VIRY.CZ

Dobry den,

je to asi 5 dni, co se pri hrani zacali objevovat jedno-sekundove freezy s velkymi vykyvy FPS a pri praci ve Windows problemy s plynulosti... pocitac byl defragmentovan, vycisten CCleanerem a napady, cim by to mohlo byt uz mi dochazeji, proto bych prosil o kontrolu logu, jestli nahodou neni problem v nejakem viru, nebo necem podobnem.

Dekuji predem.


LOG:


Logfile of random's system information tool 1.09 (written by random/random)
Run by SIMON at 2012-02-13 17:37:21
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 97 GB (83%) free of 116 GB
Total RAM: 2046 MB (62% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:37:38, on 13. 2. 2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Steam\Steam.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Documents and Settings\SIMON\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\SIMON\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\SIMON\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\SIMON\Plocha\Photoshopping\RSIT.exe
C:\Program Files\trend micro\SIMON.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-18 Startup: OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe (User 'Default user')
O4 - Startup: OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: BDARemote.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 7322035687
O17 - HKLM\System\CCS\Services\Tcpip\..\{EE7551BB-8615-4526-AAC0-21233627A50E}: NameServer = 192.168.0.1
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2009.SP3c\RpcAgentSrv.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

--
End of file - 6719 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{B27A758B-AFAA-4163-B8E4-960DC90CF985}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2012-01-17 325408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Browser Helper - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2011-11-29 3844768]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2012-01-17 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2012-01-17 79648]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NVMixerTray"=C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe [2004-12-20 131072]
"APSDaemon"=C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [2011-11-01 59240]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2011-12-08 421736]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2011-06-09 254696]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2011-10-13 17351304]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
C:\Documents and Settings\SIMON\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe [2010-09-21 136176]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe [2009-10-14 2793304]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\QTTask.exe [2007-10-19 286720]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files\Skype\Phone\Skype.exe [2011-10-13 17351304]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
C:\Program Files\Steam\Steam.exe [2012-01-04 1242448]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^SIMON^Nabídka Start^Programy^Po spuštění^Logitech . Registrácia výrobku.lnk]
C:\PROGRA~1\Logitech\LOGITE~1\eReg.exe [2009-10-14 517384]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3
"wlidsvc"=2
"ose"=3
"lxdxCATSCustConnectService"=2

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
BDARemote.lnk - C:\Program Files\USB TV\EM28XX\BDARemote.exe

C:\Documents and Settings\SIMON\Nabídka Start\Programy\Po spuštění
OpenOffice.org 3.2.lnk - C:\Program Files\OpenOffice.org 3\program\quickstart.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2010-02-11 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoInstrumentation"=1
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2009.SP3c\RpcAgentSrv.exe"="C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2009.SP3c\RpcAgentSrv.exe:*:Enabled:SiSoftware Deployment Agent Service"
"C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2009.SP3c\WNt500x86\RpcSandraSrv.exe"="C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2009.SP3c\WNt500x86\RpcSandraSrv.exe:*:Enabled:SiSoftware Sandra Agent Service"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\Steam\Steam.exe"="C:\Program Files\Steam\Steam.exe:*:Enabled:Steam"
"C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe"="C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe:*:Enabled:WebKit"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour Service"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\Steam\steamapps\siafz\counter-strike\hl.exe"="C:\Program Files\Steam\steamapps\siafz\counter-strike\hl.exe:*:Enabled:Counter-Strike"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Lexmark 2500 Series\app4r.exe"="C:\Program Files\Lexmark 2500 Series\App4R.exe:*:Enabled:Printing Application"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"VIDC.I420"=lvcodec2.dll
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"VIDC.IYUV"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVU9"=tsbyuv.dll
"VIDC.YVYU"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"VIDC.DIVX"=divx.dll
"VIDC.XVID"=xvidvfw.dll
"VIDC.YV12"=yv12vfw.dll
"msacm.ac3acm"=ac3acm.acm
"msacm.lameacm"=lameACM.acm
"VIDC.FFDS"=ff_vfw.dll
"MSVideo8"=VfWWDM32.dll
"MSVideo"=vfwwdm32.dll

======List of files/folders created in the last 1 month======

2012-02-13 17:34:51 ----D---- C:\rsit
2012-02-13 17:34:51 ----D---- C:\Program Files\trend micro
2012-02-12 14:58:24 ----HD---- C:\WINDOWS\system32\GroupPolicy
2012-02-10 22:06:34 ----D---- C:\Program Files\Common Files\ATI Technologies
2012-02-10 22:06:22 ----D---- C:\Program Files\DIFX
2012-02-10 22:06:17 ----D---- C:\Program Files\USB TV
2012-01-26 10:11:50 ----HDC---- C:\WINDOWS\$NtUninstallKB2585542$
2012-01-24 20:51:18 ----D---- C:\Documents and Settings\SIMON\Data aplikací\OpenOffice.org
2012-01-24 20:41:49 ----D---- C:\Program Files\OpenOffice.org 3
2012-01-24 11:10:32 ----D---- C:\Program Files\BurnAware Free
2012-01-20 18:58:30 ----D---- C:\Documents and Settings\SIMON\Data aplikací\Ventrilo
2012-01-20 18:19:14 ----D---- C:\Documents and Settings\SIMON\Data aplikací\TS3Client
2012-01-20 18:17:47 ----D---- C:\Program Files\TeamSpeak 3 Client
2012-01-17 17:37:41 ----D---- C:\WINDOWS\Sun
2012-01-17 17:36:29 ----D---- C:\Documents and Settings\All Users\Data aplikací\Sun
2012-01-17 17:36:26 ----D---- C:\Program Files\Common Files\Java
2012-01-17 17:36:14 ----A---- C:\WINDOWS\system32\javaws.exe
2012-01-17 17:36:14 ----A---- C:\WINDOWS\system32\javaw.exe
2012-01-17 17:36:14 ----A---- C:\WINDOWS\system32\java.exe
2012-01-17 17:36:14 ----A---- C:\WINDOWS\system32\deployJava1.dll
2012-01-17 17:35:32 ----D---- C:\Program Files\Java
2012-01-17 17:34:21 ----D---- C:\Documents and Settings\SIMON\Data aplikací\Sun

======List of files/folders modified in the last 1 month======

2012-02-13 17:35:03 ----D---- C:\WINDOWS\Prefetch
2012-02-13 17:34:51 ----RD---- C:\Program Files
2012-02-13 16:15:18 ----D---- C:\Program Files\Steam
2012-02-13 16:14:47 ----D---- C:\WINDOWS\temp
2012-02-13 16:14:47 ----D---- C:\WINDOWS
2012-02-13 15:00:33 ----D---- C:\WINDOWS\system32\CatRoot2
2012-02-13 10:51:39 ----D---- C:\Documents and Settings\SIMON\Data aplikací\Skype
2012-02-12 22:19:23 ----N---- C:\WINDOWS\SchedLgU.Txt
2012-02-12 16:36:29 ----D---- C:\Documents and Settings\All Users\Data aplikací\Spybot - Search & Destroy
2012-02-12 14:58:40 ----SHD---- C:\WINDOWS\Installer
2012-02-12 14:58:39 ----D---- C:\Config.Msi
2012-02-12 14:58:38 ----D---- C:\WINDOWS\system32\drivers
2012-02-12 14:58:33 ----SD---- C:\WINDOWS\Tasks
2012-02-12 14:58:24 ----D---- C:\WINDOWS\system32
2012-02-11 18:15:44 ----SHD---- C:\System Volume Information
2012-02-11 18:11:40 ----RSHDC---- C:\WINDOWS\system32\dllcache
2012-02-11 12:34:53 ----D---- C:\Program Files\Common Files\Steam
2012-02-10 22:06:35 ----SD---- C:\Documents and Settings\SIMON\Data aplikací\Microsoft
2012-02-10 22:06:34 ----D---- C:\Program Files\Common Files
2012-02-10 22:06:22 ----HD---- C:\WINDOWS\inf
2012-02-10 22:06:22 ----DC---- C:\WINDOWS\system32\DRVSTORE
2012-02-10 22:06:16 ----HD---- C:\Program Files\InstallShield Installation Information
2012-02-10 21:37:44 ----D---- C:\Program Files\ATI Technologies
2012-02-10 21:37:18 ----RSD---- C:\WINDOWS\assembly
2012-02-10 21:37:17 ----D---- C:\WINDOWS\WinSxS
2012-02-09 14:49:05 ----A---- C:\Documents and Settings\SIMON\Data aplikací\burnaware.ini
2012-01-31 13:44:05 ----N---- C:\WINDOWS\system32\MpSigStub.exe
2012-01-25 19:18:47 ----HD---- C:\WINDOWS\$hf_mig$
2012-01-24 20:42:09 ----RSD---- C:\WINDOWS\Fonts
2012-01-15 10:46:40 ----D---- C:\WINDOWS\SoftwareDistribution
2012-01-15 10:46:38 ----D---- C:\WINDOWS\Debug

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 nvata;nvata; C:\WINDOWS\system32\DRIVERS\nvata.sys [2005-05-17 92800]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-10-25 12032]
R3 Afc;PPdus ASPI Shell; C:\WINDOWS\system32\drivers\Afc.sys [2005-02-23 11776]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2010-02-11 3565056]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 LVPr2Mon;Logitech LVPr2Mon Driver; C:\WINDOWS\system32\DRIVERS\LVPr2Mon.sys [2009-10-07 25752]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 nvax;Service for NVIDIA(R) nForce(TM) Audio Enumerator; C:\WINDOWS\system32\drivers\nvax.sys [2005-04-13 53376]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2005-04-06 33536]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2005-04-06 12928]
R3 nvnforce;Service for NVIDIA(R) nForce(TM) Audio; C:\WINDOWS\system32\drivers\nvapu.sys [2005-04-13 414464]
R3 PID_0928;Logitech QuickCam Express(PID_0928); C:\WINDOWS\system32\DRIVERS\LV561AV.SYS [2009-04-30 495768]
R3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2008-04-13 20992]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S1 MpKsl5527f533;MpKsl5527f533; \??\C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{D181CC92-FBB0-49AE-89D9-79E17D8A5F43}\MpKsl5527f533.sys []
S3 catchme;catchme; \??\C:\DOCUME~1\SIMON\LOCALS~1\Temp\catchme.sys []
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 cpuz134;cpuz134; \??\C:\DOCUME~1\SIMON\LOCALS~1\Temp\cpuz134\cpuz134_x32.sys []
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\WINDOWS\system32\DRIVERS\ewusbmdm.sys []
S3 hwusbdev;Huawei DataCard USB PNP Device; C:\WINDOWS\system32\DRIVERS\ewusbdev.sys []
S3 Memctl;Memctl; \??\C:\Program Files\U-ABIT\FlashMenu\Memctl.sys []
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 SANDRA;SANDRA; \??\C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2009.SP3c\WNt500x86\Sandra.sys []
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 speccy;speccy; \??\C:\DOCUME~1\SIMON\LOCALS~1\Temp\78124a59-000b-4379-8c53-be007ce75564 []
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2011-08-02 42496]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WINFLASH;WINFLASH; \??\C:\Program Files\U-ABIT\FlashMenu\WinFlash.sys []
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S3 ZD1211BU(ZyDAS);ZyDAS ZD1211B IEEE 802.11 b+g Wireless LAN Driver (USB)(ZyDAS); C:\WINDOWS\system32\DRIVERS\zd1211Bu.sys [2006-08-24 477696]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2011-10-24 55144]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2010-02-11 602112]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2011-08-30 390504]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2012-01-17 153376]
R2 LVPrcSrv;Process Monitor; C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe [2009-10-07 154136]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2011-12-08 821608]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2010-02-10 593920]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 SandraAgentSrv;SiSoftware Deployment Agent Service; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2009.SP3c\RpcAgentSrv.exe [2009-05-17 98488]
S3 Steam Client Service;Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe [2012-02-10 481064]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
S4 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]

-----------------EOF-----------------

Zdravím!
Především vás musím upozornit, že problematiku her neřešíme, od toho jsou jiná fóra. PC vám můžeme vyčistit, příp odvirovat. Poprosím o log ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware

Jasne, to chapu... jen jsem chtel blize popsat problem. Jsem tu jen kvuli kontrole logu.


EDIT: Omlouvam se ale pro dnesek musim mimo PC, pokud by to bylo mozne, byl bych rad, kdyby to slo doresit zitra. Jeste jednou se omlouvam ale bohuzel to jinak nejde.
Prozatim diky za vasi ochotu a pomoc.


Zde log z ComboFixu:



ComboFix 12-02-13.01 - SIMON . 02. 2012 18:43:11.2.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2046.1534 [GMT 1:00]
Spuštěný z: c:\documents and settings\SIMON\Plocha\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\GroupPolicy\Machine\Registry.pol
c:\windows\system32\SETBA.tmp
c:\windows\system32\SETBD.tmp
c:\windows\system32\SETC1.tmp
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-01-13 do 2012-02-13 )))))))))))))))))))))))))))))))
.
.
2012-02-13 16:34 . 2012-02-13 16:37 -------- d-----w- c:\program files\trend micro
2012-02-13 16:34 . 2012-02-13 16:35 -------- d-----w- C:\rsit
2012-02-12 13:58 . 2012-02-12 13:58 -------- d--h--w- c:\windows\system32\GroupPolicy
2012-02-10 21:06 . 2012-02-10 21:06 -------- d-----w- c:\program files\Common Files\ATI Technologies
2012-02-10 21:06 . 2012-02-10 21:06 -------- d-----w- c:\program files\DIFX
2012-02-10 21:06 . 2012-02-10 21:06 -------- d-----w- c:\program files\USB TV
2012-01-27 08:26 . 2012-01-27 08:26 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-01-24 19:51 . 2012-01-24 19:51 -------- d-----w- c:\documents and settings\SIMON\Data aplikací\OpenOffice.org
2012-01-24 19:41 . 2012-01-24 19:41 -------- d-----w- c:\program files\OpenOffice.org 3
2012-01-24 10:10 . 2012-01-24 10:10 -------- d-----w- c:\program files\BurnAware Free
2012-01-20 17:58 . 2012-02-08 11:45 -------- d-----w- c:\documents and settings\SIMON\Data aplikací\Ventrilo
2012-01-20 17:19 . 2012-02-12 12:50 -------- d-----w- c:\documents and settings\SIMON\Data aplikací\TS3Client
2012-01-20 17:17 . 2012-01-20 17:18 -------- d-----w- c:\program files\TeamSpeak 3 Client
2012-01-17 16:37 . 2012-01-17 16:37 -------- d-----w- c:\windows\Sun
2012-01-17 16:36 . 2012-01-17 16:36 -------- d-----w- c:\program files\Common Files\Java
2012-01-17 16:36 . 2012-01-17 16:35 73728 ----a-w- c:\windows\system32\javacpl.cpl
2012-01-17 16:36 . 2012-01-17 16:35 472808 ----a-w- c:\windows\system32\deployJava1.dll
2012-01-17 16:35 . 2012-01-17 16:35 -------- d-----w- c:\program files\Java
2012-01-17 16:20 . 2012-01-17 16:20 -------- d-----w- c:\documents and settings\SIMON\Local Settings\Data aplikací\Identities
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-31 12:44 . 2011-10-05 13:55 237072 ------w- c:\windows\system32\MpSigStub.exe
2011-11-25 21:57 . 2008-04-14 06:52 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-11-23 14:40 . 2008-04-14 05:45 1859584 ----a-w- c:\windows\system32\win32k.sys
2011-11-20 06:12 . 2008-04-14 06:52 60416 ----a-w- c:\windows\system32\packager.exe
2011-11-16 14:21 . 2008-04-14 06:52 354816 ----a-w- c:\windows\system32\winhttp.dll
2011-11-16 14:21 . 2008-04-14 06:51 152064 ----a-w- c:\windows\system32\schannel.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2012-01-10_15.57.36 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-05-13 19:17 . 2011-05-13 19:17 65536 c:\windows\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_452bf920\vcomp.dll
+ 2011-05-13 18:45 . 2011-05-13 18:45 49152 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789\mfc80KOR.dll
+ 2011-05-13 18:45 . 2011-05-13 18:45 49152 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789\mfc80JPN.dll
+ 2011-05-13 18:45 . 2011-05-13 18:45 61440 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789\mfc80ITA.dll
+ 2011-05-13 18:45 . 2011-05-13 18:45 45056 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789\mfc80CHT.dll
+ 2011-05-13 18:45 . 2011-05-13 18:45 40960 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789\mfc80CHS.dll
+ 2011-05-13 18:45 . 2011-05-13 18:45 61440 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789\mfc80FRA.dll
+ 2011-05-13 18:45 . 2011-05-13 18:45 61440 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789\mfc80ESP.dll
+ 2011-05-13 18:45 . 2011-05-13 18:45 57344 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789\mfc80ENU.dll
+ 2011-05-13 18:45 . 2011-05-13 18:45 65536 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789\mfc80DEU.dll
+ 2011-05-14 00:06 . 2011-05-14 00:06 57856 c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_150c9e8b\mfcm80u.dll
+ 2011-05-14 00:23 . 2011-05-14 00:23 69632 c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_150c9e8b\mfcm80.dll
+ 2011-05-13 17:37 . 2011-05-13 17:37 97280 c:\windows\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_a4c618fa\ATL80.dll
+ 2012-02-13 09:49 . 2012-02-13 09:49 16384 c:\windows\temp\Perflib_Perfdata_760.dat
+ 2012-02-10 20:36 . 2001-11-09 16:01 24064 c:\windows\system32\ReinstallBackups\0001\DriverFiles\ativcoxx.dll
+ 2012-02-10 20:36 . 2010-02-11 03:53 17408 c:\windows\system32\ReinstallBackups\0001\DriverFiles\atitvo32.dll
+ 2012-02-10 20:36 . 2010-02-11 04:32 53248 c:\windows\system32\ReinstallBackups\0001\DriverFiles\ATIDDC.DLL
+ 2012-02-10 20:36 . 2010-02-11 04:23 45056 c:\windows\system32\ReinstallBackups\0001\DriverFiles\aticalrt.dll
+ 2012-02-10 20:36 . 2010-02-11 04:22 45056 c:\windows\system32\ReinstallBackups\0001\DriverFiles\aticalcl.dll
+ 2012-02-10 20:36 . 2010-02-11 04:35 26112 c:\windows\system32\ReinstallBackups\0001\DriverFiles\Ati2mdxx.exe
+ 2012-02-10 20:36 . 2010-02-11 04:19 53248 c:\windows\system32\ReinstallBackups\0001\DriverFiles\ati2erec.dll
+ 2012-02-10 20:36 . 2009-04-28 04:31 43520 c:\windows\system32\ReinstallBackups\0001\DriverFiles\ati2edxx.dll
+ 2012-02-10 20:36 . 2010-02-11 03:59 49664 c:\windows\system32\ReinstallBackups\0001\DriverFiles\amdpcom32.dll
+ 2012-02-10 20:30 . 2001-11-09 15:01 24064 c:\windows\system32\ReinstallBackups\0000\DriverFiles\ativcoxx.dll
+ 2012-02-10 20:30 . 2009-04-28 03:49 17408 c:\windows\system32\ReinstallBackups\0000\DriverFiles\atitvo32.dll
+ 2012-02-10 20:30 . 2009-04-28 04:28 53248 c:\windows\system32\ReinstallBackups\0000\DriverFiles\ATIDDC.DLL
+ 2012-02-10 20:30 . 2009-04-28 01:58 45056 c:\windows\system32\ReinstallBackups\0000\DriverFiles\aticalrt.dll
+ 2012-02-10 20:30 . 2009-04-28 01:58 45056 c:\windows\system32\ReinstallBackups\0000\DriverFiles\aticalcl.dll
+ 2012-02-10 20:30 . 2009-04-28 04:31 26112 c:\windows\system32\ReinstallBackups\0000\DriverFiles\Ati2mdxx.exe
+ 2012-02-10 20:30 . 2009-04-28 03:49 53248 c:\windows\system32\ReinstallBackups\0000\DriverFiles\ati2erec.dll
+ 2012-02-10 20:30 . 2009-04-28 04:31 43520 c:\windows\system32\ReinstallBackups\0000\DriverFiles\ati2edxx.dll
+ 2012-02-10 20:30 . 2009-04-28 03:55 49664 c:\windows\system32\ReinstallBackups\0000\DriverFiles\amdpcom32.dll
- 2001-10-25 12:00 . 2011-11-05 15:50 68622 c:\windows\system32\perfc009.dat
+ 2001-10-25 12:00 . 2012-01-11 22:08 68622 c:\windows\system32\perfc009.dat
- 2001-10-25 12:00 . 2011-11-05 15:50 79528 c:\windows\system32\perfc005.dat
+ 2001-10-25 12:00 . 2012-01-11 22:08 79528 c:\windows\system32\perfc005.dat
- 2008-04-14 06:51 . 2008-04-14 06:51 23040 c:\windows\system32\mciseq.dll
+ 2008-04-14 06:51 . 2011-10-14 14:47 23040 c:\windows\system32\mciseq.dll
+ 2012-02-10 21:06 . 2007-08-31 13:14 38656 c:\windows\system32\DRVSTORE\embda_754491038463AF55DC013DBF40581C2B1BFEE429\emOEM.sys
+ 2012-02-10 21:06 . 2006-12-15 15:54 61440 c:\windows\system32\DRVSTORE\embda_754491038463AF55DC013DBF40581C2B1BFEE429\emMON.exe
+ 2012-02-10 21:06 . 2007-08-31 13:15 24448 c:\windows\system32\DRVSTORE\emaudio_754491038463AF55DC013DBF40581C2B1BFEE429\emAudio.sys
+ 2009-04-28 03:49 . 2010-02-11 04:19 53248 c:\windows\system32\drivers\ati2erec.dll
- 2009-04-28 03:49 . 2009-04-28 03:49 53248 c:\windows\system32\drivers\ati2erec.dll
+ 2008-04-14 06:52 . 2011-11-20 06:12 60416 c:\windows\system32\dllcache\packager.exe
+ 2008-04-14 06:51 . 2011-10-14 14:47 23040 c:\windows\system32\dllcache\mciseq.dll
- 2008-04-14 06:51 . 2008-04-14 06:51 23040 c:\windows\system32\dllcache\mciseq.dll
- 2001-11-09 15:01 . 2001-11-09 15:01 24064 c:\windows\system32\ativcoxx.dll
+ 2001-11-09 15:01 . 2001-11-09 16:01 24064 c:\windows\system32\ativcoxx.dll
- 2009-04-28 03:49 . 2009-04-28 03:49 17408 c:\windows\system32\atitvo32.dll
+ 2009-04-28 03:49 . 2010-02-11 03:53 17408 c:\windows\system32\atitvo32.dll
- 2009-04-28 04:28 . 2009-04-28 04:28 53248 c:\windows\system32\ATIDDC.DLL
+ 2009-04-28 04:28 . 2010-02-11 04:32 53248 c:\windows\system32\ATIDDC.DLL
- 2009-04-28 01:58 . 2009-04-28 01:58 45056 c:\windows\system32\aticalrt.dll
+ 2009-04-28 01:58 . 2010-02-11 04:23 45056 c:\windows\system32\aticalrt.dll
- 2009-04-28 01:58 . 2009-04-28 01:58 45056 c:\windows\system32\aticalcl.dll
+ 2009-04-28 01:58 . 2010-02-11 04:22 45056 c:\windows\system32\aticalcl.dll
- 2009-04-28 04:31 . 2009-04-28 04:31 26112 c:\windows\system32\Ati2mdxx.exe
+ 2009-04-28 04:31 . 2010-02-11 04:35 26112 c:\windows\system32\Ati2mdxx.exe
+ 2009-04-28 04:31 . 2010-02-11 04:35 43520 c:\windows\system32\ati2edxx.dll
- 2009-04-28 04:31 . 2009-04-28 04:31 43520 c:\windows\system32\ati2edxx.dll
+ 2009-04-28 03:55 . 2010-02-11 03:59 49664 c:\windows\system32\amdpcom32.dll
- 2009-04-28 03:55 . 2009-04-28 03:55 49664 c:\windows\system32\amdpcom32.dll
+ 2011-12-25 02:49 . 2011-12-25 02:49 31504 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe
+ 2012-01-12 10:06 . 2012-01-12 10:06 36864 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\750de53f30e516eb2c62de9bab7954e9\System.Web.DynamicData.Design.ni.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 77824 c:\windows\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
- 2011-10-15 08:53 . 2011-10-15 08:53 77824 c:\windows\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
- 2011-10-15 08:53 . 2011-10-15 08:53 81920 c:\windows\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 81920 c:\windows\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 81920 c:\windows\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
- 2011-10-15 08:54 . 2011-10-15 08:54 81920 c:\windows\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
- 2011-10-15 08:53 . 2011-10-15 08:53 32768 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 32768 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
- 2011-10-15 08:53 . 2011-10-15 08:53 12800 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 12800 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 28672 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
- 2011-10-15 08:53 . 2011-10-15 08:53 28672 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
- 2011-10-15 08:54 . 2011-10-15 08:54 77824 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 77824 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 36864 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
- 2011-10-15 08:54 . 2011-10-15 08:54 36864 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
- 2011-10-15 08:53 . 2011-10-15 08:53 77824 c:\windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 77824 c:\windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
- 2011-10-15 08:53 . 2011-10-15 08:53 13312 c:\windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 13312 c:\windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
+ 2012-01-24 19:41 . 2012-01-24 19:41 11264 c:\windows\assembly\GAC_MSIL\cli_basetypes\1.0.15.0__ce2cb7e279207b9e\cli_basetypes.dll
- 2011-10-15 08:53 . 2011-10-15 08:53 10752 c:\windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 10752 c:\windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 72192 c:\windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
- 2011-10-15 08:53 . 2011-10-15 08:53 72192 c:\windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 69120 c:\windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
- 2011-10-15 08:53 . 2011-10-15 08:53 69120 c:\windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
+ 2012-01-24 19:42 . 2012-01-24 19:42 63488 c:\windows\assembly\GAC_32\cli_cppuhelper\1.0.18.0__ce2cb7e279207b9e\cli_cppuhelper.dll
+ 2012-01-11 22:09 . 2008-04-14 06:51 23040 c:\windows\$NtUninstallKB2598479$\mciseq.dll
+ 2012-01-11 22:06 . 2008-04-14 06:52 58368 c:\windows\$NtUninstallKB2584146$\packager.exe
+ 2012-01-11 22:11 . 2010-07-05 13:13 26488 c:\windows\$hf_mig$\KB2646524\update\spcustom.dll
+ 2012-01-11 22:11 . 2010-07-05 13:13 18296 c:\windows\$hf_mig$\KB2646524\spmsg.dll
+ 2012-01-11 22:11 . 2010-07-05 13:13 26488 c:\windows\$hf_mig$\KB2631813\update\spcustom.dll
+ 2012-01-11 22:11 . 2010-07-05 13:13 18296 c:\windows\$hf_mig$\KB2631813\spmsg.dll
+ 2012-01-11 22:06 . 2010-07-05 13:13 26488 c:\windows\$hf_mig$\KB2603381\update\spcustom.dll
+ 2012-01-11 22:06 . 2010-07-05 13:13 18296 c:\windows\$hf_mig$\KB2603381\spmsg.dll
+ 2012-01-11 22:09 . 2010-07-05 13:13 26488 c:\windows\$hf_mig$\KB2598479\update\spcustom.dll
+ 2012-01-11 22:09 . 2010-07-05 13:13 18296 c:\windows\$hf_mig$\KB2598479\spmsg.dll
+ 2011-10-14 14:45 . 2011-10-14 14:45 23040 c:\windows\$hf_mig$\KB2598479\SP3QFE\mciseq.dll
+ 2012-01-11 22:06 . 2010-07-05 13:13 26488 c:\windows\$hf_mig$\KB2584146\update\spcustom.dll
+ 2012-01-11 22:06 . 2010-07-05 13:13 18296 c:\windows\$hf_mig$\KB2584146\spmsg.dll
+ 2011-11-20 06:11 . 2011-11-20 06:11 60416 c:\windows\$hf_mig$\KB2584146\SP3QFE\packager.exe
+ 2012-01-11 22:08 . 2012-01-11 22:08 8192 c:\windows\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
- 2011-10-15 08:53 . 2011-10-15 08:53 8192 c:\windows\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
+ 2012-01-24 19:41 . 2012-01-24 19:41 3072 c:\windows\assembly\GAC_MSIL\policy.1.0.cli_uretypes\4.0.0.0__ce2cb7e279207b9e\policy.1.0.cli_uretypes.dll
+ 2012-01-24 19:41 . 2012-01-24 19:41 3072 c:\windows\assembly\GAC_MSIL\policy.1.0.cli_ure\18.0.0.0__ce2cb7e279207b9e\policy.1.0.cli_ure.dll
+ 2012-01-24 19:42 . 2012-01-24 19:42 3072 c:\windows\assembly\GAC_MSIL\policy.1.0.cli_oootypes\4.0.0.0__ce2cb7e279207b9e\policy.1.0.cli_oootypes.dll
+ 2012-01-24 19:41 . 2012-01-24 19:41 3072 c:\windows\assembly\GAC_MSIL\policy.1.0.cli_basetypes\15.0.0.0__ce2cb7e279207b9e\policy.1.0.cli_basetypes.dll
- 2011-10-15 08:53 . 2011-10-15 08:53 7168 c:\windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 7168 c:\windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 5632 c:\windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
- 2011-10-15 08:54 . 2011-10-15 08:54 5632 c:\windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 6656 c:\windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
- 2011-10-15 08:53 . 2011-10-15 08:53 6656 c:\windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
- 2011-10-15 08:53 . 2011-10-15 08:53 8192 c:\windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 8192 c:\windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
+ 2012-01-24 19:41 . 2012-01-24 19:41 7680 c:\windows\assembly\GAC_MSIL\cli_ure\1.0.18.0__ce2cb7e279207b9e\cli_ure.dll
+ 2012-01-24 19:42 . 2012-01-24 19:42 3072 c:\windows\assembly\GAC_32\policy.1.0.cli_cppuhelper\18.0.0.0__ce2cb7e279207b9e\policy.1.0.cli_cppuhelper.dll
+ 2012-01-11 19:29 . 2011-11-03 18:17 4608 c:\windows\$hf_mig$\KB2603381\update\customaddreg.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 113664 c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
- 2011-10-15 08:53 . 2011-10-15 08:53 113664 c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 258048 c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
- 2011-10-15 08:53 . 2011-10-15 08:53 258048 c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
+ 2009-07-12 00:12 . 2009-07-12 00:12 632656 c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll
+ 2009-07-12 00:09 . 2009-07-12 00:09 554832 c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcp80.dll
+ 2009-07-12 00:08 . 2009-07-12 00:08 479232 c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcm80.dll
+ 2008-04-14 06:52 . 2011-10-14 14:47 174592 c:\windows\system32\winmm.dll
- 2008-04-14 06:52 . 2008-04-14 06:52 174592 c:\windows\system32\winmm.dll
+ 2008-04-14 06:51 . 2011-11-16 14:21 152064 c:\windows\system32\schannel.dll
+ 2012-02-10 20:36 . 2010-02-11 04:35 155648 c:\windows\system32\ReinstallBackups\0001\DriverFiles\Oemdspif.dll
+ 2012-02-10 20:36 . 2010-02-11 04:12 887724 c:\windows\system32\ReinstallBackups\0001\DriverFiles\ativva6x.dat
+ 2012-02-10 20:36 . 2009-04-28 04:32 204800 c:\windows\system32\ReinstallBackups\0001\DriverFiles\atipdlxx.dll
+ 2012-02-10 20:36 . 2009-04-28 04:32 290816 c:\windows\system32\ReinstallBackups\0001\DriverFiles\atiok3x2.dll
+ 2012-02-10 20:36 . 2009-04-28 03:51 475136 c:\windows\system32\ReinstallBackups\0001\DriverFiles\atikvmag.dll
+ 2012-02-10 20:36 . 2010-02-11 05:07 307200 c:\windows\system32\ReinstallBackups\0001\DriverFiles\atiiiexx.dll
+ 2012-02-10 20:36 . 2009-04-23 22:29 189051 c:\windows\system32\ReinstallBackups\0001\DriverFiles\atiicdxx.dat
+ 2012-02-10 20:36 . 2009-04-28 04:41 442368 c:\windows\system32\ReinstallBackups\0001\DriverFiles\ATIDEMGX.dll
+ 2012-02-10 20:36 . 2008-10-21 18:51 118784 c:\windows\system32\ReinstallBackups\0001\DriverFiles\atibrtmon.exe
+ 2012-02-10 20:36 . 2009-04-28 03:50 126976 c:\windows\system32\ReinstallBackups\0001\DriverFiles\atiadlxx.dll
+ 2012-02-10 20:36 . 2009-04-28 04:30 602112 c:\windows\system32\ReinstallBackups\0001\DriverFiles\ati2evxx.exe
+ 2012-02-10 20:36 . 2009-04-28 04:31 155648 c:\windows\system32\ReinstallBackups\0001\DriverFiles\ati2evxx.dll
+ 2012-02-10 20:36 . 2009-04-28 04:40 325120 c:\windows\system32\ReinstallBackups\0001\DriverFiles\ati2dvag.dll
+ 2012-02-10 20:36 . 2009-04-28 03:44 626688 c:\windows\system32\ReinstallBackups\0001\DriverFiles\ati2cqag.dll
+ 2012-02-10 20:30 . 2009-04-28 04:31 155648 c:\windows\system32\ReinstallBackups\0000\DriverFiles\Oemdspif.dll
+ 2012-02-10 20:30 . 2009-04-28 04:08 887724 c:\windows\system32\ReinstallBackups\0000\DriverFiles\ativva6x.dat
+ 2012-02-10 20:30 . 2009-04-28 04:32 204800 c:\windows\system32\ReinstallBackups\0000\DriverFiles\atipdlxx.dll
+ 2012-02-10 20:30 . 2009-04-28 04:32 290816 c:\windows\system32\ReinstallBackups\0000\DriverFiles\atiok3x2.dll
+ 2012-02-10 20:30 . 2009-04-28 03:51 475136 c:\windows\system32\ReinstallBackups\0000\DriverFiles\atikvmag.dll
+ 2012-02-10 20:30 . 2009-04-28 03:58 307200 c:\windows\system32\ReinstallBackups\0000\DriverFiles\atiiiexx.dll
+ 2012-02-10 20:30 . 2009-04-23 21:29 189051 c:\windows\system32\ReinstallBackups\0000\DriverFiles\atiicdxx.dat
+ 2012-02-10 20:30 . 2009-04-28 04:41 442368 c:\windows\system32\ReinstallBackups\0000\DriverFiles\ATIDEMGX.dll
+ 2012-02-10 20:30 . 2008-10-21 17:51 118784 c:\windows\system32\ReinstallBackups\0000\DriverFiles\atibrtmon.exe
+ 2012-02-10 20:30 . 2009-04-28 03:50 126976 c:\windows\system32\ReinstallBackups\0000\DriverFiles\atiadlxx.dll
+ 2012-02-10 20:30 . 2009-04-28 04:30 602112 c:\windows\system32\ReinstallBackups\0000\DriverFiles\ati2evxx.exe
+ 2012-02-10 20:30 . 2009-04-28 04:31 155648 c:\windows\system32\ReinstallBackups\0000\DriverFiles\ati2evxx.dll
+ 2012-02-10 20:30 . 2009-04-28 04:40 325120 c:\windows\system32\ReinstallBackups\0000\DriverFiles\ati2dvag.dll
+ 2012-02-10 20:30 . 2009-04-28 03:44 626688 c:\windows\system32\ReinstallBackups\0000\DriverFiles\ati2cqag.dll
+ 2008-04-14 06:51 . 2011-11-03 15:29 386560 c:\windows\system32\qdvd.dll
- 2008-04-14 06:51 . 2008-04-14 06:51 386560 c:\windows\system32\qdvd.dll
- 2001-10-25 12:00 . 2011-11-05 15:50 435726 c:\windows\system32\perfh009.dat
+ 2001-10-25 12:00 . 2012-01-11 22:08 435726 c:\windows\system32\perfh009.dat
+ 2001-10-25 12:00 . 2012-01-11 22:08 432470 c:\windows\system32\perfh005.dat
- 2001-10-25 12:00 . 2011-11-05 15:50 432470 c:\windows\system32\perfh005.dat
+ 2009-04-28 04:31 . 2010-02-11 04:35 155648 c:\windows\system32\Oemdspif.dll
- 2009-04-28 04:31 . 2009-04-28 04:31 155648 c:\windows\system32\Oemdspif.dll
+ 2012-01-27 08:26 . 2012-01-27 08:26 247968 c:\windows\system32\Macromed\Flash\FlashUtil11e_Plugin.exe
+ 2012-01-17 16:36 . 2012-01-17 16:35 157472 c:\windows\system32\javaws.exe
+ 2012-01-17 16:36 . 2012-01-17 16:35 149280 c:\windows\system32\javaw.exe
+ 2012-01-17 16:36 . 2012-01-17 16:35 149280 c:\windows\system32\java.exe
+ 2009-07-11 15:38 . 2012-01-25 10:23 237552 c:\windows\system32\FNTCACHE.DAT
+ 2012-02-10 21:06 . 2007-08-31 16:33 479744 c:\windows\system32\DRVSTORE\embda_754491038463AF55DC013DBF40581C2B1BFEE429\emBDA.sys
+ 2008-04-14 06:52 . 2011-11-25 21:57 293376 c:\windows\system32\dllcache\winsrv.dll
- 2008-04-14 06:52 . 2011-06-20 17:44 293376 c:\windows\system32\dllcache\winsrv.dll
+ 2008-04-14 06:52 . 2011-10-14 14:47 174592 c:\windows\system32\dllcache\winmm.dll
- 2008-04-14 06:52 . 2008-04-14 06:52 174592 c:\windows\system32\dllcache\winmm.dll
- 2008-04-14 06:52 . 2009-08-25 09:19 354816 c:\windows\system32\dllcache\winhttp.dll
+ 2008-04-14 06:52 . 2011-11-16 14:21 354816 c:\windows\system32\dllcache\winhttp.dll
+ 2008-04-14 06:51 . 2011-11-16 14:21 152064 c:\windows\system32\dllcache\schannel.dll
+ 2008-04-14 06:51 . 2011-11-03 15:29 386560 c:\windows\system32\dllcache\qdvd.dll
- 2008-04-14 06:51 . 2008-04-14 06:51 386560 c:\windows\system32\dllcache\qdvd.dll
+ 2009-04-28 04:08 . 2010-02-11 04:12 887724 c:\windows\system32\ativva6x.dat
- 2009-04-28 04:08 . 2009-04-28 04:08 887724 c:\windows\system32\ativva6x.dat
- 2009-04-28 04:32 . 2009-04-28 04:32 204800 c:\windows\system32\atipdlxx.dll
+ 2009-04-28 04:32 . 2010-02-11 04:36 204800 c:\windows\system32\atipdlxx.dll
+ 2009-04-28 04:32 . 2010-02-11 04:37 290816 c:\windows\system32\atiok3x2.dll
- 2009-04-28 04:32 . 2009-04-28 04:32 290816 c:\windows\system32\atiok3x2.dll
+ 2009-04-28 03:51 . 2010-02-11 03:55 475136 c:\windows\system32\atikvmag.dll
- 2009-04-28 03:51 . 2009-04-28 03:51 475136 c:\windows\system32\atikvmag.dll
+ 2009-04-28 03:58 . 2010-02-11 05:07 307200 c:\windows\system32\atiiiexx.dll
- 2009-04-28 03:58 . 2009-04-28 03:58 307200 c:\windows\system32\atiiiexx.dll
- 2009-04-23 21:29 . 2009-04-23 21:29 189051 c:\windows\system32\atiicdxx.dat
+ 2009-04-23 21:29 . 2009-04-23 22:29 189051 c:\windows\system32\atiicdxx.dat
+ 2009-04-28 04:41 . 2010-02-11 04:46 442368 c:\windows\system32\ATIDEMGX.dll
- 2009-04-28 04:41 . 2009-04-28 04:41 442368 c:\windows\system32\ATIDEMGX.dll
- 2008-10-21 17:51 . 2008-10-21 17:51 118784 c:\windows\system32\atibrtmon.exe
+ 2008-10-21 17:51 . 2008-10-21 18:51 118784 c:\windows\system32\atibrtmon.exe
- 2009-04-28 03:50 . 2009-04-28 03:50 126976 c:\windows\system32\atiadlxx.dll
+ 2009-04-28 03:50 . 2010-02-11 03:54 126976 c:\windows\system32\atiadlxx.dll
+ 2009-07-11 14:16 . 2010-02-10 20:20 593920 c:\windows\system32\ati2sgag.exe
- 2009-07-11 14:16 . 2009-04-27 19:20 593920 c:\windows\system32\ati2sgag.exe
+ 2009-04-28 04:30 . 2010-02-11 04:33 602112 c:\windows\system32\ati2evxx.exe
- 2009-04-28 04:30 . 2009-04-28 04:30 602112 c:\windows\system32\ati2evxx.exe
- 2009-04-28 04:31 . 2009-04-28 04:31 155648 c:\windows\system32\ati2evxx.dll
+ 2009-04-28 04:31 . 2010-02-11 04:35 155648 c:\windows\system32\ati2evxx.dll
- 2009-04-28 04:40 . 2009-04-28 04:40 325120 c:\windows\system32\ati2dvag.dll
+ 2009-04-28 04:40 . 2010-02-11 04:45 325120 c:\windows\system32\ati2dvag.dll
- 2009-04-28 03:44 . 2009-04-28 03:44 626688 c:\windows\system32\ati2cqag.dll
+ 2009-04-28 03:44 . 2010-02-11 03:47 626688 c:\windows\system32\ati2cqag.dll
+ 2011-12-25 02:49 . 2011-12-25 02:49 436496 c:\windows\Microsoft.NET\Framework\v2.0.50727\webengine.dll
+ 2012-02-05 22:14 . 2012-02-05 22:14 467456 c:\windows\Installer\230e3bf.msi
+ 2012-01-17 16:36 . 2012-01-17 16:36 203776 c:\windows\Installer\182fe79.msi
+ 2012-01-17 16:35 . 2012-01-17 16:35 901120 c:\windows\Installer\182fe73.msi
+ 2011-12-25 04:40 . 2011-12-25 04:40 819200 c:\windows\Installer\17e5071.msp
+ 2012-02-10 21:06 . 2012-02-10 21:06 774144 c:\windows\Installer\1550af.msi
+ 2012-01-12 10:06 . 2012-01-12 10:06 129536 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Routing\0bda7bdfaf440d5dd4bc6a1dea7ffa39\System.Web.Routing.ni.dll
+ 2012-01-12 10:06 . 2012-01-12 10:06 859648 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\6e29f9faa74a48b83a13a3413b826295\System.Web.Extensions.Design.ni.dll
+ 2012-01-12 10:06 . 2012-01-12 10:06 328704 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity\be8965fe859bc53dff61579bf626858b\System.Web.Entity.ni.dll
+ 2012-01-12 10:06 . 2012-01-12 10:06 301056 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity.D#\8441b3eb247e0344fede848337ee911c\System.Web.Entity.Design.ni.dll
+ 2012-01-12 10:06 . 2012-01-12 10:06 547328 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\09c6a41f187ba483486cdb92dad714a1\System.Web.DynamicData.ni.dll
+ 2012-01-12 10:06 . 2012-01-12 10:06 141312 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Abstract#\5efb726d424b9712632eff749411fa89\System.Web.Abstractions.ni.dll
+ 2012-01-12 10:06 . 2012-01-12 10:06 756736 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Entity.#\f374e8e7849a72d1470b4a6a0771a137\System.Data.Entity.Design.ni.dll
+ 2012-01-12 10:06 . 2012-01-12 10:06 320512 c:\windows\assembly\NativeImages_v2.0.50727_32\ServiceModelReg\439732479756e0f6df88d29e50a402bf\ServiceModelReg.ni.exe
+ 2012-01-12 10:05 . 2012-01-12 10:05 842240 c:\windows\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\bfcea15c95909860c4f4ac19bd7a2d6c\AspNetMMCExt.ni.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 839680 c:\windows\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
- 2011-10-15 08:53 . 2011-10-15 08:53 839680 c:\windows\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 835584 c:\windows\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
- 2011-10-15 08:53 . 2011-10-15 08:53 835584 c:\windows\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 114688 c:\windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
- 2011-10-15 08:53 . 2011-10-15 08:53 114688 c:\windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 258048 c:\windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
- 2011-10-15 08:53 . 2011-10-15 08:53 258048 c:\windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 131072 c:\windows\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
- 2011-10-15 08:53 . 2011-10-15 08:53 131072 c:\windows\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 303104 c:\windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
- 2011-10-15 08:54 . 2011-10-15 08:54 303104 c:\windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
- 2011-10-15 08:54 . 2011-10-15 08:54 258048 c:\windows\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 258048 c:\windows\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
- 2011-10-15 08:54 . 2011-10-15 08:54 372736 c:\windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 372736 c:\windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
- 2011-10-15 08:54 . 2011-10-15 08:54 626688 c:\windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 626688 c:\windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 401408 c:\windows\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
- 2011-10-15 08:53 . 2011-10-15 08:53 401408 c:\windows\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 188416 c:\windows\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
- 2011-10-15 08:53 . 2011-10-15 08:53 188416 c:\windows\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
- 2011-10-15 08:54 . 2011-10-15 08:54 970752 c:\windows\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 970752 c:\windows\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
- 2011-10-15 08:54 . 2011-10-15 08:54 745472 c:\windows\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 745472 c:\windows\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
- 2011-10-15 08:54 . 2011-10-15 08:54 425984 c:\windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 425984 c:\windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 110592 c:\windows\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
- 2011-10-15 08:54 . 2011-10-15 08:54 110592 c:\windows\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
- 2011-10-15 08:53 . 2011-10-15 08:53 659456 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 659456 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 372736 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
- 2011-10-15 08:53 . 2011-10-15 08:53 372736 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 110592 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
- 2011-10-15 08:53 . 2011-10-15 08:53 110592 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
- 2011-10-15 08:53 . 2011-10-15 08:53 749568 c:\windows\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 749568 c:\windows\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
- 2011-10-15 08:54 . 2011-10-15 08:54 655360 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 655360 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
- 2011-10-15 08:53 . 2011-10-15 08:53 348160 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 348160 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
+ 2012-01-24 19:41 . 2012-01-24 19:41 118784 c:\windows\assembly\GAC_MSIL\cli_uretypes\1.0.4.0__ce2cb7e279207b9e\cli_uretypes.dll
+ 2012-01-24 19:42 . 2012-01-24 19:42 856064 c:\windows\assembly\GAC_MSIL\cli_oootypes\1.0.4.0__ce2cb7e279207b9e\cli_oootypes.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 507904 c:\windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
- 2011-10-15 08:53 . 2011-10-15 08:53 507904 c:\windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 261632 c:\windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
- 2011-10-15 08:53 . 2011-10-15 08:53 261632 c:\windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
- 2011-10-15 08:53 . 2011-10-15 08:53 113664 c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 113664 c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 258048 c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
- 2011-10-15 08:53 . 2011-10-15 08:53 258048 c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
- 2011-10-15 08:54 . 2011-10-15 08:54 486400 c:\windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 486400 c:\windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
+ 2012-01-11 22:11 . 2011-06-20 17:44 293376 c:\windows\$NtUninstallKB2646524$\winsrv.dll
+ 2012-01-11 22:11 . 2010-07-05 13:13 391032 c:\windows\$NtUninstallKB2646524$\spuninst\updspapi.dll
+ 2012-01-11 22:11 . 2010-07-05 13:13 233848 c:\windows\$NtUninstallKB2646524$\spuninst\spuninst.exe
+ 2012-01-11 22:11 . 2010-07-05 13:13 391032 c:\windows\$NtUninstallKB2631813$\spuninst\updspapi.dll
+ 2012-01-11 22:11 . 2010-07-05 13:13 233848 c:\windows\$NtUninstallKB2631813$\spuninst\spuninst.exe
+ 2012-01-11 22:11 . 2008-04-14 06:51 386560 c:\windows\$NtUninstallKB2631813$\qdvd.dll
+ 2012-01-11 22:06 . 2010-07-05 13:13 391032 c:\windows\$NtUninstallKB2603381$\spuninst\updspapi.dll
+ 2012-01-11 22:06 . 2010-07-05 13:13 233848 c:\windows\$NtUninstallKB2603381$\spuninst\spuninst.exe
+ 2012-01-11 22:09 . 2008-04-14 06:52 174592 c:\windows\$NtUninstallKB2598479$\winmm.dll
+ 2012-01-11 22:09 . 2010-07-05 13:13 391032 c:\windows\$NtUninstallKB2598479$\spuninst\updspapi.dll
+ 2012-01-11 22:09 . 2010-07-05 13:13 233848 c:\windows\$NtUninstallKB2598479$\spuninst\spuninst.exe
+ 2012-01-11 22:06 . 2010-07-05 13:13 391032 c:\windows\$NtUninstallKB2584146$\spuninst\updspapi.dll
+ 2012-01-11 22:06 . 2010-07-05 13:13 233848 c:\windows\$NtUninstallKB2584146$\spuninst\spuninst.exe
+ 2012-01-11 22:11 . 2010-07-05 13:13 391032 c:\windows\$hf_mig$\KB2646524\update\updspapi.dll
+ 2012-01-11 22:11 . 2010-07-05 13:13 759160 c:\windows\$hf_mig$\KB2646524\update\update.exe
+ 2012-01-11 22:11 . 2010-07-05 13:13 233848 c:\windows\$hf_mig$\KB2646524\spuninst.exe
+ 2011-11-25 21:56 . 2011-11-25 21:56 293376 c:\windows\$hf_mig$\KB2646524\SP3QFE\winsrv.dll
+ 2012-01-11 22:11 . 2010-07-05 13:13 391032 c:\windows\$hf_mig$\KB2631813\update\updspapi.dll
+ 2012-01-11 22:11 . 2010-07-05 13:13 759160 c:\windows\$hf_mig$\KB2631813\update\update.exe
+ 2012-01-11 22:11 . 2010-07-05 13:13 233848 c:\windows\$hf_mig$\KB2631813\spuninst.exe
+ 2011-11-03 15:27 . 2011-11-03 15:27 386560 c:\windows\$hf_mig$\KB2631813\SP3QFE\qdvd.dll
+ 2012-01-11 22:06 . 2010-07-05 13:13 391032 c:\windows\$hf_mig$\KB2603381\update\updspapi.dll
+ 2012-01-11 22:06 . 2010-07-05 13:13 759160 c:\windows\$hf_mig$\KB2603381\update\update.exe
+ 2012-01-11 22:06 . 2010-07-05 13:13 233848 c:\windows\$hf_mig$\KB2603381\spuninst.exe
+ 2012-01-11 22:09 . 2010-07-05 13:13 391032 c:\windows\$hf_mig$\KB2598479\update\updspapi.dll
+ 2012-01-11 22:09 . 2010-07-05 13:13 759160 c:\windows\$hf_mig$\KB2598479\update\update.exe
+ 2012-01-11 22:09 . 2010-07-05 13:13 233848 c:\windows\$hf_mig$\KB2598479\spuninst.exe
+ 2011-10-14 14:45 . 2011-10-14 14:45 174592 c:\windows\$hf_mig$\KB2598479\SP3QFE\winmm.dll
+ 2012-01-11 22:06 . 2010-07-05 13:13 391032 c:\windows\$hf_mig$\KB2584146\update\updspapi.dll
+ 2012-01-11 22:06 . 2010-07-05 13:13 759160 c:\windows\$hf_mig$\KB2584146\update\update.exe
+ 2012-01-11 22:06 . 2010-07-05 13:13 233848 c:\windows\$hf_mig$\KB2584146\spuninst.exe
+ 2011-05-13 19:04 . 2011-05-13 19:04 1093120 c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_150c9e8b\mfc80u.dll
+ 2011-05-13 19:04 . 2011-05-13 19:04 1101824 c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_150c9e8b\mfc80.dll
+ 2012-02-10 20:36 . 2009-04-28 04:08 2670720 c:\windows\system32\ReinstallBackups\0001\DriverFiles\ativvaxx.dll
+ 2012-02-10 20:36 . 2010-02-11 04:12 3107788 c:\windows\system32\ReinstallBackups\0001\DriverFiles\ativva5x.dat
+ 2012-02-10 20:36 . 2010-02-11 04:21 3227648 c:\windows\system32\ReinstallBackups\0001\DriverFiles\aticaldd.dll
+ 2012-02-10 20:36 . 2009-04-28 04:21 3818272 c:\windows\system32\ReinstallBackups\0001\DriverFiles\ati3duag.dll
+ 2012-02-10 20:36 . 2010-02-11 07:38 3565056 c:\windows\system32\ReinstallBackups\0001\DriverFiles\ati2mtag.sys
+ 2012-02-10 20:30 . 2009-04-28 04:08 2670720 c:\windows\system32\ReinstallBackups\0000\DriverFiles\ativvaxx.dll
+ 2012-02-10 20:30 . 2009-04-28 04:08 3107788 c:\windows\system32\ReinstallBackups\0000\DriverFiles\ativva5x.dat
+ 2012-02-10 20:30 . 2009-04-28 01:56 3227648 c:\windows\system32\ReinstallBackups\0000\DriverFiles\aticaldd.dll
+ 2012-02-10 20:30 . 2009-04-28 04:21 3818272 c:\windows\system32\ReinstallBackups\0000\DriverFiles\ati3duag.dll
+ 2012-02-10 20:30 . 2009-04-28 06:13 3565568 c:\windows\system32\ReinstallBackups\0000\DriverFiles\ati2mtag.sys
+ 2008-04-14 06:51 . 2011-11-03 15:29 1294848 c:\windows\system32\quartz.dll
+ 2009-02-03 02:15 . 2012-01-27 08:26 8527008 c:\windows\system32\Macromed\Flash\NPSWF32.dll
+ 2009-04-28 06:13 . 2010-02-11 07:38 3565056 c:\windows\system32\drivers\ati2mtag.sys
+ 2008-04-14 06:51 . 2011-11-03 15:29 1294848 c:\windows\system32\dllcache\quartz.dll
+ 2009-04-28 04:08 . 2010-02-11 04:12 2670592 c:\windows\system32\ativvaxx.dll
+ 2009-04-28 04:08 . 2010-02-11 04:12 3107788 c:\windows\system32\ativva5x.dat
- 2009-04-28 04:08 . 2009-04-28 04:08 3107788 c:\windows\system32\ativva5x.dat
+ 2009-04-28 01:56 . 2010-02-11 04:21 3227648 c:\windows\system32\aticaldd.dll
- 2009-04-28 01:56 . 2009-04-28 01:56 3227648 c:\windows\system32\aticaldd.dll
+ 2009-04-28 04:21 . 2010-02-11 04:25 3818144 c:\windows\system32\ati3duag.dll
+ 2011-12-25 02:50 . 2011-12-25 02:50 5246976 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.dll
+ 2011-12-26 08:59 . 2011-12-26 08:59 4368896 c:\windows\Installer\17e5069.msp
+ 2012-01-24 19:43 . 2012-01-24 19:43 7424000 c:\windows\Installer\{B7CF6A5E-EBBE-4B79-B833-BDF71BBF399E}\soffice.exe
+ 2012-01-12 10:07 . 2012-01-12 10:07 1356288 c:\windows\assembly\NativeImages_v2.0.50727_32\System.WorkflowServ#\05c29118462056cf810df0b6aa660d05\System.WorkflowServices.ni.dll
+ 2012-01-12 10:07 . 2012-01-12 10:07 1908224 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Run#\26b3258c559dc0ab6bdce481ffd458b3\System.Workflow.Runtime.ni.dll
+ 2012-01-12 10:07 . 2012-01-12 10:07 4514304 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Com#\1642d1b72cd84caf24cbe7c5e8fd8368\System.Workflow.ComponentModel.ni.dll
+ 2012-01-12 10:07 . 2012-01-12 10:07 2992640 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Act#\32ce12c3c2049f2df94c44c94b052e16\System.Workflow.Activities.ni.dll
+ 2012-01-12 10:07 . 2012-01-12 10:07 1840640 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\f63ae1310e004777e880f28377bcddd2\System.Web.Services.ni.dll
+ 2012-01-12 10:06 . 2012-01-12 10:06 2209280 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\c99b02434e71ca9898bebbc08d63e885\System.Web.Mobile.ni.dll
+ 2012-01-12 10:06 . 2012-01-12 10:06 2405888 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\c8f78b9e94857fdf6c2a378dd1629ee0\System.Web.Extensions.ni.dll
+ 2012-01-12 10:06 . 2012-01-12 10:06 1706496 c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel#\ae749b024162e9ac79110c633b5ce6be\System.ServiceModel.Web.ni.dll
+ 2012-01-12 10:05 . 2012-01-12 10:05 1070080 c:\windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\23eb4618c9d171be9fb551a13a475a32\System.IdentityModel.ni.dll
+ 2012-01-12 10:06 . 2012-01-12 10:06 1328128 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Services\f35064c125799df650c1a959d8fa450b\System.Data.Services.ni.dll
+ 2012-01-12 10:06 . 2012-01-12 10:06 1712128 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\a86c12788293105a0d9fda1bc90c90bc\Microsoft.VisualBasic.ni.dll
- 2011-10-15 08:54 . 2011-10-15 08:54 3182592 c:\windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 3182592 c:\windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
- 2011-10-15 08:54 . 2011-10-15 08:54 2048000 c:\windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 2048000 c:\windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
- 2011-10-15 08:53 . 2011-10-15 08:53 5025792 c:\windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 5025792 c:\windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
- 2010-10-05 12:27 . 2010-10-05 12:27 1277952 c:\windows\assembly\GAC_MSIL\System.Web.Extensions\3.5.0.0__31bf3856ad364e35\System.Web.Extensions.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 1277952 c:\windows\assembly\GAC_MSIL\System.Web.Extensions\3.5.0.0__31bf3856ad364e35\System.Web.Extensions.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 5062656 c:\windows\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
- 2011-10-15 08:53 . 2011-10-15 08:53 5062656 c:\windows\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 5246976 c:\windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 2933248 c:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
- 2011-10-15 08:54 . 2011-10-15 08:54 2933248 c:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
+ 2012-01-11 22:08 . 2012-01-11 22:08 4550656 c:\windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
- 2011-10-15 08:54 . 2011-10-15 08:54 4550656 c:\windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
+ 2012-01-11 22:11 . 2010-02-05 18:27 1294336 c:\windows\$NtUninstallKB2631813$\quartz.dll
+ 2011-11-03 15:27 . 2011-11-03 15:27 1294848 c:\windows\$hf_mig$\KB2631813\SP3QFE\quartz.dll
+ 2012-02-10 20:36 . 2010-02-11 05:17 11845632 c:\windows\system32\ReinstallBackups\0001\DriverFiles\atioglxx.dll
+ 2012-02-10 20:30 . 2009-04-28 05:12 11845632 c:\windows\system32\ReinstallBackups\0000\DriverFiles\atioglxx.dll
+ 2009-07-11 16:16 . 2012-01-11 22:09 52128560 c:\windows\system32\MRT.exe
+ 2009-04-28 05:12 . 2010-02-11 05:17 11845632 c:\windows\system32\atioglxx.dll
- 2009-04-28 05:12 . 2009-04-28 05:12 11845632 c:\windows\system32\atioglxx.dll
+ 2012-01-24 19:43 . 2012-01-24 19:43 10158080 c:\windows\Installer\2135ae0.msi
+ 2012-01-12 10:06 . 2012-01-12 10:06 11817472 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web\62e34cfb5a8b233667c7c5a47a32ad93\System.Web.ni.dll
+ 2012-01-12 10:06 . 2012-01-12 10:06 17403904 c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\2dac4fc006596760cd4988d0bfd52ff0\System.ServiceModel.ni.dll
+ 2012-01-11 22:09 . 2012-01-11 22:10 10683392 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Design\9e15d80ffb037e9171fa4bd2e0233497\System.Design.ni.dll
.
-- Snímek resetován k současnému datu --
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-10-13 17351304]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVMixerTray"="c:\program files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-12-20 131072]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-12-08 421736]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-25 437160]
.
c:\documents and settings\SIMON\Nabídka Start\Programy\Po spuštění\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-2-16 384512]
.
c:\documents and settings\SIMON\Nabídka Start\Programy\Po spuštění\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-2-16 384512]
.
c:\documents and settings\SIMON\Nabídka Start\Programy\Po spuštění\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-2-16 384512]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
BDARemote.lnk - c:\program files\USB TV\EM28XX\BDARemote.exe [2012-2-10 81997]
.
c:\documents and settings\SIMON\Nabídka Start\Programy\Po spuštění\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-2-16 384512]
.
[HKLM\~\startupfolder\C:^Documents and Settings^SIMON^Nabídka Start^Programy^Po spuštění^Logitech . Registrácia výrobku.lnk]
path=c:\documents and settings\SIMON\Nabídka Start\Programy\Po spuštění\Logitech . Registrácia výrobku.lnk
backup=c:\windows\pss\Logitech . Registrácia výrobku.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-02-27 15:10 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2010-09-21 15:04 136176 ----atw- c:\documents and settings\SIMON\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
2009-10-14 12:36 2793304 ----a-w- c:\program files\Logitech\Logitech WebCam Software\LWS.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2007-10-19 18:16 286720 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2011-10-13 08:27 17351304 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 14:07 2260480 --sha-r- c:\program files\Spybot - Search & Destroy\TeaTimer.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2012-01-04 13:26 1242448 ----a-w- c:\program files\Steam\Steam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"wlidsvc"=2 (0x2)
"ose"=3 (0x3)
"lxdxCATSCustConnectService"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite 2009.SP3c\\RpcAgentSrv.exe"=
"c:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite 2009.SP3c\\WNt500x86\\RpcSandraSrv.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Steam\\steamapps\\siafz\\counter-strike\\hl.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
.
S1 MpKsl5527f533;MpKsl5527f533;\??\c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{D181CC92-FBB0-49AE-89D9-79E17D8A5F43}\MpKsl5527f533.sys --> c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{D181CC92-FBB0-49AE-89D9-79E17D8A5F43}\MpKsl5527f533.sys [?]
S3 cpuz134;cpuz134;\??\c:\docume~1\SIMON\LOCALS~1\Temp\cpuz134\cpuz134_x32.sys --> c:\docume~1\SIMON\LOCALS~1\Temp\cpuz134\cpuz134_x32.sys [?]
S3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys --> c:\windows\system32\DRIVERS\ewusbdev.sys [?]
S3 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\program files\SiSoftware\SiSoftware Sandra Lite 2009.SP3c\RpcAgentSrv.exe [11. 7. 2009 17:35 98488]
S3 speccy;speccy;\??\c:\docume~1\SIMON\LOCALS~1\Temp\78124a59-000b-4379-8c53-be007ce75564 --> c:\docume~1\SIMON\LOCALS~1\Temp\78124a59-000b-4379-8c53-be007ce75564 [?]
.
Obsah adresáře 'Naplánované úlohy'
.
2012-02-07 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 16:57]
.
2012-02-13 c:\windows\Tasks\User_Feed_Synchronization-{B27A758B-AFAA-4163-B8E4-960DC90CF985}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Doplňkový sken -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{EE7551BB-8615-4526-AAC0-21233627A50E}: NameServer = 192.168.0.1
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-02-13 18:47
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
.
c:\docume~1\SIMON\LOCALS~1\Temp\Perflib_Perfdata_dcc.dat 16384 bytes
.
sken byl úspešně dokončen
skryté soubory: 1
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\speccy]
"ImagePath"="\??\c:\docume~1\SIMON\LOCALS~1\Temp\78124a59-000b-4379-8c53-be007ce75564"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(780)
c:\windows\system32\Ati2evxx.dll
.
Celkový čas: 2012-02-13 18:49:36
ComboFix-quarantined-files.txt 2012-02-13 17:49
ComboFix2.txt 2012-01-10 17:14
.
Před spuštěním: Volných bajtů: 101 455 380 480
Po spuštění: Volných bajtů: 101 454 680 064
.
- - End Of File - - E136930C675E97B5C694196A7670757A

Otevřte ponámkový blok a zkopírujte do něj:

KillAll::

Folder::
c:\documents and settings\SIMON\Local Settings\Data aplikací\Google\Update

Collect::
c:\docume~1\SIMON\LOCALS~1\Temp\78124a59-000b-4379-8c53-be007ce75564
c:\docume~1\SIMON\LOCALS~1\Temp\Perflib_Perfdata_dcc.dat

Driver::
speccy

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]

Uložte na plochu jako CFScript.txt. Pak jej myší petáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

CFScript jsem tedy pouzil a vyhodilo mi to novy log...


Zde prikladam:


ComboFix 12-02-13.01 - SIMON . 02. 2012 21:25:03.3.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2046.1518 [GMT 1:00]
Spuštěný z: c:\documents and settings\SIMON\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\SIMON\Plocha\CFScript.txt
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_SPECCY
-------\Service_speccy
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-01-13 do 2012-02-13 )))))))))))))))))))))))))))))))
.
.
2012-02-13 16:34 . 2012-02-13 16:37 -------- d-----w- c:\program files\trend micro
2012-02-13 16:34 . 2012-02-13 16:35 -------- d-----w- C:\rsit
2012-02-12 13:58 . 2012-02-12 13:58 -------- d--h--w- c:\windows\system32\GroupPolicy
2012-02-10 21:06 . 2012-02-10 21:06 -------- d-----w- c:\program files\Common Files\ATI Technologies
2012-02-10 21:06 . 2012-02-10 21:06 -------- d-----w- c:\program files\DIFX
2012-02-10 21:06 . 2012-02-10 21:06 -------- d-----w- c:\program files\USB TV
2012-01-27 08:26 . 2012-01-27 08:26 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-01-24 19:51 . 2012-01-24 19:51 -------- d-----w- c:\documents and settings\SIMON\Data aplikací\OpenOffice.org
2012-01-24 19:41 . 2012-01-24 19:41 -------- d-----w- c:\program files\OpenOffice.org 3
2012-01-24 10:10 . 2012-01-24 10:10 -------- d-----w- c:\program files\BurnAware Free
2012-01-20 17:58 . 2012-02-08 11:45 -------- d-----w- c:\documents and settings\SIMON\Data aplikací\Ventrilo
2012-01-20 17:19 . 2012-02-12 12:50 -------- d-----w- c:\documents and settings\SIMON\Data aplikací\TS3Client
2012-01-20 17:17 . 2012-01-20 17:18 -------- d-----w- c:\program files\TeamSpeak 3 Client
2012-01-17 16:37 . 2012-01-17 16:37 -------- d-----w- c:\windows\Sun
2012-01-17 16:36 . 2012-01-17 16:36 -------- d-----w- c:\program files\Common Files\Java
2012-01-17 16:36 . 2012-01-17 16:35 73728 ----a-w- c:\windows\system32\javacpl.cpl
2012-01-17 16:36 . 2012-01-17 16:35 472808 ----a-w- c:\windows\system32\deployJava1.dll
2012-01-17 16:35 . 2012-01-17 16:35 -------- d-----w- c:\program files\Java
2012-01-17 16:20 . 2012-01-17 16:20 -------- d-----w- c:\documents and settings\SIMON\Local Settings\Data aplikací\Identities
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-31 12:44 . 2011-10-05 13:55 237072 ------w- c:\windows\system32\MpSigStub.exe
2011-11-25 21:57 . 2008-04-14 06:52 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-11-23 14:40 . 2008-04-14 05:45 1859584 ----a-w- c:\windows\system32\win32k.sys
2011-11-20 06:12 . 2008-04-14 06:52 60416 ----a-w- c:\windows\system32\packager.exe
2011-11-16 14:21 . 2008-04-14 06:52 354816 ----a-w- c:\windows\system32\winhttp.dll
2011-11-16 14:21 . 2008-04-14 06:51 152064 ----a-w- c:\windows\system32\schannel.dll
.
.
((((((((((((((((((((((((((((( SnapShot_2012-02-13_17.47.31 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-02-13 20:30 . 2012-02-13 20:30 16384 c:\windows\temp\Perflib_Perfdata_244.dat
+ 2012-02-13 20:30 . 2009-10-07 00:47 109080 c:\windows\temp\logishrd\LVPrcInj01.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-10-13 17351304]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVMixerTray"="c:\program files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-12-20 131072]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-12-08 421736]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-25 437160]
.
c:\documents and settings\SIMON\Nabídka Start\Programy\Po spuštění\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-2-16 384512]
.
c:\documents and settings\SIMON\Nabídka Start\Programy\Po spuštění\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-2-16 384512]
.
c:\documents and settings\SIMON\Nabídka Start\Programy\Po spuštění\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-2-16 384512]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
BDARemote.lnk - c:\program files\USB TV\EM28XX\BDARemote.exe [2012-2-10 81997]
.
c:\documents and settings\SIMON\Nabídka Start\Programy\Po spuštění\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-2-16 384512]
.
[HKLM\~\startupfolder\C:^Documents and Settings^SIMON^Nabídka Start^Programy^Po spuštění^Logitech . Registrácia výrobku.lnk]
path=c:\documents and settings\SIMON\Nabídka Start\Programy\Po spuštění\Logitech . Registrácia výrobku.lnk
backup=c:\windows\pss\Logitech . Registrácia výrobku.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-02-27 15:10 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
2009-10-14 12:36 2793304 ----a-w- c:\program files\Logitech\Logitech WebCam Software\LWS.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2007-10-19 18:16 286720 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2011-10-13 08:27 17351304 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 14:07 2260480 --sha-r- c:\program files\Spybot - Search & Destroy\TeaTimer.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2012-01-04 13:26 1242448 ----a-w- c:\program files\Steam\Steam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"wlidsvc"=2 (0x2)
"ose"=3 (0x3)
"lxdxCATSCustConnectService"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite 2009.SP3c\\RpcAgentSrv.exe"=
"c:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite 2009.SP3c\\WNt500x86\\RpcSandraSrv.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Steam\\steamapps\\siafz\\counter-strike\\hl.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
.
S1 MpKsl5527f533;MpKsl5527f533;\??\c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{D181CC92-FBB0-49AE-89D9-79E17D8A5F43}\MpKsl5527f533.sys --> c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{D181CC92-FBB0-49AE-89D9-79E17D8A5F43}\MpKsl5527f533.sys [?]
S3 cpuz134;cpuz134;\??\c:\docume~1\SIMON\LOCALS~1\Temp\cpuz134\cpuz134_x32.sys --> c:\docume~1\SIMON\LOCALS~1\Temp\cpuz134\cpuz134_x32.sys [?]
S3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys --> c:\windows\system32\DRIVERS\ewusbdev.sys [?]
S3 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\program files\SiSoftware\SiSoftware Sandra Lite 2009.SP3c\RpcAgentSrv.exe [11. 7. 2009 17:35 98488]
.
Obsah adresáře 'Naplánované úlohy'
.
2012-02-07 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 16:57]
.
2012-02-13 c:\windows\Tasks\User_Feed_Synchronization-{B27A758B-AFAA-4163-B8E4-960DC90CF985}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Doplňkový sken -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{EE7551BB-8615-4526-AAC0-21233627A50E}: NameServer = 192.168.0.1
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-02-13 21:30
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(784)
c:\windows\system32\Ati2evxx.dll
.
- - - - - - - > 'explorer.exe'(5888)
c:\windows\TEMP\logishrd\LVPrcInj01.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\windows\system32\wscntfy.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Celkový čas: 2012-02-13 21:32:53 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-02-13 20:32
ComboFix2.txt 2012-02-13 17:49
ComboFix3.txt 2012-01-10 17:14
.
Před spuštěním: Volných bajtů: 101 433 720 832
Po spuštění: Volných bajtů: 101 323 649 024
.
- - End Of File - - 9D3F3A4EE80446B3941C2BF1218CC3F3

Log již vypadá čistý. Nastala nějaká změna?