Scan result of Farbar Recovery Scan Tool Version: 11-07-2012 Ran by SYSTEM at 14-07-2012 04:54:12 Running from Z:\ Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US) The current controlset is ControlSet001 ========================== Registry (Whitelisted) ============= HKLM\...\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe [168216 2011-04-19] (Intel Corporation) HKLM\...\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe [392472 2011-04-19] (Intel Corporation) HKLM\...\Run: [Persistence] C:\Windows\system32\igfxpers.exe [416024 2011-04-19] (Intel Corporation) HKLM\...\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe [525312 2011-01-25] (IDT, Inc.) HKLM\...\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe [609144 2011-04-12] (Alps Electric Co., Ltd.) HKLM\...\Run: [NVHotkey] rundll32.exe C:\Windows\system32\nvHotkey.dll,Start [312936 2011-04-21] (NVIDIA Corporation) HKLM\...\Run: [DellStage] "C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\start.umj" --startup [207845 2011-04-29] () HKLM\...\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice [4030008 2011-09-06] (ESET) HKLM\...\Run: [TaskSchdPS] C:\Users\Marcelina\AppData\Local\Microsoft\Windows\3460\TaskSchdPS.exe [49664 2012-07-06] () HKLM\...\Run: [Wwanpref] C:\Users\Serwis Administrator\AppData\Local\Microsoft\Windows\3706\Wwanpref.exe [x] HKLM\...\Run: [Advanced Uninstaller PRO Installation Monitor] "C:\Program Files (x86)\Innovative Solutions\Advanced Uninstaller PRO\Monitor.exe" [1075160 2010-02-04] (Innovative Solutions GRUP SRL) HKLM-x32\...\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-11-05] (Intel Corporation) HKLM-x32\...\Run: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [113288 2010-11-17] (Renesas Electronics Corporation) HKLM-x32\...\Run: [Dell Registration] C:\Program Files (x86)\System Registration\prodreg.exe /boot [4144448 2010-11-10] (Dell, Inc.) HKLM-x32\...\Run: [] [x] HKLM-x32\...\Run: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2010-03-12] (Hewlett-Packard) HKLM-x32\...\Run: [Bing Bar] "C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1449.0\mswinext.exe" [243544 2010-04-27] (Microsoft Corp.) HKLM-x32\...\Run: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume [288088 2009-11-11] (Microsoft Corporation) HKU\Serwis Administrator\...\Run: [Advanced Uninstaller PRO Installation Monitor] "C:\Program Files (x86)\Innovative Solutions\Advanced Uninstaller PRO\Monitor.exe" [1075160 2010-02-04] (Innovative Solutions GRUP SRL) Winlogon\Notify\igfxcui: igfxdev.dll (Intel Corporation) AppInit_DLLs: C:\Windows\system32\nvinitx.dll ==================== Services (Whitelisted) ====== 2 Bluetooth Device Monitor; "C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe" [921664 2011-05-19] (Intel Corporation) 3 Bluetooth Media Service; "C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe" [1335360 2011-05-19] (Intel Corporation) 2 Bluetooth OBEX Service; "C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe" [995392 2011-05-19] (Intel Corporation) 2 BTHSSecurityMgr; "C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe" [134928 2011-06-03] (Intel(R) Corporation) 2 ekrn; "C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe" [974944 2011-09-06] (ESET) 3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-07-27] () 2 RoxWatch12; "C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe" [219632 2010-11-25] (Sonic Solutions) 2 UNS; "C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe" [2655768 2010-10-05] (Intel Corporation) ========================== Drivers (Whitelisted) ============= 2 eamonm; C:\Windows\System32\Drivers\eamonm.sys [202576 2011-08-09] (ESET) 1 ehdrv; C:\Windows\System32\Drivers\ehdrv.sys [146432 2011-08-04] (ESET) 2 epfw; C:\Windows\System32\Drivers\epfw.sys [187632 2011-08-04] (ESET) 1 EpfwLWF; C:\Windows\System32\Drivers\EpfwLWF.sys [38288 2011-08-04] (ESET) 0 epfwwfp; C:\Windows\System32\Drivers\epfwwfp.sys [62496 2011-08-04] (ESET) 0 hotcore3; C:\Windows\System32\Drivers\hotcore3.sys [37392 2010-07-13] (Paragon Software Group) 3 hwdatacard; C:\Windows\System32\DRIVERS\ewusbmdm.sys [115328 2008-09-26] (Huawei Technologies Co., Ltd.) 3 iBtFltCoex; C:\Windows\System32\Drivers\iBtFltCoex.sys [59904 2011-07-19] (Intel Corporation) 2 IDMWFP; C:\Windows\System32\Drivers\IDMWFP.sys [149640 2012-02-07] (Tonec Inc.) ========================== NetSvcs (Whitelisted) =========== ============ One Month Created Files and Folders ============== 2012-07-14 04:24 - 2012-07-14 04:25 - 00000000 ____D C:\FRST 2012-07-07 16:44 - 2012-07-07 16:52 - 00000000 ____D C:\Users\Marcelina\AppData\Local\Microsoft Games 2012-07-06 12:41 - 2012-07-06 12:41 - 00000000 ____D C:\Users\Marcelina\AppData\Roaming\hellomoto 2012-07-06 12:40 - 2012-07-06 12:40 - 00000000 ____D C:\Windows\Sun 2012-06-21 05:40 - 2012-06-02 17:19 - 02428952 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll 2012-06-21 05:40 - 2012-06-02 17:19 - 00701976 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll 2012-06-21 05:40 - 2012-06-02 17:19 - 00057880 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe 2012-06-21 05:40 - 2012-06-02 17:19 - 00044056 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll 2012-06-21 05:40 - 2012-06-02 17:19 - 00038424 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll 2012-06-21 05:40 - 2012-06-02 17:15 - 02622464 ____A (Microsoft Corporation) C:\Windows\System32\wucltux.dll 2012-06-21 05:40 - 2012-06-02 17:15 - 00099840 ____A (Microsoft Corporation) C:\Windows\System32\wudriver.dll 2012-06-21 05:40 - 2012-06-02 08:19 - 00186752 ____A (Microsoft Corporation) C:\Windows\System32\wuwebv.dll 2012-06-21 05:40 - 2012-06-02 08:15 - 00036864 ____A (Microsoft Corporation) C:\Windows\System32\wuapp.exe 2012-06-19 12:33 - 2012-05-17 21:47 - 17807360 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll 2012-06-19 12:33 - 2012-05-17 21:16 - 10924032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll 2012-06-19 12:33 - 2012-05-17 21:06 - 02311680 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll 2012-06-19 12:33 - 2012-05-17 20:59 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll 2012-06-19 12:33 - 2012-05-17 20:59 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll 2012-06-19 12:33 - 2012-05-17 20:58 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl 2012-06-19 12:33 - 2012-05-17 20:58 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll 2012-06-19 12:33 - 2012-05-17 20:56 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll 2012-06-19 12:33 - 2012-05-17 20:55 - 00818688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll 2012-06-19 12:33 - 2012-05-17 20:55 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe 2012-06-19 12:33 - 2012-05-17 20:54 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll 2012-06-19 12:33 - 2012-05-17 20:51 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb 2012-06-19 12:33 - 2012-05-17 20:51 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll 2012-06-19 12:33 - 2012-05-17 20:47 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll 2012-06-19 12:33 - 2012-05-17 18:11 - 12314624 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2012-06-19 12:33 - 2012-05-17 17:48 - 09737728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2012-06-19 12:33 - 2012-05-17 17:45 - 01800192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2012-06-19 12:33 - 2012-05-17 17:36 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2012-06-19 12:33 - 2012-05-17 17:35 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2012-06-19 12:33 - 2012-05-17 17:35 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2012-06-19 12:33 - 2012-05-17 17:33 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll 2012-06-19 12:33 - 2012-05-17 17:31 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2012-06-19 12:33 - 2012-05-17 17:29 - 00716800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2012-06-19 12:33 - 2012-05-17 17:29 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2012-06-19 12:33 - 2012-05-17 17:27 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2012-06-19 12:33 - 2012-05-17 17:25 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2012-06-19 12:33 - 2012-05-17 17:24 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2012-06-19 12:33 - 2012-05-17 17:20 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2012-06-19 12:33 - 2012-04-26 00:41 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll 2012-06-19 12:33 - 2012-04-26 00:41 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\rdpwsx.dll 2012-06-19 12:33 - 2012-04-26 00:34 - 00009216 ____A (Microsoft Corporation) C:\Windows\System32\rdrmemptylst.exe 2012-06-19 12:25 - 2012-05-04 06:06 - 05559664 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe 2012-06-19 12:25 - 2012-05-04 05:03 - 03913072 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2012-06-19 12:24 - 2012-05-14 20:32 - 03146752 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys 2012-06-19 12:24 - 2012-05-04 06:00 - 00366592 ____A (Microsoft Corporation) C:\Windows\System32\qdvd.dll 2012-06-19 12:24 - 2012-05-04 05:03 - 03968368 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2012-06-19 12:24 - 2012-05-04 04:59 - 00514560 ____A (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll 2012-06-19 12:24 - 2012-05-01 00:40 - 00209920 ____A (Microsoft Corporation) C:\Windows\System32\profsvc.dll 2012-06-19 12:24 - 2012-04-27 22:55 - 00210944 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys 2012-06-19 12:24 - 2012-04-24 00:37 - 01462272 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll 2012-06-19 12:24 - 2012-04-24 00:37 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll 2012-06-19 12:24 - 2012-04-24 00:37 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll 2012-06-19 12:24 - 2012-04-23 23:36 - 01158656 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll 2012-06-19 12:24 - 2012-04-23 23:36 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll 2012-06-19 12:24 - 2012-04-23 23:36 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll 2012-06-19 12:24 - 2012-04-07 07:31 - 03216384 ____A (Microsoft Corporation) C:\Windows\System32\msi.dll 2012-06-19 12:24 - 2012-04-07 06:26 - 02342400 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll ============ 3 Months Modified Files ======================== 2012-07-13 21:46 - 2011-10-07 04:45 - 02083913 ____A C:\Windows\WindowsUpdate.log 2012-07-13 21:46 - 2009-07-13 23:45 - 00020928 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2012-07-13 21:46 - 2009-07-13 23:45 - 00020928 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2012-07-13 21:42 - 2009-07-14 00:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT 2012-07-13 21:42 - 2009-07-13 23:51 - 00074376 ____A C:\Windows\setupact.log 2012-07-13 18:28 - 2012-04-30 12:23 - 00000944 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-327448945-3961107767-944625937-1001UA.job 2012-07-13 17:50 - 2011-10-07 07:37 - 00737980 ____A C:\Windows\System32\perfh015.dat 2012-07-13 17:50 - 2011-10-07 07:37 - 00154636 ____A C:\Windows\System32\perfc015.dat 2012-07-13 17:50 - 2009-07-14 00:13 - 01662556 ____A C:\Windows\System32\PerfStringBackup.INI 2012-07-06 12:28 - 2012-04-30 12:23 - 00000922 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-327448945-3961107767-944625937-1001Core.job 2012-07-05 11:45 - 2012-02-18 15:58 - 00005504 ____A C:\Users\Marcelina\maw32.lc 2012-06-19 12:50 - 2009-07-13 23:45 - 00333360 ____A C:\Windows\System32\FNTCACHE.DAT 2012-06-19 12:36 - 2012-02-18 11:25 - 58957832 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe 2012-06-10 07:46 - 2012-02-19 11:49 - 00000295 ____A C:\user.js 2012-06-07 14:06 - 2009-07-14 00:08 - 00032604 ____A C:\Windows\Tasks\SCHEDLGU.TXT 2012-06-02 17:19 - 2012-06-21 05:40 - 02428952 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll 2012-06-02 17:19 - 2012-06-21 05:40 - 00701976 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll 2012-06-02 17:19 - 2012-06-21 05:40 - 00057880 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe 2012-06-02 17:19 - 2012-06-21 05:40 - 00044056 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll 2012-06-02 17:19 - 2012-06-21 05:40 - 00038424 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll 2012-06-02 17:15 - 2012-06-21 05:40 - 02622464 ____A (Microsoft Corporation) C:\Windows\System32\wucltux.dll 2012-06-02 17:15 - 2012-06-21 05:40 - 00099840 ____A (Microsoft Corporation) C:\Windows\System32\wudriver.dll 2012-06-02 08:19 - 2012-06-21 05:40 - 00186752 ____A (Microsoft Corporation) C:\Windows\System32\wuwebv.dll 2012-06-02 08:15 - 2012-06-21 05:40 - 00036864 ____A (Microsoft Corporation) C:\Windows\System32\wuapp.exe 2012-05-17 21:47 - 2012-06-19 12:33 - 17807360 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll 2012-05-17 21:16 - 2012-06-19 12:33 - 10924032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll 2012-05-17 21:06 - 2012-06-19 12:33 - 02311680 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll 2012-05-17 20:59 - 2012-06-19 12:33 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll 2012-05-17 20:59 - 2012-06-19 12:33 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll 2012-05-17 20:58 - 2012-06-19 12:33 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl 2012-05-17 20:58 - 2012-06-19 12:33 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll 2012-05-17 20:56 - 2012-06-19 12:33 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll 2012-05-17 20:55 - 2012-06-19 12:33 - 00818688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll 2012-05-17 20:55 - 2012-06-19 12:33 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe 2012-05-17 20:54 - 2012-06-19 12:33 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll 2012-05-17 20:51 - 2012-06-19 12:33 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb 2012-05-17 20:51 - 2012-06-19 12:33 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll 2012-05-17 20:47 - 2012-06-19 12:33 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll 2012-05-17 18:11 - 2012-06-19 12:33 - 12314624 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2012-05-17 17:48 - 2012-06-19 12:33 - 09737728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2012-05-17 17:45 - 2012-06-19 12:33 - 01800192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2012-05-17 17:36 - 2012-06-19 12:33 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2012-05-17 17:35 - 2012-06-19 12:33 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2012-05-17 17:35 - 2012-06-19 12:33 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2012-05-17 17:33 - 2012-06-19 12:33 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll 2012-05-17 17:31 - 2012-06-19 12:33 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2012-05-17 17:29 - 2012-06-19 12:33 - 00716800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2012-05-17 17:29 - 2012-06-19 12:33 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2012-05-17 17:27 - 2012-06-19 12:33 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2012-05-17 17:25 - 2012-06-19 12:33 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2012-05-17 17:24 - 2012-06-19 12:33 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2012-05-17 17:20 - 2012-06-19 12:33 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2012-05-14 20:32 - 2012-06-19 12:24 - 03146752 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys 2012-05-04 06:06 - 2012-06-19 12:25 - 05559664 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe 2012-05-04 06:00 - 2012-06-19 12:24 - 00366592 ____A (Microsoft Corporation) C:\Windows\System32\qdvd.dll 2012-05-04 05:03 - 2012-06-19 12:25 - 03913072 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2012-05-04 05:03 - 2012-06-19 12:24 - 03968368 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2012-05-04 04:59 - 2012-06-19 12:24 - 00514560 ____A (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll 2012-05-01 00:40 - 2012-06-19 12:24 - 00209920 ____A (Microsoft Corporation) C:\Windows\System32\profsvc.dll 2012-04-27 22:55 - 2012-06-19 12:24 - 00210944 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys 2012-04-26 00:41 - 2012-06-19 12:33 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll 2012-04-26 00:41 - 2012-06-19 12:33 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\rdpwsx.dll 2012-04-26 00:34 - 2012-06-19 12:33 - 00009216 ____A (Microsoft Corporation) C:\Windows\System32\rdrmemptylst.exe 2012-04-24 00:37 - 2012-06-19 12:24 - 01462272 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll 2012-04-24 00:37 - 2012-06-19 12:24 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll 2012-04-24 00:37 - 2012-06-19 12:24 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll 2012-04-23 23:36 - 2012-06-19 12:24 - 01158656 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll 2012-04-23 23:36 - 2012-06-19 12:24 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll 2012-04-23 23:36 - 2012-06-19 12:24 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll ========================= Known DLLs (Whitelisted) ============ ========================= Bamital & volsnap Check ============ C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== EXE ASSOCIATION ===================== HKLM\...\.exe: exefile => OK HKLM\...\exefile\DefaultIcon: %1 => OK HKLM\...\exefile\open\command: "%1" %* => OK ========================= Memory info ====================== Percentage of memory in use: 19% Total physical RAM: 4003.16 MB Available physical RAM: 3220.62 MB Total Pagefile: 4001.36 MB Available Pagefile: 3213.29 MB Total Virtual: 8192 MB Available Virtual: 8191.9 MB ======================= Partitions ========================= 1 Drive c: (OS) (Fixed) (Total:100.92 GB) (Free:64.44 GB) NTFS 3 Drive e: (DATA) (Fixed) (Total:350.1 GB) (Free:306.36 GB) NTFS 4 Drive f: (Recovery) (Fixed) (Total:14.65 GB) (Free:7.46 GB) NTFS ==>[System with boot components (obtained from reading drive)] 6 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS 7 Drive z: () (Removable) (Total:7.53 GB) (Free:7.53 GB) FAT32 Nr dysku Stan Rozmiar Wolne Dyn GPT -------- ------------- ------- ------- --- --- Dysk 0 Online 465 GB 0 B Dysk 1 Online 7728 MB 0 B Dysk 2 Brak nosnika 0 B 0 B Trwa opuszczanie programu DiskPart... ========================================================== Last Boot: 2012-07-13 15:28 ======================= End Of Log ==========================