Trojaner tr/vundo.gen entfernen
 

hallo hab mir wieder ein trojaner eingefangen tr/vundo.gen
bitte helft mir in zu entfenen antivir meldet sich als.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:31:08, on 19.01.2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe
C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Lexmark 3600-4600 Series\lxdxmon.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Users\Iwan\AppData\Local\Temp\matrix309811.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http:\\www.samsungcomputer.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [lxdxmon.exe] "C:\Program Files\Lexmark 3600-4600 Series\lxdxmon.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O13 - Gopher Prefix:
O17 - HKLM\System\CCS\Services\Tcpip\..\{2CF450DA-444B-4548-B304-FDB255539168}: NameServer = 85.255.116.132,85.255.112.180
O17 - HKLM\System\CCS\Services\Tcpip\..\{69FD5326-C4FC-4FFA-B6F9-0A99E59C71C8}: NameServer = 85.255.116.132,85.255.112.180
O17 - HKLM\System\CCS\Services\Tcpip\..\{8ABBBC40-5F9B-4C7C-9BFA-57B09F350444}: NameServer = 85.255.116.132,85.255.112.180
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.132,85.255.112.180
O17 - HKLM\System\CS1\Services\Tcpip\..\{2CF450DA-444B-4548-B304-FDB255539168}: NameServer = 85.255.116.132,85.255.112.180
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.132,85.255.112.180
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira AntiVir Personal - Free Antivirus Planer (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: lxdxCATSCustConnectService - Lexmark International, Inc. - C:\Windows\system32\spool\DRIVERS\W32X86\3\\lxdxserv.exe
O23 - Service: lxdx_device - - C:\Windows\system32\lxdxcoms.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Samsung Update Plus - Unknown owner - C:\Program Files\Samsung\Samsung Update Plus\SLUBackgroundService.exe (file missing)
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: @%SystemRoot%\System32\TUProgSt.exe,-1 (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\Windows\System32\TUProgSt.exe

--
End of file - 7333 bytes

ComboFix 09-01-19.03 - Iwan 2009-01-19 23:46:18.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1031.18.3066.1931 [GMT 1:00]
ausgeführt von:: c:\users\Iwan\Desktop\trojaner\ComboFix.exe
* Neuer Wiederherstellungspunkt wurde erstellt
.
ADS - Windows: deleted 72 bytes in 1 streams.

(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\autorun.inf
c:\program files\Mozilla Firefox\components\iamfamous.dll
C:\resycled
c:\resycled\ntldr.com
c:\users\Iwan\AppData\Roaming\drivers\downld
c:\windows\msetup
c:\windows\msetup\BASW-00919A17\setup.exe
c:\windows\msetup\BASW-00919A17\setup.iss
c:\windows\msetup\BASW-00919A17\SWDesc.txt
c:\windows\msetup\BASW-01038A05\ChgWLANSettings.exe
c:\windows\msetup\MSetup.exe
c:\windows\msetup\MSetupLog.log
c:\windows\system32\drivers\gaopdxcnvvseyq.sys
c:\windows\system32\gaopdxmtwpwlnv.dll
D:\Autorun.inf
D:\resycled
d:\resycled\ntldr.com

.
((((((((((((((((((((((((((((((((((((((( Treiber/Dienste )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_gaopdxserv.sys


((((((((((((((((((((((( Dateien erstellt von 2008-12-19 bis 2009-01-19 ))))))))))))))))))))))))))))))
.

2009-01-19 23:31 . 2009-01-19 23:31 <DIR> d-------- c:\program files\CleanUp!
2009-01-19 23:30 . 2009-01-19 23:30 <DIR> d-------- c:\program files\Trend Micro
2009-01-19 22:53 . 2009-01-19 22:53 <DIR> d-------- c:\program files\MagicDVDRipper
2009-01-19 13:56 . 2009-01-19 16:15 <DIR> d-------- c:\program files\DVDx
2009-01-18 17:30 . 2009-01-18 17:30 <DIR> d-------- c:\users\Iwan\AppData\Roaming\dvdcss
2009-01-18 17:30 . 2009-01-18 17:30 <DIR> d-------- c:\program files\Xilisoft
2009-01-18 16:46 . 2009-01-19 23:48 <DIR> d--h----- c:\users\Iwan\AppData\Roaming\drivers
2009-01-18 16:36 . 2009-01-19 21:53 <DIR> d-------- c:\users\All Users\eMule
2009-01-18 16:36 . 2009-01-19 21:53 <DIR> d-------- c:\programdata\eMule
2009-01-18 12:37 . 2009-01-18 12:46 <DIR> d-------- c:\program files\BearShare
2009-01-18 12:37 . 2009-01-19 23:20 <DIR> d-------- C:\My Downloads
2009-01-18 11:55 . 2009-01-18 11:55 <DIR> d-------- c:\program files\Red Kawa
2009-01-18 11:54 . 2009-01-18 11:54 <DIR> d-------- C:\OpenCandy
2009-01-18 11:44 . 2009-01-18 11:44 <DIR> d-------- c:\program files\Gabest
2009-01-18 11:44 . 2009-01-18 11:44 <DIR> d-------- c:\program files\AviSynth 2.5
2009-01-18 11:44 . 2009-01-18 11:44 43,698 --a------ c:\windows\System32\xvid-uninstall.exe
2009-01-18 11:08 . 2009-01-18 11:20 <DIR> d-------- C:\ShrinkTo5_Movies
2009-01-18 11:08 . 2009-01-18 11:08 <DIR> d-------- c:\program files\FoxBurnerPlugin
2009-01-17 00:28 . 2009-01-17 00:28 <DIR> d-------- c:\program files\ConvertHelper
2009-01-16 21:37 . 2009-01-16 21:39 <DIR> d-------- c:\program files\ICQ6.5
2009-01-15 20:41 . 2009-01-18 19:08 <DIR> d-------- c:\users\Iwan\AppData\Roaming\Skype
2009-01-15 20:39 . 2009-01-15 20:39 <DIR> d-------- c:\program files\Skype
2009-01-15 20:39 . 2009-01-15 20:39 <DIR> d-------- c:\program files\Common Files\Skype
2009-01-14 16:34 . 2008-12-16 03:42 288,768 --a------ c:\windows\System32\drivers\srv.sys
2009-01-11 20:28 . 2009-01-16 21:38 <DIR> d-------- c:\users\All Users\ICQ
2009-01-11 20:28 . 2009-01-16 21:38 <DIR> d-------- c:\programdata\ICQ
2009-01-11 20:28 . 2009-01-17 13:50 <DIR> d-------- c:\program files\ICQ6Toolbar
2009-01-10 17:23 . 2009-01-11 00:38 <DIR> d-------- c:\users\All Users\Google
2009-01-10 17:21 . 2009-01-10 17:21 <DIR> d-------- c:\program files\Western Digital
2009-01-09 14:44 . 2009-01-09 14:46 <DIR> d-------- c:\users\Iwan\dwhelper
2009-01-07 22:09 . 2009-01-07 22:09 <DIR> d-------- c:\program files\Common Files\PX Storage Engine
2009-01-07 20:45 . 2009-01-18 12:34 <DIR> d-------- c:\program files\Common Files\DVDVideoSoft
2009-01-07 20:45 . 2009-01-07 20:45 <DIR> d-------- C:\DVDVideoSoft
2009-01-07 20:45 . 2002-01-05 14:37 344,064 --a------ c:\windows\System32\msvcr70.dll
2009-01-05 20:56 . 2009-01-11 21:20 <DIR> d-------- c:\users\All Users\App4rTemp
2009-01-05 20:56 . 2009-01-11 21:20 <DIR> d-------- c:\programdata\App4rTemp
2008-12-31 16:55 . 2009-01-18 12:22 <DIR> d-------- c:\users\Iwan\AppData\Roaming\LimeWire
2008-12-30 22:17 . 2008-12-30 22:17 <DIR> d-------- c:\users\All Users\Alawar Stargaze
2008-12-30 22:17 . 2008-12-30 22:17 <DIR> d-------- c:\programdata\Alawar Stargaze
2008-12-30 14:13 . 2008-12-30 14:13 <DIR> d-------- c:\program files\Rockstar Games
2008-12-30 14:13 . 2008-12-30 14:13 <DIR> d-------- c:\program files\directx
2008-12-29 17:40 . 2008-12-29 17:40 <DIR> d-------- c:\users\Iwan\AppData\Roaming\My Games
2008-12-29 17:40 . 2008-12-30 17:33 <DIR> d-------- c:\users\All Users\AlawarWrapper
2008-12-29 17:40 . 2008-12-30 17:33 <DIR> d-------- c:\programdata\AlawarWrapper
2008-12-29 17:39 . 2008-12-29 21:48 <DIR> d-------- c:\program files\Games.Rambler.ru
2008-12-25 14:44 . 2009-01-18 18:56 <DIR> d-------- c:\users\Iwan\AppData\Roaming\skypePM
2008-12-25 14:44 . 2008-12-25 14:44 56 --ah----- c:\windows\System32\ezsidmv.dat
2008-12-25 14:42 . 2009-01-15 20:39 <DIR> d-------- c:\users\All Users\Skype
2008-12-25 14:42 . 2009-01-15 20:39 <DIR> d-------- c:\programdata\Skype
2008-12-22 09:25 . 2008-12-22 09:25 <DIR> dr------- c:\windows\System32\config\systemprofile\Music
2008-12-20 16:05 . 2008-12-20 16:05 <DIR> d-------- c:\program files\Microsoft Silverlight

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-19 22:46 54,932 ----a-w c:\users\All Users\nvModes.dat
2009-01-19 22:46 54,932 ----a-w c:\programdata\nvModes.dat
2009-01-18 15:10 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-18 15:10 --------- d-----w c:\program files\Samsung
2009-01-18 15:10 --------- d-----w c:\program files\DivX
2009-01-18 11:35 --------- d-----w c:\program files\CyberLink
2009-01-17 12:50 --------- d-----w c:\program files\Google
2009-01-16 07:54 --------- d-----w c:\programdata\Lx_cats
2009-01-15 16:33 --------- d-----w c:\program files\ICQ6
2009-01-14 18:12 --------- d-----w c:\program files\Windows Mail
2009-01-12 11:16 --------- d-----w c:\users\Iwan\AppData\Roaming\ICQ
2009-01-11 21:38 --------- d-----w c:\program files\Lexmark 3600-4600 Series
2009-01-10 16:22 --------- d-----w c:\program files\Mozilla Thunderbird
2009-01-03 00:41 --------- d-----w c:\users\Iwan\AppData\Roaming\Nero
2008-12-31 15:00 --------- d-----w c:\program files\Common Files\Adobe
2008-12-30 13:43 --------- d-----w c:\program files\The GodFather
2008-12-19 21:45 --------- d-----w c:\programdata\CyberLink
2008-12-13 23:39 603,904 ----a-w c:\windows\System32\TUProgSt.exe
2008-12-13 23:39 360,192 ----a-w c:\windows\System32\TuneUpDefragService.exe
2008-12-13 23:39 --------- d-----w c:\program files\TuneUp Utilities 2009
2008-12-13 22:53 --------- d-----w c:\users\Iwan\AppData\Roaming\NeroDigital(TM)
2008-12-13 22:47 --------- d-----w c:\programdata\Nero
2008-12-13 22:23 --------- d-----w c:\program files\Common Files\Nero
2008-12-13 22:06 --------- d-----w c:\program files\Nero
2008-12-13 21:47 --------- d-----w c:\program files\DAMN NFO Viewer
2008-12-11 12:31 27,904 ----a-w c:\windows\System32\uxtuneup.dll
2008-12-11 12:31 17,152 ----a-w c:\windows\System32\authuitu.dll
2008-12-11 00:33 86,016 ----a-w c:\windows\System32\dpl100.dll
2008-12-11 00:33 200,704 ----a-w c:\windows\System32\dtu100.dll
2008-12-10 16:42 --------- d-----w c:\users\Iwan\AppData\Roaming\CoSoSys
2008-12-09 02:28 593,920 ----a-w c:\windows\System32\dpuGUI11.dll
2008-12-09 02:28 57,344 ----a-w c:\windows\System32\dpv11.dll
2008-12-09 02:28 344,064 ----a-w c:\windows\System32\dpus11.dll
2008-12-09 02:28 294,912 ----a-w c:\windows\System32\dpu11.dll
2008-12-07 22:28 4,300 ----a-w c:\windows\System32\MEMIO.SYS
2008-12-07 22:26 --------- d-----w c:\program files\Pixum
2008-11-30 11:36 --------- d-----w c:\users\Iwan\AppData\Roaming\diginet
2008-11-30 11:36 --------- d-----w c:\program files\Diginet
2008-11-30 10:20 130,208 ------r c:\windows\bwUnin-8.1.1.87-8876480SL.exe
2008-11-29 17:52 --------- d-----w c:\programdata\Elaborate Bytes
2008-11-29 17:50 --------- d-----w c:\programdata\SlySoft
2008-11-29 17:44 --------- d-----w c:\program files\Elaborate Bytes
2008-11-29 17:40 --------- d-----w c:\program files\SlySoft
2008-11-27 14:38 --------- d-----w c:\program files\Common Files\Remote Control Software Common
2008-11-27 14:37 127,034 ------r c:\windows\bwUnin-8.1.1.50-8876480SL.exe
2008-11-27 14:37 --------- d-----w c:\program files\Logitech
2008-11-27 14:37 --------- d-----w c:\program files\Common Files\Remote Control USB Driver
2008-11-24 20:48 74,752 ----a-w c:\windows\ST6UNST.EXE
2008-11-24 20:48 290,816 ------w c:\windows\Setup1.exe
2008-11-24 18:28 65,024 ----a-w c:\windows\IFinst26.exe
2008-11-24 18:28 --------- d-----w c:\program files\Lame MP3 Codec
2008-11-24 18:00 --------- d-----w c:\program files\XviD
2008-11-24 17:59 --------- d-----w c:\users\Iwan\AppData\Roaming\DivX
2008-11-24 17:41 0 ---ha-w c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2008-11-23 16:00 --------- d-----w c:\program files\MSXML 4.0
2008-11-21 19:42 --------- d-----w c:\users\Iwan\AppData\Roaming\SAMSUNG
2008-11-21 19:34 5,632 ----a-w c:\windows\system32\drivers\StarOpen.sys
2008-11-06 16:37 524,288 ----a-w c:\windows\System32\DivXsm.exe
2008-11-06 16:37 3,596,288 ----a-w c:\windows\System32\qt-dx331.dll
2008-11-06 16:35 200,704 ----a-w c:\windows\System32\ssldivx.dll
2008-11-06 16:35 1,044,480 ----a-w c:\windows\System32\libdivx.dll
2008-11-06 16:33 823,296 ----a-w c:\windows\System32\divx_xx0c.dll
2008-11-06 16:33 823,296 ----a-w c:\windows\System32\divx_xx07.dll
2008-11-06 16:33 815,104 ----a-w c:\windows\System32\divx_xx0a.dll
2008-11-06 16:33 802,816 ----a-w c:\windows\System32\divx_xx11.dll
2008-11-06 16:33 684,032 ----a-w c:\windows\System32\DivX.dll
2008-11-06 16:33 12,288 ----a-w c:\windows\System32\DivXWMPExtType.dll
2008-11-01 03:44 541,696 ----a-w c:\windows\AppPatch\AcLayers.dll
2008-11-01 03:44 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll
2008-11-01 03:44 460,288 ----a-w c:\windows\AppPatch\AcSpecfc.dll
2008-11-01 03:44 28,672 ----a-w c:\windows\System32\Apphlpdm.dll
2008-11-01 03:44 2,154,496 ----a-w c:\windows\AppPatch\AcGenral.dll
2008-11-01 03:44 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll
2008-11-01 01:21 4,240,384 ----a-w c:\windows\System32\GameUXLegacyGDFs.dll
2008-10-29 06:29 2,927,104 ----a-w c:\windows\explorer.exe
2008-10-27 21:44 129,784 ------w c:\windows\System32\pxafs.dll
2008-10-22 03:57 241,152 ----a-w c:\windows\System32\PortableDeviceApi.dll
2008-10-22 01:22 2,048 ----a-w c:\windows\System32\tzres.dll
2008-10-21 05:25 296,960 ----a-w c:\windows\System32\gdi32.dll
2008-10-21 05:25 1,645,568 ----a-w c:\windows\System32\connect.dll
2008-01-21 02:43 174 --sha-w c:\program files\desktop.ini