,316,664 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)

SRV - [2009-07-14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)

SRV - [2009-07-14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)

SRV - [2009-07-14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2009-04-12 03:26:35 | 000,578,878 | ---- | M] () [Auto | Stopped] -- C:\Program Files\ESET\ESET Smart Security\Shahed.exe -- (.EsetTrialReset)

SRV - [2009-03-19 12:48:08 | 000,020,680 | ---- | M] (ESET) [On_Demand | Stopped] -- C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe -- (EhttpSrv)

SRV - [2009-03-19 12:44:50 | 000,731,840 | ---- | M] (ESET) [Auto | Running] -- C:\Program Files\ESET\ESET Smart Security\ekrn.exe -- (ekrn)

 

 

========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | On_Demand | Running] -- -- (ALSysIO)

DRV - [2011-04-08 07:14:00 | 010,690,024 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)

DRV - [2011-03-03 17:59:19 | 000,139,368 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)

DRV - [2010-04-27 17:57:28 | 000,066,632 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\WmXlCore.sys -- (WmXlCore)

DRV - [2010-04-27 17:57:28 | 000,015,048 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WmVirHid.sys -- (WmVirHid)

DRV - [2010-04-27 17:57:24 | 000,031,816 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\WmHidLo.sys -- (WmHidLo)

DRV - [2010-04-27 17:57:22 | 000,022,856 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\WmBEnum.sys -- (WmBEnum)

DRV - [2010-04-27 15:01:26 | 000,037,704 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\WmFilter.sys -- (WmFilter)

DRV - [2010-03-26 00:28:13 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd)

DRV - [2009-12-18 11:58:52 | 000,011,336 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files\SystemRequirementsLab\cpudrv.sys -- (cpudrv)

DRV - [2009-11-02 20:18:37 | 000,035,840 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)

DRV - [2009-11-02 20:12:29 | 000,294,912 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\vpcvmm.sys -- (vpcvmm)

DRV - [2009-11-02 20:12:29 | 000,165,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vpchbus.sys -- (vpcbus)

DRV - [2009-11-02 20:12:29 | 000,078,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vpcusb.sys -- (vpcusb)

DRV - [2009-11-02 20:12:29 | 000,055,040 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\vpcnfltr.sys -- (vpcnfltr)

DRV - [2009-10-21 22:47:48 | 000,011,440 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vmmouse.sys -- (vmmouse)

DRV - [2009-10-21 22:46:54 | 000,070,704 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vm3dmp.sys -- (vm3dmp)

DRV - [2009-10-19 17:09:35 | 001,497,600 | ---- | M] (C-Media Inc) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\cmudaxp.sys -- (cmudaxp)

DRV - [2009-09-28 17:27:28 | 000,007,168 | ---- | M] () [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\StarOpen.sys -- (StarOpen)

DRV - [2009-09-22 17:40:48 | 000,174,592 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\Drivers\RtsUStor.sys -- (RSUSBSTOR)

DRV - [2009-08-21 14:48:12 | 000,027,136 | ---- | M] (Alcor Micro, Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\AmUStor.SYS -- (AmUStor)

DRV - [2009-08-04 12:49:08 | 000,106,512 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\iSSetup.sys -- (iSSetup)

DRV - [2009-07-27 00:00:00 | 000,047,448 | ---- | M] (O2Micro ) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\o2media.sys -- (O2MDRDR)

DRV - [2009-07-27 00:00:00 | 000,044,064 | ---- | M] (O2Micro) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\o2sd.sys -- (O2SDRDR)

DRV - [2009-07-14 03:19:10 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\vmbus.sys -- (vmbus)

DRV - [2009-07-14 03:19:10 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\vmstorfl.sys -- (storflt)

DRV - [2009-07-14 03:19:10 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\storvsc.sys -- (storvsc)

DRV - [2009-07-14 01:28:47 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\vms3cap.sys -- (s3cap)

DRV - [2009-07-14 01:28:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\VMBusHID.sys -- (VMBusHID)

DRV - [2009-07-14 00:02:47 | 000,047,104 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\L1E62x86.sys -- (L1E) NDIS Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller(NDIS6.20)

DRV - [2009-07-04 18:37:08 | 000,038,400 | ---- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\rixdpe86.sys -- (rixdpcie)

DRV - [2009-07-02 08:50:16 | 000,047,104 | ---- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\rimspe86.sys -- (rimspci)

DRV - [2009-06-30 19:28:28 | 000,049,152 | ---- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\risdpe86.sys -- (risdpcie)

DRV - [2009-06-25 16:58:10 | 000,048,128 | ---- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\rimmptsk.sys -- (rimmptsk)

DRV - [2009-06-25 16:25:58 | 000,038,400 | ---- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\rixdptsk.sys -- (rismxdp)

DRV - [2009-06-25 16:10:48 | 000,044,544 | ---- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\rimsptsk.sys -- (rimsptsk)

DRV - [2009-03-19 12:45:38 | 000,038,240 | ---- | M] (ESET) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\epfwwfp.sys -- (epfwwfp)

DRV - [2009-03-19 12:45:34 | 000,033,096 | ---- | M] (ESET) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\epfwndis.sys -- (Epfwndis)

DRV - [2009-03-19 12:45:32 | 000,131,976 | ---- | M] (ESET) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\epfw.sys -- (epfw)

DRV - [2009-03-19 12:44:34 | 000,107,256 | ---- | M] (ESET) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\ehdrv.sys -- (ehdrv)

DRV - [2009-03-19 12:41:38 | 000,113,960 | ---- | M] (ESET) [File_System | Auto | Running] -- C:\Windows\System32\drivers\eamon.sys -- (eamon)

DRV - [2008-01-18 06:14:20 | 000,037,504 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\Drivers\qd26032.sys -- (ioatdma) Intel®

DRV - [2008-01-18 06:14:14 | 000,036,480 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\Drivers\qd16032.sys -- (ioatdma1)

DRV - [2007-09-25 16:59:46 | 000,015,152 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files\MediaCoder\SysInfo.sys -- (CrystalSysInfo)

DRV - [2007-02-16 20:27:26 | 000,068,936 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AnyDVD.sys -- (AnyDVD)

DRV - [2005-09-23 23:18:32 | 000,171,520 | ---- | M] (Pinnacle Systems GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\MarvinBus.sys -- (MarvinBus)

DRV - [2005-05-25 06:39:06 | 000,004,608 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Program Files\MSI Afterburner\RTCore32.sys -- (RTCore32)

DRV - [2004-08-13 10:56:20 | 000,005,810 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ASACPI.sys -- (MTsensor)

 

 

========== Standard Registry (SafeList) ==========

 

 

========== Internet Explorer ==========

 

 

 

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = www.win7extreme.project-os.org

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = www.win7extreme.project-os.org

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 

IE - HKU\S-1-5-21-4163563121-293549032-1130137683-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = www.win7extreme.project-os.org

IE - HKU\S-1-5-21-4163563121-293549032-1130137683-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

========== FireFox ==========

 

 

FF - HKLM\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2010-03-26 00:29:33 | 000,000,000 | ---D | M]

 

[2011-02-08 16:14:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\logimen\AppData\Roaming\mozilla\Extensions

[2011-02-08 16:13:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\logimen\AppData\Roaming\mozilla\Extensions\Coder Preset

[2011-02-08 16:14:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\logimen\AppData\Roaming\mozilla\Extensions\MediaCoder

[2011-02-08 16:08:46 | 000,000,000 | ---D | M] (No name found) -- C:\Users\logimen\AppData\Roaming\mozilla\Extensions\MediaCoder-Setup-Wizard

 

O1 HOSTS File: ([2011-02-10 01:51:34 | 000,000,155 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 activate.adobe.com

O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)

O3 - HKLM\..\Toolbar: (&RoboForm) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)

O3 - HKU\S-1-5-21-4163563121-293549032-1130137683-1005\..\Toolbar\WebBrowser: (&RoboForm) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)

O4 - HKLM..\Run: [Cmaudio8788] File not found

O4 - HKLM..\Run: [Cmaudio8788GX] C:\Windows\system\HsMgr.exe ()

O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET Smart Security\egui.exe (ESET)

O4 - HKU\S-1-5-21-4163563121-293549032-1130137683-1005..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)

O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)

O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SynchronousMachineGroupPolicy = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SynchronousUserGroupPolicy = 0

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Activities present

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\BrowserEmulation present

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\CaretBrowsing present

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\CommandBar present

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Infodelivery present

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Main present

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\PhishingFilter present

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Privacy present

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Safety present

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Toolbar present

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Toolbars present

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Activities present

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\BrowserEmulation present

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\CaretBrowsing present

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\CommandBar present

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Infodelivery present

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Main present

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\PhishingFilter present

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Privacy present

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Safety present

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Toolbar present

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Toolbars present

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Activities present

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\BrowserEmulation present

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\CaretBrowsing present

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\CommandBar present

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Infodelivery present

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Main present

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\PhishingFilter present

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Privacy present

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Safety present

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Toolbar present

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Toolbars present

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Activities present

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\BrowserEmulation present

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\CaretBrowsing present

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\CommandBar present

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Infodelivery present

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Main present

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\PhishingFilter present

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Privacy present

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Safety present

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Toolbar present

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Toolbars present

O7 - HKU\S-1-5-21-4163563121-293549032-1130137683-1005\Software\Policies\Microsoft\Internet Explorer\Activities present

O7 - HKU\S-1-5-21-4163563121-293549032-1130137683-1005\Software\Policies\Microsoft\Internet Explorer\BrowserEmulation present

O7 - HKU\S-1-5-21-4163563121-293549032-1130137683-1005\Software\Policies\Microsoft\Internet Explorer\CaretBrowsing present

O7 - HKU\S-1-5-21-4163563121-293549032-1130137683-1005\Software\Policies\Microsoft\Internet Explorer\CommandBar present

O7 - HKU\S-1-5-21-4163563121-293549032-1130137683-1005\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-4163563121-293549032-1130137683-1005\Software\Policies\Microsoft\Internet Explorer\Infodelivery present

O7 - HKU\S-1-5-21-4163563121-293549032-1130137683-1005\Software\Policies\Microsoft\Internet Explorer\Main present

O7 - HKU\S-1-5-21-4163563121-293549032-1130137683-1005\Software\Policies\Microsoft\Internet Explorer\PhishingFilter present

O7 - HKU\S-1-5-21-4163563121-293549032-1130137683-1005\Software\Policies\Microsoft\Internet Explorer\Privacy present

O7 - HKU\S-1-5-21-4163563121-293549032-1130137683-1005\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O7 - HKU\S-1-5-21-4163563121-293549032-1130137683-1005\Software\Policies\Microsoft\Internet Explorer\Safety present

O7 - HKU\S-1-5-21-4163563121-293549032-1130137683-1005\Software\Policies\Microsoft\Internet Explorer\Toolbar present

O7 - HKU\S-1-5-21-4163563121-293549032-1130137683-1005\Software\Policies\Microsoft\Internet Explorer\Toolbars present

O7 - HKU\S-1-5-21-4163563121-293549032-1130137683-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: AlwaysShowClassicMenu = 1

O7 - HKU\S-1-5-21-4163563121-293549032-1130137683-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-4163563121-293549032-1130137683-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 1

O7 - HKU\S-1-5-21-4163563121-293549032-1130137683-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\SearchExtensions: InternetExtensionName = Google Search

O7 - HKU\S-1-5-21-4163563121-293549032-1130137683-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\SearchExtensions: InternetExtensionAction = %w - Google Search

O9 - Extra Button: Wypełnij pola - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()

O9 - Extra 'Tools' menuitem : Wypełnij Pola - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()

O9 - Extra Button: Zapisz - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()

O9 - Extra 'Tools' menuitem : Zapisz Pola - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()

O9 - Extra Button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()

O9 - Extra 'Tools' menuitem : Pasek Narzędzi RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)

O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found

O21 - SSODL: IconPackager Repair - {1799460C-0BC8-4865-B9DF-4A36CD703FF0} - C:\Program Files\Stardock\Object Desktop\IconPackager\iprepair.dll (Stardock.net, Inc)

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.

O22 - SharedTaskScheduler: {E31004D1-A431-41B8-826F-E902F9D95C81} - Windows DreamScene - C:\Windows\System32\DreamScene.dll (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009-06-10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O32 - AutoRun File - [2010-04-26 12:31:28 | 000,013,399 | ---- | M] () - C:\AutoMapaSetupLog.txt -- [ NTFS ]

O32 - AutoRun File - [2010-04-26 12:31:18 | 000,000,000 | ---D | M] - D:\AutoMapa EU -- [ NTFS ]

O34 - HKLM BootExecute: (OODBS) - C:\Windows\System32\OODBS.exe (O&O Software GmbH)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

========== Files/Folders - Created Within 30 Days ==========

 

[2011-04-23 08:54:40 | 000,000,000 | ---D | C] -- C:\Users\logimen\Desktop\AVS

[2011-04-21 08:42:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Valve

[2011-04-21 00:56:59 | 000,000,000 | ---D | C] -- C:\ProgramData\boost_interprocess

[2011-04-20 18:52:08 | 000,000,000 | ---D | C] -- C:\Users\logimen\Documents\SimBin

[2011-04-20 18:48:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SimBin

[2011-04-20 15:43:32 | 000,245,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\unicows.dll

[2011-04-20 15:43:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Performance Monitor 4.x

[2011-04-20 15:43:31 | 000,000,000 | ---D | C] -- C:\Program Files\PerfMon4x

[2011-04-18 19:54:00 | 015,227,496 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvoglv32.dll

[2011-04-18 19:54:00 | 013,007,464 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvcompiler.dll

[2011-04-18 19:54:00 | 010,690,024 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\drivers\nvlddmkm.sys

[2011-04-18 19:54:00 | 010,071,656 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvd3dum.dll

[2011-04-18 19:54:00 | 005,180,824 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvcuda.dll

[2011-04-18 19:54:00 | 002,765,928 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvcuvid.dll

[2011-04-18 19:54:00 | 002,074,216 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvcuvenc.dll

[2011-04-18 19:54:00 | 000,944,232 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvdispco3220140.dll

[2011-04-18 19:54:00 | 000,855,656 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvgenco322060.dll

[2011-04-18 19:54:00 | 000,837,224 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvhdagenco322040.dll

[2011-04-18 19:54:00 | 000,139,368 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\drivers\nvhda32v.sys

[2011-04-18 19:54:00 | 000,057,960 | ---- | C] (Khronos Group) -- C:\Windows\System32\OpenCL.dll

[2011-04-18 19:54:00 | 000,026,216 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvhdap32.dll

[2011-04-18 19:54:00 | 000,010,920 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\drivers\nvBridge.kmd

[2011-04-16 23:14:48 | 000,000,000 | ---D | C] -- C:\ProgramData\LogiShrd

[2011-04-10 23:16:45 | 000,000,000 | ---D | C] -- C:\Program Files\WinHex

[2011-04-07 22:45:08 | 000,580,200 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\easyUpdatusAPIU.dll

[2011-04-07 22:45:06 | 000,111,208 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvmctray.dll

[2011-04-07 22:44:58 | 003,701,352 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvcpl.dll

[2011-04-07 22:44:48 | 002,565,224 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvsvc.dll

[2011-04-02 17:28:33 | 000,000,000 | ---D | C] -- C:\Users\logimen\Desktop\Shift2 Tools

[2011-04-02 12:12:21 | 000,000,000 | ---D | C] -- C:\Users\logimen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Fraps

[2011-03-31 12:28:49 | 000,000,000 | ---D | C] -- C:\Users\logimen\Desktop\skany bre mazda5

[2011-03-29 08:49:50 | 000,000,000 | ---D | C] -- C:\Users\logimen\Documents\SHIFT 2 UNLEASHED

[2011-03-27 19:16:57 | 000,000,000 | ---D | C] -- C:\Users\logimen\AppData\Roaming\BDREBUILDER

[2011-03-27 19:16:41 | 000,000,000 | ---D | C] -- C:\Users\logimen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AviSynth 2.5

[2011-03-27 19:16:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AviSynth 2.5

[2011-03-27 19:16:38 | 000,000,000 | ---D | C] -- C:\Program Files\AviSynth 2.5

[2011-03-27 01:31:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Solidshield

[2011-03-26 18:38:55 | 000,217,600 | ---- | C] (Microsoft) -- C:\Users\logimen\Desktop\Crysis2AdvancedGraphicsOptions.exe

[3 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 

========== Files - Modified Within 30 Days ==========

 

[2011-04-23 08:26:40 | 000,019,248 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2011-04-23 08:26:40 | 000,019,248 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2011-04-23 08:25:51 | 002,038,388 | ---- | M] () -- C:\Windows\System32\perfh015.dat

[2011-04-23 08:25:51 | 001,074,246 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2011-04-23 08:25:51 | 000,593,092 | ---- | M] () -- C:\Windows\System32\perfc015.dat

[2011-04-23 08:25:51 | 000,547,450 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2011-04-23 08:19:06 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2011-04-23 08:19:04 | 000,188,696 | ---- | M] () -- C:\Windows\System32\oodbs.lor

[2011-04-22 22:56:56 | 000,000,270 | ---- | M] () -- C:\Users\logimen\Documents\BFF_Unpacker.config

[2011-04-21 08:42:28 | 000,000,680 | ---- | M] () -- C:\Users\Public\Desktop\Portal 2.lnk

[2011-04-20 18:48:07 | 000,000,748 | ---- | M] () -- C:\Users\Public\Desktop\STCC The Game 2.lnk

[2011-04-19 20:35:15 | 000,000,352 | ---- | M] () -- C:\Users\logimen\Documents\BFF_Repacker.config

[2011-04-16 22:54:14 | 006,358,287 | ---- | M] () -- C:\Users\logimen\Desktop\Scan-110416-0001.jpg

[2011-04-12 23:08:16 | 000,000,031 | ---- | M] () -- C:\Users\logimen\Last session logimen.prj

[2011-04-10 21:56:33 | 000,001,032 | ---- | M] () -- C:\Users\logimen\Desktop\Shift2.lnk

[2011-04-08 07:14:00 | 015,227,496 | ---- | M] (NVIDIA Corporation) -- C:\Windows\System32\nvoglv32.dll

[2011-04-08 07:14:00 | 013,007,464 | ---- | M] (NVIDIA Corporation) -- C:\Windows\System32\nvcompiler.dll

[2011-04-08 07:14:00 | 010,690,024 | ---- | M] (NVIDIA Corporation) -- C:\Windows\System32\drivers\nvlddmkm.sys

[2011-04-08 07:14:00 | 010,071,656 | ---- | M] (NVIDIA Corporation) -- C:\Windows\System32\nvd3dum.dll

[2011-04-08 07:14:00 | 006,299,752 | ---- | M] (NVIDIA Corporation) -- C:\Windows\System32\nvwgf2um.dll

[2011-04-08 07:14:00 | 005,180,824 | ---- | M] (NVIDIA Corporation) -- C:\Windows\System32\nvcuda.dll

[2011-04-08 07:14:00 | 002,765,928 | ---- | M] (NVIDIA Corporation) -- C:\Windows\System32\nvcuvid.dll

[2011-04-08 07:14:00 | 002,074,216 | ---- | M] (NVIDIA Corporation) -- C:\Windows\System32\nvcuvenc.dll

[2011-04-08 07:14:00 | 002,034,280 | ---- | M] (NVIDIA Corporation) -- C:\Windows\System32\nvapi.dll

[2011-04-08 07:14:00 | 000,944,232 | ---- | M] (NVIDIA Corporation) -- C:\Windows\System32\nvdispco3220140.dll

[2011-04-08 07:14:00 | 000,855,656 | ---- | M] (NVIDIA Corporation) -- C:\Windows\System32\nvgenco322060.dll

[2011-04-08 07:14:00 | 000,057,960 | ---- | M] (Khronos Group) -- C:\Windows\System32\OpenCL.dll

[2011-04-08 07:14:00 | 000,010,920 | ---- | M] (NVIDIA Corporation) -- C:\Windows\System32\drivers\nvBridge.kmd

[2011-04-08 07:14:00 | 000,004,755 | ---- | M] () -- C:\Windows\System32\nvinfo.pb

[2011-04-07 23:17:26 | 000,007,680 | ---- | M] () -- C:\Users\logimen\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2011-04-07 22:45:08 | 000,580,200 | ---- | M] (NVIDIA Corporation) -- C:\Windows\System32\easyUpdatusAPIU.dll

[2011-04-07 22:45:06 | 000,111,208 | ---- | M] (NVIDIA Corporation) -- C:\Windows\System32\nvmctray.dll

[2011-04-07 22:44:58 | 003,701,352 | ---- | M] (NVIDIA Corporation) -- C:\Windows\System32\nvcpl.dll

[2011-04-07 22:44:48 | 002,565,224 | ---- | M] (NVIDIA Corporation) -- C:\Windows\System32\nvsvc.dll

[2011-04-04 19:34:22 | 000,000,865 | ---- | M] () -- C:\Users\logimen\Desktop\Shift Mods.lnk

[2011-04-04 18:09:22 | 000,000,299 | ---- | M] () -- C:\Users\logimen\Desktop\logimen.bat

[2011-04-04 18:09:09 | 000,000,299 | ---- | M] () -- C:\Users\logimen\Desktop\kisiel.bat

[2011-04-02 21:14:10 | 000,001,124 | ---- | M] () -- C:\Users\logimen\Desktop\Shift 2 Saves.lnk

[2011-03-27 21:54:59 | 000,000,606 | ---- | M] () -- C:\Users\logimen\Desktop\autoexec.cfg

[2011-03-27 01:30:26 | 000,000,018 | ---- | M] () -- C:\Users\logimen\Desktop\Crysis2AdvancedSettings.ini

[2011-03-25 17:34:52 | 000,217,600 | ---- | M] (Microsoft) -- C:\Users\logimen\Desktop\Crysis2AdvancedGraphicsOptions.exe

[3 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 

========== Files Created - No Company Name ==========

 

[2011-04-21 08:42:28 | 000,000,680 | ---- | C] () -- C:\Users\Public\Desktop\Portal 2.lnk

[2011-04-20 18:48:07 | 000,000,748 | ---- | C] () -- C:\Users\Public\Desktop\STCC The Game 2.lnk

[2011-04-18 19:54:00 | 000,004,755 | ---- | C] () -- C:\Windows\System32\nvinfo.pb

[2011-04-16 22:54:13 | 006,358,287 | ---- | C] () -- C:\Users\logimen\Desktop\Scan-110416-0001.jpg

[2011-04-10 23:27:42 | 000,000,031 | ---- | C] () -- C:\Users\logimen\Last session logimen.prj

[2011-04-10 23:16:46 | 000,000,972 | ---- | C] () -- C:\Users\logimen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinHex.lnk

[2011-04-03 01:21:49 | 000,000,352 | ---- | C] () -- C:\Users\logimen\Documents\BFF_Repacker.config

[2011-04-02 17:56:25 | 000,000,270 | ---- | C] () -- C:\Users\logimen\Documents\BFF_Unpacker.config

[2011-03-30 01:24:18 | 000,000,299 | ---- | C] () -- C:\Users\logimen\Desktop\kisiel.bat

[2011-03-30 01:19:25 | 000,000,299 | ---- | C] () -- C:\Users\logimen\Desktop\logimen.bat

[2011-03-29 08:49:44 | 000,001,032 | ---- | C] () -- C:\Users\logimen\Desktop\Shift2.lnk

[2011-03-27 01:31:06 | 000,000,606 | ---- | C] () -- C:\Users\logimen\Desktop\autoexec.cfg

[2011-03-27 01:30:12 | 000,000,018 | ---- | C] () -- C:\Users\logimen\Desktop\Crysis2AdvancedSettings.ini

[2011-03-05 03:01:10 | 000,007,666 | ---- | C] () -- C:\Users\logimen\AppData\Local\Resmon.ResmonCfg

[2011-02-27 19:09:51 | 000,110,592 | ---- | C] () -- C:\Windows\System32\rtvcvfw32.dll

[2011-02-26 01:36:20 | 000,000,000 | ---- | C] () -- C:\Windows\DbgOut.INI

[2011-02-10 12:24:52 | 000,001,456 | ---- | C] () -- C:\Users\logimen\AppData\Local\Adobe Save for Web 12.0 Prefs

[2011-02-03 01:48:10 | 000,000,042 | ---- | C] () -- C:\Windows\oodjobd.INI

[2011-02-01 19:12:03 | 001,871,840 | ---- | C] () -- C:\Windows\System32\xerces-c_2_6.dll

[2011-01-30 12:21:18 | 000,000,123 | -HS- | C] () -- C:\ProgramData\.zreglib

[2010-10-14 02:36:44 | 000,179,263 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat

[2010-04-25 12:09:55 | 000,000,053 | ---- | C] () -- C:\Windows\System32\cmasiop.ini

[2010-04-25 12:09:53 | 000,045,212 | ---- | C] () -- C:\Windows\Cmicnfgp.ini.cfl

[2010-04-25 12:09:52 | 000,557,056 | ---- | C] () -- C:\Windows\System32\Cmeauoxy.exe

[2010-04-25 12:09:26 | 000,000,889 | ---- | C] () -- C:\Windows\Cmicnfgp.ini.imi

[2010-04-25 12:09:23 | 000,303,104 | ---- | C] () -- C:\Windows\System32\CmiInstallResAll.dll

[2010-04-25 12:09:23 | 000,004,967 | ---- | C] () -- C:\Windows\Cmicnfgp.ini.cfg

[2010-04-25 12:09:23 | 000,000,560 | ---- | C] () -- C:\Windows\cmudaxp.ini

[2010-04-18 10:22:32 | 000,000,000 | ---- | C] () -- C:\Windows\Bench32.INI

[2010-03-30 23:15:53 | 000,007,680 | ---- | C] () -- C:\Users\logimen\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2010-03-29 23:40:36 | 000,140,248 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys

[2010-03-29 23:40:23 | 000,266,400 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe

[2010-03-29 23:40:02 | 000,075,136 | ---- | C] () -- C:\Windows\System32\PnkBstrA.exe

[2010-03-27 01:37:32 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini

[2010-03-26 17:59:53 | 002,038,388 | ---- | C] () -- C:\Windows\System32\perfh015.dat

[2010-03-26 17:59:53 | 000,593,092 | ---- | C] () -- C:\Windows\System32\perfc015.dat

[2010-03-26 17:59:53 | 000,337,158 | ---- | C] () -- C:\Windows\System32\perfi015.dat

[2010-03-26 17:59:53 | 000,038,710 | ---- | C] () -- C:\Windows\System32\perfd015.dat

[2009-11-16 15:59:21 | 002,580,858 | ---- | C] () -- C:\Windows\System32\activate.exe

[2009-11-16 15:59:21 | 000,613,401 | ---- | C] () -- C:\Windows\System32\activator.exe

[2009-11-16 15:58:26 | 000,613,189 | ---- | C] () -- C:\Windows\closetheme.exe

[2009-11-16 09:15:36 | 000,007,168 | ---- | C] () -- C:\Windows\System32\drivers\StarOpen.sys

[2009-11-12 19:03:28 | 000,059,904 | ---- | C] () -- C:\Windows\System32\zlib1.dll

[2009-11-12 19:03:27 | 000,394,752 | ---- | C] () -- C:\Windows\System32\cygwinb19.dll

[2009-11-12 19:03:27 | 000,162,304 | ---- | C] () -- C:\Windows\System32\libpng13.dll

[2009-11-09 13:54:47 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat

[2009-11-08 23:33:51 | 000,178,176 | ---- | C] () -- C:\Windows\System32\unrar.dll

[2009-11-08 23:33:51 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini

[2009-11-08 23:33:50 | 002,378,752 | ---- | C] () -- C:\Windows\System32\x264vfw.dll

[2009-11-08 23:33:50 | 000,881,664 | ---- | C] () -- C:\Windows\System32\xvidcore.dll

[2009-11-08 23:33:50 | 000,205,824 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll

[2009-11-08 23:33:49 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll

[2009-11-08 23:33:47 | 000,085,504 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll

[2009-07-14 06:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

[2009-07-14 06:33:53 | 003,710,296 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT

[2009-07-14 04:05:48 | 001,074,246 | ---- | C] () -- C:\Windows\System32\perfh009.dat

[2009-07-14 04:05:48 | 000,547,450 | ---- | C] () -- C:\Windows\System32\perfc009.dat

[2009-07-14 04:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat

[2009-07-14 04:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat

[2009-07-14 04:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT

[2009-07-14 04:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat

[2009-07-14 02:55:09 | 000,587,776 | ---- | C] () -- C:\Windows\System32\hpotscl1.dll

[2009-07-14 02:19:49 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe

[2009-07-14 01:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2009-07-14 01:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll

[2009-07-14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll

[2009-06-10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

[2004-08-13 10:56:20 | 000,005,810 | ---- | C] () -- C:\Windows\System32\drivers\ASACPI.sys

 

========== Alternate Data Streams ==========

 

@Alternate Data Stream - 128 bytes -> C:\Windows:nlsPreferences

 

< End of report >

 

 

 

 

Z gory dziekuje za pomoc

Udostępnij ten post


Link to postu
Udostępnij na innych stronach

Logi z laptopa:

 

Gmer (widze rootkita), problem jak i czym go wywalic ?

 

 

 

 

GMER 1.0.15.15570 - GMER - Rootkit Detector and Remover

Rootkit scan 2011-04-23 15:24:17

Windows 6.1.7600 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 TOSHIBA_MK3252GSX rev.LV010A

Running: kfgrpwpp.exe; Driver: C:\Users\dorotex\AppData\Local\Temp\uwddapow.sys

 

 

---- System - GMER 1.0.15 ----

 

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwAdjustPrivilegesToken [0x8BBA9BD0]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwAlpcConnectPort [0x8BBAB52C]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwAlpcCreatePort [0x8BBAB782]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwAlpcSendWaitReceivePort [0x8BBAB9FC]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwClose [0x8BBAA450]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwConnectPort [0x8BBAAB32]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwCreateEvent [0x8BBAAF3C]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwCreateFile [0x8BBAA5F8]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwCreateMutant [0x8BBAAE14]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwCreateNamedPipeFile [0x8BBA97D6]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwCreatePort [0x8BBAACD0]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwCreateSection [0x8BBA9992]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwCreateSemaphore [0x8BBAB06E]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwCreateSymbolicLinkObject [0x8BBACCB0]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwCreateThread [0x8BBAA0EE]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwCreateThreadEx [0x8BBAA1EE]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwCreateWaitablePort [0x8BBAAD72]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwDebugActiveProcess [0x8BBAC6A2]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwDuplicateObject [0x8BBAD672]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwFsControlFile [0x8BBAA752]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwLoadDriver [0x8BBAC734]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwMapViewOfSection [0x8BBACD64]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwOpenEvent [0x8BBAAFDE]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwOpenFile [0x8BBAA4D2]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwOpenMutant [0x8BBAAEAC]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwOpenProcess [0x8BBA9DD6]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwOpenSection [0x8BBACCDA]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwOpenSemaphore [0x8BBAB110]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwOpenThread [0x8BBA9CFA]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwQueryDirectoryObject [0x8BBABC3E]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwQuerySection [0x8BBAD07C]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwQueueApcThread [0x8BBAC9CA]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwReplyPort [0x8BBAB49A]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwReplyWaitReceivePort [0x8BBAB360]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwRequestWaitReplyPort [0x8BBAC442]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwResumeThread [0x8BBAD554]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwSecureConnectPort [0x8BBAA86C]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwSetContextThread [0x8BBAA30C]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwSetInformationToken [0x8BBABCF2]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwSetSecurityObject [0x8BBAC82E]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwSetSystemInformation [0x8BBAD1BC]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwSuspendProcess [0x8BBAD2A0]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwSuspendThread [0x8BBAD3C8]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwSystemDebugControl [0x8BBAC5CE]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwTerminateProcess [0x8BBA9F4E]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwTerminateThread [0x8BBA9EA4]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwUnmapViewOfSection [0x8BBACF32]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab) ZwWriteVirtualMemory [0x8BBAA02E]

 

---- Kernel code sections - GMER 1.0.15 ----

 

.text ntkrnlpa.exe!ZwSaveKeyEx + 13BD 82E8B9A9 1 Byte [06]

.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 82EC5352 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}

.text ntkrnlpa.exe!RtlSidHashLookup + 220 82ECCAF0 4 Bytes [D0, 9B, BA, 8B]

.text ntkrnlpa.exe!RtlSidHashLookup + 248 82ECCB18 8 Bytes [2C, B5, BA, 8B, 82, B7, BA, ...]

.text ntkrnlpa.exe!RtlSidHashLookup + 28C 82ECCB5C 4 Bytes [FC, B9, BA, 8B]

.text ntkrnlpa.exe!RtlSidHashLookup + 2B8 82ECCB88 4 Bytes [50, A4, BA, 8B]

.text ntkrnlpa.exe!RtlSidHashLookup + 2DC 82ECCBAC 4 Bytes [32, AB, BA, 8B]

.text ...

? System32\Drivers\spoa.sys System nie może odnaleźć określonej ścieżki. !

PAGE ataport.SYS!DllUnload + 1 8B4A0AD7 4 Bytes JMP 855421D9

.text C:\Windows\system32\DRIVERS\atikmdag.sys section is writeable [0x9980C000, 0x352E10, 0xE8000020]

.text USBPORT.SYS!DllUnload 91BD6CA0 5 Bytes JMP 86C081D8

.text a2ajvanf.SYS 9A548000 12 Bytes [44, 78, E1, 82, EE, 76, E1, ...]

.text a2ajvanf.SYS 9A54800D 9 Bytes [57, E1, 82, 48, 7B, E1, 82, ...] {PUSH EDI; LOOPZ 0xffffffffffffff85; DEC EAX; JNP 0xffffffffffffffe7; ADD BYTE [EAX], 0x0}

.text a2ajvanf.SYS 9A548017 20 Bytes [00, DE, 47, 39, 8B, E6, 45, ...]

.text a2ajvanf.SYS 9A54802C 134 Bytes [00, 00, 00, 00, F0, 65, E8, ...]

.text a2ajvanf.SYS 9A5480B3 14 Bytes [82, 30, 93, EC, 82, 80, 76, ...]

.text ...

 

---- User code sections - GMER 1.0.15 ----

 

? C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] C:\Windows\SYSTEM32\ntdll.dll time/date stamp mismatch;

? C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] C:\Windows\system32\kernel32.dll time/date stamp mismatch; unknown module: KERNELBASE.dll

.text C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] USER32.dll!NotifyWinEvent + 48B 761FF724 4 Bytes [70, 11, 33, 6D]

? C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] C:\Windows\SYSTEM32\ntdll.dll time/date stamp mismatch;

? C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] C:\Windows\system32\kernel32.dll time/date stamp mismatch; unknown module: KERNELBASE.dll

.text C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] USER32.dll!NotifyWinEvent + 48B 761FF724 4 Bytes [70, 11, 33, 6D]

 

---- Kernel IAT/EAT - GMER 1.0.15 ----

 

IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUchar] [8B298042] \SystemRoot\System32\Drivers\spoa.sys

IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortUchar] [8B2986D6] \SystemRoot\System32\Drivers\spoa.sys

IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortBufferUshort] [8B298800] \SystemRoot\System32\Drivers\spoa.sys

IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortBufferUshort] [8B29813E] \SystemRoot\System32\Drivers\spoa.sys

IAT \SystemRoot\System32\Drivers\a2ajvanf.SYS[ataport.SYS!AtaPortNotification] 00147880

IAT \SystemRoot\System32\Drivers\a2ajvanf.SYS[ataport.SYS!AtaPortQuerySystemTime] 78800C75

IAT \SystemRoot\System32\Drivers\a2ajvanf.SYS[ataport.SYS!AtaPortReadPortUchar] 06750015

IAT \SystemRoot\System32\Drivers\a2ajvanf.SYS[ataport.SYS!AtaPortStallExecution] C25DC033

IAT \SystemRoot\System32\Drivers\a2ajvanf.SYS[ataport.SYS!AtaPortWritePortUchar] 458B0008

IAT \SystemRoot\System32\Drivers\a2ajvanf.SYS[ataport.SYS!AtaPortWritePortUlong] 6A006A08

IAT \SystemRoot\System32\Drivers\a2ajvanf.SYS[ataport.SYS!AtaPortGetPhysicalAddress] 50056A24

IAT \SystemRoot\System32\Drivers\a2ajvanf.SYS[ataport.SYS!AtaPortConvertPhysicalAddressToUlong] 005AB7E8

IAT \SystemRoot\System32\Drivers\a2ajvanf.SYS[ataport.SYS!AtaPortGetScatterGatherList] 0001B800

IAT \SystemRoot\System32\Drivers\a2ajvanf.SYS[ataport.SYS!AtaPortGetParentBusType] C25D0000

IAT \SystemRoot\System32\Drivers\a2ajvanf.SYS[ataport.SYS!AtaPortRequestCallback] CCCC0008

IAT \SystemRoot\System32\Drivers\a2ajvanf.SYS[ataport.SYS!AtaPortWritePortBufferUshort] CCCCCCCC

IAT \SystemRoot\System32\Drivers\a2ajvanf.SYS[ataport.SYS!AtaPortGetUnCachedExtension] CCCCCCCC

IAT \SystemRoot\System32\Drivers\a2ajvanf.SYS[ataport.SYS!AtaPortCompleteRequest] CCCCCCCC

IAT \SystemRoot\System32\Drivers\a2ajvanf.SYS[ataport.SYS!AtaPortCopyMemory] 53EC8B55

IAT \SystemRoot\System32\Drivers\a2ajvanf.SYS[ataport.SYS!AtaPortEtwTraceLog] 800C5D8B

IAT \SystemRoot\System32\Drivers\a2ajvanf.SYS[ataport.SYS!AtaPortCompleteAllActiveRequests] 7500117B

IAT \SystemRoot\System32\Drivers\a2ajvanf.SYS[ataport.SYS!AtaPortReleaseRequestSenseIrb] 127B806A

IAT \SystemRoot\System32\Drivers\a2ajvanf.SYS[ataport.SYS!AtaPortBuildRequestSenseIrb] 80647500

IAT \SystemRoot\System32\Drivers\a2ajvanf.SYS[ataport.SYS!AtaPortReadPortBufferUshort] 7500137B

IAT \SystemRoot\System32\Drivers\a2ajvanf.SYS[ataport.SYS!AtaPortInitialize] 157B805E

IAT \SystemRoot\System32\Drivers\a2ajvanf.SYS[ataport.SYS!AtaPortGetDeviceBase] 56587500

IAT \SystemRoot\System32\Drivers\a2ajvanf.SYS[ataport.SYS!AtaPortDeviceStateChange] 8008758B

 

---- User IAT/EAT - GMER 1.0.15 ----

 

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\kernel32.dll [ntdll.dll!RtlReAllocateHeap] 001F0240

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\kernel32.dll [ntdll.dll!RtlSizeHeap] 001F02B0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\kernel32.dll [ntdll.dll!RtlAllocateHeap] 001F0320

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\kernel32.dll [ntdll.dll!RtlFreeHeap] 001F0390

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\RPCRT4.dll [ntdll.dll!RtlFreeHeap] 001F07F0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\RPCRT4.dll [ntdll.dll!RtlAllocateHeap] 001F0860

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\USER32.dll [ntdll.dll!RtlSizeHeap] 001F0B00

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\USER32.dll [ntdll.dll!RtlReAllocateHeap] 001F0B70

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\USER32.dll [ntdll.dll!RtlAllocateHeap] 001F0BE0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\USER32.dll [ntdll.dll!RtlFreeHeap] 001F0C50

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] 00540DA0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!CreateThread] 001F0CC0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!CreateProcessW] 00540E10

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetModuleFileNameA] 00540E80

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExA] 00540EF0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 00540F60

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!FreeLibrary] 77D10860

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress] 77D108D0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryW] 77D10940

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetModuleFileNameW] 77D109B0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\GDI32.dll [ntdll.dll!RtlAllocateHeap] 001F0D30

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\GDI32.dll [ntdll.dll!RtlFreeHeap] 001F0DA0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 77D10A20

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW] 77D10A90

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA] 77D10B00

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW] 77D10B70

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!FreeLibrary] 77D10BE0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] 77D10C50

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\ADVAPI32.dll [ntdll.dll!RtlFreeHeap] 77C00710

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\ADVAPI32.dll [ntdll.dll!RtlAllocateHeap] 77C00780

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\ADVAPI32.dll [ntdll.dll!RtlReAllocateHeap] 77C007F0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!VirtualFree] 77C008D0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetModuleFileNameW] 00550400

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW] 00550470

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!SetErrorMode] 005504E0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] 00550550

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryA] 005505C0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!FreeLibrary] 00550630

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryW] 005506A0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!HeapFree] 77C00A90

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExA] 00550710

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 00550780

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\SHELL32.dll [ntdll.dll!RtlFreeHeap] 77CF06A0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] 005602B0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW] 00560320

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW] 00560390

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!CreateThread] 77CF0710

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!HeapFree] 77CF07F0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetModuleFileNameA] 00560400

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetModuleFileNameW] 00560470

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] 005604E0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW] 00560550

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] 005605C0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FreeLibrary] 00560630

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA] 005606A0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!SetErrorMode] 00560710

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 00560780

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\ole32.dll [ntdll.dll!RtlFreeHeap] 77CF0860

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\ole32.dll [ntdll.dll!RtlAllocateHeap] 77CF08D0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\ole32.dll [ntdll.dll!RtlReAllocateHeap] 77CF0940

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!LoadLibraryW] 00560B70

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!LoadLibraryA] 00560BE0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\iphlpapi.dll [ntdll.dll!RtlFreeHeap] 77C00080

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\iphlpapi.dll [ntdll.dll!RtlAllocateHeap] 77C00010

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\WS2_32.dll [ntdll.dll!RtlFreeHeap] 77C00080

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\WS2_32.dll [ntdll.dll!RtlAllocateHeap] 77C00010

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\CRYPT32.dll [ntdll.dll!RtlFreeHeap] 77C00080

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\CRYPT32.dll [ntdll.dll!RtlAllocateHeap] 77C00010

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\CRYPT32.dll [KERNEL32.dll!HeapFree] 77CF00F0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\CRYPT32.dll [KERNEL32.dll!VirtualAlloc] 77CF0160

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\CRYPT32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 77D104E0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryExW] 77D10390

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\CRYPT32.dll [KERNEL32.dll!GetModuleFileNameW] 77D101D0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryExA] 77D10320

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryA] 77D102B0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress] 77D10240

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\CRYPT32.dll [KERNEL32.dll!FreeLibrary] 77D100F0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\Secur32.dll [ntdll.dll!RtlAllocateHeap] 77C00010

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\Secur32.dll [ntdll.dll!RtlFreeHeap] 77C00080

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\Secur32.dll [KERNEL32.dll!LoadLibraryExA] 77D10320

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\Secur32.dll [KERNEL32.dll!FreeLibrary] 77D100F0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\Secur32.dll [KERNEL32.dll!GetProcAddress] 77D10240

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\Secur32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 77D104E0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\WININET.dll [KERNEL32.dll!SetErrorMode] 77D10470

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\WININET.dll [KERNEL32.dll!LoadLibraryW] 77D10400

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\WININET.dll [KERNEL32.dll!HeapFree] 77CF00F0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\WININET.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 77D104E0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\WININET.dll [KERNEL32.dll!LoadLibraryExW] 77D10390

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\WININET.dll [KERNEL32.dll!CreateThread] 77CF0010

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\WININET.dll [KERNEL32.dll!GetProcAddress] 77D10240

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\WININET.dll [KERNEL32.dll!LoadLibraryA] 77D102B0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\WININET.dll [KERNEL32.dll!FreeLibrary] 77D100F0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\WININET.dll [KERNEL32.dll!GetModuleFileNameW] 77D101D0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[1356] @ C:\Windows\system32\WININET.dll [KERNEL32.dll!GetModuleFileNameA] 77D10160

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\kernel32.dll [ntdll.dll!RtlReAllocateHeap] 001F0240

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\kernel32.dll [ntdll.dll!RtlSizeHeap] 001F02B0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\kernel32.dll [ntdll.dll!RtlAllocateHeap] 001F0320

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\kernel32.dll [ntdll.dll!RtlFreeHeap] 001F0390

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\RPCRT4.dll [ntdll.dll!RtlFreeHeap] 001F07F0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\RPCRT4.dll [ntdll.dll!RtlAllocateHeap] 001F0860

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\USER32.dll [ntdll.dll!RtlSizeHeap] 001F0B00

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\USER32.dll [ntdll.dll!RtlReAllocateHeap] 001F0B70

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\USER32.dll [ntdll.dll!RtlAllocateHeap] 001F0BE0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\USER32.dll [ntdll.dll!RtlFreeHeap] 001F0C50

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] 003E0DA0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!CreateThread] 001F0CC0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!CreateProcessW] 003E0E10

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetModuleFileNameA] 003E0E80

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExA] 003E0EF0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 003E0F60

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!FreeLibrary] 77D10860

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress] 77D108D0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryW] 77D10940

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetModuleFileNameW] 77D109B0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\GDI32.dll [ntdll.dll!RtlAllocateHeap] 001F0D30

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\GDI32.dll [ntdll.dll!RtlFreeHeap] 001F0DA0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 77D10A20

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW] 77D10A90

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA] 77D10B00

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW] 77D10B70

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!FreeLibrary] 77D10BE0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] 77D10C50

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\ADVAPI32.dll [ntdll.dll!RtlFreeHeap] 77C00710

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\ADVAPI32.dll [ntdll.dll!RtlAllocateHeap] 77C00780

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\ADVAPI32.dll [ntdll.dll!RtlReAllocateHeap] 77C007F0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!VirtualFree] 77C008D0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetModuleFileNameW] 003F0400

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW] 003F0470

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!SetErrorMode] 003F04E0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] 003F0550

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryA] 003F05C0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!FreeLibrary] 003F0630

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryW] 003F06A0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!HeapFree] 77C00A90

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExA] 003F0710

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 003F0780

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\SHELL32.dll [ntdll.dll!RtlFreeHeap] 77CF06A0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] 016102B0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW] 01610320

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW] 01610390

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!CreateThread] 77CF0710

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!HeapFree] 77CF07F0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetModuleFileNameA] 01610400

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetModuleFileNameW] 01610470

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] 016104E0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW] 01610550

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] 016105C0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FreeLibrary] 01610630

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA] 016106A0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!SetErrorMode] 01610710

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 01610780

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\ole32.dll [ntdll.dll!RtlFreeHeap] 77CF0860

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\ole32.dll [ntdll.dll!RtlAllocateHeap] 77CF08D0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\ole32.dll [ntdll.dll!RtlReAllocateHeap] 77CF0940

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!LoadLibraryW] 01610B70

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!LoadLibraryA] 01610BE0

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\NETAPI32.dll [ntdll.dll!RtlAllocateHeap] 77C00010

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\NETAPI32.dll [ntdll.dll!RtlFreeHeap] 77C00080

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\WS2_32.dll [ntdll.dll!RtlFreeHeap] 77C00080

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe[2636] @ C:\Windows\system32\WS2_32.dll [ntdll.dll!RtlAllocateHeap] 77C00010

 

---- Devices - GMER 1.0.15 ----

 

Device \FileSystem\Ntfs \Ntfs 855491F8

Device \Driver\NetBT \Device\NetBT_Tcpip_{A0B6DF4E-19AD-4886-9445-0938AEB86BE2} 862E71F8

Device \Driver\volmgr \Device\VolMgrControl 855441F8

Device \Driver\NetBT \Device\NetBT_Tcpip_{D3ED0050-7030-462D-88FC-034038E37030} 862E71F8

 

---- Registry - GMER 1.0.15 ----

 

Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00214f4dd33a

Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00214f4dd33a@00234542af76 0x73 0x17 0x65 0x91 ...

Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00214f4dd33a@0017e5ba95a2 0xF7 0x06 0x64 0x63 ...

Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00214f4dd33a@8c541d2c8728 0x8E 0x70 0x20 0xBC ...

Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s1 771343423

Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s2 285507792

Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@h0 1

Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC

Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\

Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...

Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0

Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x58 0x37 0x80 0x9D ...

Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001

Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...

Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x1E 0xBA 0x26 0xB8 ...

Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0

Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xE8 0x30 0xA1 0x26 ...

Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\00214f4dd33a (not active ControlSet)

Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32

Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ThreadingModel Apartment

Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ C:\Windows\system32\OLE32.DLL

Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@cd042efbbd7f7af1647644e76e06692b 0xC8 0x28 0x51 0xAF ...

Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32

Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ThreadingModel Apartment

Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ C:\Windows\system32\OLE32.DLL

Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@bca643cdc5c2726b20d2ecedcc62c59b 0x6A 0x9C 0xD6 0x61 ...

Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32

Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ThreadingModel Apartment

Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ C:\Windows\system32\OLE32.DLL

Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@2c81e34222e8052573023a60d06dd016 0xFF 0x7C 0x85 0xE0 ...

Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32

Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ThreadingModel Apartment

Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ C:\Windows\system32\OLE32.DLL

Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@2582ae41fb52324423be06337561aa48 0x3E 0x1E 0x9E 0xE0 ...

Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32

Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ThreadingModel Apartment

Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ C:\Windows\system32\OLE32.DLL

Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@caaeda5fd7a9ed7697d9686d4b818472 0xCD 0x44 0xCD 0xB9 ...

Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32

Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ThreadingModel Apartment

Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ C:\Windows\system32\OLE32.DLL

Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@a4a1bcf2cc2b8bc3716b74b2b4522f5d 0xDF 0x20 0x58 0x62 ...

Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32

Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ThreadingModel Apartment

Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ C:\Windows\system32\OLE32.DLL

Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@4d370831d2c43cd13623e232fed27b7b 0x31 0x77 0xE1 0xBA ...

Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32

Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ThreadingModel Apartment

Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ C:\Windows\system32\OLE32.DLL

Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@1d68fe701cdea33e477eb204b76f993d 0x83 0x6C 0x56 0x8B ...

Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32

Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ThreadingModel Apartment

Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ C:\Windows\system32\OLE32.DLL

Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@1fac81b91d8e3c5aa4b0a51804d844a3 0xF6 0x0F 0x4E 0x58 ...

Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32

Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ThreadingModel Apartment

Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ C:\Windows\system32\OLE32.DLL

Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@f5f62a6129303efb32fbe080bb27835b 0xB1 0xCD 0x45 0x5A ...

Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32

Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ThreadingModel Apartment

Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ C:\Windows\system32\OLE32.DLL

Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@fd4e2e1a3940b94dceb5a6a021f2e3c6 0xE3 0x0E 0x66 0xD5 ...

Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32

Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ThreadingModel Apartment

Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ C:\Windows\system32\OLE32.DLL

Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@8a8aec57dd6508a385616fbc86791ec2 0x6C 0x43 0x2D 0x1E ...

 

---- EOF - GMER 1.0.15 ----

 

 

Edytowano przez logimen

Udostępnij ten post


Link to postu
Udostępnij na innych stronach

> 3 przelewy elektroniczne "poszly w kosmos" z matki firmowego konta

 

Co to znaczy? Przelew moze sie wykonac lub nie, ewentualna infekcja nie ma tutaj nic do rzeczy.

 

> Gmer (widze rootkita), problem jak i czym go wywalic ?

 

Gdzie ten rootkit?

 

Skan przy pomocy mbam oraz cureit cos wykrywa?

 

Daj logi z MbrCheck oraz TDSSKiller:

http://ad13.geekstogo.com/MBRCheck.exe

How to remove malware belonging to the family Rootkit.Win32.TDSS (aka Tidserv, TDSServ, Alureon)?

Nawet jezeli cos wykryja to NIC nie usuwaj.

Udostępnij ten post


Link to postu
Udostępnij na innych stronach

Ok. Moze sie pomylilem z tym rootkitem. Co do przelewow to matka twierdzi, ze wyslane a nie doszly, a kasa zniknela z konta. NIe_wiem co dokladnie sie stalo bo nie ja robilem przelew bo bym widzial czy wykonany czy nie. Ew. moze byc tak, ze kasa zeszla z konta, a nic nie poszlo ? Wina banku ?

 

W kazdym badz razie, jeszzce jutro poskanuje tym czym mowiles i wrzuce logi.

Edytowano przez Kolobos

Udostępnij ten post


Link to postu
Udostępnij na innych stronach

Skoro konto zostalo obciazone to przelewy zostaly wykonane, mozesz to sprawdzic w historii. Jezeli tam sa i wszystkie dane sie zgadzaja to trzeba zadzwonic do banku i sie dowiedziec.

Udostępnij ten post


Link to postu
Udostępnij na innych stronach

TDSS Log

 

 

 

 

2011/04/26 18:56:50.0661 2628 TDSS rootkit removing tool 2.4.21.0 Mar 10 2011 12:26:28

2011/04/26 18:56:50.0957 2628 ================================================================================

2011/04/26 18:56:50.0957 2628 SystemInfo:

2011/04/26 18:56:50.0957 2628

2011/04/26 18:56:50.0957 2628 OS Version: 6.1.7600 ServicePack: 0.0

2011/04/26 18:56:50.0957 2628 Product type: Workstation

2011/04/26 18:56:50.0957 2628 ComputerName: PAWEŁ57

2011/04/26 18:56:50.0957 2628 UserName: dorotex

2011/04/26 18:56:50.0957 2628 Windows directory: C:\Windows

2011/04/26 18:56:50.0957 2628 System windows directory: C:\Windows

2011/04/26 18:56:50.0957 2628 Processor architecture: Intel x86

2011/04/26 18:56:50.0957 2628 Number of processors: 2

2011/04/26 18:56:50.0957 2628 Page size: 0x1000

2011/04/26 18:56:50.0957 2628 Boot type: Normal boot

2011/04/26 18:56:50.0957 2628 ================================================================================

2011/04/26 18:56:58.0960 2628 Initialize success

2011/04/26 18:57:05.0621 3736 ================================================================================

2011/04/26 18:57:05.0621 3736 Scan started

2011/04/26 18:57:05.0621 3736 Mode: Manual;

2011/04/26 18:57:05.0621 3736 ================================================================================

2011/04/26 18:57:07.0228 3736 1394ohci (bf02f806c873abb04b197161e8e5a316) C:\Windows\system32\DRIVERS\1394ohci.sys

2011/04/26 18:57:07.0290 3736 ACPI (f0e07d144c8685b8774bc32fc8da4df0) C:\Windows\system32\drivers\ACPI.sys

2011/04/26 18:57:07.0400 3736 AcpiPmi (98d81ca942d19f7d9153b095162ac013) C:\Windows\system32\drivers\acpipmi.sys

2011/04/26 18:57:07.0524 3736 adp94xx (21e785ebd7dc90a06391141aac7892fb) C:\Windows\system32\drivers\adp94xx.sys

2011/04/26 18:57:07.0556 3736 adpahci (0c676bc278d5b59ff5abd57bbe9123f2) C:\Windows\system32\drivers\adpahci.sys

2011/04/26 18:57:07.0680 3736 adpu320 (7c7b5ee4b7b822ec85321fe23a27db33) C:\Windows\system32\drivers\adpu320.sys

2011/04/26 18:57:07.0743 3736 AFD (ddc040fdb01ef1712a6b13e52afb104c) C:\Windows\system32\drivers\afd.sys

2011/04/26 18:57:07.0868 3736 agp440 (507812c3054c21cef746b6ee3d04dd6e) C:\Windows\system32\drivers\agp440.sys

2011/04/26 18:57:07.0930 3736 aic78xx (8b30250d573a8f6b4bd23195160d8707) C:\Windows\system32\drivers\djsvs.sys

2011/04/26 18:57:08.0039 3736 aliide (0d40bcf52ea90fc7df2aeab6503dea44) C:\Windows\system32\drivers\aliide.sys

2011/04/26 18:57:08.0133 3736 amdagp (3c6600a0696e90a463771c7422e23ab5) C:\Windows\system32\drivers\amdagp.sys

2011/04/26 18:57:08.0211 3736 amdide (cd5914170297126b6266860198d1d4f0) C:\Windows\system32\drivers\amdide.sys

2011/04/26 18:57:08.0258 3736 AmdK8 (00dda200d71bac534bf56a9db5dfd666) C:\Windows\system32\drivers\amdk8.sys

2011/04/26 18:57:08.0460 3736 amdkmdag (a91e07a35c0f31da7905f4a79d1ad924) C:\Windows\system32\DRIVERS\atikmdag.sys

2011/04/26 18:57:08.0741 3736 amdkmdap (baac8ebb76c4cc16a342670263b0ef4d) C:\Windows\system32\DRIVERS\atikmpag.sys

2011/04/26 18:57:08.0804 3736 AmdPPM (3cbf30f5370fda40dd3e87df38ea53b6) C:\Windows\system32\drivers\amdppm.sys

2011/04/26 18:57:08.0897 3736 amdsata (2101a86c25c154f8314b24ef49d7fbc2) C:\Windows\system32\drivers\amdsata.sys

2011/04/26 18:57:08.0944 3736 amdsbs (ea43af0c423ff267355f74e7a53bdaba) C:\Windows\system32\drivers\amdsbs.sys

2011/04/26 18:57:09.0006 3736 amdxata (b81c2b5616f6420a9941ea093a92b150) C:\Windows\system32\drivers\amdxata.sys

2011/04/26 18:57:09.0116 3736 AmUStor (d2bf422c2611632afb9ce8f7b2a8c306) C:\Windows\system32\drivers\AmUStor.SYS

2011/04/26 18:57:09.0194 3736 ApfiltrService (9325e49d555d8f12ce1735227dbb3d80) C:\Windows\system32\DRIVERS\Apfiltr.sys

2011/04/26 18:57:09.0334 3736 AppID (feb834c02ce1e84b6a38f953ca067706) C:\Windows\system32\drivers\appid.sys

2011/04/26 18:57:09.0459 3736 arc (2932004f49677bd84dbc72edb754ffb3) C:\Windows\system32\drivers\arc.sys

2011/04/26 18:57:09.0490 3736 arcsas (5d6f36c46fd283ae1b57bd2e9feb0bc7) C:\Windows\system32\drivers\arcsas.sys

2011/04/26 18:57:09.0615 3736 AsyncMac (add2ade1c2b285ab8378d2daaf991481) C:\Windows\system32\DRIVERS\asyncmac.sys

2011/04/26 18:57:09.0662 3736 atapi (338c86357871c167a96ab976519bf59e) C:\Windows\system32\drivers\atapi.sys

2011/04/26 18:57:09.0927 3736 atikmdag (a91e07a35c0f31da7905f4a79d1ad924) C:\Windows\system32\DRIVERS\atikmdag.sys

2011/04/26 18:57:10.0098 3736 b06bdrv (1a231abec60fd316ec54c66715543cec) C:\Windows\system32\drivers\bxvbdx.sys

2011/04/26 18:57:10.0223 3736 b57nd60x (bd8869eb9cde6bbe4508d869929869ee) C:\Windows\system32\DRIVERS\b57nd60x.sys

2011/04/26 18:57:10.0348 3736 Beep (505506526a9d467307b3c393dedaf858) C:\Windows\system32\drivers\Beep.sys

2011/04/26 18:57:10.0410 3736 blbdrive (2287078ed48fcfc477b05b20cf38f36f) C:\Windows\system32\DRIVERS\blbdrive.sys

2011/04/26 18:57:10.0520 3736 bowser (9a5c671b7fbae4865149bb11f59b91b2) C:\Windows\system32\DRIVERS\bowser.sys

2011/04/26 18:57:10.0566 3736 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\BrFiltLo.sys

2011/04/26 18:57:10.0754 3736 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\BrFiltUp.sys

2011/04/26 18:57:11.0034 3736 Brserid (845b8ce732e67f3b4133164868c666ea) C:\Windows\System32\Drivers\Brserid.sys

2011/04/26 18:57:11.0331 3736 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\System32\Drivers\BrSerWdm.sys

2011/04/26 18:57:11.0534 3736 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\System32\Drivers\BrUsbMdm.sys

2011/04/26 18:57:11.0627 3736 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\System32\Drivers\BrUsbSer.sys

2011/04/26 18:57:11.0721 3736 BthEnum (2865a5c8e98c70c605f417908cebb3a4) C:\Windows\system32\DRIVERS\BthEnum.sys

2011/04/26 18:57:11.0955 3736 BTHMODEM (ed3df7c56ce0084eb2034432fc56565a) C:\Windows\system32\DRIVERS\bthmodem.sys

2011/04/26 18:57:12.0189 3736 BthPan (ad1872e5829e8a2c3b5b4b641c3eab0e) C:\Windows\system32\DRIVERS\bthpan.sys

2011/04/26 18:57:12.0438 3736 BTHPORT (4a34888e13224678dd062466afec4240) C:\Windows\system32\Drivers\BTHport.sys

2011/04/26 18:57:12.0657 3736 BTHUSB (fa04c63916fa221dbb91fce153d07a55) C:\Windows\system32\Drivers\BTHUSB.sys

2011/04/26 18:57:12.0797 3736 cdfs (77ea11b065e0a8ab902d78145ca51e10) C:\Windows\system32\DRIVERS\cdfs.sys

2011/04/26 18:57:12.0860 3736 cdrom (656d1ec977e3c5316a62dbbe52cb9663) C:\Windows\system32\DRIVERS\cdrom.sys

2011/04/26 18:57:13.0062 3736 circlass (3fe3fe94a34df6fb06e6418d0f6a0060) C:\Windows\system32\drivers\circlass.sys

2011/04/26 18:57:13.0156 3736 CLFS (635181e0e9bbf16871bf5380d71db02d) C:\Windows\system32\CLFS.sys

2011/04/26 18:57:13.0296 3736 CmBatt (dea805815e587dad1dd2c502220b5616) C:\Windows\system32\DRIVERS\CmBatt.sys

2011/04/26 18:57:13.0562 3736 cmdide (c537b1db64d495b9b4717b4d6d9edbf2) C:\Windows\system32\drivers\cmdide.sys

2011/04/26 18:57:13.0718 3736 CNG (1b675691ed940766149c93e8f4488d68) C:\Windows\system32\Drivers\cng.sys

2011/04/26 18:57:13.0905 3736 Compbatt (a6023d3823c37043986713f118a89bee) C:\Windows\system32\drivers\compbatt.sys

2011/04/26 18:57:14.0154 3736 CompositeBus (f1724ba27e97d627f808fb0ba77a28a6) C:\Windows\system32\DRIVERS\CompositeBus.sys

2011/04/26 18:57:14.0342 3736 crcdisk (2c4ebcfc84a9b44f209dff6c6e6c61d1) C:\Windows\system32\drivers\crcdisk.sys

2011/04/26 18:57:14.0451 3736 CSC (27c9490bdd0ae48911ab8cf1932591ed) C:\Windows\system32\drivers\csc.sys

2011/04/26 18:57:14.0529 3736 DfsC (8e09e52ee2e3ceb199ef3dd99cf9e3fb) C:\Windows\system32\Drivers\dfsc.sys

2011/04/26 18:57:14.0607 3736 discache (1a050b0274bfb3890703d490f330c0da) C:\Windows\system32\drivers\discache.sys

2011/04/26 18:57:14.0685 3736 Disk (565003f326f99802e68ca78f2a68e9ff) C:\Windows\system32\DRIVERS\disk.sys

2011/04/26 18:57:14.0810 3736 drmkaud (b918e7c5f9bf77202f89e1a9539f2eb4) C:\Windows\system32\drivers\drmkaud.sys

2011/04/26 18:57:14.0856 3736 DXGKrnl (8b6c3464d7fac176500061dbfff42ad4) C:\Windows\System32\drivers\dxgkrnl.sys

2011/04/26 18:57:14.0919 3736 E1G60 (22ef8965101685add128f03a2b03ce16) C:\Windows\system32\DRIVERS\E1G60I32.sys

2011/04/26 18:57:15.0090 3736 ebdrv (024e1b5cac09731e4d868e64dbfb4ab0) C:\Windows\system32\drivers\evbdx.sys

2011/04/26 18:57:15.0262 3736 elxstor (0ed67910c8c326796faa00b2bf6d9d3c) C:\Windows\system32\drivers\elxstor.sys

2011/04/26 18:57:15.0293 3736 ErrDev (8fc3208352dd3912c94367a206ab3f11) C:\Windows\system32\drivers\errdev.sys

2011/04/26 18:57:15.0434 3736 exfat (2dc9108d74081149cc8b651d3a26207f) C:\Windows\system32\drivers\exfat.sys

2011/04/26 18:57:15.0465 3736 fastfat (7e0ab74553476622fb6ae36f73d97d35) C:\Windows\system32\drivers\fastfat.sys

2011/04/26 18:57:15.0527 3736 fdc (e817a017f82df2a1f8cfdbda29388b29) C:\Windows\system32\drivers\fdc.sys

2011/04/26 18:57:15.0636 3736 FileInfo (6cf00369c97f3cf563be99be983d13d8) C:\Windows\system32\drivers\fileinfo.sys

2011/04/26 18:57:15.0683 3736 Filetrace (42c51dc94c91da21cb9196eb64c45db9) C:\Windows\system32\drivers\filetrace.sys

2011/04/26 18:57:15.0699 3736 flpydisk (87907aa70cb3c56600f1c2fb8841579b) C:\Windows\system32\drivers\flpydisk.sys

2011/04/26 18:57:15.0761 3736 FltMgr (7520ec808e0c35e0ee6f841294316653) C:\Windows\system32\drivers\fltmgr.sys

2011/04/26 18:57:15.0886 3736 FsDepends (1a16b57943853e598cff37fe2b8cbf1d) C:\Windows\system32\drivers\FsDepends.sys

2011/04/26 18:57:15.0902 3736 Fs_Rec (a574b4360e438977038aae4bf60d79a2) C:\Windows\system32\drivers\Fs_Rec.sys

2011/04/26 18:57:15.0980 3736 FTDIBUS (b7aa8283ec551d3a3b924e520e0621a7) C:\Windows\system32\drivers\ftdibus.sys

2011/04/26 18:57:16.0104 3736 FTSER2K (596d31583ce332b5514520d74837f434) C:\Windows\system32\drivers\ftser2k.sys

2011/04/26 18:57:16.0182 3736 fvevol (dafbd9fe39197495aed6d51f3b85b5d2) C:\Windows\system32\DRIVERS\fvevol.sys

2011/04/26 18:57:16.0276 3736 gagp30kx (65ee0c7a58b65e74ae05637418153938) C:\Windows\system32\drivers\gagp30kx.sys

2011/04/26 18:57:16.0338 3736 ggflt (007aea2e06e7cef7372e40c277163959) C:\Windows\system32\DRIVERS\ggflt.sys

2011/04/26 18:57:16.0385 3736 ggsemc (c73de35960ca75c5ab4ae636b127c64e) C:\Windows\system32\DRIVERS\ggsemc.sys

2011/04/26 18:57:16.0588 3736 hcw85cir (c44e3c2bab6837db337ddee7544736db) C:\Windows\system32\drivers\hcw85cir.sys

2011/04/26 18:57:16.0635 3736 HDAudBus (717a2207fd6f13ad3e664c7d5a43c7bf) C:\Windows\system32\DRIVERS\HDAudBus.sys

2011/04/26 18:57:16.0744 3736 HidBatt (1d58a7f3e11a9731d0eaaaa8405acc36) C:\Windows\system32\drivers\HidBatt.sys

2011/04/26 18:57:16.0791 3736 HidBth (89448f40e6df260c206a193a4683ba78) C:\Windows\system32\DRIVERS\hidbth.sys

2011/04/26 18:57:16.0822 3736 HidIr (cf50b4cf4a4f229b9f3c08351f99ca5e) C:\Windows\system32\drivers\hidir.sys

2011/04/26 18:57:16.0931 3736 HidUsb (25072fb35ac90b25f9e4e3bacf774102) C:\Windows\system32\DRIVERS\hidusb.sys

2011/04/26 18:57:16.0978 3736 HpSAMD (295fdc419039090eb8b49ffdbb374549) C:\Windows\system32\drivers\HpSAMD.sys

2011/04/26 18:57:17.0025 3736 HTTP (c531c7fd9e8b62021112787c4e2c5a5a) C:\Windows\system32\drivers\HTTP.sys

2011/04/26 18:57:17.0150 3736 hwpolicy (8305f33cde89ad6c7a0763ed0b5a8d42) C:\Windows\system32\drivers\hwpolicy.sys

2011/04/26 18:57:17.0274 3736 i8042prt (f151f0bdc47f4a28b1b20a0818ea36d6) C:\Windows\system32\DRIVERS\i8042prt.sys

2011/04/26 18:57:17.0337 3736 iaStorV (934af4d7c5f457b9f0743f4299b77b67) C:\Windows\system32\drivers\iaStorV.sys

2011/04/26 18:57:17.0493 3736 iirsp (4173ff5708f3236cf25195fecd742915) C:\Windows\system32\drivers\iirsp.sys

2011/04/26 18:57:17.0602 3736 IntcAzAudAddService (d0a6c0ceb3b74a91884f804ff4f031c0) C:\Windows\system32\drivers\RTKVHDA.sys

2011/04/26 18:57:17.0742 3736 intelide (a0f12f2c9ba6c72f3987ce780e77c130) C:\Windows\system32\drivers\intelide.sys

2011/04/26 18:57:17.0774 3736 intelppm (3b514d27bfc4accb4037bc6685f766e0) C:\Windows\system32\DRIVERS\intelppm.sys

2011/04/26 18:57:17.0883 3736 ioatdma (e2c2ce489356943c1922b8353dcdad05) C:\Windows\System32\Drivers\qd26032.sys

2011/04/26 18:57:17.0930 3736 ioatdma1 (c4317da9066ef0678db2b68492523b38) C:\Windows\System32\Drivers\qd16032.sys

2011/04/26 18:57:18.0008 3736 IpFilterDriver (709d1761d3b19a932ff0238ea6d50200) C:\Windows\system32\DRIVERS\ipfltdrv.sys

2011/04/26 18:57:18.0086 3736 IPMIDRV (e4454b6c37d7ffd5649611f6496308a7) C:\Windows\system32\drivers\IPMIDrv.sys

2011/04/26 18:57:18.0117 3736 IPNAT (a5fa468d67abcdaa36264e463a7bb0cd) C:\Windows\system32\drivers\ipnat.sys

2011/04/26 18:57:18.0164 3736 IRENUM (42996cff20a3084a56017b7902307e9f) C:\Windows\system32\drivers\irenum.sys

2011/04/26 18:57:18.0210 3736 isapnp (1f32bb6b38f62f7df1a7ab7292638a35) C:\Windows\system32\drivers\isapnp.sys

2011/04/26 18:57:18.0304 3736 iScsiPrt (ed46c223ae46c6866ab77cdc41c404b7) C:\Windows\system32\drivers\msiscsi.sys

2011/04/26 18:57:18.0351 3736 iSSetup (2247354a4d999c9cbb4d61b2a27576b9) C:\Windows\system32\DRIVERS\iSSetup.sys

2011/04/26 18:57:18.0491 3736 kbdclass (adef52ca1aeae82b50df86b56413107e) C:\Windows\system32\DRIVERS\kbdclass.sys

2011/04/26 18:57:18.0522 3736 kbdhid (3d9f0ebf350edcfd6498057301455964) C:\Windows\system32\DRIVERS\kbdhid.sys

2011/04/26 18:57:18.0585 3736 kl1 (ce3958f58547454884e97bda78cd7040) C:\Windows\system32\DRIVERS\kl1.sys

2011/04/26 18:57:18.0710 3736 klbg (53eedab3f0511321ac3ae8bc968b158c) C:\Windows\system32\drivers\klbg.sys

2011/04/26 18:57:18.0866 3736 KLIF (de6c14fb8438ef932d9f58f269a19b85) C:\Windows\system32\DRIVERS\klif.sys

2011/04/26 18:57:18.0944 3736 KLIM6 (892cc162dc88ab084c86485879526c59) C:\Windows\system32\DRIVERS\klim6.sys

2011/04/26 18:57:19.0053 3736 KSecDD (e36a061ec11b373826905b21be10948f) C:\Windows\system32\Drivers\ksecdd.sys

2011/04/26 18:57:19.0100 3736 KSecPkg (ebcc522bf6ee19dddfa00057e1d52039) C:\Windows\system32\Drivers\ksecpkg.sys

2011/04/26 18:57:19.0240 3736 LgBttPort (fa522813fdca27e60302b77f169972af) C:\Windows\system32\DRIVERS\lgbtport.sys

2011/04/26 18:57:19.0334 3736 lgbusenum (50707aa5d4bb694e3f6b0a00b09e664a) C:\Windows\system32\DRIVERS\lgbtbus.sys

2011/04/26 18:57:19.0474 3736 lgmdbus (54fec13b60914784aa06685f352aed70) C:\Windows\system32\DRIVERS\lgmdbus.sys

2011/04/26 18:57:19.0536 3736 lgmdmdfl (97b52613f0b621fc9eae007668da7b01) C:\Windows\system32\DRIVERS\lgmdmdfl.sys

2011/04/26 18:57:19.0583 3736 lgmdmdm (b9cc203836509083d8be07b6a5b40862) C:\Windows\system32\DRIVERS\lgmdmdm.sys

2011/04/26 18:57:19.0724 3736 lgmdmgmt (b5e3263ca8173f9619075898df5d4718) C:\Windows\system32\DRIVERS\lgmdmgmt.sys

2011/04/26 18:57:19.0786 3736 lgmdobex (a218c22fd0c4b8ac3ce38e08d1ac9e88) C:\Windows\system32\DRIVERS\lgmdobex.sys

2011/04/26 18:57:19.0911 3736 LGVMODEM (7a47926c78596d1e245d27e1aeb7bf55) C:\Windows\system32\DRIVERS\lgvmodem.sys

2011/04/26 18:57:20.0020 3736 lltdio (f7611ec07349979da9b0ae1f18ccc7a6) C:\Windows\system32\DRIVERS\lltdio.sys

2011/04/26 18:57:20.0129 3736 LSI_FC (eb119a53ccf2acc000ac71b065b78fef) C:\Windows\system32\drivers\lsi_fc.sys

2011/04/26 18:57:20.0176 3736 LSI_SAS (8ade1c877256a22e49b75d1cc9161f9c) C:\Windows\system32\drivers\lsi_sas.sys

2011/04/26 18:57:20.0207 3736 LSI_SAS2 (dc9dc3d3daa0e276fd2ec262e38b11e9) C:\Windows\system32\drivers\lsi_sas2.sys

2011/04/26 18:57:20.0238 3736 LSI_SCSI (0a036c7d7cab643a7f07135ac47e0524) C:\Windows\system32\drivers\lsi_scsi.sys

2011/04/26 18:57:20.0316 3736 luafv (6703e366cc18d3b6e534f5cf7df39cee) C:\Windows\system32\drivers\luafv.sys

2011/04/26 18:57:20.0441 3736 megasas (0fff5b045293002ab38eb1fd1fc2fb74) C:\Windows\system32\drivers\megasas.sys

2011/04/26 18:57:20.0535 3736 MegaSR (dcbab2920c75f390caf1d29f675d03d6) C:\Windows\system32\drivers\MegaSR.sys

2011/04/26 18:57:20.0613 3736 Modem (f001861e5700ee84e2d4e52c712f4964) C:\Windows\system32\drivers\modem.sys

2011/04/26 18:57:20.0675 3736 monitor (79d10964de86b292320e9dfe02282a23) C:\Windows\system32\DRIVERS\monitor.sys

2011/04/26 18:57:20.0753 3736 mouclass (fb18cc1d4c2e716b6b903b0ac0cc0609) C:\Windows\system32\DRIVERS\mouclass.sys

2011/04/26 18:57:20.0800 3736 mouhid (2c388d2cd01c9042596cf3c8f3c7b24d) C:\Windows\system32\DRIVERS\mouhid.sys

2011/04/26 18:57:20.0909 3736 mountmgr (921c18727c5920d6c0300736646931c2) C:\Windows\system32\drivers\mountmgr.sys

2011/04/26 18:57:20.0956 3736 mpio (2af5997438c55fb79d33d015c30e1974) C:\Windows\system32\drivers\mpio.sys

2011/04/26 18:57:20.0987 3736 mpsdrv (ad2723a7b53dd1aacae6ad8c0bfbf4d0) C:\Windows\system32\drivers\mpsdrv.sys

2011/04/26 18:57:21.0018 3736 MRxDAV (b1be47008d20e43da3adc37c24cdb89d) C:\Windows\system32\drivers\mrxdav.sys

2011/04/26 18:57:21.0143 3736 mrxsmb (b4c76ef46322a9711c7b0f4e21ef6ea5) C:\Windows\system32\DRIVERS\mrxsmb.sys

2011/04/26 18:57:21.0206 3736 mrxsmb10 (e593d45024a3fdd11e93cc4a6ca91101) C:\Windows\system32\DRIVERS\mrxsmb10.sys

2011/04/26 18:57:21.0330 3736 mrxsmb20 (a9f86c82c9cc3b679cc3957e1183a30f) C:\Windows\system32\DRIVERS\mrxsmb20.sys

2011/04/26 18:57:21.0393 3736 msahci (bb14a640e7f234f260d1aa19a60cf960) C:\Windows\system32\drivers\msahci.sys

2011/04/26 18:57:21.0486 3736 msdsm (455029c7174a2dbb03dba8a0d8bddd9a) C:\Windows\system32\drivers\msdsm.sys

2011/04/26 18:57:21.0518 3736 Msfs (daefb28e3af5a76abcc2c3078c07327f) C:\Windows\system32\drivers\Msfs.sys

2011/04/26 18:57:21.0549 3736 mshidkmdf (3e1e5767043c5af9367f0056295e9f84) C:\Windows\System32\drivers\mshidkmdf.sys

2011/04/26 18:57:21.0580 3736 msisadrv (0a4e5757ae09fa9622e3158cc1aef114) C:\Windows\system32\drivers\msisadrv.sys

2011/04/26 18:57:21.0642 3736 MSKSSRV (8c0860d6366aaffb6c5bb9df9448e631) C:\Windows\system32\drivers\MSKSSRV.sys

2011/04/26 18:57:21.0736 3736 MSPCLOCK (3ea8b949f963562cedbb549eac0c11ce) C:\Windows\system32\drivers\MSPCLOCK.sys

2011/04/26 18:57:21.0752 3736 MSPQM (f456e973590d663b1073e9c463b40932) C:\Windows\system32\drivers\MSPQM.sys

2011/04/26 18:57:21.0783 3736 MsRPC (0e008fc4819d238c51d7c93e7b41e560) C:\Windows\system32\drivers\MsRPC.sys

2011/04/26 18:57:21.0830 3736 mssmbios (fc6b9ff600cc585ea38b12589bd4e246) C:\Windows\system32\DRIVERS\mssmbios.sys

2011/04/26 18:57:21.0986 3736 MSTEE (b42c6b921f61a6e55159b8be6cd54a36) C:\Windows\system32\drivers\MSTEE.sys

2011/04/26 18:57:22.0032 3736 MTConfig (33599130f44e1f34631cea241de8ac84) C:\Windows\system32\drivers\MTConfig.sys

2011/04/26 18:57:22.0048 3736 Mup (159fad02f64e6381758c990f753bcc80) C:\Windows\system32\Drivers\mup.sys

2011/04/26 18:57:22.0204 3736 NativeWifiP (26384429fcd85d83746f63e798ab1480) C:\Windows\system32\DRIVERS\nwifi.sys

2011/04/26 18:57:22.0266 3736 NDIS (779e9149d3662ed6beb58a67e3c775f4) C:\Windows\system32\drivers\ndis.sys

2011/04/26 18:57:22.0407 3736 NdisCap (0e1787aa6c9191d3d319e8bafe86f80c) C:\Windows\system32\DRIVERS\ndiscap.sys

2011/04/26 18:57:22.0422 3736 NdisTapi (e4a8aec125a2e43a9e32afeea7c9c888) C:\Windows\system32\DRIVERS\ndistapi.sys

2011/04/26 18:57:22.0500 3736 Ndisuio (b30ae7f2b6d7e343b0df32e6c08fce75) C:\Windows\system32\DRIVERS\ndisuio.sys

2011/04/26 18:57:22.0532 3736 NdisWan (267c415eadcbe53c9ca873dee39cf3a4) C:\Windows\system32\DRIVERS\ndiswan.sys

2011/04/26 18:57:22.0563 3736 NDProxy (af7e7c63dcef3f8772726f86039d6eb4) C:\Windows\system32\drivers\NDProxy.sys

2011/04/26 18:57:22.0625 3736 NetBIOS (80b275b1ce3b0e79909db7b39af74d51) C:\Windows\system32\DRIVERS\netbios.sys

2011/04/26 18:57:22.0719 3736 NetBT (dd52a733bf4ca5af84562a5e2f963b91) C:\Windows\system32\DRIVERS\netbt.sys

2011/04/26 18:57:23.0015 3736 NETw5v32 (ac11813196ad734b8aa6164c8491f37f) C:\Windows\system32\DRIVERS\NETw5v32.sys

2011/04/26 18:57:23.0327 3736 nfrd960 (1d85c4b390b0ee09c7a46b91efb2c097) C:\Windows\system32\drivers\nfrd960.sys

2011/04/26 18:57:23.0483 3736 nmwcd (c3963d85b721a7f80d8a55f4e2867a3a) C:\Windows\system32\drivers\ccdcmb.sys

2011/04/26 18:57:23.0670 3736 nmwcdc (3859c69a77793180548802dac9f34a38) C:\Windows\system32\drivers\ccdcmbo.sys

2011/04/26 18:57:23.0748 3736 Npfs (1db262a9f8c087e8153d89bef3d2235f) C:\Windows\system32\drivers\Npfs.sys

2011/04/26 18:57:23.0936 3736 nsiproxy (e9a0a4d07e53d8fea2bb8387a3293c58) C:\Windows\system32\drivers\nsiproxy.sys

2011/04/26 18:57:24.0123 3736 Ntfs (3795dcd21f740ee799fb7223234215af) C:\Windows\system32\drivers\Ntfs.sys

2011/04/26 18:57:24.0232 3736 Null (f9756a98d69098dca8945d62858a812c) C:\Windows\system32\drivers\Null.sys

2011/04/26 18:57:24.0263 3736 nvraid (3f3d04b1d08d43c16ea7963954ec768d) C:\Windows\system32\drivers\nvraid.sys

2011/04/26 18:57:24.0294 3736 nvstor (c99f251a5de63c6f129cf71933aced0f) C:\Windows\system32\drivers\nvstor.sys

2011/04/26 18:57:24.0310 3736 nv_agp (5a0983915f02bae73267cc2a041f717d) C:\Windows\system32\drivers\nv_agp.sys

2011/04/26 18:57:24.0435 3736 O2MDRDR (908593eac1ffe529fe760b0a378b3600) C:\Windows\system32\DRIVERS\o2media.sys

2011/04/26 18:57:24.0497 3736 O2SDRDR (e5e4f48a17cdd4683936b06563ba1c51) C:\Windows\system32\DRIVERS\o2sd.sys

2011/04/26 18:57:24.0575 3736 ohci1394 (08a70a1f2cdde9bb49b885cb817a66eb) C:\Windows\system32\drivers\ohci1394.sys

2011/04/26 18:57:24.0731 3736 Parport (2ea877ed5dd9713c5ac74e8ea7348d14) C:\Windows\system32\drivers\parport.sys

2011/04/26 18:57:24.0794 3736 partmgr (ff4218952b51de44fe910953a3e686b9) C:\Windows\system32\drivers\partmgr.sys

2011/04/26 18:57:24.0825 3736 Parvdm (eb0a59f29c19b86479d36b35983daadc) C:\Windows\system32\drivers\parvdm.sys

2011/04/26 18:57:24.0903 3736 pccsmcfd (fd2041e9ba03db7764b2248f02475079) C:\Windows\system32\DRIVERS\pccsmcfd.sys

2011/04/26 18:57:25.0043 3736 pci (80a4748a0304715c29093311795ac448) C:\Windows\system32\drivers\pci.sys

2011/04/26 18:57:25.0106 3736 pciide (afe86f419014db4e5593f69ffe26ce0a) C:\Windows\system32\drivers\pciide.sys

2011/04/26 18:57:25.0152 3736 pcmcia (f396431b31693e71e8a80687ef523506) C:\Windows\system32\drivers\pcmcia.sys

2011/04/26 18:57:25.0308 3736 pcw (250f6b43d2b613172035c6747aeeb19f) C:\Windows\system32\drivers\pcw.sys

2011/04/26 18:57:25.0464 3736 PEAUTH (9e0104ba49f4e6973749a02bf41344ed) C:\Windows\system32\drivers\peauth.sys

2011/04/26 18:57:25.0730 3736 PptpMiniport (631e3e205ad6d86f2aed6a4a8e69f2db) C:\Windows\system32\DRIVERS\raspptp.sys

2011/04/26 18:57:25.0854 3736 Processor (85b1e3a0c7585bc4aae6899ec6fcf011) C:\Windows\system32\drivers\processr.sys

2011/04/26 18:57:25.0917 3736 Psched (6270ccae2a86de6d146529fe55b3246a) C:\Windows\system32\DRIVERS\pacer.sys

2011/04/26 18:57:26.0088 3736 ql2300 (ab95ecf1f6659a60ddc166d8315b0751) C:\Windows\system32\drivers\ql2300.sys

2011/04/26 18:57:26.0260 3736 ql40xx (b4dd51dd25182244b86737dc51af2270) C:\Windows\system32\drivers\ql40xx.sys

2011/04/26 18:57:26.0307 3736 QWAVEdrv (584078ca1b95ca72df2a27c336f9719d) C:\Windows\system32\drivers\qwavedrv.sys

2011/04/26 18:57:26.0416 3736 RasAcd (30a81b53c766d0133bb86d234e5556ab) C:\Windows\system32\DRIVERS\rasacd.sys

2011/04/26 18:57:26.0478 3736 RasAgileVpn (57ec4aef73660166074d8f7f31c0d4fd) C:\Windows\system32\DRIVERS\AgileVpn.sys

2011/04/26 18:57:26.0588 3736 Rasl2tp (d9f91eafec2815365cbe6d167e4e332a) C:\Windows\system32\DRIVERS\rasl2tp.sys

2011/04/26 18:57:26.0619 3736 RasPppoe (0fe8b15916307a6ac12bfb6a63e45507) C:\Windows\system32\DRIVERS\raspppoe.sys

2011/04/26 18:57:26.0666 3736 RasSstp (44101f495a83ea6401d886e7fd70096b) C:\Windows\system32\DRIVERS\rassstp.sys

2011/04/26 18:57:26.0775 3736 rdbss (835d7e81bf517a3b72384bdcc85e1ce6) C:\Windows\system32\DRIVERS\rdbss.sys

2011/04/26 18:57:26.0822 3736 rdpbus (0d8f05481cb76e70e1da06ee9f0da9df) C:\Windows\system32\DRIVERS\rdpbus.sys

2011/04/26 18:57:26.0915 3736 RDPCDD (1e016846895b15a99f9a176a05029075) C:\Windows\system32\DRIVERS\RDPCDD.sys

2011/04/26 18:57:26.0946 3736 RDPDR (c5ff95883ffef704d50c40d21cfb3ab5) C:\Windows\system32\drivers\rdpdr.sys

2011/04/26 18:57:27.0024 3736 RDPENCDD (5a53ca1598dd4156d44196d200c94b8a) C:\Windows\system32\drivers\rdpencdd.sys

2011/04/26 18:57:27.0134 3736 RDPREFMP (44b0a53cd4f27d50ed461dae0c0b4e1f) C:\Windows\system32\drivers\rdprefmp.sys

2011/04/26 18:57:27.0196 3736 RDPWD (801371ba9782282892d00aadb08ee367) C:\Windows\system32\drivers\RDPWD.sys

2011/04/26 18:57:27.0305 3736 rdyboost (4ea225bf1cf05e158853f30a99ca29a7) C:\Windows\system32\drivers\rdyboost.sys

2011/04/26 18:57:27.0352 3736 RFCOMM (cb928d9e6daf51879dd6ba8d02f01321) C:\Windows\system32\DRIVERS\rfcomm.sys

2011/04/26 18:57:27.0446 3736 rimmptsk (df672613fbbcd58c38bb0bc2694bcfb0) C:\Windows\system32\DRIVERS\rimmptsk.sys

2011/04/26 18:57:27.0539 3736 rimspci (af213955c4d952c914620e8db0cd0cf7) C:\Windows\system32\DRIVERS\rimspe86.sys

2011/04/26 18:57:27.0648 3736 rimsptsk (9bfb54d3559f2ff7301271d29d383564) C:\Windows\system32\DRIVERS\rimsptsk.sys

2011/04/26 18:57:27.0758 3736 risdpcie (6978decc2c38c5ce10a8b0f2b12f4451) C:\Windows\system32\DRIVERS\risdpe86.sys

2011/04/26 18:57:27.0820 3736 rismxdp (dcb87da83cc1010cbc9fc4dc9e395bbc) C:\Windows\system32\DRIVERS\rixdptsk.sys

2011/04/26 18:57:27.0867 3736 rixdpcie (764c1f3453e779724ba647327de7ddd4) C:\Windows\system32\DRIVERS\rixdpe86.sys

2011/04/26 18:57:27.0960 3736 rspndr (032b0d36ad92b582d869879f5af5b928) C:\Windows\system32\DRIVERS\rspndr.sys

2011/04/26 18:57:28.0007 3736 RSUSBSTOR (83f7a29b659771e60cd71999ef57aa0c) C:\Windows\System32\Drivers\RtsUStor.sys

2011/04/26 18:57:28.0179 3736 RTHDMIAzAudService (3f521ee3308fe66bcfe688dbbc7acf7f) C:\Windows\system32\drivers\RtHDMIV.sys

2011/04/26 18:57:28.0366 3736 RTSTOR (702a60acc6c067cc3f688c801a1f76e1) C:\Windows\system32\drivers\RTSTOR.SYS

2011/04/26 18:57:28.0506 3736 s117bus (1f561844318914e7eb6e54673a4cc54c) C:\Windows\system32\DRIVERS\s117bus.sys

2011/04/26 18:57:28.0647 3736 s117mdfl (ba93eec3cdf6a63b77ae66221aa4f902) C:\Windows\system32\DRIVERS\s117mdfl.sys

2011/04/26 18:57:28.0725 3736 s117mdm (cba12fd8a8ee5b5cdfbbae2381cd6703) C:\Windows\system32\DRIVERS\s117mdm.sys

2011/04/26 18:57:28.0865 3736 s117mgmt (bd6483e64b1da17e812b34bcdefd9459) C:\Windows\system32\DRIVERS\s117mgmt.sys

2011/04/26 18:57:29.0021 3736 s117nd5 (c7ca36c3054b4cd47a1f6611b046e2f9) C:\Windows\system32\DRIVERS\s117nd5.sys

2011/04/26 18:57:29.0146 3736 s117obex (e290b3a6b58fb72ca97dd48d64e4fc1c) C:\Windows\system32\DRIVERS\s117obex.sys

2011/04/26 18:57:29.0427 3736 s117unic (5c4d1ba23c7511ac880e8ba7baa80dba) C:\Windows\system32\DRIVERS\s117unic.sys

2011/04/26 18:57:29.0864 3736 s3cap (5423d8437051e89dd34749f242c98648) C:\Windows\system32\drivers\vms3cap.sys

2011/04/26 18:57:30.0129 3736 sbp2port (34ee0c44b724e3e4ce2eff29126de5b5) C:\Windows\system32\drivers\sbp2port.sys

2011/04/26 18:57:30.0363 3736 scfilter (a95c54b2ac3cc9c73fcdf9e51a1d6b51) C:\Windows\system32\DRIVERS\scfilter.sys

2011/04/26 18:57:30.0722 3736 sdbus (aa826e35f6d28a8e5d1efeb337f24ba2) C:\Windows\system32\DRIVERS\sdbus.sys

2011/04/26 18:57:30.0987 3736 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys

2011/04/26 18:57:31.0236 3736 seehcri (e5b56569a9f79b70314fede6c953641e) C:\Windows\system32\DRIVERS\seehcri.sys

2011/04/26 18:57:31.0424 3736 Serenum (9ad8b8b515e3df6acd4212ef465de2d1) C:\Windows\system32\DRIVERS\serenum.sys

2011/04/26 18:57:31.0455 3736 Serial (5fb7fcea0490d821f26f39cc5ea3d1e2) C:\Windows\system32\drivers\serial.sys

2011/04/26 18:57:31.0486 3736 sermouse (79bffb520327ff916a582dfea17aa813) C:\Windows\system32\drivers\sermouse.sys

2011/04/26 18:57:31.0689 3736 SFEP (8b7c1768d2cde2e02e09a66563ddfd16) C:\Windows\system32\DRIVERS\SFEP.sys

2011/04/26 18:57:31.0876 3736 sffdisk (9f976e1eb233df46fce808d9dea3eb9c) C:\Windows\system32\DRIVERS\sffdisk.sys

2011/04/26 18:57:31.0954 3736 sffp_mmc (932a68ee27833cfd57c1639d375f2731) C:\Windows\system32\drivers\sffp_mmc.sys

2011/04/26 18:57:32.0016 3736 sffp_sd (a0708bbd07d245c06ff9de549ca47185) C:\Windows\system32\DRIVERS\sffp_sd.sys

2011/04/26 18:57:32.0032 3736 sfloppy (db96666cc8312ebc45032f30b007a547) C:\Windows\system32\drivers\sfloppy.sys

2011/04/26 18:57:32.0079 3736 sisagp (2565cac0dc9fe0371bdce60832582b2e) C:\Windows\system32\drivers\sisagp.sys

2011/04/26 18:57:32.0126 3736 SiSRaid2 (a9f0486851becb6dda1d89d381e71055) C:\Windows\system32\drivers\SiSRaid2.sys

2011/04/26 18:57:32.0157 3736 SiSRaid4 (3727097b55738e2f554972c3be5bc1aa) C:\Windows\system32\drivers\sisraid4.sys

2011/04/26 18:57:32.0250 3736 Smb (3e21c083b8a01cb70ba1f09303010fce) C:\Windows\system32\DRIVERS\smb.sys

2011/04/26 18:57:32.0328 3736 snapman (e78c98378a071ce4d48a7c514fa98fa1) C:\Windows\system32\DRIVERS\snapman.sys

2011/04/26 18:57:32.0469 3736 spldr (95cf1ae7527fb70f7816563cbc09d942) C:\Windows\system32\drivers\spldr.sys

2011/04/26 18:57:32.0578 3736 sptd (cdddec541bc3c96f91ecb48759673505) C:\Windows\system32\Drivers\sptd.sys

2011/04/26 18:57:32.0578 3736 Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: cdddec541bc3c96f91ecb48759673505

2011/04/26 18:57:32.0578 3736 sptd - detected Locked file (1)

2011/04/26 18:57:32.0765 3736 srv (4a9b0f215de2519e2363f91df25c1e97) C:\Windows\system32\DRIVERS\srv.sys

2011/04/26 18:57:32.0921 3736 srv2 (14c44875518ae1c982e54ea8c5f7fe28) C:\Windows\system32\DRIVERS\srv2.sys

2011/04/26 18:57:33.0077 3736 SrvHsfHDA (e00fdfaff025e94f9821153750c35a6d) C:\Windows\system32\DRIVERS\VSTAZL3.SYS

2011/04/26 18:57:33.0311 3736 SrvHsfV92 (ceb4e3b6890e1e42dca6694d9e59e1a0) C:\Windows\system32\DRIVERS\VSTDPV3.SYS

2011/04/26 18:57:33.0623 3736 SrvHsfWinac (bc0c7ea89194c299f051c24119000e17) C:\Windows\system32\DRIVERS\VSTCNXT3.SYS

2011/04/26 18:57:33.0873 3736 srvnet (07a14223b0a50e76ade003fdf95d4fec) C:\Windows\system32\DRIVERS\srvnet.sys

2011/04/26 18:57:34.0107 3736 stexstor (db32d325c192b801df274bfd12a7e72b) C:\Windows\system32\drivers\stexstor.sys

2011/04/26 18:57:34.0294 3736 storflt (957e346ca948668f2496a6ccf6ff82cc) C:\Windows\system32\drivers\vmstorfl.sys

2011/04/26 18:57:34.0434 3736 storvsc (d5751969dc3e4b88bf482ac8ec9fe019) C:\Windows\system32\drivers\storvsc.sys

2011/04/26 18:57:34.0497 3736 swenum (e58c78a848add9610a4db6d214af5224) C:\Windows\system32\DRIVERS\swenum.sys

2011/04/26 18:57:34.0606 3736 Tcpip (bb7f39c31c4a4417fd318e7cd184e225) C:\Windows\system32\drivers\tcpip.sys

2011/04/26 18:57:34.0918 3736 TCPIP6 (bb7f39c31c4a4417fd318e7cd184e225) C:\Windows\system32\DRIVERS\tcpip.sys

2011/04/26 18:57:35.0074 3736 tcpipreg (e64444523add154f86567c469bc0b17f) C:\Windows\system32\drivers\tcpipreg.sys

2011/04/26 18:57:35.0105 3736 TDPIPE (1875c1490d99e70e449e3afae9fcbadf) C:\Windows\system32\drivers\tdpipe.sys

2011/04/26 18:57:35.0136 3736 TDTCP (7551e91ea999ee9a8e9c331d5a9c31f3) C:\Windows\system32\drivers\tdtcp.sys

2011/04/26 18:57:35.0199 3736 tdx (cb39e896a2a83702d1737bfd402b3542) C:\Windows\system32\DRIVERS\tdx.sys

2011/04/26 18:57:35.0230 3736 TermDD (c36f41ee20e6999dbf4b0425963268a5) C:\Windows\system32\DRIVERS\termdd.sys

2011/04/26 18:57:35.0308 3736 tssecsrv (98ae6fa07d12cb4ec5cf4a9bfa5f4242) C:\Windows\system32\DRIVERS\tssecsrv.sys

2011/04/26 18:57:35.0448 3736 tunnel (3e461d890a97f9d4c168f5fda36e1d00) C:\Windows\system32\DRIVERS\tunnel.sys

2011/04/26 18:57:35.0495 3736 uagp35 (750fbcb269f4d7dd2e420c56b795db6d) C:\Windows\system32\drivers\uagp35.sys

2011/04/26 18:57:35.0589 3736 udfs (eb0a7bd4d471ac3ce55564a4c55b9d8e) C:\Windows\system32\DRIVERS\udfs.sys

2011/04/26 18:57:35.0854 3736 uliagpkx (44e8048ace47befbfdc2e9be4cbc8880) C:\Windows\system32\drivers\uliagpkx.sys

2011/04/26 18:57:35.0963 3736 umbus (71bbf3e8078d585abf27411a8986eb95) C:\Windows\system32\DRIVERS\umbus.sys

2011/04/26 18:57:36.0010 3736 UmPass (7550ad0c6998ba1cb4843e920ee0feac) C:\Windows\system32\drivers\umpass.sys

2011/04/26 18:57:36.0135 3736 UnlockerDriver5 (f365fa561c3ab455d8685770d208691a) C:\Program Files\Unlocker\UnlockerDriver5.sys

2011/04/26 18:57:36.0322 3736 upperdev (0ccadc7391021376edbb8aa649d04e68) C:\Windows\system32\DRIVERS\usbser_lowerflt.sys

2011/04/26 18:57:36.0431 3736 usbccgp (8455c4ed038efd09e99327f9d2d48ffa) C:\Windows\system32\DRIVERS\usbccgp.sys

2011/04/26 18:57:37.0367 3736 usbcir (04ec7cec62ec3b6d9354eee93327fc82) C:\Windows\system32\drivers\usbcir.sys

2011/04/26 18:57:38.0397 3736 usbehci (1c333bfd60f2fed2c7ad5daf533cb742) C:\Windows\system32\DRIVERS\usbehci.sys

2011/04/26 18:57:39.0333 3736 usbhub (0db84eda895894ba222e27acf597c806) C:\Windows\system32\DRIVERS\usbhub.sys

2011/04/26 18:57:40.0284 3736 usbohci (a6fb7957ea7afb1165991e54ce934b74) C:\Windows\system32\drivers\usbohci.sys

2011/04/26 18:57:41.0174 3736 usbprint (797d862fe0875e75c7cc4c1ad7b30252) C:\Windows\system32\drivers\usbprint.sys

2011/04/26 18:57:42.0141 3736 usbser (88701eca76145e2c011c0eeff0f7b70e) C:\Windows\system32\drivers\usbser.sys

2011/04/26 18:57:43.0124 3736 UsbserFilt (68b4f83cccf70a2ff32ee142c234332a) C:\Windows\system32\DRIVERS\usbser_lowerfltj.sys

2011/04/26 18:57:44.0122 3736 USBSTOR (d8889d56e0d27e57ed4591837fe71d27) C:\Windows\system32\DRIVERS\USBSTOR.SYS

2011/04/26 18:57:44.0949 3736 usbuhci (78780c3ebce17405b1ccd07a3a8a7d72) C:\Windows\system32\DRIVERS\usbuhci.sys

2011/04/26 18:57:45.0947 3736 usbvideo (f642a7e4bf78cfa359cca0a3557c28d7) C:\Windows\system32\Drivers\usbvideo.sys

2011/04/26 18:57:46.0821 3736 vdrvroot (a059c4c3edb09e07d21a8e5c0aabd3cb) C:\Windows\system32\drivers\vdrvroot.sys

2011/04/26 18:57:47.0726 3736 vga (17c408214ea61696cec9c66e388b14f3) C:\Windows\system32\DRIVERS\vgapnp.sys

2011/04/26 18:57:48.0568 3736 VgaSave (8e38096ad5c8570a6f1570a61e251561) C:\Windows\System32\drivers\vga.sys

2011/04/26 18:57:49.0473 3736 vhdmp (3be6e1f3a4f1afec8cee0d7883f93583) C:\Windows\system32\drivers\vhdmp.sys

2011/04/26 18:57:50.0378 3736 viaagp (c829317a37b4bea8f39735d4b076e923) C:\Windows\system32\drivers\viaagp.sys

2011/04/26 18:57:51.0142 3736 ViaC7 (e02f079a6aa107f06b16549c6e5c7b74) C:\Windows\system32\drivers\viac7.sys

2011/04/26 18:57:51.0907 3736 viaide (e43574f6a56a0ee11809b48c09e4fd3c) C:\Windows\system32\drivers\viaide.sys

2011/04/26 18:57:52.0733 3736 vm3dmp (e2d93ecd5a0f3bfba99d023074c73f6a) C:\Windows\system32\DRIVERS\vm3dmp.sys

2011/04/26 18:57:54.0028 3736 vmbus (379b349f65f453d2a6e75ea6b7448e49) C:\Windows\system32\drivers\vmbus.sys

2011/04/26 18:57:54.0683 3736 VMBusHID (ec2bbab4b84d0738c6c83d2234dc36fe) C:\Windows\system32\drivers\VMBusHID.sys

2011/04/26 18:57:56.0072 3736 vmmouse (17cd671136032e3a202b4a9c6c4c9dba) C:\Windows\system32\DRIVERS\vmmouse.sys

2011/04/26 18:57:56.0665 3736 volmgr (384e5a2aa49934295171e499f86ba6f3) C:\Windows\system32\drivers\volmgr.sys

2011/04/26 18:57:57.0398 3736 volmgrx (b5bb72067ddddbbfb04b2f89ff8c3c87) C:\Windows\system32\drivers\volmgrx.sys

2011/04/26 18:57:58.0162 3736 volsnap (70f41d1ebdd9ee6ed2fd0fc05aa1fc13) C:\Windows\system32\drivers\volsnap.sys

2011/04/26 18:57:59.0067 3736 vpcbus (33e74df34753fcaab06f6f2bdc8cabf5) C:\Windows\system32\DRIVERS\vpchbus.sys

2011/04/26 18:57:59.0753 3736 vpcnfltr (5f04362ceb5fb5901037e9d9eadd3760) C:\Windows\system32\DRIVERS\vpcnfltr.sys

2011/04/26 18:57:59.0863 3736 vpcusb (625088d6ee9ede977fd03cf18d1cd5c5) C:\Windows\system32\DRIVERS\vpcusb.sys

2011/04/26 18:57:59.0956 3736 vpcvmm (5ed378d91e32134f3c0b3810860ffd71) C:\Windows\system32\drivers\vpcvmm.sys

2011/04/26 18:58:00.0143 3736 vsmraid (9dfa0cc2f8855a04816729651175b631) C:\Windows\system32\drivers\vsmraid.sys

2011/04/26 18:58:00.0221 3736 vwifibus (90567b1e658001e79d7c8bbd3dde5aa6) C:\Windows\System32\drivers\vwifibus.sys

2011/04/26 18:58:00.0315 3736 WacomPen (de3721e89c653aa281428c8a69745d90) C:\Windows\system32\drivers\wacompen.sys

2011/04/26 18:58:00.0393 3736 WANARP (692a712062146e96d28ba0b7d75de31b) C:\Windows\system32\DRIVERS\wanarp.sys

2011/04/26 18:58:00.0409 3736 Wanarpv6 (692a712062146e96d28ba0b7d75de31b) C:\Windows\system32\DRIVERS\wanarp.sys

2011/04/26 18:58:00.0518 3736 Wd (1112a9badacb47b7c0bb0392e3158dff) C:\Windows\system32\drivers\wd.sys

2011/04/26 18:58:00.0596 3736 Wdf01000 (9950e3d0f08141c7e89e64456ae7dc73) C:\Windows\system32\drivers\Wdf01000.sys

2011/04/26 18:58:00.0705 3736 WfpLwf (8b9a943f3b53861f2bfaf6c186168f79) C:\Windows\system32\DRIVERS\wfplwf.sys

2011/04/26 18:58:00.0767 3736 WIMMount (5cf95b35e59e2a38023836fff31be64c) C:\Windows\system32\drivers\wimmount.sys

2011/04/26 18:58:00.0845 3736 WinUsb (b5ba3cc19d00f2eba92f1cfbebb5d650) C:\Windows\system32\DRIVERS\WinUsb.sys

2011/04/26 18:58:00.0955 3736 WmiAcpi (0217679b8fca58714c3bf2726d2ca84e) C:\Windows\system32\drivers\wmiacpi.sys

2011/04/26 18:58:01.0033 3736 ws2ifsl (6db3276587b853bf886b69528fdb048c) C:\Windows\system32\drivers\ws2ifsl.sys

2011/04/26 18:58:01.0111 3736 WudfPf (6f9b6c0c93232cff47d0f72d6db1d21e) C:\Windows\system32\drivers\WudfPf.sys

2011/04/26 18:58:01.0189 3736 WUDFRd (f91ff1e51fca30b3c3981db7d5924252) C:\Windows\system32\DRIVERS\WUDFRd.sys

2011/04/26 18:58:01.0329 3736 yukonw7 (3eb1576f77b60a6c79dd7742b67219b8) C:\Windows\system32\DRIVERS\yk62x86.sys

2011/04/26 18:58:01.0454 3736 ================================================================================

2011/04/26 18:58:01.0454 3736 Scan finished

2011/04/26 18:58:01.0454 3736 ================================================================================

2011/04/26 18:58:01.0469 1784 Detected object count: 1

2011/04/26 18:58:15.0026 1784 Locked file(sptd) - User select action: Skip

 

 

 

 

MBAM log

 

 

 

 

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

 

Wersja bazy: 6448

 

Windows 6.1.7600

Internet Explorer 8.0.7600.16385

 

2011-04-26 19:14:33

mbam-log-2011-04-26 (19-14-21).txt

 

Typ skanowania: Szybkie skanowanie

Przeskanowano obiektów: 152653

Upłynęło: 12 minut(y), 35 sekund(y)

 

Zainfekowanych procesów w pamięci: 0

Zainfekowanych modułów w pamięci: 0

Zainfekowanych kluczy rejestru: 0

Zainfekowanych wartości rejestru: 0

Zainfekowane informacje rejestru systemowego: 3

Zainfekowanych folderów: 0

Zainfekowanych plików: 4

 

Zainfekowanych procesów w pamięci:

(Nie znaleziono zagrożeń)

 

Zainfekowanych modułów w pamięci:

(Nie znaleziono zagrożeń)

 

Zainfekowanych kluczy rejestru:

(Nie znaleziono zagrożeń)

 

Zainfekowanych wartości rejestru:

(Nie znaleziono zagrożeń)

 

Zainfekowane informacje rejestru systemowego:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

 

Zainfekowanych folderów:

(Nie znaleziono zagrożeń)

 

Zainfekowanych plików:

c:\Users\dorotex\local settings\tempxm2920.html (Trojan.FakeAlert) -> No action taken.

c:\Users\dorotex\local settings\tempxo4520.html (Trojan.FakeAlert) -> No action taken.

c:\Users\dorotex\local settings\tempxq1876.html (Trojan.FakeAlert) -> No action taken.

c:\Users\dorotex\local settings\tempxu1788.html (Trojan.FakeAlert) -> No action taken.

 

 

 

 

mbr chceck nie zapisuje loga, za to mbr.exe (jakis skaner z tematu o logach) nic nie znajduje.

Udostępnij ten post


Link to postu
Udostępnij na innych stronach

To spoko,dzieki. Widocznie KAV usunal to co bylo,a byl w raporcie jakis rootkit.bigs cos takiego.

Udostępnij ten post


Link to postu
Udostępnij na innych stronach

Bądź aktywny! Zaloguj się lub utwórz konto

Tylko zarejestrowani użytkownicy mogą komentować zawartość tej strony

Utwórz konto

Zarejestruj nowe konto, to proste!

Zarejestruj nowe konto

Zaloguj się

Posiadasz własne konto? Użyj go!

Zaloguj się
Zaloguj się, aby obserwować  

Aktualności

Artykuły



×

Ważne informacje

Umieściliśmy pliki cookie na Twoim urządzeniu, aby pomóc Ci ulepszyć tę witrynę. Możesz dostosować ustawienia plików cookie, w przeciwnym razie zakładamy, że możesz kontynuować.