TR/Kazy.58415.21

Diorama

Hallo Ihrs, ich bräuchte mal eure Hilfe, bin hier echt am verzweifeln. Ich hab vor knapp zwei Wochen erst das System neu aufgesetzt wegen Maleware um sicher zu gehen und jetzt hab ich als was neues drauf was ich mit Antivir nicht wegbekomm. Ausgegeben wird es mir als TR/Kazy.58415.21 und irgendwie lässt es meine Ordnerpfade verschwinden. Als ich zum Beispiel die txt Datein speichern wollte auf dem Desktop kam die Meldung dass der Pfad nicht existieren würde. Antivir verweist mich immer wieder drauf selbst wenn ichs lösch damit. Weiß nicht wie ich des nun wegbekommen soll ohne den Laptop nochmal neu aufzusetzen. Die Logs hab ich gemacht. DDS direkt im Post und die Attach im Anhang...


.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421
Run by HansWurst at 23:11:54 on 2012-04-02
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.3950.2832 [GMT 2:00]
.
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\atieclxx.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\Dwm.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Windows\Explorer.EXE
C:\Windows\SysWOW64\svchost.exe -k hpdevmgmt
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\svchost.exe -k HPService
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\system32\WUDFHost.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Windows\system32\sppsvc.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\taskhost.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.de/
mWinlogon: Userinit=userinit.exe
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll
mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
mRun: [hpqSRMon] C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\HPDIGI~1.LNK - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MICROS~1.LNK - C:\Program Files (x86)\Microsoft Office\Office10\OSA.EXE
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Free YouTube Download - C:\Users\HansWurst\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Nach Microsoft &Excel exportieren - C:\PROGRA~2\MICROS~1\Office10\EXCEL.EXE/3000
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
TCP: DhcpNameServer = 192.168.2.1
TCP: Interfaces\{321711A3-7236-4F54-AA31-973E23509A21} : DhcpNameServer = 192.168.0.100 192.168.0.254
TCP: Interfaces\{5B6625C7-42AD-487D-A89E-82240C4DF67C} : DhcpNameServer = 192.168.2.1
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\PKMCDO.DLL
{0347C33E-8762-4905-BF09-768834316C61}
{18DF081C-E8AD-4283-A596-FA578C2EBDC3}
{FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856}
EB-X64: {555D4D79-4BD2-4094-A395-CFC534424A05} - No File
mRun-x64: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun-x64: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun-x64: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
mRun-x64: [hpqSRMon] C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\HansWurst\AppData\Roaming\Mozilla\Firefox\Profiles\9e5vfvv8.default\
FF - prefs.js: browser.startup.homepage - google.de
FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
.
============= SERVICES / DRIVERS ===============
.
R1 avkmgr;avkmgr;C:\Windows\system32\DRIVERS\avkmgr.sys --> C:\Windows\system32\DRIVERS\avkmgr.sys [?]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-1-3 63928]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?]
R2 AntiVirSchedulerService;Avira Planer;C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [2012-3-23 86224]
R2 AntiVirService;Avira Echtzeit Scanner;C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [2012-3-23 110032]
R2 avgntflt;avgntflt;C:\Windows\system32\DRIVERS\avgntflt.sys --> C:\Windows\system32\DRIVERS\avgntflt.sys [?]
R2 rimspci;rimspci;C:\Windows\system32\DRIVERS\rimssne64.sys --> C:\Windows\system32\DRIVERS\rimssne64.sys [?]
R3 HECIx64;Intel(R) Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys --> C:\Windows\system32\DRIVERS\HECIx64.sys [?]
R3 SFEP;Sony Firmware Extension Parser;C:\Windows\system32\DRIVERS\SFEP.sys --> C:\Windows\system32\DRIVERS\SFEP.sys [?]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk62x64.sys --> C:\Windows\system32\DRIVERS\yk62x64.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
.
=============== Created Last 30 ================
.
2012-04-02 20:33:46 8669240 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{018A6A14-5948-4E1A-9416-A777D03294C8}\mpengine.dll
2012-03-28 08:36:35 -------- d-----w- C:\Program Files (x86)\MSXML 4.0
2012-03-27 15:45:02 -------- d-----w- C:\Users\HansWurst\AppData\Local\AOL
2012-03-27 12:52:54 -------- d-----w- C:\Users\HansWurst\AppData\Local\Microsoft Games
2012-03-26 20:43:49 -------- d-----w- C:\ProgramData\WEBREG
2012-03-26 20:43:00 -------- d-----w- C:\Users\HansWurst\AppData\Local\HP
2012-03-26 20:41:57 101376 ----a-w- C:\Windows\System32\Spool\prtprocs\x64\HPZPPWN7.DLL
2012-03-26 20:34:49 -------- d-----w- C:\Windows\SysWow64\spool
2012-03-26 20:33:41 -------- d-----w- C:\Program Files (x86)\Common Files\Hewlett-Packard
2012-03-26 20:33:18 -------- d-----w- C:\Program Files (x86)\Common Files\HP
2012-03-26 20:31:53 -------- d-----w- C:\Program Files (x86)\HP
2012-03-26 20:30:23 861184 ----a-w- C:\Windows\System32\hpowiav1.dll
2012-03-26 20:30:23 730624 ----a-w- C:\Windows\System32\hpotscl1.dll
2012-03-26 20:30:23 642360 ----a-w- C:\Windows\System32\hpzids40.dll
2012-03-26 20:30:23 498176 ----a-w- C:\Windows\System32\hpovst01.dll
2012-03-26 14:05:53 -------- d-----w- C:\Users\HansWurst\AppData\Roaming\DVDVideoSoftIEHelpers
2012-03-26 14:05:39 -------- d-----w- C:\Users\HansWurst\AppData\Roaming\DVDVideoSoft
2012-03-26 14:05:39 -------- d-----w- C:\Program Files (x86)\DVDVideoSoft
2012-03-26 14:05:39 -------- d-----w- C:\Program Files (x86)\Common Files\DVDVideoSoft
2012-03-25 20:59:11 -------- d-----w- C:\Users\HansWurst\AppData\Roaming\SYSTEMAX Software Development
2012-03-25 20:59:11 -------- d-----w- C:\ProgramData\SYSTEMAX Software Development
2012-03-25 01:10:29 -------- d-----w- C:\Windows\Msagent
2012-03-24 08:14:38 -------- d-----w- C:\Users\HansWurst\AppData\Roaming\TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1
2012-03-24 08:14:36 -------- d-----w- C:\Program Files (x86)\TweetDeck
2012-03-24 08:03:01 -------- d-----w- C:\Program Files (x86)\VideoLAN
2012-03-23 13:33:50 414368 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2012-03-23 13:31:03 -------- d-----w- C:\Users\HansWurst\AppData\Roaming\Avira
2012-03-23 11:29:53 8669240 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2012-03-23 11:08:34 -------- d-----w- C:\Users\HansWurst\AppData\Local\Adobe
2012-03-23 11:06:03 -------- d-----w- C:\Program Files\Core Temp
2012-03-23 10:43:12 97312 ----a-w- C:\Windows\System32\drivers\avgntflt.sys
2012-03-23 10:43:12 27760 ----a-w- C:\Windows\System32\drivers\avkmgr.sys
2012-03-23 10:43:12 -------- d-----w- C:\ProgramData\Avira
2012-03-23 10:43:12 -------- d-----w- C:\Program Files (x86)\Avira
2012-03-23 10:19:02 -------- d-----w- C:\Users\HansWurst\AppData\Local\twitter
2012-03-23 10:17:07 -------- d-----w- C:\Users\HansWurst\AppData\Local\Mozilla
2012-03-22 12:24:27 77312 ----a-w- C:\Windows\System32\rdpwsx.dll
2012-03-22 12:24:27 149504 ----a-w- C:\Windows\System32\rdpcorekmts.dll
2012-03-22 09:24:56 -------- d-----w- C:\Windows\System32\SPReview
2012-03-22 09:24:15 -------- d-----w- C:\Windows\System32\EventProviders
2012-03-22 09:20:59 749568 ----a-w- C:\Program Files\Common Files\System\msadc\msadce.dll
2012-03-22 09:19:59 82944 ----a-w- C:\Windows\SysWow64\iccvid.dll
2012-03-22 09:18:19 529408 ----a-w- C:\Windows\System32\wbemcomn.dll
2012-03-22 09:18:19 244736 ----a-w- C:\Program Files\Windows Portable Devices\sqmapi.dll
2012-03-22 09:18:09 244736 ----a-w- C:\Windows\System32\sqmapi.dll
2012-03-21 17:08:44 -------- d-----w- C:\Windows\SysWow64\wbem\en-US
2012-03-21 17:08:42 -------- d-----w- C:\Windows\System32\wbem\en-US
2012-03-21 16:18:20 5559152 ----a-w- C:\Windows\System32\ntoskrnl.exe
2012-03-21 16:18:19 3968368 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2012-03-21 16:18:19 3913584 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
2012-03-21 16:15:36 294912 ----a-w- C:\Windows\System32\browserchoice.exe
2012-03-21 15:56:02 340992 ----a-w- C:\Windows\System32\schannel.dll
2012-03-21 15:55:59 2871808 ----a-w- C:\Windows\explorer.exe
2012-03-21 15:54:55 509952 ----a-w- C:\Windows\System32\ntshrui.dll
2012-03-21 15:54:55 442880 ----a-w- C:\Windows\SysWow64\ntshrui.dll
2012-03-21 15:54:44 1923952 ----a-w- C:\Windows\System32\drivers\tcpip.sys
2012-03-21 15:54:43 288640 ----a-w- C:\Windows\System32\drivers\FWPKCLNT.SYS
2012-03-21 15:54:04 43520 ----a-w- C:\Windows\System32\csrsrv.dll
2012-03-21 15:54:00 31232 ----a-w- C:\Windows\SysWow64\prevhost.exe
2012-03-21 15:54:00 31232 ----a-w- C:\Windows\System32\prevhost.exe
2012-03-21 15:52:57 498688 ----a-w- C:\Windows\System32\drivers\afd.sys
2012-03-21 15:51:56 514560 ----a-w- C:\Windows\SysWow64\qdvd.dll
2012-03-21 15:51:56 366592 ----a-w- C:\Windows\System32\qdvd.dll
2012-03-21 15:51:56 1572864 ----a-w- C:\Windows\System32\quartz.dll
2012-03-21 15:51:56 1328128 ----a-w- C:\Windows\SysWow64\quartz.dll
2012-03-21 15:51:55 77312 ----a-w- C:\Windows\System32\packager.dll
2012-03-21 15:51:55 67072 ----a-w- C:\Windows\SysWow64\packager.dll
2012-03-21 15:51:37 1731920 ----a-w- C:\Windows\System32\ntdll.dll
2012-03-21 15:51:37 1292080 ----a-w- C:\Windows\SysWow64\ntdll.dll
2012-03-21 12:44:32 -------- d-----w- C:\HansWurst
2012-03-21 12:42:32 -------- d-----w- C:\Treiber
2012-03-21 12:39:12 279656 ------w- C:\Windows\System32\MpSigStub.exe
2012-03-21 12:35:28 9216 ----a-w- C:\Windows\System32\rdrmemptylst.exe
2012-03-21 12:35:00 826880 ----a-w- C:\Windows\SysWow64\rdpcore.dll
2012-03-21 12:35:00 210944 ----a-w- C:\Windows\System32\drivers\rdpwd.sys
2012-03-21 12:35:00 1031680 ----a-w- C:\Windows\System32\rdpcore.dll
2012-03-21 12:34:59 23552 ----a-w- C:\Windows\System32\drivers\tdtcp.sys
2012-03-21 12:30:31 64032 ----a-w- C:\Windows\System32\RHCoInst64.dll
2012-03-21 12:30:31 304640 ----a-w- C:\Windows\System32\RH3DHT64.dll
2012-03-21 12:30:31 304640 ----a-w- C:\Windows\System32\RH3DAA64.dll
2012-03-21 12:30:31 213280 ----a-w- C:\Windows\System32\drivers\RtHDMIVX.sys
2012-03-21 12:30:31 1691680 ----a-w- C:\Windows\System32\RHDMEx64.dll
2012-03-21 12:30:31 1638432 ----a-w- C:\Windows\System32\RtkHDM64.dll
2012-03-21 12:29:00 -------- d-----w- C:\Users\HansWurst\AppData\Local\ATI
2012-03-21 08:56:49 -------- d-----w- C:\Program Files\Synaptics
2012-03-20 16:31:23 0 ----a-w- C:\Windows\ativpsrm.bin
2012-03-20 16:28:20 -------- d-----w- C:\Windows\Panther
.
==================== Find3M ====================
.
2012-03-22 11:01:09 152576 ----a-w- C:\Windows\SysWow64\msclmd.dll
2012-03-22 11:01:08 175616 ----a-w- C:\Windows\System32\msclmd.dll
2012-03-21 12:26:27 2904576 ----a-w- C:\Windows\SysWow64\atiumdva.dll
2012-03-21 08:56:29 1721576 ----a-w- C:\Windows\System32\WdfCoInstaller01009.dll
2012-03-21 08:56:28 205608 ----a-w- C:\Windows\System32\SynTPAPI.dll
2012-03-21 08:56:28 147752 ----a-w- C:\Windows\System32\SynTPCo4.dll
2012-03-21 08:56:28 107816 ----a-w- C:\Windows\SysWow64\SynTPCOM.dll
2012-03-21 08:56:27 396072 ----a-w- C:\Windows\System32\SynCOM.dll
2012-03-21 08:56:27 293936 ----a-w- C:\Windows\System32\drivers\SynTP.sys
2012-03-21 08:56:27 263464 ----a-w- C:\Windows\System32\SynCtrl.dll
2012-03-21 08:56:27 206120 ----a-w- C:\Windows\SysWow64\SynCtrl.dll
2012-03-21 08:56:27 169256 ----a-w- C:\Windows\SysWow64\SynCOM.dll
2012-03-21 08:55:12 93696 ----a-w- C:\Windows\System32\drivers\rimssne64.sys
2012-03-21 08:55:12 623616 ----a-w- C:\Windows\snymsico.dll
2012-03-21 08:47:06 496128 ----a-w- C:\Windows\System32\yk62x64.dll
2012-03-21 08:47:06 395264 ----a-w- C:\Windows\System32\drivers\yk62x64.sys
2012-03-21 08:40:59 95744 ----a-w- C:\Windows\System32\RTEEL64A.dll
2012-03-21 08:40:59 73216 ----a-w- C:\Windows\System32\RTEEG64A.dll
2012-03-21 08:40:59 66592 ----a-w- C:\Windows\System32\RCoInst64.dll
2012-03-21 08:40:59 325904 ----a-w- C:\Windows\System32\MaxxAudioAPO20.dll
2012-03-21 08:40:59 321536 ----a-w- C:\Windows\System32\FMAPO64.dll
2012-03-21 08:40:59 304640 ----a-w- C:\Windows\System32\RP3DHT64.dll
2012-03-21 08:40:59 304640 ----a-w- C:\Windows\System32\RP3DAA64.dll
2012-03-21 08:40:59 2197264 ----a-w- C:\Windows\System32\MaxxAudioEQ.dll
2012-03-21 08:40:59 198656 ----a-w- C:\Windows\System32\RTEED64A.dll
2012-03-21 08:40:59 1201184 ----a-w- C:\Windows\System32\RTCOM64.dll
2012-03-21 08:40:58 168864 ----a-w- C:\Windows\System32\AERTAC64.dll
2012-03-21 08:40:58 108960 ----a-w- C:\Windows\System32\AERTAR64.dll
2012-03-21 08:40:55 838176 ----a-w- C:\Windows\RtlExUpd.dll
2012-02-10 06:36:07 1544192 ----a-w- C:\Windows\System32\DWrite.dll
2012-02-10 05:38:43 1077248 ----a-w- C:\Windows\SysWow64\DWrite.dll
2012-02-03 04:34:34 3145728 ----a-w- C:\Windows\System32\win32k.sys
.
============= FINISH: 23:12:52,99 ===============