Prosím zkontrolujte log Vyřešeno

[siskai]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:02:00, on 8.1.2009
Platform: Windows Vista SP2, v.113 (WinNT 6.00.1906)
MSIE: Internet Explorer v7.00 (7.00.6002.16497)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe
C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 86.110.225.166:80
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: DeviceVM Url Search Hook - {0063BF63-BFFF-4B8F-9D26-4267DF7F17DD} - C:\Windows\SysWOW64\dvmurl.dll
F2 - REG:system.ini: UserInit=userinit.exe
O1 - Hosts: ::1 localhost
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [EasyTuneVI] C:\Program Files (x86)\GIGABYTE\ET6\ETcall.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKCU\..\Run: [nodenable] C:\Program Files\eset\nodenable.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Ati External Event Utility - Unknown owner - C:\Windows\system32\Ati2evxx.exe (file missing)
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files (x86)\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: Služba Windows Media Player Network Sharing (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)


Děkuju.

[Reklama]

[jaro3]

Vítej na fóru PC-HELP!
Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Update Malwarebytes' Anti-Malware (Aktualizace Malwarebytes' Anti-Malware) a Launch Malwarebytes' Anti-Malware (Spustit aplikaci Malwarebytes' Anti-Malware), pokud jo tak klikni na tlačítko Finish
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Perform Quick Scan (Provést rychlý sken) a klikni na tlačítko Scan (Skenovat)
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Show Results
- pak zvol možnost Save Logfile a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

[siskai]

Malwarebytes' Anti-Malware 1.32
Verze databáze: 1632
Windows 6.0.6002 Service Pack 2, v.113

9.1.2009 13:34:35
mbam-log-2009-01-09 (13-34-35).txt

Typ skenu: Rychlý sken
Objektu skenováno: 49236
Uplynulý cas: 1 minute(s), 58 second(s)

Infikované procesy pameti: 0
Infikované pametové moduly: 0
Infikované klíce registru: 0
Infikované hodnoty registru: 0
Infikované položky dat registru: 0
Infikované složky: 0
Infikované soubory: 0

Infikované procesy pameti:
(Žádné zákerné položky nebyly zjišteny)

Infikované pametové moduly:
(Žádné zákerné položky nebyly zjišteny)

Infikované klíce registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované hodnoty registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované položky dat registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované složky:
(Žádné zákerné položky nebyly zjišteny)

Infikované soubory:
(Žádné zákerné položky nebyly zjišteny)



Důvodem ke kontrole logu je dlouhý start Windows a občasné hlášení NODa na nějakého trojana BHO.

[jaro3]

Pokud máš 32 bitovou verzi win, postupuj takto:
vypni rez. ochranu u SpyBota:
- spusť Spybot - Search & Destroy
- nahoře v menu zvol: Režim => Pro pokročilé
- objeví se ti varovné okno kde zvol Ano
- okno programu se ti přepne do pokročilého zobrazení a tam zvol: Nástroje => Rezidentní
- tam zruš zatržení pokud bude u položky: Rezidentní program "TeaTimer" (Ochrana ...)
- zavři program
Restartuj PC.
Po té si stáhni ResetTeaTimer.bat(viz. Poznámka)
a ulož si ho na disku.
- spusť ho a po vyzvání zmáčkni libovolnou klávesu
- po proběhnutí a výzvě opět zmáčkni libovolnou klávesu a program se zavře.
Poznámka:
- pokud používáš Operu, tak klikni pravým tlačítkem myši na odkaz a zvol možnost Uložit cíl odkazu jako...
- pokud používáš Firefox tak klikni pravým tlačítkem myši na odkaz a zvol možnost Uložit odkaz jako...

Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

Pořiď si nějaký antivir.

[siskai]

Antivir mám ESET SmartSecurity. Když mám OS WV x64, mám postupovat také takto?

[jaro3]

Ne, na x64 Combofix nelze.
Stáhni si RSIT (by random/random)
- spusť ho, objeví se ti okno, tak pro pokračování klikni na Continue
- počkej až program proběhne a zobrazí se ti log jinak ho najdeš zde: C:\rsit\log.txt zkopíruj sem prosím celý jeho obsah

[siskai]

Logfile of random's system information tool 1.05 (written by random/random)
Run by admin at 2009-01-09 17:26:05
Microsoft® Windows Vista™ Ultimate Service Pack 2, v.113
System drive C: has 8 GB (11%) free of 75 GB
Total RAM: 4094 MB (79% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:26:11, on 9.1.2009
Platform: Windows Vista SP2, v.113 (WinNT 6.00.1906)
MSIE: Internet Explorer v7.00 (7.00.6002.16497)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe
D:\download\RSIT.exe
C:\Program Files (x86)\Trend Micro\HijackThis\admin.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 86.110.225.166:80
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: DeviceVM Url Search Hook - {0063BF63-BFFF-4B8F-9D26-4267DF7F17DD} - C:\Windows\SysWOW64\dvmurl.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [EasyTuneVI] C:\Program Files (x86)\GIGABYTE\ET6\ETcall.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKCU\..\Run: [nodenable] C:\Program Files\eset\nodenable.exe
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Ati External Event Utility - Unknown owner - C:\Windows\system32\Ati2evxx.exe (file missing)
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files (x86)\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: Služba Windows Media Player Network Sharing (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 5184 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~2\SPYBOT~1\SDHelper.dll [2008-09-15 1562960]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"EasyTuneVI"=C:\Program Files (x86)\GIGABYTE\ET6\ETcall.exe [2007-07-26 20480]
"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2008-08-29 61440]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"nodenable"=C:\Program Files\eset\nodenable.exe [2008-09-23 803495]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLUA"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=
"ForceActiveDesktopOn"=
"BindDirectlyToPropertySetStorage"=
"NoActiveDesktopChanges"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======List of files/folders created in the last 1 months======

2009-01-09 17:26:05 ----D---- C:\rsit
2009-01-08 23:20:28 ----D---- C:\Users\admin\AppData\Roaming\Malwarebytes
2009-01-08 23:20:24 ----D---- C:\ProgramData\Malwarebytes
2009-01-08 23:20:23 ----D---- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2009-01-08 22:01:24 ----D---- C:\Program Files (x86)\Trend Micro
2009-01-07 19:28:17 ----D---- C:\Users\admin\AppData\Roaming\Ansys
2009-01-07 19:25:48 ----D---- C:\Users\admin\AppData\Roaming\Autodesk
2009-01-07 19:17:55 ----D---- C:\ProgramData\Autodesk
2009-01-07 19:17:33 ----D---- C:\Program Files (x86)\Microsoft WSE
2009-01-07 19:16:44 ----D---- C:\Program Files (x86)\Common Files\Autodesk Shared
2009-01-07 19:16:44 ----D---- C:\Program Files (x86)\Autodesk
2009-01-06 22:54:31 ----D---- C:\Program Files (x86)\Testy Autoškola
2009-01-06 22:51:00 ----D---- C:\inv
2009-01-06 22:49:23 ----D---- C:\Program Files (x86)\Common Files\Designer
2009-01-06 22:49:17 ----D---- C:\Program Files (x86)\Microsoft Office
2009-01-06 22:07:52 ----D---- C:\Windows\LastGood
2009-01-06 21:15:34 ----D---- C:\Users\admin\AppData\Roaming\IrfanView
2009-01-06 21:15:33 ----D---- C:\Program Files (x86)\IrfanView
2009-01-06 21:06:12 ----A---- C:\Windows\unlite3.exe
2009-01-06 21:06:11 ----D---- C:\Program Files (x86)\Bradbury
2009-01-06 21:01:40 ----D---- C:\skola
2009-01-06 20:29:20 ----D---- C:\Program Files (x86)\Safer Networking
2009-01-06 20:17:24 ----D---- C:\ProgramData\Spybot - Search & Destroy
2009-01-06 20:17:24 ----D---- C:\Program Files (x86)\Spybot - Search & Destroy
2009-01-05 20:39:07 ----D---- C:\ProgramData\ATI
2009-01-05 20:36:09 ----D---- C:\Program Files (x86)\ATI
2009-01-05 20:35:07 ----D---- C:\Windows\LastGood.Tmp
2009-01-05 20:30:28 ----D---- C:\ProgramData\Startup Manager
2009-01-05 20:30:28 ----D---- C:\Program Files (x86)\Startup Manager
2009-01-05 16:44:42 ----A---- C:\Windows\system32\urlmon.dll
2009-01-05 16:44:38 ----A---- C:\Windows\system32\gdi32.dll
2009-01-05 16:44:31 ----A---- C:\Windows\system32\explorer.exe
2009-01-05 16:44:31 ----A---- C:\Windows\explorer.exe
2009-01-05 16:44:12 ----A---- C:\Windows\system32\mshtml.dll
2009-01-05 15:14:12 ----A---- C:\Windows\ntbtlog.txt
2009-01-04 18:18:07 ----D---- C:\Windows\system32\vi-VN
2009-01-04 18:18:07 ----D---- C:\Windows\system32\eu-ES
2009-01-04 18:18:07 ----D---- C:\Windows\system32\ca-ES
2009-01-04 17:51:15 ----A---- C:\Windows\system32\ntdll.dll
2009-01-04 17:51:14 ----A---- C:\Windows\system32\offfilt.dll
2009-01-04 17:51:14 ----A---- C:\Windows\system32\odbc32.dll
2009-01-04 17:51:14 ----A---- C:\Windows\system32\NlsLexicons0009.dll
2009-01-04 17:51:14 ----A---- C:\Windows\system32\NlsLexicons0007.dll
2009-01-04 17:51:14 ----A---- C:\Windows\system32\nlhtml.dll
2009-01-04 17:51:13 ----A---- C:\Windows\system32\odbccp32.dll
2009-01-04 17:51:13 ----A---- C:\Windows\system32\odbcconf.dll
2009-01-04 17:51:13 ----A---- C:\Windows\system32\occache.dll
2009-01-04 17:51:13 ----A---- C:\Windows\system32\ntprint.dll
2009-01-04 17:51:13 ----A---- C:\Windows\system32\ntmarta.dll
2009-01-04 17:51:13 ----A---- C:\Windows\system32\netplwiz.dll
2009-01-04 17:51:13 ----A---- C:\Windows\system32\netlogon.dll
2009-01-04 17:51:13 ----A---- C:\Windows\system32\netiohlp.dll
2009-01-04 17:51:12 ----A---- C:\Windows\system32\netcenter.dll
2009-01-04 17:51:12 ----A---- C:\Windows\system32\netapi32.dll
2009-01-04 17:51:12 ----A---- C:\Windows\system32\ncryptui.dll
2009-01-04 17:51:12 ----A---- C:\Windows\system32\ncrypt.dll
2009-01-04 17:51:12 ----A---- C:\Windows\system32\NcdProp.dll
2009-01-04 17:51:11 ----A---- C:\Windows\system32\newdev.dll
2009-01-04 17:51:11 ----A---- C:\Windows\system32\networkmap.dll
2009-01-04 17:51:11 ----A---- C:\Windows\system32\networkitemfactory.dll
2009-01-04 17:51:11 ----A---- C:\Windows\system32\networkexplorer.dll
2009-01-04 17:51:11 ----A---- C:\Windows\system32\netshell.dll
2009-01-04 17:51:10 ----A---- C:\Windows\system32\pnidui.dll
2009-01-04 17:51:10 ----A---- C:\Windows\system32\pidgenx.dll
2009-01-04 17:51:10 ----A---- C:\Windows\system32\PhotoMetadataHandler.dll
2009-01-04 17:51:09 ----A---- C:\Windows\system32\photowiz.dll
2009-01-04 17:51:08 ----A---- C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-01-04 17:51:08 ----A---- C:\Windows\system32\powrprof.dll
2009-01-04 17:51:08 ----A---- C:\Windows\system32\powercpl.dll
2009-01-04 17:51:07 ----A---- C:\Windows\system32\p2psvc.dll
2009-01-04 17:51:07 ----A---- C:\Windows\system32\P2PGraph.dll
2009-01-04 17:51:06 ----A---- C:\Windows\system32\oobefldr.dll
2009-01-04 17:51:06 ----A---- C:\Windows\system32\olepro32.dll
2009-01-04 17:51:06 ----A---- C:\Windows\system32\oleprn.dll
2009-01-04 17:51:06 ----A---- C:\Windows\system32\ole32.dll
2009-01-04 17:51:05 ----A---- C:\Windows\system32\PerfCenterCPL.dll
2009-01-04 17:51:05 ----A---- C:\Windows\system32\pcaui.dll
2009-01-04 17:51:05 ----A---- C:\Windows\system32\osk.exe
2009-01-04 17:51:05 ----A---- C:\Windows\system32\onex.dll
2009-01-04 17:51:02 ----A---- C:\Windows\system32\msdrm.dll
2009-01-04 17:51:02 ----A---- C:\Windows\system32\msctfp.dll
2009-01-04 17:51:02 ----A---- C:\Windows\system32\MsCtfMonitor.dll
2009-01-04 17:51:02 ----A---- C:\Windows\system32\msctf.dll
2009-01-04 17:51:01 ----A---- C:\Windows\system32\msctfui.dll
2009-01-04 17:51:00 ----A---- C:\Windows\system32\msimsg.dll
2009-01-04 17:51:00 ----A---- C:\Windows\system32\msihnd.dll
2009-01-04 17:51:00 ----A---- C:\Windows\system32\msiexec.exe
2009-01-04 17:51:00 ----A---- C:\Windows\system32\msident.dll
2009-01-04 17:51:00 ----A---- C:\Windows\system32\msi.dll
2009-01-04 17:51:00 ----A---- C:\Windows\system32\msexcl40.dll
2009-01-04 17:50:59 ----A---- C:\Windows\system32\msvcp60.dll
2009-01-04 17:50:59 ----A---- C:\Windows\system32\msutb.dll
2009-01-04 17:50:59 ----A---- C:\Windows\system32\mstscax.dll
2009-01-04 17:50:59 ----A---- C:\Windows\system32\mssrch.dll
2009-01-04 17:50:59 ----A---- C:\Windows\system32\mshtmled.dll
2009-01-04 17:50:59 ----A---- C:\Windows\system32\msftedit.dll
2009-01-04 17:50:59 ----A---- C:\Windows\system32\msexch40.dll
2009-01-04 17:50:59 ----A---- C:\Windows\system32\msdtcprx.dll
2009-01-04 17:50:58 ----A---- C:\Windows\system32\NaturalLanguage6.dll
2009-01-04 17:50:58 ----A---- C:\Windows\system32\mtxclu.dll
2009-01-04 17:50:58 ----A---- C:\Windows\system32\msxml6.dll
2009-01-04 17:50:58 ----A---- C:\Windows\system32\MSVidCtl.dll
2009-01-04 17:50:58 ----A---- C:\Windows\system32\msvcrt.dll
2009-01-04 17:50:58 ----A---- C:\Windows\system32\mstsc.exe
2009-01-04 17:50:58 ----A---- C:\Windows\system32\mstlsapi.dll
2009-01-04 17:50:58 ----A---- C:\Windows\system32\mstime.dll
2009-01-04 17:50:58 ----A---- C:\Windows\system32\mstext40.dll
2009-01-04 17:50:58 ----A---- C:\Windows\system32\mssvp.dll
2009-01-04 17:50:58 ----A---- C:\Windows\system32\msstrc.dll
2009-01-04 17:50:58 ----A---- C:\Windows\system32\mssprxy.dll
2009-01-04 17:50:58 ----A---- C:\Windows\system32\mssphtb.dll
2009-01-04 17:50:57 ----A---- C:\Windows\system32\msxml3.dll
2009-01-04 17:50:57 ----A---- C:\Windows\system32\msxbde40.dll
2009-01-04 17:50:57 ----A---- C:\Windows\system32\mswstr10.dll
2009-01-04 17:50:57 ----A---- C:\Windows\system32\mswsock.dll
2009-01-04 17:50:57 ----A---- C:\Windows\system32\mswdat10.dll
2009-01-04 17:50:57 ----A---- C:\Windows\system32\msltus40.dll
2009-01-04 17:50:57 ----A---- C:\Windows\system32\msjtes40.dll
2009-01-04 17:50:57 ----A---- C:\Windows\system32\msjter40.dll
2009-01-04 17:50:57 ----A---- C:\Windows\system32\msjint40.dll
2009-01-04 17:50:57 ----A---- C:\Windows\system32\msjetoledb40.dll
2009-01-04 17:50:57 ----A---- C:\Windows\system32\msjet40.dll
2009-01-04 17:50:57 ----A---- C:\Windows\system32\msisip.dll
2009-01-04 17:50:56 ----A---- C:\Windows\system32\mssph.dll
2009-01-04 17:50:56 ----A---- C:\Windows\system32\mssitlb.dll
2009-01-04 17:50:56 ----A---- C:\Windows\system32\msshsq.dll
2009-01-04 17:50:56 ----A---- C:\Windows\system32\msshooks.dll
2009-01-04 17:50:56 ----A---- C:\Windows\system32\msscp.dll
2009-01-04 17:50:56 ----A---- C:\Windows\system32\msscntrs.dll
2009-01-04 17:50:56 ----A---- C:\Windows\system32\msscb.dll
2009-01-04 17:50:56 ----A---- C:\Windows\system32\msnetobj.dll
2009-01-04 17:50:56 ----A---- C:\Windows\system32\MSMPEG2VDEC.DLL
2009-01-04 17:50:56 ----A---- C:\Windows\system32\MSMPEG2ENC.DLL
2009-01-04 17:50:56 ----A---- C:\Windows\system32\msinfo32.exe
2009-01-04 17:50:56 ----A---- C:\Windows\system32\msimtf.dll
2009-01-04 17:50:55 ----A---- C:\Windows\system32\msrepl40.dll
2009-01-04 17:50:55 ----A---- C:\Windows\system32\msrd3x40.dll
2009-01-04 17:50:55 ----A---- C:\Windows\system32\msrd2x40.dll
2009-01-04 17:50:55 ----A---- C:\Windows\system32\msrating.dll
2009-01-04 17:50:55 ----A---- C:\Windows\system32\mspbde40.dll
2009-01-04 17:50:54 ----A---- C:\Windows\system32\secur32.dll
2009-01-04 17:50:54 ----A---- C:\Windows\system32\secproc_ssp.dll
2009-01-04 17:50:54 ----A---- C:\Windows\system32\secproc_isv.dll
2009-01-04 17:50:54 ----A---- C:\Windows\system32\secproc.dll
2009-01-04 17:50:54 ----A---- C:\Windows\system32\SearchProtocolHost.exe
2009-01-04 17:50:54 ----A---- C:\Windows\system32\SearchIndexer.exe
2009-01-04 17:50:54 ----A---- C:\Windows\system32\SearchFilterHost.exe
2009-01-04 17:50:50 ----A---- C:\Windows\system32\raschap.dll
2009-01-04 17:50:50 ----A---- C:\Windows\system32\rasgcw.dll
2009-01-04 17:50:50 ----A---- C:\Windows\system32\rasdlg.dll
2009-01-04 17:50:50 ----A---- C:\Windows\system32\rasdial.exe
2009-01-04 17:50:50 ----A---- C:\Windows\system32\rasapi32.dll
2009-01-04 17:50:49 ----A---- C:\Windows\system32\rdpencom.dll
2009-01-04 17:50:49 ----A---- C:\Windows\system32\rastls.dll
2009-01-04 17:50:49 ----A---- C:\Windows\system32\rastapi.dll
2009-01-04 17:50:49 ----A---- C:\Windows\system32\rasplap.dll
2009-01-04 17:50:49 ----A---- C:\Windows\system32\rasmontr.dll
2009-01-04 17:50:49 ----A---- C:\Windows\system32\rasdiag.dll
2009-01-04 17:50:49 ----A---- C:\Windows\system32\RacEngn.dll
2009-01-04 17:50:49 ----A---- C:\Windows\system32\Query.dll
2009-01-04 17:50:49 ----A---- C:\Windows\system32\quartz.dll
2009-01-04 17:50:48 ----A---- C:\Windows\system32\propsys.dll
2009-01-04 17:50:48 ----A---- C:\Windows\system32\propdefs.dll
2009-01-04 17:50:48 ----A---- C:\Windows\system32\prnntfy.dll
2009-01-04 17:50:48 ----A---- C:\Windows\system32\printui.dll
2009-01-04 17:50:48 ----A---- C:\Windows\system32\PresentationNative_v0300.dll
2009-01-04 17:50:48 ----A---- C:\Windows\system32\PresentationHostProxy.dll
2009-01-04 17:50:48 ----A---- C:\Windows\system32\PresentationHost.exe
2009-01-04 17:50:47 ----A---- C:\Windows\system32\qedit.dll
2009-01-04 17:50:47 ----A---- C:\Windows\system32\qdvd.dll
2009-01-04 17:50:47 ----A---- C:\Windows\system32\psisdecd.dll
2009-01-04 17:50:46 ----A---- C:\Windows\system32\scrrun.dll
2009-01-04 17:50:46 ----A---- C:\Windows\system32\scrobj.dll
2009-01-04 17:50:46 ----A---- C:\Windows\system32\scksp.dll
2009-01-04 17:50:46 ----A---- C:\Windows\system32\SCardSvr.dll
2009-01-04 17:50:46 ----A---- C:\Windows\system32\scansetting.dll
2009-01-04 17:50:45 ----A---- C:\Windows\system32\scesrv.dll
2009-01-04 17:50:45 ----A---- C:\Windows\system32\scecli.dll
2009-01-04 17:50:45 ----A---- C:\Windows\system32\riched20.dll
2009-01-04 17:50:45 ----A---- C:\Windows\system32\RelMon.dll
2009-01-04 17:50:44 ----A---- C:\Windows\system32\rtutils.dll
2009-01-04 17:50:44 ----A---- C:\Windows\system32\rtffilt.dll
2009-01-04 17:50:44 ----A---- C:\Windows\system32\rsaenh.dll
2009-01-04 17:50:44 ----A---- C:\Windows\system32\rrinstaller.exe
2009-01-04 17:50:44 ----A---- C:\Windows\system32\RMActivate_ssp_isv.exe
2009-01-04 17:50:44 ----A---- C:\Windows\system32\RMActivate_ssp.exe
2009-01-04 17:50:44 ----A---- C:\Windows\system32\RMActivate_isv.exe
2009-01-04 17:50:44 ----A---- C:\Windows\system32\RMActivate.exe
2009-01-04 17:50:44 ----A---- C:\Windows\system32\rekeywiz.exe
2009-01-04 17:50:44 ----A---- C:\Windows\system32\regapi.dll
2009-01-04 17:50:44 ----A---- C:\Windows\system32\reg.exe
2009-01-04 17:50:43 ----A---- C:\Windows\system32\rpcrt4.dll
2009-01-04 17:50:43 ----A---- C:\Windows\system32\dsprop.dll
2009-01-04 17:50:43 ----A---- C:\Windows\system32\dsound.dll
2009-01-04 17:50:43 ----A---- C:\Windows\system32\drvinst.exe
2009-01-04 17:50:42 ----A---- C:\Windows\system32\eapphost.dll
2009-01-04 17:50:42 ----A---- C:\Windows\system32\drmv2clt.dll
2009-01-04 17:50:42 ----A---- C:\Windows\system32\drmmgrtn.dll
2009-01-04 17:50:42 ----A---- C:\Windows\system32\dpapimig.exe
2009-01-04 17:50:42 ----A---- C:\Windows\system32\dot3cfg.dll
2009-01-04 17:50:41 ----A---- C:\Windows\system32\eappgnui.dll
2009-01-04 17:50:41 ----A---- C:\Windows\system32\eappcfg.dll
2009-01-04 17:50:40 ----A---- C:\Windows\system32\eapp3hst.dll
2009-01-04 17:50:40 ----A---- C:\Windows\system32\dxmasf.dll
2009-01-04 17:50:39 ----A---- C:\Windows\system32\diskraid.exe
2009-01-04 17:50:39 ----A---- C:\Windows\system32\dfshim.dll
2009-01-04 17:50:39 ----A---- C:\Windows\system32\devmgr.dll
2009-01-04 17:50:39 ----A---- C:\Windows\system32\DevicePairingWizard.exe
2009-01-04 17:50:39 ----A---- C:\Windows\system32\DevicePairingProxy.dll
2009-01-04 17:50:39 ----A---- C:\Windows\system32\DevicePairing.dll
2009-01-04 17:50:39 ----A---- C:\Windows\system32\dbgeng.dll
2009-01-04 17:50:39 ----A---- C:\Windows\system32\davclnt.dll
2009-01-04 17:50:39 ----A---- C:\Windows\system32\dataclen.dll
2009-01-04 17:50:38 ----A---- C:\Windows\system32\FunctionDiscoveryFolder.dll
2009-01-04 17:50:38 ----A---- C:\Windows\system32\ftp.exe
2009-01-04 17:50:38 ----A---- C:\Windows\system32\diskpart.exe
2009-01-04 17:50:38 ----A---- C:\Windows\system32\dhcpcsvc6.dll
2009-01-04 17:50:38 ----A---- C:\Windows\system32\dhcpcsvc.dll
2009-01-04 17:50:37 ----A---- C:\Windows\system32\FWPUCLNT.DLL
2009-01-04 17:50:37 ----A---- C:\Windows\system32\fundisc.dll
2009-01-04 17:50:37 ----A---- C:\Windows\system32\findstr.exe
2009-01-04 17:50:37 ----A---- C:\Windows\system32\fdWSD.dll
2009-01-04 17:50:36 ----A---- C:\Windows\system32\gameux.dll
2009-01-04 17:50:36 ----A---- C:\Windows\system32\evr.dll
2009-01-04 17:50:36 ----A---- C:\Windows\system32\eudcedit.exe
2009-01-04 17:50:36 ----A---- C:\Windows\system32\es.dll
2009-01-04 17:50:36 ----A---- C:\Windows\system32\EncDec.dll
2009-01-04 17:50:36 ----A---- C:\Windows\system32\EhStorAPI.dll
2009-01-04 17:50:35 ----A---- C:\Windows\system32\fdWCN.dll
2009-01-04 17:50:35 ----A---- C:\Windows\system32\fdSSDP.dll
2009-01-04 17:50:35 ----A---- C:\Windows\system32\fdProxy.dll
2009-01-04 17:50:35 ----A---- C:\Windows\system32\fdBthProxy.dll
2009-01-04 17:50:35 ----A---- C:\Windows\system32\fdBth.dll
2009-01-04 17:50:35 ----A---- C:\Windows\system32\fc.exe
2009-01-04 17:50:35 ----A---- C:\Windows\system32\Faultrep.dll
2009-01-04 17:50:35 ----A---- C:\Windows\system32\extmgr.dll
2009-01-04 17:50:35 ----A---- C:\Windows\system32\ExplorerFrame.dll
2009-01-04 17:50:35 ----A---- C:\Windows\system32\EhStorShell.dll
2009-01-04 17:50:35 ----A---- C:\Windows\system32\EhStorPwdMgr.dll
2009-01-04 17:50:35 ----A---- C:\Windows\system32\EhStorAuthn.dll
2009-01-04 17:50:34 ----A---- C:\Windows\system32\blackbox.dll
2009-01-04 17:50:34 ----A---- C:\Windows\system32\bcrypt.dll
2009-01-04 17:50:34 ----A---- C:\Windows\system32\AuxiliaryDisplayCpl.dll
2009-01-04 17:50:34 ----A---- C:\Windows\system32\autoplay.dll
2009-01-04 17:50:34 ----A---- C:\Windows\system32\autofmt.exe
2009-01-04 17:50:33 ----A---- C:\Windows\system32\bthudtask.exe
2009-01-04 17:50:33 ----A---- C:\Windows\system32\browseui.dll
2009-01-04 17:50:33 ----A---- C:\Windows\system32\basecsp.dll
2009-01-04 17:50:33 ----A---- C:\Windows\system32\azroles.dll
2009-01-04 17:50:32 ----A---- C:\Windows\system32\Apphlpdm.dll
2009-01-04 17:50:32 ----A---- C:\Windows\system32\apds.dll
2009-01-04 17:50:31 ----A---- C:\Windows\system32\comuid.dll
2009-01-04 17:50:31 ----A---- C:\Windows\system32\comsvcs.dll
2009-01-04 17:50:31 ----A---- C:\Windows\system32\autochk.exe
2009-01-04 17:50:31 ----A---- C:\Windows\system32\autoconv.exe
2009-01-04 17:50:31 ----A---- C:\Windows\system32\authui.dll
2009-01-04 17:50:31 ----A---- C:\Windows\system32\AudioSes.dll
2009-01-04 17:50:31 ----A---- C:\Windows\system32\AUDIOKSE.dll
2009-01-04 17:50:31 ----A---- C:\Windows\system32\AudioEng.dll
2009-01-04 17:50:31 ----A---- C:\Windows\system32\audiodg.exe
2009-01-04 17:50:31 ----A---- C:\Windows\system32\atmlib.dll
2009-01-04 17:50:31 ----A---- C:\Windows\system32\atmfd.dll
2009-01-04 17:50:30 ----A---- C:\Windows\system32\cscript.exe
2009-01-04 17:50:30 ----A---- C:\Windows\system32\cscobj.dll
2009-01-04 17:50:30 ----A---- C:\Windows\system32\cscapi.dll
2009-01-04 17:50:30 ----A---- C:\Windows\system32\cryptui.dll
2009-01-04 17:50:30 ----A---- C:\Windows\system32\crypt32.dll
2009-01-04 17:50:30 ----A---- C:\Windows\system32\connect.dll
2009-01-04 17:50:30 ----A---- C:\Windows\system32\conime.exe
2009-01-04 17:50:30 ----A---- C:\Windows\system32\comdlg32.dll
2009-01-04 17:50:30 ----A---- C:\Windows\system32\cmdial32.dll
2009-01-04 17:50:30 ----A---- C:\Windows\system32\certreq.exe
2009-01-04 17:50:29 ----A---- C:\Windows\system32\cipher.exe
2009-01-04 17:50:29 ----A---- C:\Windows\system32\certutil.exe
2009-01-04 17:50:29 ----A---- C:\Windows\system32\certmgr.dll
2009-01-04 17:50:29 ----A---- C:\Windows\system32\CertEnrollUI.dll
2009-01-04 17:50:29 ----A---- C:\Windows\system32\CertEnroll.dll
2009-01-04 17:50:29 ----A---- C:\Windows\system32\certcli.dll
2009-01-04 17:50:28 ----A---- C:\Windows\system32\mfps.dll
2009-01-04 17:50:28 ----A---- C:\Windows\system32\mfpmp.exe
2009-01-04 17:50:28 ----A---- C:\Windows\system32\mferror.dll
2009-01-04 17:50:28 ----A---- C:\Windows\system32\mfc42u.dll
2009-01-04 17:50:28 ----A---- C:\Windows\system32\mf.dll
2009-01-04 17:50:28 ----A---- C:\Windows\system32\CHxReadingStringIME.dll
2009-01-04 17:50:28 ----A---- C:\Windows\system32\chtbrkr.dll
2009-01-04 17:50:28 ----A---- C:\Windows\system32\chsbrkr.dll
2009-01-04 17:50:24 ----A---- C:\Windows\system32\mfc42.dll
2009-01-04 17:50:24 ----A---- C:\Windows\system32\MediaMetadataHandler.dll
2009-01-04 17:50:21 ----A---- C:\Windows\system32\kerberos.dll
2009-01-04 17:50:20 ----A---- C:\Windows\system32\korwbrkr.dll
2009-01-04 17:50:20 ----A---- C:\Windows\system32\kernel32.dll
2009-01-04 17:50:20 ----A---- C:\Windows\system32\jscript.dll
2009-01-04 17:50:19 ----A---- C:\Windows\system32\lpk.dll
2009-01-04 17:50:19 ----A---- C:\Windows\system32\logman.exe
2009-01-04 17:50:19 ----A---- C:\Windows\system32\jsproxy.dll
2009-01-04 17:50:18 ----A---- C:\Windows\system32\Magnify.exe
2009-01-04 17:50:18 ----A---- C:\Windows\system32\localspl.dll
2009-01-04 17:50:17 ----A---- C:\Windows\system32\MSAC3ENC.DLL
2009-01-04 17:50:17 ----A---- C:\Windows\system32\logagent.exe
2009-01-04 17:50:16 ----A---- C:\Windows\system32\mscoree.dll
2009-01-04 17:50:15 ----A---- C:\Windows\system32\mscories.dll
2009-01-04 17:50:14 ----A---- C:\Windows\system32\mscorier.dll
2009-01-04 17:50:14 ----A---- C:\Windows\system32\mscandui.dll
2009-01-04 17:50:13 ----A---- C:\Windows\system32\mimefilt.dll
2009-01-04 17:50:12 ----A---- C:\Windows\system32\mmc.exe
2009-01-04 17:50:11 ----A---- C:\Windows\system32\mpr.dll
2009-01-04 17:50:10 ----A---- C:\Windows\system32\mprapi.dll
2009-01-04 17:50:10 ----A---- C:\Windows\system32\modemui.dll
2009-01-04 17:50:10 ----A---- C:\Windows\system32\MMDevAPI.dll
2009-01-04 17:50:10 ----A---- C:\Windows\system32\mmcndmgr.dll
2009-01-04 17:50:10 ----A---- C:\Windows\system32\ifmon.dll
2009-01-04 17:50:09 ----A---- C:\Windows\system32\IMJP10K.DLL
2009-01-04 17:50:09 ----A---- C:\Windows\system32\iertutil.dll
2009-01-04 17:50:09 ----A---- C:\Windows\system32\iepeers.dll
2009-01-04 17:50:09 ----A---- C:\Windows\system32\ieframe.dll
2009-01-04 17:50:08 ----A---- C:\Windows\system32\imapi2fs.dll
2009-01-04 17:50:08 ----A---- C:\Windows\system32\imapi2.dll
2009-01-04 17:50:08 ----A---- C:\Windows\system32\imapi.dll
2009-01-04 17:50:07 ----A---- C:\Windows\system32\iedkcs32.dll
2009-01-04 17:50:07 ----A---- C:\Windows\system32\ieapfltr.dll
2009-01-04 17:50:07 ----A---- C:\Windows\system32\icardres.dll
2009-01-04 17:50:07 ----A---- C:\Windows\system32\icardagt.exe
2009-01-04 17:50:07 ----A---- C:\Windows\system32\iassam.dll
2009-01-04 17:50:07 ----A---- C:\Windows\system32\hidserv.dll
2009-01-04 17:50:07 ----A---- C:\Windows\system32\hbaapi.dll
2009-01-04 17:50:06 ----A---- C:\Windows\system32\input.dll
2009-01-04 17:50:06 ----A---- C:\Windows\system32\InkEd.dll
2009-01-04 17:50:06 ----A---- C:\Windows\system32\infocardapi.dll
2009-01-04 17:50:06 ----A---- C:\Windows\system32\inetcomm.dll
2009-01-04 17:50:06 ----A---- C:\Windows\system32\iasrad.dll
2009-01-04 17:50:06 ----A---- C:\Windows\system32\iashlpr.dll
2009-01-04 17:50:06 ----A---- C:\Windows\system32\iasacct.dll
2009-01-04 17:50:05 ----A---- C:\Windows\system32\ipsmsnap.dll
2009-01-04 17:50:05 ----A---- C:\Windows\system32\ipsecsnp.dll
2009-01-04 17:50:05 ----A---- C:\Windows\system32\IPHLPAPI.DLL
2009-01-04 17:50:03 ----A---- C:\Windows\system32\version.dll
2009-01-04 17:50:03 ----A---- C:\Windows\system32\imm32.dll
2009-01-04 17:50:02 ----A---- C:\Windows\system32\vdsutil.dll
2009-01-04 17:50:02 ----A---- C:\Windows\system32\vdmdbg.dll
2009-01-04 17:50:02 ----A---- C:\Windows\system32\vbscript.dll
2009-01-04 17:50:02 ----A---- C:\Windows\system32\Utilman.exe
2009-01-04 17:50:02 ----A---- C:\Windows\system32\usp10.dll
2009-01-04 17:50:01 ----A---- C:\Windows\system32\untfs.dll
2009-01-04 17:50:01 ----A---- C:\Windows\system32\ulib.dll
2009-01-04 17:50:00 ----A---- C:\Windows\system32\usercpl.dll
2009-01-04 17:49:57 ----A---- C:\Windows\system32\wcnwiz.dll
2009-01-04 17:49:56 ----A---- C:\Windows\system32\wiaaut.dll
2009-01-04 17:49:56 ----A---- C:\Windows\system32\wevtapi.dll
2009-01-04 17:49:56 ----A---- C:\Windows\system32\WerFaultSecure.exe
2009-01-04 17:49:56 ----A---- C:\Windows\system32\WerFault.exe
2009-01-04 17:49:56 ----A---- C:\Windows\system32\wer.dll
2009-01-04 17:49:56 ----A---- C:\Windows\system32\webcheck.dll
2009-01-04 17:49:56 ----A---- C:\Windows\system32\WebClnt.dll
2009-01-04 17:49:56 ----A---- C:\Windows\system32\wdc.dll
2009-01-04 17:49:56 ----A---- C:\Windows\system32\wcnwiz2.dll
2009-01-04 17:49:56 ----A---- C:\Windows\system32\WcnNetsh.dll
2009-01-04 17:49:56 ----A---- C:\Windows\system32\wcncsvc.dll
2009-01-04 17:49:56 ----A---- C:\Windows\system32\vssapi.dll
2009-01-04 17:49:55 ----A---- C:\Windows\system32\systemcpl.dll
2009-01-04 17:49:53 ----A---- C:\Windows\system32\tcpmon.dll
2009-01-04 17:49:53 ----A---- C:\Windows\system32\taskeng.exe
2009-01-04 17:49:53 ----A---- C:\Windows\system32\taskcomp.dll
2009-01-04 17:49:50 ----A---- C:\Windows\system32\TsWpfWrp.exe
2009-01-04 17:49:50 ----A---- C:\Windows\system32\TSTheme.exe
2009-01-04 17:49:50 ----A---- C:\Windows\system32\themeui.dll
2009-01-04 17:49:50 ----A---- C:\Windows\system32\themecpl.dll
2009-01-04 17:49:50 ----A---- C:\Windows\system32\thawbrkr.dll
2009-01-04 17:49:49 ----A---- C:\Windows\system32\wusa.exe
2009-01-04 17:49:49 ----A---- C:\Windows\system32\wshext.dll
2009-01-04 17:49:49 ----A---- C:\Windows\system32\wshbth.dll
2009-01-04 17:49:49 ----A---- C:\Windows\system32\WSDMon.dll
2009-01-04 17:49:49 ----A---- C:\Windows\system32\wsdchngr.dll
2009-01-04 17:49:49 ----A---- C:\Windows\system32\WSDApi.dll
2009-01-04 17:49:49 ----A---- C:\Windows\system32\wscript.exe
2009-01-04 17:49:49 ----A---- C:\Windows\system32\wpcsvc.dll
2009-01-04 17:49:49 ----A---- C:\Windows\system32\wpcao.dll
2009-01-04 17:49:49 ----A---- C:\Windows\system32\WMVCORE.DLL
2009-01-04 17:49:49 ----A---- C:\Windows\system32\tsgqec.dll
2009-01-04 17:49:49 ----A---- C:\Windows\system32\tscupgrd.exe
2009-01-04 17:49:49 ----A---- C:\Windows\system32\tquery.dll
2009-01-04 17:49:48 ----A---- C:\Windows\system32\zipfldr.dll
2009-01-04 17:49:48 ----A---- C:\Windows\system32\xmlfilter.dll
2009-01-04 17:49:48 ----A---- C:\Windows\system32\WscEapPr.dll
2009-01-04 17:49:48 ----A---- C:\Windows\system32\wpdwcn.dll
2009-01-04 17:49:48 ----A---- C:\Windows\system32\WMVSDECD.DLL
2009-01-04 17:49:48 ----A---- C:\Windows\system32\WMVENCOD.DLL
2009-01-04 17:49:48 ----A---- C:\Windows\system32\WMVDECOD.DLL
2009-01-04 17:49:48 ----A---- C:\Windows\system32\advapi32.dll
2009-01-04 17:49:48 ----A---- C:\Windows\system32\adtschema.dll
2009-01-04 17:49:48 ----A---- C:\Windows\system32\adsmsext.dll
2009-01-04 17:49:48 ----A---- C:\Windows\system32\adsldpc.dll
2009-01-04 17:49:48 ----A---- C:\Windows\system32\accessibilitycpl.dll
2009-01-04 17:49:48 ----A---- C:\Windows\system32\aaclient.dll
2009-01-04 17:49:47 ----A---- C:\Windows\system32\winmm.dll
2009-01-04 17:49:47 ----A---- C:\Windows\system32\winlogon.exe
2009-01-04 17:49:47 ----A---- C:\Windows\system32\wininet.dll
2009-01-04 17:49:47 ----A---- C:\Windows\system32\winhttp.dll
2009-01-04 17:49:47 ----A---- C:\Windows\system32\WindowsCodecsExt.dll
2009-01-04 17:49:47 ----A---- C:\Windows\system32\WindowsCodecs.dll
2009-01-04 17:49:47 ----A---- C:\Windows\system32\win32spl.dll
2009-01-04 17:49:46 ----A---- C:\Windows\system32\wmpps.dll
2009-01-04 17:49:46 ----A---- C:\Windows\system32\wmpmde.dll
2009-01-04 17:49:46 ----A---- C:\Windows\system32\wmploc.DLL
2009-01-04 17:49:46 ----A---- C:\Windows\system32\WMPhoto.dll
2009-01-04 17:49:46 ----A---- C:\Windows\system32\wmpeffects.dll
2009-01-04 17:49:46 ----A---- C:\Windows\system32\wmp.dll
2009-01-04 17:49:46 ----A---- C:\Windows\system32\WMNetMgr.dll
2009-01-04 17:49:45 ----A---- C:\Windows\system32\wmdrmsdk.dll
2009-01-04 17:49:45 ----A---- C:\Windows\system32\wmdrmnet.dll
2009-01-04 17:49:45 ----A---- C:\Windows\system32\wmdrmdev.dll
2009-01-04 17:49:45 ----A---- C:\Windows\system32\WMADMOD.DLL
2009-01-04 17:49:45 ----A---- C:\Windows\system32\wlgpclnt.dll
2009-01-04 17:49:45 ----A---- C:\Windows\system32\wlanui.dll
2009-01-04 17:49:45 ----A---- C:\Windows\system32\wlanpref.dll
2009-01-04 17:49:45 ----A---- C:\Windows\system32\wlanmsm.dll
2009-01-04 17:49:45 ----A---- C:\Windows\system32\wlanhlp.dll
2009-01-04 17:49:45 ----A---- C:\Windows\system32\wlangpui.dll
2009-01-04 17:49:45 ----A---- C:\Windows\system32\WinSCard.dll
2009-01-04 17:49:45 ----A---- C:\Windows\system32\sendmail.dll
2009-01-04 17:49:44 ----A---- C:\Windows\system32\shdocvw.dll
2009-01-04 17:49:43 ----A---- C:\Windows\system32\shell32.dll
2009-01-04 17:49:43 ----A---- C:\Windows\system32\setupapi.dll
2009-01-04 17:49:43 ----A---- C:\Windows\system32\sethc.exe
2009-01-04 17:49:43 ----A---- C:\Windows\system32\services.exe
2009-01-04 17:49:42 ----A---- C:\Windows\system32\spwmp.dll
2009-01-04 17:49:42 ----A---- C:\Windows\system32\spwizui.dll
2009-01-04 17:49:41 ----A---- C:\Windows\system32\stobject.dll
2009-01-04 17:49:41 ----A---- C:\Windows\system32\sqmapi.dll
2009-01-04 17:49:41 ----A---- C:\Windows\system32\sqlsrv32.dll
2009-01-04 17:49:41 ----A---- C:\Windows\system32\spreview.exe
2009-01-04 17:49:41 ----A---- C:\Windows\system32\spp.dll
2009-01-04 17:49:41 ----A---- C:\Windows\system32\spoolss.dll
2009-01-04 17:49:41 ----A---- C:\Windows\system32\spinstall.exe
2009-01-04 17:49:41 ----A---- C:\Windows\system32\sperror.dll
2009-01-04 17:49:41 ----A---- C:\Windows\system32\spcmsg.dll
2009-01-04 17:49:40 ----A---- C:\Windows\system32\srchadmin.dll
2009-01-04 17:49:40 ----A---- C:\Windows\system32\slwmi.dll
2009-01-04 17:49:40 ----A---- C:\Windows\system32\slwga.dll
2009-01-04 17:49:40 ----A---- C:\Windows\system32\slmgr.vbs
2009-01-04 17:49:40 ----A---- C:\Windows\system32\SLCommDlg.dll
2009-01-04 17:49:40 ----A---- C:\Windows\system32\slcinst.dll
2009-01-04 17:49:40 ----A---- C:\Windows\system32\SLCExt.dll
2009-01-04 17:49:40 ----A---- C:\Windows\system32\slcc.dll
2009-01-04 17:49:40 ----A---- C:\Windows\system32\SLC.dll
2009-01-04 17:49:40 ----A---- C:\Windows\system32\shsetup.dll
2009-01-04 17:49:40 ----A---- C:\Windows\system32\shlwapi.dll
2009-01-04 17:49:40 ----A---- C:\Windows\system32\shgina.dll
2009-01-04 17:49:39 ----A---- C:\Windows\system32\softkbd.dll
2009-01-04 17:49:39 ----A---- C:\Windows\system32\SndVol.exe
2009-01-04 17:49:39 ----A---- C:\Windows\system32\SMBHelperClass.dll
2009-01-04 17:49:39 ----A---- C:\Windows\system32\SmartcardCredentialProvider.dll
2009-01-04 17:49:39 ----A---- C:\Windows\system32\shwebsvc.dll
2009-01-04 17:49:39 ----A---- C:\Windows\system32\shsvcs.dll
2009-01-04 17:49:34 ----A---- C:\Windows\system32\SyncCenter.dll
2009-01-04 17:49:34 ----A---- C:\Windows\system32\sud.dll
2009-01-04 13:34:38 ----D---- C:\Program Files (x86)\CCleaner
2009-01-03 00:21:30 ----RHD---- C:\Users\admin\AppData\Roaming\SecuROM
2009-01-03 00:21:27 ----A---- C:\Windows\system32\xa31823845.exe
2009-01-03 00:21:26 ----A---- C:\Windows\system32\xa31822955.exe
2009-01-02 23:16:36 ----D---- C:\Users\admin\AppData\Roaming\uTorrent
2009-01-02 19:26:51 ----D---- C:\Users\admin\AppData\Roaming\GHISLER
2009-01-02 19:26:51 ----D---- C:\totalcmd
2009-01-01 16:08:58 ----D---- C:\taktovani
2009-01-01 03:36:29 ----D---- C:\Users\admin\AppData\Roaming\Disney Interactive Studios
2009-01-01 03:35:40 ----A---- C:\Windows\system32\d3dx10_40.dll
2009-01-01 03:35:40 ----A---- C:\Windows\system32\D3DCompiler_40.dll
2009-01-01 03:35:39 ----A---- C:\Windows\system32\XAudio2_3.dll
2009-01-01 03:35:39 ----A---- C:\Windows\system32\XAPOFX1_2.dll
2009-01-01 03:35:39 ----A---- C:\Windows\system32\xactengine3_3.dll
2009-01-01 03:35:39 ----A---- C:\Windows\system32\X3DAudio1_5.dll
2009-01-01 03:35:39 ----A---- C:\Windows\system32\D3DX9_40.dll
2009-01-01 03:35:38 ----A---- C:\Windows\system32\XAudio2_2.dll
2009-01-01 03:35:38 ----A---- C:\Windows\system32\XAPOFX1_1.dll
2009-01-01 03:35:38 ----A---- C:\Windows\system32\xactengine3_2.dll
2009-01-01 03:35:38 ----A---- C:\Windows\system32\d3dx10_39.dll
2009-01-01 03:35:38 ----A---- C:\Windows\system32\D3DCompiler_39.dll
2009-01-01 03:35:37 ----A---- C:\Windows\system32\D3DX9_39.dll
2008-12-31 18:42:36 ----D---- C:\Users\admin\AppData\Roaming\Ashampoo
2008-12-31 18:42:00 ----D---- C:\ProgramData\ashampoo
2008-12-31 18:41:51 ----D---- C:\Program Files (x86)\Ashampoo
2008-12-31 00:02:43 ----D---- C:\Program Files (x86)\Common Files\Adobe AIR
2008-12-31 00:02:14 ----D---- C:\ProgramData\Adobe
2008-12-31 00:02:11 ----D---- C:\Program Files (x86)\Common Files\Adobe
2008-12-31 00:02:11 ----D---- C:\Program Files (x86)\Adobe
2008-12-30 21:47:19 ----D---- C:\Users\admin\AppData\Roaming\Macromedia
2008-12-30 21:47:19 ----D---- C:\Users\admin\AppData\Roaming\Adobe
2008-12-30 21:47:07 ----D---- C:\Windows\system32\Macromed
2008-12-29 17:59:18 ----D---- C:\Program Files (x86)\MPlayer for Windows
2008-12-29 16:15:59 ----AD---- C:\ProgramData\TEMP
2008-12-29 14:54:03 ----D---- C:\Program Files (x86)\Prime95
2008-12-28 23:29:19 ----D---- C:\Windows\system32\RTCOM
2008-12-28 23:27:01 ----D---- C:\Users\admin\AppData\Roaming\InstallShield
2008-12-28 23:26:02 ----A---- C:\Windows\SkyTel.exe
2008-12-28 23:26:02 ----A---- C:\Windows\RtlUpd64.exe
2008-12-28 23:26:02 ----A---- C:\Windows\RAVCpl64.exe
2008-12-28 21:44:24 ----D---- C:\Users\admin\AppData\Roaming\uniblue
2008-12-28 21:43:05 ----D---- C:\Program Files (x86)\Uniblue
2008-12-28 16:56:12 ----D---- C:\Program Files (x86)\QIP Infium
2008-12-28 16:54:46 ----A---- C:\Windows\system32\netfxperf.dll
2008-12-28 16:19:31 ----D---- C:\8bac7fad99813ce27739068e
2008-12-28 16:19:19 ----D---- C:\524227a693a77b7f6ec9ac
2008-12-28 16:02:02 ----D---- C:\2fa55ed2fc251d0fb018dae6ce747703
2008-12-28 16:01:08 ----RHD---- C:\AHCache
2008-12-28 15:54:51 ----D---- C:\Users\admin\AppData\Roaming\Mozilla
2008-12-28 15:54:11 ----D---- C:\Program Files (x86)\Mozilla Firefox
2008-12-28 13:19:34 ----A---- C:\Windows\system32\kbd106n.dll
2008-12-28 13:01:27 ----A---- C:\Windows\system32\PortableDeviceApi.dll
2008-12-28 12:08:12 ----A---- C:\Windows\system32\wups.dll
2008-12-28 12:08:12 ----A---- C:\Windows\system32\wudriver.dll
2008-12-28 12:08:12 ----A---- C:\Windows\system32\wuapi.dll
2008-12-28 12:08:08 ----A---- C:\Windows\system32\wuwebv.dll
2008-12-28 12:08:08 ----A---- C:\Windows\system32\wuapp.exe
2008-12-26 20:17:12 ----D---- C:\ProgramData\Media Center Programs
2008-12-26 20:06:18 ----D---- C:\Program Files (x86)\Electronic Arts
2008-12-26 10:58:12 ----D---- C:\Windows\pss
2008-12-26 10:21:06 ----D---- C:\Users\admin\AppData\Roaming\ESET
2008-12-26 10:20:24 ----D---- C:\ProgramData\ESET
2008-12-25 22:09:16 ----D---- C:\LAVA.EVERULTiMEDiT.4.60.1576.BETA
2008-12-25 21:22:46 ----D---- C:\ProgramData\Codemasters
2008-12-25 21:21:42 ----RA---- C:\Windows\system32\tmp9DF5.tmp
2008-12-25 21:21:42 ----D---- C:\Program Files (x86)\OpenAL
2008-12-25 21:21:42 ----A---- C:\Windows\system32\wrap_oal.dll
2008-12-25 21:21:42 ----A---- C:\Windows\system32\OpenAL32.dll
2008-12-25 21:21:21 ----HD---- C:\Windows\msdownld.tmp
2008-12-25 21:05:17 ----D---- C:\Windows\system32\directx
2008-12-25 19:23:38 ----A---- C:\Windows\system32\Msvcr71.dll
2008-12-25 19:23:38 ----A---- C:\Windows\system32\mfc71.dll
2008-12-25 19:23:38 ----A---- C:\Windows\system32\gdiplus.dll
2008-12-25 19:21:59 ----D---- C:\Windows\system32\xlive
2008-12-25 19:21:59 ----D---- C:\Program Files (x86)\Microsoft Games for Windows - LIVE
2008-12-25 18:42:36 ----D---- C:\Program Files (x86)\Rockstar Games
2008-12-25 17:24:57 ----D---- C:\Windows\Panther
2008-12-25 17:24:42 ----RAS---- C:\BOOTSECT.BAK
2008-12-25 17:24:39 ----SHD---- C:\Boot
2008-12-25 17:15:11 ----A---- C:\Windows\system32\CmdLineExt_x64.dll
2008-12-25 17:14:56 ----A---- C:\Windows\system32\XAudio2_1.dll
2008-12-25 17:14:56 ----A---- C:\Windows\system32\XAPOFX1_0.dll
2008-12-25 17:14:56 ----A---- C:\Windows\system32\xactengine3_1.dll
2008-12-25 17:14:56 ----A---- C:\Windows\system32\X3DAudio1_4.dll
2008-12-25 17:14:56 ----A---- C:\Windows\system32\d3dx10_38.dll
2008-12-25 17:14:56 ----A---- C:\Windows\system32\D3DCompiler_38.dll
2008-12-25 17:14:55 ----A---- C:\Windows\system32\D3DX9_38.dll
2008-12-25 17:14:54 ----A---- C:\Windows\system32\XAudio2_0.dll
2008-12-25 17:14:54 ----A---- C:\Windows\system32\xactengine3_0.dll
2008-12-25 17:14:54 ----A---- C:\Windows\system32\X3DAudio1_3.dll
2008-12-25 17:14:54 ----A---- C:\Windows\system32\d3dx10_37.dll
2008-12-25 17:14:54 ----A---- C:\Windows\system32\D3DCompiler_37.dll
2008-12-25 17:14:53 ----A---- C:\Windows\system32\D3DX9_37.dll
2008-12-25 17:14:52 ----A---- C:\Windows\system32\xactengine2_10.dll
2008-12-25 17:14:52 ----A---- C:\Windows\system32\d3dx10_36.dll
2008-12-25 17:14:52 ----A---- C:\Windows\system32\D3DCompiler_36.dll
2008-12-25 17:14:51 ----A---- C:\Windows\system32\d3dx9_36.dll
2008-12-25 17:14:50 ----A---- C:\Windows\system32\xactengine2_9.dll
2008-12-25 17:14:50 ----A---- C:\Windows\system32\d3dx10_35.dll
2008-12-25 17:14:50 ----A---- C:\Windows\system32\D3DCompiler_35.dll
2008-12-25 17:14:49 ----A---- C:\Windows\system32\xactengine2_8.dll
2008-12-25 17:14:49 ----A---- C:\Windows\system32\X3DAudio1_2.dll
2008-12-25 17:14:49 ----A---- C:\Windows\system32\d3dx9_35.dll
2008-12-25 17:14:49 ----A---- C:\Windows\system32\d3dx10_34.dll
2008-12-25 17:14:49 ----A---- C:\Windows\system32\D3DCompiler_34.dll
2008-12-25 17:14:48 ----A---- C:\Windows\system32\xinput1_3.dll
2008-12-25 17:14:48 ----A---- C:\Windows\system32\xactengine2_7.dll
2008-12-25 17:14:48 ----A---- C:\Windows\system32\d3dx9_34.dll
2008-12-25 17:14:48 ----A---- C:\Windows\system32\d3dx10_33.dll
2008-12-25 17:14:48 ----A---- C:\Windows\system32\D3DCompiler_33.dll
2008-12-25 17:14:47 ----A---- C:\Windows\system32\xactengine2_6.dll
2008-12-25 17:14:47 ----A---- C:\Windows\system32\d3dx9_33.dll
2008-12-25 17:14:46 ----A---- C:\Windows\system32\xactengine2_5.dll
2008-12-25 17:14:46 ----A---- C:\Windows\system32\d3dx9_32.dll
2008-12-25 17:14:46 ----A---- C:\Windows\system32\d3dx10.dll
2008-12-25 17:14:45 ----A---- C:\Windows\system32\xactengine2_4.dll
2008-12-25 17:14:45 ----A---- C:\Windows\system32\x3daudio1_1.dll
2008-12-25 17:14:45 ----A---- C:\Windows\system32\d3dx9_31.dll
2008-12-25 17:14:44 ----A---- C:\Windows\system32\xinput1_2.dll
2008-12-25 17:14:44 ----A---- C:\Windows\system32\xactengine2_3.dll
2008-12-25 17:14:43 ----A---- C:\Windows\system32\xinput1_1.dll
2008-12-25 17:14:43 ----A---- C:\Windows\system32\xactengine2_2.dll
2008-12-25 17:14:43 ----A---- C:\Windows\system32\xactengine2_1.dll
2008-12-25 17:14:36 ----A---- C:\Windows\system32\d3dx9_30.dll
2008-12-25 17:14:35 ----A---- C:\Windows\system32\xactengine2_0.dll
2008-12-25 17:14:35 ----A---- C:\Windows\system32\x3daudio1_0.dll
2008-12-25 17:14:35 ----A---- C:\Windows\system32\d3dx9_29.dll
2008-12-25 17:14:35 ----A---- C:\Windows\system32\d3dx9_28.dll
2008-12-25 17:14:34 ----A---- C:\Windows\system32\d3dx9_27.dll
2008-12-25 17:14:34 ----A---- C:\Windows\system32\d3dx9_26.dll
2008-12-25 17:14:34 ----A---- C:\Windows\system32\d3dx9_25.dll
2008-12-25 17:14:33 ----A---- C:\Windows\system32\d3dx9_24.dll
2008-12-25 17:05:20 ----RA---- C:\Windows\system32\tmp9DD5.tmp
2008-12-25 17:01:07 ----D---- C:\Users\admin\AppData\Roaming\DAEMON Tools Pro
2008-12-25 17:01:07 ----D---- C:\Users\admin\AppData\Roaming\DAEMON Tools
2008-12-25 17:00:28 ----D---- C:\ProgramData\DAEMON Tools Lite
2008-12-25 17:00:25 ----D---- C:\Program Files (x86)\DAEMON Tools Lite
2008-12-25 16:58:43 ----D---- C:\Users\admin\AppData\Roaming\DAEMON Tools Lite
2008-12-25 16:26:36 ----D---- C:\ort
2008-12-25 15:58:21 ----A---- C:\Windows\DIFxAPI.dll
2008-12-25 15:58:17 ----D---- C:\Program Files (x86)\Realtek
2008-12-25 15:58:17 ----A---- C:\Windows\RtlExUpd.dll
2008-12-25 15:58:17 ----A---- C:\Windows\HideWin.exe
2008-12-25 15:56:10 ----D---- C:\Program Files (x86)\Intel
2008-12-25 15:56:10 ----A---- C:\Windows\system32\CSVer.dll
2008-12-25 15:56:05 ----D---- C:\Intel
2008-12-25 15:55:51 ----D---- C:\Program Files (x86)\Browser Configuration Utility
2008-12-25 15:55:51 ----A---- C:\Windows\system32\dvmurl.dll
2008-12-25 15:46:29 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2008-12-25 15:46:29 ----D---- C:\Program Files (x86)\GIGABYTE
2008-12-25 15:46:24 ----D---- C:\Program Files (x86)\Common Files\InstallShield
2008-12-25 15:42:21 ----A---- C:\Windows\GSetup.ini
2008-12-25 15:38:30 ----D---- C:\hry
2008-12-25 15:25:13 ----D---- C:\Users\admin\AppData\Roaming\ATI
2008-12-25 15:22:34 ----D---- C:\Program Files (x86)\ATI Technologies
2008-12-25 15:21:49 ----D---- C:\ATI
2008-12-25 11:06:24 ----D---- C:\Program Files (x86)\SpeedFan
2008-12-25 10:55:54 ----A---- C:\Windows\IsUninst.exe
2008-12-25 09:42:35 ----D---- C:\Users\admin\AppData\Roaming\Identities
2008-12-25 09:42:20 ----SD---- C:\Users\admin\AppData\Roaming\Microsoft
2008-12-25 09:42:20 ----D---- C:\Users\admin\AppData\Roaming\Media Center Programs
2008-12-25 09:38:16 ----D---- C:\Windows\system32\CSY
2008-12-25 09:38:15 ----D---- C:\Windows\system32\x64
2008-12-25 09:38:15 ----A---- C:\Windows\system32\difxapi.dll
2008-12-25 09:38:00 ----SHD---- C:\ProgramData\Šablony
2008-12-25 09:38:00 ----SHD---- C:\ProgramData\Plocha
2008-12-25 09:38:00 ----SHD---- C:\ProgramData\Oblíbené položky
2008-12-25 09:38:00 ----SHD---- C:\ProgramData\Nabídka Start
2008-12-25 09:38:00 ----SHD---- C:\ProgramData\Dokumenty
2008-12-25 09:38:00 ----SHD---- C:\ProgramData\Data aplikací
2008-12-25 09:37:23 ----D---- C:\Windows\Debug
2008-12-25 09:32:20 ----A---- C:\errlgr.txt
2008-12-25 09:24:41 ----SHD---- C:\Windows\Installer
2008-12-25 08:32:09 ----D---- C:\Windows\SoftwareDistribution
2008-12-25 08:29:55 ----D---- C:\Windows\CSC
2008-12-25 08:25:53 ----SHD---- C:\System Volume Information
2008-12-20 00:30:00 ----A---- C:\Windows\system32\frapsvid.dll

======List of files/folders modified in the last 1 months======

2009-01-09 17:23:29 ----D---- C:\Windows\SysWOW64
2009-01-09 13:32:38 ----D---- C:\Windows\System32
2009-01-09 13:32:38 ----D---- C:\Windows\inf
2009-01-08 23:20:27 ----D---- C:\Windows\system32\drivers
2009-01-08 23:20:24 ----HD---- C:\ProgramData
2009-01-08 23:20:23 ----RD---- C:\Program Files (x86)
2009-01-07 21:25:12 ----RSD---- C:\Windows\assembly
2009-01-07 21:25:11 ----D---- C:\Windows\winsxs
2009-01-07 21:24:11 ----RSD---- C:\Windows\Fonts
2009-01-07 19:20:01 ----SD---- C:\Windows\Downloaded Program Files
2009-01-07 19:17:28 ----D---- C:\Windows
2009-01-07 19:16:44 ----D---- C:\Program Files (x86)\Common Files
2009-01-07 19:16:33 ----D---- C:\Windows\Temp
2009-01-06 22:49:20 ----D---- C:\Program Files (x86)\Common Files\microsoft shared
2009-01-05 21:48:00 ----RD---- C:\Program Files
2009-01-04 23:13:41 ----D---- C:\PerfLogs
2009-01-04 18:50:41 ----D---- C:\Windows\rescache
2009-01-04 18:25:31 ----D---- C:\Windows\Microsoft.NET
2009-01-04 18:19:40 ----D---- C:\Program Files (x86)\Windows Mail
2009-01-04 18:19:40 ----D---- C:\Program Files (x86)\Windows Calendar
2009-01-04 18:19:39 ----D---- C:\Program Files (x86)\Windows Sidebar
2009-01-04 18:19:39 ----D---- C:\Program Files (x86)\Windows Media Player
2009-01-04 18:19:39 ----D---- C:\Program Files (x86)\Internet Explorer
2009-01-04 18:19:38 ----D---- C:\Program Files (x86)\Windows Photo Gallery
2009-01-04 18:19:38 ----D---- C:\Program Files (x86)\Common Files\System
2009-01-04 18:19:33 ----D---- C:\Windows\ehome
2009-01-04 18:19:14 ----D---- C:\Windows\system32\XPSViewer
2009-01-04 18:19:14 ----D---- C:\Windows\system32\sk-SK
2009-01-04 18:19:14 ----D---- C:\Windows\system32\lv-LV
2009-01-04 18:19:14 ----D---- C:\Windows\system32\ko-KR
2009-01-04 18:19:14 ----D---- C:\Windows\system32\hr-HR
2009-01-04 18:19:14 ----D---- C:\Windows\system32\et-EE
2009-01-04 18:19:14 ----D---- C:\Windows\system32\da-DK
2009-01-04 18:19:13 ----D---- C:\Windows\system32\en-US
2009-01-04 18:19:12 ----D---- C:\Windows\system32\oobe
2009-01-04 18:19:12 ----D---- C:\Windows\system32\it-IT
2009-01-04 18:19:12 ----D---- C:\Windows\system32\el-GR
2009-01-04 18:19:12 ----D---- C:\Windows\system32\de-DE
2009-01-04 18:19:11 ----D---- C:\Windows\system32\migration
2009-01-04 18:19:09 ----D---- C:\Windows\system32\sv-SE
2009-01-04 18:19:09 ----D---- C:\Windows\system32\setup
2009-01-04 18:19:09 ----D---- C:\Windows\system32\ru-RU
2009-01-04 18:19:09 ----D---- C:\Windows\system32\he-IL
2009-01-04 18:19:09 ----D---- C:\Windows\system32\fr-FR
2009-01-04 18:19:09 ----D---- C:\Windows\system32\fi-FI
2009-01-04 18:19:09 ----D---- C:\Windows\system32\cs-CZ
2009-01-04 18:19:09 ----D---- C:\Windows\system32\cs
2009-01-04 18:19:08 ----D---- C:\Windows\system32\SLUI
2009-01-04 18:19:08 ----D---- C:\Windows\system32\pt-PT
2009-01-04 18:19:08 ----D---- C:\Windows\system32\hu-HU
2009-01-04 18:19:07 ----D---- C:\Windows\system32\zh-TW
2009-01-04 18:19:07 ----D---- C:\Windows\system32\zh-CN
2009-01-04 18:19:07 ----D---- C:\Windows\system32\wbem
2009-01-04 18:19:07 ----D---- C:\Windows\system32\uk-UA
2009-01-04 18:19:07 ----D---- C:\Windows\system32\tr-TR
2009-01-04 18:19:07 ----D---- C:\Windows\system32\th-TH
2009-01-04 18:19:07 ----D---- C:\Windows\system32\sr-Latn-CS
2009-01-04 18:19:07 ----D---- C:\Windows\system32\sl-SI
2009-01-04 18:19:07 ----D---- C:\Windows\system32\ro-RO
2009-01-04 18:19:07 ----D---- C:\Windows\system32\pt-BR
2009-01-04 18:19:07 ----D---- C:\Windows\system32\pl-PL
2009-01-04 18:19:07 ----D---- C:\Windows\system32\nl-NL
2009-01-04 18:19:07 ----D---- C:\Windows\system32\nb-NO
2009-01-04 18:19:07 ----D---- C:\Windows\system32\migwiz
2009-01-04 18:19:07 ----D---- C:\Windows\system32\manifeststore
2009-01-04 18:19:07 ----D---- C:\Windows\system32\lt-LT
2009-01-04 18:19:07 ----D---- C:\Windows\system32\ja-JP
2009-01-04 18:19:07 ----D---- C:\Windows\system32\es-ES
2009-01-04 18:19:07 ----D---- C:\Windows\system32\bg-BG
2009-01-04 18:19:07 ----D---- C:\Windows\system32\ar-SA
2009-01-04 18:18:42 ----D---- C:\Windows\PolicyDefinitions
2009-01-04 18:18:42 ----D---- C:\Windows\IME
2009-01-04 18:18:14 ----D---- C:\Windows\AppPatch
2008-12-28 12:23:19 ----D---- C:\Windows\Logs
2008-12-26 20:46:22 ----D---- C:\Windows\LiveKernelReports
2008-12-25 15:40:07 ----SHD---- C:\$Recycle.Bin
2008-12-25 15:37:30 ----SD---- C:\ProgramData\Microsoft
2008-12-25 09:42:19 ----RD---- C:\Users
2008-12-25 09:38:33 ----D---- C:\Windows\Prefetch
2008-12-25 08:35:23 ----ASH---- C:\Program Files (x86)\desktop.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 CSC;Offline Files Driver; C:\Windows\system32\drivers\csc.sys []
R1 easdrv;easdrv; C:\Windows\system32\DRIVERS\easdrv.sys []
R1 epfwtdi;epfwtdi; C:\Windows\system32\DRIVERS\epfwtdi.sys []
R2 eamon;EAMON; C:\Windows\system32\DRIVERS\eamon.sys []
R2 epfw;epfw; C:\Windows\system32\DRIVERS\epfw.sys []
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys []
R3 Epfwndis;Eset Personal Firewall; C:\Windows\system32\DRIVERS\Epfwndis.sys []
R3 gdrv;gdrv; \??\C:\Windows\gdrv.sys [2009-01-09 24072]
R3 GVTDrv64;GVTDrv64; \??\C:\Windows\GVTDrv64.sys [2009-01-09 30528]
R3 HdAudAddService;Ovladač funkce Microsoft 1.1 UAA pro službu zvuku High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys []
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys []
R3 ksthunk;Kernel Streaming Thunks; C:\Windows\system32\drivers\ksthunk.sys []
R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh64.sys []
S3 aeet9hkz;aeet9hkz; C:\Windows\system32\drivers\aeet9hkz.sys []
S3 BthEnum;Ovladač pro Bluetooth Request Block; C:\Windows\system32\DRIVERS\BthEnum.sys []
S3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys []
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys []
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys []
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\Windows\system32\drivers\drmkaud.sys []
S3 MSKSSRV;Server proxy služby datových proudů Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys []
S3 MSPCLOCK;Server proxy hodin datových proudů Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys []
S3 MSPQM;Server proxy správce kvality datových proudů Microsoft; C:\Windows\system32\drivers\MSPQM.sys []
S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; C:\Windows\system32\drivers\MSTEE.sys []
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys []
S3 RTCore64;RTCore64; \??\D:\rmma\RTCore64.sys []
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys []
S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys []
S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys []
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe []
R2 BthServ;@%SystemRoot%\System32\bthserv.dll,-101; C:\Windows\system32\svchost.exe [2008-04-20 21504]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2008-04-20 21504]
R2 ekrn;Eset Service; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [2008-10-24 468224]
S2 SBSDWSCService;SBSD Security Center Service; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2008-07-07 809296]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2008-04-20 21504]
S3 Autodesk Licensing Service;Autodesk Licensing Service; C:\Program Files (x86)\Common Files\Autodesk Shared\Service\AdskScSrv.exe [2009-01-07 79360]
S3 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64; C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [2008-09-24 93184]
S3 EhttpSrv;Eset HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2008-10-24 21760]
S3 PerfHost;@%systemroot%\sysWow64\perfhost.exe,-2; C:\Windows\SysWow64\perfhost.exe [2008-04-20 19968]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2008-04-20 21504]
S3 wbengine;@%systemroot%\system32\wbengine.exe,-104; C:\Windows\system32\wbengine.exe []
S4 GEST Service;GEST Service for program management.; C:\Program Files (x86)\GIGABYTE\EnergySaver\GSvr.exe [2008-07-11 80392]
S4 IDriverT;InstallDriver Table Manager; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]

-----------------EOF-----------------

[jaro3]

Stahni si Avanger
do něj podle navodu:
zadej prikaz z kodu:

Kód: Vybrat vše

Files to delete:
C:\Windows\system32\explorer.exe

po restartu log z avengeru

Toto otestuj na Virustotal
C:\Windows\system32\fc.exe
C:\Windows\system32\xa31823845.exe
C:\Windows\system32\xa31822955.exe
C:\Windows\system32\tmp9DF5.tmp
C:\Windows\system32\tmp9DD5.tmp
Vlož sem pak výsledky.
Budu možná až zítra..

[siskai]

Avenger smazal soubor explorer.exe, ale nevytvořil log. Nikde jsem ho nenašel. 3 exe soubory jsou podle VirusTotal čistý. Tempy už neexistují.

[jaro3]

Stáhni si OTViewIt (by OldTimer)
http://oldtimer.geekstogo.com/OTViewIt.exe

- ukonči všechna aktivní okna a spusť ho.
- klikni na tlačítko Run Scan a počkej až proběhne kontrola
- po jejím ukončení se ti zobrazí log tak ho sem vlož.

[siskai]

Nepovoluje to více jak 60000 znaků, takže jsem to dal sem: http://sweb.cz/siskai/OTViewIt.Txt

[jaro3]

Příště ten log vlož na dvě části a vlož sem.
Toto otestuj na Virustotal
C:\Windows\System32\drivers\aqyxeb.sys
C:\Windows\bthservsdp.dat
C:\Users\admin\Documents\desktop.ini
C:\Windows\GSetup.ini
Vlož sem pak výsledky, ten: C:\Windows\system32\explorer.exe se taky zatím nesmazal.