RSIT-LOG.TXT TEIL 1 Code:
Alles auswählen Aufklappen ATTFilter
Logfile of random's system information tool 1.06 (written by random/random)
Run by *** at 2009-10-14 12:54:49
Microsoft® Windows Vista™ Home Premium Service Pack 2
System drive C: has 376 GB (64%) free of 590 GB
Total RAM: 3069 MB (63% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:54:58, on 14.10.2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\avmwlanstick\WLanGUI.exe
C:\Program Files\NewSoft\Smart Start UP\PnPDetect.exe
C:\Program Files\iTunesHelper.exe
C:\Program Files\Deamon Tools\DAEMON Tools Lite\daemon.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\***\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\***.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.aldi.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.aldi.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\IPSBHO.DLL
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [AVMWlanClient] C:\Program Files\avmwlanstick\wlangui.exe
O4 - HKLM\..\Run: [Smart Start UP] C:\Program Files\NewSoft\Smart Start UP\PnPDetect.exe /Automation
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunesHelper.exe"
O4 - HKLM\..\Run: [ Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\Deamon Tools\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - http://rover.ebay.com/rover/1/707-37276-17534-25/4 (file missing)
O9 - Extra 'Tools' menuitem: eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - http://rover.ebay.com/rover/1/707-37276-17534-25/4 (file missing)
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ 6\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ 6\ICQ6.5\ICQ.exe
O9 - Extra button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - http://rover.ebay.com/rover/1/707-37276-17534-25/4 (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - http://rover.ebay.com/rover/1/707-37276-17534-25/4 (file missing) (HKCU)
O13 - Gopher Prefix:
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O23 - Service: Apache2.2 - Apache Software Foundation - C:\Program Files\AppServ\Apache2.2\bin\httpd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVM WLAN Connection Service - AVM Berlin - C:\Program Files\avmwlanstick\WlanNetService.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Lookout Citadel Server (LkCitadelServer) - National Instruments, Inc. - C:\Windows\system32\lkcitdl.exe
O23 - Service: National Instruments PSP Server Locator (lkClassAds) - National Instruments Corporation - C:\Windows\system32\lkads.exe
O23 - Service: National Instruments Time Synchronization (lkTimeSync) - National Instruments Corporation - C:\Windows\system32\lktsrv.exe
O23 - Service: mysql - Unknown owner - C:\Program.exe (file missing)
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: National Instruments Domain Service (NIDomainService) - National Instruments Corporation - C:\Program Files\National Instruments\Shared\Security\nidmsrv.exe
O23 - Service: NI Service Locator (niSvcLoc) - National Instruments Corp. - C:\Windows\system32\nisvcloc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
--
End of file - 9034 bytes
======Scheduled tasks folder======
C:\Windows\tasks\User_Feed_Synchronization-{5D45F506-F4EF-4182-A01D-3FAE181CAEC5}.job
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2008-06-11 75128]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]
Symantec NCO BHO - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll [2009-08-22 378736]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
Symantec Intrusion Prevention - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\IPSBHO.DLL [2009-08-22 107896]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Anmelde-Hilfsprogramm - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-08-25 41760]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Norton Toolbar - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll [2009-08-22 378736]
{855F3B16-6D32-4fe6-8A56-BBB695989046} - ICQToolBar - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll [2008-12-09 958200]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-21 1008184]
"IAAnotif"=C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [2008-05-07 178712]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2008-05-07 6139904]
"NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2008-06-09 13543968]
"NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2008-06-09 92704]
"AppleSyncNotifier"=C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [2009-08-13 177440]
"AVMWlanClient"=C:\Program Files\avmwlanstick\wlangui.exe [2009-05-07 1904640]
"Smart Start UP"=C:\Program Files\NewSoft\Smart Start UP\PnPDetect.exe [2007-04-27 104528]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-09-05 417792]
"iTunesHelper"=C:\Program Files\iTunesHelper.exe [2009-09-21 305440]
" Malwarebytes Anti-Malware (reboot)"=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2009-09-10 1312080]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"=C:\Program Files\Deamon Tools\DAEMON Tools Lite\daemon.exe [2008-08-08 490952]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2009-02-04 23975720]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-21 202240]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\QTTask.exe [2009-09-05 417792]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre6\bin\jusched.exe [2009-08-25 149280]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SymEFA.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLUA"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5ab293f8-99e5-11dd-8aa0-0021853e7da2}]
shell\AutoRun\command - J:\pushinst.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a7fe9655-9eba-11dd-8974-001c4afc84a5}]
shell\AutoRun\command - I:\SETUP.EXE
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c41103c7-b881-11dd-8d55-001c4afc84a5}]
shell\AutoRun\command - J:\Launch.exe /run
======File associations======
.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*
======List of files/folders created in the last 1 months======
2009-10-14 12:54:49 ----D---- C:\rsit
2009-10-14 10:42:00 ----D---- C:\Users\***\AppData\Roaming\Malwarebytes
2009-10-14 10:41:54 ----D---- C:\ProgramData\Malwarebytes
2009-10-14 10:41:54 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-10-14 10:36:16 ----D---- C:\Program Files\CCleaner
2009-10-13 20:22:18 ----D---- C:\Program Files\Trend Micro
2009-10-13 19:39:50 ----D---- C:\Program Files\AVM_update
2009-10-13 11:32:02 ----D---- C:\Windows\system32\vi-VN
2009-10-13 11:32:02 ----D---- C:\Windows\system32\eu-ES
2009-10-13 11:32:02 ----D---- C:\Windows\system32\ca-ES
2009-10-13 10:44:07 ----D---- C:\Windows\system32\EventProviders
2009-10-11 16:11:25 ----A---- C:\Windows\system32\D3DX9_40.dll
2009-10-11 16:11:25 ----A---- C:\Windows\system32\d3dx10_40.dll
2009-10-11 16:11:25 ----A---- C:\Windows\system32\D3DCompiler_40.dll
2009-10-06 18:04:00 ----D---- C:\Program Files\WE Unlimited
2009-10-03 18:35:56 ----A---- C:\Windows\system32\PnkBstrB.exe
2009-10-03 18:35:50 ----A---- C:\Windows\system32\PnkBstrA.exe
2009-09-28 16:33:18 ----D---- C:\Program Files\Common Files\Merge Modules
2009-09-28 16:33:11 ----D---- C:\Program Files\GBX Master Light
2009-09-26 12:58:25 ----A---- C:\Windows\system32\GEARAspi.dll
2009-09-26 12:58:22 ----D---- C:\Program Files\Mozilla Plugins
2009-09-26 12:58:21 ----D---- C:\Program Files\iTunesMiniPlayer.Resources
2009-09-26 12:58:19 ----D---- C:\Program Files\iTunesHelper.Resources
2009-09-26 12:57:30 ----D---- C:\Program Files\iTunes.Resources
2009-09-26 12:57:30 ----D---- C:\Program Files\iPod
2009-09-26 12:57:21 ----D---- C:\ProgramData\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-09-26 12:57:21 ----D---- C:\Program Files\CD Configuration
2009-09-26 12:38:35 ----D---- C:\Program Files\iPhone-Konfigurationsprogramm
2009-09-24 13:59:44 ----A---- C:\Windows\system32\NlsLexicons0007.dll
2009-09-24 13:59:42 ----A---- C:\Windows\system32\SLsvc.exe
2009-09-24 13:59:42 ----A---- C:\Windows\system32\SLCExt.dll
2009-09-24 13:59:40 ----A---- C:\Windows\system32\FunctionDiscoveryFolder.dll
2009-09-24 13:59:40 ----A---- C:\Windows\system32\DevicePairingWizard.exe
2009-09-24 13:59:39 ----A---- C:\Windows\system32\NlsLexicons0009.dll
2009-09-24 13:59:38 ----A---- C:\Windows\system32\mssrch.dll
2009-09-24 13:59:36 ----A---- C:\Windows\system32\tquery.dll
2009-09-24 13:59:35 ----A---- C:\Windows\system32\scavenge.dll
2009-09-24 13:59:35 ----A---- C:\Windows\system32\RMActivate_isv.exe
2009-09-24 13:59:35 ----A---- C:\Windows\system32\RMActivate.exe
2009-09-24 13:59:35 ----A---- C:\Windows\system32\PresentationNative_v0300.dll
2009-09-24 13:59:34 ----A---- C:\Windows\system32\msi.dll
2009-09-24 13:59:34 ----A---- C:\Windows\system32\imapi2fs.dll
2009-09-24 13:59:33 ----A---- C:\Windows\system32\WscEapPr.dll
2009-09-24 13:59:33 ----A---- C:\Windows\system32\wcnwiz2.dll
2009-09-24 13:59:33 ----A---- C:\Windows\system32\sysmain.dll
2009-09-24 13:59:33 ----A---- C:\Windows\system32\secproc_isv.dll
2009-09-24 13:59:32 ----A---- C:\Windows\system32\icardagt.exe
2009-09-24 13:59:31 ----A---- C:\Windows\system32\EhStorShell.dll
2009-09-24 13:59:31 ----A---- C:\Windows\system32\AuxiliaryDisplayCpl.dll
2009-09-24 13:59:30 ----A---- C:\Windows\system32\spreview.exe
2009-09-24 13:59:30 ----A---- C:\Windows\system32\spinstall.exe
2009-09-24 13:59:30 ----A---- C:\Windows\system32\drmv2clt.dll
2009-09-24 13:59:29 ----A---- C:\Windows\system32\spwizui.dll
2009-09-24 13:59:29 ----A---- C:\Windows\system32\shell32.dll
2009-09-24 13:59:29 ----A---- C:\Windows\system32\secproc.dll
2009-09-24 13:59:29 ----A---- C:\Windows\system32\mcupdate_GenuineIntel.dll
2009-09-24 13:59:28 ----A---- C:\Windows\system32\SearchIndexer.exe
2009-09-24 13:59:28 ----A---- C:\Windows\system32\p2psvc.dll
2009-09-24 13:59:28 ----A---- C:\Windows\system32\mssvp.dll
2009-09-24 13:59:27 ----A---- C:\Windows\system32\sdohlp.dll
2009-09-24 13:59:27 ----A---- C:\Windows\system32\mssphtb.dll
2009-09-24 13:59:27 ----A---- C:\Windows\system32\mssph.dll
2009-09-24 13:59:27 ----A---- C:\Windows\system32\MSMPEG2VDEC.DLL
2009-09-24 13:59:27 ----A---- C:\Windows\system32\mscoree.dll
2009-09-24 13:59:27 ----A---- C:\Windows\system32\imapi2.dll
2009-09-24 13:59:26 ----A---- C:\Windows\system32\ntkrnlpa.exe
2009-09-24 13:59:26 ----A---- C:\Windows\system32\IMJP10K.DLL
2009-09-24 13:59:26 ----A---- C:\Windows\system32\esent.dll
2009-09-24 13:59:26 ----A---- C:\Windows\system32\DevicePairing.dll
2009-09-24 13:59:25 ----A---- C:\Windows\system32\wevtsvc.dll
2009-09-24 13:59:25 ----A---- C:\Windows\system32\sperror.dll
2009-09-24 13:59:25 ----A---- C:\Windows\system32\SLC.dll
2009-09-24 13:59:25 ----A---- C:\Windows\system32\RMActivate_ssp_isv.exe
2009-09-24 13:59:25 ----A---- C:\Windows\system32\RMActivate_ssp.exe
2009-09-24 13:59:25 ----A---- C:\Windows\system32\PresentationHostProxy.dll
2009-09-24 13:59:25 ----A---- C:\Windows\system32\msshsq.dll
2009-09-24 13:59:25 ----A---- C:\Windows\system32\korwbrkr.dll
2009-09-24 13:59:25 ----A---- C:\Windows\system32\IasMigReader.exe
2009-09-24 13:59:24 ----A---- C:\Windows\system32\msjet40.dll
2009-09-24 13:59:23 ----A---- C:\Windows\system32\Query.dll
2009-09-24 13:59:23 ----A---- C:\Windows\system32\qmgr.dll
2009-09-24 13:59:23 ----A---- C:\Windows\system32\ntoskrnl.exe
2009-09-24 13:59:23 ----A---- C:\Windows\system32\msxml6.dll
2009-09-24 13:59:23 ----A---- C:\Windows\system32\MPSSVC.dll
2009-09-24 13:59:22 ----A---- C:\Windows\system32\srchadmin.dll
__________________