Toho dole si nevšímejte - výpis procmon na hotplug (předpokládám, že toto je vytvoření okna- jeho prvotní impuls (vyškrtnutý výčet zařízení a pod blbosti))svchost je ten velkej (-netsvc i s motivy) Hoď si tam filtr na hotplug - jestli to máme podobný. Ty čísla tučně ignoruj - hlaš je stav

6163 12:51,3641603 RUNDLL32.EXE 3008 CreateFile D:\WIND OWS\system32\hotplug.dll SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened
6165 12:51,3646420 RUNDLL32.EXE 3008 QueryStandardInfor mationFile D:\WINDOWS\system32\hotplug.dll SUCCESS AllocationSize: 147 456, EndOfFile: 144 384, NumberOfLinks: 1, DeletePending: False, Directory: False
6345 12:51,3872440 RUNDLL32.EXE 3008 CloseFile D:\WINDO WS\system32\hotplug.dll SUCCESS
6653 12:51,4398088 RUNDLL32.EXE 3008 CreateFile D:\WIND OWS\system32\hotplug.dll SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened
6654 12:51,4402725 RUNDLL32.EXE 3008 QueryNameInformati onFile D:\WINDOWS\system32\hotplug.dll SUCCESS Name: \WINDOWS\system32\hotplug.dll
6769 12:51,4574040 RUNDLL32.EXE 3008 CloseFile D:\WINDO WS\system32\hotplug.dll SUCCESS
9027 12:51,8708222 RUNDLL32.EXE 3008 QueryOpen D:\WINDO WS\system32\hotplug.dll SUCCESS CreationTime: 2. 3. 2006 14:00, LastAccessTime: 8. 7. 2008 12:51, LastWriteTime: 14. 4. 2008 05:21, ChangeTime: 10. 5. 2008 05:59, AllocationSize: 147 456, EndOfFile: 144 384, FileAttributes: A
9396 12:51,0285649 svchost.exe 764 QueryOpen D:\WINDOWS \system32\hotplug.dll SUCCESS CreationTime: 2. 3. 2006 14:00, LastAccessTime: 8. 7. 2008 12:51, LastWriteTime: 14. 4. 2008 05:21, ChangeTime: 10. 5. 2008 05:59, AllocationSize: 147 456, EndOfFile: 144 384, FileAttributes: A
9404 12:51,0299193 svchost.exe 764 CreateFile D:\WINDOW S\system32\hotplug.dll SUCCESS Desired Access: Read EA, Read Attributes, Read Control, Disposition: Open, Options: , Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, Impersonating: NT AUTHORITY\SYSTEM, OpenResult: Opened
9405 12:51,0306409 svchost.exe 764 QueryNameInformation File D:\WINDOWS\system32\hotplug.dll SUCCESS Name: \WINDOWS\system32\hotplug.dll
9409 12:51,0318913 svchost.exe 764 QueryFileInternalInf ormationFile D:\WINDOWS\system32\hotplug.dll SUCCESS IndexNumber: 0xd000000002345
9410 12:51,0321327 svchost.exe 764 CloseFile D:\WINDOWS \system32\hotplug.dll SUCCESS