Pomalý chod programů, grafika blbně

[tomassovak]

Projelo a našlo to jenom zbytky o kterých jsem vůbec nevěděl. Ačkoliv mám vypnutý bod obnovení tak tři malware byly, vymazáno, které jsem před nějakým měsíce vymazal a zachytil antivir KaV.

Zkoušel jsem otestoval co mám doma. Našlo zbytby v ole drivers a malware . Ok

Přišel jsem na to že ten problém je lepší ale když počítač jsem nechal běžet zahřál se stejně tak tomu bylo minule začalo blbnou od internetu. Pomalé načítaní stránek ok Chrome. Zkusil jsem jinou relaci a už to bylo dobré. Pustil video a cvrkání a trhání. Náhodou jsem vyzkoušel testování derectu a snížil se výkon grafické karty tj particies 3d a vertex.

Mám dojem že by tzo mohlo být nějaké na grafickém rozhraní. Problém by mohl být v jiných medicích? Ty jsem ještě neotestoval. Ale posledně to chytlo právě Dx ve sys.

Až na poslední místě bych zkoušel gk a audio. jedině ještě mě napadá nějaký ten hidden soubor rootkit

btw náhodou jsem zaregisoroval tu nákazu ve stejný den co jsem nainstaloval evolve tv. Vymazal vše co je ale přesto zbytky v pc zůstaly. Tak nevím

[Rudy]

Dejte znovu log RSIT: http://forum.viry.cz/viewtopic.php?f=13&t=105895 .

[tomassovak]

Z mého pohledu jsou podezřelé ty ovladače. k tomu nutno dodat, že mi znizí zmizely programu mwav. Dále, že spustitelné soubory aktualizace se zobrazují jinak jako kdyby byly poškozený. Znám z minulosti pokud omylem vymažu soubory co se jeví jako falešné infiltrace. Dále že občas nezjištěné příčiny problikne kurzor na myši jako kdyby něco běželo na pozadí. Nevymazaly se soubory od evolte zbytek v registru dvb-t

tohle bych nejraději vymazal nezdá se mi to, možný pozůstatek po usb tv evolve?
MSTEE.sys
MPE.sys
NdisIP.sys
StreamIP.sys
SLIP.sys
WSTCODEC.SYS
NABTSFEC.sys
CCDECODE.sys

Logfile of random's system information tool 1.09 (written by random/random)
Run by Hans-Peter Geerdes at 2013-01-18 22:06:55
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 42 GB (28%) free of 153 GB
Total RAM: 3582 MB (79% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:07:27, on 18.1.2013
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Logitech\Gaming Software\LWEMon.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Hans-Peter Geerdes.DOMOV-AC71F76AA\Dokumenty\Downloads\RSIT.exe
C:\Program Files\trend micro\Hans-Peter Geerdes.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\ievkbd.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner.exe" /S
O4 - HKLM\..\Run: [Start WingMan Profiler] C:\Program Files\Logitech\Gaming Software\LWEMon.exe /noui
O4 - HKLM\..\Run: [avp] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: &Virtual Keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll
O9 - Extra button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Kaspersky Anti-Virus Service (AVP) - Kaspersky Lab ZAO - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

--
End of file - 4878 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-12-18 66280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}]
IEVkbdBHO Class - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\ievkbd.dll [2010-07-01 68280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre7\bin\ssv.dll [2012-10-07 449512]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18 403840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre7\bin\jp2ssv.dll [2012-10-07 157672]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E33CF602-D945-461A-83F0-819F76A199F8}]
FilterBHO Class - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll [2010-07-01 191160]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2012-07-03 98304]
"WINDVDPatch"=C:\WINDOWS\system32\CTHELPER.EXE [2002-02-07 40960]
"UpdReg"=C:\WINDOWS\UpdReg.EXE [2000-05-11 90112]
"Jet Detection"=C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe [2001-10-04 28672]
"RivaTunerStartupDaemon"=C:\Program Files\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner.exe [2009-08-22 2781184]
"Start WingMan Profiler"=C:\Program Files\Logitech\Gaming Software\LWEMon.exe [2010-06-14 153672]
"avp"=C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe [2012-11-13 352976]

C:\Documents and Settings\All Users.WINDOWS\Nabídka Start\Programy\Po spuštění
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2012-07-04 192512]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
C:\WINDOWS\system32\klogon.dll [2010-07-01 228024]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=475
"NoDrives"=0
"NoDriveAutoRun"=67108863

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=475
"NoDrives"=0
""=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Microsoft DirectX SDK (June 2010)\Utilities\bin\x86\AudConsole3.exe"="C:\Program Files\Microsoft DirectX SDK (June 2010)\Utilities\bin\x86\AudConsole3.exe:*:Enabled:Audio Console"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype "
"C:\Program Files\Logitech\Gaming Software\LWEMon.exe"="C:\Program Files\Logitech\Gaming Software\LWEMon.exe:*:Enabled:LWEMon"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"VIDC.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"VIDC.IYUV"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVU9"=tsbyuv.dll
"VIDC.YVYU"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"msacm.ctmp3"=C:\WINDOWS\system32\ctmp3.acm
"VIDC.FPS1"=frapsvid.dll
"MSVideo8"=VfWWDM32.dll

======File associations======

.js - open - %SystemRoot%\System32\CScript.exe "%1" %*
.vbs - open - %SystemRoot%\System32\CScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2013-01-18 19:53:21 ----A---- C:\TDSSKiller.2.8.15.0_18.01.2013_19.53.21_log.txt
2013-01-18 19:52:54 ----A---- C:\TDSSKiller.2.8.8.0_18.01.2013_19.52.54_log.txt
2013-01-18 19:38:22 ----A---- C:\WINDOWS\system32\drivers\AvgArCln.sys
2013-01-18 12:58:34 ----AD---- C:\WINDOWS\rundll16.exe
2013-01-18 12:58:34 ----AD---- C:\WINDOWS\logo1_.exe
2013-01-18 12:18:59 ----A---- C:\WINDOWS\system32\TASKMGR.COM
2013-01-18 12:18:59 ----A---- C:\WINDOWS\REGEDIT.COM
2013-01-18 11:01:46 ----SHD---- C:\RECYCLER
2013-01-17 21:09:35 ----A---- C:\WINDOWS\system32\d3d9caps.dat
2013-01-17 21:06:36 ----D---- C:\WINDOWS\temp
2013-01-17 13:15:14 ----A---- C:\WINDOWS\system32\drivers\2157388drv.sys
2013-01-16 17:24:46 ----A---- C:\WINDOWS\system32\drivers\39581892.sys
2013-01-05 19:43:03 ----D---- C:\Config.Msi
2013-01-03 17:07:27 ----D---- C:\Documents and Settings\Hans-Peter Geerdes.DOMOV-AC71F76AA\Data aplikací\SUPERAntiSpyware.com
2013-01-03 17:07:27 ----D---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\SUPERAntiSpyware.com
2013-01-02 21:30:30 ----D---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Spybot - Search & Destroy
2013-01-02 16:46:27 ----A---- C:\WINDOWS\system32\FlashPlayerInstaller.exe
2012-12-27 22:28:46 ----A---- C:\WINDOWS\system32\rapture3d_oal.dll
2012-12-25 10:56:45 ----A---- C:\WINDOWS\system32\drivers\afc.sys
2012-12-25 10:52:02 ----A---- C:\WINDOWS\system32\drivers\MSTEE.sys
2012-12-25 10:52:00 ----A---- C:\WINDOWS\system32\drivers\MPE.sys
2012-12-25 10:51:58 ----A---- C:\WINDOWS\system32\drivers\NdisIP.sys
2012-12-25 10:51:56 ----A---- C:\WINDOWS\system32\drivers\StreamIP.sys
2012-12-25 10:51:55 ----A---- C:\WINDOWS\system32\drivers\SLIP.sys
2012-12-25 10:51:52 ----A---- C:\WINDOWS\system32\drivers\WSTCODEC.SYS
2012-12-25 10:51:50 ----A---- C:\WINDOWS\system32\drivers\NABTSFEC.sys
2012-12-25 10:51:47 ----A---- C:\WINDOWS\system32\drivers\CCDECODE.sys
2012-12-25 10:51:37 ----A---- C:\WINDOWS\system32\vfwwdm32.dll
2012-12-25 10:51:37 ----A---- C:\WINDOWS\system32\PsisDecd.dll
2012-12-25 10:51:35 ----A---- C:\WINDOWS\system32\drivers\BdaSup.sys
2012-12-22 19:57:26 ----D---- C:\Documents and Settings\Hans-Peter Geerdes.DOMOV-AC71F76AA\Data aplikací\Media Player Classic

======List of files/folders modified in the last 1 month======

2013-01-18 22:07:22 ----A---- C:\WINDOWS\WINCMD.INI
2013-01-18 22:07:03 ----D---- C:\Program Files\trend micro
2013-01-18 22:00:15 ----SHD---- C:\System Volume Information
2013-01-18 20:00:29 ----D---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Kaspersky Lab
2013-01-18 19:58:03 ----A---- C:\WINDOWS\SchedLgU.Txt
2013-01-18 19:57:32 ----AD---- C:\WINDOWS\system32\drivers
2013-01-18 18:48:59 ----D---- C:\Program Files\Common Files
2013-01-18 12:59:22 ----D---- C:\WINDOWS
2013-01-18 12:47:23 ----A---- C:\WINDOWS\win.ini
2013-01-18 12:18:59 ----AD---- C:\WINDOWS\system32
2013-01-18 11:54:51 ----D---- C:\WINDOWS\system32\CatRoot2
2013-01-18 11:30:41 ----D---- C:\WINDOWS\Prefetch
2013-01-18 11:22:42 ----D---- C:\Program Files\Driver Sweeper
2013-01-18 10:59:06 ----HD---- C:\WINDOWS\inf
2013-01-18 10:56:03 ----HD---- C:\Program Files\InstallShield Installation Information
2013-01-18 10:56:02 ----RD---- C:\Program Files
2013-01-18 10:47:39 ----D---- C:\WINDOWS\system32\CatRoot
2013-01-18 10:32:27 ----D---- C:\Program Files\HijackThis
2013-01-17 21:10:51 ----A---- C:\WINDOWS\ntbtlog.txt
2013-01-17 21:03:36 ----A---- C:\WINDOWS\system.ini
2013-01-17 20:54:54 ----D---- C:\WINDOWS\AppPatch
2013-01-17 20:41:34 ----AD---- C:\Qoobox
2013-01-16 18:57:58 ----D---- C:\Documents and Settings\Hans-Peter Geerdes.DOMOV-AC71F76AA\Data aplikací\ICQ
2013-01-16 17:40:43 ----D---- C:\Downloads
2013-01-16 17:35:46 ----SD---- C:\WINDOWS\Tasks
2013-01-15 20:43:54 ----D---- C:\WINDOWS\system32\drivers\etc
2013-01-14 22:47:17 ----D---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\BOINC
2013-01-12 19:28:33 ----A---- C:\WINDOWS\system32\FlashPlayerApp.exe
2013-01-09 20:49:44 ----SHD---- C:\WINDOWS\Installer
2013-01-06 23:33:19 ----D---- C:\WINDOWS\system32\config
2013-01-06 23:33:05 ----D---- C:\WINDOWS\erdnt
2013-01-06 23:19:10 ----D---- C:\WINDOWS\system32\Restore
2013-01-03 12:11:40 ----A---- C:\WINDOWS\{00000003-00000000-00000001-00001102-00000002-00201102}.BAK
2012-12-27 22:28:48 ----D---- C:\Program Files\BRS
2012-12-27 21:24:49 ----A---- C:\WINDOWS\system32\OpenAL32.dll
2012-12-27 21:22:39 ----D---- C:\WINDOWS\system32\appmgmt
2012-12-27 21:19:47 ----A---- C:\WINDOWS\system32\wrap_oal.dll
2012-12-25 10:52:07 ----RSHDC---- C:\WINDOWS\system32\dllcache
2012-12-24 19:18:08 ----D---- C:\WINDOWS\Help

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 39581892;39581892; C:\WINDOWS\system32\DRIVERS\39581892.sys [2013-01-16 133208]
R0 agp440;Filtr Intel sběrnice AGP; C:\WINDOWS\system32\DRIVERS\agp440.sys [2008-04-13 42368]
R0 AVG Anti-Rootkit;AVG Anti-Rootkit; C:\WINDOWS\System32\DRIVERS\avgarkt.sys [2007-01-31 5632]
R0 KL1;kl1; C:\WINDOWS\system32\DRIVERS\kl1.sys [2010-06-09 132184]
R1 AvgArCln;Avg Anti-Rootkit Clean Driver; C:\WINDOWS\System32\DRIVERS\AvgArCln.sys [2007-01-18 3968]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 kl2;kl2; C:\WINDOWS\system32\DRIVERS\kl2.sys [2010-06-09 11352]
R1 KLIF;Kaspersky Lab Driver; C:\WINDOWS\system32\DRIVERS\klif.sys [2013-01-05 475736]
R1 SASDIFSV;SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS []
R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys []
R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-10-25 12032]
R2 cpuz134;cpuz134; \??\C:\WINDOWS\system32\drivers\cpuz134_x32.sys []
R2 PfModNT;PfModNT; \??\C:\WINDOWS\system32\PfModNT.sys []
R2 SIODRV;SIODRV; \??\C:\WINDOWS\system32\drivers\SIODRV.SYS []
R3 Afc;PPdus ASPI Shell; C:\WINDOWS\system32\drivers\Afc.sys [2006-11-10 18688]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2012-07-04 7874560]
R3 ctac32k;Creative AC3 Software Decoder; C:\WINDOWS\System32\drivers\ctac32k.sys [2002-03-22 114944]
R3 ctaud2k;Creative Audio Driver (WDM); C:\WINDOWS\system32\drivers\ctaud2k.sys [2002-03-22 835636]
R3 ctprxy2k;Creative Proxy Driver; C:\WINDOWS\System32\drivers\ctprxy2k.sys [2002-03-22 11068]
R3 ctsfm2k;Creative SoundFont Management Device Driver; C:\WINDOWS\System32\drivers\ctsfm2k.sys [2002-03-22 211724]
R3 E1000;Intel(R) PRO/1000 Adapter Driver; C:\WINDOWS\system32\DRIVERS\e1000325.sys [2003-10-28 130048]
R3 emupia;E-mu Plug-in Architecture Driver; C:\WINDOWS\System32\drivers\emupia2k.sys [2002-03-22 156604]
R3 ha10kx2k;Creative Hardware Abstract Layer Driver; C:\WINDOWS\system32\drivers\ha10kx2k.sys [2002-03-22 991656]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 klim5;Kaspersky Anti-Virus NDIS Filter; C:\WINDOWS\system32\DRIVERS\klim5.sys [2010-05-07 32856]
R3 klmouflt;Kaspersky Lab KLMOUFLT; C:\WINDOWS\system32\DRIVERS\klmouflt.sys [2009-11-02 19472]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 ossrv;Creative OS Services Driver; C:\WINDOWS\system32\drivers\ctoss2k.sys [2002-03-22 195432]
R3 RivaTuner32;RivaTuner32; \??\C:\Program Files\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner32.sys []
R3 SMBios;Intel (R) System Management BIOS Service; C:\WINDOWS\system32\DRIVERS\SMBios.sys [2005-05-02 36484]
R3 smbusp;Intel(R) SMBus 2.0 Driver; C:\WINDOWS\system32\DRIVERS\smb.sys [2002-10-23 21963]
R3 usbstor;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 WmBEnum;Logitech Virtual Bus Enumerator Driver; C:\WINDOWS\system32\drivers\WmBEnum.sys [2010-04-27 22856]
R3 WmFilter;Logitech Gaming HID Filter Driver; C:\WINDOWS\system32\drivers\WmFilter.sys [2010-04-27 37704]
R3 WmHidLo;Logitech Gaming USB Filter Driver; C:\WINDOWS\system32\drivers\WmHidLo.sys [2010-04-27 31816]
R3 WmVirHid;Logitech Virtual Hid Device Driver; C:\WINDOWS\system32\drivers\WmVirHid.sys [2010-04-27 15048]
R3 WmXlCore;Logitech Translation Layer Driver; C:\WINDOWS\system32\drivers\WmXlCore.sys [2010-04-27 66632]
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 cpuz135;cpuz135; \??\D:\Program Files\PC Wizard 2012\pcwiz_x32.sys []
S3 ctljystk;Game port pro zařízení Creative SB Live!; C:\WINDOWS\system32\DRIVERS\ctljystk.sys [2001-08-17 3712]
S3 emu10k;Creative SB Live! (WDM); C:\WINDOWS\system32\drivers\emu10k1m.sys [2001-08-17 283904]
S3 emu10k1;Creative Interface Manager Driver (WDM); C:\WINDOWS\system32\drivers\ctlfacem.sys [2001-08-17 6912]
S3 MPE;Filtr MPE BDA; C:\WINDOWS\system32\DRIVERS\MPE.sys [2008-04-14 15232]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 SASENUM;SASENUM; \??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS []
S3 sfman;Creative SoundFont Manager Driver (WDM); C:\WINDOWS\system32\drivers\sfmanm.sys [2001-08-17 36480]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2012-07-04 643072]
R2 AVP;Kaspersky Anti-Virus Service; C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe [2012-11-13 352976]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2009-08-18 1529728]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2010-03-18 35160]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 TUWinStylerThemeSvc;TuneUp WinStyler Theme Service; C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe [2005-08-10 118272]
S3 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S4 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-01-12 251400]
S4 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S4 Creative Service for CDROM Access;Creative Service for CDROM Access; C:\WINDOWS\system32\CTSVCCDA.EXE [1999-12-13 44032]
S4 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-02-03 133104]
S4 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-02-03 133104]
S4 imonNT;Intel(R) Active Monitor; C:\Program Files\Intel\Intel(R) Active Monitor\imonnt.exe [2005-05-02 106496]
S4 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre7\bin\jqs.exe [2012-10-07 161768]
S4 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2006-10-19 61440]
S4 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-01-05 774144]
S4 NetSvc;Intel NCS NetService; c:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe [2003-10-30 143360]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2006-12-23 262144]

-----------------EOF-----------------

[Rudy]

tohle bych nejraději vymazal nezdá se mi to, možný pozůstatek po usb tv evolve?

Jsou to soubory od MS a nějakých kodeků.

Stáhněte OTM: http://oldtimer.geekstogo.com/OTM.exe a uložte na plochu. Spusťte a do levého okna zkopírujte:

:files
C:\WINDOWS\system32\drivers\2157388drv.sys
C:\WINDOWS\system32\drivers\39581892.sys
C:\WINDOWS\{00000003-00000000-00000001-00001102-00000002-00201102}.BAK

:services
39581892
2157388drv

:commands
[Purity]
[Emptytemp]
[Emptyflash]

a klikněte na >MoveIt!<. Po skenu restartujte PC a dejte nový log RSIT.

Odinstalujte Spybot a Superantispyware, mohly by být v konfliktu s KIS. Co přesně "blbne" a jak? Nějak už ztrácím přehled.

[tomassovak]

Velký průšvich pc jsem vymazal. A během sledování činnosti jsem zaregistroval, že rsit jako by mrzlo tláčítko dále. vymzel potřebné zbytky. Kurzor u myši občas poblikával. Restar všeho po odinstalce a restaroval se. Ovšem zamrz kurzor myši. Obnova a polsení nepomohla. Když jsem hledal ovladače hlásilo chybu. Zvolil jsem možnost myš pře usb to šlo. Pustil jsem se vesele do opravy. Ale narazil jsem na problém chyby mechanik dvd a myši potom připojení k internetu. Když jsem dal možnost opravení win tak se to instalovalo a vyzvalo k nalezení z instalačního cd soubor asms ovšem průzkumní neraáguje na procházení mediem. je tam jistě zadaná cesta global devicet i 386 a nejde s tím nic udělat. Nějaká řečení? Snad by se pokazila základovla nebo ovladeče na mechaniku? Ale disky a vše ostatní bylo ok. Nevím jak se z toho vymotat. Záhada

[Rudy]

Tak z tohoto jsem zmaten i já sám. RSIT, ani OTM vám toto udělat nemohl. Pokud to není hardwarový problém, muselo tam být něco, co nám nenašel žádný z postupů. Nejlepší by bylo vyjmout disk a v jiném PC, kde bude zapojen jako druhý, ho otestovat jak na viry, tak na jeho kondici. Pak asi nezbude, než reinstal systému.

[tomassovak]

pohoda udělal jsem to ale testování ne. Instalaci taky. Prostě infekce totožná té první. S menším rozdílem, že nejprve zvuk potom drhání až v poslední fázi mrznutí. Při spouštění win a rsit. Víte právě že jsem před půl rokem řešil ten otcův a ten udělal to stejné že nešla myš ovladače všechno bylo ok. Stejně tak ten můj. Přes usb myšla šla, ale projistotu jsem to instaloval. Znova půjdu od píky. Otestuji a nainstaluji to njelpší. Jediná věc co by mohlo být je KAV beta jedině to by mohlo dělat neplechu.

Zpěk pro problémy. S Kasperský verzus skybot a spywere. Je lepší varianta k IS či KAV? V9te že spybot ma bezčností prvky jako imunize prohlížečů a taky hosts přídavá do bezpečnostích vyjímek.

Máte nějaký nápad co by to mohlo způsobovat? Kombofix, KAT, MWAV a rootkit to nenašlo s meším rozdílem našlo jenom zamknuté registry mcfeerootkitdetective. Asi 90 položek jedina ta možnost. Jinak se mi to jevilo že je to problém v registestrch. Zálohu už raději dávat nebud, protože od tý nebo případně při instalaci evolve tv skype a icq, potom jsem natahoval přes flashku soubory z otcového pc. Ještě je tu jedna možnost včera a předtím mi vyška hláška že v souboru došlo k chybě a bude ukončena. Jedná se o ntdll.dll

[Rudy]

V9te že spybot ma bezčností prvky.....

Vím. Ale také vím, že by mohl být v konfliktu s KAV a navíc je to sw, který je už dávno za zenitem. SaS by mohl rovněž být v konfliktu s KAV.

Co vlastně v této chvíli nefunguje?

[tomassovak]

Tak jsem vymazal windows naistaloval vše potřebné kompletně jsem to neotestoval. Ale video stejně blbná ale mám dojem že zvukovka vypadá divné zvuky. Mohla by být navině 10 let stará zvukovka? No ten obraz se trhá ne moc ale přesto. Neistalo jsem všechny prvky. Pokusím se zjisit co tam mám za programy a co nebudu vědět co je tak vymažu. Jinak to nepůjde. Ale nemůže v tom být nějaký zdánlivě neškodný software? Keyloger? No ještě by to chtělo protesotvat nějakým gmerem atd. Snad to by pomohlo.

Formát všeho se mi nechce. Můe to být blbost a nebo nějaký hw problémem třeba. Ale objevilo se to jak jsem psal minule při instalaci tv.

Ehm buď je to náhoda nebo nevím ale kouknul jsem se na prohlížeč události a zjištuji chybu v ati. Proto by se to to občas trhalo? Chyb tam je habaděj...

000000047: 2013-01-23 20:05:03:765 FAILED: ADL.ADL.ADL_Display_ImageExpansion_Get
Error Called by: ATI.ACE.CLI.Aspect.DeviceProperty.Graphics.Runtime.DevicePropertyImageScalingController::Parse processID:00200 threadID:( ) domainName:(ccc.exe ) assemblyName:(CLI.Aspect.DeviceProperty.Graphics.Runtime, Version=2.0.4567.41182, Culture=neutral, PublicKeyToken=90ba9c70f846762e)

000000046: 2013-01-23 20:05:03:656 RT_MMVideo::InitializeInternetVideo GetMMVideoAdjustInfoItem Pulldown FAILED
Error Called by: ATI.ACE.CLI.Aspect.MMVideo.Graphics.Runtime.RT_MMVideo::InitializeInternetVideo processID:00200 threadID:( ) domainName:(ccc.exe ) assemblyName:(CLI.Aspect.MMVideo.Graphics.Runtime, Version=2.0.4567.41184, Culture=neutral, PublicKeyToken=90ba9c70f846762e)

0000000045: 2013-01-23 20:05:03:656 RT_MMVideo::InitializeBlueStretch GetMMVideoAdjustInfoItem Pulldown FAILED
Error Called by: ATI.ACE.CLI.Aspect.MMVideo.Graphics.Runtime.RT_MMVideo::InitializeBlueStretch processID:00200 threadID:( ) domainName:(ccc.exe ) assemblyName:(CLI.Aspect.MMVideo.Graphics.Runtime, Version=2.0.4567.41184, Culture=neutral, PublicKeyToken=90ba9c70f846762e)

0000000018: 2013-01-23 19:47:06:468 Could not find Type [ATI.ACE.CLI.AIB.TutorialInfoCentre.Tutorial.Dashboard.DB_TutorialInfoCentre] from [CLI.AIB.TutorialInfoCentre.Tutorial.Dashboard] in assembly [CLI.AIB.TutorialInfoCentre.Tutorial.Dashboard]
Error Called by: ATI.ACE.LOG.Foundation.Services::LoadAssembly processID:00200 threadID:(CCCThreadNew:Dashboard) domainName:(ccc.exe ) assemblyName:(LOG.Foundation, Version=2.0.4567.41122, Culture=neutral, PublicKeyToken=90ba9c70f846762e)

[Rudy]

Pokud jste přeinstaloval Windows, nemůže tam být nic, co tam eventuálně bylo před tím. Ten sken GMER udělat můžete: http://forum.viry.cz/viewtopic.php?f=29&t=62878 . Dejte oba logy.

[tomassovak]

o jé jsou tam chyby v event logu od ati až aplikace

[Rudy]

o jé jsou tam chyby v event logu od ati až aplikace

Vy umíte číst log GMER, že to tak dobře víte?

[tomassovak]

nn to je ze systému a spravovat a log aplikaci a systému atd. Prostě možné chyby co jsou v systému winXP. Tak gmer nechávám kompletně proskenovat všechny disky a našlo to module noname hidden 01100000 - 0210A000 address 01100000 size 16818176. Více zítra...

[Rudy]

Až uvidím logy, řeknu vám.

[tomassovak]

Odhaleno. Včera zapnutý prohlížeč tam se to ukázalo. Dnes jsem nic nedělal gmer neodhalil. Spustil to a zkusil znova a rootkit na 00 dr0 disk

Problém je že log je nějaký zmršený. Protože ukazuje disk E ale ve výpisu to ukazuje disk C na kterém je rootkit. Navíc výpis je strašený dlouhý má přes 2MB

obnovení vymyzáno

GMER 2.0.18444 - http://www.gmer.net
Rootkit scan 2013-01-24 17:18:52
Windows 5.1.2600 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IdePort1 ST3160812A rev.3.AAD 149,05GB
Running: gmer.exe; Driver: C:\DOCUME~1\HANSPE~1.DOM\LOCALS~1\Temp\pfqdqfog.sys


---- Kernel code sections - GMER 2.0 ----

.text C:\WINDOWS\system32\DRIVERS\ati2mtag.sys section is writeable [0xB9511000, 0x1E2E6E, 0xE8000020]

---- Disk sectors - GMER 2.0 ----

Disk \Device\Harddisk0\DR0 sector 00: rootkit-like behavior

---- EOF - GMER 2.0 ----


MER 2.0.18444 - http://www.gmer.net
Rootkit scan 2013-01-24 17:31:39
Windows 5.1.2600 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IdePort1 ST3160812A rev.3.AAD 149,05GB
Running: gmer.exe; Driver: C:\DOCUME~1\HANSPE~1.DOM\LOCALS~1\Temp\pfqdqfog.sys


---- Kernel code sections - GMER 2.0 ----

.text C:\WINDOWS\system32\DRIVERS\ati2mtag.sys section is writeable [0xB9511000, 0x1E2E6E, 0xE8000020]

---- Disk sectors - GMER 2.0 ----

Disk \Device\Harddisk0\DR0 sector 00: rootkit-like behavior

---- Files - GMER 2.0 ----

File C:\license.rtf 15048 bytes
File C:\Drive Rescue 0 bytes
File C:\Drive Rescue\readme.rtf 21987 bytes
File C:\Drive Rescue\rescue.chm 224684 bytes
File C:\Drive Rescue\rescue.exe 1166848 bytes
File C:\Drive Rescue\transl.txt 20485 bytes
File C:\Drive Rescue\unins000.dat 1815 bytes
File C:\Drive Rescue\unins000.exe


File C:\Program Files\Mozilla Firefox\plds4.dll (size mismatch) 30320/20952 bytes executable
File C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll (size mismatch) 13952/19416 bytes executable
File C:\Program Files\Mozilla Firefox\browserconfig.properties 222 bytes
File C:\Program Files\Mozilla Firefox\chrome\browser.jar 1287124 bytes
File C:\Program Files\Mozilla Firefox\chrome\browser.manifest 550 bytes
File C:\Program Files\Mozilla Firefox\chrome\chromelist.txt 28472 bytes
File C:\Program Files\Mozilla Firefox\chrome\classic.jar 766981 bytes
File C:\Program Files\Mozilla Firefox\chrome\classic.manifest 322 bytes
File C:\Program Files\Mozilla Firefox\chrome\comm.jar 31967 bytes
File C:\Program Files\Mozilla Firefox\chrome\comm.manifest 144 bytes
File C:\Program Files\Mozilla Firefox\chrome\cs.jar 656578 bytes
File C:\Program Files\Mozilla Firefox\chrome\cs.manifest 768 bytes
File C:\Program Files\Mozilla Firefox\chrome\pippki.jar 299987 bytes
File C:\Program Files\Mozilla Firefox\chrome\pippki.manifest 69 bytes
File C:\Program Files\Mozilla Firefox\chrome\reporter.jar 44541 bytes
File C:\Program Files\Mozilla Firefox\chrome\reporter.manifest 340 bytes
File C:\Program Files\Mozilla Firefox\chrome\toolkit.jar 1862539 bytes
File C:\Program Files\Mozilla Firefox\chrome\toolkit.manifest 469 bytes
File C:\Program Files\Mozilla Firefox\components\nsSearchSuggestions.js 27061 bytes
File C:\Program Files\Mozilla Firefox\components\browser.xpt 321474 bytes
File C:\Program Files\Mozilla Firefox\components\compreg.dat 146881 bytes
File C:\Program Files\Mozilla Firefox\components\FeedConverter.js 20770 bytes
File C:\Program Files\Mozilla Firefox\components\FeedProcessor.js 60396 bytes
File C:\Program Files\Mozilla Firefox\components\FeedWriter.js 41338 bytes
File C:\Program Files\Mozilla Firefox\components\jar50.dll 66672 bytes executable
File C:\Program Files\Mozilla Firefox\components\jsconsole-clhandler.js 6313 bytes
File C:\Program Files\Mozilla Firefox\components\jsd3250.dll 54376 bytes
File C:\Program Files\Mozilla Firefox\components\myspell.dll 34952 bytes executable
File C:\Program Files\Mozilla Firefox\components\nsBookmarkTransactionManager.js 13895 bytes
File C:\Program Files\Mozilla Firefox\components\nsBrowserContentHandler.js 29967 bytes
File C:\Program Files\Mozilla Firefox\components\nsBrowserGlue.js 9459 bytes
File C:\Program Files\Mozilla Firefox\components\nsCloseAllWindows.js 5132 bytes
File C:\Program Files\Mozilla Firefox\components\nsDictionary.js 4805 bytes
File C:\Program Files\Mozilla Firefox\components\nsExtensionManager.js 324298 bytes
File C:\Program Files\Mozilla Firefox\components\nsHelperAppDlg.js 39291 bytes
File C:\Program Files\Mozilla Firefox\components\nsMicrosummaryService.js 81649 bytes
File C:\Program Files\Mozilla Firefox\components\nsPostUpdateWin.js 22254 bytes
File C:\Program Files\Mozilla Firefox\components\nsProxyAutoConfig.js 13475 bytes
File C:\Program Files\Mozilla Firefox\components\nsSafebrowsingApplication.js 147647 bytes
File C:\Program Files\Mozilla Firefox\components\nsSearchService.js 107030 bytes
File C:\Program Files\Mozilla Firefox\components\nsSessionStartup.js 15383 bytes
File C:\Program Files\Mozilla Firefox\components\nsSessionStore.js 73657 bytes
File C:\Program Files\Mozilla Firefox\components\nsSetDefaultBrowser.js 5054 bytes
File C:\Program Files\Mozilla Firefox\components\nsSidebar.js 14892 bytes
File C:\Program Files\Mozilla Firefox\components\nsUpdateService.js 104040 bytes
File C:\Program Files\Mozilla Firefox\components\nsUrlClassifierLib.js 136062 bytes
File C:\Program Files\Mozilla Firefox\components\nsUrlClassifierListManager.js 32944 bytes
File C:\Program Files\Mozilla Firefox\components\nsUrlClassifierTable.js 45938 bytes
File C:\Program Files\Mozilla Firefox\components\nsURLFormatter.js 5835 bytes
File C:\Program Files\Mozilla Firefox\components\nsXmlRpcClient.js 35263 bytes
File C:\Program Files\Mozilla Firefox\components\spellchk.dll 46720 bytes executable
File C:\Program Files\Mozilla Firefox\components\WebContentConverter.js 24340 bytes
File C:\Program Files\Mozilla Firefox\components\xpinstal.dll 172144 bytes executable
File C:\Program Files\Mozilla Firefox\components\xpti.dat 93147 bytes
File C:\Program Files\Mozilla Firefox\defaults\autoconfig\platform.js 87 bytes
File C:\Program Files\Mozilla Firefox\defaults\autoconfig\prefcalls.js 7296 bytes
File C:\Program Files\Mozilla Firefox\defaults\pref\firefox-branding.js 915 bytes
File C:\Program Files\Mozilla Firefox\defaults\pref\firefox-l10n.js 359 bytes
File C:\Program Files\Mozilla Firefox\defaults\pref\firefox.js 26801 bytes
File C:\Program Files\Mozilla Firefox\defaults\pref\reporter.js 206 bytes
File C:\Program Files\Mozilla Firefox\defaults\profile\bookmarks.html 7129 bytes
File C:\Program Files\Mozilla Firefox\defaults\profile\chrome\userChrome-example.css 877 bytes
File C:\Program Files\Mozilla Firefox\defaults\profile\chrome\userContent-example.css 723 bytes
File C:\Program Files\Mozilla Firefox\defaults\profile\localstore.rdf 158 bytes
File C:\Program Files\Mozilla Firefox\defaults\profile\mimeTypes.rdf 369 bytes
File C:\Program Files\Mozilla Firefox\defaults\profile\search.rdf 2402 bytes
File C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org 0 bytes
File C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\chrome.manifest 0 bytes
File C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components 0 bytes
File C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\BrandRes.dll 99840 bytes executable
File C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\fullsoft.dll 156544 bytes executable
File C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\master.ini 3323 bytes
File C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\qfaservices.dll 14456 bytes executable
File C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\qfaservices.xpt 144 bytes
File C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\talkback-l10n.ini 14826 bytes
File C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\talkback.cnt 1355 bytes
File C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\talkback.exe 407040 bytes executable
File C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\talkback.hlp 32928 bytes
File C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\install.rdf 1727 bytes
File C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\InstallDisabled 2 bytes
File C:\Program Files\Mozilla Firefox\firefox.exe (size mismatch) 7633008/924632 bytes executable
File C:\Program Files\Mozilla Firefox\freebl3.dll (size mismatch) 200829/269272 bytes executable
File C:\Program Files\Mozilla Firefox\greprefs\all.js 64659 bytes
File C:\Program Files\Mozilla Firefox\greprefs\security-prefs.js 3013 bytes
File C:\Program Files\Mozilla Firefox\greprefs\xpinstall.js 85 bytes
File C:\Program Files\Mozilla Firefox\js3250.dll 455272 bytes executable
File C:\Program Files\Mozilla Firefox\LICENSE 30869 bytes
File C:\Program Files\Mozilla Firefox\nspr4.dll (size mismatch) 161392/187352 bytes executable
File C:\Program Files\Mozilla Firefox\nss3.dll (size mismatch) 378472/646104 bytes executable
File C:\Program Files\Mozilla Firefox\nssckbi.dll (size mismatch) 259696/371672 bytes executable
File C:\Program Files\Mozilla Firefox\old-homepage-default.properties 107 bytes
File C:\Program Files\Mozilla Firefox\plc4.dll (size mismatch) 34424/22488 bytes executable
File C:\Program Files\Mozilla Firefox\plugins\npnul32.dll 22664 bytes executable
File C:\Program Files\Mozilla Firefox\plugins\NPOFFICE.DLL 17248 bytes executable
File C:\Program Files\Mozilla Firefox\README.txt 438 bytes
File C:\Program Files\Mozilla Firefox\res\table-add-column-after-active.gif 823 bytes
File C:\Program Files\Mozilla Firefox\res\arrow.gif 49 bytes
File C:\Program Files\Mozilla Firefox\res\arrowd.gif 52 bytes
File C:\Program Files\Mozilla Firefox\res\broken-image.gif 165 bytes
File C:\Program Files\Mozilla Firefox\res\charsetalias.properties 11348 bytes
File C:\Program Files\Mozilla Firefox\res\charsetData.properties 8507 bytes
File C:\Program Files\Mozilla Firefox\res\cmessage.txt 93 bytes
File C:\Program Files\Mozilla Firefox\res\dtd\mathml.dtd 64504 bytes
File C:\Program Files\Mozilla Firefox\res\dtd\xhtml11.dtd 8427 bytes
File C:\Program Files\Mozilla Firefox\res\EditorOverride.css 10566 bytes
File C:\Program Files\Mozilla Firefox\res\entityTables\html40Latin1.properties 3690 bytes
File C:\Program Files\Mozilla Firefox\res\entityTables\html40Special.properties 2396 bytes
File C:\Program Files\Mozilla Firefox\res\entityTables\html40Symbols.properties 4090 bytes
File C:\Program Files\Mozilla Firefox\res\entityTables\htmlEntityVersions.properties 1967 bytes
File C:\Program Files\Mozilla Firefox\res\entityTables\mathml20.properties 29091 bytes
File C:\Program Files\Mozilla Firefox\res\entityTables\transliterate.properties 38499 bytes
File C:\Program Files\Mozilla Firefox\res\fonts\fontEncoding.properties 5169 bytes
File C:\Program Files\Mozilla Firefox\res\fonts\fontNameMap.properties 3793 bytes
File C:\Program Files\Mozilla Firefox\res\fonts\mathfont.properties 42412 bytes
File C:\Program Files\Mozilla Firefox\res\fonts\mathfontCMEX10.properties 5951 bytes
File C:\Program Files\Mozilla Firefox\res\fonts\mathfontCMSY10.properties 4439 bytes
File C:\Program Files\Mozilla Firefox\res\fonts\mathfontMath1.properties 3353 bytes
File C:\Program Files\Mozilla Firefox\res\fonts\mathfontMath2.properties 5472 bytes
File C:\Program Files\Mozilla Firefox\res\fonts\mathfontMath4.properties 6512 bytes
File C:\Program Files\Mozilla Firefox\res\fonts\mathfontMTExtra.properties 2348 bytes
File C:\Program Files\Mozilla Firefox\res\fonts\mathfontPUA.properties 15688 bytes
File C:\Program Files\Mozilla Firefox\res\fonts\mathfontSymbol.properties 3747 bytes
File C:\Program Files\Mozilla Firefox\res\forms.css 13385 bytes
File C:\Program Files\Mozilla Firefox\res\grabber.gif 858 bytes
File C:\Program Files\Mozilla Firefox\res\hiddenWindow.html 117 bytes
File C:\Program Files\Mozilla Firefox\res\html\gopher-audio.gif 163 bytes
File C:\Program Files\Mozilla Firefox\res\html\gopher-binary.gif 165 bytes
File C:\Program Files\Mozilla Firefox\res\html\gopher-find.gif 178 bytes
File C:\Program Files\Mozilla Firefox\res\html\gopher-image.gif 188 bytes
File C:\Program Files\Mozilla Firefox\res\html\gopher-menu.gif 135 bytes
File C:\Program Files\Mozilla Firefox\res\html\gopher-movie.gif 180 bytes
File C:\Program Files\Mozilla Firefox\res\html\gopher-sound.gif 163 bytes
File C:\Program Files\Mozilla Firefox\res\html\gopher-telnet.gif 189 bytes
File C:\Program Files\Mozilla Firefox\res\html\gopher-text.gif 154 bytes
File C:\Program Files\Mozilla Firefox\res\html\gopher-unknown.gif 132 bytes
File C:\Program Files\Mozilla Firefox\res\html.css 9568 bytes
File C:\Program Files\Mozilla Firefox\res\langGroups.properties 5619 bytes
File C:\Program Files\Mozilla Firefox\res\language.properties 5452 bytes
File C:\Program Files\Mozilla Firefox\res\loading-image.gif 157 bytes
File C:\Program Files\Mozilla Firefox\res\mathml.css 13572 bytes
File C:\Program Files\Mozilla Firefox\res\quirk.css 11757 bytes
File C:\Program Files\Mozilla Firefox\res\svg.css 2251 bytes
File C:\Program Files\Mozilla Firefox\res\table-add-column-after-hover.gif 826 bytes
File C:\Program Files\Mozilla Firefox\res\table-add-column-after.gif 826 bytes
File C:\Program Files\Mozilla Firefox\res\table-add-column-before-active.gif 50 bytes
File C:\Program Files\Mozilla Firefox\res\table-add-column-before-hover.gif 825 bytes
File C:\Program Files\Mozilla Firefox\res\table-add-column-before.gif 825 bytes
File C:\Program Files\Mozilla Firefox\res\table-add-row-after-active.gif 822 bytes
File C:\Program Files\Mozilla Firefox\res\table-add-row-after-hover.gif 826 bytes
File C:\Program Files\Mozilla Firefox\res\table-add-row-after.gif 826 bytes
File C:\Program Files\Mozilla Firefox\res\table-add-row-before-active.gif 821 bytes
File C:\Program Files\Mozilla Firefox\res\table-add-row-before-hover.gif 825 bytes
File C:\Program Files\Mozilla Firefox\res\table-add-row-before.gif 825 bytes
File C:\Program Files\Mozilla Firefox\res\table-remove-column-active.gif 835 bytes
File C:\Program Files\Mozilla Firefox\res\table-remove-column-hover.gif 841 bytes
File C:\Program Files\Mozilla Firefox\res\table-remove-column.gif 841 bytes
File C:\Program Files\Mozilla Firefox\res\table-remove-row-active.gif 835 bytes
File C:\Program Files\Mozilla Firefox\res\table-remove-row-hover.gif 841 bytes
File C:\Program Files\Mozilla Firefox\res\table-remove-row.gif 841 bytes
File C:\Program Files\Mozilla Firefox\res\ua.css 6053 bytes
File C:\Program Files\Mozilla Firefox\res\viewsource.css 3042 bytes
File C:\Program Files\Mozilla Firefox\res\wincharset.properties 2080 bytes
File C:\Program Files\Mozilla Firefox\searchplugins 0 bytes
File C:\Program Files\Mozilla Firefox\searchplugins\centrum-cz.xml 1118 bytes
File C:\Program Files\Mozilla Firefox\searchplugins\google.xml 2368 bytes
File C:\Program Files\Mozilla Firefox\searchplugins\jyxo-cz.xml 661 bytes
File C:\Program Files\Mozilla Firefox\searchplugins\mall-cz.xml 1674 bytes
File C:\Program Files\Mozilla Firefox\searchplugins\seznam-cz.xml 1302 bytes
File C:\Program Files\Mozilla Firefox\searchplugins\slunecnice-cz.xml 765 bytes
File C:\Program Files\Mozilla Firefox\smime3.dll (size mismatch) 112232/105432 bytes executable
File C:\Program Files\Mozilla Firefox\softokn3.dll (size mismatch) 254060/170968 bytes executable
File C:\Program Files\Mozilla Firefox\ssl3.dll (size mismatch) 132712/154584 bytes executable
File C:\Program Files\Mozilla Firefox\uninstall\helper.exe (size mismatch) 431808/835832 bytes executable
File C:\Program Files\Mozilla Firefox\updater.exe (size mismatch) 130184/269272 bytes executable
File C:\Program Files\Mozilla Firefox\xpcom.dll (size mismatch) 13416/19928 bytes executable
File C:\Program Files\Mozilla Firefox\xpcom_compat.dll 73848 bytes executable
File C:\Program Files\Mozilla Firefox\xpcom_core.dll 421488 bytes executable
File C:\Program Files\Mozilla Firefox\xpicleanup.exe 73336 bytes executable
File C:\Program Files\Mozilla Firefox\xpistub.dll 12400 bytes executable
File C:\Program Files\star.tga 3116 bytes
File C:\Program Files\Undo 0 bytes
File C:\Program Files\Undo\ECUndo01.reg 23790 bytes
File C:\Program Files\Uninstall Information\odbc.dat 24 bytes
File C:\Program Files\Video Card Stability Test 0 bytes
File C:\Program Files\Video Card Stability Test\EarthDX9.dll 667648 bytes executable
File C:\Program Files\Video Card Stability Test\fgsender.dll 65536 bytes executable
File C:\Program Files\Video Card Stability Test\FreeStone-Group.com.ico 2998 bytes
File C:\Program Files\Video Card Stability Test\FreeStone-Group.com.url 115 bytes
File C:\Program Files\Video Card Stability Test\Games.FreeStone-Group.com.url 59 bytes
File C:\Program Files\Video Card Stability Test\License.txt 958 bytes
File C:\Program Files\Video Card Stability Test\Media 0 bytes
File C:\Program Files\Video Card Stability Test\Media\bumpshader.vsh 825 bytes
File C:\Program Files\Video Card Stability Test\Media\bumpshader2.vsh 835 bytes
File C:\Program Files\Video Card Stability Test\Media\bumpshader3.vsh 779 bytes
File C:\Program Files\Video Card Stability Test\Media\bumpshader4.vsh 783 bytes
File C:\Program Files\Video Card Stability Test\Media\fg.bmp 17462 bytes
File C:\Program Files\Video Card Stability Test\Media\shadowbumpshader.psh 659 bytes
File C:\Program Files\Video Card Stability Test\Media\shine 0 bytes
File C:\Program Files\Video Card Stability Test\Media\shine0.bmp 17462 bytes
File C:\Program Files\Video Card Stability Test\Media\shine1.bmp 17462 bytes
File C:\Program Files\Video Card Stability Test\Media\shine2.bmp 17462 bytes
File C:\Program Files\Video Card Stability Test\Media\shine3.bmp 17462 bytes
File C:\Program Files\Video Card Stability Test\Media\shine4.bmp 17462 bytes
File C:\Program Files\Video Card Stability Test\Media\shine5.bmp 17462 bytes
File C:\Program Files\Video Card Stability Test\Media\shine6.bmp 17462 bytes
File C:\Program Files\Video Card Stability Test\Media\shine7.bmp 17462 bytes
File C:\Program Files\Video Card Stability Test\Media\shine8.bmp 17462 bytes
File C:\Program Files\Video Card Stability Test\Media\shine9.bmp 17462 bytes
File C:\Program Files\Video Card Stability Test\Media\sphere_h.x 3101498 bytes
File C:\Program Files\Video Card Stability Test\Media\sphere_m.x 392344 bytes
File C:\Program Files\Video Card Stability Test\Media\Thumbs.db 25088 bytes
File C:\Program Files\Video Card Stability Test\meshes.dat 78293 bytes
File C:\Program Files\Video Card Stability Test\StabilityTestDX9.dll 176128 bytes executable
File C:\Program Files\Video Card Stability Test\uninstall.exe 58384 bytes executable
File C:\Program Files\Video Card Stability Test\unrar.dll 153088 bytes
File C:\Program Files\Video Card Stability Test\vcstres.dll 90112 bytes executable
File C:\Program Files\Video Card Stability Test\Video Card Stability Test.exe 108544 bytes executable
File C:\Program Files\wood.tga 196652 bytes
File C:\readme.txt 2208 bytes
File C:\RECYCLER\S-1-5-21-1801674531-1935655697-1060284298-1004 0 bytes
File C:\RECYCLER\S-1-5-21-343818398-1647877149-725345543-1003 0 bytes
File C:\RECYCLER\S-1-5-21-343818398-1647877149-725345543-500 0 bytes
File C:\RECYCLER\S-1-5-21-57989841-789336058-842925246-1004 0 bytes
File C:\RECYCLER\S-1-5-21-842925246-1580818891-1957994488-1004 0 bytes
File C:\RelNotes.rtf 22200 bytes
File C:\System Volume Information\_restore{06A5AF6C-7E18-4ABD-A2C2-A3A0E86141D1} 0 bytes
F
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP41\snapshot\_REGISTRY_MACHINE_SECURITY 40960 bytes
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP41\snapshot\_REGISTRY_MACHINE_SOFTWARE 22298624 bytes
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP41\snapshot\_REGISTRY_MACHINE_SYSTEM 4837376 bytes
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP41\snapshot\_REGISTRY_USER_.DEFAULT 282624 bytes
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP41\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18 282624 bytes
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP41\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19 233472 bytes
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP41\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20 237568 bytes
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP41\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-57989841-789336058-842925246-1004 2588672 bytes
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP41\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19 8192 bytes
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP41\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20 8192 bytes
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42 0 bytes
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026227.dll 103776 bytes executable
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026228.ini 222 bytes
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026229.rbf 7084384 bytes executable
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026230.rbf 766 bytes
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026231.rbf 409600 bytes executable
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026232.rbf 286720 bytes executable
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026233.rbf 135168 bytes executable
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026234.rbf 61440 bytes executable
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026235.rbf 249856 bytes executable
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026236.rbf 593920 bytes executable
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026237.rbf 12288 bytes executable
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026238.rbf 86016 bytes executable
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026239.rbf 11264 bytes executable
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026240.rbf 27136 bytes executable
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026241.rbf 4096 bytes executable
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026242.rbf 794624 bytes executable
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026243.rbf 23040 bytes executable
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026245.rbf 612352 bytes executable
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026246.rbf 562184 bytes executable
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026247.rbf 766 bytes
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026248.rbf 409600 bytes executable
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026249.rbf 286720 bytes executable
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026250.rbf 135168 bytes executable
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026251.rbf 61440 bytes executable
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026252.rbf 249856 bytes executable
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026253.rbf 593920 bytes executable
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026254.rbf 12288 bytes executable
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026255.rbf 86016 bytes executable
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026256.rbf 11264 bytes executable
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026257.rbf 27136 bytes executable
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026258.rbf 4096 bytes executable
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026259.rbf 794624 bytes executable
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026260.rbf 23040 bytes executable
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026261.rbf 422912 bytes executable
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026263.rbf 409600 bytes executable
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026264.rbf 286720 bytes executable
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026265.rbf 135168 bytes executable
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026266.rbf 61440 bytes executable
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026267.rbf 249856 bytes executable
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026268.rbf 593920 bytes executable
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026269.rbf 12288 bytes executable
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026270.rbf 86016 bytes executable
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026271.rbf 11264 bytes executable
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026272.rbf 27136 bytes executable
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026273.rbf 4096 bytes executable
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026274.rbf 794624 bytes executable
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026275.rbf 23040 bytes executable
File C:\System Volume Information\_restore{44E0F3CF-EBBF-4DA8-8B70-F95813736D6C}\RP42\A0026276.rbf 766 bytes