# Can't get past windows blue welcome screen



## kickrz (Jul 30, 2003)

I can boot ok in safe mode and the odd time can boot normally but for the most part I can't get back in.

I was online last night and got some weird popups from my virus scanner that said scripts were blocked so I clicked ok and went to do an online virus scan. When I got to trend micro and clicked the link I got an error that said the exe file was not a compatible win32 file. I knew something must be up as I had used it several times before. I revolted and my computer kept looping. I got in through safe mode and did a sys restore and rebooted. Everything seemed ok so I did the virus scan and it found 5 threats so I fixed those and it required a reboot and since that I can't get back in unless I am in safe mode. 

I also ran chkdsk and let it fixed an error there but I am again stuck at the blue welcome screen.

I am running win xp home edition
Computer is a toshiba satellite P20 laptop

Any idea how to fix this issue? Does it sound software or hardware related?

TIA

Eta: can I run hjt's and the others in safe mode? I tried another restore just to get in but it locks up. So I am backing up pics and stuff now to an external. I went to another laptop and downloaded all programs suggested and can transfer to my wonky one but is it ok to run in safe mode?


----------



## DariusSupport (Apr 5, 2011)

click on report at the bottom right of your post window and request to be moved to security and HJT forums. The virus's you do/did have messed up your registry which is why your computer is acting off.


----------



## kickrz (Jul 30, 2003)

Ok thanks


----------



## TerryNet (Mar 23, 2005)

I moved your thread per your request. Now ...

Read Everyone MUST read this BEFORE posting for help in this forum, post the requested information here.

Bump your thread once a day--no more often--until you get a reply. They're kinda busy here.

DariusSupport, if you could include the above information along with your other advice that would be even better.


----------



## kickrz (Jul 30, 2003)

So it took some doing between computers but I was able to pull the HJT log:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:43:46 PM, on 4/26/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sunbelt Software\VIPRE\SBAMSvc.exe
C:\Program Files\Sunbelt Software\VIPRE\SBPIMSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\PCHealth\HelpCtr\Binaries\helpctr.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpHost.exe
I:\HiJackThis\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O1 - Hosts: 74.208.10.249 gs.apple.com
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Foxit PDF Creator Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SBAMTray] "C:\Program Files\Sunbelt Software\VIPRE\SBAMTray.exe"
O4 - HKLM\..\Run: [Monitor] "C:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Hiyo] C:\Program Files\HiYo\bin\HiYo.exe /RunFromStartup
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [cdloader] "C:\Documents and Settings\Kickrz\Application Data\mjusbsp\cdloader2.exe" MAGICJACK
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\PROGRA~1\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil10l_ActiveX.exe -update activex
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1265376705171
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1273110928250
O16 - DPF: {BEA7310D-06C4-4339-A784-DC3804819809} (Photo Upload Plugin Class) - http://www.walmartphotocentre.ca/upload/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab
O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LeapFrog Connect Device Service - LeapFrog Enterprises, Inc. - C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: VIPRE Antivirus (SBAMSvc) - Sunbelt Software - C:\Program Files\Sunbelt Software\VIPRE\SBAMSvc.exe
O23 - Service: SB Recovery Service (SBPIMSvc) - Sunbelt Software - C:\Program Files\Sunbelt Software\VIPRE\SBPIMSvc.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--
End of file - 6519 bytes

_________________________________________________________________________

.
DDS (Ver_11-03-05.01) - NTFSx86 MINIMAL 
Run by Kickrz at 22:52:10.12 on Tue 04/26/2011
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_21
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.800 [GMT -4:00]
.
AV: Sunbelt VIPRE *Enabled/Updated* {964FCE60-0B18-4D30-ADD6-EB178909041C}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\Program Files\Sunbelt Software\VIPRE\SBAMSvc.exe
C:\Program Files\Sunbelt Software\VIPRE\SBPIMSvc.exe
C:\WINDOWS\Explorer.EXE
I:\dds.com
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Foxit PDF Creator Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\progra~1\yahoo!\companion\installs\cpn\YTSingleInstance.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
TB: Foxit PDF Creator Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
TB: {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No File
TB: {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [IncrediMail] c:\program files\incredimail\bin\IncMail.exe /c
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [cdloader] "c:\documents and settings\kickrz\application data\mjusbsp\cdloader2.exe" MAGICJACK
uRun: [Messenger (Yahoo!)] "c:\progra~1\yahoo!\messenger\YahooMessenger.exe" -quiet
uRunOnce: [FlashPlayerUpdate] c:\windows\system32\macromed\flash\FlashUtil10l_ActiveX.exe -update activex
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [SBAMTray] "c:\program files\sunbelt software\vipre\SBAMTray.exe"
mRun: [Monitor] "c:\program files\leapfrog\leapfrog connect\Monitor.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [Hiyo] c:\program files\hiyo\bin\HiYo.exe /RunFromStartup
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/templates/ieawsdc.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1265376705171
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1273110928250
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {BEA7310D-06C4-4339-A784-DC3804819809} - hxxp://www.walmartphotocentre.ca/upload/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab
DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} - hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab
DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} - hxxp://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
Hosts: 74.208.10.249 gs.apple.com
.
============= SERVICES / DRIVERS ===============
.
R1 SBRE;SBRE;c:\windows\system32\drivers\SBREDrv.sys [2010-6-9 98392]
R2 SBAMSvc;VIPRE Antivirus;c:\program files\sunbelt software\vipre\SBAMSvc.exe [2010-8-20 2763080]
R2 SBPIMSvc;SB Recovery Service;c:\program files\sunbelt software\vipre\SBPIMSvc.exe [2010-8-20 181584]
R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.12.2;c:\windows\system32\drivers\libusb0.sys [2010-3-20 28160]
S1 sbaphd;sbaphd;c:\windows\system32\drivers\sbaphd.sys [2010-12-23 21464]
S1 SbTis;SbTis;c:\windows\system32\drivers\sbtis.sys [2010-12-23 212568]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-7-31 136176]
S2 sbapifs;sbapifs;c:\windows\system32\drivers\sbapifs.sys [2010-12-23 69976]
S3 FlyUsb;FLY Fusion;c:\windows\system32\drivers\FlyUsb.sys [2010-4-17 18560]
S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys --> c:\windows\system32\drivers\massfilter.sys [?]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2010-3-30 38224]
.
=============== Created Last 30 ================
.
2011-04-27 01:41:21	--------	d-----w-	c:\windows\system32\wbem\repository\FS
2011-04-27 01:41:21	--------	d-----w-	c:\windows\system32\wbem\Repository
2011-04-26 20:06:40	--------	d-----w-	c:\docume~1\kickrz\locals~1\applic~1\Deployment
2011-04-14 07:39:02	103864	----a-w-	c:\program files\internet explorer\plugins\nppdf32.dll
2011-04-06 21:08:33	--------	d-----w-	c:\program files\FreeFileOpener
.
==================== Find3M ====================
.
2011-03-09 23:10:37	102400	----a-w-	c:\windows\RegBootClean.exe
2011-03-03 13:21:11	1857920	----a-w-	c:\windows\system32\win32k(2)(2).sys
2011-03-03 06:55:19	149504	----a-w-	c:\windows\system32\dnsapi(2)(2).dll
2011-02-22 23:06:29	916480	----a-w-	c:\windows\system32\wininet(2)(2).dll
2011-02-22 23:06:29	1210880	----a-w-	c:\windows\system32\urlmon(2)(2).dll
2011-02-22 23:06:28	1991680	----a-w-	c:\windows\system32\iertutil(2)(2).dll
2011-02-22 23:06:28	11080704	----a-w-	c:\windows\system32\ieframe(2)(2).dll
2011-02-22 11:41:59	385024	----a-w-	c:\windows\system32\html.iec
2011-02-15 12:56:39	290432	----a-w-	c:\windows\system32\atmfd(2)(2).dll
2011-02-09 13:53:52	270848	----a-w-	c:\windows\system32\sbe.dll
2011-02-09 13:53:52	186880	----a-w-	c:\windows\system32\encdec.dll
2011-02-02 07:58:35	2067456	----a-w-	c:\windows\system32\mstscax.dll
2011-01-27 11:57:06	677888	----a-w-	c:\windows\system32\mstsc.exe
2010-05-11 18:23:56	1699840	----a-w-	c:\program files\FreeSCAN-0.9K.msi
2010-05-02 04:58:42	212713	----a-w-	c:\program files\mp3DC211.exe
2010-05-01 01:32:10	661552	----a-w-	c:\program files\SpywareTerminatorSetup.exe
2010-05-01 00:48:45	1156877	----a-w-	c:\program files\WhatsRunning2_2_Setup.exe
2010-04-13 16:14:27	1909248	----a-w-	c:\program files\spreadsheetJune2009.msi
2010-03-30 23:46:59	5918720	----a-w-	c:\program files\mbam-setup-1.45.exe
2010-03-23 01:16:37	22649132	----a-w-	c:\program files\VideoThangTM_Installer_2.1.0.exe
2010-03-18 03:33:58	708658	----a-w-	c:\program files\ypops-win-0.9.7.3.exe
2010-02-06 00:07:12	9918872	----a-w-	c:\program files\WMEncoder.exe
2010-02-05 18:26:24	16205198	----a-w-	c:\program files\PhotoScapeSetup_V3.4.exe
2010-02-05 18:22:54	10798000	----a-w-	c:\program files\winamp5572_full_bundle_emusic-7plus_en-us.exe
2010-02-05 18:15:30	98180904	----a-w-	c:\program files\iTunesSetup.exe
2006-05-03 10:06:54	163328	--sh--r-	c:\windows\system32\flvDX.dll
2007-02-21 11:47:16	31232	--sh--r-	c:\windows\system32\msfDX.dll
2007-12-17 13:43:00	27648	--sh--w-	c:\windows\system32\Smab0.dll
2008-02-04 19:26:34	151040	--sh--w-	c:\windows\system32\VistaUltm.dll
.
============= FINISH: 22:53:49.21 ===============

Ok and I don't have ark.txt but I assume it is the GMER file so I will post that...if not correct then please let me know.

GMER 1.0.15.15570 - http://www.gmer.net
Rootkit scan 2011-04-27 07:50:05
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 WDC_WD800VE-00KWT0 rev.01.03K01
Running: gmer.exe; Driver: C:\DOCUME~1\Kickrz\LOCALS~1\Temp\awtyraoc.sys

---- Kernel code sections - GMER 1.0.15 ----

? C:\DOCUME~1\Kickrz\LOCALS~1\Temp\mbr.sys The system cannot find the file specified. !

---- EOF - GMER 1.0.15 ----

Hope that helps....I miss my computer


----------



## kickrz (Jul 30, 2003)

Bumping  My computer is my phone and I need my phone!


----------



## kickrz (Jul 30, 2003)

Can someone please ... Pretty please help me. I miss my computer so much and there are people getting help after only 1 day while others are still waiting. I know it gets busy and there is so much going on but I am so lost without my phone and my computer.


----------



## kickrz (Jul 30, 2003)

I am scrambling here trying to figure this out. I ran spysweeper and it says it foind 23 threats and 1 trojan. It was Trojan.Gen but I couldn't do anything with it since it said I needed to subscribe to remove threats. I then ran malware bytes and after waiting almost 2 hours I went to bed and let it run. When I woke up this morning my computer had restarted and was sitting on the same blue welcome screen. I went into malware bytes to see if I could pull the history but now I can't even open it. It gives me an error "vbaccelerator SGrid II Control then says Run-time error "0"I click ok and then I get run-time error "440" Automation Error.. so now I have no idea if it found the same trojan or what it found.

I just installed Avast and am trying to run it. Hopefully it doesn't restart on me and I miss it. If no one can help can you at least give me an idea of something I can download or run or tells me how and what to edit my registry. I am afraid with all these errors I am doing more damage then good 

So Avast found nothing however I uninstall mbam and reinstalled it and it kept all the old logs! It says I had 3 infections that were quarantined and deleted. They were Trojan.Dropper!

I guess that is a start....However when mbam rebooted it still hung so does that mean even though the viruses may be gone the damage is still done?


----------



## Cookiegal (Aug 27, 2003)

Pleae post the MalwareBytes log so I can see what it found.


----------



## kickrz (Jul 30, 2003)

OMG I am here but not at home with my laptop! I will be home in about 4 hours so please please don't leave me..LOL.

Promise to post it ASAP when I get home.


----------



## Cookiegal (Aug 27, 2003)

I should be around later on.


----------



## kickrz (Jul 30, 2003)

I AM HEEERRREE!!

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4110

Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 8.0.6001.18702

4/29/2011 6:34:18 AM
mbam-log-2011-04-29 (06-34-18).txt

Scan type: Full scan (C:\|)
Objects scanned: 259502
Time elapsed: 3 hour(s), 22 minute(s), 47 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\Kickrz\Local Settings\temp\0.20646126746806137.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Kickrz\Local Settings\temp\0.1980939779167078.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Kickrz\Local Settings\temp\0.9637910085712056.exe (Trojan.Dropper) -> Quarantined and deleted successfully.


----------



## Cookiegal (Aug 27, 2003)

Please download *TFC* by OldTimer to your desktop.

Double-click *TFC.exe* to run it. (If you are running Vista then right-click on the file and select *Run As Administrator*).
*Note: It will close all programs when you run it so make sure you have saved everything you may have been working on before you begin.*
Click the *Start* button to begin the process. It should only take a short time so let it run uninterrupted until it's finished. 
When it's finished it should reboot your machine. If it doesn't then please reboot manually to be sure everything is cleared.

The database for MBAM is very old. Please update it and then run a new scan and post the new log.


----------



## kickrz (Jul 30, 2003)

Ok I will download TFC but I cannot update MBAM as I have no internet connection. Is there a way to download the updates manually.

ETA: Ok the TFC is still going and I was able to find the manual update for MBAM. Now do I need to do a FULL scan cause that is 3 hours again or will a quick scan be ok?


----------



## Cookiegal (Aug 27, 2003)

You can start off with a Quick Scan and we'll take it from there.


----------



## kickrz (Jul 30, 2003)

Ok so when I rebooted it still hung on the windows screen. I update and ran MBAM athough it is still 9 days out.

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6408

Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 8.0.6001.18702

4/29/2011 6:16:40 PM
mbam-log-2011-04-29 (18-16-40).txt

Scan type: Quick scan
Objects scanned: 177836
Time elapsed: 9 minute(s), 12 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


----------



## Cookiegal (Aug 27, 2003)

What happens when you try to connect to the Internet?


----------



## kickrz (Jul 30, 2003)

There is no option to even get on the internet in safe mode...if there is I don't know how to access it. When I try to log on safe mode with networking it hangs the same as a regular boot.


----------



## Cookiegal (Aug 27, 2003)

You can't log into Windows normally at all? I thought you could sometimes but that's no longer the case?


----------



## Cookiegal (Aug 27, 2003)

Try another system restore to before this happened.


----------



## kickrz (Jul 30, 2003)

No longer. I got on once but no more. When I did the system restore back to Feb 1st I got in but everything locked up and since then no more. I tried to do a system restore again to see if I could get on but the only thing that works is safe mode.


----------



## Cookiegal (Aug 27, 2003)

OK. Thanks.

You can download this program to a flash drive and transfer it over.

Download *OTS.exe * to your Desktop. 

Close any open browsers.
If your Real protection or Antivirus interferes with OTS, allow it to run.
Double-click on *OTS.exe* to start the program.
In *Additional Scans *section put a check in Disabled MS Config Items and EventViewer logs
Now click the *Run Scan *button on the toolbar.
Let it run unhindered until it finishes.
When the scan is complete Notepad will open with the report file loaded in it.
Save that notepad file.
Use the *Reply* button, scroll down to the attachments section and attach the notepad file here.


----------



## kickrz (Jul 30, 2003)

Ok here is the file


----------



## TerryNet (Mar 23, 2005)

> There is no option to even get on the internet in safe mode..


I'm a little (lot?) late with this, but there is a *Safe Mode with Networking* option. Same as Safe Mode except that the networking drivers are also loaded.


----------



## kickrz (Jul 30, 2003)

I can't get in that way for some reason. When I select that option it hangs on the blue windows screen as well. I haven't tried the other safe mode options other then safe mode and safe mode with networking.

Well everyone is probably gone to bed and I am heading there to. But before I go here is the complete MBAM log.

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6408

Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 8.0.6001.18702

4/29/2011 11:33:19 PM
mbam-log-2011-04-29 (23-33-19).txt

Scan type: Full scan (C:\|)
Objects scanned: 267573
Time elapsed: 2 hour(s), 38 minute(s), 25 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


----------



## kickrz (Jul 30, 2003)

Last night before bed I did another system restore to see if I could get in and I did however I just keep getting windows errors. After I click Don't Send the next one pops up. 

Microsoft Windows

The system has recovered from a serious error.

The last time I got in I tried to run antivirus at this point and that is when the whole computer locked up and I had to restart. I am not touching anything else at this point so hopefully this is a step in the right direction.


----------



## Cookiegal (Aug 27, 2003)

TerryNet said:


> I'm a little (lot?) late with this, but there is a *Safe Mode with Networking* option. Same as Safe Mode except that the networking drivers are also loaded.


I was going to suggest that but they did say they had tried it and it just hung up so they couldn't get it to boot.


----------



## Cookiegal (Aug 27, 2003)

kickrz said:


> Last night before bed I did another system restore to see if I could get in and I did however I just keep getting windows errors. After I click Don't Send the next one pops up.
> 
> Microsoft Windows
> 
> ...


OK, I was hoping for the Internet connection which we got as that will help us greatly. We can deal with errors and such after.

Please visit *Combofix Guide & Instructions * for instructions for installing the recovery console and downloading and running ComboFix.

The only thing different from the instructions there is that when downloading and saving the ComboFix.exe I would like you to rename it to puppy.exe please.

Post the log from ComboFix when you've accomplished that along with a new HijackThis log.

Important notes regarding ComboFix:

ComboFix may reset a number of Internet Explorer's settings, including making it the default browser. This can easily be changed once we're finished.

ComboFix also prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you, please let me know. This can be undone manually when we're finished. Read  *HERE * for an article written by dvk01 on why we disable autoruns.


----------



## kickrz (Jul 30, 2003)

I am still "in" and ran MBAM again...should I be updating my other logs or should they be the same.


----------



## Cookiegal (Aug 27, 2003)

You can just go ahead with ComboFix please.


----------



## kickrz (Jul 30, 2003)

Ok I am doing that now...thanks


----------



## kickrz (Jul 30, 2003)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:19:53 AM, on 4/30/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Sunbelt Software\VIPRE\SBPIMSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe
C:\Program Files\HiYo\bin\HiYo.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\HijackThis\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O1 - Hosts: 74.208.10.249 gs.apple.com
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Foxit PDF Creator Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SBAMTray] "C:\Program Files\Sunbelt Software\VIPRE\SBAMTray.exe"
O4 - HKLM\..\Run: [Monitor] "C:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Hiyo] C:\Program Files\HiYo\bin\HiYo.exe /RunFromStartup
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\WebrootSecurity\SpySweeperUI.exe" /startintray
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [cdloader] "C:\Documents and Settings\Kickrz\Application Data\mjusbsp\cdloader2.exe" MAGICJACK
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\PROGRA~1\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1265376705171
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1273110928250
O16 - DPF: {BEA7310D-06C4-4339-A784-DC3804819809} (Photo Upload Plugin Class) - http://www.walmartphotocentre.ca/upload/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab
O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LeapFrog Connect Device Service - LeapFrog Enterprises, Inc. - C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: VIPRE Antivirus (SBAMSvc) - Sunbelt Software - C:\Program Files\Sunbelt Software\VIPRE\SBAMSvc.exe
O23 - Service: SB Recovery Service (SBPIMSvc) - Sunbelt Software - C:\Program Files\Sunbelt Software\VIPRE\SBPIMSvc.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. (www.webroot.com) - C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe
O23 - Service: Webroot Client Service (WRConsumerService) - Webroot Software, Inc. - C:\Program Files\Webroot\WebrootSecurity\WRConsumerService.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--
End of file - 7342 bytes

ComboFix 11-04-29.03 - Kickrz 04/30/2011 10:06:14.3.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.689 [GMT -4:00]
Running from: c:\documents and settings\Kickrz\Desktop\puppy.exe
AV: Sunbelt VIPRE *Disabled/Updated* {964FCE60-0B18-4D30-ADD6-EB178909041C}
AV: Webroot AntiVirus with Spy Sweeper *Disabled/Outdated* {77E10C7F-2CCA-4187-9394-BDBC267AD597}
.
.
((((((((((((((((((((((((( Files Created from 2011-03-28 to 2011-04-30 )))))))))))))))))))))))))))))))
.
.
2011-04-30 12:10 . 2011-04-30 12:10	775168	----a-w-	c:\windows\isRS-000.tmp
2011-04-30 12:10 . 2011-04-30 12:10	--------	d-----w-	c:\program files\MSSOAP
2011-04-30 12:09 . 2009-11-06 19:19	1563008	----a-w-	c:\windows\WRSetup.dll
2011-04-30 12:09 . 2011-04-30 12:12	--------	d-----w-	c:\documents and settings\All Users\Application Data\Webroot
2011-04-30 12:09 . 2011-04-30 12:09	--------	d-----w-	c:\program files\Webroot
2011-04-30 12:09 . 2011-04-30 12:09	--------	d-----w-	c:\documents and settings\Kickrz\Application Data\Webroot
2011-04-30 05:31 . 2011-04-30 05:31	--------	d-----w-	c:\windows\LastGood
2011-04-30 05:25 . 2011-04-30 05:25	--------	d-----w-	c:\windows\system32\wbem\Repository
2011-04-30 05:07 . 2011-04-30 05:07	--------	d-----w-	c:\documents and settings\Kickrz\Application Data\FreeFileOpener
2011-04-30 05:01 . 2011-04-30 05:01	--------	d-----w-	c:\documents and settings\Kickrz\Local Settings\Application Data\Deployment
2011-04-30 04:00 . 2011-04-30 12:03	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2011-04-30 03:58 . 2011-04-30 03:58	--------	d-----w-	c:\windows\7E7D778E121D4BBDBA29FAA81B9FBD8C.TMP
2011-04-30 03:58 . 2011-04-30 03:58	--------	d-----w-	c:\windows\8A83AE5FF59B4E1FBF2A49185A42ED1B.TMP
2011-04-30 03:58 . 2011-04-30 03:58	--------	d-----w-	c:\windows\BB77DC4CB8184FD48D1D5D3B617B78B4.TMP
2011-04-30 03:58 . 2011-04-30 03:58	--------	d-----w-	c:\windows\CC33E708A7954AB3908A8F45919BC097.TMP
2011-04-30 03:58 . 2011-04-30 03:58	--------	d--h--w-	c:\windows\msdownld.tmp
2011-04-27 20:49 . 2011-04-30 04:04	--------	d-----w-	C:\35c48c3876ce67c68d3718b079b6
2011-04-27 01:09 . 2011-04-30 04:06	--------	d-s---w-	c:\documents and settings\Administrator
2011-04-25 22:47 . 2011-04-25 22:47	--------	d-----w-	c:\documents and settings\NetworkService\IETldCache
2011-04-14 07:39 . 2011-03-12 16:28	103864	----a-w-	c:\program files\Internet Explorer\PLUGINS\nppdf32.dll
2011-04-06 21:08 . 2011-04-30 05:07	--------	d-----w-	c:\program files\FreeFileOpener
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-09 23:10 . 2011-03-09 23:10	102400	----a-w-	c:\windows\RegBootClean.exe
2011-03-07 05:33 . 2010-02-05 00:42	692736	----a-w-	c:\windows\system32\inetcomm.dll
2011-03-04 06:37 . 2003-03-31 12:00	420864	----a-w-	c:\windows\system32\vbscript.dll
2011-03-03 13:21 . 2003-03-31 12:00	1857920	----a-w-	c:\windows\system32\win32k.sys
2011-02-22 23:06 . 2003-03-31 12:00	916480	----a-w-	c:\windows\system32\wininet.dll
2011-02-22 23:06 . 2003-03-31 12:00	43520	----a-w-	c:\windows\system32\licmgr10.dll
2011-02-22 23:06 . 2003-03-31 12:00	1469440	------w-	c:\windows\system32\inetcpl.cpl
2011-02-22 11:41 . 2004-08-04 05:59	385024	----a-w-	c:\windows\system32\html.iec
2011-02-17 13:18 . 2003-03-31 12:00	455936	----a-w-	c:\windows\system32\drivers\mrxsmb.sys
2011-02-17 13:18 . 2003-03-31 12:00	357888	----a-w-	c:\windows\system32\drivers\srv.sys
2011-02-17 12:32 . 2010-02-05 15:19	5120	----a-w-	c:\windows\system32\xpsp4res.dll
2011-02-15 12:56 . 2003-03-31 12:00	290432	----a-w-	c:\windows\system32\atmfd.dll
2011-02-09 13:53 . 2003-03-31 12:00	270848	----a-w-	c:\windows\system32\sbe.dll
2011-02-09 13:53 . 2003-03-31 12:00	186880	----a-w-	c:\windows\system32\encdec.dll
2011-02-08 13:33 . 2003-03-31 12:00	978944	----a-w-	c:\windows\system32\mfc42.dll
2011-02-08 13:33 . 2003-03-31 12:00	974848	----a-w-	c:\windows\system32\mfc42u.dll
2011-02-02 07:58 . 2010-02-05 00:40	2067456	----a-w-	c:\windows\system32\mstscax.dll
2010-05-11 18:23 . 2010-05-11 18:23	1699840	----a-w-	c:\program files\FreeSCAN-0.9K.msi
2010-05-02 04:58 . 2010-05-02 04:58	212713	----a-w-	c:\program files\mp3DC211.exe
2010-05-01 01:32 . 2010-05-01 01:32	661552	----a-w-	c:\program files\SpywareTerminatorSetup.exe
2010-05-01 00:48 . 2010-05-01 00:48	1156877	----a-w-	c:\program files\WhatsRunning2_2_Setup.exe
2010-04-13 16:14 . 2010-04-13 16:14	1909248	----a-w-	c:\program files\spreadsheetJune2009.msi
2010-03-30 23:46 . 2010-03-30 23:46	5918720	----a-w-	c:\program files\mbam-setup-1.45.exe
2010-03-23 01:16 . 2010-03-23 01:16	22649132	----a-w-	c:\program files\VideoThangTM_Installer_2.1.0.exe
2010-03-18 03:33 . 2010-03-18 03:33	708658	----a-w-	c:\program files\ypops-win-0.9.7.3.exe
2010-02-06 00:07 . 2010-02-06 00:07	9918872	----a-w-	c:\program files\WMEncoder.exe
2010-02-05 18:26 . 2010-02-05 18:26	16205198	----a-w-	c:\program files\PhotoScapeSetup_V3.4.exe
2010-02-05 18:22 . 2010-02-05 18:22	10798000	----a-w-	c:\program files\winamp5572_full_bundle_emusic-7plus_en-us.exe
2010-02-05 18:15 . 2010-02-05 18:15	98180904	----a-w-	c:\program files\iTunesSetup.exe
2006-05-03 10:06	163328	--sh--r-	c:\windows\system32\flvDX.dll
2007-02-21 11:47	31232	--sh--r-	c:\windows\system32\msfDX.dll
2007-12-17 13:43	27648	--sh--w-	c:\windows\system32\Smab0.dll
2008-02-04 19:26	151040	--sh--w-	c:\windows\system32\VistaUltm.dll
.
.
((((((((((((((((((((((((((((( [email protected]_00.23.29 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-01-11 14:59 . 2011-01-11 14:59	51024 c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_214ee422\vcomp90.dll
+ 2011-01-11 14:59 . 2011-01-11 14:59	59728 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90rus.dll
+ 2011-01-11 14:59 . 2011-01-11 14:59	42832 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90kor.dll
+ 2011-01-11 14:59 . 2011-01-11 14:59	43344 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90jpn.dll
+ 2011-01-11 14:59 . 2011-01-11 14:59	61264 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90ita.dll
+ 2011-01-11 14:59 . 2011-01-11 14:59	62800 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90fra.dll
+ 2011-01-11 14:59 . 2011-01-11 14:59	61776 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90esp.dll
+ 2011-01-11 14:59 . 2011-01-11 14:59	61776 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90esn.dll
+ 2011-01-11 14:59 . 2011-01-11 14:59	53584 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90enu.dll
+ 2011-01-11 14:59 . 2011-01-11 14:59	63312 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90deu.dll
+ 2011-01-11 14:59 . 2011-01-11 14:59	36688 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90cht.dll
+ 2011-01-11 14:59 . 2011-01-11 14:59	35664 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90chs.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05	62976 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90rus.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05	46080 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90kor.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05	46592 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90jpn.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05	64512 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90ita.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05	66048 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90fra.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05	65024 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90esp.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05	65024 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90esn.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05	56832 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90enu.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05	66560 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90deu.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05	39936 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90cht.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05	38912 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90chs.dll
+ 2011-01-11 14:59 . 2011-01-11 14:59	59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_d5fe2ecb\mfcm90u.dll
+ 2011-01-11 14:59 . 2011-01-11 14:59	59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_d5fe2ecb\mfcm90.dll
+ 2008-07-29 10:07 . 2008-07-29 10:07	59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfcm90u.dll
+ 2008-07-29 10:07 . 2008-07-29 10:07	59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfcm90.dll
+ 2008-07-29 10:07 . 2008-07-29 10:07	80896 c:\windows\WinSxS\x86_Microsoft.VC90.DebugMFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_c94a3a24\mfcm90ud.dll
+ 2008-07-29 10:07 . 2008-07-29 10:07	80896 c:\windows\WinSxS\x86_Microsoft.VC90.DebugMFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_c94a3a24\mfcm90d.dll
+ 2011-01-11 03:03 . 2011-01-11 03:03	65536 c:\windows\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.5592_x-ww_189d6662\vcomp.dll
+ 2011-01-11 02:32 . 2011-01-11 02:32	49152 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.5592_x-ww_3dcd24cb\mfc80KOR.dll
+ 2011-01-11 02:32 . 2011-01-11 02:32	49152 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.5592_x-ww_3dcd24cb\mfc80JPN.dll
+ 2011-01-11 02:32 . 2011-01-11 02:32	61440 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.5592_x-ww_3dcd24cb\mfc80ITA.dll
+ 2011-01-11 02:32 . 2011-01-11 02:32	61440 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.5592_x-ww_3dcd24cb\mfc80FRA.dll
+ 2011-01-11 02:32 . 2011-01-11 02:32	61440 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.5592_x-ww_3dcd24cb\mfc80ESP.dll
+ 2011-01-11 02:32 . 2011-01-11 02:32	57344 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.5592_x-ww_3dcd24cb\mfc80ENU.dll
+ 2011-01-11 02:32 . 2011-01-11 02:32	65536 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.5592_x-ww_3dcd24cb\mfc80DEU.dll
+ 2011-01-11 02:32 . 2011-01-11 02:32	45056 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.5592_x-ww_3dcd24cb\mfc80CHT.dll
+ 2011-01-11 02:32 . 2011-01-11 02:32	40960 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.5592_x-ww_3dcd24cb\mfc80CHS.dll
+ 2011-01-11 08:05 . 2011-01-11 08:05	57856 c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.5592_x-ww_e87e0bcd\mfcm80u.dll
+ 2011-01-11 08:23 . 2011-01-11 08:23	69632 c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.5592_x-ww_e87e0bcd\mfcm80.dll
+ 2011-01-11 01:21 . 2011-01-11 01:21	97280 c:\windows\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.5592_x-ww_7837863c\ATL80.dll
+ 2008-09-30 20:45 . 2008-09-30 20:45	91656 c:\windows\WinSxS\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.1.0_x-ww_2a41bceb\msxml4r.dll
+ 2010-04-06 22:34 . 2010-04-06 22:34	82432 c:\windows\WinSxS\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a\msxml4r.dll
+ 2011-04-30 05:29 . 2011-04-30 05:29	16384 c:\windows\temp\Perflib_Perfdata_7f0.dat
+ 2010-06-15 03:21 . 2004-01-25 04:00	70656 c:\windows\system32\yv12vfw.dll
+ 2006-09-28 22:56 . 2006-09-28 22:56	55808 c:\windows\system32\WudfSvc.dll
+ 2006-09-29 00:13 . 2006-09-29 00:13	95344 c:\windows\system32\WUDFCoinstaller.dll
+ 2009-11-06 16:00 . 2009-11-06 16:00	31088 c:\windows\system32\wrLZMA.dll
+ 2009-01-31 00:35 . 2009-01-31 00:35	38400 c:\windows\system32\wpdshextres.dll
+ 2009-01-30 21:21 . 2009-01-30 21:21	17408 c:\windows\system32\wpdshextautoplay.exe
+ 2005-01-28 18:44 . 2009-01-31 00:35	63488 c:\windows\system32\wpdmtpus.dll
+ 2005-01-28 18:44 . 2009-01-31 00:35	35840 c:\windows\system32\wpdconns.dll
+ 2003-03-31 12:00 . 2009-01-31 00:34	99840 c:\windows\system32\wmpshell.dll
+ 2003-03-31 12:00 . 2009-01-31 00:34	37376 c:\windows\system32\wmdmps.dll
+ 2003-03-31 12:00 . 2009-01-31 00:34	33792 c:\windows\system32\wmdmlog.dll
+ 2010-02-05 15:33 . 2010-11-03 13:12	46080 c:\windows\system32\tzchange.exe
- 2010-02-05 15:33 . 2010-01-23 08:11	46080 c:\windows\system32\tzchange.exe
+ 2010-05-06 00:48 . 2003-01-26 17:41	40960 c:\windows\system32\ssubtmr6.dll
+ 2009-11-06 16:00 . 2009-11-06 16:00	16240 c:\windows\system32\SsiEfr.exe
+ 2003-03-31 12:00 . 2010-08-27 05:57	99840 c:\windows\system32\srvsvc.dll
+ 2003-03-31 12:00 . 2010-08-17 13:17	58880 c:\windows\system32\spoolsv.exe
+ 2010-07-16 03:02 . 2010-07-05 13:15	17272 c:\windows\system32\spmsg.dll
+ 2010-08-20 14:18 . 2010-08-20 14:18	27984 c:\windows\system32\sbbd.exe
+ 2011-01-29 02:47 . 2010-04-20 00:47	41984 c:\windows\system32\ReinstallBackups\0009\DriverFiles\usbaapl.sys
+ 2010-10-14 23:05 . 2009-08-29 00:42	40448 c:\windows\system32\ReinstallBackups\0008\DriverFiles\usbaapl.sys
+ 2010-08-23 02:41 . 2008-04-13 18:45	15104 c:\windows\system32\ReinstallBackups\0004\DriverFiles\i386\usbscan.sys
+ 2010-03-31 04:16 . 2010-03-31 04:16	99176 c:\windows\system32\PresentationHostProxy.dll
+ 2003-03-31 12:00 . 2011-04-26 07:17	92232 c:\windows\system32\perfc009.dat
+ 2004-03-24 03:12 . 2004-03-24 03:12	35840 c:\windows\system32\nvwddi.dll
- 2003-08-01 04:08 . 2003-08-01 04:08	77824 c:\windows\system32\nvsvc32.exe
+ 2003-08-01 04:08 . 2004-03-24 03:12	77824 c:\windows\system32\nvsvc32.exe
+ 2003-08-01 04:08 . 2004-03-24 03:12	73728 c:\windows\system32\nvrszht.dll
+ 2003-08-01 04:08 . 2004-03-24 03:12	46080 c:\windows\system32\nvmctray.dll
+ 2004-03-24 03:12 . 2004-03-24 03:12	32256 c:\windows\system32\nvcodins.dll
+ 2004-03-24 03:12 . 2004-03-24 03:12	32256 c:\windows\system32\nvcod.dll
+ 2009-11-07 05:07 . 2009-11-07 05:07	49488 c:\windows\system32\netfxperf.dll
+ 2009-11-07 05:07 . 2009-11-07 05:07	11600 c:\windows\system32\mui\0409\mscorees.dll
+ 2002-02-04 06:43 . 2002-02-04 06:43	82432 c:\windows\system32\msxml4r.dll
+ 2004-08-04 07:56 . 2009-01-31 00:33	27136 c:\windows\system32\mspmsnsv.dll
+ 2003-03-31 12:00 . 2011-02-22 23:06	66560 c:\windows\system32\mshtmled.dll
- 2003-03-31 12:00 . 2009-03-08 09:31	66560 c:\windows\system32\mshtmled.dll
+ 2009-03-08 09:31 . 2011-02-22 23:06	55296 c:\windows\system32\msfeedsbs.dll
- 2009-03-08 09:31 . 2009-12-21 19:14	55296 c:\windows\system32\msfeedsbs.dll
+ 2010-10-15 11:45 . 2010-10-15 11:45	55748 c:\windows\system32\mlfcache.dat
+ 2003-05-02 00:06 . 2003-05-02 00:06	59392 c:\windows\system32\lfwmf11n.dll
+ 2003-05-02 00:06 . 2003-05-02 00:06	27648 c:\windows\system32\lftga11n.dll
+ 2003-05-02 00:06 . 2003-05-02 00:06	56320 c:\windows\system32\lfpsd11n.dll
+ 2003-05-02 00:06 . 2003-05-02 00:06	33280 c:\windows\system32\lfpcx11n.dll
+ 2003-05-02 00:06 . 2003-05-02 00:06	26112 c:\windows\system32\lfpcd11n.dll
+ 2003-05-02 00:06 . 2003-05-02 00:06	41472 c:\windows\system32\lfgif11n.dll
+ 2003-05-02 00:06 . 2003-05-02 00:06	81408 c:\windows\system32\lffax11n.dll
+ 2003-05-02 00:06 . 2003-05-02 00:06	31232 c:\windows\system32\lfeps11n.dll
+ 2003-05-02 00:06 . 2003-05-02 00:06	36864 c:\windows\system32\lfbmp11n.dll
+ 2003-03-31 12:00 . 2009-01-31 00:33	11264 c:\windows\system32\LAPRXY.dll
+ 2003-03-31 12:00 . 2011-02-22 23:06	25600 c:\windows\system32\jsproxy.dll
- 2003-03-31 12:00 . 2009-12-21 19:14	25600 c:\windows\system32\jsproxy.dll
+ 2010-02-05 00:42 . 2010-11-18 18:12	81920 c:\windows\system32\isign32.dll
- 2010-02-05 00:42 . 2008-04-14 00:11	81920 c:\windows\system32\isign32.dll
- 2003-03-31 12:00 . 2008-04-14 00:11	80384 c:\windows\system32\iccvid.dll
+ 2003-03-31 12:00 . 2010-06-17 14:03	80384 c:\windows\system32\iccvid.dll
+ 2010-06-15 03:21 . 2004-01-25 04:00	70656 c:\windows\system32\i420vfw.dll
+ 2010-09-09 18:50 . 2007-06-03 18:31	10752 c:\windows\system32\ff_vfw.dll
+ 2011-01-29 02:47 . 2010-12-14 23:51	41984 c:\windows\system32\DRVSTORE\usbaapl_A4C70B47551C2629A145AE032C4D1823570ADB7B\usbaapl.sys
+ 2011-01-29 02:47 . 2010-04-20 00:29	18432 c:\windows\system32\DRVSTORE\netaapl_8A27A03003759CB01567E831096473C330131D64\netaapl.sys
+ 2010-10-08 23:19 . 2010-01-20 19:18	33792 c:\windows\system32\DRVSTORE\leapfrog-0_B30D43972967E3C09B8E635B22BC13082452FEEA\i386\btblan.sys
+ 2010-08-23 22:59 . 2009-04-17 19:48	18304 c:\windows\system32\DRVSTORE\grmnusb_09F3E629557EBE4D2BA1A9469BDAE635AC0807AE\I386\grmngen.sys
+ 2010-04-17 17:15 . 2009-11-10 13:27	18560 c:\windows\system32\DRVSTORE\flyusb_E1B194E4380F1C20BBC476848F70DDC967C29749\i386\FlyUsb.sys
+ 2006-09-28 23:00 . 2006-09-28 23:00	82944 c:\windows\system32\drivers\WudfRd.sys
+ 2006-09-28 22:55 . 2006-09-28 22:55	77568 c:\windows\system32\drivers\WudfPf.sys
+ 2005-01-28 18:44 . 2009-01-30 21:20	38528 c:\windows\system32\drivers\wpdusb.sys
+ 2010-07-17 20:52 . 2006-09-06 14:54	11520 c:\windows\system32\drivers\WDMSTUB.sys
+ 2010-02-05 18:17 . 2010-12-14 23:51	41984 c:\windows\system32\drivers\usbaapl.sys
+ 2009-11-06 16:00 . 2009-11-06 16:00	23152 c:\windows\system32\drivers\sshrmd.sys
+ 2009-11-06 16:00 . 2009-11-06 16:00	29808 c:\windows\system32\drivers\ssfs0bbc.sys
+ 2010-06-09 17:17 . 2010-11-03 17:38	98392 c:\windows\system32\drivers\SBREDrv.sys
+ 2010-12-24 03:38 . 2010-06-14 19:54	69976 c:\windows\system32\drivers\sbapifs.sys
+ 2010-12-24 03:38 . 2010-06-14 19:54	21464 c:\windows\system32\drivers\sbaphd.sys
+ 2008-04-16 18:51 . 2008-04-16 18:51	22784 c:\windows\system32\drivers\RimUsb.sys
+ 2003-03-31 12:00 . 2010-11-02 15:17	40960 c:\windows\system32\drivers\ndproxy.sys
+ 2010-03-30 23:47 . 2010-12-20 22:09	38224 c:\windows\system32\drivers\mbamswissarmy.sys
- 2010-03-30 23:47 . 2010-03-29 19:24	38224 c:\windows\system32\drivers\mbamswissarmy.sys
+ 2010-03-30 23:47 . 2010-12-20 22:08	20952 c:\windows\system32\drivers\mbam.sys
+ 2010-04-29 04:10 . 2010-05-24 21:33	15944 c:\windows\system32\drivers\hitmanpro35.sys
+ 2010-07-17 20:37 . 2009-04-17 19:48	18304 c:\windows\system32\drivers\grmngen.sys
+ 2010-04-17 17:15 . 2009-11-10 13:27	18560 c:\windows\system32\drivers\FlyUsb.sys
- 2003-03-31 12:00 . 2008-04-13 18:40	96512 c:\windows\system32\drivers\atapi.sys
+ 2003-03-31 12:00 . 2010-04-29 04:16	96512 c:\windows\system32\drivers\atapi.sys
+ 2010-10-07 17:23 . 2010-10-07 17:23	91424 c:\windows\system32\dnssd.dll
- 2003-03-31 12:00 . 2008-04-14 00:11	45568 c:\windows\system32\dnsrslvr.dll
+ 2003-03-31 12:00 . 2009-04-20 17:17	45568 c:\windows\system32\dnsrslvr.dll
+ 2010-02-05 16:13 . 2011-02-22 23:06	12800 c:\windows\system32\dllcache\xpshims.dll
- 2010-02-05 16:13 . 2009-12-21 19:14	12800 c:\windows\system32\dllcache\xpshims.dll
+ 2010-02-05 15:34 . 2009-01-31 00:34	99840 c:\windows\system32\dllcache\wmpshell.dll
+ 2010-02-05 15:34 . 2009-01-31 00:30	64512 c:\windows\system32\dllcache\wmplayer.exe
+ 2010-02-05 15:34 . 2009-01-31 00:34	96256 c:\windows\system32\dllcache\wmpband.dll
+ 2003-03-31 12:00 . 2009-01-31 00:34	37376 c:\windows\system32\dllcache\wmdmps.dll
+ 2003-03-31 12:00 . 2009-01-31 00:34	33792 c:\windows\system32\dllcache\wmdmlog.dll
+ 2010-12-15 13:35 . 2010-10-11 14:59	45568 c:\windows\system32\dllcache\wab.exe
+ 2010-08-27 05:57 . 2010-08-27 05:57	99840 c:\windows\system32\dllcache\srvsvc.dll
+ 2010-08-17 13:17 . 2010-08-17 13:17	58880 c:\windows\system32\dllcache\spoolsv.exe
+ 2010-12-15 13:37 . 2010-11-02 15:17	40960 c:\windows\system32\dllcache\ndproxy.sys
+ 2004-08-04 07:56 . 2009-01-31 00:33	27136 c:\windows\system32\dllcache\mspmsnsv.dll
- 2009-03-08 09:31 . 2009-03-08 09:31	66560 c:\windows\system32\dllcache\mshtmled.dll
+ 2009-03-08 09:31 . 2011-02-22 23:06	66560 c:\windows\system32\dllcache\mshtmled.dll
+ 2010-02-05 16:13 . 2011-02-22 23:06	55296 c:\windows\system32\dllcache\msfeedsbs.dll
- 2010-02-05 16:13 . 2009-12-21 19:14	55296 c:\windows\system32\dllcache\msfeedsbs.dll
+ 2009-03-08 09:34 . 2011-02-22 23:06	43520 c:\windows\system32\dllcache\licmgr10.dll
+ 2003-03-31 12:00 . 2009-01-31 00:33	11264 c:\windows\system32\dllcache\LAPRXY.dll
- 2009-03-08 09:33 . 2009-12-21 19:14	25600 c:\windows\system32\dllcache\jsproxy.dll
+ 2009-03-08 09:33 . 2011-02-22 23:06	25600 c:\windows\system32\dllcache\jsproxy.dll
+ 2010-11-18 18:12 . 2010-11-18 18:12	81920 c:\windows\system32\dllcache\isign32.dll
+ 2009-04-20 17:17 . 2009-04-20 17:17	45568 c:\windows\system32\dllcache\dnsrslvr.dll
+ 2009-12-14 07:08 . 2010-12-09 14:30	33280 c:\windows\system32\dllcache\csrsrv.dll
- 2009-12-14 07:08 . 2009-12-14 07:08	33280 c:\windows\system32\dllcache\csrsrv.dll
+ 2009-12-22 18:39 . 2009-12-22 18:39	62592 c:\windows\system32\dllcache\cdrom.sys
+ 2010-01-13 14:01 . 2010-01-13 14:01	86016 c:\windows\system32\dllcache\cabview.dll
+ 2003-03-31 12:00 . 2010-04-29 04:16	96512 c:\windows\system32\dllcache\atapi.sys
+ 2010-03-05 14:37 . 2010-03-05 14:37	65536 c:\windows\system32\dllcache\asycfilt.dll
- 2003-03-31 12:00 . 2009-12-14 07:08	33280 c:\windows\system32\csrsrv.dll
+ 2003-03-31 12:00 . 2010-12-09 14:30	33280 c:\windows\system32\csrsrv.dll
+ 2010-02-05 00:46 . 2011-04-29 02:00	32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2010-02-05 00:46 . 2010-02-05 15:57	32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2011-04-29 02:03 . 2011-04-29 02:00	16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2010-02-05 00:46 . 2010-02-05 15:57	16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2003-03-31 12:00 . 2010-01-13 14:01	86016 c:\windows\system32\cabview.dll
+ 2010-06-15 03:21 . 2005-07-14 16:31	27648 c:\windows\system32\AVSredirect.dll
+ 2003-03-31 12:00 . 2010-03-05 14:37	65536 c:\windows\system32\asycfilt.dll
+ 2010-06-15 03:21 . 2006-04-05 12:09	66560 c:\windows\MOTA113.exe
- 2008-07-30 00:16 . 2008-07-30 00:16	32768 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\System.ServiceModel.WasHosting.dll
+ 2010-04-08 03:48 . 2010-04-08 03:48	32768 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\System.ServiceModel.WasHosting.dll
+ 2009-11-07 05:07 . 2009-11-07 05:07	13648 c:\windows\Microsoft.NET\Framework\v2.0.50727\sbscmp20_mscorlib.dll
+ 2010-09-22 13:43 . 2010-09-22 13:43	30544 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe
+ 2009-11-07 05:07 . 2009-11-07 05:07	13648 c:\windows\Microsoft.NET\Framework\SharedReg12.dll
+ 2009-11-07 05:07 . 2009-11-07 05:07	13648 c:\windows\Microsoft.NET\Framework\sbscmp20_perfcounter.dll
+ 2009-11-07 05:07 . 2009-11-07 05:07	13648 c:\windows\Microsoft.NET\Framework\sbscmp20_mscorwks.dll
+ 2009-11-07 05:07 . 2009-11-07 05:07	13648 c:\windows\Microsoft.NET\Framework\sbscmp10.dll
+ 2009-11-07 05:07 . 2009-11-07 05:07	13664 c:\windows\Microsoft.NET\Framework\sbs_wminet_utils.dll
+ 2009-11-07 05:07 . 2009-11-07 05:07	13688 c:\windows\Microsoft.NET\Framework\sbs_system.enterpriseservices.dll
+ 2009-11-07 05:07 . 2009-11-07 05:07	13664 c:\windows\Microsoft.NET\Framework\sbs_system.data.dll
+ 2009-11-07 05:07 . 2009-11-07 05:07	13696 c:\windows\Microsoft.NET\Framework\sbs_system.configuration.install.dll
+ 2009-11-07 05:07 . 2009-11-07 05:07	13656 c:\windows\Microsoft.NET\Framework\sbs_mscorsec.dll
+ 2009-11-07 05:07 . 2009-11-07 05:07	13656 c:\windows\Microsoft.NET\Framework\sbs_mscorrc.dll
+ 2009-11-07 05:07 . 2009-11-07 05:07	13656 c:\windows\Microsoft.NET\Framework\sbs_mscordbi.dll
+ 2009-11-07 05:07 . 2009-11-07 05:07	13672 c:\windows\Microsoft.NET\Framework\sbs_microsoft.jscript.dll
+ 2009-11-07 05:07 . 2009-11-07 05:07	13664 c:\windows\Microsoft.NET\Framework\sbs_diasymreader.dll
+ 2009-11-07 05:07 . 2009-11-07 05:07	86864 c:\windows\Microsoft.NET\Framework\NETFXSBS10.exe
+ 2010-04-24 03:37 . 2010-04-24 03:37	49664 c:\windows\Installer\f30e2f.msi
+ 2010-10-14 17:37 . 2010-10-14 17:37	21504 c:\windows\Installer\8a7279b.msi
+ 2010-08-23 22:59 . 2010-08-23 22:59	84480 c:\windows\Installer\459339b.msi
+ 2010-04-06 22:37 . 2010-04-06 22:37	40960 c:\windows\Installer\{FB98D390-54A4-4CD1-93D3-FBC96A6F07A3}\ARPPRODUCTICON.exe
+ 2010-12-24 03:29 . 2010-12-24 03:29	71040 c:\windows\Installer\{F9D06C1D-EEB6-443A-B5BE-63CE1A5C1290}\NewShortcut21_339C927BB4B547F9804FDF51F01D2D57.exe
+ 2010-12-24 03:29 . 2010-12-24 03:29	71040 c:\windows\Installer\{F9D06C1D-EEB6-443A-B5BE-63CE1A5C1290}\NewShortcut2_339C927BB4B547F9804FDF51F01D2D57.exe
+ 2010-04-08 07:00 . 2010-04-08 07:00	32768 c:\windows\Installer\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}\icon.exe
+ 2010-11-27 02:49 . 2010-11-27 02:49	29184 c:\windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C240BF}\IconCD95F6617.exe
+ 2011-01-29 02:48 . 2011-01-29 02:48	27136 c:\windows\Installer\{C41300B9-185D-475E-BFEC-39EF732F19B1}\AppleSoftwareUpdateIco.exe
+ 2010-06-04 07:01 . 2011-04-21 07:05	49152 c:\windows\Installer\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}\ConfigIcon.dll
+ 2010-04-07 12:46 . 2010-04-07 12:46	32768 c:\windows\Installer\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}\icon.exe
+ 2011-01-17 20:28 . 2011-01-17 20:28	22486 c:\windows\Installer\{788A0222-5690-4212-AA9C-C48FD0E1C9AE}\NewShortcut5_13EAD6A36F4049F188131A5F2C93BF98.exe
+ 2011-01-17 20:28 . 2011-01-17 20:28	22486 c:\windows\Installer\{788A0222-5690-4212-AA9C-C48FD0E1C9AE}\NewShortcut4_6927C36F1BD54B129BBCFE115DD41CB3.exe
+ 2011-01-17 20:28 . 2011-01-17 20:28	22486 c:\windows\Installer\{788A0222-5690-4212-AA9C-C48FD0E1C9AE}\NewShortcut3_C9197A9D0F4742FE8F5C07711E9F6FBA.exe
+ 2011-01-17 20:28 . 2011-01-17 20:28	22486 c:\windows\Installer\{788A0222-5690-4212-AA9C-C48FD0E1C9AE}\NewShortcut2_98233C0114894F9999D7FD9080DE7E73.exe
+ 2011-01-17 20:28 . 2011-01-17 20:28	22486 c:\windows\Installer\{788A0222-5690-4212-AA9C-C48FD0E1C9AE}\ARPPRODUCTICON.exe
+ 2010-06-17 17:11 . 2010-08-25 09:42	22486 c:\windows\Installer\{75AE8014-1184-4BC0-B279-C879540719EE}\NewShortcut2_D0E18D3A3D424BB5B8A236B927BBFA2C.exe
+ 2010-06-17 17:11 . 2010-08-25 09:42	22486 c:\windows\Installer\{75AE8014-1184-4BC0-B279-C879540719EE}\NewShortcut1_3278016E37314C2092483418FC03D7EE.exe
+ 2010-06-17 17:11 . 2010-08-25 09:42	22486 c:\windows\Installer\{75AE8014-1184-4BC0-B279-C879540719EE}\ARPPRODUCTICON.exe
+ 2010-05-06 02:32 . 2010-05-06 02:32	65536 c:\windows\Installer\{49FC50FC-F965-40D9-89B4-CBFF80941033}\ARPPRODUCTICON.exe
+ 2010-11-01 13:43 . 2010-11-01 13:43	25214 c:\windows\Installer\{4286E640-B5FB-11DF-AC4B-005056C00008}\UNINST_Uninstall_G_F6A848FB884248E6A4CDCBDCF41F6A74_1.exe
+ 2010-11-01 13:43 . 2010-11-01 13:43	25214 c:\windows\Installer\{4286E640-B5FB-11DF-AC4B-005056C00008}\UNINST_Uninstall_G_F6A848FB884248E6A4CDCBDCF41F6A74.exe
+ 2010-11-01 13:43 . 2010-11-01 13:43	25214 c:\windows\Installer\{4286E640-B5FB-11DF-AC4B-005056C00008}\ShortcutOGL_EB071909B9884F8CBF3D6115D4ADEE5E.exe
+ 2010-11-01 13:43 . 2010-11-01 13:43	25214 c:\windows\Installer\{4286E640-B5FB-11DF-AC4B-005056C00008}\ShortcutDX_EB071909B9884F8CBF3D6115D4ADEE5E.exe
+ 2010-11-01 13:43 . 2010-11-01 13:43	25214 c:\windows\Installer\{4286E640-B5FB-11DF-AC4B-005056C00008}\googleearth.exe1_F6A848FB884248E6A4CDCBDCF41F6A74.exe
+ 2010-11-01 13:43 . 2010-11-01 13:43	25214 c:\windows\Installer\{4286E640-B5FB-11DF-AC4B-005056C00008}\googleearth.exe_F6A848FB884248E6A4CDCBDCF41F6A74.exe
+ 2010-11-01 13:43 . 2010-11-01 13:43	25214 c:\windows\Installer\{4286E640-B5FB-11DF-AC4B-005056C00008}\ARPPRODUCTICON.exe
+ 2011-04-30 12:10 . 2011-04-30 12:10	10134 c:\windows\Installer\{3F5B6210-0903-4DC6-8034-8F488AA3A782}\ARPPRODUCTICON.exe
+ 2011-04-30 12:10 . 2011-04-30 12:10	10134 c:\windows\Installer\{32343DB6-9A52-40C9-87E4-5E7C79791C87}\ARPPRODUCTICON.exe
+ 2010-06-17 17:11 . 2011-04-01 22:09	23558 c:\windows\Installer\{18DB3375-0649-4EA3-959A-44F1ACD278BA}\NewShortcut1_FB1A4886DFA548E696F9EB9C87509AD8.exe
+ 2010-05-13 11:19 . 2010-05-13 11:19	25214 c:\windows\Installer\{18DB3375-0649-4EA3-959A-44F1ACD278BA}\NewShortcut1_BE582A2282214E84A6C4A160580195B9.exe
- 2010-02-05 17:13 . 2010-02-05 17:13	65536 c:\windows\Installer\{18DB3375-0649-4EA3-959A-44F1ACD278BA}\NewShortcut1_AE5DC8FAD49B474F8424C8285D0BE9D9.exe
+ 2010-02-05 17:13 . 2011-04-01 22:09	65536 c:\windows\Installer\{18DB3375-0649-4EA3-959A-44F1ACD278BA}\NewShortcut1_AE5DC8FAD49B474F8424C8285D0BE9D9.exe
+ 2010-02-05 17:13 . 2011-04-01 22:09	17542 c:\windows\Installer\{18DB3375-0649-4EA3-959A-44F1ACD278BA}\MagenticDesktopSho_C9EDD37560824E198F30E3A914AA0CF3.exe
+ 2010-02-05 17:13 . 2011-04-01 22:09	65536 c:\windows\Installer\{18DB3375-0649-4EA3-959A-44F1ACD278BA}\IncrediMailQuickLa_B9881DCFEEE44103B0B70238F263AEBC.exe
- 2010-02-05 17:13 . 2010-02-05 17:13	65536 c:\windows\Installer\{18DB3375-0649-4EA3-959A-44F1ACD278BA}\IncrediMailQuickLa_B9881DCFEEE44103B0B70238F263AEBC.exe
- 2010-02-05 17:13 . 2010-02-05 17:13	65536 c:\windows\Installer\{18DB3375-0649-4EA3-959A-44F1ACD278BA}\IncrediMailProgram_A88684EF7449474DB02892A444C5EBAC.exe
+ 2010-02-05 17:13 . 2011-04-01 22:09	65536 c:\windows\Installer\{18DB3375-0649-4EA3-959A-44F1ACD278BA}\IncrediMailProgram_A88684EF7449474DB02892A444C5EBAC.exe
+ 2010-02-05 17:13 . 2011-04-01 22:09	65536 c:\windows\Installer\{18DB3375-0649-4EA3-959A-44F1ACD278BA}\IncrediMailMenuFol_A2DA5AEC1C204AFCA02B199D5A54DAC2.exe
- 2010-02-05 17:13 . 2010-02-05 17:13	65536  c:\windows\Installer\{18DB3375-0649-4EA3-959A-44F1ACD278BA}\IncrediMailMenuFol_A2DA5AEC1C204AFCA02B199D5A54DAC2.exe
- 2010-02-05 17:13 . 2010-02-05 17:13	65536 c:\windows\Installer\{18DB3375-0649-4EA3-959A-44F1ACD278BA}\IncrediMailDesktop_D17BEBF4240D4B7BB561D5EC353EF0F3.exe
+ 2010-02-05 17:13 . 2011-04-01 22:09	65536 c:\windows\Installer\{18DB3375-0649-4EA3-959A-44F1ACD278BA}\IncrediMailDesktop_D17BEBF4240D4B7BB561D5EC353EF0F3.exe
- 2010-02-05 17:13 . 2010-02-05 17:13	27766 c:\windows\Installer\{18DB3375-0649-4EA3-959A-44F1ACD278BA}\GamesStartMenuShor_3723B974645C4C01AE7F3B62146B60FD.exe
+ 2010-02-05 17:13 . 2011-04-01 22:09	27766 c:\windows\Installer\{18DB3375-0649-4EA3-959A-44F1ACD278BA}\GamesStartMenuShor_3723B974645C4C01AE7F3B62146B60FD.exe
+ 2010-02-05 17:13 . 2011-04-01 22:09	25214 c:\windows\Installer\{18DB3375-0649-4EA3-959A-44F1ACD278BA}\GalleryStartMenuSh_70DD0B26371643879C8D4168168B149E.exe
- 2010-02-05 17:13 . 2010-02-05 17:13	25214 c:\windows\Installer\{18DB3375-0649-4EA3-959A-44F1ACD278BA}\GalleryStartMenuSh_70DD0B26371643879C8D4168168B149E.exe
- 2010-02-05 17:13 . 2010-02-05 17:13	25214 c:\windows\Installer\{18DB3375-0649-4EA3-959A-44F1ACD278BA}\ARPPRODUCTICON.exe
+ 2010-02-05 17:13 . 2011-04-01 22:09	25214 c:\windows\Installer\{18DB3375-0649-4EA3-959A-44F1ACD278BA}\ARPPRODUCTICON.exe
+ 2011-02-15 22:18 . 2011-02-15 22:18	14534 c:\windows\Installer\{1287B0B4-0E89-4839-B552-809D5C0DC9F6}\SystemFolder_msiexec.exe
+ 2011-02-15 22:18 . 2011-02-15 22:18	25214 c:\windows\Installer\{1287B0B4-0E89-4839-B552-809D5C0DC9F6}\StudioTax.exe
+ 2011-02-15 22:18 . 2011-02-15 22:18	26950 c:\windows\Installer\{1287B0B4-0E89-4839-B552-809D5C0DC9F6}\Overview.exe
+ 2011-02-15 22:18 . 2011-02-15 22:18	25214 c:\windows\Installer\{1287B0B4-0E89-4839-B552-809D5C0DC9F6}\controlPanelIcon.exe
+ 2010-05-13 11:40 . 2011-01-18 23:58	17542 c:\windows\Installer\{00E1E235-AB45-4695-A156-073118949ED4}\NewShortcut6_D93733619CA548BBB3075870A1681AAB.exe
+ 2010-05-13 11:40 . 2011-01-18 23:58	25214 c:\windows\Installer\{00E1E235-AB45-4695-A156-073118949ED4}\NewShortcut5_DDCE803CDC5C411082D68C5AD6497A2A.exe
+ 2010-05-13 11:40 . 2011-01-18 23:58	15086 c:\windows\Installer\{00E1E235-AB45-4695-A156-073118949ED4}\NewShortcut2_569C74F853D147C0802E971DD74EC31B.exe
+ 2010-05-13 11:40 . 2011-01-18 23:58	15086 c:\windows\Installer\{00E1E235-AB45-4695-A156-073118949ED4}\NewShortcut1_644D622AEF3D40E290EE92523E2DA87A.exe
+ 2010-05-13 11:40 . 2011-01-18 23:58	15086 c:\windows\Installer\{00E1E235-AB45-4695-A156-073118949ED4}\ARPPRODUCTICON.exe
+ 2010-09-23 08:47 . 2010-09-23 08:47	35760 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0400000010\9.4.0\reader_sl.exe
+ 2010-09-23 07:03 . 2010-09-23 07:03	99776 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0400000010\9.4.0\eula.exe
+ 2010-09-23 06:52 . 2010-09-23 06:52	27048 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0400000010\9.4.0\acrotextextractor.exe
+ 2010-09-22 22:12 . 2010-09-22 22:12	15800 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0400000010\9.4.0\AcroRd32Info.exe
+ 2010-06-10 04:52 . 2010-02-25 06:24	12800 c:\windows\ie8updates\KB982381-IE8\xpshims.dll
+ 2010-06-10 04:52 . 2010-02-25 06:24	55296 c:\windows\ie8updates\KB982381-IE8\msfeedsbs.dll
+ 2010-06-10 04:52 . 2010-02-25 06:24	25600 c:\windows\ie8updates\KB982381-IE8\jsproxy.dll
+ 2010-03-31 07:00 . 2009-12-21 19:14	12800 c:\windows\ie8updates\KB980182-IE8\xpshims.dll
+ 2010-03-31 07:00 . 2009-12-21 19:14	55296 c:\windows\ie8updates\KB980182-IE8\msfeedsbs.dll
+ 2010-03-31 07:00 . 2009-12-21 19:14	25600 c:\windows\ie8updates\KB980182-IE8\jsproxy.dll
+ 2011-04-15 07:37 . 2010-12-20 23:59	12800 c:\windows\ie8updates\KB2497640-IE8\xpshims.dll
+ 2011-04-15 07:37 . 2010-12-20 23:59	66560 c:\windows\ie8updates\KB2497640-IE8\mshtmled.dll
+ 2011-04-15 07:37 . 2010-12-20 23:59	55296 c:\windows\ie8updates\KB2497640-IE8\msfeedsbs.dll
+ 2011-04-15 07:37 . 2010-12-20 23:59	43520 c:\windows\ie8updates\KB2497640-IE8\licmgr10.dll
+ 2011-04-15 07:37 . 2010-12-20 23:59	25600 c:\windows\ie8updates\KB2497640-IE8\jsproxy.dll
+ 2011-02-09 22:44 . 2010-11-06 00:26	12800 c:\windows\ie8updates\KB2482017-IE8\xpshims.dll
+ 2011-02-09 22:44 . 2010-11-06 00:26	66560 c:\windows\ie8updates\KB2482017-IE8\mshtmled.dll
+ 2011-02-09 22:44 . 2010-11-06 00:26	55296 c:\windows\ie8updates\KB2482017-IE8\msfeedsbs.dll
+ 2011-02-09 22:44 . 2010-11-06 00:26	43520 c:\windows\ie8updates\KB2482017-IE8\licmgr10.dll
+ 2011-02-09 22:44 . 2010-11-06 00:26	25600 c:\windows\ie8updates\KB2482017-IE8\jsproxy.dll
+ 2010-12-16 08:05 . 2010-09-10 05:58	12800 c:\windows\ie8updates\KB2416400-IE8\xpshims.dll
+ 2010-12-16 08:05 . 2010-09-10 05:58	66560 c:\windows\ie8updates\KB2416400-IE8\mshtmled.dll
+ 2010-12-16 08:05 . 2010-09-10 05:58	55296 c:\windows\ie8updates\KB2416400-IE8\msfeedsbs.dll
+ 2010-12-16 08:05 . 2010-09-10 05:58	43520 c:\windows\ie8updates\KB2416400-IE8\licmgr10.dll
+ 2010-12-16 08:05 . 2010-09-10 05:58	25600 c:\windows\ie8updates\KB2416400-IE8\jsproxy.dll
+ 2010-10-12 20:36 . 2010-06-24 12:22	12800 c:\windows\ie8updates\KB2360131-IE8\xpshims.dll
+ 2010-10-12 20:35 . 2009-03-08 09:31	66560 c:\windows\ie8updates\KB2360131-IE8\mshtmled.dll
+ 2010-10-12 20:35 . 2010-06-24 12:21	55296 c:\windows\ie8updates\KB2360131-IE8\msfeedsbs.dll
+ 2010-10-12 20:35 . 2009-03-08 09:34	43008 c:\windows\ie8updates\KB2360131-IE8\licmgr10.dll
+ 2010-10-12 20:35 . 2010-06-24 12:21	25600 c:\windows\ie8updates\KB2360131-IE8\jsproxy.dll
+ 2010-08-11 01:08 . 2010-05-06 10:41	12800 c:\windows\ie8updates\KB2183461-IE8\xpshims.dll
+ 2010-08-11 01:08 . 2010-05-06 10:41	55296 c:\windows\ie8updates\KB2183461-IE8\msfeedsbs.dll
+ 2010-08-11 01:08 . 2010-05-06 10:41	25600 c:\windows\ie8updates\KB2183461-IE8\jsproxy.dll
+ 2010-10-06 23:57 . 2003-10-18 18:29	49152 c:\windows\Driver Cache\ttvins.dll
+ 2010-10-06 23:57 . 2003-09-01 19:31	81920 c:\windows\Driver Cache\TOSTVRat.dll
+ 2010-10-06 23:57 . 2001-03-21 16:49	31232 c:\windows\Driver Cache\DrvUpdt.exe
+ 2010-05-02 03:06 . 2002-07-25 21:13	24576 c:\windows\Downloaded Program Files\dwusplay.dll
+ 2010-02-25 21:30 . 2010-10-08 23:21	27011 c:\windows\CC33E708A7954AB3908A8F45919BC097.TMP\WiseCustomCall.dll
- 2010-02-25 21:30 . 2010-02-25 21:30	27011 c:\windows\CC33E708A7954AB3908A8F45919BC097.TMP\WiseCustomCall.dll
+ 2010-12-26 00:59 . 2010-12-26 00:59	27011 c:\windows\BB77DC4CB8184FD48D1D5D3B617B78B4.TMP\WiseCustomCall.dll
+ 2010-10-07 07:03 . 2010-10-07 07:03	28672 c:\windows\assembly\tmp\8127G5AJ\Microsoft.VisualBasic.Vsa.dll
+ 2011-04-15 07:42 . 2011-04-15 07:42	60928 c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationProvider\368187bcb570d202a019fc7c53b1df4c\UIAutomationProvider.ni.dll
+ 2011-04-15 07:56 . 2011-04-15 07:56	37888 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Pres#\3f621b90371e67197bd4d0b86aa6f21d\System.Windows.Presentation.ni.dll
+ 2011-04-15 07:55 . 2011-04-15 07:55	36864 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\577b049541803541e6b00e2c36c00852\System.Web.DynamicData.Design.ni.dll
+ 2011-04-15 07:48 . 2011-04-15 07:48	94208 c:\windows\assembly\NativeImages_v2.0.50727_32\System.ComponentMod#\636ed65b7e5481320e3010b78a5e6cfa\System.ComponentModel.DataAnnotations.ni.dll
+ 2011-04-15 07:48 . 2011-04-15 07:48	82944 c:\windows\assembly\NativeImages_v2.0.50727_32\System.AddIn.Contra#\f83b1e8dd8c90490c8d924826c8b107d\System.AddIn.Contract.ni.dll
+ 2011-04-15 07:35 . 2011-04-15 07:35	47104 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\2740ba673b1040f1995f13c6044da64c\PresentationFontCache.ni.exe
+ 2011-04-15 07:32 . 2011-04-15 07:32	39424 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCFFRast#\8514e7de63d46b6f8232ef70d93a1650\PresentationCFFRasterizer.ni.dll
+ 2011-04-15 07:53 . 2011-04-15 07:53	55296 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Vsa\108426b4dc654100c9a99bfa71f69886\Microsoft.Vsa.ni.dll
+ 2011-04-15 07:47 . 2011-04-15 07:47	74752 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\8905268997c77a27c7f9c54aeba37f24\Microsoft.Build.Framework.ni.dll
+ 2011-04-15 07:47 . 2011-04-15 07:47	65024 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\11bb8ef375848eb1c074da1afd5cecdc\Microsoft.Build.Framework.ni.dll
+ 2011-04-15 07:46 . 2011-04-15 07:46	14336 c:\windows\assembly\NativeImages_v2.0.50727_32\dfsvc\6d74b9308a1517bfe959e597c3dd2427\dfsvc.ni.exe
+ 2011-04-15 07:44 . 2011-04-15 07:44	25600 c:\windows\assembly\NativeImages_v2.0.50727_32\Accessibility\fdf7f1404f4a5c7f5a0463d8e7a442e4\Accessibility.ni.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	77824 c:\windows\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
+ 2011-04-15 07:25 . 2011-04-15 07:25	77824 c:\windows\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
+ 2010-06-10 04:48 . 2010-06-10 04:48	32768 c:\windows\assembly\GAC_MSIL\System.ServiceModel.WasHosting\3.0.0.0__b77a5c561934e089\System.ServiceModel.WasHosting.dll
- 2010-02-17 08:02 . 2010-02-17 08:02	32768 c:\windows\assembly\GAC_MSIL\System.ServiceModel.WasHosting\3.0.0.0__b77a5c561934e089\System.ServiceModel.WasHosting.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	81920 c:\windows\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
+ 2011-04-15 07:24 . 2011-04-15 07:24	81920 c:\windows\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
+ 2011-04-15 07:26 . 2011-04-15 07:26	81920 c:\windows\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	81920 c:\windows\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	32768 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
+ 2011-04-15 07:25 . 2011-04-15 07:25	32768 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
+ 2011-04-15 07:25 . 2011-04-15 07:25	12800 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	12800 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	28672 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
+ 2011-04-15 07:25 . 2011-04-15 07:25	28672 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	77824 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
+ 2011-04-15 07:25 . 2011-04-15 07:25	77824 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
+ 2011-04-15 07:25 . 2011-04-15 07:25	36864 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	36864 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
+ 2011-04-15 07:25 . 2011-04-15 07:25	77824 c:\windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	77824 c:\windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	13312 c:\windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
+ 2011-04-15 07:25 . 2011-04-15 07:25	13312 c:\windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
+ 2011-04-15 07:25 . 2011-04-15 07:25	10752 c:\windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	10752 c:\windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
+ 2011-04-15 07:25 . 2011-04-15 07:25	72192 c:\windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	72192 c:\windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
+ 2011-04-15 07:25 . 2011-04-15 07:25	69120 c:\windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	69120 c:\windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
+ 2010-10-08 23:21 . 2010-12-26 00:59	27011 c:\windows\8A83AE5FF59B4E1FBF2A49185A42ED1B.TMP\WiseCustomCall.dll
+ 2010-07-16 02:59 . 2006-09-28 23:01	58368 c:\windows\$NtUninstallWudf01000$\spuninst\WudfCustom.dll
+ 2010-07-16 03:01 . 2008-04-14 00:12	73728 c:\windows\$NtUninstallwmp11$\wmplayer.exe
+ 2010-07-16 03:01 . 2008-04-14 00:12	98304 c:\windows\$NtUninstallwmp11$\wmpband.dll
+ 2010-07-16 03:00 . 2005-01-28 18:44	18944 c:\windows\$NtUninstallWMFDist11$\wpdusb.sys
+ 2010-07-16 03:00 . 2005-01-28 18:44	66560 c:\windows\$NtUninstallWMFDist11$\wpdmtpus.dll
+ 2010-07-16 03:00 . 2005-01-28 18:44	61952 c:\windows\$NtUninstallWMFDist11$\wpdconns.dll
+ 2010-07-16 03:00 . 2005-01-28 18:44	38912 c:\windows\$NtUninstallWMFDist11$\wpd_ci.dll
+ 2010-07-16 03:00 . 2005-01-28 18:44	33792 c:\windows\$NtUninstallWMFDist11$\wmdmps.dll
+ 2010-07-16 03:00 . 2005-01-28 18:44	28160 c:\windows\$NtUninstallWMFDist11$\wmdmlog.dll
+ 2010-07-16 03:00 . 2005-01-28 18:44	38912 c:\windows\$NtUninstallWMFDist11$\wdfmgr.exe
+ 2010-07-16 03:00 . 2005-01-28 18:44	15872 c:\windows\$NtUninstallWMFDist11$\wdfapi.dll
+ 2010-07-16 03:00 . 2005-01-28 18:44	47104 c:\windows\$NtUninstallWMFDist11$\uwdf.exe
+ 2010-07-16 03:00 . 2009-02-03 00:01	13312 c:\windows\$NtUninstallWMFDist11$\spuninst\wpdinstallutil.dll
+ 2010-07-16 03:00 . 2005-01-28 18:44	25088 c:\windows\$NtUninstallWMFDist11$\mspmsnsv.dll
+ 2010-07-16 03:00 . 2008-06-10 10:52	96768 c:\windows\$NtUninstallWMFDist11$\logagent.exe
+ 2010-08-11 01:05 . 2008-04-14 00:11	80384 c:\windows\$NtUninstallKB982665$\iccvid.dll
+ 2010-05-26 12:21 . 2010-01-23 08:11	46080 c:\windows\$NtUninstallKB981793$\tzchange.exe
+ 2010-05-26 12:21 . 2010-04-22 22:21	16896 c:\windows\$NtUninstallKB981793$\spuninst\tzchange.dll
+ 2010-06-10 04:49 . 2008-04-14 00:11	65024 c:\windows\$NtUninstallKB979482$\asycfilt.dll
+ 2010-04-14 07:00 . 2008-04-14 00:11	84480 c:\windows\$NtUninstallKB979309$\cabview.dll
+ 2011-02-09 22:44 . 2009-12-14 07:08	33280 c:\windows\$NtUninstallKB2476687$\csrsrv.dll
+ 2010-12-16 08:04 . 2002-12-12 00:38	49152 c:\windows\$NtUninstallKB2447961_WM9L$\wmencagt.exe
+ 2010-12-16 08:04 . 2010-06-21 14:46	46080 c:\windows\$NtUninstallKB2443685$\tzchange.exe
+ 2010-12-16 08:04 . 2010-11-05 05:57	16896 c:\windows\$NtUninstallKB2443685$\spuninst\tzchange.dll
+ 2010-12-16 08:05 . 2008-04-14 00:11	81920 c:\windows\$NtUninstallKB2443105$\isign32.dll
+ 2010-12-16 08:04 . 2008-04-13 18:57	40576 c:\windows\$NtUninstallKB2440591$\ndproxy.sys
+ 2010-12-16 08:01 . 2008-04-14 00:12	46080 c:\windows\$NtUninstallKB2423089$\wab.exe
+ 2010-09-15 07:02 . 2008-04-14 00:12	57856 c:\windows\$NtUninstallKB2347290$\spoolsv.exe
+ 2010-10-12 20:35 . 2008-04-14 00:12	96768 c:\windows\$NtUninstallKB2345886$\srvsvc.dll
+ 2010-10-07 07:00 . 2010-04-21 13:28	46080 c:\windows\$NtUninstallKB2158563$\tzchange.exe
+ 2010-10-07 07:00 . 2010-06-23 00:54	16896 c:\windows\$NtUninstallKB2158563$\spuninst\tzchange.dll
+ 2010-09-15 07:02 . 2010-02-22 14:23	26488 c:\windows\$hf_mig$\KB982802\update\spcustom.dll
+ 2010-09-15 07:02 . 2010-02-22 14:23	17272 c:\windows\$hf_mig$\KB982802\spmsg.dll
+ 2010-08-11 01:05 . 2010-02-22 14:23	26488 c:\windows\$hf_mig$\KB982665\update\spcustom.dll
+ 2010-08-11 01:05 . 2010-02-22 14:23	17272 c:\windows\$hf_mig$\KB982665\spmsg.dll
+ 2010-06-17 14:02 . 2010-06-17 14:02	80384 c:\windows\$hf_mig$\KB982665\SP3QFE\iccvid.dll
+ 2010-06-10 04:52 . 2008-07-08 13:02	26488 c:\windows\$hf_mig$\KB982381-IE8\update\spcustom.dll
+ 2010-06-10 04:52 . 2008-07-08 13:02	17272 c:\windows\$hf_mig$\KB982381-IE8\spmsg.dll
+ 2010-06-10 04:20 . 2010-05-06 10:36	12800 c:\windows\$hf_mig$\KB982381-IE8\SP3QFE\xpshims.dll
+ 2010-06-10 04:20 . 2010-05-06 10:36	55296 c:\windows\$hf_mig$\KB982381-IE8\SP3QFE\msfeedsbs.dll
+ 2010-06-10 04:20 . 2010-05-06 10:36	25600 c:\windows\$hf_mig$\KB982381-IE8\SP3QFE\jsproxy.dll
+ 2010-08-11 01:18 . 2010-02-22 14:23	26488 c:\windows\$hf_mig$\KB982214\update\spcustom.dll
+ 2010-08-11 01:18 . 2010-02-22 14:23	17272 c:\windows\$hf_mig$\KB982214\spmsg.dll
+ 2010-10-12 20:38 . 2009-05-26 11:40	26488 c:\windows\$hf_mig$\KB982132\update\spcustom.dll
+ 2010-10-12 20:38 . 2009-05-26 11:40	17272 c:\windows\$hf_mig$\KB982132\spmsg.dll
+ 2010-08-11 01:06 . 2009-05-26 11:40	26488 c:\windows\$hf_mig$\KB981997\update\spcustom.dll
+ 2010-08-11 01:06 . 2009-05-26 11:40	17272 c:\windows\$hf_mig$\KB981997\spmsg.dll
+ 2010-10-12 20:38 . 2010-02-22 14:23	26488 c:\windows\$hf_mig$\KB981957\update\spcustom.dll
+ 2010-10-12 20:38 . 2010-02-22 14:23	17272 c:\windows\$hf_mig$\KB981957\spmsg.dll
+ 2010-08-11 01:18 . 2010-02-22 14:23	26488 c:\windows\$hf_mig$\KB981852\update\spcustom.dll
+ 2010-08-10 23:19 . 2010-06-18 06:28	16896 c:\windows\$hf_mig$\KB981852\update\mpsyschk.dll
+ 2010-08-11 01:18 . 2010-02-22 14:23	17272 c:\windows\$hf_mig$\KB981852\spmsg.dll
+ 2010-04-15 00:09 . 2009-05-26 11:40	26488 c:\windows\$hf_mig$\KB981332-IE8\update\spcustom.dll
+ 2010-04-15 00:09 . 2009-05-26 11:40	17272 c:\windows\$hf_mig$\KB981332-IE8\spmsg.dll
+ 2010-09-15 07:02 . 2009-05-26 11:40	26488 c:\windows\$hf_mig$\KB981322\update\spcustom.dll
+ 2010-09-15 07:02 . 2009-05-26 11:40	17272 c:\windows\$hf_mig$\KB981322\spmsg.dll
+ 2010-08-11 01:07 . 2009-05-26 11:40	26488 c:\windows\$hf_mig$\KB980436\update\spcustom.dll
+ 2010-08-11 01:07 . 2009-05-26 11:40	17272 c:\windows\$hf_mig$\KB980436\spmsg.dll
+ 2010-04-15 00:10 . 2009-05-26 09:01	26488 c:\windows\$hf_mig$\KB980232\update\spcustom.dll
+ 2010-04-15 00:10 . 2009-05-26 09:01	17272 c:\windows\$hf_mig$\KB980232\spmsg.dll
+ 2010-06-10 04:53 . 2009-05-26 11:40	26488 c:\windows\$hf_mig$\KB980218\update\spcustom.dll
+ 2010-06-10 04:53 . 2009-05-26 11:40	17272 c:\windows\$hf_mig$\KB980218\spmsg.dll
+ 2010-06-10 04:53 . 2008-07-08 13:02	26488 c:\windows\$hf_mig$\KB980195\update\spcustom.dll
+ 2010-06-10 04:53 . 2008-07-08 13:02	17272 c:\windows\$hf_mig$\KB980195\spmsg.dll
+ 2010-03-31 07:00 . 2009-05-26 11:40	26488 c:\windows\$hf_mig$\KB980182-IE8\update\spcustom.dll
+ 2010-03-31 07:00 . 2009-05-26 11:40	17272 c:\windows\$hf_mig$\KB980182-IE8\spmsg.dll
+ 2010-03-31 04:05 . 2010-02-25 06:19	12800 c:\windows\$hf_mig$\KB980182-IE8\SP3QFE\xpshims.dll
+ 2010-03-31 04:05 . 2010-02-25 06:19	55296 c:\windows\$hf_mig$\KB980182-IE8\SP3QFE\msfeedsbs.dll
+ 2010-03-31 04:05 . 2010-02-25 06:19	25600 c:\windows\$hf_mig$\KB980182-IE8\SP3QFE\jsproxy.dll
+ 2010-10-12 20:34 . 2009-05-26 09:01	26488 c:\windows\$hf_mig$\KB979687\update\spcustom.dll
+ 2010-10-12 20:34 . 2009-05-26 09:01	17272 c:\windows\$hf_mig$\KB979687\spmsg.dll
+ 2010-04-15 00:10 . 2009-05-26 11:40	26488 c:\windows\$hf_mig$\KB979683\update\spcustom.dll
+ 2010-04-15 00:03 . 2010-03-05 14:54	16896 c:\windows\$hf_mig$\KB979683\update\mpsyschk.dll
+ 2010-04-15 00:10 . 2009-05-26 11:40	17272 c:\windows\$hf_mig$\KB979683\spmsg.dll
+ 2010-06-10 04:53 . 2009-05-26 09:01	26488 c:\windows\$hf_mig$\KB979559\update\spcustom.dll
+ 2010-06-10 04:53 . 2009-05-26 09:01	17272 c:\windows\$hf_mig$\KB979559\spmsg.dll
+ 2010-06-10 04:49 . 2009-05-26 11:40	26488 c:\windows\$hf_mig$\KB979482\update\spcustom.dll
+ 2010-06-10 04:49 . 2009-05-26 11:40	17272 c:\windows\$hf_mig$\KB979482\spmsg.dll
+ 2010-03-05 14:52 . 2010-03-05 14:52	65536 c:\windows\$hf_mig$\KB979482\SP3QFE\asycfilt.dll
+ 2010-04-14 07:00 . 2008-07-08 13:02	26488 c:\windows\$hf_mig$\KB979309\update\spcustom.dll
+ 2010-04-14 07:00 . 2008-07-08 13:02	17272 c:\windows\$hf_mig$\KB979309\spmsg.dll
+ 2010-01-13 13:48 . 2010-01-13 13:48	86016 c:\windows\$hf_mig$\KB979309\SP3QFE\cabview.dll
+ 2010-04-14 07:00 . 2008-07-08 13:02	26488 c:\windows\$hf_mig$\KB978601\update\spcustom.dll
+ 2010-04-14 07:00 . 2008-07-08 13:02	17272 c:\windows\$hf_mig$\KB978601\spmsg.dll
+ 2010-05-11 20:35 . 2009-05-26 11:40	26488 c:\windows\$hf_mig$\KB978542\update\spcustom.dll
+ 2010-05-11 20:35 . 2009-05-26 11:40	17272 c:\windows\$hf_mig$\KB978542\spmsg.dll
+ 2010-04-15 00:09 . 2009-05-26 11:40	26488 c:\windows\$hf_mig$\KB978338\update\spcustom.dll
+ 2010-04-15 00:09 . 2009-05-26 11:40	17272 c:\windows\$hf_mig$\KB978338\spmsg.dll
+ 2010-04-15 00:09 . 2009-05-26 11:40	26488 c:\windows\$hf_mig$\KB977816\update\spcustom.dll
+ 2010-04-15 00:09 . 2009-05-26 11:40	17272 c:\windows\$hf_mig$\KB977816\spmsg.dll
+ 2010-06-10 04:49 . 2008-07-08 13:02	26488 c:\windows\$hf_mig$\KB975562\update\spcustom.dll
+ 2010-06-10 04:49 . 2008-07-08 13:02	17272 c:\windows\$hf_mig$\KB975562\spmsg.dll
+ 2011-03-16 07:02 . 2008-07-08 13:02	26488 c:\windows\$hf_mig$\KB971029\update\spcustom.dll
+ 2011-03-16 07:02 . 2008-07-08 13:02	17272 c:\windows\$hf_mig$\KB971029\spmsg.dll
+ 2011-03-24 07:02 . 2010-07-05 13:15	26488 c:\windows\$hf_mig$\KB2524375\update\spcustom.dll
+ 2011-03-24 07:02 . 2010-07-05 13:15	17272 c:\windows\$hf_mig$\KB2524375\spmsg.dll
+ 2011-02-09 22:49 . 2010-07-05 13:15	26488 c:\windows\$hf_mig$\KB2485376\update\spcustom.dll
+ 2011-02-09 22:49 . 2010-07-05 13:15	17272 c:\windows\$hf_mig$\KB2485376\spmsg.dll
+ 2011-02-09 22:48 . 2010-07-05 13:15	26488 c:\windows\$hf_mig$\KB2483185\update\spcustom.dll
+ 2011-02-09 22:48 . 2010-07-05 13:15	17272 c:\windows\$hf_mig$\KB2483185\spmsg.dll
+ 2011-02-09 22:44 . 2010-07-05 13:15	26488 c:\windows\$hf_mig$\KB2482017-IE8\update\spcustom.dll
+ 2011-02-09 22:44 . 2010-07-05 13:15	17272 c:\windows\$hf_mig$\KB2482017-IE8\spmsg.dll
+ 2011-02-09 22:13 . 2010-12-20 23:58	12800 c:\windows\$hf_mig$\KB2482017-IE8\SP3QFE\xpshims.dll
+ 2011-02-09 22:13 . 2010-12-20 23:58	66560 c:\windows\$hf_mig$\KB2482017-IE8\SP3QFE\mshtmled.dll
+ 2011-02-09 22:13 . 2010-12-20 23:58	55296 c:\windows\$hf_mig$\KB2482017-IE8\SP3QFE\msfeedsbs.dll
+ 2011-02-09 22:13 . 2010-12-20 23:58	43520 c:\windows\$hf_mig$\KB2482017-IE8\SP3QFE\licmgr10.dll
+ 2011-02-09 22:13 . 2010-12-20 23:58	25600 c:\windows\$hf_mig$\KB2482017-IE8\SP3QFE\jsproxy.dll
+ 2011-03-10 08:02 . 2010-07-05 13:15	26488 c:\windows\$hf_mig$\KB2481109\update\spcustom.dll
+ 2011-03-10 08:02 . 2010-07-05 13:15	17272 c:\windows\$hf_mig$\KB2481109\spmsg.dll
+ 2011-02-02 07:57 . 2011-02-02 07:57	53248 c:\windows\$hf_mig$\KB2481109\SP3QFE\tsgqec.dll
+ 2011-03-10 08:14 . 2010-07-05 13:15	26488 c:\windows\$hf_mig$\KB2479943\update\spcustom.dll
+ 2011-03-10 08:14 . 2010-07-05 13:15	17272 c:\windows\$hf_mig$\KB2479943\spmsg.dll
+ 2011-02-09 22:49 . 2010-07-05 13:15	26488 c:\windows\$hf_mig$\KB2479628\update\spcustom.dll
+ 2011-02-09 22:49 . 2010-07-05 13:15	17272 c:\windows\$hf_mig$\KB2479628\spmsg.dll
+ 2011-02-09 22:49 . 2010-07-05 13:15	26488 c:\windows\$hf_mig$\KB2478971\update\spcustom.dll
+ 2011-02-09 22:49 . 2010-07-05 13:15	17272 c:\windows\$hf_mig$\KB2478971\spmsg.dll
+ 2011-02-09 22:44 . 2010-07-05 13:15	26488 c:\windows\$hf_mig$\KB2478960\update\spcustom.dll
+ 2011-02-09 22:44 . 2010-07-05 13:15	17272 c:\windows\$hf_mig$\KB2478960\spmsg.dll
+ 2011-02-09 22:44 . 2010-07-05 13:15	26488 c:\windows\$hf_mig$\KB2476687\update\spcustom.dll
+ 2011-02-09 22:44 . 2010-07-05 13:15	17272 c:\windows\$hf_mig$\KB2476687\spmsg.dll
+ 2010-12-09 14:29 . 2010-12-09 14:29	33280 c:\windows\$hf_mig$\KB2476687\SP3QFE\csrsrv.dll
+ 2010-12-16 08:04 . 2010-02-22 14:23	26488 c:\windows\$hf_mig$\KB2467659\update\spcustom.dll
+ 2010-12-16 08:04 . 2010-02-22 14:23	17272 c:\windows\$hf_mig$\KB2467659\spmsg.dll
+ 2010-12-16 08:05 . 2010-02-22 14:23	26488 c:\windows\$hf_mig$\KB2443105\update\spcustom.dll
+ 2010-12-16 08:05 . 2010-02-22 14:23	17272 c:\windows\$hf_mig$\KB2443105\spmsg.dll
+ 2010-11-18 18:12 . 2010-11-18 18:12	81920 c:\windows\$hf_mig$\KB2443105\SP3QFE\isign32.dll
+ 2010-12-16 08:04 . 2009-05-26 11:40	26488 c:\windows\$hf_mig$\KB2440591\update\spcustom.dll
+ 2010-12-16 08:04 . 2009-05-26 11:40	17272 c:\windows\$hf_mig$\KB2440591\spmsg.dll
+ 2010-12-15 13:37 . 2010-11-03 05:55	40960 c:\windows\$hf_mig$\KB2440591\SP3QFE\ndproxy.sys
+ 2010-12-16 08:04 . 2009-05-26 11:40	26488 c:\windows\$hf_mig$\KB2436673\update\spcustom.dll
+ 2010-12-16 08:04 . 2009-05-26 11:40	17272 c:\windows\$hf_mig$\KB2436673\spmsg.dll
+ 2010-12-16 08:01 . 2010-02-22 14:23	26488 c:\windows\$hf_mig$\KB2423089\update\spcustom.dll
+ 2010-12-16 08:01 . 2010-02-22 14:23	17272 c:\windows\$hf_mig$\KB2423089\spmsg.dll
+ 2010-12-15 13:35 . 2010-10-11 14:55	45568 c:\windows\$hf_mig$\KB2423089\SP3QFE\wab.exe
+ 2011-01-12 17:49 . 2010-02-22 14:23	26488 c:\windows\$hf_mig$\KB2419632\update\spcustom.dll
+ 2011-01-12 17:49 . 2010-02-22 14:23	17272 c:\windows\$hf_mig$\KB2419632\spmsg.dll
+ 2010-12-16 08:05 . 2010-02-22 14:23	26488 c:\windows\$hf_mig$\KB2416400-IE8\update\spcustom.dll
+ 2010-12-16 08:05 . 2010-02-22 14:23	17272 c:\windows\$hf_mig$\KB2416400-IE8\spmsg.dll
+ 2010-12-15 13:38 . 2010-11-06 00:27	12800 c:\windows\$hf_mig$\KB2416400-IE8\SP3QFE\xpshims.dll
+ 2010-12-15 13:38 . 2010-11-06 00:27	66560 c:\windows\$hf_mig$\KB2416400-IE8\SP3QFE\mshtmled.dll
+ 2010-12-15 13:38 . 2010-11-06 00:27	55296 c:\windows\$hf_mig$\KB2416400-IE8\SP3QFE\msfeedsbs.dll
+ 2010-12-15 13:38 . 2010-11-06 00:27	43520 c:\windows\$hf_mig$\KB2416400-IE8\SP3QFE\licmgr10.dll
+ 2010-12-15 13:38 . 2010-11-06 00:27	25600 c:\windows\$hf_mig$\KB2416400-IE8\SP3QFE\jsproxy.dll
+ 2011-02-09 22:43 . 2010-07-05 13:15	26488 c:\windows\$hf_mig$\KB2393802\update\spcustom.dll
+ 2011-02-09 22:13 . 2010-12-09 15:15	16896 c:\windows\$hf_mig$\KB2393802\update\mpsyschk.dll
+ 2011-02-09 22:43 . 2010-07-05 13:15	17272 c:\windows\$hf_mig$\KB2393802\spmsg.dll
+ 2010-10-12 20:37 . 2010-02-22 14:23	26488 c:\windows\$hf_mig$\KB2387149\update\spcustom.dll
+ 2010-10-12 20:37 . 2010-02-22 14:23	17272 c:\windows\$hf_mig$\KB2387149\spmsg.dll
+ 2010-10-12 20:39 . 2010-02-22 14:23	26488 c:\windows\$hf_mig$\KB2360937\update\spcustom.dll
+ 2010-10-12 20:39 . 2010-02-22 14:23	17272 c:\windows\$hf_mig$\KB2360937\spmsg.dll
+ 2010-10-12 20:36 . 2009-05-26 09:01	26488 c:\windows\$hf_mig$\KB2360131-IE8\update\spcustom.dll
+ 2010-10-12 20:36 . 2009-05-26 09:01	17272 c:\windows\$hf_mig$\KB2360131-IE8\spmsg.dll
+ 2010-10-12 20:23 . 2010-09-10 05:57	12800 c:\windows\$hf_mig$\KB2360131-IE8\SP3QFE\xpshims.dll
+ 2010-10-12 20:23 . 2010-09-10 05:57	66560 c:\windows\$hf_mig$\KB2360131-IE8\SP3QFE\mshtmled.dll
+ 2010-10-12 20:23 . 2010-09-10 05:57	55296 c:\windows\$hf_mig$\KB2360131-IE8\SP3QFE\msfeedsbs.dll
+ 2010-10-12 20:23 . 2010-09-10 05:57	43520 c:\windows\$hf_mig$\KB2360131-IE8\SP3QFE\licmgr10.dll
+ 2010-10-12 20:23 . 2010-09-10 05:57	25600 c:\windows\$hf_mig$\KB2360131-IE8\SP3QFE\jsproxy.dll
+ 2010-09-15 07:03 . 2009-05-26 11:40	26488 c:\windows\$hf_mig$\KB2347290\update\spcustom.dll
+ 2010-09-15 07:03 . 2009-05-26 11:40	17272 c:\windows\$hf_mig$\KB2347290\spmsg.dll
+ 2010-08-17 13:19 . 2010-08-17 13:19	58880 c:\windows\$hf_mig$\KB2347290\SP3QFE\spoolsv.exe
+ 2010-10-12 20:35 . 2010-02-22 14:23	26488 c:\windows\$hf_mig$\KB2345886\update\spcustom.dll
+ 2010-10-12 20:35 . 2010-02-22 14:23	17272 c:\windows\$hf_mig$\KB2345886\spmsg.dll
+ 2010-08-27 06:05 . 2010-08-27 06:05	99840 c:\windows\$hf_mig$\KB2345886\SP3QFE\srvsvc.dll
+ 2010-12-16 08:05 . 2009-05-26 11:40	26488 c:\windows\$hf_mig$\KB2296199\update\spcustom.dll
+ 2010-12-16 08:05 . 2009-05-26 11:40	17272 c:\windows\$hf_mig$\KB2296199\spmsg.dll
+ 2010-08-03 07:00 . 2010-02-22 14:23	26488 c:\windows\$hf_mig$\KB2286198\update\spcustom.dll
+ 2010-08-03 07:00 . 2010-02-22 14:23	17272 c:\windows\$hf_mig$\KB2286198\spmsg.dll
+ 2010-10-12 20:38 . 2010-02-22 14:23	26488 c:\windows\$hf_mig$\KB2279986\update\spcustom.dll
+ 2010-10-12 20:38 . 2010-02-22 14:23	17272 c:\windows\$hf_mig$\KB2279986\spmsg.dll
+ 2010-09-15 07:03 . 2009-05-26 09:01	26488 c:\windows\$hf_mig$\KB2259922\update\spcustom.dll
+ 2010-09-15 07:03 . 2009-05-26 09:01	17272 c:\windows\$hf_mig$\KB2259922\spmsg.dll
+ 2010-07-14 14:45 . 2009-05-26 11:40	26488 c:\windows\$hf_mig$\KB2229593\update\spcustom.dll
+ 2010-07-14 14:45 . 2009-05-26 11:40	17272 c:\windows\$hf_mig$\KB2229593\spmsg.dll
+ 2010-08-11 01:08 . 2009-05-26 09:01	26488 c:\windows\$hf_mig$\KB2183461-IE8\update\spcustom.dll
+ 2010-08-11 01:08 . 2009-05-26 09:01	17272 c:\windows\$hf_mig$\KB2183461-IE8\spmsg.dll
+ 2010-08-10 23:18 . 2010-06-24 12:24	12800 c:\windows\$hf_mig$\KB2183461-IE8\SP3QFE\xpshims.dll
+ 2010-08-10 23:18 . 2010-06-24 12:24	55296 c:\windows\$hf_mig$\KB2183461-IE8\SP3QFE\msfeedsbs.dll
+ 2010-08-10 23:18 . 2010-06-24 12:24	25600 c:\windows\$hf_mig$\KB2183461-IE8\SP3QFE\jsproxy.dll
+ 2010-08-11 01:07 . 2010-02-22 14:23	26488 c:\windows\$hf_mig$\KB2160329\update\spcustom.dll
+ 2010-08-11 01:07 . 2010-02-22 14:23	17272 c:\windows\$hf_mig$\KB2160329\spmsg.dll
+ 2010-09-15 07:00 . 2010-02-22 14:23	26488 c:\windows\$hf_mig$\KB2141007\update\spcustom.dll
+ 2010-09-15 07:00 . 2010-02-22 14:23	17272 c:\windows\$hf_mig$\KB2141007\spmsg.dll
+ 2010-09-15 07:02 . 2010-02-22 14:23	26488 c:\windows\$hf_mig$\KB2121546\update\spcustom.dll
+ 2010-09-15 07:02 . 2010-02-22 14:23	17272 c:\windows\$hf_mig$\KB2121546\spmsg.dll
+ 2010-08-11 01:18 . 2009-05-26 11:40	26488 c:\windows\$hf_mig$\KB2115168\update\spcustom.dll
+ 2010-08-11 01:18 . 2009-05-26 11:40	17272 c:\windows\$hf_mig$\KB2115168\spmsg.dll
+ 2010-08-11 01:17 . 2009-05-26 11:40	26488 c:\windows\$hf_mig$\KB2079403\update\spcustom.dll
+ 2010-08-11 01:17 . 2009-05-26 11:40	17272 c:\windows\$hf_mig$\KB2079403\spmsg.dll
+ 2011-04-15 07:25 . 2011-04-15 07:25	8192 c:\windows\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	8192 c:\windows\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
+ 2010-12-08 21:52 . 2010-12-08 21:52	4212 c:\windows\system32\zllictbl.dat
+ 2004-08-04 07:56 . 2009-01-31 00:35	4096 c:\windows\system32\wmvdmoe2.dll
+ 2003-03-31 12:00 . 2009-01-31 00:35	4096 c:\windows\system32\wmvdmod.dll
+ 2005-01-28 18:44 . 2009-01-31 00:34	4096 c:\windows\system32\WMVADVE.DLL
+ 2005-01-28 18:44 . 2009-01-31 00:34	4096 c:\windows\system32\WMVADVD.dll
+ 2004-08-04 07:56 . 2009-01-31 00:34	4096 c:\windows\system32\wmsdmoe2.dll
+ 2003-03-31 12:00 . 2009-01-31 00:34	4096 c:\windows\system32\wmsdmod.dll
+ 2005-01-28 18:44 . 2009-02-03 00:01	8704 c:\windows\system32\wdfmgr.exe
+ 2005-01-28 18:44 . 2009-01-31 00:34	4096 c:\windows\system32\wdfapi.dll
+ 2005-01-28 18:44 . 2009-02-03 00:01	8704 c:\windows\system32\uwdf.exe
+ 2010-08-23 02:41 . 2001-08-17 22:36	5632 c:\windows\system32\ReinstallBackups\0004\DriverFiles\i386\ptpusb.dll
+ 2003-03-31 12:00 . 2009-01-31 00:33	4096 c:\windows\system32\MPG4DMOD.dll
+ 2004-08-04 07:56 . 2009-01-31 00:33	4096 c:\windows\system32\MP4SDMOD.dll
+ 2004-08-04 07:56 . 2009-01-31 00:33	4096 c:\windows\system32\MP43DMOD.dll
+ 2010-08-23 22:59 . 2009-04-17 19:48	9344 c:\windows\system32\DRVSTORE\grmnusb_09F3E629557EBE4D2BA1A9469BDAE635AC0807AE\I386\grmnusb.sys
+ 2010-08-23 21:38 . 2001-08-17 17:56	7552 c:\windows\system32\drivers\SONYPVU1.SYS
+ 2010-07-17 20:37 . 2009-04-17 19:48	9344 c:\windows\system32\drivers\grmnusb.sys
+ 2004-08-04 07:56 . 2009-01-31 00:35	4096 c:\windows\system32\dllcache\wmvdmoe2.dll
+ 2003-03-31 12:00 . 2009-01-31 00:35	4096 c:\windows\system32\dllcache\wmvdmod.dll
+ 2004-08-04 07:56 . 2009-01-31 00:34	4096 c:\windows\system32\dllcache\wmsdmoe2.dll
+ 2003-03-31 12:00 . 2009-01-31 00:34	4096 c:\windows\system32\dllcache\wmsdmod.dll
+ 2010-08-23 21:38 . 2001-08-17 17:56	7552 c:\windows\system32\dllcache\sonypvu1.sys
+ 2010-02-05 15:33 . 2009-01-31 00:33	4096 c:\windows\system32\dllcache\MPG4DMOD.dll
+ 2010-02-05 15:33 . 2009-01-31 00:33	4096 c:\windows\system32\dllcache\MP4SDMOD.dll
+ 2010-02-05 15:33 . 2009-01-31 00:33	4096 c:\windows\system32\dllcache\MP43DMOD.dll
+ 2003-03-31 12:00 . 2009-01-31 00:33	7168 c:\windows\system32\dllcache\asferror.dll
+ 2003-03-31 12:00 . 2009-01-31 00:33	7168 c:\windows\system32\asferror.dll
+ 2011-02-15 22:18 . 2011-02-15 22:18	4608 c:\windows\Installer\1eb1e191.msi
+ 2010-04-06 22:37 . 2010-04-06 22:37	2238 c:\windows\Installer\{FB98D390-54A4-4CD1-93D3-FBC96A6F07A3}\Shortcut1_71F6DF7DB6394FADBA93E6DF267AA44D.exe
+ 2010-06-17 17:11 . 2010-08-25 09:42	8854 c:\windows\Installer\{75AE8014-1184-4BC0-B279-C879540719EE}\NewShortcut4_6DA5A1D78B8341BC8B0E6ECB2E7024B5.exe
+ 2010-04-13 16:14 . 2010-08-06 05:05	8478 c:\windows\Installer\{70780F71-8BAC-4800-8A06-FC36461F52F2}\_6FEFF9B68218417F98F549.exe
+ 2010-04-13 16:14 . 2010-08-06 05:05	8478 c:\windows\Installer\{70780F71-8BAC-4800-8A06-FC36461F52F2}\_37A242B96C616492F7198B.exe
+ 2010-02-05 17:13 . 2011-04-01 22:09	8854 c:\windows\Installer\{18DB3375-0649-4EA3-959A-44F1ACD278BA}\UNINST_Uninstall_I_A55A816FBDB947CCB2F72A2FF62B6901.exe
- 2010-02-05 17:13 . 2010-02-05 17:13	8854 c:\windows\Installer\{18DB3375-0649-4EA3-959A-44F1ACD278BA}\UNINST_Uninstall_I_A55A816FBDB947CCB2F72A2FF62B6901.exe
+ 2011-04-15 07:25 . 2011-04-15 07:25	7168 c:\windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	7168 c:\windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
+ 2011-04-15 07:26 . 2011-04-15 07:26	5632 c:\windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
- 2010-02-17 08:06 . 2010-02-17 08:06	5632 c:\windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
+ 2011-04-15 07:25 . 2011-04-15 07:25	6656 c:\windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	6656 c:\windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
+ 2010-07-16 03:01 . 2002-12-11 20:16	7680 c:\windows\$NtUninstallwmp11$\asferror.dll
+ 2010-07-16 03:00 . 2005-01-28 18:44	6656 c:\windows\$NtUninstallWMFDist11$\laprxy.dll
+ 2010-09-15 07:02 . 2008-05-03 11:55	2560 c:\windows\$NtUninstallKB982802$\xpsp4res.dll
+ 2010-10-12 20:35 . 2010-07-22 05:57	5120 c:\windows\$NtUninstallKB2345886$\xpsp4res.dll
+ 2010-07-22 05:57 . 2010-07-22 05:57	5120 c:\windows\$hf_mig$\KB982802\SP3QFE\xpsp4res.dll
+ 2010-07-12 12:53 . 2010-07-12 12:53	5120 c:\windows\$hf_mig$\KB979687\SP3QFE\xpsp4res.dll
+ 2010-10-12 20:32 . 2010-08-13 12:53	5120 c:\windows\$hf_mig$\KB2360937\SP3QFE\xpsp4res.dll
+ 2010-08-26 12:52 . 2010-08-26 12:52	5120 c:\windows\$hf_mig$\KB2345886\SP3QFE\xpsp4res.dll
+ 2010-06-15 03:21 . 2006-10-07 21:43	502784 c:\windows\x2.64.exe
- 2010-02-17 08:06 . 2010-02-17 08:06	113664 c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
+ 2011-04-15 07:25 . 2011-04-15 07:25	113664 c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	258048 c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
+ 2011-04-15 07:25 . 2011-04-15 07:25	258048 c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05	875520 c:\windows\WinSxS\x86_Microsoft.VC90.DebugCRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_f863c71f\msvcp90d.dll
+ 2008-07-29 07:54 . 2008-07-29 07:54	312832 c:\windows\WinSxS\x86_Microsoft.VC90.DebugCRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_f863c71f\msvcm90d.dll
+ 2011-01-11 14:59 . 2011-01-11 14:59	653136 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_0517bbc6\msvcr90.dll
+ 2011-01-11 14:59 . 2011-01-11 14:59	569680 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_0517bbc6\msvcp90.dll
+ 2011-01-11 14:59 . 2011-01-11 14:59	225280 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_0517bbc6\msvcm90.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05	655872 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\msvcr90.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05	572928 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\msvcp90.dll
+ 2008-07-29 07:54 . 2008-07-29 07:54	225280 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\msvcm90.dll
+ 2011-01-11 14:59 . 2011-01-11 14:59	159048 c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_65b7a93a\atl90.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05	161784 c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_d01483b2\atl90.dll
+ 2011-01-11 08:27 . 2011-01-11 08:27	632656 c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.5592_x-ww_179798c8\msvcr80.dll
+ 2011-01-11 08:24 . 2011-01-11 08:24	554832 c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.5592_x-ww_179798c8\msvcp80.dll
+ 2011-01-11 08:08 . 2011-01-11 08:08	479232 c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.5592_x-ww_179798c8\msvcm80.dll
+ 2010-04-08 15:53 . 2010-04-08 15:53	634560 c:\windows\system32\XceedZip.dll
+ 2010-06-15 03:21 . 2005-02-28 17:16	240128 c:\windows\system32\x.264.exe
+ 2006-09-28 22:56 . 2006-09-28 22:56	316416 c:\windows\system32\WUDFx.dll
+ 2006-09-28 22:56 . 2006-09-28 22:56	165376 c:\windows\system32\WudfPlatform.dll
+ 2006-09-28 22:56 . 2006-09-28 22:56	146432 c:\windows\system32\WudfHost.exe
+ 2005-01-28 18:44 . 2009-01-31 00:35	356352 c:\windows\system32\wpdsp.dll
+ 2009-01-31 00:35 . 2009-01-31 00:35	133632 c:\windows\system32\WPDShServiceObj.dll
+ 2005-01-28 18:44 . 2009-01-31 00:35	154624 c:\windows\system32\wpdmtp.dll
+ 2005-01-28 18:44 . 2009-01-31 00:35	629760 c:\windows\system32\wpd_ci.dll
+ 2009-01-31 00:35 . 2009-01-31 00:35	656896 c:\windows\system32\WMVXENCD.dll
+ 2009-01-31 00:35 . 2009-01-31 00:35	767488 c:\windows\system32\WMVSENCD.dll
+ 2004-08-04 07:56 . 2009-04-02 03:02	604160 c:\windows\system32\wmspdmod.dll
+ 2009-01-31 00:34 . 2009-01-31 00:34	204288 c:\windows\system32\wmpsrcwp.dll
+ 2009-01-31 00:34 . 2009-01-31 00:34	130048 c:\windows\system32\wmpps.dll
+ 2009-01-31 00:34 . 2009-01-31 00:34	613376 c:\windows\system32\wmpmde.dll
+ 2009-01-31 00:34 . 2009-01-31 00:34	295936 c:\windows\system32\wmpeffects.dll
+ 2004-08-04 07:56 . 2009-07-14 03:43	286208 c:\windows\system32\wmpdxm.dll
+ 2004-08-04 07:56 . 2009-01-31 00:34	211456 c:\windows\system32\wmpasf.dll
+ 2003-03-31 12:00 . 2009-01-31 00:34	938496 c:\windows\system32\WMNetMgr.dll
+ 2004-08-04 07:56 . 2009-01-31 00:34	157184 c:\windows\system32\wmidx.dll
+ 2004-08-04 07:56 . 2009-01-31 00:34	227328 c:\windows\system32\wmerror.dll
+ 2009-01-31 00:34 . 2009-01-31 00:34	535040 c:\windows\system32\wmdrmsdk.dll
+ 2005-01-28 18:44 . 2009-01-31 00:34	348672 c:\windows\system32\wmdrmnet.dll
+ 2005-01-28 18:44 . 2009-01-31 00:34	429056 c:\windows\system32\wmdrmdev.dll
+ 2003-03-31 12:00 . 2009-01-31 00:34	222208 c:\windows\system32\WMASF.dll
+ 2003-03-31 12:00 . 2009-01-31 00:34	757248 c:\windows\system32\WMADMOD.dll
+ 2003-03-31 12:00 . 2009-12-24 06:59	177664 c:\windows\system32\wintrust.dll
- 2003-03-31 12:00 . 2008-04-14 00:12	293376 c:\windows\system32\winsrv.dll
+ 2003-03-31 12:00 . 2010-06-18 17:45	293376 c:\windows\system32\winsrv.dll
+ 2003-03-31 12:00 . 2010-12-20 23:59	916480 c:\windows\system32\wininet(3)(2).dll
+ 2003-03-31 12:00 . 2010-12-20 23:59	916480 c:\windows\system32\wininet(2)(2).dll
+ 2003-03-31 12:00 . 2010-04-16 15:36	406016 c:\windows\system32\usp10.dll
- 2003-03-31 12:00 . 2008-04-14 00:12	406016 c:\windows\system32\usp10.dll
+ 2003-03-31 12:00 . 2010-08-27 08:02	119808 c:\windows\system32\t2embed.dll
- 2003-03-31 12:00 . 2009-10-15 16:28	119808 c:\windows\system32\t2embed.dll
+ 2010-06-15 03:22 . 2007-11-13 13:31	399360 c:\windows\system32\Smab.dll
- 2003-03-31 12:00 . 2008-04-14 00:12	135168 c:\windows\system32\shsvcs.dll
+ 2003-03-31 12:00 . 2009-07-27 23:17	135168 c:\windows\system32\shsvcs.dll
+ 2003-03-31 12:00 . 2008-04-14 00:12	135168 c:\windows\system32\shsvcs(2)(2).dll
+ 2003-03-31 12:00 . 2011-01-21 14:44	439296 c:\windows\system32\shimgvw.dll
+ 2003-03-31 12:00 . 2010-06-30 12:31	149504 c:\windows\system32\schannel.dll
+ 2003-03-31 12:00 . 2010-08-16 08:45	590848 c:\windows\system32\rpcrt4.dll
+ 2010-08-23 02:41 . 2008-04-14 00:12	159232 c:\windows\system32\ReinstallBackups\0004\DriverFiles\i386\ptpusd.dll
+ 2003-03-31 12:00 . 2009-01-31 00:34	211456 c:\windows\system32\qasf.dll
+ 2010-03-31 04:10 . 2010-03-31 04:10	295264 c:\windows\system32\PresentationHost.exe
+ 2009-01-31 00:34 . 2009-01-31 00:34	199168 c:\windows\system32\PortableDeviceWMDRM.dll
+ 2009-01-31 00:34 . 2009-01-31 00:34	132096 c:\windows\system32\PortableDeviceWiaCompat.dll
+ 2009-01-31 00:34 . 2009-01-31 00:34	166912 c:\windows\system32\PortableDeviceTypes.dll
+ 2009-01-31 00:34 . 2009-01-31 00:34	101888 c:\windows\system32\PortableDeviceClassExtension.dll
+ 2009-01-31 00:34 . 2009-01-31 00:34	254976 c:\windows\system32\PortableDeviceApi.dll
+ 2003-03-31 12:00 . 2011-04-26 07:17	493292 c:\windows\system32\perfh009.dat
- 2003-03-31 12:00 . 2008-04-14 00:12	249856 c:\windows\system32\odbc32.dll
+ 2003-03-31 12:00 . 2010-11-09 14:52	249856 c:\windows\system32\odbc32.dll
- 2003-03-31 12:00 . 2009-12-21 19:14	206848 c:\windows\system32\occache.dll
+ 2003-03-31 12:00 . 2011-02-22 23:06	206848 c:\windows\system32\occache.dll
+ 2003-08-01 04:08 . 2004-03-24 03:12	782336 c:\windows\system32\nwiz.exe
+ 2003-08-01 04:08 . 2004-03-24 03:12	139264 c:\windows\system32\nvwrszht.dll
+ 2003-08-01 04:08 . 2004-03-24 03:12	135168 c:\windows\system32\nvwrszhc.dll
+ 2003-08-01 04:08 . 2004-03-24 03:12	245760 c:\windows\system32\nvwrssv.dll
+ 2003-08-01 04:08 . 2004-03-24 03:12	262144 c:\windows\system32\nvwrsru.dll
+ 2003-08-01 04:08 . 2004-03-24 03:12	266240 c:\windows\system32\nvwrsptb.dll
+ 2003-08-01 04:08 . 2004-03-24 03:12	249856 c:\windows\system32\nvwrsno.dll
+ 2003-08-01 04:08 . 2004-03-24 03:12	262144 c:\windows\system32\nvwrsnl.dll
+ 2003-08-01 04:08 . 2004-03-24 03:12	163840 c:\windows\system32\nvwrsko.dll
+ 2003-08-01 04:08 . 2004-03-24 03:12	176128 c:\windows\system32\nvwrsja.dll
+ 2003-08-01 04:08 . 2004-03-24 03:12	270336 c:\windows\system32\nvwrsit.dll
+ 2003-08-01 04:08 . 2004-03-24 03:12	270336 c:\windows\system32\nvwrsfr.dll
+ 2003-08-01 04:08 . 2004-03-24 03:12	249856 c:\windows\system32\nvwrsfi.dll
+ 2003-08-01 04:08 . 2004-03-24 03:12	278528 c:\windows\system32\nvwrses.dll
+ 2003-08-01 04:08 . 2004-03-24 03:12	237568 c:\windows\system32\nvwrseng.dll
+ 2003-08-01 04:08 . 2004-03-24 03:12	253952 c:\windows\system32\nvwrsde.dll
+ 2003-08-01 04:08 . 2004-03-24 03:12	245760 c:\windows\system32\nvwrsda.dll
+ 2003-08-01 04:08 . 2004-03-24 03:12	233472 c:\windows\system32\nvwrsar.dll
+ 2010-10-06 23:51 . 2004-03-24 03:12	110592 c:\windows\system32\nvudisp.exe
+ 2003-08-01 04:08 . 2004-03-24 03:12	454656 c:\windows\system32\nvshell.dll
+ 2003-08-01 04:08 . 2004-03-24 03:12	147456 c:\windows\system32\nvrszhc.dll
+ 2003-08-01 04:08 . 2004-03-24 03:12	147456 c:\windows\system32\nvrssv.dll
+ 2003-08-01 04:08 . 2004-03-24 03:12	155648 c:\windows\system32\nvrsru.dll
+ 2003-08-01 04:08 . 2004-03-24 03:12	159744 c:\windows\system32\nvrsptb.dll
+ 2003-08-01 04:08 . 2004-03-24 03:12	147456 c:\windows\system32\nvrsno.dll
+ 2003-08-01 04:08 . 2004-03-24 03:12	159744 c:\windows\system32\nvrsnl.dll
+ 2003-08-01 04:08 . 2004-03-24 03:12	172032 c:\windows\system32\nvrsko.dll
+ 2003-08-01 04:08 . 2004-03-24 03:12	172032 c:\windows\system32\nvrsja.dll
+ 2003-08-01 04:08 . 2004-03-24 03:12	167936 c:\windows\system32\nvrsit.dll
+ 2003-08-01 04:08 . 2004-03-24 03:12	163840 c:\windows\system32\nvrsfr.dll
+ 2003-08-01 04:08 . 2004-03-24 03:12	139264 c:\windows\system32\nvrsfi.dll
+ 2003-08-01 04:08 . 2004-03-24 03:12	163840 c:\windows\system32\nvrses.dll
+ 2003-08-01 04:08 . 2004-03-24 03:12	147456 c:\windows\system32\nvrseng.dll
+ 2003-08-01 04:08 . 2004-03-24 03:12	163840 c:\windows\system32\nvrsde.dll
+ 2003-08-01 04:08 . 2004-03-24 03:12	151552 c:\windows\system32\nvrsda.dll
+ 2003-08-01 04:08 . 2004-03-24 03:12	200704 c:\windows\system32\nvrsar.dll
+ 2003-08-01 04:08 . 2004-03-24 03:12	131072 c:\windows\system32\nvinstnt.dll
+ 2010-10-06 23:51 . 2004-03-24 03:12	851968 c:\windows\system32\nvdspsch.exe
+ 2010-10-06 23:51 . 2004-03-24 03:12	401408 c:\windows\system32\nvappbar.exe
+ 2003-03-31 12:00 . 2010-12-09 15:15	718336 c:\windows\system32\ntdll.dll
+ 2009-08-06 23:23 . 2009-08-06 23:23	215904 c:\windows\system32\muweb.dll
+ 2010-05-06 04:32 . 2009-08-06 23:23	274288 c:\windows\system32\mucltui.dll
+ 2003-03-31 12:00 . 2008-06-20 16:02	245248 c:\windows\system32\mswsock.dll
- 2003-03-31 12:00 . 2008-06-20 17:46	245248 c:\windows\system32\mswsock.dll
+ 2003-03-31 12:00 . 2008-06-20 17:46	245248 c:\windows\system32\mswsock(2)(3).dll
+ 2003-03-31 12:00 . 2009-01-31 00:33	321536 c:\windows\system32\mswmdm.dll
- 2010-03-23 01:17 . 2006-12-11 03:32	348160 c:\windows\system32\msvcr71.dll
+ 2010-09-09 18:50 . 2004-01-12 04:00	348160 c:\windows\system32\msvcr71.dll
+ 2010-02-05 00:40 . 2011-01-27 11:57	677888 c:\windows\system32\mstsc.exe
- 2010-02-05 00:40 . 2008-04-14 00:12	677888 c:\windows\system32\mstsc.exe
- 2003-03-31 12:00 . 2009-03-08 09:32	611840 c:\windows\system32\mstime.dll
+ 2003-03-31 12:00 . 2011-02-22 23:06	611840 c:\windows\system32\mstime.dll
+ 2003-03-31 12:00 . 2009-01-31 00:33	414720 c:\windows\system32\msscp.dll
+ 2003-03-31 12:00 . 2009-01-31 00:33	175616 c:\windows\system32\mspmsp.dll
+ 2003-03-31 12:00 . 2009-01-31 00:33	179712 c:\windows\system32\msnetobj.dll
+ 2009-03-08 09:32 . 2011-02-22 23:06	602112 c:\windows\system32\msfeeds.dll
+ 2006-10-02 19:28 . 2006-10-02 19:28	312128 c:\windows\system32\msdelta.dll
+ 2009-11-07 05:07 . 2009-11-07 05:07	297808 c:\windows\system32\mscoree.dll
+ 2009-01-31 00:33 . 2009-01-31 00:33	259072 c:\windows\system32\MPG4DECD.dll
+ 2009-01-31 00:33 . 2010-03-30 16:24	317440 c:\windows\system32\mp4sdecd.dll
+ 2009-01-31 00:33 . 2009-01-31 00:33	259072 c:\windows\system32\MP43DECD.dll
+ 2009-01-31 00:33 . 2009-01-31 00:33	212992 c:\windows\system32\MFPLAT.dll
+ 2003-03-31 12:00 . 2010-09-18 06:53	953856 c:\windows\system32\mfc40u.dll
+ 2003-03-31 12:00 . 2010-09-18 06:53	954368 c:\windows\system32\mfc40.dll
+ 2010-11-18 17:55 . 2010-11-18 17:55	233936 c:\windows\system32\Macromed\Flash\FlashUtil10l_ActiveX.exe
+ 2010-11-18 17:55 . 2010-11-18 17:55	311248 c:\windows\system32\Macromed\Flash\FlashUtil10l_ActiveX.dll
+ 2003-05-02 00:06 . 2003-05-02 00:06	716288 c:\windows\system32\Ltwvc11n.dll
+ 2003-05-02 00:06 . 2003-05-02 00:06	392192 c:\windows\system32\ltkrn11n.dll
+ 2003-05-02 00:06 . 2003-05-02 00:06	127488 c:\windows\system32\ltimg11n.dll
+ 2003-05-02 00:06 . 2003-05-02 00:06	118784 c:\windows\system32\ltfil11n.DLL
+ 2003-05-02 00:06 . 2003-05-02 00:06	262656 c:\windows\system32\LTDIS11n.dll
+ 2003-03-31 12:00 . 2010-12-20 17:26	730112 c:\windows\system32\lsasrv.dll
- 2003-03-31 12:00 . 2009-06-25 08:25	730112 c:\windows\system32\lsasrv.dll
+ 2003-03-31 12:00 . 2009-01-30 21:37	100864 c:\windows\system32\logagent.exe
+ 2003-05-02 00:06 . 2003-05-02 00:06	152064 c:\windows\system32\lftif11n.dll
+ 2003-05-02 00:06 . 2003-05-02 00:06	172032 c:\windows\system32\Lfpng11n.dll
+ 2003-05-02 00:06 . 2003-05-02 00:06	285184 c:\windows\system32\LFCMP11n.DLL
- 2003-03-31 12:00 . 2009-06-25 08:25	301568 c:\windows\system32\kerberos.dll
+ 2003-03-31 12:00 . 2010-12-22 12:34	301568 c:\windows\system32\kerberos.dll
- 2003-03-31 12:00 . 2009-12-09 05:53	726528 c:\windows\system32\jscript.dll
+ 2003-03-31 12:00 . 2011-03-04 06:37	726528 c:\windows\system32\jscript.dll
+ 2003-03-31 12:00 . 2009-12-09 05:53	726528 c:\windows\system32\jscript(3).dll
- 2010-02-05 18:11 . 2009-12-17 22:14	153376 c:\windows\system32\javaws.exe
+ 2010-08-29 02:18 . 2010-07-17 09:00	153376 c:\windows\system32\javaws.exe
- 2010-02-05 18:11 . 2009-12-17 22:14	145184 c:\windows\system32\javaw.exe
+ 2010-08-29 02:18 . 2010-07-17 09:00	145184 c:\windows\system32\javaw.exe
+ 2010-08-29 02:18 . 2010-07-17 09:00	145184 c:\windows\system32\java.exe
- 2010-02-05 18:11 . 2009-12-17 22:14	145184 c:\windows\system32\java.exe
+ 2009-12-22 18:39 . 2009-12-22 18:39	922112 c:\windows\system32\imapi2fs.dll
+ 2009-12-22 18:39 . 2009-12-22 18:39	426496 c:\windows\system32\imapi2.dll
+ 2003-03-31 12:00 . 2011-02-22 23:06	184320 c:\windows\system32\iepeers.dll
- 2003-03-31 12:00 . 2009-12-21 19:14	184320 c:\windows\system32\iepeers.dll
+ 2003-03-31 12:00 . 2011-02-22 23:06	387584 c:\windows\system32\iedkcs32.dll
- 2003-03-31 12:00 . 2009-12-21 19:14	387584 c:\windows\system32\iedkcs32.dll
+ 2003-03-31 12:00 . 2011-02-18 11:49	173568 c:\windows\system32\ie4uinit.exe
+ 2009-06-10 20:40 . 2011-04-30 05:28	263024 c:\windows\system32\FNTCACHE.DAT
+ 2003-03-31 12:00 . 2009-01-31 00:33	991744 c:\windows\system32\drmv2clt.dll
+ 2009-01-30 21:23 . 2009-01-30 21:23	249856 c:\windows\system32\drmupgds.exe
+ 2009-01-31 00:35 . 2009-01-31 00:35	671232 c:\windows\system32\drivers\UMDF\wpdmtpdr.dll
+ 2003-03-31 12:00 . 2010-02-11 12:02	226880 c:\windows\system32\drivers\tcpip6.sys
+ 2009-11-06 16:00 . 2009-11-06 16:00	176752 c:\windows\system32\drivers\ssidrv.sys
+ 2010-12-24 03:29 . 2010-07-27 09:48	212568 c:\windows\system32\drivers\sbtis.sys
+ 2010-11-09 18:57 . 2003-09-15 02:16	324608 c:\windows\system32\drivers\ar5211.sys
- 2003-03-31 12:00 . 2008-08-14 10:04	138496 c:\windows\system32\drivers\afd.sys
+ 2003-03-31 12:00 . 2008-10-16 14:43	138496 c:\windows\system32\drivers\afd.sys
+ 2010-10-07 17:23 . 2010-10-07 17:23	197920 c:\windows\system32\dnssdX.dll
+ 2003-03-31 12:00 . 2011-03-03 06:55	149504 c:\windows\system32\dnsapi.dll
+ 2003-03-31 12:00 . 2008-06-20 17:46	147968 c:\windows\system32\dnsapi(2)(3).dll
+ 2010-10-07 17:23 . 2010-10-07 17:23	107808 c:\windows\system32\dns-sd.exe
+ 2010-02-05 15:19 . 2010-07-12 12:55	218112 c:\windows\system32\dllcache\wordpad.exe
+ 2004-08-04 07:56 . 2009-04-02 03:02	604160 c:\windows\system32\dllcache\wmspdmod.dll
+ 2010-02-05 15:34 . 2009-07-14 03:43	286208 c:\windows\system32\dllcache\wmpdxm.dll
+ 2010-02-05 15:34 . 2009-01-31 00:34	211456 c:\windows\system32\dllcache\wmpasf.dll
+ 2003-03-31 12:00 . 2009-01-31 00:34	938496 c:\windows\system32\dllcache\WMNetMgr.dll
+ 2004-08-04 07:56 . 2009-01-31 00:34	157184 c:\windows\system32\dllcache\wmidx.dll
+ 2010-02-05 15:34 . 2009-01-31 00:34	227328 c:\windows\system32\dllcache\wmerror.dll
+ 2003-03-31 12:00 . 2009-01-31 00:34	222208 c:\windows\system32\dllcache\WMASF.dll
+ 2003-03-31 12:00 . 2009-01-31 00:34	757248 c:\windows\system32\dllcache\WMADMOD.dll
+ 2009-12-24 06:59 . 2009-12-24 06:59	177664 c:\windows\system32\dllcache\wintrust.dll
+ 2010-06-18 17:45 . 2010-06-18 17:45	293376 c:\windows\system32\dllcache\winsrv.dll
+ 2009-03-08 09:34 . 2011-02-22 23:06	916480 c:\windows\system32\dllcache\wininet.dll
- 2009-03-08 09:34 . 2009-12-21 19:14	916480 c:\windows\system32\dllcache\wininet.dll
+ 2008-05-09 10:53 . 2011-03-04 06:37	420864 c:\windows\system32\dllcache\vbscript.dll
+ 2010-04-16 15:36 . 2010-04-16 15:36	406016 c:\windows\system32\dllcache\usp10.dll
+ 2010-02-05 15:33 . 2009-01-30 21:40	317440 c:\windows\system32\dllcache\unregmp2.exe
+ 2008-06-20 11:08 . 2010-02-11 12:02	226880 c:\windows\system32\dllcache\tcpip6.sys
+ 2010-02-05 15:37 . 2010-08-27 08:02	119808 c:\windows\system32\dllcache\t2embed.dll
- 2010-02-05 15:37 . 2009-10-15 16:28	119808 c:\windows\system32\dllcache\t2embed.dll
+ 2010-02-05 15:33 . 2011-02-17 13:18	357888 c:\windows\system32\dllcache\srv.sys
+ 2009-07-27 23:17 . 2009-07-27 23:17	135168 c:\windows\system32\dllcache\shsvcs.dll
+ 2011-01-21 14:44 . 2011-01-21 14:44	439296 c:\windows\system32\dllcache\shimgvw.dll
+ 2008-12-05 06:54 . 2010-06-30 12:31	149504 c:\windows\system32\dllcache\schannel.dll
+ 2011-02-09 13:53 . 2011-02-09 13:53	270848 c:\windows\system32\dllcache\sbe.dll
+ 2009-04-15 14:51 . 2010-08-16 08:45	590848 c:\windows\system32\dllcache\rpcrt4.dll
+ 2003-03-31 12:00 . 2009-01-31 00:34	211456 c:\windows\system32\dllcache\qasf.dll
+ 2010-11-09 14:52 . 2010-11-09 14:52	249856 c:\windows\system32\dllcache\odbc32.dll
- 2009-03-08 09:34 . 2009-12-21 19:14	206848 c:\windows\system32\dllcache\occache.dll
+ 2009-03-08 09:34 . 2011-02-22 23:06	206848 c:\windows\system32\dllcache\occache.dll
+ 2010-02-05 15:37 . 2010-12-09 15:15	718336 c:\windows\system32\dllcache\ntdll.dll
- 2008-06-20 17:46 . 2008-06-20 17:46	245248 c:\windows\system32\dllcache\mswsock.dll
+ 2008-06-20 17:46 . 2008-06-20 16:02	245248 c:\windows\system32\dllcache\mswsock.dll
+ 2003-03-31 12:00 . 2009-01-31 00:33	321536 c:\windows\system32\dllcache\mswmdm.dll
+ 2009-03-08 09:32 . 2011-02-22 23:06	611840 c:\windows\system32\dllcache\mstime.dll
- 2009-03-08 09:32 . 2009-03-08 09:32	611840 c:\windows\system32\dllcache\mstime.dll
+ 2003-03-31 12:00 . 2009-01-31 00:33	414720 c:\windows\system32\dllcache\msscp.dll
+ 2003-03-31 12:00 . 2009-01-31 00:33	175616 c:\windows\system32\dllcache\mspmsp.dll
+ 2003-03-31 12:00 . 2009-01-31 00:33	179712 c:\windows\system32\dllcache\msnetobj.dll
+ 2010-11-09 14:52 . 2010-11-09 14:52	102400 c:\windows\system32\dllcache\msjro.dll
+ 2010-02-05 16:13 . 2011-02-22 23:06	602112 c:\windows\system32\dllcache\msfeeds.dll
+ 2010-11-09 14:52 . 2010-11-09 14:52	200704 c:\windows\system32\dllcache\msadox.dll
+ 2010-11-09 14:52 . 2010-11-09 14:52	180224 c:\windows\system32\dllcache\msadomd.dll
+ 2010-11-09 14:52 . 2010-11-09 14:52	536576 c:\windows\system32\dllcache\msado15.dll
+ 2010-11-09 14:52 . 2010-11-09 14:52	143360 c:\windows\system32\dllcache\msadco.dll
+ 2010-02-05 15:34 . 2011-02-17 13:18	455936 c:\windows\system32\dllcache\mrxsmb.sys
+ 2010-02-05 15:33 . 2009-01-31 00:33	243712 c:\windows\system32\dllcache\mpvis.dll
+ 2010-03-30 16:24 . 2010-03-30 16:24	317440 c:\windows\system32\dllcache\mp4sdecd.dll
+ 2010-09-18 16:23 . 2011-02-08 13:33	974848 c:\windows\system32\dllcache\mfc42u.dll
+ 2010-10-12 20:30 . 2011-02-08 13:33	978944 c:\windows\system32\dllcache\mfc42.dll
+ 2010-10-12 20:30 . 2010-09-18 06:53	953856 c:\windows\system32\dllcache\mfc40u.dll
+ 2003-03-31 12:00 . 2010-09-18 06:53	954368 c:\windows\system32\dllcache\mfc40.dll
+ 2010-02-05 15:37 . 2010-12-20 17:26	730112 c:\windows\system32\dllcache\lsasrv.dll
- 2010-02-05 15:37 . 2009-06-25 08:25	730112 c:\windows\system32\dllcache\lsasrv.dll
+ 2003-03-31 12:00 . 2009-01-30 21:37	100864 c:\windows\system32\dllcache\logagent.exe
+ 2011-01-27 11:57 . 2011-01-27 11:57	677888 c:\windows\system32\dllcache\lhmstsc.exe
- 2009-06-25 08:25 . 2009-06-25 08:25	301568 c:\windows\system32\dllcache\kerberos.dll
+ 2009-06-25 08:25 . 2010-12-22 12:34	301568 c:\windows\system32\dllcache\kerberos.dll
+ 2008-05-09 10:53 . 2011-03-04 06:37	726528 c:\windows\system32\dllcache\jscript.dll
- 2008-05-09 10:53 . 2009-12-09 05:53	726528 c:\windows\system32\dllcache\jscript.dll
+ 2010-02-05 15:26 . 2011-03-07 05:33	692736 c:\windows\system32\dllcache\inetcomm.dll
+ 2009-12-22 18:39 . 2009-12-22 18:39	922112 c:\windows\system32\dllcache\imapi2fs.dll
+ 2009-12-22 18:39 . 2009-12-22 18:39	426496 c:\windows\system32\dllcache\imapi2.dll
+ 2010-02-05 16:13 . 2011-02-22 23:06	247808 c:\windows\system32\dllcache\ieproxy.dll
- 2009-03-08 09:31 . 2009-12-21 19:14	184320 c:\windows\system32\dllcache\iepeers.dll
+ 2009-03-08 09:31 . 2011-02-22 23:06	184320 c:\windows\system32\dllcache\iepeers.dll
+ 2010-06-10 04:20 . 2011-02-22 23:06	743424 c:\windows\system32\dllcache\iedvtool.dll
+ 2009-03-08 19:09 . 2011-02-22 23:06	387584 c:\windows\system32\dllcache\iedkcs32.dll
- 2009-03-08 19:09 . 2009-12-21 19:14	387584 c:\windows\system32\dllcache\iedkcs32.dll
+ 2009-03-08 09:32 . 2011-02-18 11:49	173568 c:\windows\system32\dllcache\ie4uinit.exe
+ 2010-07-14 14:32 . 2010-06-14 14:31	744448 c:\windows\system32\dllcache\helpsvc.exe
+ 2011-02-09 13:53 . 2011-02-09 13:53	186880 c:\windows\system32\dllcache\encdec.dll
+ 2003-03-31 12:00 . 2009-01-31 00:33	991744 c:\windows\system32\dllcache\drmv2clt.dll
+ 2008-06-20 17:46 . 2011-03-03 06:55	149504 c:\windows\system32\dllcache\dnsapi.dll
+ 2010-10-12 20:21 . 2010-08-23 16:12	617472 c:\windows\system32\dllcache\comctl32.dll
+ 2003-03-31 12:00 . 2009-01-31 00:33	229376 c:\windows\system32\dllcache\cewmdm.dll
+ 2003-03-31 12:00 . 2009-01-31 00:33	542720 c:\windows\system32\dllcache\blackbox.dll
+ 2010-04-20 05:30 . 2011-02-15 12:56	290432 c:\windows\system32\dllcache\atmfd.dll
- 2008-06-20 11:40 . 2008-08-14 10:04	138496 c:\windows\system32\dllcache\afd.sys
+ 2008-06-20 11:40 . 2008-10-16 14:43	138496 c:\windows\system32\dllcache\afd.sys
+ 2010-02-12 04:33 . 2010-02-12 04:33	100864 c:\windows\system32\dllcache\6to4svc.dll
+ 2010-06-24 00:42 . 2010-07-17 09:00	423656 c:\windows\system32\deployJava1.dll
+ 2010-08-11 01:14 . 2010-08-11 01:13	262144 c:\windows\system32\config\systemprofile\IETldCache\index.dat
+ 2003-03-31 12:00 . 2010-08-23 16:12	617472 c:\windows\system32\comctl32.dll
- 2003-03-31 12:00 . 2008-04-14 00:11	617472 c:\windows\system32\comctl32.dll
+ 2003-03-31 12:00 . 2009-01-31 00:33	229376 c:\windows\system32\cewmdm.dll
+ 2011-04-30 12:10 . 2009-11-06 19:14	511328 c:\windows\system32\capicom.dll
+ 2003-03-31 12:00 . 2009-01-31 00:33	542720 c:\windows\system32\blackbox.dll
+ 2006-12-31 02:16 . 2007-05-17 21:30	318976 c:\windows\system32\avisynth.dll
+ 2009-01-31 00:33 . 2009-01-31 00:33	276992 c:\windows\system32\audiodev.dll
+ 2003-03-31 12:00 . 2011-01-07 14:09	290048 c:\windows\system32\atmfd(3)(2).dll
+ 2003-03-31 12:00 . 2011-01-07 14:09	290048 c:\windows\system32\atmfd(2)(2).dll
+ 2003-03-31 12:00 . 2010-02-12 04:33	100864 c:\windows\system32\6to4svc.dll
+ 2010-02-05 00:42 . 2010-06-14 14:31	744448 c:\windows\PCHealth\HelpCtr\Binaries\helpsvc.exe
- 2010-02-05 00:42 . 2008-04-14 00:12	744448 c:\windows\PCHealth\HelpCtr\Binaries\helpsvc.exe
+ 2010-03-31 04:16 . 2010-03-31 04:16	130408 c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationHostDLL.dll
+ 2010-04-08 03:48 . 2010-04-08 03:48	970752 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\System.Runtime.Serialization.dll
- 2008-07-30 00:16 . 2008-07-30 00:16	110592 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMdiagnostics.dll
+ 2010-04-08 03:48 . 2010-04-08 03:48	110592 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMdiagnostics.dll
+ 2010-09-22 13:43 . 2010-09-22 13:43	435024 c:\windows\Microsoft.NET\Framework\v2.0.50727\webengine.dll
+ 2010-02-09 16:22 . 2010-02-09 16:22	258048 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Security.dll
- 2008-07-25 16:17 . 2008-07-25 16:17	258048 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Security.dll
+ 2011-01-18 08:39 . 2011-01-18 08:39	388936 c:\windows\Microsoft.NET\Framework\v2.0.50727\SOS.dll
+ 2011-01-18 08:39 . 2011-01-18 08:39	363856 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
+ 2011-01-18 08:39 . 2011-01-18 08:39	989016 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscordacwks.dll
- 2009-08-08 04:51 . 2009-08-08 04:51	989016 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscordacwks.dll
+ 2010-06-15 03:21 . 2006-04-12 13:47	217073 c:\windows\meta4.exe
+ 2010-08-29 02:18 . 2010-08-29 02:18	180224 c:\windows\Installer\aacffab.msi
+ 2010-12-26 01:01 . 2010-12-26 01:01	512000 c:\windows\Installer\9bd0a85.msi
+ 2010-12-26 00:59 . 2010-12-26 00:59	842752 c:\windows\Installer\9bd0a80.msi
+ 2010-06-15 21:01 . 2010-06-15 21:01	836096 c:\windows\Installer\8997139.msi
+ 2010-07-16 03:07 . 2010-07-16 03:07	467968 c:\windows\Installer\7df2cb7.msi
+ 2010-04-08 07:00 . 2010-04-08 07:00	429568 c:\windows\Installer\67cc281.msi
+ 2011-04-30 07:00 . 2011-04-30 07:00	459264 c:\windows\Installer\54b587.msi
+ 2011-04-30 07:00 . 2011-04-30 07:00	223232 c:\windows\Installer\54b581.msi
+ 2010-09-24 01:02 . 2010-09-24 01:02	798208 c:\windows\Installer\48049bc.msp
+ 2010-06-09 17:00 . 2010-06-09 17:00	236032 c:\windows\Installer\3bc3cfd8.msi
+ 2011-01-07 04:01 . 2011-01-07 04:01	811008 c:\windows\Installer\36a9d2f2.msi
+ 2010-04-07 12:46 . 2010-04-07 12:46	432640 c:\windows\Installer\293a76b.msi
+ 2010-02-25 04:14 . 2010-02-25 04:14	543232 c:\windows\Installer\26bc1ee.msp
+ 2010-04-13 16:14 . 2010-04-13 16:14	531968 c:\windows\Installer\22382d1d.msi
+ 2010-06-24 00:42 . 2010-06-24 00:42	576000 c:\windows\Installer\10f28a.msi
+ 2010-12-24 03:29 . 2010-12-24 03:29	345472 c:\windows\Installer\{F9D06C1D-EEB6-443A-B5BE-63CE1A5C1290}\ARPPRODUCTICON.exe
+ 2010-11-27 02:49 . 2010-11-27 02:49	632320 c:\windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C240BF}\IconCD95F66110.exe
+ 2011-01-29 02:54 . 2011-01-29 02:54	380928 c:\windows\Installer\{AAD47011-8518-4608-9656-951DA35B587B}\iTunesIco.exe
+ 2011-02-24 02:12 . 2011-02-24 02:12	102400 c:\windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}\ARPPRODUCTICON.exe
+ 2010-10-14 22:47 . 2010-10-14 22:47	897024 c:\windows\Installer\{20ACB2F8-3BCA-45A8-80A2-9D3CB5C25F43}\SafariIco.exe
+ 2010-09-22 22:10 . 2010-09-22 22:10	103864 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0400000010\9.4.0\nppdf32.dll
+ 2010-09-10 22:17 . 2010-09-10 22:17	684032 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0400000010\9.4.0\JP2KLib.dll
+ 2010-09-23 00:41 . 2010-09-23 00:41	542168 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0400000010\9.4.0\AdobeCollabSync.exe
+ 2010-09-23 08:47 . 2010-09-23 08:47	349616 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0400000010\9.4.0\AcroRd32.exe
+ 2010-09-22 22:04 . 2010-09-22 22:04	660912 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0400000010\9.4.0\AcroPDF.dll
+ 2010-09-22 23:39 . 2010-09-22 23:39	280024 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0400000010\9.4.0\acrobroker.exe
+ 2010-09-22 22:50 . 2010-09-22 22:50	251296 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0400000010\9.4.0\a3dutility.exe
+ 2003-03-31 12:00 . 2009-01-30 21:40	317440 c:\windows\inf\unregmp2.exe
+ 2010-06-10 04:52 . 2010-02-25 06:24	916480 c:\windows\ie8updates\KB982381-IE8\wininet.dll
+ 2010-06-10 04:52 . 2010-02-22 14:23	382840 c:\windows\ie8updates\KB982381-IE8\spuninst\updspapi.dll
+ 2010-06-10 04:52 . 2008-07-08 13:02	231288 c:\windows\ie8updates\KB982381-IE8\spuninst\spuninst.exe
+ 2010-06-10 04:52 . 2010-02-25 06:24	206848 c:\windows\ie8updates\KB982381-IE8\occache.dll
+ 2010-06-10 04:52 . 2010-02-25 06:24	611840 c:\windows\ie8updates\KB982381-IE8\mstime.dll
+ 2010-06-10 04:52 . 2010-02-25 06:24	594432 c:\windows\ie8updates\KB982381-IE8\msfeeds.dll
+ 2010-06-10 04:52 . 2010-02-25 06:24	247808 c:\windows\ie8updates\KB982381-IE8\ieproxy.dll
+ 2010-06-10 04:52 . 2010-02-25 06:24	184320 c:\windows\ie8updates\KB982381-IE8\iepeers.dll
+ 2010-06-10 04:52 . 2009-03-08 09:35	742912 c:\windows\ie8updates\KB982381-IE8\iedvtool.dll
+ 2010-06-10 04:52 . 2010-02-25 06:24	387584 c:\windows\ie8updates\KB982381-IE8\iedkcs32.dll
+ 2010-06-10 04:52 . 2010-02-24 09:54	173056 c:\windows\ie8updates\KB982381-IE8\ie4uinit.exe
+ 2010-04-15 00:09 . 2009-03-08 09:33	420352 c:\windows\ie8updates\KB981332-IE8\vbscript.dll
+ 2010-04-15 00:09 . 2009-05-26 11:40	382840 c:\windows\ie8updates\KB981332-IE8\spuninst\updspapi.dll
+ 2010-04-15 00:09 . 2009-05-26 11:40	231288 c:\windows\ie8updates\KB981332-IE8\spuninst\spuninst.exe
+ 2010-03-31 07:00 . 2009-12-21 19:14	916480 c:\windows\ie8updates\KB980182-IE8\wininet.dll
+ 2010-03-31 07:00 . 2009-05-26 11:40	382840 c:\windows\ie8updates\KB980182-IE8\spuninst\updspapi.dll
+ 2010-03-31 07:00 . 2009-05-26 11:40	231288 c:\windows\ie8updates\KB980182-IE8\spuninst\spuninst.exe
+ 2010-03-31 07:00 . 2009-12-21 19:14	206848 c:\windows\ie8updates\KB980182-IE8\occache.dll
+ 2010-03-31 07:00 . 2009-03-08 09:32	611840 c:\windows\ie8updates\KB980182-IE8\mstime.dll
+ 2010-03-31 07:00 . 2009-12-21 19:14	594432 c:\windows\ie8updates\KB980182-IE8\msfeeds.dll
+ 2010-03-31 07:00 . 2009-12-21 19:14	246272 c:\windows\ie8updates\KB980182-IE8\ieproxy.dll
+ 2010-03-31 07:00 . 2009-12-21 19:14	184320 c:\windows\ie8updates\KB980182-IE8\iepeers.dll
+ 2010-03-31 07:00 . 2009-12-21 19:14	387584 c:\windows\ie8updates\KB980182-IE8\iedkcs32.dll
+ 2010-03-31 07:00 . 2009-12-21 13:19	173056 c:\windows\ie8updates\KB980182-IE8\ie4uinit.exe
+ 2011-04-15 07:02 . 2010-03-10 06:15	420352 c:\windows\ie8updates\KB2510531-IE8\vbscript.dll
+ 2011-04-15 07:02 . 2010-07-05 13:16	382840 c:\windows\ie8updates\KB2510531-IE8\spuninst\updspapi.dll
+ 2011-04-15 07:02 . 2010-07-05 13:15	231288  c:\windows\ie8updates\KB2510531-IE8\spuninst\spuninst.exe
+ 2011-04-15 07:02 . 2009-12-09 05:53	726528 c:\windows\ie8updates\KB2510531-IE8\jscript.dll
+ 2011-04-15 07:37 . 2010-12-20 23:59	916480 c:\windows\ie8updates\KB2497640-IE8\wininet.dll
+ 2011-04-15 07:37 . 2010-07-05 13:16	382840 c:\windows\ie8updates\KB2497640-IE8\spuninst\updspapi.dll
+ 2011-04-15 07:37 . 2010-07-05 13:15	231288 c:\windows\ie8updates\KB2497640-IE8\spuninst\spuninst.exe
+ 2011-04-15 07:37 . 2010-12-20 23:59	206848 c:\windows\ie8updates\KB2497640-IE8\occache.dll
+ 2011-04-15 07:37 . 2010-12-20 23:59	611840 c:\windows\ie8updates\KB2497640-IE8\mstime.dll
+ 2011-04-15 07:37 . 2010-12-20 23:59	602112 c:\windows\ie8updates\KB2497640-IE8\msfeeds.dll
+ 2011-04-15 07:37 . 2010-12-20 23:59	247808 c:\windows\ie8updates\KB2497640-IE8\ieproxy.dll
+ 2011-04-15 07:37 . 2010-12-20 23:59	184320 c:\windows\ie8updates\KB2497640-IE8\iepeers.dll
+ 2011-04-15 07:37 . 2010-12-20 23:59	743424 c:\windows\ie8updates\KB2497640-IE8\iedvtool.dll
+ 2011-04-15 07:37 . 2010-12-20 23:59	387584 c:\windows\ie8updates\KB2497640-IE8\iedkcs32.dll
+ 2011-04-15 07:37 . 2010-12-20 12:55	173568 c:\windows\ie8updates\KB2497640-IE8\ie4uinit.exe
+ 2011-02-09 22:44 . 2010-11-06 00:26	916480 c:\windows\ie8updates\KB2482017-IE8\wininet.dll
+ 2011-02-09 22:44 . 2010-07-05 13:16	382840 c:\windows\ie8updates\KB2482017-IE8\spuninst\updspapi.dll
+ 2011-02-09 22:44 . 2010-07-05 13:15	231288 c:\windows\ie8updates\KB2482017-IE8\spuninst\spuninst.exe
+ 2011-02-09 22:44 . 2010-11-06 00:26	206848 c:\windows\ie8updates\KB2482017-IE8\occache.dll
+ 2011-02-09 22:44 . 2010-11-06 00:26	611840 c:\windows\ie8updates\KB2482017-IE8\mstime.dll
+ 2011-02-09 22:44 . 2010-11-06 00:26	602112 c:\windows\ie8updates\KB2482017-IE8\msfeeds.dll
+ 2011-02-09 22:44 . 2010-11-06 00:26	247808 c:\windows\ie8updates\KB2482017-IE8\ieproxy.dll
+ 2011-02-09 22:44 . 2010-11-06 00:26	184320 c:\windows\ie8updates\KB2482017-IE8\iepeers.dll
+ 2011-02-09 22:44 . 2010-11-06 00:26	743424 c:\windows\ie8updates\KB2482017-IE8\iedvtool.dll
+ 2011-02-09 22:44 . 2010-11-06 00:26	387584 c:\windows\ie8updates\KB2482017-IE8\iedkcs32.dll
+ 2011-02-09 22:44 . 2010-11-03 12:26	173568 c:\windows\ie8updates\KB2482017-IE8\ie4uinit.exe
+ 2010-12-16 08:05 . 2010-09-10 05:58	916480 c:\windows\ie8updates\KB2416400-IE8\wininet.dll
+ 2010-12-16 08:05 . 2010-07-05 13:16	382840 c:\windows\ie8updates\KB2416400-IE8\spuninst\updspapi.dll
+ 2010-12-16 08:05 . 2010-02-22 14:23	231288 c:\windows\ie8updates\KB2416400-IE8\spuninst\spuninst.exe
+ 2010-12-16 08:05 . 2010-09-10 05:58	206848 c:\windows\ie8updates\KB2416400-IE8\occache.dll
+ 2010-12-16 08:05 . 2010-09-10 05:58	611840 c:\windows\ie8updates\KB2416400-IE8\mstime.dll
+ 2010-12-16 08:05 . 2010-09-10 05:58	602112 c:\windows\ie8updates\KB2416400-IE8\msfeeds.dll
+ 2010-12-16 08:05 . 2010-09-10 05:58	247808 c:\windows\ie8updates\KB2416400-IE8\ieproxy.dll
+ 2010-12-16 08:05 . 2010-09-10 05:58	184320 c:\windows\ie8updates\KB2416400-IE8\iepeers.dll
+ 2010-12-16 08:05 . 2010-09-10 05:58	743424 c:\windows\ie8updates\KB2416400-IE8\iedvtool.dll
+ 2010-12-16 08:05 . 2010-09-10 05:58	387584 c:\windows\ie8updates\KB2416400-IE8\iedkcs32.dll
+ 2010-12-16 08:05 . 2010-08-26 12:22	173056 c:\windows\ie8updates\KB2416400-IE8\ie4uinit.exe
+ 2010-10-12 20:35 . 2010-06-24 12:22	916480 c:\windows\ie8updates\KB2360131-IE8\wininet.dll
+ 2010-10-12 20:36 . 2010-07-05 13:16	382840 c:\windows\ie8updates\KB2360131-IE8\spuninst\updspapi.dll
+ 2010-10-12 20:36 . 2009-05-26 09:01	231288 c:\windows\ie8updates\KB2360131-IE8\spuninst\spuninst.exe
+ 2010-10-12 20:35 . 2010-06-24 12:22	206848 c:\windows\ie8updates\KB2360131-IE8\occache.dll
+ 2010-10-12 20:35 . 2010-06-24 12:22	611840 c:\windows\ie8updates\KB2360131-IE8\mstime.dll
+ 2010-10-12 20:35 . 2010-06-24 12:21	599040 c:\windows\ie8updates\KB2360131-IE8\msfeeds.dll
+ 2010-10-12 20:36 . 2010-06-24 12:21	247808 c:\windows\ie8updates\KB2360131-IE8\ieproxy.dll
+ 2010-10-12 20:35 . 2010-06-24 12:21	184320 c:\windows\ie8updates\KB2360131-IE8\iepeers.dll
+ 2010-10-12 20:36 . 2010-06-24 12:21	743424 c:\windows\ie8updates\KB2360131-IE8\iedvtool.dll
+ 2010-10-12 20:35 . 2010-06-24 12:21	387584 c:\windows\ie8updates\KB2360131-IE8\iedkcs32.dll
+ 2010-10-12 20:35 . 2010-06-23 12:08	173056 c:\windows\ie8updates\KB2360131-IE8\ie4uinit.exe
+ 2010-08-11 01:08 . 2010-05-06 10:41	916480 c:\windows\ie8updates\KB2183461-IE8\wininet.dll
+ 2010-08-11 01:08 . 2010-02-22 14:23	382840 c:\windows\ie8updates\KB2183461-IE8\spuninst\updspapi.dll
+ 2010-08-11 01:08 . 2009-05-26 09:01	231288 c:\windows\ie8updates\KB2183461-IE8\spuninst\spuninst.exe
+ 2010-08-11 01:08 . 2010-05-06 10:41	206848 c:\windows\ie8updates\KB2183461-IE8\occache.dll
+ 2010-08-11 01:08 . 2010-05-06 10:41	611840 c:\windows\ie8updates\KB2183461-IE8\mstime.dll
+ 2010-08-11 01:08 . 2010-05-06 10:41	599040 c:\windows\ie8updates\KB2183461-IE8\msfeeds.dll
+ 2010-08-11 01:08 . 2010-05-06 10:41	247808 c:\windows\ie8updates\KB2183461-IE8\ieproxy.dll
+ 2010-08-11 01:08 . 2010-05-06 10:41	184320 c:\windows\ie8updates\KB2183461-IE8\iepeers.dll
+ 2010-08-11 01:08 . 2010-05-06 10:41	743424 c:\windows\ie8updates\KB2183461-IE8\iedvtool.dll
+ 2010-08-11 01:08 . 2010-05-06 10:41	387584 c:\windows\ie8updates\KB2183461-IE8\iedkcs32.dll
+ 2010-08-11 01:08 . 2010-05-05 13:30	173056 c:\windows\ie8updates\KB2183461-IE8\ie4uinit.exe
+ 2010-10-06 23:57 . 2003-11-26 15:07	379215 c:\windows\Driver Cache\install.exe
+ 2010-02-05 15:34 . 2011-02-17 13:18	455936 c:\windows\Driver Cache\i386\mrxsmb.sys
+ 2010-11-09 18:57 . 2003-09-15 02:16	324576 c:\windows\Driver Cache\ar52119x.sys
+ 2010-11-09 18:57 . 2003-09-15 02:16	324608 c:\windows\Driver Cache\ar5211.sys
+ 2010-04-15 18:45 . 2010-04-15 18:45	732296 c:\windows\Downloaded Program Files\Photochannel.dll
+ 2010-05-02 03:06 . 2002-07-25 21:05	172032 c:\windows\Downloaded Program Files\isusweb.dll
+ 2010-05-02 03:06 . 2002-07-25 21:13	196608 c:\windows\Downloaded Program Files\dwusplay.exe
+ 2010-10-08 23:21 . 2010-10-08 23:21	130323 c:\windows\CC33E708A7954AB3908A8F45919BC097.TMP\WiseCustomCalla.dll
+ 2010-12-26 00:59 . 2010-12-26 00:59	130323 c:\windows\BB77DC4CB8184FD48D1D5D3B617B78B4.TMP\WiseCustomCalla.exe
+ 2011-04-15 07:47 . 2011-04-15 07:47	321536 c:\windows\assembly\NativeImages_v2.0.50727_32\WsatConfig\95de80b860252231b46014f58226e473\WsatConfig.ni.exe
+ 2011-04-15 07:43 . 2011-04-15 07:43	240128 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\715710f5a31a494ed5c0ec0874dafe3e\WindowsFormsIntegration.ni.dll
+ 2011-04-15 07:42 . 2011-04-15 07:42	187904 c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationTypes\017be0e6c5f1810f15a696157cd5e2c2\UIAutomationTypes.ni.dll
+ 2011-04-15 07:42 . 2011-04-15 07:42	447488 c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClient\bec5b0a93df12eb26c02c877a4eae678\UIAutomationClient.ni.dll
+ 2011-04-15 07:57 . 2011-04-15 07:57	400896 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml.Linq\3d8f787002439f4942c33f376cfd8555\System.Xml.Linq.ni.dll
+ 2011-04-15 07:55 . 2011-04-15 07:55	129536 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Routing\4b746fea8062a10ccc6e5331914e7dad\System.Web.Routing.ni.dll
+ 2011-04-15 07:55 . 2011-04-15 07:55	202240 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\103956fdb019bce8a173fe9cb9da3e02\System.Web.RegularExpressions.ni.dll
+ 2011-04-15 07:55 . 2011-04-15 07:55	859648 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\c0a156fbf46ad272ac262e45eaa998f4\System.Web.Extensions.Design.ni.dll
+ 2011-04-15 07:55 . 2011-04-15 07:55	328704 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity\e3651e13567ce4e3fa7bb2fbab737d9a\System.Web.Entity.ni.dll
+ 2011-04-15 07:55 . 2011-04-15 07:55	301056 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity.D#\834d7769f39e4d937eda1ad3707d4716\System.Web.Entity.Design.ni.dll
+ 2011-04-15 07:55 . 2011-04-15 07:55	547328 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\032c96c6206b53bca122d1fbaf5f8ca2\System.Web.DynamicData.ni.dll
+ 2011-04-15 07:54 . 2011-04-15 07:54	141312 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Abstract#\6ce0e4fb33afcfcce43c427e82b987db\System.Web.Abstractions.ni.dll
+ 2011-04-15 07:54 . 2011-04-15 07:54	627200 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\990d96810a21e0fa95f916ffc66f3a94\System.Transactions.ni.dll
+ 2011-04-15 07:54 . 2011-04-15 07:54	212992 c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\e0d56c0582316e9ecb4c18186e37217c\System.ServiceProcess.ni.dll
+ 2011-04-15 07:47 . 2011-04-15 07:47	679936 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Security\9e91cca51a5ed6fb13b67558109d2726\System.Security.ni.dll
+ 2011-04-15 07:52 . 2011-04-15 07:52	311296 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\fa6a58394a1f162eecce4cd8af0875c3\System.Runtime.Serialization.Formatters.Soap.ni.dll
+ 2011-04-15 07:53 . 2011-04-15 07:53	621056 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Net\6194eb4bc1e0133d0183d086b747f512\System.Net.ni.dll
+ 2011-04-15 07:53 . 2011-04-15 07:53	998400 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Management\042658de519bb1e22ec5925092061892\System.Management.ni.dll
+ 2011-04-15 07:52 . 2011-04-15 07:52	330752 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Management.I#\d6ae8171ae6fd4fe83add34e6d70e5b5\System.Management.Instrumentation.ni.dll
+ 2011-04-15 07:45 . 2011-04-15 07:45	381440 c:\windows\assembly\NativeImages_v2.0.50727_32\System.IO.Log\abd5a61d39e474f12b30ccbbe6277667\System.IO.Log.ni.dll
+ 2011-04-15 07:45 . 2011-04-15 07:45	212992 c:\windows\assembly\NativeImages_v2.0.50727_32\System.IdentityMode#\12c4dba6d4ff0278d208c283d9ed7670\System.IdentityModel.Selectors.ni.dll
+ 2011-04-15 07:52 . 2011-04-15 07:52	280064 c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\ff5c7a52497d892f3a3206384d46b5e7\System.EnterpriseServices.Wrapper.dll
+ 2011-04-15 07:52 . 2011-04-15 07:52	627712 c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\ff5c7a52497d892f3a3206384d46b5e7\System.EnterpriseServices.ni.dll
+ 2011-04-15 07:40 . 2011-04-15 07:40	208384 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing.Desi#\e6b7128278d8c0e8382a5685f5b196c6\System.Drawing.Design.ni.dll
+ 2011-04-15 07:52 . 2011-04-15 07:52	881152 c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\8ef56bf47fc2fc4204e0fcc1f32bab01\System.DirectoryServices.AccountManagement.ni.dll
+ 2011-04-15 07:52 . 2011-04-15 07:52	455680 c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\447d7b4a7d0add13f8d2086088bcc41c\System.DirectoryServices.Protocols.ni.dll
+ 2011-04-15 07:52 . 2011-04-15 07:52	354816 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\ce2afe8854ee9cdc834b6f392348c882\System.Data.Services.Design.ni.dll
+ 2011-04-15 07:52 . 2011-04-15 07:52	939008 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\03d4658290e300e437e745ef4a613b59\System.Data.Services.Client.ni.dll
+ 2011-04-15 07:51 . 2011-04-15 07:51	756736 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Entity.#\7ce21a2855bb7731de4dab797e69f3f6\System.Data.Entity.Design.ni.dll
+ 2011-04-15 07:48 . 2011-04-15 07:48	135680 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.DataSet#\ea57694aea47c05853516c9bb2ad54b4\System.Data.DataSetExtensions.ni.dll
+ 2011-04-15 07:47 . 2011-04-15 07:47	971264 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\3d6b4509225efde2a4e3db77205f8a51\System.Configuration.ni.dll
+ 2011-04-15 07:52 . 2011-04-15 07:52	141312 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\f312bb844670ebc7458fec9e6b2568b3\System.Configuration.Install.ni.dll
+ 2011-04-15 07:48 . 2011-04-15 07:48	633856 c:\windows\assembly\NativeImages_v2.0.50727_32\System.AddIn\afd9595f07a8c68b26e81cf995957f56\System.AddIn.ni.dll
+ 2011-04-15 07:47 . 2011-04-15 07:47	366080 c:\windows\assembly\NativeImages_v2.0.50727_32\SMSvcHost\3a42b2fbafe93d7b9395e328bea35afa\SMSvcHost.ni.exe
+ 2011-04-15 07:47 . 2011-04-15 07:47	256000 c:\windows\assembly\NativeImages_v2.0.50727_32\SMDiagnostics\97ff96d3fc8d0b10ea294f320acf821e\SMDiagnostics.ni.dll
+ 2011-04-15 07:47 . 2011-04-15 07:47	320512 c:\windows\assembly\NativeImages_v2.0.50727_32\ServiceModelReg\28ed0e9efd938b05b4f53e0d90046701\ServiceModelReg.ni.exe
+ 2011-04-15 07:37 . 2011-04-15 07:37	368128 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\ffe13679e6b3e36e5cb6c47f8c4faf9c\PresentationFramework.Aero.ni.dll
+ 2011-04-15 07:37 . 2011-04-15 07:37	224768 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\dbb40299379f2009c140ddadb04231b4\PresentationFramework.Classic.ni.dll
+ 2011-04-15 07:37 . 2011-04-15 07:37	258048 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\a34cd33cec1bdfebe4a3910bceb8723b\PresentationFramework.Royale.ni.dll
+ 2011-04-15 07:37 . 2011-04-15 07:37	539648 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\689bb394bcb437ed085c22a43aba30c6\PresentationFramework.Luna.ni.dll
+ 2011-04-15 07:47 . 2011-04-15 07:47	133632 c:\windows\assembly\NativeImages_v2.0.50727_32\MSBuild\5670e74887ef1025c6a8c056ffe86b38\MSBuild.ni.exe
+ 2011-04-15 07:47 . 2011-04-15 07:47	386560 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\653732002ebf5c68f69150a60e145e6a\Microsoft.Transactions.Bridge.Dtc.ni.dll
+ 2011-04-15 07:48 . 2011-04-15 07:48	175104 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\cc62770393640302bd4d7e442b1e49a4\Microsoft.Build.Utilities.v3.5.ni.dll
+ 2011-04-15 07:48 . 2011-04-15 07:48	144384 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\352bff1ee71ce114e225f849038dc48d\Microsoft.Build.Utilities.ni.dll
+ 2011-04-15 07:47 . 2011-04-15 07:47	839680 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\7345f4d2d7157bf49de4158e8f2b6847\Microsoft.Build.Engine.ni.dll
+ 2011-04-15 07:47 . 2011-04-15 07:47	222720 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Con#\d7dba901ddd410ca1a0156d0f2a27533\Microsoft.Build.Conversion.v3.5.ni.dll
+ 2011-04-15 07:47 . 2011-04-15 07:47	220672 c:\windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\010552e529d130ce914765b0801e2367\CustomMarshalers.ni.dll
+ 2011-04-15 07:46 . 2011-04-15 07:46	410112 c:\windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\6861f639b13967e9b014b44bbb7c5d4c\ComSvcConfig.ni.exe
+ 2011-04-15 07:45 . 2011-04-15 07:45	842240 c:\windows\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\800da7dec567fadf3392091e9f01ecb9\AspNetMMCExt.ni.dll
+ 2011-04-15 07:25 . 2011-04-15 07:25	839680 c:\windows\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	839680 c:\windows\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	835584 c:\windows\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
+ 2011-04-15 07:25 . 2011-04-15 07:25	835584 c:\windows\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
+ 2011-04-15 07:25 . 2011-04-15 07:25	114688 c:\windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	114688 c:\windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	258048 c:\windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
+ 2011-04-15 07:25 . 2011-04-15 07:25	258048 c:\windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
+ 2010-06-10 04:48 . 2010-06-10 04:48	970752 c:\windows\assembly\GAC_MSIL\System.Runtime.Serialization\3.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll
+ 2011-04-15 07:25 . 2011-04-15 07:25	131072 c:\windows\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	131072 c:\windows\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	303104 c:\windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
+ 2011-04-15 07:25 . 2011-04-15 07:25	303104 c:\windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
+ 2011-04-15 07:25 . 2011-04-15 07:25	258048 c:\windows\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	258048 c:\windows\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	372736 c:\windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
+ 2011-04-15 07:25 . 2011-04-15 07:25	372736 c:\windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
+ 2010-06-10 04:48 . 2010-06-10 04:48	438272 c:\windows\assembly\GAC_MSIL\System.IdentityModel\3.0.0.0__b77a5c561934e089\System.IdentityModel.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	626688 c:\windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
+ 2011-04-15 07:25 . 2011-04-15 07:25	626688 c:\windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
+ 2011-04-15 07:25 . 2011-04-15 07:25	401408 c:\windows\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	401408 c:\windows\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	188416 c:\windows\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
+ 2011-04-15 07:25 . 2011-04-15 07:25	188416 c:\windows\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
+ 2011-04-15 07:26 . 2011-04-15 07:26	970752 c:\windows\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	970752 c:\windows\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	745472 c:\windows\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
+ 2011-04-15 07:26 . 2011-04-15 07:26	745472 c:\windows\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	425984 c:\windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
+ 2011-04-15 07:26 . 2011-04-15 07:26	425984 c:\windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	110592 c:\windows\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
+ 2011-04-15 07:26 . 2011-04-15 07:26	110592 c:\windows\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
+ 2010-06-10 04:48 . 2010-06-10 04:48	110592 c:\windows\assembly\GAC_MSIL\SMDiagnostics\3.0.0.0__b77a5c561934e089\SMdiagnostics.dll
- 2010-02-17 08:02 . 2010-02-17 08:02	110592 c:\windows\assembly\GAC_MSIL\SMDiagnostics\3.0.0.0__b77a5c561934e089\SMdiagnostics.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	659456 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
+ 2011-04-15 07:25 . 2011-04-15 07:25	659456 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
+ 2011-04-15 07:25 . 2011-04-15 07:25	372736 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	372736 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	110592 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
+ 2011-04-15 07:25 . 2011-04-15 07:25	110592 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	749568 c:\windows\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
+ 2011-04-15 07:25 . 2011-04-15 07:25	749568 c:\windows\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
+ 2011-04-15 07:25 . 2011-04-15 07:25	655360 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	655360 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
+ 2011-04-15 07:25 . 2011-04-15 07:25	348160 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	348160 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
+ 2011-04-15 07:24 . 2011-04-15 07:24	507904 c:\windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	507904 c:\windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
+ 2011-04-15 07:25 . 2011-04-15 07:25	261632 c:\windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	261632 c:\windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
+ 2011-04-15 07:26 . 2011-04-15 07:26	486400 c:\windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	486400 c:\windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
+ 2010-10-08 23:21 . 2010-10-08 23:21	130323 c:\windows\8A83AE5FF59B4E1FBF2A49185A42ED1B.TMP\WiseCustomCalla.exe
+ 2010-12-26 00:59 . 2010-12-26 00:59	130323 c:\windows\8A83AE5FF59B4E1FBF2A49185A42ED1B.TMP\WiseCustomCalla.dll
+ 2010-10-08 23:19 . 2010-10-08 23:19	129728 c:\windows\7E7D778E121D4BBDBA29FAA81B9FBD8C.TMP\WiseCustomCalla.exe
+ 2010-07-16 02:59 . 2006-09-16 05:05	379184 c:\windows\$NtUninstallWudf01000$\spuninst\updspapi.dll
+ 2010-07-16 02:59 . 2006-09-16 05:05	221488 c:\windows\$NtUninstallWudf01000$\spuninst\spuninst.exe
+ 2010-07-16 03:01 . 2008-04-14 00:12	102400 c:\windows\$NtUninstallwmp11$\wmpshell.dll
+ 2010-07-16 03:01 . 2009-07-12 17:21	233472 c:\windows\$NtUninstallwmp11$\wmpdxm.dll
+ 2010-07-16 03:01 . 2008-04-14 00:12	114688 c:\windows\$NtUninstallwmp11$\wmpasf.dll
+ 2010-07-16 03:01 . 2008-04-13 17:23	168448 c:\windows\$NtUninstallwmp11$\wmerror.dll
+ 2010-07-16 03:01 . 2008-04-14 00:12	208896 c:\windows\$NtUninstallwmp11$\unregmp2.exe
+ 2010-07-16 03:01 . 2008-02-13 16:52	371424 c:\windows\$NtUninstallwmp11$\spuninst\updspapi.dll
+ 2010-07-16 03:01 . 2008-02-13 16:52	213216 c:\windows\$NtUninstallwmp11$\spuninst\spuninst.exe
+ 2010-07-16 03:01 . 2008-04-14 00:12	774144 c:\windows\$NtUninstallwmp11$\setup_wm.exe
+ 2010-07-16 03:01 . 2008-04-14 00:11	368640 c:\windows\$NtUninstallwmp11$\mpvis.dll
+ 2010-07-16 03:00 . 2005-01-28 18:44	331264 c:\windows\$NtUninstallWMFDist11$\wpdsp.dll
+ 2010-07-16 03:00 . 2005-01-28 18:44	114176 c:\windows\$NtUninstallWMFDist11$\wpdmtp.dll
+ 2010-07-16 03:00 . 2005-01-28 18:44	895736 c:\windows\$NtUninstallWMFDist11$\wmvdmod.dll
+ 2010-07-16 03:00 . 2005-01-28 18:44	940544 c:\windows\$NtUninstallWMFDist11$\wmspdmoe.dll
+ 2010-07-16 03:00 . 2009-04-10 06:01	413032 c:\windows\$NtUninstallWMFDist11$\wmspdmod.dll
+ 2010-07-16 03:00 . 2005-01-28 18:44	819200 c:\windows\$NtUninstallWMFDist11$\wmsetsdk.exe
+ 2010-07-16 03:00 . 2005-01-28 18:44	774904 c:\windows\$NtUninstallWMFDist11$\wmsdmod.dll
+ 2010-07-16 03:00 . 2005-01-28 18:44	150016 c:\windows\$NtUninstallWMFDist11$\wmidx.dll
+ 2010-07-16 03:00 . 2005-01-28 18:44	290816 c:\windows\$NtUninstallWMFDist11$\wmdrmnet.dll
+ 2010-07-16 03:00 . 2005-01-28 18:44	335872 c:\windows\$NtUninstallWMFDist11$\wmdrmdev.dll
+ 2010-07-16 03:00 . 2007-10-27 22:40	227328 c:\windows\$NtUninstallWMFDist11$\wmasf.dll
+ 2010-07-16 03:00 . 2005-01-28 18:44	716288 c:\windows\$NtUninstallWMFDist11$\wmadmoe.dll
+ 2010-07-16 03:00 . 2005-01-28 18:44	396528 c:\windows\$NtUninstallWMFDist11$\wmadmod.dll
+ 2010-07-16 03:00 . 2008-02-13 16:52	371424 c:\windows\$NtUninstallWMFDist11$\spuninst\updspapi.dll
+ 2010-07-16 03:00 . 2008-02-13 16:52	213216 c:\windows\$NtUninstallWMFDist11$\spuninst\spuninst.exe
+ 2010-07-16 03:00 . 2005-01-28 18:44	221184 c:\windows\$NtUninstallWMFDist11$\qasf.dll
+ 2010-07-16 03:00 . 2005-01-28 18:44	315904 c:\windows\$NtUninstallWMFDist11$\mswmdm.dll
+ 2010-07-16 03:00 . 2005-01-28 18:44	364784 c:\windows\$NtUninstallWMFDist11$\msscp.dll
+ 2010-07-16 03:00 . 2005-01-28 18:44	173568 c:\windows\$NtUninstallWMFDist11$\mspmsp.dll
+ 2010-07-16 03:00 . 2005-01-28 18:44	142336 c:\windows\$NtUninstallWMFDist11$\msnetobj.dll
+ 2010-07-16 03:00 . 2008-04-14 00:11	240640 c:\windows\$NtUninstallWMFDist11$\mpg4dmod.dll
+ 2010-07-16 03:00 . 2008-04-14 00:11	384512 c:\windows\$NtUninstallWMFDist11$\mp4sdmod.dll
+ 2010-07-16 03:00 . 2008-04-14 00:11	310272 c:\windows\$NtUninstallWMFDist11$\mp43dmod.dll
+ 2010-07-16 03:00 . 2005-01-28 18:44	502272 c:\windows\$NtUninstallWMFDist11$\drmv2clt.dll
+ 2010-07-16 03:00 . 2005-01-28 18:44	164864 c:\windows\$NtUninstallWMFDist11$\cewmdm.dll
+ 2010-07-16 03:00 . 2005-01-28 18:44	294912 c:\windows\$NtUninstallWMFDist11$\blackbox.dll
+ 2010-07-16 03:02 . 2006-09-25 21:58	379184 c:\windows\$NtUninstallMSCompPackV1$\spuninst\updspapi.dll
+ 2010-07-16 03:02 . 2006-09-25 21:58	221488 c:\windows\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe
+ 2010-09-15 07:02 . 2010-02-22 14:23	382840 c:\windows\$NtUninstallKB982802$\spuninst\updspapi.dll
+ 2010-09-15 07:02 . 2010-02-22 14:23	231288 c:\windows\$NtUninstallKB982802$\spuninst\spuninst.exe
+ 2010-09-15 07:02 . 2009-04-15 14:51	585216 c:\windows\$NtUninstallKB982802$\rpcrt4.dll
+ 2010-08-11 01:05 . 2010-02-22 14:23	382840 c:\windows\$NtUninstallKB982665$\spuninst\updspapi.dll
+ 2010-08-11 01:05 . 2010-02-22 14:23	231288 c:\windows\$NtUninstallKB982665$\spuninst\spuninst.exe
+ 2010-08-11 01:18 . 2009-12-31 16:50	353792 c:\windows\$NtUninstallKB982214$\srv.sys
+ 2010-08-11 01:18 . 2010-02-22 14:23	382840 c:\windows\$NtUninstallKB982214$\spuninst\updspapi.dll
+ 2010-08-11 01:18 . 2010-02-22 14:23	231288 c:\windows\$NtUninstallKB982214$\spuninst\spuninst.exe
+ 2010-10-12 20:38 . 2009-10-15 16:28	119808 c:\windows\$NtUninstallKB982132$\t2embed.dll
+ 2010-10-12 20:38 . 2009-05-26 11:40	382840 c:\windows\$NtUninstallKB982132$\spuninst\updspapi.dll
+ 2010-10-12 20:38 . 2009-05-26 11:40	231288 c:\windows\$NtUninstallKB982132$\spuninst\spuninst.exe
+ 2010-08-11 01:06 . 2009-05-26 11:40	382840 c:\windows\$NtUninstallKB981997$\spuninst\updspapi.dll
+ 2010-08-11 01:06 . 2009-05-26 11:40	231288 c:\windows\$NtUninstallKB981997$\spuninst\spuninst.exe
+ 2010-10-12 20:38 . 2010-02-22 14:23	382840 c:\windows\$NtUninstallKB981957$\spuninst\updspapi.dll
+ 2010-10-12 20:38 . 2010-02-22 14:23	231288 c:\windows\$NtUninstallKB981957$\spuninst\spuninst.exe
+ 2010-08-11 01:18 . 2010-02-22 14:23	382840 c:\windows\$NtUninstallKB981852$\spuninst\updspapi.dll
+ 2010-08-11 01:18 . 2010-02-22 14:23	231288 c:\windows\$NtUninstallKB981852$\spuninst\spuninst.exe
+ 2010-05-26 12:21 . 2009-05-26 09:01	382840 c:\windows\$NtUninstallKB981793$\spuninst\updspapi.dll
+ 2010-05-26 12:21 . 2009-05-26 09:01	231288 c:\windows\$NtUninstallKB981793$\spuninst\spuninst.exe
+ 2010-09-15 07:02 . 2008-04-14 00:12	406016 c:\windows\$NtUninstallKB981322$\usp10.dll
+ 2010-09-15 07:02 . 2009-05-26 11:40	382840 c:\windows\$NtUninstallKB981322$\spuninst\updspapi.dll
+ 2010-09-15 07:02 . 2009-05-26 11:40	231288 c:\windows\$NtUninstallKB981322$\spuninst\spuninst.exe
+ 2010-08-11 01:07 . 2009-05-26 11:40	382840 c:\windows\$NtUninstallKB980436$\spuninst\updspapi.dll
+ 2010-08-11 01:07 . 2009-05-26 11:40	231288 c:\windows\$NtUninstallKB980436$\spuninst\spuninst.exe
+ 2010-08-11 01:07 . 2009-06-25 08:25	147456 c:\windows\$NtUninstallKB980436$\schannel.dll
+ 2010-04-15 00:10 . 2009-05-26 09:01	382840 c:\windows\$NtUninstallKB980232$\spuninst\updspapi.dll
+ 2010-04-15 00:10 . 2009-05-26 09:01	231288 c:\windows\$NtUninstallKB980232$\spuninst\spuninst.exe
+ 2010-04-15 00:10 . 2009-12-04 18:22	455424 c:\windows\$NtUninstallKB980232$\mrxsmb.sys
+ 2010-06-10 04:53 . 2009-05-26 11:40	382840 c:\windows\$NtUninstallKB980218$\spuninst\updspapi.dll
+ 2010-06-10 04:53 . 2009-05-26 11:40	231288 c:\windows\$NtUninstallKB980218$\spuninst\spuninst.exe
+ 2010-06-10 04:53 . 2008-04-14 00:09	285696 c:\windows\$NtUninstallKB980218$\atmfd.dll
+ 2010-06-10 04:53 . 2008-07-08 13:02	382840 c:\windows\$NtUninstallKB980195$\spuninst\updspapi.dll
+ 2010-06-10 04:53 . 2008-07-08 13:02	231288 c:\windows\$NtUninstallKB980195$\spuninst\spuninst.exe
+ 2010-10-12 20:34 . 2008-04-21 12:08	215552 c:\windows\$NtUninstallKB979687$\wordpad.exe
+ 2010-10-12 20:34 . 2009-05-26 11:40	382840 c:\windows\$NtUninstallKB979687$\spuninst\updspapi.dll
+ 2010-10-12 20:34 . 2009-05-26 09:01	231288 c:\windows\$NtUninstallKB979687$\spuninst\spuninst.exe
+ 2010-04-15 00:10 . 2009-05-26 11:40	382840 c:\windows\$NtUninstallKB979683$\spuninst\updspapi.dll
+ 2010-04-15 00:10 . 2009-05-26 11:40	231288 c:\windows\$NtUninstallKB979683$\spuninst\spuninst.exe
+ 2010-06-10 04:53 . 2009-05-26 11:40	382840 c:\windows\$NtUninstallKB979559$\spuninst\updspapi.dll
+ 2010-06-10 04:53 . 2009-05-26 09:01	231288 c:\windows\$NtUninstallKB979559$\spuninst\spuninst.exe
+ 2010-06-10 04:49 . 2009-05-26 11:40	382840 c:\windows\$NtUninstallKB979482$\spuninst\updspapi.dll
+ 2010-06-10 04:49 . 2009-05-26 11:40	231288 c:\windows\$NtUninstallKB979482$\spuninst\spuninst.exe
+ 2010-04-15 00:10 . 2007-07-28 03:11	382840 c:\windows\$NtUninstallKB979402_WM9$\spuninst\updspapi.dll
+ 2010-04-15 00:10 . 2007-07-28 03:11	231288 c:\windows\$NtUninstallKB979402_WM9$\spuninst\spuninst.exe
+ 2010-06-10 04:38 . 2007-07-28 03:11	382840 c:\windows\$NtUninstallKB979332_WM9L$\spuninst\updspapi.dll
+ 2010-06-10 04:38 . 2007-07-28 03:11	231288 c:\windows\$NtUninstallKB979332_WM9L$\spuninst\spuninst.exe
+ 2010-04-14 07:00 . 2009-05-26 11:40	382840 c:\windows\$NtUninstallKB979309$\spuninst\updspapi.dll
+ 2010-04-14 07:00 . 2008-07-08 13:02	231288 c:\windows\$NtUninstallKB979309$\spuninst\spuninst.exe
+ 2010-06-10 04:49 . 2007-07-28 03:11	382840 c:\windows\$NtUninstallKB978695_WM9$\spuninst\updspapi.dll
+ 2010-06-10 04:49 . 2007-07-28 03:11	231288 c:\windows\$NtUninstallKB978695_WM9$\spuninst\spuninst.exe
+ 2010-04-14 07:00 . 2008-04-14 00:12	176640 c:\windows\$NtUninstallKB978601$\wintrust.dll
+ 2010-04-14 07:00 . 2009-05-26 11:40	382840 c:\windows\$NtUninstallKB978601$\spuninst\updspapi.dll
+ 2010-04-14 07:00 . 2008-07-08 13:02	231288 c:\windows\$NtUninstallKB978601$\spuninst\spuninst.exe
+ 2010-05-11 20:35 . 2009-05-26 11:40	382840 c:\windows\$NtUninstallKB978542$\spuninst\updspapi.dll
+ 2010-05-11 20:35 . 2009-05-26 11:40	231288 c:\windows\$NtUninstallKB978542$\spuninst\spuninst.exe
+ 2010-05-11 20:35 . 2008-04-11 19:04	691712 c:\windows\$NtUninstallKB978542$\inetcomm.dll
+ 2010-04-15 00:09 . 2008-06-20 11:08	225856 c:\windows\$NtUninstallKB978338$\tcpip6.sys
+ 2010-04-15 00:09 . 2009-05-26 11:40	382840 c:\windows\$NtUninstallKB978338$\spuninst\updspapi.dll
+ 2010-04-15 00:09 . 2009-05-26 11:40	231288 c:\windows\$NtUninstallKB978338$\spuninst\spuninst.exe
+ 2010-04-15 00:09 . 2008-04-14 00:11	100352 c:\windows\$NtUninstallKB978338$\6to4svc.dll
+ 2010-04-15 00:09 . 2009-05-26 11:40	382840 c:\windows\$NtUninstallKB977816$\spuninst\updspapi.dll
+ 2010-04-15 00:09 . 2009-05-26 11:40	231288 c:\windows\$NtUninstallKB977816$\spuninst\spuninst.exe
+ 2010-06-10 04:49 . 2009-05-26 11:40	382840 c:\windows\$NtUninstallKB975562$\spuninst\updspapi.dll
+ 2010-06-10 04:49 . 2008-07-08 13:02	231288 c:\windows\$NtUninstallKB975562$\spuninst\spuninst.exe
+ 2010-09-15 07:03 . 2007-07-28 03:11	382840 c:\windows\$NtUninstallKB975558_WM8$\spuninst\updspapi.dll
+ 2010-09-15 07:03 . 2007-07-28 03:11	231288 c:\windows\$NtUninstallKB975558_WM8$\spuninst\spuninst.exe
+ 2010-09-15 07:03 . 2009-01-31 00:33	317440 c:\windows\$NtUninstallKB975558_WM8$\mp4sdecd.dll
+ 2011-03-16 07:02 . 2009-05-26 11:40	382840 c:\windows\$NtUninstallKB971029$\spuninst\updspapi.dll
+ 2011-03-16 07:02 . 2008-07-08 13:02	231288 c:\windows\$NtUninstallKB971029$\spuninst\spuninst.exe
+ 2011-03-16 07:02 . 2008-04-14 00:12	135168 c:\windows\$NtUninstallKB971029$\shsvcs.dll
+ 2010-05-05 01:35 . 2009-12-22 18:39	379184 c:\windows\$NtUninstallKB952011$\spuninst\updspapi.dll
+ 2010-05-05 01:35 . 2009-12-22 18:39	221488 c:\windows\$NtUninstallKB952011$\spuninst\spuninst.exe
+ 2011-03-24 07:02 . 2010-07-05 13:16	382840 c:\windows\$NtUninstallKB2524375$\spuninst\updspapi.dll
+ 2011-03-24 07:02 . 2010-07-05 13:15	231288 c:\windows\$NtUninstallKB2524375$\spuninst\spuninst.exe
+ 2011-02-09 22:49 . 2010-07-05 13:16	382840 c:\windows\$NtUninstallKB2485376$\spuninst\updspapi.dll
+ 2011-02-09 22:49 . 2010-07-05 13:15	231288 c:\windows\$NtUninstallKB2485376$\spuninst\spuninst.exe
+ 2011-02-09 22:49 . 2010-10-28 13:13	290048 c:\windows\$NtUninstallKB2485376$\atmfd.dll
+ 2011-02-09 22:48 . 2010-07-05 13:16	382840 c:\windows\$NtUninstallKB2483185$\spuninst\updspapi.dll
+ 2011-02-09 22:48 . 2010-07-05 13:15	231288 c:\windows\$NtUninstallKB2483185$\spuninst\spuninst.exe
+ 2011-02-09 22:48 . 2008-04-14 00:12	438272 c:\windows\$NtUninstallKB2483185$\shimgvw.dll
+ 2011-03-10 08:02 . 2010-07-05 13:16	382840 c:\windows\$NtUninstallKB2481109$\spuninst\updspapi.dll
+ 2011-03-10 08:02 . 2010-07-05 13:15	231288 c:\windows\$NtUninstallKB2481109$\spuninst\spuninst.exe
+ 2011-03-10 08:02 . 2008-04-14 00:12	677888 c:\windows\$NtUninstallKB2481109$\mstsc.exe
+ 2011-03-10 08:14 . 2010-07-05 13:16	382840 c:\windows\$NtUninstallKB2479943$\spuninst\updspapi.dll
+ 2011-03-10 08:14 . 2010-07-05 13:15	231288 c:\windows\$NtUninstallKB2479943$\spuninst\spuninst.exe
+ 2011-03-10 08:14 . 2008-04-14 00:12	270848 c:\windows\$NtUninstallKB2479943$\sbe.dll
+ 2011-03-10 08:14 . 2008-04-14 00:11	186880 c:\windows\$NtUninstallKB2479943$\encdec.dll
+ 2011-02-09 22:49 . 2010-07-05 13:16	382840 c:\windows\$NtUninstallKB2479628$\spuninst\updspapi.dll
+ 2011-02-09 22:49 . 2010-07-05 13:15	231288 c:\windows\$NtUninstallKB2479628$\spuninst\spuninst.exe
+ 2011-02-09 22:49 . 2010-07-05 13:16	382840 c:\windows\$NtUninstallKB2478971$\spuninst\updspapi.dll
+ 2011-02-09 22:49 . 2010-07-05 13:15	231288 c:\windows\$NtUninstallKB2478971$\spuninst\spuninst.exe
+ 2011-02-09 22:49 . 2009-06-25 08:25	301568 c:\windows\$NtUninstallKB2478971$\kerberos.dll
+ 2011-02-09 22:44 . 2010-07-05 13:16	382840 c:\windows\$NtUninstallKB2478960$\spuninst\updspapi.dll
+ 2011-02-09 22:44 . 2010-07-05 13:15	231288 c:\windows\$NtUninstallKB2478960$\spuninst\spuninst.exe
+ 2011-02-09 22:44 . 2009-06-25 08:25	730112 c:\windows\$NtUninstallKB2478960$\lsasrv.dll
+ 2011-02-09 22:44 . 2010-07-05 13:16	382840 c:\windows\$NtUninstallKB2476687$\spuninst\updspapi.dll
+ 2011-02-09 22:44 . 2010-07-05 13:15	231288 c:\windows\$NtUninstallKB2476687$\spuninst\spuninst.exe
+ 2010-12-16 08:04 . 2010-02-22 14:23	382840 c:\windows\$NtUninstallKB2467659$\spuninst\updspapi.dll
+ 2010-12-16 08:04 . 2010-02-22 14:23	231288 c:\windows\$NtUninstallKB2467659$\spuninst\spuninst.exe
+ 2010-12-16 08:04 . 2008-06-24 07:25	949760 c:\windows\$NtUninstallKB2447961_WM9L$\wmex.dll
+ 2010-12-16 08:04 . 2002-12-12 00:38	613888 c:\windows\$NtUninstallKB2447961_WM9L$\wmenc.exe
+ 2010-12-16 08:04 . 2002-12-12 00:38	163328 c:\windows\$NtUninstallKB2447961_WM9L$\wmdevctl.dll
+ 2010-12-16 08:04 . 2007-07-28 04:11	382840 c:\windows\$NtUninstallKB2447961_WM9L$\spuninst\updspapi.dll
+ 2010-12-16 08:04 . 2007-07-28 04:11	231288 c:\windows\$NtUninstallKB2447961_WM9L$\spuninst\spuninst.exe
+ 2010-12-16 08:04 . 2009-05-26 11:40	382840 c:\windows\$NtUninstallKB2443685$\spuninst\updspapi.dll
+ 2010-12-16 08:04 . 2009-05-26 11:40	231288 c:\windows\$NtUninstallKB2443685$\spuninst\spuninst.exe
+ 2010-12-16 08:05 . 2010-02-22 14:23	382840  c:\windows\$NtUninstallKB2443105$\spuninst\updspapi.dll
+ 2010-12-16 08:05 . 2010-02-22 14:23	231288 c:\windows\$NtUninstallKB2443105$\spuninst\spuninst.exe
+ 2010-12-16 08:04 . 2009-05-26 11:40	382840 c:\windows\$NtUninstallKB2440591$\spuninst\updspapi.dll
+ 2010-12-16 08:04 . 2009-05-26 11:40	231288 c:\windows\$NtUninstallKB2440591$\spuninst\spuninst.exe
+ 2010-12-16 08:04 . 2009-05-26 11:40	382840 c:\windows\$NtUninstallKB2436673$\spuninst\updspapi.dll
+ 2010-12-16 08:04 . 2009-05-26 11:40	231288 c:\windows\$NtUninstallKB2436673$\spuninst\spuninst.exe
+ 2010-12-16 08:01 . 2010-02-22 14:23	382840 c:\windows\$NtUninstallKB2423089$\spuninst\updspapi.dll
+ 2010-12-16 08:01 . 2010-02-22 14:23	231288 c:\windows\$NtUninstallKB2423089$\spuninst\spuninst.exe
+ 2011-01-12 17:49 . 2010-02-22 14:23	382840 c:\windows\$NtUninstallKB2419632$\spuninst\updspapi.dll
+ 2011-01-12 17:49 . 2010-02-22 14:23	231288 c:\windows\$NtUninstallKB2419632$\spuninst\spuninst.exe
+ 2011-01-12 17:49 . 2008-04-14 00:12	249856 c:\windows\$NtUninstallKB2419632$\odbc32.dll
+ 2011-01-12 17:49 . 2008-04-14 00:12	102400 c:\windows\$NtUninstallKB2419632$\msjro.dll
+ 2011-01-12 17:49 . 2008-04-14 00:11	200704 c:\windows\$NtUninstallKB2419632$\msadox.dll
+ 2011-01-12 17:49 . 2008-04-14 00:11	180224 c:\windows\$NtUninstallKB2419632$\msadomd.dll
+ 2011-01-12 17:49 . 2008-04-14 00:11	536576 c:\windows\$NtUninstallKB2419632$\msado15.dll
+ 2011-01-12 17:49 . 2008-04-14 00:11	143360 c:\windows\$NtUninstallKB2419632$\msadco.dll
+ 2011-02-09 22:43 . 2010-07-05 13:16	382840 c:\windows\$NtUninstallKB2393802$\spuninst\updspapi.dll
+ 2011-02-09 22:43 . 2010-07-05 13:15	231288 c:\windows\$NtUninstallKB2393802$\spuninst\spuninst.exe
+ 2011-02-09 22:43 . 2009-02-09 12:10	714752 c:\windows\$NtUninstallKB2393802$\ntdll.dll
+ 2010-10-12 20:37 . 2010-02-22 14:23	382840 c:\windows\$NtUninstallKB2387149$\spuninst\updspapi.dll
+ 2010-10-12 20:37 . 2010-02-22 14:23	231288 c:\windows\$NtUninstallKB2387149$\spuninst\spuninst.exe
+ 2010-10-12 20:37 . 2007-04-03 03:14	981760 c:\windows\$NtUninstallKB2387149$\mfc42u.dll
+ 2010-10-12 20:37 . 2008-04-14 00:11	927504 c:\windows\$NtUninstallKB2387149$\mfc40u.dll
+ 2010-10-12 20:37 . 2003-03-31 12:00	924432 c:\windows\$NtUninstallKB2387149$\mfc40.dll
+ 2010-10-12 20:37 . 2007-07-28 03:11	382840 c:\windows\$NtUninstallKB2378111_WM9$\spuninst\updspapi.dll
+ 2010-10-12 20:37 . 2007-07-28 03:11	231288 c:\windows\$NtUninstallKB2378111_WM9$\spuninst\spuninst.exe
+ 2010-10-12 20:39 . 2010-02-22 14:23	382840 c:\windows\$NtUninstallKB2360937$\spuninst\updspapi.dll
+ 2010-10-12 20:39 . 2010-02-22 14:23	231288 c:\windows\$NtUninstallKB2360937$\spuninst\spuninst.exe
+ 2010-10-12 20:39 . 2010-07-22 15:49	590848 c:\windows\$NtUninstallKB2360937$\rpcrt4.dll
+ 2010-09-15 07:02 . 2009-05-26 11:40	382840 c:\windows\$NtUninstallKB2347290$\spuninst\updspapi.dll
+ 2010-09-15 07:02 . 2009-05-26 11:40	231288 c:\windows\$NtUninstallKB2347290$\spuninst\spuninst.exe
+ 2010-10-12 20:35 . 2010-06-21 15:27	354304 c:\windows\$NtUninstallKB2345886$\srv.sys
+ 2010-10-12 20:35 . 2010-02-22 14:23	382840 c:\windows\$NtUninstallKB2345886$\spuninst\updspapi.dll
+ 2010-10-12 20:35 . 2010-02-22 14:23	231288 c:\windows\$NtUninstallKB2345886$\spuninst\spuninst.exe
+ 2010-12-16 08:05 . 2009-05-26 11:40	382840 c:\windows\$NtUninstallKB2296199$\spuninst\updspapi.dll
+ 2010-12-16 08:05 . 2009-05-26 11:40	231288 c:\windows\$NtUninstallKB2296199$\spuninst\spuninst.exe
+ 2010-12-16 08:05 . 2010-09-01 11:51	285824 c:\windows\$NtUninstallKB2296199$\atmfd.dll
+ 2010-10-12 20:34 . 2009-05-26 09:01	382840 c:\windows\$NtUninstallKB2296011$\spuninst\updspapi.dll
+ 2010-10-12 20:34 . 2009-05-26 09:01	231288 c:\windows\$NtUninstallKB2296011$\spuninst\spuninst.exe
+ 2010-10-12 20:34 . 2008-04-14 00:11	617472 c:\windows\$NtUninstallKB2296011$\comctl32.dll
+ 2010-08-03 07:00 . 2010-02-22 14:23	382840 c:\windows\$NtUninstallKB2286198$\spuninst\updspapi.dll
+ 2010-08-03 07:00 . 2010-02-22 14:23	231288 c:\windows\$NtUninstallKB2286198$\spuninst\spuninst.exe
+ 2010-10-12 20:38 . 2010-07-05 13:16	382840 c:\windows\$NtUninstallKB2279986$\spuninst\updspapi.dll
+ 2010-10-12 20:38 . 2010-02-22 14:23	231288 c:\windows\$NtUninstallKB2279986$\spuninst\spuninst.exe
+ 2010-10-12 20:38 . 2010-04-20 05:30	285696 c:\windows\$NtUninstallKB2279986$\atmfd.dll
+ 2010-09-15 07:03 . 2009-05-26 09:01	382840 c:\windows\$NtUninstallKB2259922$\spuninst\updspapi.dll
+ 2010-09-15 07:03 . 2009-05-26 09:01	231288 c:\windows\$NtUninstallKB2259922$\spuninst\spuninst.exe
+ 2010-07-14 14:45 . 2010-02-22 23:53	382840 c:\windows\$NtUninstallKB2229593$\spuninst\updspapi.dll
+ 2010-07-14 14:45 . 2009-05-26 11:40	231288 c:\windows\$NtUninstallKB2229593$\spuninst\spuninst.exe
+ 2010-07-14 14:45 . 2008-04-14 00:12	744448 c:\windows\$NtUninstallKB2229593$\helpsvc.exe
+ 2010-08-11 01:07 . 2010-02-22 14:23	382840 c:\windows\$NtUninstallKB2160329$\spuninst\updspapi.dll
+ 2010-08-11 01:07 . 2010-02-22 14:23	231288 c:\windows\$NtUninstallKB2160329$\spuninst\spuninst.exe
+ 2010-10-07 07:00 . 2010-02-22 14:23	382840 c:\windows\$NtUninstallKB2158563$\spuninst\updspapi.dll
+ 2010-10-07 07:00 . 2010-02-22 14:23	231288 c:\windows\$NtUninstallKB2158563$\spuninst\spuninst.exe
+ 2010-09-15 07:00 . 2010-02-22 14:23	382840 c:\windows\$NtUninstallKB2141007$\spuninst\updspapi.dll
+ 2010-09-15 07:00 . 2010-02-22 14:23	231288 c:\windows\$NtUninstallKB2141007$\spuninst\spuninst.exe
+ 2010-09-15 07:00 . 2010-01-29 15:01	691712 c:\windows\$NtUninstallKB2141007$\inetcomm.dll
+ 2010-09-15 07:02 . 2008-04-14 00:12	293376 c:\windows\$NtUninstallKB2121546$\winsrv.dll
+ 2010-09-15 07:02 . 2010-02-22 14:23	382840 c:\windows\$NtUninstallKB2121546$\spuninst\updspapi.dll
+ 2010-09-15 07:02 . 2010-02-22 14:23	231288 c:\windows\$NtUninstallKB2121546$\spuninst\spuninst.exe
+ 2010-08-11 01:18 . 2009-05-26 11:40	382840 c:\windows\$NtUninstallKB2115168$\spuninst\updspapi.dll
+ 2010-08-11 01:18 . 2009-05-26 11:40	231288 c:\windows\$NtUninstallKB2115168$\spuninst\spuninst.exe
+ 2010-08-11 01:17 . 2009-05-26 11:40	382840 c:\windows\$NtUninstallKB2079403$\spuninst\updspapi.dll
+ 2010-08-11 01:17 . 2009-05-26 11:40	231288 c:\windows\$NtUninstallKB2079403$\spuninst\spuninst.exe
+ 2010-09-15 07:02 . 2010-02-22 14:23	382840 c:\windows\$hf_mig$\KB982802\update\updspapi.dll
+ 2010-09-15 07:02 . 2010-02-22 14:23	755576 c:\windows\$hf_mig$\KB982802\update\update.exe
+ 2010-09-15 07:02 . 2010-02-22 14:23	231288 c:\windows\$hf_mig$\KB982802\spuninst.exe
+ 2010-07-23 06:13 . 2010-07-23 06:13	590848 c:\windows\$hf_mig$\KB982802\SP3QFE\rpcrt4.dll
+ 2010-08-11 01:05 . 2010-02-22 14:23	382840 c:\windows\$hf_mig$\KB982665\update\updspapi.dll
+ 2010-08-11 01:05 . 2010-02-22 14:23	755576 c:\windows\$hf_mig$\KB982665\update\update.exe
+ 2010-08-11 01:05 . 2010-02-22 14:23	231288 c:\windows\$hf_mig$\KB982665\spuninst.exe
+ 2010-06-10 04:52 . 2010-02-22 14:23	382840 c:\windows\$hf_mig$\KB982381-IE8\update\updspapi.dll
+ 2010-06-10 04:52 . 2008-07-08 13:02	755576 c:\windows\$hf_mig$\KB982381-IE8\update\update.exe
+ 2010-06-10 04:52 . 2008-07-08 13:02	231288 c:\windows\$hf_mig$\KB982381-IE8\spuninst.exe
+ 2010-06-10 04:20 . 2010-05-06 10:36	919040 c:\windows\$hf_mig$\KB982381-IE8\SP3QFE\wininet.dll
+ 2010-06-10 04:20 . 2010-05-06 10:36	206848 c:\windows\$hf_mig$\KB982381-IE8\SP3QFE\occache.dll
+ 2010-06-10 04:20 . 2010-05-06 10:36	611840 c:\windows\$hf_mig$\KB982381-IE8\SP3QFE\mstime.dll
+ 2010-06-10 04:20 . 2010-05-06 10:36	599040 c:\windows\$hf_mig$\KB982381-IE8\SP3QFE\msfeeds.dll
+ 2010-06-10 04:20 . 2010-05-06 10:36	247808 c:\windows\$hf_mig$\KB982381-IE8\SP3QFE\ieproxy.dll
+ 2010-06-10 04:20 . 2010-05-06 10:36	184320 c:\windows\$hf_mig$\KB982381-IE8\SP3QFE\iepeers.dll
+ 2010-06-10 04:20 . 2010-05-06 10:36	743424 c:\windows\$hf_mig$\KB982381-IE8\SP3QFE\iedvtool.dll
+ 2010-06-10 04:20 . 2010-05-06 10:36	387584 c:\windows\$hf_mig$\KB982381-IE8\SP3QFE\iedkcs32.dll
+ 2010-06-10 04:20 . 2010-05-05 13:55	173056 c:\windows\$hf_mig$\KB982381-IE8\SP3QFE\ie4uinit.exe
+ 2010-08-11 01:18 . 2010-02-22 14:23	382840 c:\windows\$hf_mig$\KB982214\update\updspapi.dll
+ 2010-08-11 01:18 . 2010-02-22 14:23	755576 c:\windows\$hf_mig$\KB982214\update\update.exe
+ 2010-08-11 01:18 . 2010-02-22 14:23	231288 c:\windows\$hf_mig$\KB982214\spuninst.exe
+ 2010-08-10 23:19 . 2010-06-21 14:18	354304 c:\windows\$hf_mig$\KB982214\SP3QFE\srv.sys
+ 2010-10-12 20:38 . 2009-05-26 11:40	382840 c:\windows\$hf_mig$\KB982132\update\updspapi.dll
+ 2010-10-12 20:38 . 2009-05-26 11:40	755576 c:\windows\$hf_mig$\KB982132\update\update.exe
+ 2010-10-12 20:38 . 2009-05-26 11:40	231288 c:\windows\$hf_mig$\KB982132\spuninst.exe
+ 2010-08-27 08:01 . 2010-08-27 08:01	119808 c:\windows\$hf_mig$\KB982132\SP3QFE\t2embed.dll
+ 2010-08-11 01:06 . 2009-05-26 11:40	382840 c:\windows\$hf_mig$\KB981997\update\updspapi.dll
+ 2010-08-11 01:06 . 2009-05-26 11:40	755576 c:\windows\$hf_mig$\KB981997\update\update.exe
+ 2010-08-11 01:06 . 2009-05-26 11:40	231288 c:\windows\$hf_mig$\KB981997\spuninst.exe
+ 2010-10-12 20:38 . 2010-02-22 14:23	382840 c:\windows\$hf_mig$\KB981957\update\updspapi.dll
+ 2010-10-12 20:38 . 2010-02-22 14:23	755576 c:\windows\$hf_mig$\KB981957\update\update.exe
+ 2010-10-12 20:38 . 2010-02-22 14:23	231288 c:\windows\$hf_mig$\KB981957\spuninst.exe
+ 2010-08-11 01:18 . 2010-02-22 14:23	382840 c:\windows\$hf_mig$\KB981852\update\updspapi.dll
+ 2010-08-11 01:18 . 2010-02-22 14:23	755576 c:\windows\$hf_mig$\KB981852\update\update.exe
+ 2010-08-11 01:18 . 2010-02-22 14:23	231288 c:\windows\$hf_mig$\KB981852\spuninst.exe
+ 2010-04-15 00:09 . 2009-05-26 11:40	382840 c:\windows\$hf_mig$\KB981332-IE8\update\updspapi.dll
+ 2010-04-15 00:09 . 2009-05-26 11:40	755576 c:\windows\$hf_mig$\KB981332-IE8\update\update.exe
+ 2010-04-15 00:09 . 2009-05-26 11:40	231288 c:\windows\$hf_mig$\KB981332-IE8\spuninst.exe
+ 2010-04-15 00:03 . 2010-03-10 06:18	420352 c:\windows\$hf_mig$\KB981332-IE8\SP3QFE\vbscript.dll
+ 2010-09-15 07:02 . 2009-05-26 11:40	382840 c:\windows\$hf_mig$\KB981322\update\updspapi.dll
+ 2010-09-15 07:02 . 2009-05-26 11:40	755576 c:\windows\$hf_mig$\KB981322\update\update.exe
+ 2010-09-15 07:02 . 2009-05-26 11:40	231288 c:\windows\$hf_mig$\KB981322\spuninst.exe
+ 2010-04-16 15:29 . 2010-04-16 15:29	406016 c:\windows\$hf_mig$\KB981322\SP3QFE\usp10.dll
+ 2010-08-11 01:07 . 2009-05-26 11:40	382840 c:\windows\$hf_mig$\KB980436\update\updspapi.dll
+ 2010-08-11 01:07 . 2009-05-26 11:40	755576 c:\windows\$hf_mig$\KB980436\update\update.exe
+ 2010-08-11 01:07 . 2009-05-26 11:40	231288 c:\windows\$hf_mig$\KB980436\spuninst.exe
+ 2010-06-30 12:23 . 2010-06-30 12:23	149504 c:\windows\$hf_mig$\KB980436\SP3QFE\schannel.dll
+ 2010-04-15 00:10 . 2009-05-26 09:01	382840 c:\windows\$hf_mig$\KB980232\update\updspapi.dll
+ 2010-04-15 00:10 . 2009-05-26 09:01	755576 c:\windows\$hf_mig$\KB980232\update\update.exe
+ 2010-04-15 00:10 . 2009-05-26 09:01	231288 c:\windows\$hf_mig$\KB980232\spuninst.exe
+ 2010-04-15 00:03 . 2010-02-24 11:57	457216 c:\windows\$hf_mig$\KB980232\SP3QFE\mrxsmb.sys
+ 2010-06-10 04:53 . 2009-05-26 11:40	382840 c:\windows\$hf_mig$\KB980218\update\updspapi.dll
+ 2010-06-10 04:53 . 2009-05-26 11:40	755576 c:\windows\$hf_mig$\KB980218\update\update.exe
+ 2010-06-10 04:53 . 2009-05-26 11:40	231288 c:\windows\$hf_mig$\KB980218\spuninst.exe
+ 2010-04-20 05:37 . 2010-04-20 05:37	285824 c:\windows\$hf_mig$\KB980218\SP3QFE\atmfd.dll
+ 2010-06-10 04:53 . 2008-07-08 13:02	382840 c:\windows\$hf_mig$\KB980195\update\updspapi.dll
+ 2010-06-10 04:53 . 2008-07-08 13:02	755576 c:\windows\$hf_mig$\KB980195\update\update.exe
+ 2010-06-10 04:53 . 2008-07-08 13:02	231288 c:\windows\$hf_mig$\KB980195\spuninst.exe
+ 2010-03-31 07:00 . 2009-05-26 11:40	382840 c:\windows\$hf_mig$\KB980182-IE8\update\updspapi.dll
+ 2010-03-31 07:00 . 2009-05-26 11:40	755576 c:\windows\$hf_mig$\KB980182-IE8\update\update.exe
+ 2010-03-31 07:00 . 2009-05-26 11:40	231288 c:\windows\$hf_mig$\KB980182-IE8\spuninst.exe
+ 2010-03-31 04:05 . 2010-02-25 06:19	919040 c:\windows\$hf_mig$\KB980182-IE8\SP3QFE\wininet.dll
+ 2010-03-31 04:05 . 2010-02-25 06:19	206848 c:\windows\$hf_mig$\KB980182-IE8\SP3QFE\occache.dll
+ 2010-03-31 04:05 . 2010-02-25 06:19	611840 c:\windows\$hf_mig$\KB980182-IE8\SP3QFE\mstime.dll
+ 2010-03-31 04:05 . 2010-02-25 06:19	594432 c:\windows\$hf_mig$\KB980182-IE8\SP3QFE\msfeeds.dll
+ 2010-03-31 04:05 . 2010-02-25 06:19	247808 c:\windows\$hf_mig$\KB980182-IE8\SP3QFE\ieproxy.dll
+ 2010-03-31 04:05 . 2010-02-25 06:19	184320 c:\windows\$hf_mig$\KB980182-IE8\SP3QFE\iepeers.dll
+ 2010-03-31 04:05 . 2010-02-25 06:19	387584 c:\windows\$hf_mig$\KB980182-IE8\SP3QFE\iedkcs32.dll
+ 2010-03-31 04:05 . 2010-02-24 09:34	173056 c:\windows\$hf_mig$\KB980182-IE8\SP3QFE\ie4uinit.exe
+ 2010-10-12 20:34 . 2009-05-26 11:40	382840 c:\windows\$hf_mig$\KB979687\update\updspapi.dll
+ 2010-10-12 20:34 . 2009-05-26 11:40	755576 c:\windows\$hf_mig$\KB979687\update\update.exe
+ 2010-10-12 20:34 . 2009-05-26 09:01	231288 c:\windows\$hf_mig$\KB979687\spuninst.exe
+ 2010-07-12 13:02 . 2010-07-12 13:02	218112 c:\windows\$hf_mig$\KB979687\SP3QFE\wordpad.exe
+ 2010-04-15 00:10 . 2009-05-26 11:40	382840 c:\windows\$hf_mig$\KB979683\update\updspapi.dll
+ 2010-04-15 00:10 . 2009-05-26 11:40	755576 c:\windows\$hf_mig$\KB979683\update\update.exe
+ 2010-04-15 00:10 . 2009-05-26 11:40	231288 c:\windows\$hf_mig$\KB979683\spuninst.exe
+ 2010-06-10 04:53 . 2009-05-26 11:40	382840 c:\windows\$hf_mig$\KB979559\update\updspapi.dll
+ 2010-06-10 04:53 . 2009-05-26 11:40	755576 c:\windows\$hf_mig$\KB979559\update\update.exe
+ 2010-06-10 04:53 . 2009-05-26 09:01	231288 c:\windows\$hf_mig$\KB979559\spuninst.exe
+ 2010-06-10 04:49 . 2009-05-26 11:40	382840 c:\windows\$hf_mig$\KB979482\update\updspapi.dll
+ 2010-06-10 04:49 . 2009-05-26 11:40	755576 c:\windows\$hf_mig$\KB979482\update\update.exe
+ 2010-06-10 04:49 . 2009-05-26 11:40	231288 c:\windows\$hf_mig$\KB979482\spuninst.exe
+ 2010-04-14 07:00 . 2009-05-26 11:40	382840 c:\windows\$hf_mig$\KB979309\update\updspapi.dll
+ 2010-04-14 07:00 . 2009-05-26 11:40	755576 c:\windows\$hf_mig$\KB979309\update\update.exe
+ 2010-04-14 07:00 . 2008-07-08 13:02	231288 c:\windows\$hf_mig$\KB979309\spuninst.exe
+ 2010-04-14 07:00 . 2009-05-26 11:40	382840 c:\windows\$hf_mig$\KB978601\update\updspapi.dll
+ 2010-04-14 07:00 . 2009-05-26 11:40	755576 c:\windows\$hf_mig$\KB978601\update\update.exe
+ 2010-04-14 07:00 . 2008-07-08 13:02	231288 c:\windows\$hf_mig$\KB978601\spuninst.exe
+ 2009-12-24 06:42 . 2009-12-24 06:42	178176 c:\windows\$hf_mig$\KB978601\SP3QFE\wintrust.dll
+ 2010-05-11 20:35 . 2009-05-26 11:40	382840 c:\windows\$hf_mig$\KB978542\update\updspapi.dll
+ 2010-05-11 20:35 . 2009-05-26 11:40	755576 c:\windows\$hf_mig$\KB978542\update\update.exe
+ 2010-05-11 20:35 . 2009-05-26 11:40	231288 c:\windows\$hf_mig$\KB978542\spuninst.exe
+ 2010-01-29 14:53 . 2010-01-29 14:53	691712 c:\windows\$hf_mig$\KB978542\SP3QFE\inetcomm.dll
+ 2010-04-15 00:09 . 2009-05-26 11:40	382840 c:\windows\$hf_mig$\KB978338\update\updspapi.dll
+ 2010-04-15 00:09 . 2009-05-26 11:40	755576 c:\windows\$hf_mig$\KB978338\update\update.exe
+ 2010-04-15 00:09 . 2009-05-26 11:40	231288 c:\windows\$hf_mig$\KB978338\spuninst.exe
+ 2010-02-11 11:36 . 2010-02-11 11:36	226880 c:\windows\$hf_mig$\KB978338\SP3QFE\tcpip6.sys
+ 2010-02-12 04:27 . 2010-02-12 04:27	100864 c:\windows\$hf_mig$\KB978338\SP3QFE\6to4svc.dll
+ 2010-04-15 00:09 . 2009-05-26 11:40	382840 c:\windows\$hf_mig$\KB977816\update\updspapi.dll
+ 2010-04-15 00:09 . 2009-05-26 11:40	755576 c:\windows\$hf_mig$\KB977816\update\update.exe
+ 2010-04-15 00:09 . 2009-05-26 11:40	231288 c:\windows\$hf_mig$\KB977816\spuninst.exe
+ 2010-06-10 04:49 . 2009-05-26 11:40	382840 c:\windows\$hf_mig$\KB975562\update\updspapi.dll
+ 2010-06-10 04:49 . 2009-05-26 11:40	755576 c:\windows\$hf_mig$\KB975562\update\update.exe
+ 2010-06-10 04:49 . 2008-07-08 13:02	231288 c:\windows\$hf_mig$\KB975562\spuninst.exe
- 2010-03-12 05:11 . 2009-05-26 22:10	382840 c:\windows\$hf_mig$\KB975561\update\updspapi.dll
+ 2010-03-12 05:11 . 2009-05-26 21:10	382840 c:\windows\$hf_mig$\KB975561\update\updspapi.dll
+ 2011-03-16 07:02 . 2009-05-26 11:40	382840 c:\windows\$hf_mig$\KB971029\update\updspapi.dll
+ 2011-03-16 07:02 . 2009-05-26 11:40	755576 c:\windows\$hf_mig$\KB971029\update\update.exe
+ 2011-03-16 07:02 . 2008-07-08 13:02	231288 c:\windows\$hf_mig$\KB971029\spuninst.exe
+ 2009-07-27 22:13 . 2009-07-27 22:13	135168 c:\windows\$hf_mig$\KB971029\SP3QFE\shsvcs.dll
+ 2011-03-24 07:02 . 2010-07-05 13:16	382840 c:\windows\$hf_mig$\KB2524375\update\updspapi.dll
+ 2011-03-24 07:02 . 2010-07-05 13:15	755576 c:\windows\$hf_mig$\KB2524375\update\update.exe
+ 2011-03-24 07:02 . 2010-07-05 13:15	231288 c:\windows\$hf_mig$\KB2524375\spuninst.exe
+ 2011-02-09 22:49 . 2010-07-05 13:16	382840 c:\windows\$hf_mig$\KB2485376\update\updspapi.dll
+ 2011-02-09 22:49 . 2010-07-05 13:15	755576 c:\windows\$hf_mig$\KB2485376\update\update.exe
+ 2011-02-09 22:49 . 2010-07-05 13:15	231288 c:\windows\$hf_mig$\KB2485376\spuninst.exe
+ 2011-01-07 14:09 . 2011-01-07 14:09	290048 c:\windows\$hf_mig$\KB2485376\SP3QFE\atmfd.dll
+ 2011-02-09 22:48 . 2010-07-05 13:16	382840 c:\windows\$hf_mig$\KB2483185\update\updspapi.dll
+ 2011-02-09 22:48 . 2010-07-05 13:15	755576 c:\windows\$hf_mig$\KB2483185\update\update.exe
+ 2011-02-09 22:48 . 2010-07-05 13:15	231288 c:\windows\$hf_mig$\KB2483185\spuninst.exe
+ 2011-01-21 14:42 . 2011-01-21 14:42	439808 c:\windows\$hf_mig$\KB2483185\SP3QFE\shimgvw.dll
+ 2011-02-09 22:44 . 2010-07-05 13:16	382840 c:\windows\$hf_mig$\KB2482017-IE8\update\updspapi.dll
+ 2011-02-09 22:44 . 2010-07-05 13:15	755576 c:\windows\$hf_mig$\KB2482017-IE8\update\update.exe
+ 2011-02-09 22:44 . 2010-07-05 13:15	231288 c:\windows\$hf_mig$\KB2482017-IE8\spuninst.exe
+ 2011-02-09 22:13 . 2010-12-20 23:58	919552 c:\windows\$hf_mig$\KB2482017-IE8\SP3QFE\wininet.dll
+ 2011-02-09 22:13 . 2010-12-20 23:58	206848 c:\windows\$hf_mig$\KB2482017-IE8\SP3QFE\occache.dll
+ 2011-02-09 22:13 . 2010-12-20 23:58	611840 c:\windows\$hf_mig$\KB2482017-IE8\SP3QFE\mstime.dll
+ 2011-02-09 22:13 . 2010-12-20 23:58	602112 c:\windows\$hf_mig$\KB2482017-IE8\SP3QFE\msfeeds.dll
+ 2011-02-09 22:13 . 2010-12-20 23:58	247808 c:\windows\$hf_mig$\KB2482017-IE8\SP3QFE\ieproxy.dll
+ 2011-02-09 22:13 . 2010-12-20 23:58	184320 c:\windows\$hf_mig$\KB2482017-IE8\SP3QFE\iepeers.dll
+ 2011-02-09 22:13 . 2010-12-20 23:58	743424 c:\windows\$hf_mig$\KB2482017-IE8\SP3QFE\iedvtool.dll
+ 2011-02-09 22:13 . 2010-12-20 23:58	387584 c:\windows\$hf_mig$\KB2482017-IE8\SP3QFE\iedkcs32.dll
+ 2011-02-09 22:13 . 2010-12-20 12:48	173568 c:\windows\$hf_mig$\KB2482017-IE8\SP3QFE\ie4uinit.exe
+ 2011-03-10 08:02 . 2010-07-05 13:16	382840 c:\windows\$hf_mig$\KB2481109\update\updspapi.dll
+ 2011-03-10 08:02 . 2010-07-05 13:15	755576 c:\windows\$hf_mig$\KB2481109\update\update.exe
+ 2011-03-10 08:02 . 2010-07-05 13:15	231288 c:\windows\$hf_mig$\KB2481109\spuninst.exe
+ 2011-01-27 11:41 . 2011-01-27 11:41	677888 c:\windows\$hf_mig$\KB2481109\SP3QFE\lhmstsc.exe
+ 2011-02-02 07:57 . 2011-02-02 07:57	136192 c:\windows\$hf_mig$\KB2481109\SP3QFE\aaclient.dll
+ 2011-03-10 08:14 . 2010-07-05 13:16	382840 c:\windows\$hf_mig$\KB2479943\update\updspapi.dll
+ 2011-03-10 08:14 . 2010-07-05 13:15	755576 c:\windows\$hf_mig$\KB2479943\update\update.exe
+ 2011-03-10 08:14 . 2010-07-05 13:15	231288 c:\windows\$hf_mig$\KB2479943\spuninst.exe
+ 2011-02-09 13:52 . 2011-02-09 13:52	270848 c:\windows\$hf_mig$\KB2479943\SP3QFE\sbe.dll
+ 2011-02-09 13:52 . 2011-02-09 13:52	186880 c:\windows\$hf_mig$\KB2479943\SP3QFE\encdec.dll
+ 2011-02-09 22:49 . 2010-07-05 13:16	382840 c:\windows\$hf_mig$\KB2479628\update\updspapi.dll
+ 2011-02-09 22:49 . 2010-07-05 13:15	755576 c:\windows\$hf_mig$\KB2479628\update\update.exe
+ 2011-02-09 22:49 . 2010-07-05 13:15	231288 c:\windows\$hf_mig$\KB2479628\spuninst.exe
+ 2011-02-09 22:49 . 2010-07-05 13:16	382840 c:\windows\$hf_mig$\KB2478971\update\updspapi.dll
+ 2011-02-09 22:49 . 2010-07-05 13:15	755576 c:\windows\$hf_mig$\KB2478971\update\update.exe
+ 2011-02-09 22:49 . 2010-07-05 13:15	231288 c:\windows\$hf_mig$\KB2478971\spuninst.exe
+ 2010-12-22 12:32 . 2010-12-22 12:32	301568 c:\windows\$hf_mig$\KB2478971\SP3QFE\kerberos.dll
+ 2011-02-09 22:44 . 2010-07-05 13:16	382840 c:\windows\$hf_mig$\KB2478960\update\updspapi.dll
+ 2011-02-09 22:44 . 2010-07-05 13:15	755576 c:\windows\$hf_mig$\KB2478960\update\update.exe
+ 2011-02-09 22:44 . 2010-07-05 13:15	231288 c:\windows\$hf_mig$\KB2478960\spuninst.exe
+ 2010-12-20 17:24 . 2010-12-20 17:24	730112 c:\windows\$hf_mig$\KB2478960\SP3QFE\lsasrv.dll
+ 2011-02-09 22:44 . 2010-07-05 13:16	382840 c:\windows\$hf_mig$\KB2476687\update\updspapi.dll
+ 2011-02-09 22:44 . 2010-07-05 13:15	755576 c:\windows\$hf_mig$\KB2476687\update\update.exe
+ 2011-02-09 22:44 . 2010-07-05 13:15	231288 c:\windows\$hf_mig$\KB2476687\spuninst.exe
+ 2010-12-16 08:04 . 2010-02-22 14:23	382840 c:\windows\$hf_mig$\KB2467659\update\updspapi.dll
+ 2010-12-16 08:04 . 2010-02-22 14:23	755576 c:\windows\$hf_mig$\KB2467659\update\update.exe
+ 2010-12-16 08:04 . 2010-02-22 14:23	231288 c:\windows\$hf_mig$\KB2467659\spuninst.exe
+ 2010-12-16 08:05 . 2010-02-22 14:23	382840 c:\windows\$hf_mig$\KB2443105\update\updspapi.dll
+ 2010-12-16 08:05 . 2010-02-22 14:23	755576 c:\windows\$hf_mig$\KB2443105\update\update.exe
+ 2010-12-16 08:05 . 2010-02-22 14:23	231288 c:\windows\$hf_mig$\KB2443105\spuninst.exe
+ 2010-12-16 08:04 . 2009-05-26 11:40	382840 c:\windows\$hf_mig$\KB2440591\update\updspapi.dll
+ 2010-12-16 08:04 . 2009-05-26 11:40	755576 c:\windows\$hf_mig$\KB2440591\update\update.exe
+ 2010-12-16 08:04 . 2009-05-26 11:40	231288 c:\windows\$hf_mig$\KB2440591\spuninst.exe
+ 2010-12-16 08:04 . 2009-05-26 11:40	382840 c:\windows\$hf_mig$\KB2436673\update\updspapi.dll
+ 2010-12-16 08:04 . 2009-05-26 11:40	755576 c:\windows\$hf_mig$\KB2436673\update\update.exe
+ 2010-12-16 08:04 . 2009-05-26 11:40	231288 c:\windows\$hf_mig$\KB2436673\spuninst.exe
+ 2010-12-16 08:01 . 2010-02-22 14:23	382840 c:\windows\$hf_mig$\KB2423089\update\updspapi.dll
+ 2010-12-16 08:01 . 2010-02-22 14:23	755576 c:\windows\$hf_mig$\KB2423089\update\update.exe
+ 2010-12-16 08:01 . 2010-02-22 14:23	231288 c:\windows\$hf_mig$\KB2423089\spuninst.exe
+ 2011-01-12 17:49 . 2010-02-22 14:23	382840 c:\windows\$hf_mig$\KB2419632\update\updspapi.dll
+ 2011-01-12 17:49 . 2010-02-22 14:23	755576 c:\windows\$hf_mig$\KB2419632\update\update.exe
+ 2011-01-12 17:49 . 2010-02-22 14:23	231288 c:\windows\$hf_mig$\KB2419632\spuninst.exe
+ 2010-11-09 14:50 . 2010-11-09 14:50	253952 c:\windows\$hf_mig$\KB2419632\SP3QFE\odbc32.dll
+ 2010-11-09 14:50 . 2010-11-09 14:50	102400 c:\windows\$hf_mig$\KB2419632\SP3QFE\msjro.dll
+ 2010-11-09 14:50 . 2010-11-09 14:50	200704 c:\windows\$hf_mig$\KB2419632\SP3QFE\msadox.dll
+ 2010-11-09 14:50 . 2010-11-09 14:50	180224 c:\windows\$hf_mig$\KB2419632\SP3QFE\msadomd.dll
+ 2010-11-09 14:50 . 2010-11-09 14:50	565248 c:\windows\$hf_mig$\KB2419632\SP3QFE\msado15.dll
+ 2010-11-09 14:50 . 2010-11-09 14:50	143360 c:\windows\$hf_mig$\KB2419632\SP3QFE\msadco.dll
+ 2010-12-16 08:05 . 2010-07-05 13:16	382840 c:\windows\$hf_mig$\KB2416400-IE8\update\updspapi.dll
+ 2010-12-16 08:05 . 2010-02-22 14:23	755576 c:\windows\$hf_mig$\KB2416400-IE8\update\update.exe
+ 2010-12-16 08:05 . 2010-02-22 14:23	231288 c:\windows\$hf_mig$\KB2416400-IE8\spuninst.exe
+ 2010-12-15 13:38 . 2010-11-06 00:27	919552 c:\windows\$hf_mig$\KB2416400-IE8\SP3QFE\wininet.dll
+ 2010-12-15 13:38 . 2010-11-06 00:27	206848 c:\windows\$hf_mig$\KB2416400-IE8\SP3QFE\occache.dll
+ 2010-12-15 13:38 . 2010-11-06 00:27	611840 c:\windows\$hf_mig$\KB2416400-IE8\SP3QFE\mstime.dll
+ 2010-12-15 13:38 . 2010-11-06 00:27	602112 c:\windows\$hf_mig$\KB2416400-IE8\SP3QFE\msfeeds.dll
+ 2010-12-15 13:38 . 2010-11-06 00:27	247808 c:\windows\$hf_mig$\KB2416400-IE8\SP3QFE\ieproxy.dll
+ 2010-12-15 13:38 . 2010-11-06 00:27	184320 c:\windows\$hf_mig$\KB2416400-IE8\SP3QFE\iepeers.dll
+ 2010-12-15 13:38 . 2010-11-06 00:27	743424 c:\windows\$hf_mig$\KB2416400-IE8\SP3QFE\iedvtool.dll
+ 2010-12-15 13:38 . 2010-11-06 00:27	387584 c:\windows\$hf_mig$\KB2416400-IE8\SP3QFE\iedkcs32.dll
+ 2010-12-15 13:38 . 2010-11-03 12:01	173568 c:\windows\$hf_mig$\KB2416400-IE8\SP3QFE\ie4uinit.exe
+ 2011-02-09 22:43 . 2010-07-05 13:16	382840 c:\windows\$hf_mig$\KB2393802\update\updspapi.dll
+ 2011-02-09 22:43 . 2010-07-05 13:15	755576 c:\windows\$hf_mig$\KB2393802\update\update.exe
+ 2011-02-09 22:43 . 2010-07-05 13:15	231288 c:\windows\$hf_mig$\KB2393802\spuninst.exe
+ 2011-02-09 22:13 . 2010-12-09 15:15	718336 c:\windows\$hf_mig$\KB2393802\SP3QFE\ntdll.dll
+ 2010-10-12 20:37 . 2010-02-22 14:23	382840 c:\windows\$hf_mig$\KB2387149\update\updspapi.dll
+ 2010-10-12 20:37 . 2010-07-05 13:15	755576 c:\windows\$hf_mig$\KB2387149\update\update.exe
+ 2010-10-12 20:37 . 2010-02-22 14:23	231288 c:\windows\$hf_mig$\KB2387149\spuninst.exe
+ 2010-10-12 20:30 . 2010-09-18 07:18	974848 c:\windows\$hf_mig$\KB2387149\SP3QFE\mfc42u.dll
+ 2010-10-12 20:30 . 2010-09-18 07:18	974848 c:\windows\$hf_mig$\KB2387149\SP3QFE\mfc42.dll
+ 2010-10-12 20:30 . 2010-09-18 07:18	953856 c:\windows\$hf_mig$\KB2387149\SP3QFE\mfc40u.dll
+ 2010-10-12 20:30 . 2010-09-18 07:18	954368 c:\windows\$hf_mig$\KB2387149\SP3QFE\mfc40.dll
+ 2010-10-12 20:39 . 2010-02-22 14:23	382840 c:\windows\$hf_mig$\KB2360937\update\updspapi.dll
+ 2010-10-12 20:39 . 2010-02-22 14:23	755576 c:\windows\$hf_mig$\KB2360937\update\update.exe
+ 2010-10-12 20:39 . 2010-02-22 14:23	231288 c:\windows\$hf_mig$\KB2360937\spuninst.exe
+ 2010-10-12 20:32 . 2010-08-16 08:43	590848 c:\windows\$hf_mig$\KB2360937\SP3QFE\rpcrt4.dll
+ 2010-10-12 20:36 . 2010-07-05 13:16	382840 c:\windows\$hf_mig$\KB2360131-IE8\update\updspapi.dll
+ 2010-10-12 20:36 . 2009-05-26 09:01	755576 c:\windows\$hf_mig$\KB2360131-IE8\update\update.exe
+ 2010-10-12 20:36 . 2009-05-26 09:01	231288 c:\windows\$hf_mig$\KB2360131-IE8\spuninst.exe
+ 2010-10-12 20:23 . 2010-09-10 05:57	919552 c:\windows\$hf_mig$\KB2360131-IE8\SP3QFE\wininet.dll
+ 2010-10-12 20:23 . 2010-09-10 05:57	206848 c:\windows\$hf_mig$\KB2360131-IE8\SP3QFE\occache.dll
+ 2010-10-12 20:23 . 2010-09-10 05:57	611840 c:\windows\$hf_mig$\KB2360131-IE8\SP3QFE\mstime.dll
+ 2010-10-12 20:23 . 2010-09-10 05:57	602112 c:\windows\$hf_mig$\KB2360131-IE8\SP3QFE\msfeeds.dll
+ 2010-10-12 20:23 . 2010-09-10 05:57	247808 c:\windows\$hf_mig$\KB2360131-IE8\SP3QFE\ieproxy.dll
+ 2010-10-12 20:23 . 2010-09-10 05:57	184320 c:\windows\$hf_mig$\KB2360131-IE8\SP3QFE\iepeers.dll
+ 2010-10-12 20:23 . 2010-09-10 05:57	743424 c:\windows\$hf_mig$\KB2360131-IE8\SP3QFE\iedvtool.dll
+ 2010-10-12 20:23 . 2010-09-10 05:57	387584 c:\windows\$hf_mig$\KB2360131-IE8\SP3QFE\iedkcs32.dll
+ 2010-10-12 20:23 . 2010-09-08 15:48	173056 c:\windows\$hf_mig$\KB2360131-IE8\SP3QFE\ie4uinit.exe
+ 2010-09-15 07:03 . 2009-05-26 11:40	382840 c:\windows\$hf_mig$\KB2347290\update\updspapi.dll
+ 2010-09-15 07:03 . 2009-05-26 11:40	755576 c:\windows\$hf_mig$\KB2347290\update\update.exe
+ 2010-09-15 07:03 . 2009-05-26 11:40	231288 c:\windows\$hf_mig$\KB2347290\spuninst.exe
+ 2010-10-12 20:35 . 2010-02-22 14:23	382840 c:\windows\$hf_mig$\KB2345886\update\updspapi.dll
+ 2010-10-12 20:35 . 2010-02-22 14:23	755576 c:\windows\$hf_mig$\KB2345886\update\update.exe
+ 2010-10-12 20:35 . 2010-02-22 14:23	231288 c:\windows\$hf_mig$\KB2345886\spuninst.exe
+ 2010-08-26 13:37 . 2010-08-26 13:37	357248 c:\windows\$hf_mig$\KB2345886\SP3QFE\srv.sys
+ 2010-12-16 08:05 . 2009-05-26 11:40	382840 c:\windows\$hf_mig$\KB2296199\update\updspapi.dll
+ 2010-12-16 08:05 . 2009-05-26 11:40	755576 c:\windows\$hf_mig$\KB2296199\update\update.exe
+ 2010-12-16 08:05 . 2009-05-26 11:40	231288 c:\windows\$hf_mig$\KB2296199\spuninst.exe
+ 2010-10-28 13:08 . 2010-10-28 13:08	290048 c:\windows\$hf_mig$\KB2296199\SP3QFE\atmfd.dll
+ 2010-08-03 07:00 . 2010-02-22 14:23	382840 c:\windows\$hf_mig$\KB2286198\update\updspapi.dll
+ 2010-08-03 07:00 . 2010-02-22 14:23	755576 c:\windows\$hf_mig$\KB2286198\update\update.exe
+ 2010-08-03 07:00 . 2010-02-22 14:23	231288 c:\windows\$hf_mig$\KB2286198\spuninst.exe
+ 2010-10-12 20:38 . 2010-07-05 13:16	382840 c:\windows\$hf_mig$\KB2279986\update\updspapi.dll
+ 2010-10-12 20:38 . 2010-07-05 13:15	755576 c:\windows\$hf_mig$\KB2279986\update\update.exe
+ 2010-10-12 20:38 . 2010-02-22 14:23	231288 c:\windows\$hf_mig$\KB2279986\spuninst.exe
+ 2010-09-01 11:48 . 2010-09-01 11:48	285824 c:\windows\$hf_mig$\KB2279986\SP3QFE\atmfd.dll
+ 2010-09-15 07:03 . 2009-05-26 09:01	382840 c:\windows\$hf_mig$\KB2259922\update\updspapi.dll
+ 2010-09-15 07:03 . 2009-05-26 09:01	755576 c:\windows\$hf_mig$\KB2259922\update\update.exe
+ 2010-09-15 07:03 . 2009-05-26 09:01	231288 c:\windows\$hf_mig$\KB2259922\spuninst.exe
+ 2010-07-14 14:45 . 2010-02-22 23:53	382840 c:\windows\$hf_mig$\KB2229593\update\updspapi.dll
+ 2010-07-14 14:45 . 2009-05-26 11:40	755576 c:\windows\$hf_mig$\KB2229593\update\update.exe
+ 2010-07-14 14:45 . 2009-05-26 11:40	231288 c:\windows\$hf_mig$\KB2229593\spuninst.exe
+ 2010-07-14 14:32 . 2010-06-14 14:38	744448 c:\windows\$hf_mig$\KB2229593\SP3QFE\helpsvc.exe
+ 2010-08-11 01:08 . 2010-02-22 14:23	382840 c:\windows\$hf_mig$\KB2183461-IE8\update\updspapi.dll
+ 2010-08-11 01:08 . 2009-05-26 09:01	755576 c:\windows\$hf_mig$\KB2183461-IE8\update\update.exe
+ 2010-08-11 01:08 . 2009-05-26 09:01	231288 c:\windows\$hf_mig$\KB2183461-IE8\spuninst.exe
+ 2010-08-10 23:18 . 2010-06-24 12:24	919040 c:\windows\$hf_mig$\KB2183461-IE8\SP3QFE\wininet.dll
+ 2010-08-10 23:18 . 2010-06-24 12:24	206848 c:\windows\$hf_mig$\KB2183461-IE8\SP3QFE\occache.dll
+ 2010-08-10 23:18 . 2010-06-24 12:24	611840 c:\windows\$hf_mig$\KB2183461-IE8\SP3QFE\mstime.dll
+ 2010-08-10 23:18 . 2010-06-24 12:24	599040 c:\windows\$hf_mig$\KB2183461-IE8\SP3QFE\msfeeds.dll
+ 2010-08-10 23:18 . 2010-06-24 12:24	247808 c:\windows\$hf_mig$\KB2183461-IE8\SP3QFE\ieproxy.dll
+ 2010-08-10 23:18 . 2010-06-24 12:24	184320 c:\windows\$hf_mig$\KB2183461-IE8\SP3QFE\iepeers.dll
+ 2010-08-10 23:18 . 2010-06-24 12:24	743424 c:\windows\$hf_mig$\KB2183461-IE8\SP3QFE\iedvtool.dll
+ 2010-08-10 23:18 . 2010-06-24 12:24	387584 c:\windows\$hf_mig$\KB2183461-IE8\SP3QFE\iedkcs32.dll
+ 2010-08-10 23:18 . 2010-06-23 11:30	173056 c:\windows\$hf_mig$\KB2183461-IE8\SP3QFE\ie4uinit.exe
+ 2010-08-11 01:07 . 2010-02-22 14:23	382840 c:\windows\$hf_mig$\KB2160329\update\updspapi.dll
+ 2010-08-11 01:07 . 2010-02-22 14:23	755576 c:\windows\$hf_mig$\KB2160329\update\update.exe
+ 2010-08-11 01:07 . 2010-02-22 14:23	231288 c:\windows\$hf_mig$\KB2160329\spuninst.exe
+ 2010-09-15 07:00 . 2010-02-22 14:23	382840 c:\windows\$hf_mig$\KB2141007\update\updspapi.dll
+ 2010-09-15 07:00 . 2010-02-22 14:23	755576 c:\windows\$hf_mig$\KB2141007\update\update.exe
+ 2010-09-15 07:00 . 2010-02-22 14:23	231288 c:\windows\$hf_mig$\KB2141007\spuninst.exe
+ 2010-06-09 07:41 . 2010-06-09 07:41	692736 c:\windows\$hf_mig$\KB2141007\SP3QFE\inetcomm.dll
+ 2010-09-15 07:02 . 2010-02-22 14:23	382840 c:\windows\$hf_mig$\KB2121546\update\updspapi.dll
+ 2010-09-15 07:02 . 2010-02-22 14:23	755576 c:\windows\$hf_mig$\KB2121546\update\update.exe
+ 2010-09-15 07:02 . 2010-02-22 14:23	231288 c:\windows\$hf_mig$\KB2121546\spuninst.exe
+ 2010-06-18 17:43 . 2010-06-18 17:43	293376 c:\windows\$hf_mig$\KB2121546\SP3QFE\winsrv.dll
+ 2010-08-11 01:18 . 2009-05-26 11:40	382840 c:\windows\$hf_mig$\KB2115168\update\updspapi.dll
+ 2010-08-11 01:18 . 2009-05-26 11:40	755576 c:\windows\$hf_mig$\KB2115168\update\update.exe
+ 2010-08-11 01:18 . 2009-05-26 11:40	231288 c:\windows\$hf_mig$\KB2115168\spuninst.exe
+ 2010-08-11 01:17 . 2009-05-26 11:40	382840 c:\windows\$hf_mig$\KB2079403\update\updspapi.dll
+ 2010-08-11 01:17 . 2009-05-26 11:40	755576 c:\windows\$hf_mig$\KB2079403\update\update.exe
+ 2010-08-11 01:17 . 2009-05-26 11:40	231288 c:\windows\$hf_mig$\KB2079403\spuninst.exe
+ 2011-04-14 19:25 . 2010-10-23 00:51	1748992 c:\windows\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6002.22509_x-ww_c7dad023\GdiPlus.dll
+ 2010-10-12 20:21 . 2010-08-23 16:12	1054208 c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
+ 2011-01-11 14:59 . 2011-01-11 14:59	3780936 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_d5fe2ecb\mfc90u.dll
+ 2011-01-11 14:59 . 2011-01-11 14:59	3766088 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_d5fe2ecb\mfc90.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05	3783672 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfc90u.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05	3768312 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfc90.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05	5982720 c:\windows\WinSxS\x86_Microsoft.VC90.DebugMFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_c94a3a24\mfc90ud.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05	5937144 c:\windows\WinSxS\x86_Microsoft.VC90.DebugMFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_c94a3a24\mfc90d.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05	1180672 c:\windows\WinSxS\x86_Microsoft.VC90.DebugCRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_f863c71f\msvcr90d.dll
+ 2011-01-11 02:50 . 2011-01-11 02:50	1093120 c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.5592_x-ww_e87e0bcd\mfc80u.dll
+ 2011-01-11 02:50 . 2011-01-11 02:50	1101824 c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.5592_x-ww_e87e0bcd\mfc80.dll
+ 2009-07-21 04:03 . 2009-07-21 04:03	1348432 c:\windows\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9876.0_x-ww_a621d1d5\msxml4.dll
+ 2008-09-30 20:42 . 2008-09-30 20:42	1286152 c:\windows\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9870.0_x-ww_a32d74cf\msxml4.dll
+ 2010-04-06 22:34 . 2010-04-06 22:34	1230336 c:\windows\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.1.0.0_x-ww_b319d8da\msxml4.dll
+ 2009-01-31 00:35 . 2009-01-31 00:35	2603008 c:\windows\system32\WpdShext.dll
+ 2009-01-31 00:35 . 2009-01-31 00:35	1382912 c:\windows\system32\WMVSDECD.dll
+ 2009-01-31 00:35 . 2009-01-31 00:35	1575424 c:\windows\system32\WMVENCOD.dll
+ 2009-01-31 00:35 . 2009-01-31 00:35	1543680 c:\windows\system32\WMVDECOD.dll
+ 2003-03-31 12:00 . 2010-04-06 08:52	2462720 c:\windows\system32\WMVCore.dll
+ 2004-08-04 07:56 . 2009-01-31 00:34	1329152 c:\windows\system32\WMSPDMOE.dll
+ 2003-03-31 12:00 . 2009-01-31 00:34	8231936 c:\windows\system32\wmploc.dll
+ 2009-01-31 00:34 . 2009-01-31 00:34	1661952 c:\windows\system32\wmpencen.dll
+ 2003-03-31 12:00 . 2009-01-31 00:34	1117696 c:\windows\system32\WMADMOE.dll
+ 2010-02-05 18:17 . 2010-12-14 23:51	4184352 c:\windows\system32\usbaaplrc.dll
+ 2003-03-31 12:00 . 2011-02-22 23:06	1210880 c:\windows\system32\urlmon.dll
+ 2003-03-31 12:00 . 2010-12-20 23:59	1210880 c:\windows\system32\urlmon(3)(2).dll
+ 2003-03-31 12:00 . 2010-12-20 23:59	1210880 c:\windows\system32\urlmon(2)(2).dll
+ 2003-03-31 12:00 . 2011-01-21 14:44	8462336 c:\windows\system32\shell32.dll
+ 2011-01-29 02:47 . 2010-04-20 00:47	3062048 c:\windows\system32\ReinstallBackups\0009\DriverFiles\usbaaplrc.dll
+ 2010-10-14 23:05 . 2009-08-29 00:42	2065696 c:\windows\system32\ReinstallBackups\0008\DriverFiles\usbaaplrc.dll
+ 2003-03-31 12:00 . 2010-02-05 18:27	1291776 c:\windows\system32\quartz.dll
- 2003-03-31 12:00 . 2009-11-27 17:11	1291776 c:\windows\system32\quartz.dll
+ 2003-03-31 12:00 . 2010-07-16 12:05	1288192 c:\windows\system32\ole32.dll
+ 2010-10-06 23:51 . 2004-03-24 03:12	1019904 c:\windows\system32\nvwimg.dll
+ 2004-03-24 03:12 . 2004-03-24 03:12	1609728 c:\windows\system32\nvwdmcpl.dll
+ 2003-08-01 04:08 . 2004-03-24 03:12	4841472 c:\windows\system32\nvoglnt.dll
+ 2003-08-01 04:08 . 2004-03-24 03:12	1331200 c:\windows\system32\nview.dll
+ 2003-08-01 04:08 . 2004-03-24 03:12	2904064 c:\windows\system32\nvcpl.dll
+ 2004-08-04 07:56 . 2004-03-24 03:12	4166656 c:\windows\system32\nv4_disp.dll
+ 2003-03-31 12:00 . 2010-12-09 13:42	2148864 c:\windows\system32\ntoskrnl.exe
+ 2002-08-29 01:04 . 2010-12-09 13:07	2027008 c:\windows\system32\ntkrnlpa.exe
+ 2009-07-21 04:05 . 2009-07-21 04:05	1348432 c:\windows\system32\msxml4.dll
+ 2003-03-31 12:00 . 2010-06-14 07:41	1172480 c:\windows\system32\msxml3.dll
- 2003-03-31 12:00 . 2009-07-31 04:35	1172480 c:\windows\system32\msxml3.dll
+ 2003-03-31 12:00 . 2011-02-22 23:06	5962240 c:\windows\system32\mshtml.dll
+ 2008-03-20 23:06 . 2009-06-25 17:20	1485176 c:\windows\system32\LegitCheckControl.DLL
+ 2009-03-08 09:32 . 2011-02-22 23:06	1991680 c:\windows\system32\iertutil.dll
+ 2009-03-08 09:32 . 2010-12-20 23:59	1991680 c:\windows\system32\iertutil(2)(3).dll
+ 2011-01-29 02:47 . 2010-12-14 23:51	4184352 c:\windows\system32\DRVSTORE\usbaapl_A4C70B47551C2629A145AE032C4D1823570ADB7B\usbaaplrc.dll
+ 2011-01-29 02:47 . 2010-04-20 00:29	1461992 c:\windows\system32\DRVSTORE\netaapl_8A27A03003759CB01567E831096473C330131D64\wdfcoinstaller01009.dll
+ 2004-08-04 05:29 . 2004-03-24 03:12	1883424 c:\windows\system32\drivers\nv4_mini.sys
+ 2003-03-31 12:00 . 2010-04-06 08:52	2462720 c:\windows\system32\dllcache\WMVCore.dll
+ 2004-08-04 07:56 . 2009-01-31 00:34	1329152 c:\windows\system32\dllcache\WMSPDMOE.dll
+ 2010-02-05 15:34 . 2009-01-31 00:34	8231936 c:\windows\system32\dllcache\wmploc.dll
+ 2003-03-31 12:00 . 2009-01-31 00:34	1117696 c:\windows\system32\dllcache\WMADMOE.dll
+ 2009-08-14 13:21 . 2011-03-03 13:21	1857920 c:\windows\system32\dllcache\win32k.sys
+ 2009-03-08 09:34 . 2011-02-22 23:06	1210880 c:\windows\system32\dllcache\urlmon.dll
+ 2008-06-17 19:02 . 2011-01-21 14:44	8462336 c:\windows\system32\dllcache\shell32.dll
+ 2010-02-05 15:33 . 2009-01-30 21:40	1669632 c:\windows\system32\dllcache\setup_wm.exe
+ 2009-06-03 19:09 . 2010-02-05 18:27	1291776 c:\windows\system32\dllcache\quartz.dll
- 2009-06-03 19:09 . 2009-11-27 17:11	1291776 c:\windows\system32\dllcache\quartz.dll
+ 2010-07-16 12:05 . 2010-07-16 12:05	1288192 c:\windows\system32\dllcache\ole32.dll
+ 2004-08-04 05:29 . 2004-03-24 03:12	1883424 c:\windows\system32\dllcache\nv4_mini.sys
+ 2004-08-04 07:56 . 2004-03-24 03:12	4166656 c:\windows\system32\dllcache\nv4_disp.dll
+ 2010-02-05 15:37 . 2010-12-09 13:38	2192768 c:\windows\system32\dllcache\ntoskrnl.exe
+ 2010-02-05 15:37 . 2010-12-09 13:07	2027008 c:\windows\system32\dllcache\ntkrpamp.exe
+ 2009-02-08 00:02 . 2010-12-09 13:07	2069376 c:\windows\system32\dllcache\ntkrnlpa.exe
+ 2010-02-05 15:37 . 2010-12-09 13:42	2148864 c:\windows\system32\dllcache\ntkrnlmp.exe
- 2010-02-05 15:25 . 2009-07-31 04:35	1172480 c:\windows\system32\dllcache\msxml3.dll
+ 2010-02-05 15:25 . 2010-06-14 07:41	1172480 c:\windows\system32\dllcache\msxml3.dll
+ 2010-02-05 15:26 . 2010-01-29 15:01	1315328 c:\windows\system32\dllcache\msoe.dll
- 2010-02-05 15:26 . 2009-07-10 13:27	1315328 c:\windows\system32\dllcache\msoe.dll
+ 2009-03-08 09:41 . 2011-02-22 23:06	5962240 c:\windows\system32\dllcache\mshtml.dll
- 2010-03-11 16:02 . 2009-10-23 15:28	3558912 c:\windows\system32\dllcache\moviemk.exe
+ 2010-02-05 00:42 . 2010-06-18 13:36	3558912 c:\windows\system32\dllcache\moviemk.exe
+ 2011-02-02 07:58 . 2011-02-02 07:58	2067456 c:\windows\system32\dllcache\lhmstscx.dll
+ 2010-02-05 16:13 . 2011-02-22 23:06	1991680 c:\windows\system32\dllcache\iertutil.dll
+ 2009-11-07 05:06 . 2009-11-07 05:06	1130824 c:\windows\system32\dfshim.dll
+ 2010-05-06 02:20 . 2002-12-20 17:06	3366912 c:\windows\RegisteredPackages\{60BFF50D-FB2C-4498-A577-C9548C390BB9}\moviemk.exe
+ 2010-04-08 03:48 . 2010-04-08 03:48	5967872 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\System.ServiceModel.dll
+ 2010-09-22 13:44 . 2010-09-22 13:44	5242880 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.dll
- 2008-11-25 09:59 . 2008-11-25 09:59	5242880 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.dll
+ 2010-03-23 09:32 . 2010-03-23 09:32	3182592 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.dll
+ 2011-01-18 08:39 . 2011-01-18 08:39	5813072 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
+ 2011-01-18 08:39 . 2011-01-18 08:39	4550656 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll
+ 2010-08-25 09:42 . 2010-08-25 09:42	1136640 c:\windows\Installer\bcaf0e8.msi
+ 2010-10-14 22:47 . 2010-10-14 22:47	3140608 c:\windows\Installer\9c1ac37.msi
+ 2010-12-26 00:59 . 2010-12-26 00:59	1602560 c:\windows\Installer\9bd0a75.msi
+ 2010-12-26 00:55 . 2010-12-26 00:55	8136192 c:\windows\Installer\9bd0a4f.msi
+ 2011-04-01 22:09 . 2011-04-01 22:09	2810368 c:\windows\Installer\984f602.msi
+ 2010-07-17 20:37 . 2010-07-17 20:37	1044992 c:\windows\Installer\6847612.msi
+ 2010-07-17 20:37 . 2010-07-17 20:37	1096704 c:\windows\Installer\684760d.msi
+ 2009-11-09 04:25 . 2009-11-09 04:25	1935360 c:\windows\Installer\61c8c.msp
+ 2010-10-17 22:00 . 2010-10-17 22:00	3940864 c:\windows\Installer\4d0019d.msi
+ 2011-02-24 02:12 . 2011-02-24 02:12	2086912 c:\windows\Installer\48bbb9be.msi
+ 2010-08-23 22:59 . 2010-08-23 22:59	1091584 c:\windows\Installer\4593393.msi
+ 2011-01-07 04:04 . 2011-01-07 04:04	9472000 c:\windows\Installer\36a9d5a2.msi
+ 2010-11-08 07:14 . 2010-11-08 07:14	3402752 c:\windows\Installer\30b9d.msp
+ 2010-04-12 02:17 . 2010-04-12 02:17	2607104 c:\windows\Installer\26bc1fa.msp
+ 2010-04-12 02:17 . 2010-04-12 02:17	4210688 c:\windows\Installer\26bc1f9.msp
+ 2011-01-29 02:54 . 2011-01-29 02:54	6596096 c:\windows\Installer\25f5a213.msi
+ 2011-01-29 02:48 . 2011-01-29 02:48	1554944 c:\windows\Installer\25f59973.msi
+ 2011-01-29 02:47 . 2011-01-29 02:47	3085312 c:\windows\Installer\25f59942.msi
+ 2011-01-29 02:46 . 2011-01-29 02:46	1984000 c:\windows\Installer\25f598f8.msi
+ 2010-12-24 03:29 . 2010-12-24 03:29	3460096 c:\windows\Installer\25608.msi
+ 2010-04-06 22:36 . 2010-04-06 22:36	6483968 c:\windows\Installer\1be69c92.msi
+ 2010-11-27 02:49 . 2010-11-27 02:49	1543168 c:\windows\Installer\1a11ca5c.msi
+ 2011-04-14 14:46 . 2011-04-14 14:46	3854848 c:\windows\Installer\194b0a8.msp
+ 2010-09-23 11:39 . 2010-09-23 11:39	4265472 c:\windows\Installer\18760c7.msp
+ 2010-11-01 13:43 . 2010-11-01 13:43	1223680 c:\windows\Installer\1740725b.msi
+ 2011-04-30 12:10 . 2011-04-30 12:10	1473024 c:\windows\Installer\1700c40.msi
+ 2011-04-30 12:10 . 2011-04-30 12:10	2981376 c:\windows\Installer\1700c3b.msi
+ 2011-01-18 23:58 . 2011-01-18 23:58	1423872 c:\windows\Installer\16da93ee.msi
+ 2010-05-06 02:32 . 2010-05-06 02:32	5885952 c:\windows\Installer\10fbb3fa.msi
+ 2011-01-17 20:28 . 2011-01-17 20:28	1090560 c:\windows\Installer\10fa6a46.msi
+ 2010-09-22 22:05 . 2010-09-22 22:05	2405784 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0400000010\9.4.0\rt3d.dll
+ 2010-09-16 07:08 . 2010-09-16 07:08	6210560 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0400000010\9.4.0\authplay.dll
+ 2010-06-19 21:51 . 2010-06-19 21:51	5713920 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0400000010\9.4.0\AGM.dll
+ 2010-06-10 04:52 . 2010-02-25 06:24	1209344 c:\windows\ie8updates\KB982381-IE8\urlmon.dll
+ 2010-06-10 04:52 . 2010-02-25 06:24	5944832 c:\windows\ie8updates\KB982381-IE8\mshtml.dll
+ 2010-06-10 04:52 . 2010-02-25 06:24	1985536 c:\windows\ie8updates\KB982381-IE8\iertutil.dll
+ 2010-03-31 07:00 . 2009-12-21 19:14	1208832 c:\windows\ie8updates\KB980182-IE8\urlmon.dll
+ 2010-03-31 07:00 . 2009-12-21 19:14	5942784 c:\windows\ie8updates\KB980182-IE8\mshtml.dll
+ 2010-03-31 07:00 . 2009-12-21 19:14	1985536 c:\windows\ie8updates\KB980182-IE8\iertutil.dll
+ 2011-04-15 07:37 . 2010-12-20 23:59	1210880 c:\windows\ie8updates\KB2497640-IE8\urlmon.dll
+ 2011-04-15 07:37 . 2010-12-20 23:59	5961216 c:\windows\ie8updates\KB2497640-IE8\mshtml.dll
+ 2011-04-15 07:37 . 2010-12-20 23:59	1991680 c:\windows\ie8updates\KB2497640-IE8\iertutil.dll
+ 2011-02-09 22:44 . 2010-11-06 00:26	1210880 c:\windows\ie8updates\KB2482017-IE8\urlmon.dll
+ 2011-02-09 22:44 . 2010-11-06 00:26	5959168 c:\windows\ie8updates\KB2482017-IE8\mshtml.dll
+ 2011-02-09 22:44 . 2010-11-06 00:26	1991680 c:\windows\ie8updates\KB2482017-IE8\iertutil.dll
+ 2010-12-16 08:05 . 2010-09-10 05:58	1210880 c:\windows\ie8updates\KB2416400-IE8\urlmon.dll
+ 2010-12-16 08:05 . 2010-09-10 05:58	5957120 c:\windows\ie8updates\KB2416400-IE8\mshtml.dll
+ 2010-12-16 08:05 . 2010-09-10 05:58	1986560 c:\windows\ie8updates\KB2416400-IE8\iertutil.dll
+ 2010-10-12 20:35 . 2010-06-24 12:22	1210368 c:\windows\ie8updates\KB2360131-IE8\urlmon.dll
+ 2010-10-12 20:35 . 2010-06-24 12:22	5951488 c:\windows\ie8updates\KB2360131-IE8\mshtml.dll
+ 2010-10-12 20:35 . 2010-06-24 12:21	1986560 c:\windows\ie8updates\KB2360131-IE8\iertutil.dll
+ 2010-08-11 01:08 . 2010-05-06 10:41	1209344 c:\windows\ie8updates\KB2183461-IE8\urlmon.dll
+ 2010-08-11 01:08 . 2010-05-06 10:41	5950976 c:\windows\ie8updates\KB2183461-IE8\mshtml.dll
+ 2010-08-11 01:08 . 2010-05-06 10:41	1985536 c:\windows\ie8updates\KB2183461-IE8\iertutil.dll
+ 2010-10-06 23:57 . 2003-10-15 15:16	1233024 c:\windows\Driver Cache\ttv100x.sys
+ 2010-02-05 15:37 . 2010-12-09 13:38	2192768 c:\windows\Driver Cache\i386\ntoskrnl.exe
+ 2010-02-05 15:37 . 2010-12-09 13:07	2027008 c:\windows\Driver Cache\i386\ntkrpamp.exe
+ 2009-02-08 00:02 . 2010-12-09 13:07	2069376 c:\windows\Driver Cache\i386\ntkrnlpa.exe
+ 2010-02-05 15:37 . 2010-12-09 13:42	2148864 c:\windows\Driver Cache\i386\ntkrnlmp.exe
+ 2010-02-04 16:55 . 2010-02-04 16:55	3171608 c:\windows\Downloaded Program Files\EPUWALcontrol.dll
+ 2010-08-14 02:33 . 2010-08-14 02:33	4471808 c:\windows\Downloaded Installations\{8411A6B2-5AC9-481C-B49A-CAC804872EF8}\Polar WebLink 2.4.11.msi
+ 2011-04-15 07:32 . 2011-04-15 07:32	3325440 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\76e431fde1b252312b331f7108259fda\WindowsBase.ni.dll
+ 2011-04-15 07:42 . 2011-04-15 07:42	1049600 c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClients#\9e022c95e79f2b6f383a501ad99f08a9\UIAutomationClientsideProviders.ni.dll
+ 2011-04-15 07:32 . 2011-04-15 07:32	7949824 c:\windows\assembly\NativeImages_v2.0.50727_32\System\f02cf6430a9fc77908a74ab6925cb73c\System.ni.dll
+ 2011-04-15 07:42 . 2011-04-15 07:42	5450752 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\b06e49ed8cbe07dbb90e313fa634b27b\System.Xml.ni.dll
+ 2011-04-15 07:57 . 2011-04-15 07:57	1356288 c:\windows\assembly\NativeImages_v2.0.50727_32\System.WorkflowServ#\6346221cecf631e5c0b754d842aad102\System.WorkflowServices.ni.dll
+ 2011-04-15 07:56 . 2011-04-15 07:56	1908224 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Run#\1fbcd203ff8d77d561df8bf806417ab6\System.Workflow.Runtime.ni.dll
+ 2011-04-15 07:56 . 2011-04-15 07:56	4514304 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Com#\efbaf3696c44fd7d4b3cd925e0437b36\System.Workflow.ComponentModel.ni.dll
+ 2011-04-15 07:56 . 2011-04-15 07:56	2992640 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Act#\52a9bc5dd1fa497af7c7f4600bd8e6d1\System.Workflow.Activities.ni.dll
+ 2011-04-15 07:55 . 2011-04-15 07:55	1840640 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\f5ebeeb0a8aaba9db15ec3df591339ba\System.Web.Services.ni.dll
+ 2011-04-15 07:55 . 2011-04-15 07:55	2209280 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\92d6b75e3b63b528d4069bf4ee01983a\System.Web.Mobile.ni.dll
+ 2011-04-15 07:55 . 2011-04-15 07:55	2405376 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\02d53154634c8000382942e0f43ead41\System.Web.Extensions.ni.dll
+ 2011-04-15 07:41 . 2011-04-15 07:41	1917952 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Speech\dd128c8e21e7fa14c12b71df9892d046\System.Speech.ni.dll
+ 2011-04-15 07:53 . 2011-04-15 07:53	1706496 c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel#\8b0bb430bb6af96c18b43e3c54cfafe8\System.ServiceModel.Web.ni.dll
+ 2011-04-15 07:45 . 2011-04-15 07:45	2345472 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\85090bd451617e204ffda625b8d9fc30\System.Runtime.Serialization.ni.dll
+ 2011-04-15 07:41 . 2011-04-15 07:41	1035776 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Printing\85a7a7aace114e78fc6c9b219bcd5551\System.Printing.ni.dll
+ 2011-04-15 07:45 . 2011-04-15 07:45	1070080 c:\windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\86c59378e9a43bf101a10ad452a4bb8e\System.IdentityModel.ni.dll
+ 2011-04-15 07:40 . 2011-04-15 07:40	1587200 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\d912066086a59f09424c7c69f95e2c55\System.Drawing.ni.dll
+ 2011-04-15 07:52 . 2011-04-15 07:52	1116672 c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\c05d9332116964104c721e97f7ce1058\System.DirectoryServices.ni.dll
+ 2011-04-15 07:52 . 2011-04-15 07:52	1801216 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Deployment\0118c0c73ea5c77bda7b10b188102ab6\System.Deployment.ni.dll
+ 2011-04-15 07:38 . 2011-04-15 07:38	6616576 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data\1337829e3df6888464a17aab78bb9b8f\System.Data.ni.dll
+ 2011-04-15 07:47 . 2011-04-15 07:47	2510336 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.SqlXml\ba3ca7a93e227c32ce7b50d0a7ba935f\System.Data.SqlXml.ni.dll
+ 2011-04-15 07:52 . 2011-04-15 07:52	1328128 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Services\2de52be5da96059651b5bec800cb4605\System.Data.Services.ni.dll
+ 2011-04-15 07:39 . 2011-04-15 07:39	2516480 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Linq\11f1306e0e311a0d0cbd139fb2fa4c36\System.Data.Linq.ni.dll
+ 2011-04-15 07:51 . 2011-04-15 07:51	9924096 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Entity\c91e83e85c030bc914ecc302fa9b2c60\System.Data.Entity.ni.dll
+ 2011-04-15 07:37 . 2011-04-15 07:37	2295296 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Core\684fe21837d3cf3e5935bbd0a7f53141\System.Core.ni.dll
+ 2011-04-15 07:37 . 2011-04-15 07:37	2128896 c:\windows\assembly\NativeImages_v2.0.50727_32\ReachFramework\12efddabe6fe35be21246c88ed9bf8ab\ReachFramework.ni.dll
+ 2011-04-15 07:37 . 2011-04-15 07:37	1657856 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationUI\257c9327ba9cc5cd87f58de224aa2e0d\PresentationUI.ni.dll
+ 2011-04-15 07:32 . 2011-04-15 07:32	1451008 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationBuildTa#\b117bf63daa7e587f1bb2d975dccb4af\PresentationBuildTasks.ni.dll
+ 2011-04-15 07:48 . 2011-04-15 07:48	1712128 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\269103939243ec6929739c8b9a645c0d\Microsoft.VisualBasic.ni.dll
+ 2011-04-15 07:47 . 2011-04-15 07:47	1093120 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\bf7bd26d2828e35156814018939ce4f6\Microsoft.Transactions.Bridge.ni.dll
+ 2011-04-15 07:53 . 2011-04-15 07:53	2332160 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.JScript\6594c17d7e112b0507b701d5b8a67bba\Microsoft.JScript.ni.dll
+ 2011-04-15 07:48 . 2011-04-15 07:48	1620992 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\f5eb1e42ccd0f67f7496b94a31949cd0\Microsoft.Build.Tasks.ni.dll
+ 2011-04-15 07:48 . 2011-04-15 07:48	1966080 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\cc7f05675a5cd8014222be1483d6beaf\Microsoft.Build.Tasks.v3.5.ni.dll
+ 2011-04-15 07:47 . 2011-04-15 07:47	1888768 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\41cf95aa4ff5765b515d3252abc6353b\Microsoft.Build.Engine.ni.dll
+ 2010-06-23 13:15 . 2010-06-23 13:15	1249280 c:\windows\assembly\GAC_MSIL\WindowsBase\3.0.0.0__31bf3856ad364e35\WindowsBase.dll
+ 2011-04-15 07:26 . 2011-04-15 07:26	3182592 c:\windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
+ 2011-04-15 07:25 . 2011-04-15 07:25	2048000 c:\windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	2048000 c:\windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
+ 2011-04-15 07:24 . 2011-04-15 07:24	5025792  c:\windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	5025792 c:\windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
+ 2010-10-07 20:51 . 2010-10-07 20:51	1277952 c:\windows\assembly\GAC_MSIL\System.Web.Extensions\3.5.0.0__31bf3856ad364e35\System.Web.Extensions.dll
- 2010-02-17 08:08 . 2010-02-17 08:08	1277952 c:\windows\assembly\GAC_MSIL\System.Web.Extensions\3.5.0.0__31bf3856ad364e35\System.Web.Extensions.dll
+ 2010-06-10 04:48 . 2010-06-10 04:48	5967872 c:\windows\assembly\GAC_MSIL\System.ServiceModel\3.0.0.0__b77a5c561934e089\System.ServiceModel.dll
+ 2011-04-15 07:24 . 2011-04-15 07:24	5062656 c:\windows\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	5062656 c:\windows\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
+ 2010-06-23 13:15 . 2010-06-23 13:15	5279744 c:\windows\assembly\GAC_MSIL\PresentationFramework\3.0.0.0__31bf3856ad364e35\PresentationFramework.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	5242880 c:\windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
+ 2011-04-15 07:24 . 2011-04-15 07:24	5242880 c:\windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
+ 2011-04-15 07:26 . 2011-04-15 07:26	2933248 c:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
- 2010-02-17 08:06 . 2010-02-17 08:06	2933248 c:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
- 2010-02-17 08:02 . 2010-02-17 08:02	4210688 c:\windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\PresentationCore.dll
+ 2010-06-23 13:15 . 2010-06-23 13:15	4210688 c:\windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\PresentationCore.dll
+ 2011-04-15 07:25 . 2011-04-15 07:25	4550656 c:\windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
+ 2010-07-16 03:01 . 2008-04-13 17:28	2940928 c:\windows\$NtUninstallwmp11$\wmploc.dll
+ 2010-07-16 03:01 . 2010-03-19 22:05	4874240 c:\windows\$NtUninstallwmp11$\wmp.dll
+ 2010-07-16 03:00 . 2005-01-28 18:44	1003008 c:\windows\$NtUninstallWMFDist11$\wmvdmoe2.dll
+ 2010-07-16 03:00 . 2010-04-03 10:39	2377576 c:\windows\$NtUninstallWMFDist11$\wmvcore.dll
+ 2010-07-16 03:00 . 2005-01-28 18:44	1512448 c:\windows\$NtUninstallWMFDist11$\wmvadve.dll
+ 2010-07-16 03:00 . 2005-01-28 18:44	1218808 c:\windows\$NtUninstallWMFDist11$\wmvadvd.dll
+ 2010-07-16 03:00 . 2005-01-28 18:44	1119744 c:\windows\$NtUninstallWMFDist11$\wmsdmoe2.dll
+ 2010-07-16 03:00 . 2008-06-10 11:28	1028096 c:\windows\$NtUninstallWMFDist11$\wmnetmgr.dll
+ 2010-08-11 01:06 . 2009-10-23 15:28	3558912 c:\windows\$NtUninstallKB981997$\moviemk.exe
+ 2010-10-12 20:38 . 2010-06-23 13:44	1851904 c:\windows\$NtUninstallKB981957$\win32k.sys
+ 2010-08-11 01:18 . 2010-02-16 14:08	2146304 c:\windows\$NtUninstallKB981852$\ntoskrnl.exe
+ 2010-08-11 01:18 . 2010-02-16 13:25	2024448 c:\windows\$NtUninstallKB981852$\ntkrpamp.exe
+ 2010-08-11 01:17 . 2010-02-16 13:25	2024448 c:\windows\$NtUninstallKB981852$\ntkrnlpa.exe
+ 2010-08-11 01:18 . 2010-02-16 14:08	2146304 c:\windows\$NtUninstallKB981852$\ntkrnlmp.exe
+ 2010-10-12 20:34 . 2008-04-14 00:12	1287168 c:\windows\$NtUninstallKB979687$\ole32.dll
+ 2010-04-15 00:10 . 2009-12-08 19:26	2145280 c:\windows\$NtUninstallKB979683$\ntoskrnl.exe
+ 2010-04-15 00:10 . 2009-12-08 18:43	2023936 c:\windows\$NtUninstallKB979683$\ntkrpamp.exe
+ 2010-04-15 00:10 . 2009-12-08 18:43	2023936 c:\windows\$NtUninstallKB979683$\ntkrnlpa.exe
+ 2010-04-15 00:10 . 2009-12-08 19:26	2145280 c:\windows\$NtUninstallKB979683$\ntkrnlmp.exe
+ 2010-06-10 04:53 . 2009-08-14 13:21	1850624 c:\windows\$NtUninstallKB979559$\win32k.sys
+ 2010-04-15 00:10 . 2009-07-12 17:21	4874240 c:\windows\$NtUninstallKB979402_WM9$\wmp.dll
+ 2010-06-10 04:38 . 2002-12-12 00:38	1491456 c:\windows\$NtUninstallKB979332_WM9L$\wmenceng.dll
+ 2010-06-10 04:49 . 2009-05-20 17:24	2373504 c:\windows\$NtUninstallKB978695_WM9$\wmvcore.dll
+ 2010-05-11 20:35 . 2009-07-10 13:27	1315328 c:\windows\$NtUninstallKB978542$\msoe.dll
+ 2010-06-10 04:49 . 2009-11-27 17:11	1291776 c:\windows\$NtUninstallKB975562$\quartz.dll
+ 2011-02-09 22:48 . 2010-07-27 06:30	8462336 c:\windows\$NtUninstallKB2483185$\shell32.dll
+ 2011-03-10 08:02 . 2009-06-10 14:19	2066432 c:\windows\$NtUninstallKB2481109$\mstscax.dll
+ 2011-02-09 22:49 . 2010-10-26 13:25	1853312 c:\windows\$NtUninstallKB2479628$\win32k.sys
+ 2010-12-16 08:04 . 2010-04-03 10:43	1560064 c:\windows\$NtUninstallKB2447961_WM9L$\wmenceng.dll
+ 2010-12-16 08:04 . 2010-08-31 13:42	1852800 c:\windows\$NtUninstallKB2436673$\win32k.sys
+ 2011-02-09 22:43 . 2010-04-27 13:59	2146304 c:\windows\$NtUninstallKB2393802$\ntoskrnl.exe
+ 2011-02-09 22:43 . 2010-04-27 13:05	2024448 c:\windows\$NtUninstallKB2393802$\ntkrpamp.exe
+ 2011-02-09 22:43 . 2010-04-27 13:05	2024448 c:\windows\$NtUninstallKB2393802$\ntkrnlpa.exe
+ 2011-02-09 22:43 . 2010-04-27 13:59	2146304 c:\windows\$NtUninstallKB2393802$\ntkrnlmp.exe
+ 2010-10-12 20:37 . 2008-04-14 00:11	1028096 c:\windows\$NtUninstallKB2387149$\mfc42.dll
+ 2010-08-03 07:00 . 2008-06-17 19:02	8461312 c:\windows\$NtUninstallKB2286198$\shell32.dll
+ 2010-08-11 01:07 . 2010-05-02 05:22	1851264 c:\windows\$NtUninstallKB2160329$\win32k.sys
+ 2010-08-11 01:17 . 2009-07-31 04:35	1172480 c:\windows\$NtUninstallKB2079403$\msxml3.dll
+ 2010-06-10 04:20 . 2010-05-06 10:36	1209856 c:\windows\$hf_mig$\KB982381-IE8\SP3QFE\urlmon.dll
+ 2010-06-10 04:20 . 2010-05-06 10:36	5953024 c:\windows\$hf_mig$\KB982381-IE8\SP3QFE\mshtml.dll
+ 2010-06-10 04:20 . 2010-05-06 10:36	1986048 c:\windows\$hf_mig$\KB982381-IE8\SP3QFE\iertutil.dll
+ 2010-08-10 23:14 . 2010-06-18 13:43	3558912 c:\windows\$hf_mig$\KB981997\SP3QFE\moviemk.exe
+ 2010-08-31 13:38 . 2010-08-31 13:38	1861888 c:\windows\$hf_mig$\KB981957\SP3QFE\win32k.sys
+ 2010-08-10 23:19 . 2010-04-27 13:50	2190080 c:\windows\$hf_mig$\KB981852\SP3QFE\ntoskrnl.exe
+ 2010-08-10 23:19 . 2010-04-27 13:14	2024448 c:\windows\$hf_mig$\KB981852\SP3QFE\ntkrpamp.exe
+ 2010-04-28 11:14 . 2010-04-28 11:14	2066944 c:\windows\$hf_mig$\KB981852\SP3QFE\ntkrnlpa.exe
+ 2010-08-10 23:19 . 2010-04-27 13:54	2146304 c:\windows\$hf_mig$\KB981852\SP3QFE\ntkrnlmp.exe
+ 2010-03-31 04:05 . 2010-02-25 06:19	1209856 c:\windows\$hf_mig$\KB980182-IE8\SP3QFE\urlmon.dll
+ 2010-03-31 04:05 . 2010-02-25 06:19	5946880 c:\windows\$hf_mig$\KB980182-IE8\SP3QFE\mshtml.dll
+ 2010-03-31 04:05 . 2010-02-25 06:19	1986048 c:\windows\$hf_mig$\KB980182-IE8\SP3QFE\iertutil.dll
+ 2010-07-16 12:04 . 2010-07-16 12:04	1289216 c:\windows\$hf_mig$\KB979687\SP3QFE\ole32.dll
+ 2010-04-15 00:03 . 2010-02-16 12:52	2190080 c:\windows\$hf_mig$\KB979683\SP3QFE\ntoskrnl.exe
+ 2010-04-15 00:03 . 2010-02-16 12:12	2024448 c:\windows\$hf_mig$\KB979683\SP3QFE\ntkrpamp.exe
+ 2010-04-15 00:03 . 2010-02-16 12:12	2066944 c:\windows\$hf_mig$\KB979683\SP3QFE\ntkrnlpa.exe
+ 2010-04-15 00:03 . 2010-02-16 12:50	2146304 c:\windows\$hf_mig$\KB979683\SP3QFE\ntkrnlmp.exe
+ 2010-05-02 06:34 . 2010-05-02 06:34	1860352 c:\windows\$hf_mig$\KB979559\SP3QFE\win32k.sys
+ 2010-01-29 14:53 . 2010-01-29 14:53	1315328 c:\windows\$hf_mig$\KB978542\SP3QFE\msoe.dll
+ 2010-02-05 18:29 . 2010-02-05 18:29	1291776 c:\windows\$hf_mig$\KB975562\SP3QFE\quartz.dll
+ 2009-07-27 22:13 . 2009-07-27 22:13	8462848 c:\windows\$hf_mig$\KB971029\SP3QFE\shell32.dll
+ 2011-01-21 14:42 . 2011-01-21 14:42	8463360 c:\windows\$hf_mig$\KB2483185\SP3QFE\shell32.dll
+ 2011-02-09 22:13 . 2010-12-20 23:58	1211904 c:\windows\$hf_mig$\KB2482017-IE8\SP3QFE\urlmon.dll
+ 2011-02-09 22:13 . 2010-12-20 23:58	5962240 c:\windows\$hf_mig$\KB2482017-IE8\SP3QFE\mshtml.dll
+ 2011-02-09 22:13 . 2010-12-20 23:58	1992192 c:\windows\$hf_mig$\KB2482017-IE8\SP3QFE\iertutil.dll
+ 2011-02-02 07:57 . 2011-02-02 07:57	2069504 c:\windows\$hf_mig$\KB2481109\SP3QFE\lhmstscx.dll
+ 2010-12-31 13:14 . 2010-12-31 13:14	1864064 c:\windows\$hf_mig$\KB2479628\SP3QFE\win32k.sys
+ 2010-10-26 13:27 . 2010-10-26 13:27	1862272 c:\windows\$hf_mig$\KB2436673\SP3QFE\win32k.sys
+ 2010-12-15 13:38 . 2010-11-06 00:27	1211904 c:\windows\$hf_mig$\KB2416400-IE8\SP3QFE\urlmon.dll
+ 2010-12-15 13:38 . 2010-11-06 00:27	5960704 c:\windows\$hf_mig$\KB2416400-IE8\SP3QFE\mshtml.dll
+ 2010-12-15 13:38 . 2010-11-06 00:27	1992192 c:\windows\$hf_mig$\KB2416400-IE8\SP3QFE\iertutil.dll
+ 2011-02-09 22:13 . 2010-12-09 13:43	2192768 c:\windows\$hf_mig$\KB2393802\SP3QFE\ntoskrnl.exe
+ 2011-02-09 22:13 . 2010-12-09 13:09	2027008 c:\windows\$hf_mig$\KB2393802\SP3QFE\ntkrpamp.exe
+ 2010-12-09 23:39 . 2010-12-09 23:39	2069376 c:\windows\$hf_mig$\KB2393802\SP3QFE\ntkrnlpa.exe
+ 2011-02-09 22:13 . 2010-12-09 13:47	2148864 c:\windows\$hf_mig$\KB2393802\SP3QFE\ntkrnlmp.exe
+ 2010-10-12 20:23 . 2010-09-10 05:57	1211904 c:\windows\$hf_mig$\KB2360131-IE8\SP3QFE\urlmon.dll
+ 2010-10-12 20:22 . 2010-09-10 05:57	5958656 c:\windows\$hf_mig$\KB2360131-IE8\SP3QFE\mshtml.dll
+ 2010-10-12 20:23 . 2010-09-10 05:57	1987072 c:\windows\$hf_mig$\KB2360131-IE8\SP3QFE\iertutil.dll
+ 2010-07-27 06:28 . 2010-07-27 06:28	8463360 c:\windows\$hf_mig$\KB2286198\SP3QFE\shell32.dll
+ 2010-08-10 23:18 . 2010-06-24 12:24	1211904 c:\windows\$hf_mig$\KB2183461-IE8\SP3QFE\urlmon.dll
+ 2010-08-10 23:18 . 2010-06-24 12:24	5954560 c:\windows\$hf_mig$\KB2183461-IE8\SP3QFE\mshtml.dll
+ 2010-08-10 23:18 . 2010-06-24 12:24	1987072 c:\windows\$hf_mig$\KB2183461-IE8\SP3QFE\iertutil.dll
+ 2010-06-24 02:14 . 2010-06-24 02:14	1861120 c:\windows\$hf_mig$\KB2160329\SP3QFE\win32k.sys
+ 2010-06-14 07:39 . 2010-06-14 07:39	1172480 c:\windows\$hf_mig$\KB2079403\SP3QFE\msxml3.dll
+ 2004-08-04 07:56 . 2010-08-26 03:36	10841088 c:\windows\system32\wmp.dll
+ 2010-03-02 19:38 . 2011-04-30 05:27	22062744 c:\windows\system32\Restore\rstrlog.dat
+ 2010-02-05 15:10 . 2011-04-15 07:03	39828936 c:\windows\system32\MRT.exe
+ 2009-03-08 09:39 . 2011-02-22 23:06	11080704 c:\windows\system32\ieframe.dll
+ 2009-03-08 09:39 . 2010-12-21 10:29	11080704 c:\windows\system32\ieframe(2)(3).dll
+ 2010-02-05 15:34 . 2010-08-26 03:36	10841088 c:\windows\system32\dllcache\wmp.dll
+ 2010-02-05 16:13 . 2011-02-22 23:06	11080704 c:\windows\system32\dllcache\ieframe.dll
+ 2010-04-24 03:37 . 2010-04-24 03:37	15710720 c:\windows\Installer\f30e35.msp
+ 2010-09-06 03:16 . 2010-09-06 03:16	20303872 c:\windows\Installer\ad32667.msp
+ 2011-04-26 07:23 . 2011-04-26 07:23	20314624 c:\windows\Installer\78650f.msp
+ 2011-02-12 00:47 . 2011-02-12 00:47	12028928 c:\windows\Installer\786504.msp
+ 2011-02-12 00:47 . 2011-02-12 00:47	12028928 c:\windows\Installer\6d312.msp
+ 2010-03-31 05:23 . 2010-03-31 05:23	15638528 c:\windows\Installer\61c98.msp
+ 2011-03-13 01:02 . 2011-03-13 01:02	15139328 c:\windows\Installer\5616e4.msp
+ 2011-01-05 23:43 . 2011-01-05 23:43	20304384 c:\windows\Installer\3098d8c9.msp
+ 2011-01-31 10:45 . 2011-01-31 10:45	11135488 c:\windows\Installer\2e1a0314.msp
+ 2010-04-12 02:17 . 2010-04-12 02:17	14599680 c:\windows\Installer\26bc208.msp
+ 2010-06-04 07:00 . 2010-06-04 07:00	20242432 c:\windows\Installer\1fdf28b6.msp
+ 2011-04-21 07:01 . 2011-04-21 07:01	20314624 c:\windows\Installer\1e19c363.msp
+ 2011-02-12 00:47 . 2011-02-12 00:47	12028928 c:\windows\Installer\1d464675.msp
+ 2010-10-07 07:04 . 2010-10-07 07:04	20303872 c:\windows\Installer\18760d2.msp
+ 2010-05-19 17:08 . 2010-05-19 17:08	11408896 c:\windows\Installer\1542e384.msp
+ 2011-03-08 08:00 . 2011-03-08 08:00	20308992 c:\windows\Installer\11e6a0e.msp
+ 2010-05-19 17:08 . 2010-05-19 17:08	11408896 c:\windows\Installer\10ac665a.msp
+ 2010-09-23 07:03 . 2010-09-23 07:03	20460984 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0400000010\9.4.0\AcroRd32.dll
+ 2010-06-10 04:52 . 2010-02-25 15:54	11070976 c:\windows\ie8updates\KB982381-IE8\ieframe.dll
+ 2010-03-31 07:00 . 2009-12-21 19:14	11070464 c:\windows\ie8updates\KB980182-IE8\ieframe.dll
+ 2011-04-15 07:37 . 2010-12-21 10:29	11080704 c:\windows\ie8updates\KB2497640-IE8\ieframe.dll
+ 2011-02-09 22:44 . 2010-11-06 00:26	11080704 c:\windows\ie8updates\KB2482017-IE8\ieframe.dll
+ 2010-12-16 08:05 . 2010-09-10 05:58	11080192 c:\windows\ie8updates\KB2416400-IE8\ieframe.dll
+ 2010-10-12 20:35 . 2010-06-24 21:51	11077120 c:\windows\ie8updates\KB2360131-IE8\ieframe.dll
+ 2010-08-11 01:08 . 2010-05-06 10:41	11076096 c:\windows\ie8updates\KB2183461-IE8\ieframe.dll
+ 2011-04-15 07:41 . 2011-04-15 07:41	12430848 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\ed2bf0d86229128c194a872f70fe15ee\System.Windows.Forms.ni.dll
+ 2011-04-15 07:54 . 2011-04-15 07:54	11800576 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web\d7b7ee04166212533ae21eaeb584fb0d\System.Web.ni.dll
+ 2011-04-15 07:46 . 2011-04-15 07:46	17403904 c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\b5f24d96334ea08b99350421450d3ba4\System.ServiceModel.ni.dll
+ 2011-04-15 07:39 . 2011-04-15 07:40	10683392 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Design\5aeadb9ff9a86f49130de5976a9f1744\System.Design.ni.dll
+ 2011-04-15 07:36 . 2011-04-15 07:36	14328320 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\1a5d89d569e2e12842daf4d87c57361a\PresentationFramework.ni.dll
+ 2011-04-15 07:33 . 2011-04-15 07:33	12215808 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\46c57d845e55232a89e98101075cd455\PresentationCore.ni.dll
+ 2011-04-15 07:31 . 2011-04-15 07:31	11490816 c:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62d5f089dd51f18472a7caf1593d9f6b\mscorlib.ni.dll
+ 2010-10-12 20:37 . 2009-07-14 03:43	10841088 c:\windows\$NtUninstallKB2378111_WM9$\wmp.dll
+ 2010-05-06 20:06 . 2010-05-06 20:06	11078144 c:\windows\$hf_mig$\KB982381-IE8\SP3QFE\ieframe.dll
+ 2010-03-31 04:05 . 2010-02-25 06:19	11073024 c:\windows\$hf_mig$\KB980182-IE8\SP3QFE\ieframe.dll
+ 2011-02-09 22:13 . 2010-12-20 23:58	11082752 c:\windows\$hf_mig$\KB2482017-IE8\SP3QFE\ieframe.dll
+ 2010-11-06 10:57 . 2010-11-06 10:57	11082752 c:\windows\$hf_mig$\KB2416400-IE8\SP3QFE\ieframe.dll
+ 2010-09-10 15:27 . 2010-09-10 15:27	11082240 c:\windows\$hf_mig$\KB2360131-IE8\SP3QFE\ieframe.dll
+ 2010-08-10 23:18 . 2010-06-24 12:24	11079168 c:\windows\$hf_mig$\KB2183461-IE8\SP3QFE\ieframe.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-09-29 03:44	1400712	----a-w-	c:\program files\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-09-29 1400712]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-09-29 1400712]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\BackupIconOverlayId]
@="{2EE61E5C-8F94-4AAB-8A80-D2A8CD1FEDAD}"
[HKEY_CLASSES_ROOT\CLSID\{2EE61E5C-8F94-4AAB-8A80-D2A8CD1FEDAD}]
2009-11-06 19:14	238968	----a-w-	c:\program files\Webroot\WebrootSecurity\Backup\CtxMenu_1_0_0_10.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IncrediMail"="c:\program files\IncrediMail\bin\IncMail.exe" [2011-04-01 353736]
"cdloader"="c:\documents and settings\Kickrz\Application Data\mjusbsp\cdloader2.exe" [2010-12-03 50592]
"Messenger (Yahoo!)"="c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe" [2010-06-01 5252408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-03-24 2904064]
"SBAMTray"="c:\program files\Sunbelt Software\VIPRE\SBAMTray.exe" [2010-08-20 1348944]
"Monitor"="c:\program files\LeapFrog\LeapFrog Connect\Monitor.exe" [2010-11-19 193880]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
"Hiyo"="c:\program files\HiYo\bin\HiYo.exe" [2011-01-18 238960]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-01-25 421160]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"SpySweeper"="c:\program files\Webroot\WebrootSecurity\SpySweeperUI.exe" [2009-11-06 6515784]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBAMSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBPIMSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WRConsumerService]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^Kickrz^Start Menu^Programs^Startup^YPOPs.lnk]
path=c:\documents and settings\Kickrz\Start Menu\Programs\Startup\YPOPs.lnk
backup=c:\windows\pss\YPOPs.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-21 03:07	932288	----a-r-	c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-01-31 08:44	35760	----a-w-	c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12	15360	------w-	c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2010-04-10 01:51	136176	----atw-	c:\documents and settings\Kickrz\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Hiyo]
2011-01-18 23:57	238960	----a-w-	c:\program files\HiYo\Bin\HiYo.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-01-25 20:08	421160	----a-w-	c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2010-06-01 15:17	5252408	----a-w-	c:\progra~1\Yahoo!\MESSEN~1\YahooMessenger.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Monitor]
2010-11-19 18:38	193880	----a-w-	c:\program files\LeapFrog\LeapFrog Connect\Monitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12	1695232	------w-	c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2004-03-24 03:12	2904064	----a-w-	c:\windows\system32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2004-03-24 03:12	782336	----a-w-	c:\windows\system32\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 22:38	421888	----a-w-	c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 15:44	248552	----a-w-	c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ulead AutoDetector]
2005-05-23 13:57	90112	------w-	c:\program files\Common Files\Ulead Systems\Autodetector\Monitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Bonjour Service"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\IncrediMail\\Bin\\IncMail.exe"=
"c:\\Program Files\\IncrediMail\\Bin\\ImApp.exe"=
"c:\\Program Files\\IncrediMail\\Bin\\ImpCnt.exe"=
"c:\\Documents and Settings\\Kickrz\\My Documents\\Unzipped\\scannercast_V013_1224\\ScannerCast.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\Google\\Google Earth\\plugin\\geplugin.exe"=
"c:\\Program Files\\LeapFrog\\LeapFrog Connect\\LeapFrogConnect.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Documents and Settings\\Kickrz\\Application Data\\mjusbsp\\magicJack.exe"=
.
R1 sbaphd;sbaphd;c:\windows\system32\drivers\sbaphd.sys [12/23/2010 11:38 PM 21464]
R1 SBRE;SBRE;c:\windows\system32\drivers\SBREDrv.sys [6/9/2010 1:17 PM 98392]
R1 SbTis;SbTis;c:\windows\system32\drivers\sbtis.sys [12/23/2010 11:29 PM 212568]
R2 sbapifs;sbapifs;c:\windows\system32\drivers\sbapifs.sys [12/23/2010 11:38 PM 69976]
R2 SBPIMSvc;SB Recovery Service;c:\program files\Sunbelt Software\VIPRE\SBPIMSvc.exe [8/20/2010 10:15 AM 181584]
R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.12.2;c:\windows\system32\drivers\libusb0.sys [3/20/2010 11:18 AM 28160]
S0 ssfs0bbc;ssfs0bbc;c:\windows\system32\drivers\ssfs0bbc.sys [11/6/2009 12:00 PM 29808]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [7/31/2010 3:31 PM 136176]
S2 SBAMSvc;VIPRE Antivirus;c:\program files\Sunbelt Software\VIPRE\SBAMSvc.exe [8/20/2010 10:16 AM 2763080]
S2 WRConsumerService;Webroot Client Service;c:\program files\Webroot\WebrootSecurity\WRConsumerService.exe [4/30/2011 8:10 AM 1201640]
S3 FlyUsb;FLY Fusion;c:\windows\system32\drivers\FlyUsb.sys [4/17/2010 1:15 PM 18560]
S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys --> c:\windows\system32\drivers\massfilter.sys [?]
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - MBAMSwissArmy
.
Contents of the 'Scheduled Tasks' folder
.
2011-04-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-31 19:31]
.
2011-04-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-31 19:31]
.
2011-04-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-839522115-220523388-2147104195-1004Core.job
- c:\documents and settings\Kickrz\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-04-10 01:51]
.
2011-04-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-839522115-220523388-2147104195-1004UA.job
- c:\documents and settings\Kickrz\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-04-10 01:51]
.
2011-04-30 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2010-09-29 03:44]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-30 10:14
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ... 
.
scanning hidden autostart entries ... 
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(1988)
c:\windows\system32\WININET.dll
c:\program files\Webroot\WebrootSecurity\Backup\CtxMenu_1_0_0_10.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2011-04-30 10:17:13
ComboFix-quarantined-files.txt 2011-04-30 14:16
ComboFix2.txt 2010-12-07 01:14
ComboFix3.txt 2010-03-31 00:24
.
Pre-Run: 19,058,790,400 bytes free
Post-Run: 19,034,542,080 bytes free
.
- - End Of File - - 32D50C69D502A128E46D3D88339F06BA
*
Well I am off for a few hours....should be back in 4-5 hours 
Thanks for the help this far!*


----------



## kickrz (Jul 30, 2003)

I am still up and running ...should I try a restart?


----------



## Cookiegal (Aug 27, 2003)

I haven't had a chance to review the log but I'll try to get to it later on this evening. Otherwise, first thing in the morning.


----------



## kickrz (Jul 30, 2003)

ok thanks. I will check regularly


----------



## Cookiegal (Aug 27, 2003)

Please run the following on-line scanner:

http://www.eset.com/online-scanner

Accept the Terms of Use and then press the Start button

Allow the ActiveX control to be installed.

Put a check by Remove found threats and then run the scan.

When the scan is finished, you will see the results in a window.

A log.txt file is created here: C:\Program Files\EsetOnlineScanner\log.txt.

Open the log file with Notepad and copy and paste the contents here please.


----------



## kickrz (Jul 30, 2003)

93% so far and found 2 so far win32/kryptik.nbx trojan


----------



## kickrz (Jul 30, 2003)

[email protected] as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6427
# api_version=3.0.2
# EOSSerial=0fdb9a49bbc03d43ae4255308a960710
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-05-01 03:35:24
# local_time=2011-04-30 11:35:24 (-0500, Eastern Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=256 16777175 100 0 10126882 10126882 0 0
# compatibility_mode=512 16777215 100 0 30783625 30783625 0 0
# compatibility_mode=768 16777215 100 0 37899009 37899009 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=99370
# found=2
# cleaned=2
# scan_time=11108
C:\System Volume Information\_restore{F504AF40-FE73-410B-B700-6912186EF7D6}\RP471\A0066708.exe	a variant of Win32/Kryptik.NBX trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
C:\System Volume Information\_restore{F504AF40-FE73-410B-B700-6912186EF7D6}\RP471\A0066709.exe	a variant of Win32/Kryptik.NBX trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C


----------



## kickrz (Jul 30, 2003)

I also ran a scan using the antivirus program that is on my computer...Vipre and it says it found 3 viruses. Not sure how to post the details but they are not the same as the ones I have seen so far.

Trojan.Win32.Packer.Upack0.3.9 (ep)
Trojan.Win32.Generic!BT
Trojan.Win32.Generic!BT

Could these be new ones again? How am I finding so many different ones, seems like every program gives me a different one or more.


----------



## Cookiegal (Aug 27, 2003)

I would like to know what the five threats were you mentioned in your initial post and the three you mention in your last one. I need to know the file names and the entire path to the files as just the infection name doesn't tell me much and could be false positives. Many anti-virus programs detect some of the tools we use as malicioius when of course they are not.

The ones found by Eset are only in system restore so they are not a threat unless you do a system restore. We will be flushing those out when we're finished so that will take care of them.


----------



## kickrz (Jul 30, 2003)

I have no clue how to get that info here. I cannot copy and paste and there is no txt log.
I can take screen shots and upload unless there is another way you know of.

The ones I mentioned in the first post were found with housecall and it got deleted when I did the system restore. Should I run that one again?


----------



## Cookiegal (Aug 27, 2003)

No, I wouldn't run Housecall again.

Please upload the screenshots.


----------



## kickrz (Jul 30, 2003)

I can't seem to get them to show up any bigger....can you see it at all?


----------



## Cookiegal (Aug 27, 2003)

Please upload larger ones or type out the file names and paths as I can't read them.


----------



## kickrz (Jul 30, 2003)

C:\Program Files\JDownloads\downloads\Ashampoo.Slideshow.Studio.HD.v1.0.3.97.Incl.Keygen.And.Patch.WinAll-LAXITY\Ashampoo.Slideshow.Studio.HD.v1.0.3.97.Incl.Keygen.And.Patch.WinAll-LAXiTY\lxt03974.zipIlxt10397.r03ISlideshow Studio HD Patch.exe


C;\Program Files\JDownloader\downloads\Auto.Photrganizer.2.2.569_WarezBot.rarIPatch-RED.zipIauto.photo.organizer.2.2.569-patch.exe

C;\Program Files\JDownloader\downloads\Patch-RED.zipIauto.photo.organizer.2.2.569-patch.exe


----------



## Cookiegal (Aug 27, 2003)

Please download *MBRCheck.exe* to your desktop.

Be sure to disable your security programs prior to running the tool. 
Double click on MBRCheck.exe to run it. Please allow any prompts popped by Windows in order to run the tool.
_(Vista and Windows 7 users will have to confirm the UAC prompt)_
A command window will pop open and run. If any unknown MBR Code is found, you will have further options prompted, at this time please press *N* then press *Enter*.
Press *Enter* again to exit the program.
If nothing unusual is found, you will be shown the machine MBR status. Just press *Enter* to exit.
A text file named *MBRCheck_mm.dd.yy_hh.mm.ss* should appear on your deskop. Please post the contents of that file.


----------



## kickrz (Jul 30, 2003)

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line: 
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000006c

Kernel Drivers (total 133):
0x804D7000 \WINDOWS\system32\ntoskrnl.exe
0x80700000 \WINDOWS\system32\hal.dll
0xF7B61000 \WINDOWS\system32\KDCOM.DLL
0xF7A71000 \WINDOWS\system32\BOOTVID.dll
0xF7612000 ACPI.sys
0xF7B63000 \WINDOWS\System32\DRIVERS\WMILIB.SYS
0xF7601000 pci.sys
0xF7661000 isapnp.sys
0xF7671000 ohci1394.sys
0xF7681000 \WINDOWS\System32\DRIVERS\1394BUS.SYS
0xF7A75000 compbatt.sys
0xF7A79000 \WINDOWS\System32\DRIVERS\BATTC.SYS
0xF7C29000 pciide.sys
0xF78E1000 \WINDOWS\System32\DRIVERS\PCIIDEX.SYS
0xF75E3000 pcmcia.sys
0xF7691000 MountMgr.sys
0xF75C4000 ftdisk.sys
0xF7A7D000 ACPIEC.sys
0xF7C2A000 \WINDOWS\System32\DRIVERS\OPRGHDLR.SYS
0xF78E9000 PartMgr.sys
0xF76A1000 VolSnap.sys
0xF75AC000 atapi.sys
0xF76B1000 disk.sys
0xF76C1000 \WINDOWS\System32\DRIVERS\CLASSPNP.SYS
0xF758C000 fltmgr.sys
0xF757A000 sr.sys
0xF76D1000 PxHelp20.sys
0xF7563000 KSecDD.sys
0xF74D6000 Ntfs.sys
0xF74A9000 NDIS.sys
0xF748F000 Mup.sys
0xF76E1000 agp440.sys
0xF6A2C000 \SystemRoot\System32\DRIVERS\intelppm.sys
0xF6820000 \SystemRoot\system32\DRIVERS\nv4_mini.sys
0xF680C000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF79A1000 \SystemRoot\System32\DRIVERS\usbuhci.sys
0xF67E8000 \SystemRoot\System32\DRIVERS\USBPORT.SYS
0xF79B1000 \SystemRoot\System32\DRIVERS\usbehci.sys
0xF7741000 \SystemRoot\System32\DRIVERS\nic1394.sys
0xF6798000 \SystemRoot\system32\DRIVERS\ar5211.sys
0xF6784000 \SystemRoot\System32\DRIVERS\sdbus.sys
0xF7781000 \SystemRoot\System32\DRIVERS\i8042prt.sys
0xF79C1000 \SystemRoot\System32\DRIVERS\kbdclass.sys
0xF79C9000 \SystemRoot\System32\DRIVERS\mouclass.sys
0xF7791000 \SystemRoot\System32\DRIVERS\smcirda.sys
0xF7B3D000 \SystemRoot\System32\DRIVERS\irenum.sys
0xF79D1000 \SystemRoot\System32\DRIVERS\fdc.sys
0xF7B45000 \SystemRoot\System32\DRIVERS\CmBatt.sys
0xF77A1000 \SystemRoot\System32\DRIVERS\imapi.sys
0xF77B1000 \SystemRoot\System32\DRIVERS\cdrom.sys
0xF77C1000 \SystemRoot\System32\DRIVERS\redbook.sys
0xF6761000 \SystemRoot\System32\DRIVERS\ks.sys
0xF79D9000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0xF66DF000 \SystemRoot\system32\drivers\ALCXWDM.SYS
0xF66BB000 \SystemRoot\system32\drivers\portcls.sys
0xF77D1000 \SystemRoot\system32\drivers\drmk.sys
0xF665B000 \SystemRoot\system32\drivers\ALCXSENS.SYS
0xF653D000 \SystemRoot\system32\DRIVERS\AGRSM.sys
0xF79E1000 \SystemRoot\System32\Drivers\Modem.SYS
0xF7D13000 \SystemRoot\System32\DRIVERS\audstub.sys
0xF79E9000 \SystemRoot\System32\DRIVERS\rasirda.sys
0xF79F1000 \SystemRoot\System32\DRIVERS\TDI.SYS
0xF7861000 \SystemRoot\System32\DRIVERS\rasl2tp.sys
0xF7B59000 \SystemRoot\System32\DRIVERS\ndistapi.sys
0xF64FE000 \SystemRoot\System32\DRIVERS\ndiswan.sys
0xF78B1000 \SystemRoot\System32\DRIVERS\raspptp.sys
0xF64ED000 \SystemRoot\System32\DRIVERS\psched.sys
0xF78D1000 \SystemRoot\System32\DRIVERS\msgpc.sys
0xF79F9000 \SystemRoot\System32\DRIVERS\ptilink.sys
0xF7A01000 \SystemRoot\System32\DRIVERS\raspti.sys
0xF6A4C000 \SystemRoot\System32\DRIVERS\termdd.sys
0xF7BDD000 \SystemRoot\System32\DRIVERS\swenum.sys
0xF648F000 \SystemRoot\System32\DRIVERS\update.sys
0xF746B000 \SystemRoot\System32\DRIVERS\mssmbios.sys
0xF6A1C000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF69FC000 \SystemRoot\System32\DRIVERS\usbhub.sys
0xF7BF3000 \SystemRoot\System32\DRIVERS\USBD.SYS
0xF7C0B000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF7D88000 \SystemRoot\System32\Drivers\Null.SYS
0xF7C0D000 \SystemRoot\System32\Drivers\Beep.SYS
0xF7A51000 \SystemRoot\System32\drivers\vga.sys
0xF7C0F000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF7C11000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF7A59000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF7A61000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF6531000 \SystemRoot\System32\DRIVERS\rasacd.sys
0xF541D000 \SystemRoot\System32\DRIVERS\ipsec.sys
0xF53C4000 \SystemRoot\System32\DRIVERS\tcpip.sys
0xF5391000 \SystemRoot\system32\drivers\sbtis.sys
0xF536B000 \SystemRoot\System32\DRIVERS\ipnat.sys
0xF5343000 \SystemRoot\System32\DRIVERS\netbt.sys
0xF7831000 \SystemRoot\System32\DRIVERS\wanarp.sys
0xF5321000 \SystemRoot\System32\drivers\afd.sys
0xF7841000 \SystemRoot\System32\DRIVERS\arp1394.sys
0xF7851000 \SystemRoot\System32\DRIVERS\netbios.sys
0xF6515000 \SystemRoot\system32\drivers\sbaphd.sys
0xF522E000 \SystemRoot\System32\DRIVERS\rdbss.sys
0xF51BE000 \SystemRoot\System32\DRIVERS\mrxsmb.sys
0xF7881000 \SystemRoot\System32\Drivers\Fips.SYS
0xF547F000 \SystemRoot\System32\DRIVERS\hidusb.sys
0xF78A1000 \SystemRoot\System32\DRIVERS\HIDCLASS.SYS
0xF7919000 \SystemRoot\System32\DRIVERS\HIDPARSE.SYS
0xF78C1000 \SystemRoot\system32\drivers\libusb0.sys
0xF5477000 \SystemRoot\System32\DRIVERS\mouhid.sys
0xF6A7C000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xF51A6000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF7C21000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xF7B11000 \SystemRoot\System32\drivers\Dxapi.sys
0xF7939000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF7C59000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF012000 \SystemRoot\System32\nv4_disp.dll
0xBF40C000 \SystemRoot\System32\ATMFD.DLL
0xF52C1000 \SystemRoot\system32\drivers\sbapifs.sys
0xF311E000 \SystemRoot\System32\DRIVERS\irda.sys
0xF3190000 \SystemRoot\System32\DRIVERS\ndisuio.sys
0xF2F11000 \SystemRoot\System32\DRIVERS\mrxdav.sys
0xF52F1000 \SystemRoot\System32\DRIVERS\raspppoe.sys
0xF2ED4000 \SystemRoot\system32\drivers\wdmaud.sys
0xF6A6C000 \SystemRoot\system32\drivers\sysaudio.sys
0xF2B4B000 \SystemRoot\System32\DRIVERS\srv.sys
0xF1B67000 \SystemRoot\System32\Drivers\HTTP.sys
0xF7A69000 \SystemRoot\System32\DRIVERS\USBSTOR.SYS
0xF1848000 \SystemRoot\System32\Drivers\Fastfat.SYS
0xF7BC5000 \??\C:\WINDOWS\system32\Drivers\PROCEXP113.SYS
0xF7A31000 \??\C:\DOCUME~1\Kickrz\LOCALS~1\Temp\catchme.sys
0xF7A39000 \SystemRoot\System32\DRIVERS\RTL8139.SYS
0xF7989000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0xF1AA7000 \SystemRoot\system32\drivers\usbaudio.sys
0xF1389000 \SystemRoot\system32\drivers\kmixer.sys
0xF7B95000 \SystemRoot\system32\drivers\splitter.sys
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 40):
0 System Idle Process
4 System
528 C:\WINDOWS\system32\smss.exe
580 csrss.exe
604 C:\WINDOWS\system32\winlogon.exe
652 C:\WINDOWS\system32\services.exe
664 C:\WINDOWS\system32\lsass.exe
832 C:\WINDOWS\system32\svchost.exe
 908 svchost.exe
948 C:\WINDOWS\system32\svchost.exe
1060 svchost.exe
1128 svchost.exe
1456 C:\WINDOWS\system32\spoolsv.exe
1568 svchost.exe
1652 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
1888 C:\Program Files\Bonjour\mDNSResponder.exe
2032 C:\Program Files\Java\jre6\bin\jqs.exe
252 C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe
336 C:\WINDOWS\system32\nvsvc32.exe
480 C:\Program Files\Sunbelt Software\VIPRE\SBPIMSvc.exe
472 C:\WINDOWS\system32\svchost.exe
564 C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
1688 alg.exe
2628 C:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe
2924 C:\Program Files\HiYo\Bin\HiYo.exe
2704 C:\Program Files\iTunes\iTunesHelper.exe
3056 C:\WINDOWS\system32\ctfmon.exe
3216 C:\Program Files\iPod\bin\iPodService.exe
1988 C:\WINDOWS\explorer.exe
1840 C:\Documents and Settings\Kickrz\Application Data\mjusbsp\magicJack.exe
320 C:\Program Files\IncrediMail\Bin\ImApp.exe
3592 C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
2640 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
3208 wmiprvse.exe
3552 C:\Program Files\IncrediMail\Bin\IncMail.exe
2988 C:\Program Files\Internet Explorer\iexplore.exe
2716 C:\Program Files\Internet Explorer\iexplore.exe
2284 C:\Program Files\Internet Explorer\iexplore.exe
1736 C:\WINDOWS\system32\wscntfy.exe
3632 C:\Documents and Settings\Kickrz\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)

PhysicalDrive0 Model Number: WDCWD800VE-00KWT0, Rev: 01.03K01

Size Device Name MBR Status
--------------------------------------------
74 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A


Done!


----------



## Cookiegal (Aug 27, 2003)

Please download aswMBR.exe and save it to your desktop.

Double click aswMBR.exe to start the tool. (Vista/Windows 7 users - right click to run as administrator)

Click *Scan*.

Upon completion of the scan, click *Save log* then save it to your desktop and post that log in your next reply for review. 
*Note - do NOT attempt any Fix yet. *


----------



## kickrz (Jul 30, 2003)

aswMBR version 0.9.5.256 Copyright(c) 2011 AVAST Software
Run date: 2011-05-03 15:36:26
-----------------------------
15:36:26.426 OS Version: Windows 5.1.2600 Service Pack 3
15:36:26.426 Number of processors: 2 586 0x209
15:36:26.426 ComputerName: BRIAN-Y0IEJ0KFN UserName: Kickrz
15:36:27.707 Initialize success
15:36:38.707 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
15:36:38.707 Disk 0 Vendor: WDC_WD800VE-00KWT0 01.03K01 Size: 76319MB BusType: 3
15:36:40.722 Disk 0 MBR read successfully
15:36:40.722 Disk 0 MBR scan
15:36:40.722 Disk 0 Windows XP default MBR code
15:36:42.722 Disk 0 scanning sectors +156280320
15:36:42.785 Disk 0 scanning C:\WINDOWS\system32\drivers
15:37:00.894 Service scanning
15:37:02.066 Disk 0 trace - called modules:
15:37:02.097 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS 
15:37:02.097 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86f21ab8]
15:37:02.097 3 CLASSPNP.SYS[f76c1fd7] -> nt!IofCallDriver -> \Device\00000075[0x86f569e8]
15:37:02.097 5 ACPI.sys[f7618620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x86f25d98]
15:37:02.097 Scan finished successfully
15:37:27.941 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Kickrz\Desktop\MBR.dat"
15:37:27.941 The log file has been saved successfully to "C:\Documents and Settings\Kickrz\Desktop\aswMBR.txt"


----------



## kickrz (Jul 30, 2003)

I am just wondering. I have done quite a few scans but have never been asked to remove or do anything other then scan and post the log. Is there no issues seen and that is why so many scans or do you need all these scans to determine if there is an issue? Are we on the right track or still unsure of what is happening?


----------



## Cookiegal (Aug 27, 2003)

There were some infections detected and I'm looking to see if the MBR is infected but it doesn't appear so.

Please give a summary of what problems remain.


----------



## kickrz (Jul 30, 2003)

Well I just restarted and when it was shutting down I got an error about dwwin.exe. I will restart soon and see again but when I rebooted spysweeper was still waiting for a restart so it could scan and is scanning now. So far it has found 1 virus called tojan.gen.x


----------



## Cookiegal (Aug 27, 2003)

You need to post the log or at least the name of the file and the entire path to it.


----------



## kickrz (Jul 30, 2003)

I can't do anything because it wants me to subscribe and pay to remove or for more info. I will see if it saved anything but not sure what I can get.


----------



## Cookiegal (Aug 27, 2003)

I thought you had it installed. Take a screen shot if you have to or copy the names from the screen.


----------



## kickrz (Jul 30, 2003)

I uninstalled it after I couldn't do anything with it. I guess I can try to reinstall and rescan then go from there.


----------



## Cookiegal (Aug 27, 2003)

You need to keep doing things and even worse, when they find something you delete it so we have no idea what it found.

Please go to *Start *- *Run *- type in *eventvwr.msc* to open the event viewer. Look under both "Application" and "System" for recent (the last 48 hours or so) errors (shown in red) and if found, do this for each one.

Double-click the error to open it up and then click on the icon that looks like two pieces of paper. This will copy the full error. Then "paste" the error into Notepad. Do this for each one until you have them all listed in Notepad and then copy and paste the list in a reply here please.


----------



## kickrz (Jul 30, 2003)

Well the webroot I had done long before and actually had forgotten I did it but it wouldn't scan until restart so when I restarted it scanned right away. I figured since I couldn't copy, delete or anything unless subscribed it was just useless on my computer.

Anyway here is the info:

Event Type:	Error
Event Source:	Application Hang
Event Category:	(101)
Event ID:	1002
Date: 5/5/2011
Time: 8:23:34 PM
User: N/A
Computer:	BRIAN-Y0IEJ0KFN
Description:
Hanging application YahooMessenger.exe, version 10.0.0.1270, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 59 61 68 6f 6f 4d YahooM
0018: 65 73 73 65 6e 67 65 72 essenger
0020: 2e 65 78 65 20 31 30 2e .exe 10.
0028: 30 2e 30 2e 31 32 37 30 0.0.1270
0030: 20 69 6e 20 68 75 6e 67 in hung
0038: 61 70 70 20 30 2e 30 2e app 0.0.
0040: 30 2e 30 20 61 74 20 6f 0.0 at o
0048: 66 66 73 65 74 20 30 30 ffset 00
0050: 30 30 30 30 30 30 000000 
Event Type:	Error
Event Source:	Bonjour Service
Event Category:	None
Event ID:	100
Date: 5/2/2011
Time: 6:29:10 PM
User: N/A
Computer:	BRIAN-Y0IEJ0KFN
Description:
WSARecvMsg failed (10022)

Then there is about 20+ of the same error:

Event Type:	Error
Event Source:	Cdrom
Event Category:	None
Event ID:	11
Date: 5/7/2011
Time: 1:54:39 AM
User: N/A
Computer:	BRIAN-Y0IEJ0KFN
Description:
The driver detected a controller error on \Device\CdRom0.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 68 00 01 00 b8 00 ..h...¸.
0008: 00 00 00 00 0b 00 04 c0 .......À
0010: 01 01 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
0028: 09 8d 5d 00 00 00 00 00 .].....
0030: ff ff ff ff 02 00 00 00 ÿÿÿÿ....
0038: 40 00 00 c4 02 00 00 00 @..Ä....
0040: 00 00 06 12 08 00 00 00 ........
0048: 00 00 00 00 14 00 00 00 ........
0050: 00 00 00 00 e8 8f b4 86 ....è´
0058: 00 00 00 00 90 ea 32 86 ....ê2
0060: 01 00 00 00 00 00 00 00 ........
0068: 00 00 00 00 00 00 00 00 ........
0070: 00 00 00 00 00 00 00 00 ........
0078: 70 00 04 00 00 00 00 0a p.......
0080: 00 00 08 83 40 00 00 00 ...@...
0088: 00 00 00 00 00 00 00 00 ........


----------



## Cookiegal (Aug 27, 2003)

Please give me a summary of all problems you're experiencing with the computer at the moment.


----------



## kickrz (Jul 30, 2003)

At this very moment I seem to be ok. I don't restart or shut it down much so I may end up experiencing issues. Shall we call it solved then? Can it be reopened if it won't restart or do I have to start a new topic?


----------



## Cookiegal (Aug 27, 2003)

Please post a new HijackThis log before we finish this up. The thread will remain open for 45 days without any replies so you should reply back here if it's within that time frame.


----------



## kickrz (Jul 30, 2003)

Ok will post the HJT log tonight...thanks.


----------



## Cookiegal (Aug 27, 2003)

Sounds good.


----------



## kickrz (Jul 30, 2003)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 5:38:04 PM, on 5/9/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\Webroot\Security\Current\Framework\WRConsumerService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe
C:\Program Files\HiYo\bin\HiYo.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IncrediMail\Bin\ImApp.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Sunbelt Software\VIPRE\SBAMSvc.exe
C:\Program Files\Sunbelt Software\VIPRE\SBPIMSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Security\current\plugins\antimalware\AEI.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Sunbelt Software\VIPRE\SBAMTray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Webroot\Security\Current\plugins\antispam\wrhkisvc.exe
C:\Documents and Settings\Kickrz\Application Data\mjusbsp\magicJack.exe
C:\Documents and Settings\Kickrz\Local Settings\Application Data\TheWeatherNetwork\WeatherEye\WeatherEye.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\IncrediMail\Bin\IncMail.exe
C:\Program Files\Trend Micro\HijackThis\HiJackThis.exe
C:\Program Files\Trend Micro\HijackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/ig?hl=en
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O1 - Hosts: 74.208.10.249 gs.apple.com
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Webroot Browser Helper Object - {c8d5d964-2be8-4c5b-8cf5-6e975aa88504} - C:\Program Files\Webroot\Security\current\products\WISC\toolbar\LPBar.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: WRCommonBHO - {D93EC24D-8741-4D41-B83D-A5793B998416} - C:\Program Files\Webroot\Security\current\plugins\browserextension\WebrootBHO.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Foxit PDF Creator Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: Webroot Toolbar - {97ab88ef-346b-4179-a0b1-7445896547a5} - C:\Program Files\Webroot\Security\current\products\WISC\toolbar\LPBar.dll
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SBAMTray] "C:\Program Files\Sunbelt Software\VIPRE\SBAMTray.exe"
O4 - HKLM\..\Run: [Monitor] "C:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Hiyo] "C:\Program Files\HiYo\bin\HiYo.exe" /RunFromStartup
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [WebrootTrayApp] "C:\Program Files\Webroot\Security\Current\Framework\WRTray.exe"
O4 - HKCU\..\Run: [IncrediMail] "C:\Program Files\IncrediMail\bin\IncMail.exe" /c
O4 - HKCU\..\Run: [cdloader] "C:\Documents and Settings\Kickrz\Application Data\mjusbsp\cdloader2.exe" MAGICJACK
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\PROGRA~1\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Kickrz\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil10l_ActiveX.exe -update activex
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1265376705171
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1273110928250
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos-beta/OnlineScanner.cab
O16 - DPF: {BEA7310D-06C4-4339-A784-DC3804819809} (Photo Upload Plugin Class) - http://www.walmartphotocentre.ca/upload/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab
O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LeapFrog Connect Device Service - LeapFrog Enterprises, Inc. - C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: VIPRE Antivirus (SBAMSvc) - Sunbelt Software - C:\Program Files\Sunbelt Software\VIPRE\SBAMSvc.exe
O23 - Service: SB Recovery Service (SBPIMSvc) - Sunbelt Software - C:\Program Files\Sunbelt Software\VIPRE\SBPIMSvc.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. (www.webroot.com) - C:\Program Files\Webroot\Security\current\plugins\antimalware\AEI.exe
O23 - Service: Webroot Client Service (WRConsumerService) - Webroot Software, Inc. - C:\Program Files\Webroot\Security\Current\Framework\WRConsumerService.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--
End of file - 8953 bytes


----------



## Cookiegal (Aug 27, 2003)

Open HijackThis and click on the *Open Misc Tools section* button. Click on the *Open Uninstall Manager* button. Click the *Save List* button. Save the list then copy and paste it here.


----------



## kickrz (Jul 30, 2003)

7-Zip 4.65
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.4.4
Apple Application Support
Apple Mobile Device Support
Apple Software Update
AsfTools 3.1 (remove only)
Ask Toolbar
Audacity 1.2.6
Auto Photo Organizer v2.2 build 569
AviSynth 2.5
BitTorrent
Bonjour
Chainz 2 - Relinked
Coupon Printer for Windows
DesignPro 5
DiskAid 3.11
DVD Flick 1.3.0.7
ESET Online Scanner v3
FitDay PC version 2.0
Foxit PDF Editor
Free File Opener v2011.6.0.4
Garmin Communicator Plugin
Garmin USB Drivers
Garmin USB Drivers
Garmin WebUpdater
Garmin WebUpdater
GIMP 2.6.8
Google Earth
Google Update Helper
HiJackThis
HijackThis 2.0.2
Hitman Pro 3.5
HiYo
HiYo 
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows XP (KB2158563)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
ImgBurn
IncrediMail
IncrediMail 2.0
iTunes
Java(TM) 6 Update 21
JDownloader
K-Lite Codec Pack 3.2.5 Standard
LeapFrog Connect
LeapFrog Connect
LeapFrog My Pals Plugin
LeapFrog MyOwnLeaptop Plugin
LeapFrog Tag Plugin
LibUSB-Win32-0.1.12.2
Malwarebytes' Anti-Malware
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable - KB2467175
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
MP4 Player 
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 and SOAP Toolkit 3.0
NVIDIA Display Driver
PC Updater
Photo Notifier and Animation Creator
Photo Notifier and Animation Creator
Photo Story 3 for Windows
PhotoMail Maker
PhotoMail Maker
PhotoScape
QuickTime
Realtek AC'97 Audio
Safari
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB2360131)
Security Update for Windows Internet Explorer 8 (KB2416400)
Security Update for Windows Internet Explorer 8 (KB2482017)
Security Update for Windows Internet Explorer 8 (KB2497640)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Encoder (KB2447961)
Security Update for Windows Media Encoder (KB954156)
Security Update for Windows Media Encoder (KB979332)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player (KB979402)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2503658)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2506223)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2511455)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981957)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
Spreadsheet
StudioTax 2009
StudioTax 2010
TOSHIBA Software Modem
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB978506)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Update for Windows XP (KB978207)
Use the entry named LeapFrog Connect to uninstall (LeapFrog My Pals Plugin)
Use the entry named LeapFrog Connect to uninstall (LeapFrog MyOwnLeaptop Plugin)
Use the entry named LeapFrog Connect to uninstall (LeapFrog Tag Plugin)
VideoThang&#8482; 2.1.0
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
Webroot Software
Webroot Software
What's Running 2.2
Windows Driver Package - Garmin (grmnusb) GARMIN Devices (03/08/2007 2.2.1.0)
Windows Driver Package - LeapFrog (FlyUsb) USB (11/05/2008 1.1.1.0)
Windows Driver Package - Leapfrog (Leapfrog-USBLAN) Net (09/10/2009 02.03.05.012)
Windows Feature Pack for Storage (32-bit) - IMAPI update for Blu-Ray
Windows Internet Explorer 8
Windows Media Encoder 9 Series
Windows Media Encoder 9 Series
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows Media Player Firefox Plugin
Windows XP Service Pack 3
WinSCP 4.2.1 beta
WinZip 15.0
Wondershare Flash Gallery Factory Deluxe 5.0.4
Wondershare Video to Flash Encoder(Build 4.0.2.0)
Yahoo! Messenger
Yahoo! Software Update
Yahoo! Toolbar
YPOPs! 0.9.7.3


----------



## Cookiegal (Aug 27, 2003)

You should uninstall the following via the Control Panel - Add or Remove Programs:

Ask Toolbar
Webroot Software

Your *Java* is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version of *Java* components and upgrade the application.

*Upgrading Java*:


Download the latest version of *Java Runtime Environment (JRE) 6 Update 25 *.
You will see four options, Java, JavaFX, NetBeans and Java EE. Under the first one (Java) you will see two links, JDK and JRE. Click on the JRE link.
Select your Platform and check the box that says: "*I agree to the Java SE Runtime Environment 6u25 with JavaFX License Agreement.*".
Click on *Continue*.
Click on the link to download Windows Offline Installation (*jre-6u25-windows-i586.exe*) and save it to your desktop. *Do NOT use the Sun Download Manager.*
Close any programs you may have running - especially your web browser.
Go to *Start* > *Control Panel*, double-click on *Add/Remove *programs and remove all older versions of Java.
Check any item with * Java Runtime Environment, JRE, J2SE or Java(TM)* in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java version.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on the download to install the newest version.

The older version of Java that you need to uninstall is:

Java(TM) 6 Update 21

Is everything still fine with the computer?


----------



## kickrz (Jul 30, 2003)

Seems to be ok.


----------



## Cookiegal (Aug 27, 2003)

Here are some final instructions for you.

*Follow these steps to uninstall Combofix and all of its files and components.*

 Click *START* then *RUN*
 Now type *ComboFix /uninstall* in the runbox and click *OK*. Note the *space* between the *X* and the */uninstall*, it needs to be there (the screenshot is just for illustration but the actual command used the entire word uninstall and just the u).










Now you should turn system restore off to flush out all previous system restore points, then turn it back on and create a new restore point:

To turn off system restore, on the Desktop, right click on *My Computer* and click on *Properties.*
Click the *System Restore* tab.
Check *Turn off System Restore.*
Click Apply and then click OK.

Restart your computer, turn System Restore back on and create a restore point.

To create a new restore point, click on *Start*  *All Programs*  *Accessories*  *System Tools* and then select *System Restore*.

In the System Restore wizard, select *Create a restore point* and click the Next button.

Type a name for your new restore point then click on Create.


----------



## kickrz (Jul 30, 2003)

Just saw your post and was about to do as you suggested when my computer started locking up. I went to restart and now I can't get back in.. Not even in safe mode.

Eta: after a few tries I am in, in safe mode any other way just hangs so back to square 1. I even tried a system restore and even then I could boot normally. At first it just kept looping.


----------



## Cookiegal (Aug 27, 2003)

Please post a new HijackThis log.

Please download DDS by sUBs to your desktop from one of the following locations:

http://www.techsupportforum.com/sectools/sUBs/dds
http://download.bleepingcomputer.com/sUBs/dds.scr
http://www.forospyware.com/sUBs/dds

Disable any script blocker you may have as they may interfere and then double-click the DDS.scr to run the tool.

When DDS has finished scanning, it will open two logs named as follows:

DDS.txt
Attach.txt

Save them both to your desktop. Copy and paste the contents of the DDS.txt and Attach.txt files in your reply please.


----------



## kickrz (Jul 30, 2003)

Ok I did the hjt and found nothing... Will post that and the rest tonight when I get home.


----------



## Cookiegal (Aug 27, 2003)

HijackThis is just a report that I want you copy and past back here. It doesn't scan for malware.


----------



## kickrz (Jul 30, 2003)

argg sorry was thinking mbam log.

Anyway here is the requested info:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:57:50 PM, on 5/15/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sunbelt Software\VIPRE\SBAMSvc.exe
C:\Program Files\Sunbelt Software\VIPRE\SBPIMSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SBAMTray] "C:\Program Files\Sunbelt Software\VIPRE\SBAMTray.exe"
O4 - HKLM\..\Run: [Monitor] "C:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Hiyo] "C:\Program Files\HiYo\bin\HiYo.exe" /RunFromStartup
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [IncrediMail] "C:\Program Files\IncrediMail\bin\IncMail.exe" /c
O4 - HKCU\..\Run: [cdloader] "C:\Documents and Settings\Kickrz\Application Data\mjusbsp\cdloader2.exe" MAGICJACK
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\PROGRA~1\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Kickrz\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: OpenOffice.org 3.3.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1265376705171
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1273110928250
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos-beta/OnlineScanner.cab
O16 - DPF: {BEA7310D-06C4-4339-A784-DC3804819809} (Photo Upload Plugin Class) - http://www.walmartphotocentre.ca/upload/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab
O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LeapFrog Connect Device Service - LeapFrog Enterprises, Inc. - C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: VIPRE Antivirus (SBAMSvc) - Sunbelt Software - C:\Program Files\Sunbelt Software\VIPRE\SBAMSvc.exe
O23 - Service: SB Recovery Service (SBPIMSvc) - Sunbelt Software - C:\Program Files\Sunbelt Software\VIPRE\SBPIMSvc.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--
End of file - 6290 bytes

.
DDS (Ver_11-03-05.01) - NTFSx86 MINIMAL 
Run by Kickrz at 21:54:53.54 on Sun 05/15/2011
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.762 [GMT -4:00]
.
AV: Sunbelt VIPRE *Enabled/Updated* {964FCE60-0B18-4D30-ADD6-EB178909041C}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
svchost.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\Program Files\Sunbelt Software\VIPRE\SBAMSvc.exe
C:\Program Files\Sunbelt Software\VIPRE\SBPIMSvc.exe
C:\WINDOWS\Explorer.EXE
I:\dds.com
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.ca/
uInternet Settings,ProxyOverride = *.local
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
TB: {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No File
TB: {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No File
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [IncrediMail] "c:\program files\incredimail\bin\IncMail.exe" /c
uRun: [cdloader] "c:\documents and settings\kickrz\application data\mjusbsp\cdloader2.exe" MAGICJACK
uRun: [Messenger (Yahoo!)] "c:\progra~1\yahoo!\messenger\YahooMessenger.exe" -quiet
uRun: [Google Update] "c:\documents and settings\kickrz\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [NvCplDaemon] "RUNDLL32.EXE" c:\windows\system32\NvCpl.dll,NvStartup
mRun: [SBAMTray] "c:\program files\sunbelt software\vipre\SBAMTray.exe"
mRun: [Monitor] "c:\program files\leapfrog\leapfrog connect\Monitor.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [Hiyo] "c:\program files\hiyo\bin\HiYo.exe" /RunFromStartup
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
StartupFolder: c:\docume~1\kickrz\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/templates/ieawsdc.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1265376705171
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1273110928250
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos-beta/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {BEA7310D-06C4-4339-A784-DC3804819809} - hxxp://www.walmartphotocentre.ca/upload/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab
DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} - hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab
DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} - hxxp://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
.
============= SERVICES / DRIVERS ===============
.
R1 SBRE;SBRE;c:\windows\system32\drivers\SBREDrv.sys [2010-6-9 98392]
R2 SBAMSvc;VIPRE Antivirus;c:\program files\sunbelt software\vipre\SBAMSvc.exe [2010-8-20 2763080]
R2 SBPIMSvc;SB Recovery Service;c:\program files\sunbelt software\vipre\SBPIMSvc.exe [2010-8-20 181584]
R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.12.2;c:\windows\system32\drivers\libusb0.sys [2010-3-20 28160]
S1 sbaphd;sbaphd;c:\windows\system32\drivers\sbaphd.sys [2010-12-23 21464]
S1 SbTis;SbTis;c:\windows\system32\drivers\sbtis.sys [2010-12-23 212568]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-7-31 136176]
S2 sbapifs;sbapifs;c:\windows\system32\drivers\sbapifs.sys [2010-12-23 69976]
S3 FlyUsb;FLY Fusion;c:\windows\system32\drivers\FlyUsb.sys [2010-4-17 18560]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-7-31 136176]
S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys --> c:\windows\system32\drivers\massfilter.sys [?]
.
=============== Created Last 30 ================
.
2011-05-15 05:44:35	--------	d-----w-	c:\windows\system32\wbem\repository\FS
2011-05-15 05:44:35	--------	d-----w-	c:\windows\system32\wbem\Repository
2011-05-13 02:46:35	73728	----a-w-	c:\windows\system32\javacpl.cpl
2011-05-12 05:59:51	--------	d-----w-	c:\docume~1\kickrz\applic~1\OpenOffice.org
2011-05-12 05:47:42	--------	d-----w-	c:\program files\OpenOffice.org 3
2011-05-12 02:10:36	--------	d-----w-	c:\docume~1\kickrz\locals~1\applic~1\WinZip
2011-05-12 02:01:03	--------	d-----w-	c:\docume~1\alluse~1\applic~1\WinZipSE
2011-05-12 02:01:01	--------	d-----w-	c:\program files\WinZip Self-Extractor
2011-05-06 03:26:02	--------	d-----w-	c:\docume~1\kickrz\locals~1\applic~1\Webroot
2011-05-06 03:02:56	--------	d-----w-	c:\docume~1\kickrz\locals~1\applic~1\PackageAware
2011-05-01 00:26:03	--------	d-----w-	c:\program files\ESET
2011-04-30 14:19:33	388096	----a-r-	c:\docume~1\kickrz\applic~1\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
2011-04-30 12:10:22	--------	d-----w-	c:\program files\MSSOAP
2011-04-30 12:09:55	--------	d-----w-	c:\program files\Webroot
2011-04-30 05:07:35	--------	d-----w-	c:\docume~1\kickrz\applic~1\FreeFileOpener
2011-04-30 05:01:57	--------	d-----w-	c:\docume~1\kickrz\locals~1\applic~1\Deployment
2011-04-30 04:00:02	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2011-04-30 03:58:45	--------	d-----w-	c:\windows\7E7D778E121D4BBDBA29FAA81B9FBD8C.TMP
2011-04-30 03:58:44	--------	d-----w-	c:\windows\BB77DC4CB8184FD48D1D5D3B617B78B4.TMP
2011-04-30 03:58:44	--------	d-----w-	c:\windows\8A83AE5FF59B4E1FBF2A49185A42ED1B.TMP
2011-04-30 03:58:43	--------	d-----w-	c:\windows\CC33E708A7954AB3908A8F45919BC097.TMP
2011-04-30 03:58:42	--------	d--h--w-	c:\windows\msdownld.tmp
2011-04-29 12:28:32	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware(2)
2011-04-27 20:49:40	--------	d-----w-	C:\35c48c3876ce67c68d3718b079b6
.
==================== Find3M ====================
.
2011-05-13 02:46:01	472808	----a-w-	c:\windows\system32\deployJava1.dll
2011-03-09 23:10:37	102400	----a-w-	c:\windows\RegBootClean.exe
2011-03-07 05:33:50	692736	----a-w-	c:\windows\system32\inetcomm.dll
2011-03-04 06:37:06	420864	----a-w-	c:\windows\system32\vbscript.dll
2011-03-03 13:21:11	1857920	----a-w-	c:\windows\system32\win32k.sys
2011-02-22 23:06:29	916480	----a-w-	c:\windows\system32\wininet.dll
2011-02-22 23:06:29	43520	----a-w-	c:\windows\system32\licmgr10.dll
2011-02-22 23:06:29	1469440	------w-	c:\windows\system32\inetcpl.cpl
2011-02-22 11:41:59	385024	----a-w-	c:\windows\system32\html.iec
2011-02-17 12:32:12	5120	----a-w-	c:\windows\system32\xpsp4res.dll
2011-02-15 12:56:39	290432	----a-w-	c:\windows\system32\atmfd.dll
2010-05-11 18:23:56	1699840	----a-w-	c:\program files\FreeSCAN-0.9K.msi
2010-05-02 04:58:42	212713	----a-w-	c:\program files\mp3DC211.exe
2010-05-01 01:32:10	661552	----a-w-	c:\program files\SpywareTerminatorSetup.exe
2010-05-01 00:48:45	1156877	----a-w-	c:\program files\WhatsRunning2_2_Setup.exe
2010-04-13 16:14:27	1909248	----a-w-	c:\program files\spreadsheetJune2009.msi
2010-03-30 23:46:59	5918720	----a-w-	c:\program files\mbam-setup-1.45.exe
2010-03-23 01:16:37	22649132	----a-w-	c:\program files\VideoThangTM_Installer_2.1.0.exe
2010-03-18 03:33:58	708658	----a-w-	c:\program files\ypops-win-0.9.7.3.exe
2010-02-06 00:07:12	9918872	----a-w-	c:\program files\WMEncoder.exe
2010-02-05 18:26:24	16205198	----a-w-	c:\program files\PhotoScapeSetup_V3.4.exe
2010-02-05 18:22:54	10798000	----a-w-	c:\program files\winamp5572_full_bundle_emusic-7plus_en-us.exe
2010-02-05 18:15:30	98180904	----a-w-	c:\program files\iTunesSetup.exe
2006-05-03 10:06:54	163328	--sh--r-	c:\windows\system32\flvDX.dll
2007-02-21 11:47:16	31232	--sh--r-	c:\windows\system32\msfDX.dll
2007-12-17 13:43:00	27648	--sh--w-	c:\windows\system32\Smab0.dll
2008-02-04 19:26:34	151040	--sh--w-	c:\windows\system32\VistaUltm.dll
.
============= FINISH: 21:55:40.14 ===============


----------



## kickrz (Jul 30, 2003)

Ok I did a system restore to the day after I uninstalled the java and ask toolbar and am now in however I am not sure if I should to proceed with turning off system restore and restarting since doing a system restore is the only way I can get in. 

I will wait for further instructions. I did uninstall combo fix but stopped before the sys restore stuff.


----------



## Cookiegal (Aug 27, 2003)

Please visit *Combofix Guide & Instructions * for instructions for installing the recovery console and downloading and running ComboFix.

The only thing different from the instructions there is that when downloading and saving the ComboFix.exe I would like you to rename it to puppy.exe please.

Post the log from ComboFix when you've accomplished that along with a new HijackThis log.

Important notes regarding ComboFix:

ComboFix may reset a number of Internet Explorer's settings, including making it the default browser. This can easily be changed once we're finished.

ComboFix also prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you, please let me know. This can be undone manually when we're finished. Read  *HERE * for an article written by dvk01 on why we disable autoruns.


----------



## kickrz (Jul 30, 2003)

ComboFix 11-05-16.01 - Kickrz 05/16/2011 15:59:58.4.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.451 [GMT -4:00]
Running from: c:\documents and settings\Kickrz\Desktop\puppy.exe
AV: Sunbelt VIPRE *Disabled/Updated* {964FCE60-0B18-4D30-ADD6-EB178909041C}
.
.
((((((((((((((((((((((((( Files Created from 2011-04-16 to 2011-05-16 )))))))))))))))))))))))))))))))
.
.
2011-05-16 11:50 . 2011-05-16 11:50	--------	d-----w-	c:\windows\system32\wbem\Repository
2011-05-13 02:46 . 2011-05-13 02:46	--------	d-----w-	c:\program files\Common Files\Java
2011-05-13 02:46 . 2011-05-13 02:46	73728	----a-w-	c:\windows\system32\javacpl.cpl
2011-05-12 05:59 . 2011-05-12 05:59	--------	d-----w-	c:\documents and settings\Kickrz\Application Data\OpenOffice.org
2011-05-12 05:47 . 2011-05-12 05:49	--------	d-----w-	c:\program files\OpenOffice.org 3
2011-05-12 02:10 . 2011-05-12 02:10	--------	d-----w-	c:\documents and settings\Kickrz\Local Settings\Application Data\WinZip
2011-05-12 02:01 . 2011-05-12 02:01	--------	d-----w-	c:\documents and settings\All Users\Application Data\WinZipSE
2011-05-12 02:01 . 2011-05-12 02:01	--------	d-----w-	c:\program files\WinZip Self-Extractor
2011-05-06 03:26 . 2011-05-13 02:30	--------	d-----w-	c:\documents and settings\Kickrz\Local Settings\Application Data\Webroot
2011-05-06 03:25 . 2011-05-06 03:25	--------	d-sh--w-	c:\windows\system32\config\systemprofile\PrivacIE
2011-05-06 03:02 . 2011-05-06 03:02	--------	d-----w-	c:\documents and settings\Kickrz\Local Settings\Application Data\PackageAware
2011-05-01 00:26 . 2011-05-01 00:26	--------	d-----w-	c:\program files\ESET
2011-04-30 14:19 . 2011-04-30 14:19	388096	----a-r-	c:\documents and settings\Kickrz\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-04-30 12:10 . 2011-04-30 12:10	--------	d-----w-	c:\program files\MSSOAP
2011-04-30 12:09 . 2011-05-13 02:42	--------	d-----w-	c:\program files\Webroot
2011-04-30 05:07 . 2011-04-30 05:07	--------	d-----w-	c:\documents and settings\Kickrz\Application Data\FreeFileOpener
2011-04-30 05:01 . 2011-04-30 05:01	--------	d-----w-	c:\documents and settings\Kickrz\Local Settings\Application Data\Deployment
2011-04-30 04:00 . 2011-05-04 21:18	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2011-04-30 03:58 . 2011-04-30 03:58	--------	d-----w-	c:\windows\7E7D778E121D4BBDBA29FAA81B9FBD8C.TMP
2011-04-30 03:58 . 2011-04-30 03:58	--------	d-----w-	c:\windows\8A83AE5FF59B4E1FBF2A49185A42ED1B.TMP
2011-04-30 03:58 . 2011-04-30 03:58	--------	d-----w-	c:\windows\BB77DC4CB8184FD48D1D5D3B617B78B4.TMP
2011-04-30 03:58 . 2011-04-30 03:58	--------	d-----w-	c:\windows\CC33E708A7954AB3908A8F45919BC097.TMP
2011-04-30 03:58 . 2011-04-30 03:58	--------	d--h--w-	c:\windows\msdownld.tmp
2011-04-27 20:49 . 2011-04-30 04:04	--------	d-----w-	C:\35c48c3876ce67c68d3718b079b6
2011-04-27 01:09 . 2011-04-30 04:06	--------	d-s---w-	c:\documents and settings\Administrator
2011-04-25 22:47 . 2011-04-25 22:47	--------	d-----w-	c:\documents and settings\NetworkService\IETldCache
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-13 02:46 . 2010-06-24 00:42	472808	----a-w-	c:\windows\system32\deployJava1.dll
2011-03-09 23:10 . 2011-03-09 23:10	102400	----a-w-	c:\windows\RegBootClean.exe
2011-03-07 05:33 . 2010-02-05 00:42	692736	----a-w-	c:\windows\system32\inetcomm.dll
2011-03-04 06:37 . 2003-03-31 12:00	420864	----a-w-	c:\windows\system32\vbscript.dll
2011-03-03 13:21 . 2003-03-31 12:00	1857920	----a-w-	c:\windows\system32\win32k.sys
2011-02-22 23:06 . 2003-03-31 12:00	916480	----a-w-	c:\windows\system32\wininet.dll
2011-02-22 23:06 . 2003-03-31 12:00	43520	----a-w-	c:\windows\system32\licmgr10.dll
2011-02-22 23:06 . 2003-03-31 12:00	1469440	------w-	c:\windows\system32\inetcpl.cpl
2011-02-22 11:41 . 2004-08-04 05:59	385024	----a-w-	c:\windows\system32\html.iec
2011-02-17 13:18 . 2003-03-31 12:00	455936	----a-w-	c:\windows\system32\drivers\mrxsmb.sys
2011-02-17 13:18 . 2003-03-31 12:00	357888	----a-w-	c:\windows\system32\drivers\srv.sys
2011-02-17 12:32 . 2010-02-05 15:19	5120	----a-w-	c:\windows\system32\xpsp4res.dll
2010-05-11 18:23 . 2010-05-11 18:23	1699840	----a-w-	c:\program files\FreeSCAN-0.9K.msi
2010-05-02 04:58 . 2010-05-02 04:58	212713	----a-w-	c:\program files\mp3DC211.exe
2010-05-01 01:32 . 2010-05-01 01:32	661552	----a-w-	c:\program files\SpywareTerminatorSetup.exe
2010-05-01 00:48 . 2010-05-01 00:48	1156877	----a-w-	c:\program files\WhatsRunning2_2_Setup.exe
2010-04-13 16:14 . 2010-04-13 16:14	1909248	----a-w-	c:\program files\spreadsheetJune2009.msi
2010-03-30 23:46 . 2010-03-30 23:46	5918720	----a-w-	c:\program files\mbam-setup-1.45.exe
2010-03-23 01:16 . 2010-03-23 01:16	22649132	----a-w-	c:\program files\VideoThangTM_Installer_2.1.0.exe
2010-03-18 03:33 . 2010-03-18 03:33	708658	----a-w-	c:\program files\ypops-win-0.9.7.3.exe
2010-02-06 00:07 . 2010-02-06 00:07	9918872	----a-w-	c:\program files\WMEncoder.exe
2010-02-05 18:26 . 2010-02-05 18:26	16205198	----a-w-	c:\program files\PhotoScapeSetup_V3.4.exe
2010-02-05 18:22 . 2010-02-05 18:22	10798000	----a-w-	c:\program files\winamp5572_full_bundle_emusic-7plus_en-us.exe
2010-02-05 18:15 . 2010-02-05 18:15	98180904	----a-w-	c:\program files\iTunesSetup.exe
2006-05-03 10:06	163328	--sh--r-	c:\windows\system32\flvDX.dll
2007-02-21 11:47	31232	--sh--r-	c:\windows\system32\msfDX.dll
2007-12-17 13:43	27648	--sh--w-	c:\windows\system32\Smab0.dll
2008-02-04 19:26	151040	--sh--w-	c:\windows\system32\VistaUltm.dll
.
.
((((((((((((((((((((((((((((( SnapShot_2011-04-30_14.14.27 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-12 04:02 . 2009-07-12 04:02	51008 c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa\vcomp90.dll
- 2009-07-12 05:02 . 2009-07-12 05:02	51008 c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa\vcomp90.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02	59728 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90rus.dll
- 2009-07-12 05:02 . 2009-07-12 05:02	59728 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90rus.dll
- 2009-07-12 05:02 . 2009-07-12 05:02	42832 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90kor.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02	42832 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90kor.dll
- 2009-07-12 05:02 . 2009-07-12 05:02	43344 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90jpn.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02	43344 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90jpn.dll
- 2009-07-12 05:02 . 2009-07-12 05:02	61264 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90ita.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02	61264 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90ita.dll
- 2009-07-12 05:02 . 2009-07-12 05:02	62800 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90fra.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02	62800 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90fra.dll
- 2009-07-12 05:02 . 2009-07-12 05:02	61760 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esp.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02	61760 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esp.dll
- 2009-07-12 05:02 . 2009-07-12 05:02	61776 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esn.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02	61776 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esn.dll
- 2009-07-12 05:02 . 2009-07-12 05:02	53568 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90enu.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02	53568 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90enu.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02	63296 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90deu.dll
- 2009-07-12 05:02 . 2009-07-12 05:02	63296 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90deu.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02	36688 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90cht.dll
- 2009-07-12 05:02 . 2009-07-12 05:02	36688 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90cht.dll
- 2009-07-12 05:02 . 2009-07-12 05:02	35648 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90chs.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02	35648 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90chs.dll
+ 2009-07-12 04:05 . 2009-07-12 04:05	59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90u.dll
- 2009-07-12 05:05 . 2009-07-12 05:05	59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90u.dll
+ 2009-07-12 04:05 . 2009-07-12 04:05	59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90.dll
- 2009-07-12 05:05 . 2009-07-12 05:05	59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90.dll
+ 2011-05-16 12:07 . 2011-05-16 12:07	16384 c:\windows\temp\Perflib_Perfdata_564.dat
+ 2011-05-06 03:25 . 2011-05-06 03:25	32768 c:\windows\system32\config\systemprofile\PrivacIE\index.dat
+ 2011-05-04 21:20 . 2011-05-13 02:29	65536 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2011-05-06 03:26 . 2011-05-06 03:25	32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012011050520110506\index.dat
- 2010-02-05 00:46 . 2011-04-29 02:00	32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2010-02-05 00:46 . 2011-05-13 02:29	32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2011-05-04 21:20 . 2011-05-13 02:29	32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2011-05-01 02:43 . 2011-05-01 02:43	21504 c:\windows\Installer\48fb175.msi
+ 2011-05-12 02:10 . 2011-05-12 02:10	29184 c:\windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C240C2}\IconCD95F6617.exe
+ 2011-05-12 05:49 . 2011-05-12 05:49	11264 c:\windows\assembly\GAC_MSIL\cli_basetypes\1.0.18.0__ce2cb7e279207b9e\cli_basetypes.dll
+ 2011-05-12 05:50 . 2011-05-12 05:50	64000 c:\windows\assembly\GAC_32\cli_cppuhelper\1.0.21.0__ce2cb7e279207b9e\cli_cppuhelper.dll
+ 2011-05-06 03:23 . 2011-05-06 03:25	4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{451DBC50-7790-11E0-B474-0090967C3BD7}.dat
+ 2011-05-06 03:25 . 2011-05-06 03:26	7168 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{7F1C0F7A-7790-11E0-B474-0090967C3BD7}.dat
+ 2011-05-06 03:24 . 2011-05-06 03:25	4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{50E5BB06-7790-11E0-B474-0090967C3BD7}.dat
+ 2011-05-12 05:49 . 2011-05-12 05:49	3072 c:\windows\assembly\GAC_MSIL\policy.1.0.cli_uretypes\7.0.0.0__ce2cb7e279207b9e\policy.1.0.cli_uretypes.dll
+ 2011-05-12 05:49 . 2011-05-12 05:49	3072 c:\windows\assembly\GAC_MSIL\policy.1.0.cli_ure\21.0.0.0__ce2cb7e279207b9e\policy.1.0.cli_ure.dll
+ 2011-05-12 05:51 . 2011-05-12 05:51	3072 c:\windows\assembly\GAC_MSIL\policy.1.0.cli_oootypes\7.0.0.0__ce2cb7e279207b9e\policy.1.0.cli_oootypes.dll
+ 2011-05-12 05:49 . 2011-05-12 05:49	3072 c:\windows\assembly\GAC_MSIL\policy.1.0.cli_basetypes\18.0.0.0__ce2cb7e279207b9e\policy.1.0.cli_basetypes.dll
+ 2011-05-12 05:49 . 2011-05-12 05:49	7680 c:\windows\assembly\GAC_MSIL\cli_ure\1.0.21.0__ce2cb7e279207b9e\cli_ure.dll
+ 2011-05-12 05:51 . 2011-05-12 05:51	3072 c:\windows\assembly\GAC_32\policy.1.0.cli_cppuhelper\21.0.0.0__ce2cb7e279207b9e\policy.1.0.cli_cppuhelper.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02	653120 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcr90.dll
- 2009-07-12 05:02 . 2009-07-12 05:02	653120 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcr90.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02	569664 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcp90.dll
- 2009-07-12 05:02 . 2009-07-12 05:02	569664 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcp90.dll
+ 2009-07-12 04:05 . 2009-07-12 04:05	225280 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcm90.dll
- 2009-07-12 05:05 . 2009-07-12 05:05	225280 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcm90.dll
- 2009-07-12 05:02 . 2009-07-12 05:02	159032 c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2\atl90.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02	159032 c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2\atl90.dll
+ 2010-03-02 19:38 . 2011-05-16 11:52	133600 c:\windows\system32\Restore\rstrlog.dat
+ 2011-05-13 02:46 . 2011-05-13 02:46	157472 c:\windows\system32\javaws.exe
+ 2011-05-13 02:46 . 2011-05-13 02:46	145184 c:\windows\system32\javaw.exe
- 2010-08-29 02:18 . 2010-07-17 09:00	145184 c:\windows\system32\javaw.exe
- 2010-08-29 02:18 . 2010-07-17 09:00	145184 c:\windows\system32\java.exe
+ 2011-05-13 02:46 . 2011-05-13 02:46	145184 c:\windows\system32\java.exe
+ 2009-06-10 20:40 . 2011-05-13 02:42	290088 c:\windows\system32\FNTCACHE.DAT
+ 2011-05-06 03:24 . 2011-05-06 03:25	124928 c:\windows\system32\config\systemprofile\Local Settings\Application Data\AskToolbar\cache.dat
+ 2010-08-11 01:14 . 2011-05-04 21:18	262144 c:\windows\system32\config\systemprofile\IETldCache\index.dat
- 2010-08-11 01:14 . 2010-08-11 01:13	262144 c:\windows\system32\config\systemprofile\IETldCache\index.dat
+ 2011-05-06 03:13 . 2011-05-02 14:47	511328 c:\windows\system32\Capicom.dll
- 2011-04-30 12:10 . 2009-11-06 19:14	511328 c:\windows\system32\capicom.dll
+ 2011-05-15 05:41 . 2011-05-12 03:18	142820 c:\windows\PCHealth\HelpCtr\Config\Cache\Personal_32_1033.dat
+ 2011-05-13 02:46 . 2011-05-13 02:46	180224 c:\windows\Installer\37c0f.msi
+ 2011-05-13 02:45 . 2011-05-13 02:45	677376 c:\windows\Installer\37c0a.msi
+ 2011-05-12 02:10 . 2011-05-12 02:10	632320 c:\windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C240C2}\IconCD95F66110.exe
+ 2011-05-12 05:49 . 2011-05-12 05:49	118784 c:\windows\assembly\GAC_MSIL\cli_uretypes\1.0.7.0__ce2cb7e279207b9e\cli_uretypes.dll
+ 2011-05-12 05:50 . 2011-05-12 05:50	892928 c:\windows\assembly\GAC_MSIL\cli_oootypes\1.0.7.0__ce2cb7e279207b9e\cli_oootypes.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02	3780424 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90u.dll
- 2009-07-12 05:02 . 2009-07-12 05:02	3780424 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90u.dll
- 2009-07-12 05:02 . 2009-07-12 05:02	3765048 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02	3765048 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90.dll
+ 2011-04-14 14:46 . 2011-04-14 14:46	3854848 c:\windows\Installer\df4a358.msp
+ 2011-05-12 05:53 . 2011-05-12 05:53	2991104 c:\windows\Installer\b68bf0.msi
+ 2011-05-12 02:10 . 2011-05-12 02:10	1696768 c:\windows\Installer\1ea4ca1c.msi
+ 2011-04-30 14:19 . 2011-04-30 14:19	1094656 c:\windows\Installer\1e698bd.msi
+ 2010-02-05 15:10 . 2011-05-12 04:43	42829768 c:\windows\system32\MRT.exe
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IncrediMail"="c:\program files\IncrediMail\bin\IncMail.exe" [2011-04-01 353736]
"cdloader"="c:\documents and settings\Kickrz\Application Data\mjusbsp\cdloader2.exe" [2010-12-03 50592]
"Messenger (Yahoo!)"="c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe" [2010-06-01 5252408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-03-24 2904064]
"SBAMTray"="c:\program files\Sunbelt Software\VIPRE\SBAMTray.exe" [2010-08-20 1348944]
"Monitor"="c:\program files\LeapFrog\LeapFrog Connect\Monitor.exe" [2010-11-19 193880]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
"Hiyo"="c:\program files\HiYo\bin\HiYo.exe" [2011-01-18 238960]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-01-25 421160]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-01-07 253672]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBAMSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBPIMSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^Kickrz^Start Menu^Programs^Startup^YPOPs.lnk]
path=c:\documents and settings\Kickrz\Start Menu\Programs\Startup\YPOPs.lnk
backup=c:\windows\pss\YPOPs.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-21 03:07	932288	----a-r-	c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-01-31 08:44	35760	----a-w-	c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12	15360	------w-	c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2010-04-10 01:51	136176	----atw-	c:\documents and settings\Kickrz\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Hiyo]
2011-01-18 23:57	238960	----a-w-	c:\program files\HiYo\Bin\HiYo.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-01-25 20:08	421160	----a-w-	c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2010-06-01 15:17	5252408	----a-w-	c:\progra~1\Yahoo!\MESSEN~1\YahooMessenger.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Monitor]
2010-11-19 18:38	193880	----a-w-	c:\program files\LeapFrog\LeapFrog Connect\Monitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12	1695232	------w-	c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2004-03-24 03:12	2904064	----a-w-	c:\windows\system32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2004-03-24 03:12	782336	----a-w-	c:\windows\system32\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 22:38	421888	----a-w-	c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2011-01-07 17:12	253672	----a-w-	c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ulead AutoDetector]
2005-05-23 13:57	90112	------w-	c:\program files\Common Files\Ulead Systems\Autodetector\Monitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Bonjour Service"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\IncrediMail\\Bin\\IncMail.exe"=
"c:\\Program Files\\IncrediMail\\Bin\\ImApp.exe"=
"c:\\Program Files\\IncrediMail\\Bin\\ImpCnt.exe"=
"c:\\Documents and Settings\\Kickrz\\My Documents\\Unzipped\\scannercast_V013_1224\\ScannerCast.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\Google\\Google Earth\\plugin\\geplugin.exe"=
"c:\\Program Files\\LeapFrog\\LeapFrog Connect\\LeapFrogConnect.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Documents and Settings\\Kickrz\\Application Data\\mjusbsp\\magicJack.exe"=
"c:\\Documents and Settings\\Kickrz\\Desktop\\IPHONE STUFF\\tinyumbrella-4.21.11.exe"=
"c:\\Documents and Settings\\Kickrz\\Desktop\\tinyumbrella-4.33.00.exe"=
.
R1 sbaphd;sbaphd;c:\windows\system32\drivers\sbaphd.sys [12/23/2010 11:38 PM 21464]
R1 SBRE;SBRE;c:\windows\system32\drivers\SBREDrv.sys [6/9/2010 1:17 PM 98392]
R1 SbTis;SbTis;c:\windows\system32\drivers\sbtis.sys [12/23/2010 11:29 PM 212568]
R2 sbapifs;sbapifs;c:\windows\system32\drivers\sbapifs.sys [12/23/2010 11:38 PM 69976]
R2 SBPIMSvc;SB Recovery Service;c:\program files\Sunbelt Software\VIPRE\SBPIMSvc.exe [8/20/2010 10:15 AM 181584]
R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.12.2;c:\windows\system32\drivers\libusb0.sys [3/20/2010 11:18 AM 28160]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [7/31/2010 3:31 PM 136176]
S2 SBAMSvc;VIPRE Antivirus;c:\program files\Sunbelt Software\VIPRE\SBAMSvc.exe [8/20/2010 10:16 AM 2763080]
S3 FlyUsb;FLY Fusion;c:\windows\system32\drivers\FlyUsb.sys [4/17/2010 1:15 PM 18560]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [7/31/2010 3:31 PM 136176]
S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys --> c:\windows\system32\drivers\massfilter.sys [?]
.
Contents of the 'Scheduled Tasks' folder
.
2011-05-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-31 19:31]
.
2011-05-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-31 19:31]
.
2011-05-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-839522115-220523388-2147104195-1004Core.job
- c:\documents and settings\Kickrz\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-04-10 01:51]
.
2011-05-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-839522115-220523388-2147104195-1004UA.job
- c:\documents and settings\Kickrz\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-04-10 01:51]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.ca/
uInternet Settings,ProxyOverride = *.local
.
- - - - ORPHANS REMOVED - - - -
.
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-16 16:11
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ... 
.
scanning hidden autostart entries ... 
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(1524)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.5592_x-ww_179798c8\MSVCR80.dll
.
Completion time: 2011-05-16 16:14:52
ComboFix-quarantined-files.txt 2011-05-16 20:14
ComboFix2.txt 2011-04-30 14:17
ComboFix3.txt 2010-12-07 01:14
ComboFix4.txt 2010-03-31 00:24
.
Pre-Run: 16,016,953,344 bytes free
Post-Run: 16,483,430,400 bytes free
.
- - End Of File - - 54FCC2D0D8C1BE73D8F3844A0AEC909D

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 4:40:44 PM, on 5/16/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Sunbelt Software\VIPRE\SBPIMSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe
C:\Program Files\HiYo\bin\HiYo.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\IncrediMail\Bin\ImApp.exe
C:\PROGRA~1\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\IncrediMail\Bin\IncMail.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HiJackThis.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SBAMTray] "C:\Program Files\Sunbelt Software\VIPRE\SBAMTray.exe"
O4 - HKLM\..\Run: [Monitor] "C:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Hiyo] "C:\Program Files\HiYo\bin\HiYo.exe" /RunFromStartup
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [IncrediMail] "C:\Program Files\IncrediMail\bin\IncMail.exe" /c
O4 - HKCU\..\Run: [cdloader] "C:\Documents and Settings\Kickrz\Application Data\mjusbsp\cdloader2.exe" MAGICJACK
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\PROGRA~1\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1265376705171
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1273110928250
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos-beta/OnlineScanner.cab
O16 - DPF: {BEA7310D-06C4-4339-A784-DC3804819809} (Photo Upload Plugin Class) - http://www.walmartphotocentre.ca/upload/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab
O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LeapFrog Connect Device Service - LeapFrog Enterprises, Inc. - C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: VIPRE Antivirus (SBAMSvc) - Sunbelt Software - C:\Program Files\Sunbelt Software\VIPRE\SBAMSvc.exe
O23 - Service: SB Recovery Service (SBPIMSvc) - Sunbelt Software - C:\Program Files\Sunbelt Software\VIPRE\SBPIMSvc.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--
End of file - 6903 bytes


----------



## Cookiegal (Aug 27, 2003)

Please go to *VirusTotal* and upload the following file for scanning.

Click *Browse*
Copy and paste the contents of the following code box into the text box next to *File name:* then click *Open* 

```
c:\program files\mp3DC211.exe
```

Click *Send File*
If confronted with two options, choose *Reanalyse file now*
Wait for the scan to finish and then copy and paste the URL from your browser address bar in your next reply please.


----------



## kickrz (Jul 30, 2003)

http://www.virustotal.com/file-scan...174808c25abf039c8b00a6cb48e71d6218-1305663334


----------



## Cookiegal (Aug 27, 2003)

How are things behaving now?


----------



## kickrz (Jul 30, 2003)

Seems to be ok. I did get an error while restarting that said could not terminate dwwin.exe but tried to capture a screen shot but couldn't open anything as it was shutting down.

Should I be wiping the restore points and create a fresh one now?


----------



## Cookiegal (Aug 27, 2003)

Please go to *Start *- *Run *- type in *eventvwr.msc* to open the event viewer. Look under both "Application" and "System" for recent (the last 48 hours or so) errors (shown in red) and if found, do this for each one.

Double-click the error to open it up and then click on the icon that looks like two pieces of paper. This will copy the full error. Then "paste" the error into Notepad. Do this for each one until you have them all listed in Notepad and then copy and paste the list in a reply here please.


----------



## kickrz (Jul 30, 2003)

Event Type:	Error
Event Source:	Bonjour Service
Event Category:	None
Event ID:	100
Date: 5/19/2011
Time: 4:44:58 AM
User: N/A
Computer:	BRIAN-Y0IEJ0KFN
Description:
DNS Message from Â«ZERO ADDRESSÂ»:0 to Â«ZERO ADDRESSÂ»:0 length 0 too short

Event Type:	Error
Event Source:	Application Hang
Event Category:	(101)
Event ID:	1002
Date: 5/18/2011
Time: 1:11:30 AM
User: N/A
Computer:	BRIAN-Y0IEJ0KFN
Description:
Hanging application soffice.bin, version 3.3.9556.500, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 73 6f 66 66 69 63 soffic
0018: 65 2e 62 69 6e 20 33 2e e.bin 3.
0020: 33 2e 39 35 35 36 2e 35 3.9556.5
0028: 30 30 20 69 6e 20 68 75 00 in hu
0030: 6e 67 61 70 70 20 30 2e ngapp 0.
0038: 30 2e 30 2e 30 20 61 74 0.0.0 at
0040: 20 6f 66 66 73 65 74 20 offset

Event Type:	Error
Event Source:	Cdrom
Event Category:	None
Event ID:	11
Date: 5/20/2011
Time: 9:18:38 PM
User: N/A
Computer:	BRIAN-Y0IEJ0KFN
Description:
The driver detected a controller error on \Device\CdRom0.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 68 00 01 00 b8 00 ..h...¸.
0008: 00 00 00 00 0b 00 04 c0 .......À
0010: 01 01 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
0028: 1c 2d 2f 00 00 00 00 00 .-/.....
0030: ff ff ff ff 02 00 00 00 ÿÿÿÿ....
0038: 40 00 00 c4 02 00 00 00 @..Ä....
0040: 00 00 06 12 08 00 00 00 ........
0048: 00 00 00 00 14 00 00 00 ........
0050: 00 00 00 00 30 a6 fd 86 ....0¦ý
0058: 00 00 00 00 80 fc 4a 86 ....üJ
0060: 01 00 00 00 00 00 00 00 ........
0068: 00 00 00 00 00 00 00 00 ........
0070: 00 00 00 00 00 00 00 00 ........
0078: 70 00 04 00 00 00 00 0a p.......
0080: 00 00 08 83 40 00 00 00 ...@...
0088: 00 00 00 00 00 00 00 00 ........

Event Type:	Error
Event Source:	Cdrom
Event Category:	None
Event ID:	11
Date: 5/20/2011
Time: 9:18:38 PM
User: N/A
Computer:	BRIAN-Y0IEJ0KFN
Description:
The driver detected a controller error on \Device\CdRom0.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 68 00 01 00 b8 00 ..h...¸.
0008: 00 00 00 00 0b 00 04 c0 .......À
0010: 01 01 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
0028: 12 2d 2f 00 00 00 00 00 .-/.....
0030: ff ff ff ff 02 00 00 00 ÿÿÿÿ....
0038: 40 00 00 c4 02 00 00 00 @..Ä....
0040: 00 00 06 12 08 00 00 00 ........
0048: 00 00 00 00 14 00 00 00 ........
0050: 00 00 00 00 e0 f0 c8 86 ....àðÈ
0058: 00 00 00 00 50 c0 dd 86 ....PÀÝ
0060: 01 00 00 00 00 00 00 00 ........
0068: 00 00 00 00 00 00 00 00 ........
0070: 00 00 00 00 00 00 00 00 ........
0078: 70 00 04 00 00 00 00 0a p.......
0080: 00 00 08 83 40 00 00 00 ...@...
0088: 00 00 00 00 00 00 00 00 ........

Event Type:	Error
Event Source:	Cdrom
Event Category:	None
Event ID:	11
Date: 5/20/2011
Time: 1:29:51 PM
User: N/A
Computer:	BRIAN-Y0IEJ0KFN
Description:
The driver detected a controller error on \Device\CdRom0.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 68 00 01 00 b8 00 ..h...¸.
0008: 00 00 00 00 0b 00 04 c0 .......À
0010: 01 01 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
0028: 2f b5 13 00 00 00 00 00 /µ......
0030: ff ff ff ff 02 00 00 00 ÿÿÿÿ....
0038: 40 00 00 c4 02 00 00 00 @..Ä....
0040: 00 00 06 12 08 00 00 00 ........
0048: 00 00 00 00 14 00 00 00 ........
0050: 00 00 00 00 58 4f de 86 ....XOÞ
0058: 00 00 00 00 50 35 31 86 ....P51
0060: 01 00 00 00 00 00 00 00 ........
0068: 00 00 00 00 00 00 00 00 ........
0070: 00 00 00 00 00 00 00 00 ........
0078: 70 00 04 00 00 00 00 0a p.......
0080: 00 00 08 83 40 00 00 00 ...@...
0088: 00 00 00 00 00 00 00 00 ........

Event Type:	Error
Event Source:	Cdrom
Event Category:	None
Event ID:	11
Date: 5/20/2011
Time: 7:57:02 AM
User: N/A
Computer:	BRIAN-Y0IEJ0KFN
Description:
The driver detected a controller error on \Device\CdRom0.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 68 00 01 00 b8 00 ..h...¸.
0008: 00 00 00 00 0b 00 04 c0 .......À
0010: 01 01 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
0028: f6 34 00 00 00 00 00 00 ö4......
0030: ff ff ff ff 02 00 00 00 ÿÿÿÿ....
0038: 40 00 00 c4 02 00 00 00 @..Ä....
0040: 00 00 06 12 08 00 00 00 ........
0048: 00 00 00 00 14 00 00 00 ........
0050: 00 00 00 00 90 5a 45 86 ....ZE
0058: 00 00 00 00 c0 fb ee 86 ....Àûî
0060: 01 00 00 00 00 00 00 00 ........
0068: 00 00 00 00 00 00 00 00 ........
0070: 00 00 00 00 00 00 00 00 ........
0078: 70 00 04 00 00 00 00 0a p.......
0080: 00 00 08 83 40 00 00 00 ...@...
0088: 00 00 00 00 00 00 00 00 ........

0048: 30 30 30 30 30 30 30 30 00000000

There seem to be a bunch all relating to the CDROM.


----------



## Cookiegal (Aug 27, 2003)

Are you having any problems with your CD drive?

Please download aswMBR.exe and save it to your desktop.

Double click aswMBR.exe to start the tool. (Vista/Windows 7 users - right click to run as administrator)

Click *Scan.*

Upon completion of the scan, click *Save log* then save it to your desktop and post that log in your next reply for review. 
*Note - do NOT attempt any Fix yet. *


----------



## kickrz (Jul 30, 2003)

Ya my CD drive doesn't work. The disc doesn't spin up, it isn't a new problem just one we haven't gotten around to fixing.

aswMBR version 0.9.5.256 Copyright(c) 2011 AVAST Software
Run date: 2011-05-21 17:27:57
-----------------------------
17:27:57.140 OS Version: Windows 5.1.2600 Service Pack 3
17:27:57.140 Number of processors: 2 586 0x209
17:27:57.140 ComputerName: BRIAN-Y0IEJ0KFN UserName: Kickrz
17:27:58.390 Initialize success
17:28:01.359 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
17:28:01.359 Disk 0 Vendor: WDC_WD800VE-00KWT0 01.03K01 Size: 76319MB BusType: 3
17:28:03.406 Disk 0 MBR read successfully
17:28:03.406 Disk 0 MBR scan
17:28:03.406 Disk 0 Windows XP default MBR code
17:28:05.468 Disk 0 scanning sectors +156280320
17:28:05.515 Disk 0 scanning C:\WINDOWS\system32\drivers
17:28:22.781 Service scanning
17:28:23.843 Disk 0 trace - called modules:
17:28:23.859 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS 
17:28:23.859 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86f4aab8]
17:28:23.859 3 CLASSPNP.SYS[f76c1fd7] -> nt!IofCallDriver -> \Device\00000074[0x86f4e9e8]
17:28:23.859 5 ACPI.sys[f7618620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x86f5b940]
17:28:23.859 Scan finished successfully
17:28:33.593 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Kickrz\Desktop\MBR.dat"
17:28:33.593 The log file has been saved successfully to "C:\Documents and Settings\Kickrz\Desktop\aswMBR2.txt"


----------



## Cookiegal (Aug 27, 2003)

I don't know what to make of the first error message regarding the Bonjour Service. Are you having problems with that?

The MBR looks fine.


----------



## kickrz (Jul 30, 2003)

No I am not really having any other issues. I thought we were good to go after the first round but when I went to remove combofix and do the sys restore stuff it was acting up. I never expected for it to loop or for me to not get back on again.

I am not exactly sure what Bonjour Service is.... off to google now.

Ok I googled it and I don't really need it ....I found this to remove it...http://www.raymond.cc/blog/archives/2008/02/10/how-to-uninstall-or-remove-bonjour-mdnsresponderexe/

Can I go ahead with that?


----------



## Cookiegal (Aug 27, 2003)

If you uninstall it that may affect iTunes and QuickTime. Do you use those?


----------



## kickrz (Jul 30, 2003)

I have read that it only affects sharing or something like that. I am not super concerned. I could always reinstall if I find issues.

I did get another weird error that said "Windows security 2011 has found critical process activity on your PC and will perform fast scan of system files"

Then it opens what looks like my computer and appears to be scanning. What is that now? Legit or not?


----------



## Cookiegal (Aug 27, 2003)

No, it's rogue. Please post a new HijackThis log.


----------



## kickrz (Jul 30, 2003)

Oh good lord...more stuff..All I was looking at was pool decks 

Is my antivirus just crap or what?

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 4:50:35 PM, on 5/22/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe
C:\Program Files\HiYo\bin\HiYo.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Sunbelt Software\VIPRE\SBAMTray.exe
C:\Program Files\IncrediMail\bin\IncMail.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IncrediMail\Bin\ImApp.exe
C:\PROGRA~1\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Sunbelt Software\VIPRE\SBAMSvc.exe
C:\Program Files\Sunbelt Software\VIPRE\SBPIMSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Monitor] "C:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Hiyo] "C:\Program Files\HiYo\bin\HiYo.exe" /RunFromStartup
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [SBAMTray] "C:\Program Files\Sunbelt Software\VIPRE\SBAMTray.exe"
O4 - HKCU\..\Run: [IncrediMail] "C:\Program Files\IncrediMail\bin\IncMail.exe" /c
O4 - HKCU\..\Run: [cdloader] "C:\Documents and Settings\Kickrz\Application Data\mjusbsp\cdloader2.exe" MAGICJACK
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\PROGRA~1\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'c:\program files\bonjour\mdnsnsp.dll' missing
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1265376705171
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1273110928250
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos-beta/OnlineScanner.cab
O16 - DPF: {BEA7310D-06C4-4339-A784-DC3804819809} (Photo Upload Plugin Class) - http://www.walmartphotocentre.ca/upload/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab
O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Unknown owner - C:\Program Files\Bonjour\mDNSResponder.exe (file missing)
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LeapFrog Connect Device Service - LeapFrog Enterprises, Inc. - C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: VIPRE Antivirus (SBAMSvc) - Sunbelt Software - C:\Program Files\Sunbelt Software\VIPRE\SBAMSvc.exe
O23 - Service: SB Recovery Service (SBPIMSvc) - Sunbelt Software - C:\Program Files\Sunbelt Software\VIPRE\SBPIMSvc.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--
End of file - 7131 bytes


----------



## Cookiegal (Aug 27, 2003)

Are you getting redirected?

Please download DDS by sUBs to your desktop from one of the following locations:

http://www.techsupportforum.com/sectools/sUBs/dds
http://download.bleepingcomputer.com/sUBs/dds.scr
http://www.forospyware.com/sUBs/dds

Disable any script blocker you may have as they may interfere and then double-click the DDS.scr to run the tool.

When DDS has finished scanning, it will open two logs named as follows:

DDS.txt
Attach.txt

Save them both to your desktop. Copy and paste the contents of the DDS.txt and Attach.txt files in your reply please.


----------



## kickrz (Jul 30, 2003)

No not getting redirected at all...not really having any issues at the moment.

.
DDS (Ver_11-05-19.01) - NTFSx86 
Internet Explorer: 8.0.6001.18702
Run by Kickrz at 21:16:10 on 2011-05-22
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.491 [GMT -4:00]
.
AV: Sunbelt VIPRE *Enabled/Updated* {964FCE60-0B18-4D30-ADD6-EB178909041C}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe
C:\Program Files\HiYo\bin\HiYo.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Sunbelt Software\VIPRE\SBAMTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IncrediMail\Bin\ImApp.exe
C:\PROGRA~1\Yahoo!\Messenger\YahooMessenger.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Sunbelt Software\VIPRE\SBAMSvc.exe
C:\Program Files\Sunbelt Software\VIPRE\SBPIMSvc.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\IncrediMail\Bin\IncMail.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\Kickrz\Desktop\New Issues\dds.scr
C:\WINDOWS\system32\WSCRIPT.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.ca/
uInternet Settings,ProxyOverride = *.local
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
TB: {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No File
TB: {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [IncrediMail] "c:\program files\incredimail\bin\IncMail.exe" /c
uRun: [cdloader] "c:\documents and settings\kickrz\application data\mjusbsp\cdloader2.exe" MAGICJACK
uRun: [Messenger (Yahoo!)] "c:\progra~1\yahoo!\messenger\YahooMessenger.exe" -quiet
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [NvCplDaemon] "RUNDLL32.EXE" c:\windows\system32\NvCpl.dll,NvStartup
mRun: [Monitor] "c:\program files\leapfrog\leapfrog connect\Monitor.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [Hiyo] "c:\program files\hiyo\bin\HiYo.exe" /RunFromStartup
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [SBAMTray] "c:\program files\sunbelt software\vipre\SBAMTray.exe"
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/templates/ieawsdc.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1265376705171
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1273110928250
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos-beta/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {BEA7310D-06C4-4339-A784-DC3804819809} - hxxp://www.walmartphotocentre.ca/upload/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab
DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} - hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab
DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} - hxxp://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
.
============= SERVICES / DRIVERS ===============
.
R1 sbaphd;sbaphd;c:\windows\system32\drivers\sbaphd.sys [2010-12-23 21592]
R1 SBRE;SBRE;c:\windows\system32\drivers\SBREDrv.sys [2011-4-29 101720]
R1 SbTis;SbTis;c:\windows\system32\drivers\sbtis.sys [2010-12-23 212568]
R2 SBAMSvc;VIPRE Antivirus;c:\program files\sunbelt software\vipre\SBAMSvc.exe [2011-5-11 2804280]
R2 sbapifs;sbapifs;c:\windows\system32\drivers\sbapifs.sys [2010-12-23 74968]
R2 SBPIMSvc;SB Recovery Service;c:\program files\sunbelt software\vipre\SBPIMSvc.exe [2011-5-11 181584]
R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.12.2;c:\windows\system32\drivers\libusb0.sys [2010-3-20 28160]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-7-31 136176]
S3 FlyUsb;FLY Fusion;c:\windows\system32\drivers\FlyUsb.sys [2010-4-17 18560]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-7-31 136176]
S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys --> c:\windows\system32\drivers\massfilter.sys [?]
.
=============== Created Last 30 ================
.
2011-05-16 11:50:26	--------	d-----w-	c:\windows\system32\wbem\repository\FS
2011-05-16 11:50:26	--------	d-----w-	c:\windows\system32\wbem\Repository
2011-05-13 02:46:35	73728	----a-w-	c:\windows\system32\javacpl.cpl
2011-05-12 05:59:51	--------	d-----w-	c:\documents and settings\kickrz\application data\OpenOffice.org
2011-05-12 05:47:42	--------	d-----w-	c:\program files\OpenOffice.org 3
2011-05-12 02:10:36	--------	d-----w-	c:\documents and settings\kickrz\local settings\application data\WinZip
2011-05-12 02:01:03	--------	d-----w-	c:\documents and settings\all users\application data\WinZipSE
2011-05-12 02:01:01	--------	d-----w-	c:\program files\WinZip Self-Extractor
2011-05-11 20:55:16	42832	----a-w-	c:\windows\system32\sbbd.exe
2011-05-06 03:26:02	--------	d-----w-	c:\documents and settings\kickrz\local settings\application data\Webroot
2011-05-06 03:02:56	--------	d-----w-	c:\documents and settings\kickrz\local settings\application data\PackageAware
2011-05-01 00:26:03	--------	d-----w-	c:\program files\ESET
2011-04-30 14:19:33	388096	----a-r-	c:\documents and settings\kickrz\application data\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
2011-04-30 12:10:22	--------	d-----w-	c:\program files\MSSOAP
2011-04-30 12:09:55	--------	d-----w-	c:\program files\Webroot
2011-04-30 05:07:35	--------	d-----w-	c:\documents and settings\kickrz\application data\FreeFileOpener
2011-04-30 05:01:57	--------	d-----w-	c:\documents and settings\kickrz\local settings\application data\Deployment
2011-04-30 04:00:02	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2011-04-30 03:58:45	--------	d-----w-	c:\windows\7E7D778E121D4BBDBA29FAA81B9FBD8C.TMP
2011-04-30 03:58:44	--------	d-----w-	c:\windows\BB77DC4CB8184FD48D1D5D3B617B78B4.TMP
2011-04-30 03:58:44	--------	d-----w-	c:\windows\8A83AE5FF59B4E1FBF2A49185A42ED1B.TMP
2011-04-30 03:58:43	--------	d-----w-	c:\windows\CC33E708A7954AB3908A8F45919BC097.TMP
2011-04-30 03:58:42	--------	d--h--w-	c:\windows\msdownld.tmp
2011-04-29 18:15:42	101720	----a-w-	c:\windows\system32\drivers\SBREDrv.sys
2011-04-29 12:28:32	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware(2)
2011-04-27 20:49:40	--------	d-----w-	C:\35c48c3876ce67c68d3718b079b6
.
==================== Find3M ====================
.
2011-05-13 02:46:01	472808	----a-w-	c:\windows\system32\deployJava1.dll
2011-05-11 20:26:04	74968	----a-w-	c:\windows\system32\drivers\sbapifs.sys
2011-05-11 20:26:04	21592	----a-w-	c:\windows\system32\drivers\sbaphd.sys
2011-04-05 21:35:20	212568	----a-w-	c:\windows\system32\drivers\sbtis.sys
2011-03-09 23:10:37	102400	----a-w-	c:\windows\RegBootClean.exe
2011-03-07 05:33:50	692736	----a-w-	c:\windows\system32\inetcomm.dll
2011-03-04 06:37:06	420864	----a-w-	c:\windows\system32\vbscript.dll
2011-03-03 13:21:11	1857920	----a-w-	c:\windows\system32\win32k.sys
2011-02-22 23:06:29	916480	----a-w-	c:\windows\system32\wininet.dll
2011-02-22 23:06:29	43520	----a-w-	c:\windows\system32\licmgr10.dll
2011-02-22 23:06:29	1469440	------w-	c:\windows\system32\inetcpl.cpl
2011-02-22 11:41:59	385024	----a-w-	c:\windows\system32\html.iec
2010-05-11 18:23:56	1699840	----a-w-	c:\program files\FreeSCAN-0.9K.msi
2010-05-02 04:58:42	212713	----a-w-	c:\program files\mp3DC211.exe
2010-05-01 01:32:10	661552	----a-w-	c:\program files\SpywareTerminatorSetup.exe
2010-05-01 00:48:45	1156877	----a-w-	c:\program files\WhatsRunning2_2_Setup.exe
2010-04-13 16:14:27	1909248	----a-w-	c:\program files\spreadsheetJune2009.msi
2010-03-30 23:46:59	5918720	----a-w-	c:\program files\mbam-setup-1.45.exe
2010-03-23 01:16:37	22649132	----a-w-	c:\program files\VideoThangTM_Installer_2.1.0.exe
2010-03-18 03:33:58	708658	----a-w-	c:\program files\ypops-win-0.9.7.3.exe
2010-02-06 00:07:12	9918872	----a-w-	c:\program files\WMEncoder.exe
2010-02-05 18:26:24	16205198	----a-w-	c:\program files\PhotoScapeSetup_V3.4.exe
2010-02-05 18:22:54	10798000	----a-w-	c:\program files\winamp5572_full_bundle_emusic-7plus_en-us.exe
2010-02-05 18:15:30	98180904	----a-w-	c:\program files\iTunesSetup.exe
2006-05-03 10:06:54	163328	--sh--r-	c:\windows\system32\flvDX.dll
2007-02-21 11:47:16	31232	--sh--r-	c:\windows\system32\msfDX.dll
2007-12-17 13:43:00	27648	--sh--w-	c:\windows\system32\Smab0.dll
2008-02-04 19:26:34	151040	--sh--w-	c:\windows\system32\VistaUltm.dll
.
============= FINISH: 21:17:48.34 ===============


----------



## Cookiegal (Aug 27, 2003)

Please copy and paste the Attach.txt file in a post.

Also, please go to *VirusTotal* and upload the following file for scanning.

Click *Browse*
Copy and paste the contents of the following code box into the text box next to *File name:* then click *Open* 

```
c:\program files\PhotoScapeSetup_V3.4.exe
```

Click *Send File*
If confronted with two options, choose *Reanalyse file now*
Wait for the scan to finish and then copy and paste the URL from your browser address bar in your next reply please.

Then do the same for this file as well:

c:\program files\winamp5572_full_bundle_emusic-7plus_en-us.exe

Please post both of those results and a new HijackThis log.


----------



## kickrz (Jul 30, 2003)

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_11-05-19.01)
.
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 2/4/2010 7:46:23 PM
System Uptime: 5/22/2011 4:41:45 PM (5 hours ago)
.
Motherboard: TOSHIBA | | DBQ02
Processor: Intel(R) Pentium(R) 4 CPU 3.40GHz | NWD | 3391/mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 75 GiB total, 14.979 GiB free.
D: is CDROM ()
E: is Removable
F: is CDROM (CDFS)
G: is Removable
.
==== Disabled Device Manager Items =============
.
Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: 
Device ID: ACPI\CMP0101\2&DABA3FF&0
Manufacturer: 
Name: 
PNP Device ID: ACPI\CMP0101\2&DABA3FF&0
Service: 
.
==== System Restore Points ===================
.
RP409: 2/22/2011 2:24:35 AM - System Checkpoint
RP410: 2/23/2011 3:24:27 AM - System Checkpoint
RP411: 2/24/2011 4:24:28 AM - System Checkpoint
RP412: 2/25/2011 5:24:27 AM - System Checkpoint
RP413: 2/26/2011 6:16:13 AM - System Checkpoint
RP414: 2/27/2011 9:03:26 AM - System Checkpoint
RP415: 2/28/2011 12:26:58 PM - System Checkpoint
RP416: 3/1/2011 2:58:16 PM - System Checkpoint
RP417: 3/2/2011 3:09:22 PM - System Checkpoint
RP418: 3/3/2011 3:56:08 PM - System Checkpoint
RP419: 3/4/2011 4:09:24 PM - System Checkpoint
RP420: 3/5/2011 4:56:44 PM - System Checkpoint
RP421: 3/6/2011 5:09:29 PM - System Checkpoint
RP422: 3/7/2011 5:12:15 PM - System Checkpoint
RP423: 3/8/2011 3:00:29 AM - Software Distribution Service 3.0
RP424: 3/9/2011 3:52:42 AM - System Checkpoint
RP425: 3/10/2011 3:00:36 AM - Software Distribution Service 3.0
RP426: 3/11/2011 3:34:47 AM - System Checkpoint
RP427: 3/12/2011 4:34:47 AM - System Checkpoint
RP428: 3/13/2011 6:34:46 AM - System Checkpoint
RP429: 3/14/2011 7:34:48 AM - System Checkpoint
RP430: 3/15/2011 8:30:28 AM - System Checkpoint
RP431: 3/16/2011 3:00:41 AM - Software Distribution Service 3.0
RP432: 3/17/2011 3:23:51 AM - System Checkpoint
RP433: 3/18/2011 4:35:52 AM - System Checkpoint
RP434: 3/19/2011 5:23:53 AM - System Checkpoint
RP435: 3/20/2011 6:23:55 AM - System Checkpoint
RP436: 3/21/2011 7:38:31 AM - System Checkpoint
RP437: 3/22/2011 8:06:54 AM - System Checkpoint
RP438: 3/23/2011 8:31:51 AM - System Checkpoint
RP439: 3/24/2011 3:00:41 AM - Software Distribution Service 3.0
RP440: 3/25/2011 3:23:19 AM - System Checkpoint
RP441: 3/26/2011 1:01:25 PM - System Checkpoint
RP442: 3/27/2011 1:34:19 PM - System Checkpoint
RP443: 3/28/2011 2:12:37 PM - System Checkpoint
RP444: 3/29/2011 3:12:38 PM - System Checkpoint
RP445: 3/30/2011 4:13:06 PM - System Checkpoint
RP446: 3/31/2011 5:30:11 PM - System Checkpoint
RP447: 4/1/2011 5:51:56 PM - System Checkpoint
RP448: 4/2/2011 8:58:29 PM - System Checkpoint
RP449: 4/3/2011 11:14:40 PM - System Checkpoint
RP450: 4/4/2011 11:25:51 PM - System Checkpoint
RP451: 4/6/2011 12:15:13 AM - System Checkpoint
RP452: 4/7/2011 12:51:57 AM - System Checkpoint
RP453: 4/8/2011 1:52:22 AM - System Checkpoint
RP454: 4/9/2011 2:52:23 AM - System Checkpoint
RP455: 4/10/2011 2:55:32 AM - System Checkpoint
RP456: 4/11/2011 3:55:42 AM - System Checkpoint
RP457: 4/12/2011 4:55:22 AM - System Checkpoint
RP458: 4/13/2011 5:55:20 AM - System Checkpoint
RP459: 4/14/2011 6:55:22 AM - System Checkpoint
RP460: 4/15/2011 3:00:45 AM - Software Distribution Service 3.0
RP461: 4/16/2011 3:49:39 AM - System Checkpoint
RP462: 4/17/2011 3:58:25 AM - System Checkpoint
RP463: 4/18/2011 4:58:23 AM - System Checkpoint
RP464: 4/19/2011 5:58:24 AM - System Checkpoint
RP465: 4/20/2011 6:59:28 AM - System Checkpoint
RP466: 4/21/2011 3:00:41 AM - Software Distribution Service 3.0
RP467: 4/22/2011 3:03:14 AM - System Checkpoint
RP468: 4/23/2011 4:03:22 AM - System Checkpoint
RP469: 4/24/2011 3:00:31 AM - Software Distribution Service 3.0
RP470: 4/25/2011 3:01:18 AM - System Checkpoint
RP471: 4/25/2011 11:53:53 PM - Restore Operation
RP472: 4/26/2011 3:00:44 AM - Software Distribution Service 3.0
RP473: 4/26/2011 3:43:55 PM - Restore Operation
RP474: 4/26/2011 4:48:34 PM - Software Distribution Service 3.0
RP475: 4/26/2011 9:36:00 PM - Restore Operation
RP476: 4/27/2011 4:47:34 PM - Software Distribution Service 3.0
RP477: 4/29/2011 6:42:08 AM - Software Distribution Service 3.0
RP478: 4/29/2011 11:45:27 PM - Software Distribution Service 3.0
RP479: 4/29/2011 11:57:38 PM - Restore Operation
RP480: 4/30/2011 3:00:16 AM - Software Distribution Service 3.0
RP481: 4/30/2011 10:19:31 AM - Installed HiJackThis
RP482: 5/1/2011 3:00:36 AM - Software Distribution Service 3.0
RP483: 5/2/2011 3:14:14 AM - System Checkpoint
RP484: 5/3/2011 4:15:26 AM - System Checkpoint
RP485: 5/4/2011 5:14:25 AM - System Checkpoint
RP486: 5/5/2011 5:22:40 AM - System Checkpoint
RP487: 5/6/2011 5:23:34 AM - System Checkpoint
RP488: 5/7/2011 6:40:44 AM - System Checkpoint
RP489: 5/8/2011 7:23:05 AM - System Checkpoint
RP490: 5/9/2011 8:46:50 AM - System Checkpoint
RP491: 5/10/2011 9:49:26 AM - System Checkpoint
RP492: 5/11/2011 10:24:12 AM - System Checkpoint
RP493: 5/11/2011 10:09:39 PM - Removed WinZip 15.0
RP494: 5/11/2011 10:10:00 PM - Installed WinZip 15.5
RP495: 5/12/2011 12:42:29 AM - Software Distribution Service 3.0
RP496: 5/12/2011 1:43:18 AM - Removed Java(TM) 6 Update 20
RP497: 5/12/2011 1:45:08 AM - Installed Java(TM) 6 Update 22
RP498: 5/12/2011 1:47:34 AM - Installed OpenOffice.org 3.3
RP499: 5/12/2011 10:35:02 PM - Removed Ask Toolbar.
RP500: 5/12/2011 10:37:11 PM - Removed Java(TM) 6 Update 22
RP501: 5/12/2011 10:45:26 PM - Installed Java(TM) 6 Update 25
RP502: 5/14/2011 3:35:25 AM - System Checkpoint
RP503: 5/15/2011 1:43:14 AM - Restore Operation
RP504: 5/16/2011 7:48:34 AM - Restore Operation
RP505: 5/17/2011 10:03:41 AM - System Checkpoint
RP506: 5/18/2011 10:11:51 AM - System Checkpoint
RP507: 5/19/2011 10:31:53 AM - System Checkpoint
RP508: 5/20/2011 6:16:22 AM - Removed VIPRE Antivirus.
RP509: 5/20/2011 6:17:04 AM - Installed VIPRE Antivirus.
RP510: 5/21/2011 6:58:41 AM - System Checkpoint
RP511: 5/22/2011 7:58:42 AM - System Checkpoint
.
==== Installed Programs ======================
.
7-Zip 4.65
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.4.4
Apple Application Support
Apple Mobile Device Support
Apple Software Update
AsfTools 3.1 (remove only)
Audacity 1.2.6
Auto Photo Organizer v2.2 build 569
AviSynth 2.5
BitTorrent
Bonjour
Chainz 2 - Relinked
CopyTrans Suite Remove Only
Coupon Printer for Windows
DesignPro 5
DiskAid 3.11
DVD Flick 1.3.0.7
ESET Online Scanner v3
FitDay PC version 2.0
Foxit PDF Editor
Free File Opener v2011.6.0.4
Garmin Communicator Plugin
Garmin USB Drivers
Garmin WebUpdater
GIMP 2.6.8
Google Chrome
Google Earth
Google Update Helper
HiJackThis
HijackThis 2.0.2
Hitman Pro 3.5
HiYo
HiYo 
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows XP (KB2158563)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
ImgBurn
IncrediMail
IncrediMail 2.0
iTunes
Java Auto Updater
Java(TM) 6 Update 25
JDownloader
K-Lite Codec Pack 3.2.5 Standard
LeapFrog Connect
LeapFrog My Pals Plugin
LeapFrog MyOwnLeaptop Plugin
LeapFrog Tag Plugin
LibUSB-Win32-0.1.12.2
magicJack
Malwarebytes' Anti-Malware
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable - KB2467175
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
MP4 Player 
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 and SOAP Toolkit 3.0
NVIDIA Display Driver
OpenOffice.org 3.3
PC Updater
Photo Notifier and Animation Creator
Photo Story 3 for Windows
PhotoMail Maker
PhotoScape
QuickTime
Realtek AC'97 Audio
Safari
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB2360131)
Security Update for Windows Internet Explorer 8 (KB2416400)
Security Update for Windows Internet Explorer 8 (KB2482017)
Security Update for Windows Internet Explorer 8 (KB2497640)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Encoder (KB2447961)
Security Update for Windows Media Encoder (KB954156)
Security Update for Windows Media Encoder (KB979332)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player (KB979402)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2503658)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2506223)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2511455)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981957)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
Spreadsheet
StudioTax 2009
StudioTax 2010
TOSHIBA Software Modem
Ulead Photo Express 6
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB978506)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Update for Windows XP (KB978207)
Use the entry named LeapFrog Connect to uninstall (LeapFrog My Pals Plugin)
Use the entry named LeapFrog Connect to uninstall (LeapFrog MyOwnLeaptop Plugin)
Use the entry named LeapFrog Connect to uninstall (LeapFrog Tag Plugin)
VideoThang 2.1.0
VIPRE Antivirus
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
WeatherEye
WebFldrs XP
What's Running 2.2
Windows Driver Package - Garmin (grmnusb) GARMIN Devices (03/08/2007 2.2.1.0)
Windows Driver Package - LeapFrog (FlyUsb) USB (11/05/2008 1.1.1.0)
Windows Driver Package - Leapfrog (Leapfrog-USBLAN) Net (09/10/2009 02.03.05.012)
Windows Feature Pack for Storage (32-bit) - IMAPI update for Blu-Ray
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 8
Windows Media Encoder 9 Series
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player Firefox Plugin
Windows Movie Maker 2.0
Windows XP Service Pack 3
WinSCP 4.2.1 beta
WinZip 15.5
WinZip Self-Extractor
Wondershare Flash Gallery Factory Deluxe 5.0.4
Wondershare Video to Flash Encoder(Build 4.0.2.0)
Yahoo! Messenger
Yahoo! Software Update
YPOPs! 0.9.7.3
.
==== Event Viewer Messages From Past Week ========
.
5/22/2011 4:48:55 PM, error: Service Control Manager [7034] - The Bonjour Service service terminated unexpectedly. It has done this 1 time(s).
5/16/2011 8:31:31 PM, error: Dhcp [1002] - The IP address lease 192.168.1.17 for the Network Card with network address 00023FD309D4 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
5/16/2011 7:44:12 AM, error: Cdrom [11] - The driver detected a controller error on \Device\CdRom0.
5/16/2011 6:12:42 AM, error: Service Control Manager [7022] - The Windows Image Acquisition (WIA) service hung on starting.
5/16/2011 6:11:11 AM, error: Service Control Manager [7000] - The Parallel port driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
5/16/2011 6:08:50 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
5/15/2011 9:56:54 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}
5/15/2011 9:54:35 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
5/15/2011 11:57:46 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss sbaphd SbTis Tcpip
5/15/2011 11:57:46 AM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD Networking Support Environment service which failed to start because of the following error: A device attached to the system is not functioning.
5/15/2011 11:57:46 AM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
5/15/2011 11:57:46 AM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
5/15/2011 11:57:46 AM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
5/15/2011 11:57:46 AM, error: Service Control Manager [7001] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
5/15/2011 11:57:46 AM, error: Service Control Manager [7001] - The Apple Mobile Device service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
5/15/2011 10:03:18 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
5/15/2011 1:26:42 AM, error: Service Control Manager [7034] - The VIPRE Antivirus service terminated unexpectedly. It has done this 1 time(s).
.
==== End Of File ===========================

http://www.virustotal.com/file-scan...129ed3ccf92fa7316934fc38897fbf6070-1306204317

http://www.virustotal.com/file-scan...71d6d9d2019e1a8e4782d14f47e6c865ae-1306203964

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:45:53 PM, on 5/23/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe
C:\Program Files\HiYo\bin\HiYo.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Sunbelt Software\VIPRE\SBAMTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IncrediMail\Bin\ImApp.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Sunbelt Software\VIPRE\SBAMSvc.exe
C:\Program Files\Sunbelt Software\VIPRE\SBPIMSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\IncrediMail\Bin\IncMail.exe
C:\Documents and Settings\Kickrz\Application Data\mjusbsp\magicJack.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HiJackThis.exe
C:\WINDOWS\system32\taskmgr.exe

O23 - Service: VIPRE Antivirus (SBAMSvc) - Sunbelt Software - C:\Program Files\Sunbelt Software\VIPRE\SBAMSvc.exe
O23 - Service: SB Recovery Service (SBPIMSvc) - Sunbelt Software - C:\Program Files\Sunbelt Software\VIPRE\SBPIMSvc.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--
End of file - 2011 bytes


----------



## Cookiegal (Aug 27, 2003)

Where did you download PhotoScape from?


----------



## kickrz (Jul 30, 2003)

I have no clue. I have had it for over a year, maybe 2!


----------



## Cookiegal (Aug 27, 2003)

Please delete this file:

c:\program files\PhotoScapeSetup_V3.4.exe

Then post a new HijackThis log.


----------



## kickrz (Jul 30, 2003)

Deleted the file, things started locking up so I restarted and once again I can't get in unless in safe mode


----------



## kickrz (Jul 30, 2003)

After a few attempts and a system restore I am back in.

I went back and deleted the photoscape file but something still seems off. It takes a long time to open anything and it locks up quite a bit.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:50:04 PM, on 5/27/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Sunbelt Software\VIPRE\SBPIMSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Sunbelt Software\VIPRE\SBAMTray.exe
C:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe
C:\Program Files\HiYo\bin\HiYo.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\IncrediMail\bin\IncMail.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\IncrediMail\Bin\ImApp.exe
C:\Program Files\Trend Micro\HijackThis\HiJackThis.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Sunbelt Software\VIPRE\SBAMSvc.exe
C:\Program Files\Sunbelt Software\VIPRE\SBAMUI.exe
C:\Program Files\Sunbelt Software\VIPRE\SBAMUI.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Sunbelt Software\VIPRE\SBAMUI.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Monitor] "C:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Hiyo] "C:\Program Files\HiYo\bin\HiYo.exe" /RunFromStartup
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [SBAMTray] "C:\Program Files\Sunbelt Software\VIPRE\SBAMTray.exe"
O4 - HKCU\..\Run: [IncrediMail] "C:\Program Files\IncrediMail\bin\IncMail.exe" /c
O4 - HKCU\..\Run: [cdloader] "C:\Documents and Settings\Kickrz\Application Data\mjusbsp\cdloader2.exe" MAGICJACK
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\PROGRA~1\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'c:\program files\bonjour\mdnsnsp.dll' missing
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1265376705171
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1273110928250
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos-beta/OnlineScanner.cab
O16 - DPF: {BEA7310D-06C4-4339-A784-DC3804819809} (Photo Upload Plugin Class) - http://www.walmartphotocentre.ca/upload/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab
O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Unknown owner - C:\Program Files\Bonjour\mDNSResponder.exe (file missing)
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LeapFrog Connect Device Service - LeapFrog Enterprises, Inc. - C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: VIPRE Antivirus (SBAMSvc) - Sunbelt Software - C:\Program Files\Sunbelt Software\VIPRE\SBAMSvc.exe
O23 - Service: SB Recovery Service (SBPIMSvc) - Sunbelt Software - C:\Program Files\Sunbelt Software\VIPRE\SBPIMSvc.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--
End of file - 7278 bytes


----------



## Cookiegal (Aug 27, 2003)

Please go to *Start *- *Run *- type in *eventvwr.msc* to open the event viewer. Look under both "Application" and "System" for recent (the last 48 hours or so) errors (shown in red) and if found, do this for each one.

Double-click the error to open it up and then click on the icon that looks like two pieces of paper. This will copy the full error. Then "paste" the error into Notepad. Do this for each one until you have them all listed in Notepad and then copy and paste the list in a reply here please.


----------



## kickrz (Jul 30, 2003)

Event Type:	Error
Event Source:	Application Hang
Event Category:	(101)
Event ID:	1002
Date: 5/26/2011
Time: 8:39:44 PM
User: N/A
Computer:	BRIAN-Y0IEJ0KFN
Description:
Hanging application iexplore.exe, version 8.0.6001.18702, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 69 65 78 70 6c 6f iexplo
0018: 72 65 2e 65 78 65 20 38 re.exe 8
0020: 2e 30 2e 36 30 30 31 2e .0.6001.
0028: 31 38 37 30 32 20 69 6e 18702 in
0030: 20 68 75 6e 67 61 70 70 hungapp
0038: 20 30 2e 30 2e 30 2e 30 0.0.0.0
0040: 20 61 74 20 6f 66 66 73 at offs
0048: 65 74 20 30 30 30 30 30 et 00000
0050: 30 30 30 000

Event Type:	Error
Event Source:	Application Hang
Event Category:	(101)
Event ID:	1002
Date: 5/26/2011
Time: 5:24:08 PM
User: N/A
Computer:	BRIAN-Y0IEJ0KFN
Description:
Hanging application iexplore.exe, version 8.0.6001.18702, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 69 65 78 70 6c 6f iexplo
0018: 72 65 2e 65 78 65 20 38 re.exe 8
0020: 2e 30 2e 36 30 30 31 2e .0.6001.
0028: 31 38 37 30 32 20 69 6e 18702 in
0030: 20 68 75 6e 67 61 70 70 hungapp
0038: 20 30 2e 30 2e 30 2e 30 0.0.0.0
0040: 20 61 74 20 6f 66 66 73 at offs
0048: 65 74 20 30 30 30 30 30 et 00000
0050: 30 30 30 000

And a bunch of these again:

Event Type:	Error
Event Source:	Cdrom
Event Category:	None
Event ID:	11
Date: 5/28/2011
Time: 9:25:53 AM
User: N/A
Computer:	BRIAN-Y0IEJ0KFN
Description:
The driver detected a controller error on \Device\CdRom0.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 68 00 01 00 b8 00 ..h...¸.
0008: 00 00 00 00 0b 00 04 c0 .......À
0010: 01 01 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
0028: 9a 9c 29 00 00 00 00 00 ).....
0030: ff ff ff ff 02 00 00 00 ÿÿÿÿ....
0038: 40 00 00 c4 02 00 00 00 @..Ä....
0040: 00 00 06 12 08 00 00 00 ........
0048: 00 00 00 00 14 00 00 00 ........
0050: 00 00 00 00 48 d1 23 86 ....HÑ#
0058: 00 00 00 00 b0 61 ee 86 ....°aî
0060: 01 00 00 00 00 00 00 00 ........
0068: 00 00 00 00 00 00 00 00 ........
0070: 00 00 00 00 00 00 00 00 ........
0078: 70 00 04 00 00 00 00 0a p.......
0080: 00 00 08 83 40 00 00 00 ...@...
0088: 00 00 00 00 00 00 00 00 ........


----------



## Cookiegal (Aug 27, 2003)

Please go to the following link and run TDSSKiller:

http://support.kaspersky.com/viruses/solutions?qid=208280684

Allow it cure anything if prompted.

Please post the log back here.


----------



## kickrz (Jul 30, 2003)

2011/05/29 16:30:46.0683 3344	TDSS rootkit removing tool 2.5.3.0 May 25 2011 07:09:24
2011/05/29 16:30:47.0027 3344	================================================================================
2011/05/29 16:30:47.0027 3344	SystemInfo:
2011/05/29 16:30:47.0027 3344	
2011/05/29 16:30:47.0027 3344	OS Version: 5.1.2600 ServicePack: 3.0
2011/05/29 16:30:47.0027 3344	Product type: Workstation
2011/05/29 16:30:47.0027 3344	ComputerName: BRIAN-Y0IEJ0KFN
2011/05/29 16:30:47.0027 3344	UserName: Kickrz
2011/05/29 16:30:47.0027 3344	Windows directory: C:\WINDOWS
2011/05/29 16:30:47.0027 3344	System windows directory: C:\WINDOWS
2011/05/29 16:30:47.0027 3344	Processor architecture: Intel x86
2011/05/29 16:30:47.0027 3344	Number of processors: 2
2011/05/29 16:30:47.0027 3344	Page size: 0x1000
2011/05/29 16:30:47.0027 3344	Boot type: Normal boot
2011/05/29 16:30:47.0027 3344	================================================================================
2011/05/29 16:30:49.0464 3344	Initialize success
2011/05/29 16:30:52.0339 2708	================================================================================
2011/05/29 16:30:52.0339 2708	Scan started
2011/05/29 16:30:52.0339 2708	Mode: Manual; 
2011/05/29 16:30:52.0339 2708	================================================================================
2011/05/29 16:30:54.0730 2708	ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/05/29 16:30:54.0792 2708	ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
2011/05/29 16:30:54.0902 2708	aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2011/05/29 16:30:54.0948 2708	AFD (7618d5218f2a614672ec61a80d854a37) C:\WINDOWS\System32\drivers\afd.sys
2011/05/29 16:30:55.0105 2708	AgereSoftModem (b0ebcb8afa36afbeed430d49f8e4777e) C:\WINDOWS\system32\DRIVERS\AGRSM.sys
2011/05/29 16:30:56.0089 2708	agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys
2011/05/29 16:30:56.0339 2708	ALCXSENS (fbbcb95f677cbaa924140b6ea2d9a97b) C:\WINDOWS\system32\drivers\ALCXSENS.SYS
2011/05/29 16:30:56.0464 2708	ALCXWDM (391344370018a87a6c478ab76c7a47a8) C:\WINDOWS\system32\drivers\ALCXWDM.SYS
2011/05/29 16:30:56.0667 2708	AR5211 (32bf9185a7dc622c00791113d5568662) C:\WINDOWS\system32\DRIVERS\ar5211.sys
2011/05/29 16:30:56.0730 2708	Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
2011/05/29 16:30:56.0917 2708	AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/05/29 16:30:57.0011 2708	atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2011/05/29 16:30:57.0073 2708	Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/05/29 16:30:57.0277 2708	audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/05/29 16:30:57.0402 2708	Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2011/05/29 16:30:57.0683 2708	cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/05/29 16:30:57.0792 2708	Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2011/05/29 16:30:57.0870 2708	Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/05/29 16:30:57.0964 2708	Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/05/29 16:30:58.0073 2708	CmBatt (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
2011/05/29 16:30:58.0198 2708	Compbatt (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
2011/05/29 16:30:58.0355 2708	Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/05/29 16:30:58.0480 2708	dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
2011/05/29 16:30:58.0652 2708	dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
2011/05/29 16:30:58.0777 2708	dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2011/05/29 16:30:58.0839 2708	DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2011/05/29 16:30:58.0964 2708	drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2011/05/29 16:30:59.0027 2708	Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/05/29 16:30:59.0089 2708	Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
2011/05/29 16:30:59.0167 2708	Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
2011/05/29 16:30:59.0214 2708	Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
2011/05/29 16:30:59.0292 2708	FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
2011/05/29 16:30:59.0448 2708	FlyUsb (8efa9bfc940d9eb9348d9dafb839fe25) C:\WINDOWS\system32\DRIVERS\FlyUsb.sys
2011/05/29 16:30:59.0652 2708	Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/05/29 16:30:59.0745 2708	Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/05/29 16:30:59.0839 2708	GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
2011/05/29 16:30:59.0917 2708	Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/05/29 16:30:59.0995 2708	grmnusb (6003bc70f1a8307262bd3c941bda0b7e) C:\WINDOWS\system32\drivers\grmnusb.sys
2011/05/29 16:31:00.0120 2708	hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/05/29 16:31:00.0277 2708	HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/05/29 16:31:00.0370 2708	i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2011/05/29 16:31:00.0464 2708	Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2011/05/29 16:31:00.0714 2708	intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2011/05/29 16:31:00.0792 2708	ip6fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
2011/05/29 16:31:00.0917 2708	IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/05/29 16:31:00.0995 2708	IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/05/29 16:31:01.0073 2708	IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/05/29 16:31:01.0167 2708	IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/05/29 16:31:01.0214 2708	irda (aca5e7b54409f9cb5eed97ed0c81120e) C:\WINDOWS\system32\DRIVERS\irda.sys
2011/05/29 16:31:01.0308 2708	IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/05/29 16:31:01.0417 2708	isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/05/29 16:31:01.0558 2708	Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/05/29 16:31:01.0652 2708	kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2011/05/29 16:31:01.0730 2708	KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/05/29 16:31:01.0902 2708	libusb0 (03e12dbfacf1aeb86c553b0db488fb81) C:\WINDOWS\system32\drivers\libusb0.sys
2011/05/29 16:31:02.0027 2708	mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/05/29 16:31:02.0073 2708	Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
2011/05/29 16:31:02.0167 2708	Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/05/29 16:31:02.0261 2708	mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/05/29 16:31:02.0339 2708	MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/05/29 16:31:02.0448 2708	MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/05/29 16:31:02.0558 2708	MRxSmb (0ea4d8ed179b75f8afa7998ba22285ca) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/05/29 16:31:02.0698 2708	Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2011/05/29 16:31:02.0808 2708	MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/05/29 16:31:02.0870 2708	MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/05/29 16:31:02.0933 2708	MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2011/05/29 16:31:03.0089 2708	mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/05/29 16:31:03.0183 2708	Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
2011/05/29 16:31:03.0261 2708	NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2011/05/29 16:31:03.0292 2708	NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/05/29 16:31:03.0339 2708	Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/05/29 16:31:03.0511 2708	NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/05/29 16:31:03.0605 2708	NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/05/29 16:31:03.0667 2708	NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2011/05/29 16:31:03.0745 2708	NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2011/05/29 16:31:03.0917 2708	NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
2011/05/29 16:31:03.0980 2708	Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2011/05/29 16:31:04.0073 2708	Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/05/29 16:31:04.0183 2708	Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2011/05/29 16:31:04.0339 2708	nv (a39d4283282ba706b6bfb599f7808b48) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
2011/05/29 16:31:04.0980 2708	NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/05/29 16:31:05.0011 2708	NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/05/29 16:31:05.0089 2708	ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
2011/05/29 16:31:05.0167 2708	Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys
2011/05/29 16:31:05.0230 2708	PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/05/29 16:31:05.0308 2708	ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
2011/05/29 16:31:05.0386 2708	PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/05/29 16:31:05.0495 2708	PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
2011/05/29 16:31:05.0558 2708	Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\DRIVERS\pcmcia.sys
2011/05/29 16:31:05.0902 2708	PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/05/29 16:31:05.0933 2708	Processor (a32bebaf723557681bfc6bd93e98bd26) C:\WINDOWS\system32\DRIVERS\processr.sys
2011/05/29 16:31:05.0964 2708	PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2011/05/29 16:31:06.0042 2708	Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/05/29 16:31:06.0120 2708	PxHelp20 (153d02480a0a2f45785522e814c634b6) C:\WINDOWS\system32\Drivers\PxHelp20.sys
2011/05/29 16:31:06.0370 2708	RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/05/29 16:31:06.0464 2708	Rasirda (0207d26ddf796a193ccd9f83047bb5fc) C:\WINDOWS\system32\DRIVERS\rasirda.sys
2011/05/29 16:31:06.0542 2708	Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/05/29 16:31:06.0620 2708	RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/05/29 16:31:06.0652 2708	Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/05/29 16:31:06.0698 2708	Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/05/29 16:31:06.0777 2708	RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/05/29 16:31:06.0855 2708	RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/05/29 16:31:06.0980 2708	redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/05/29 16:31:07.0089 2708	RimUsb (f17713d108aca124a139fde877eef68a) C:\WINDOWS\system32\Drivers\RimUsb.sys
2011/05/29 16:31:07.0167 2708	rtl8139 (d507c1400284176573224903819ffda3) C:\WINDOWS\system32\DRIVERS\RTL8139.SYS
2011/05/29 16:31:07.0292 2708	sbaphd (65a36563c0207824c8240662043c5304) C:\WINDOWS\system32\drivers\sbaphd.sys
2011/05/29 16:31:07.0370 2708	sbapifs (3d6ba67c758735918e323d4d6f64449a) C:\WINDOWS\system32\drivers\sbapifs.sys
2011/05/29 16:31:07.0448 2708	SBRE (0505da5d357f18a5d42fc5dede6bc9a0) C:\WINDOWS\system32\drivers\SBREdrv.sys
2011/05/29 16:31:07.0542 2708	SbTis (44062a740434b7c3946096d615aaa91c) C:\WINDOWS\system32\drivers\sbtis.sys
2011/05/29 16:31:07.0652 2708	sdbus (8d04819a3ce51b9eb47e5689b44d43c4) C:\WINDOWS\system32\DRIVERS\sdbus.sys
2011/05/29 16:31:07.0761 2708	Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/05/29 16:31:07.0902 2708	Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\drivers\Serial.sys
2011/05/29 16:31:07.0980 2708	sffdisk (0fa803c64df0914b41f807ea276bf2a6) C:\WINDOWS\system32\DRIVERS\sffdisk.sys
2011/05/29 16:31:08.0058 2708	sffp_sd (c17c331e435ed8737525c86a7557b3ac) C:\WINDOWS\system32\DRIVERS\sffp_sd.sys
2011/05/29 16:31:08.0152 2708	Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
2011/05/29 16:31:08.0292 2708	SMCIRDA (707647a1aa0edb6cbef61b0c75c28ed3) C:\WINDOWS\system32\DRIVERS\smcirda.sys
2011/05/29 16:31:08.0386 2708	SONYPVU1 (a1eceeaa5c5e74b2499eb51d38185b84) C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS
2011/05/29 16:31:08.0495 2708	splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2011/05/29 16:31:08.0620 2708	sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
2011/05/29 16:31:08.0933 2708	Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/05/29 16:31:08.0995 2708	swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/05/29 16:31:09.0089 2708	swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2011/05/29 16:31:09.0261 2708	sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2011/05/29 16:31:09.0386 2708	Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/05/29 16:31:09.0527 2708	TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/05/29 16:31:09.0589 2708	TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/05/29 16:31:09.0667 2708	TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/05/29 16:31:09.0933 2708	Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2011/05/29 16:31:10.0152 2708	Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2011/05/29 16:31:10.0277 2708	USBAAPL (5c2bdc152bbab34f36473deaf7713f22) C:\WINDOWS\system32\Drivers\usbaapl.sys
2011/05/29 16:31:10.0386 2708	usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
2011/05/29 16:31:10.0433 2708	usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/05/29 16:31:10.0511 2708	usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/05/29 16:31:10.0589 2708	usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/05/29 16:31:10.0683 2708	usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2011/05/29 16:31:10.0808 2708	usbstor (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/05/29 16:31:10.0855 2708	usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2011/05/29 16:31:10.0917 2708	VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2011/05/29 16:31:11.0027 2708	VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
2011/05/29 16:31:11.0136 2708	Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/05/29 16:31:11.0245 2708	wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2011/05/29 16:31:11.0464 2708	WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
2011/05/29 16:31:11.0573 2708	WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
2011/05/29 16:31:11.0777 2708	MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0
2011/05/29 16:31:11.0948 2708	================================================================================
2011/05/29 16:31:11.0948 2708	Scan finished
2011/05/29 16:31:11.0948 2708	================================================================================
2011/05/29 16:31:11.0964 3880	Detected object count: 0
2011/05/29 16:31:11.0964 3880	Actual detected object count: 0


----------



## Cookiegal (Aug 27, 2003)

Please give me a summary of the problems you're experiencing.


----------



## kickrz (Jul 30, 2003)

Sorry sick kids have kept me busy. Things seem ok.....for now.


----------



## Cookiegal (Aug 27, 2003)

Alright, thanks.


----------



## kickrz (Jul 30, 2003)

Should I be doing the system restore thing you asked me to do before? I never did get all the way through it as I couldn't get back on for the 100th time!!


----------



## Cookiegal (Aug 27, 2003)

Yes, turn system restore off and then back on and create a new restore point.


----------



## kickrz (Jul 30, 2003)

Shocking! Went from looping to stuck at blue welcome screen. Can't get on anymore.


----------



## Cookiegal (Aug 27, 2003)

Try booting to Last Known Good Configuration.


----------



## kickrz (Jul 30, 2003)

Tried that too..I can only get it if I use system restore...took several tries but I am back in..for now.


----------



## Cookiegal (Aug 27, 2003)

How are you doing a system restore if you can't boot the computer?


----------



## kickrz (Jul 30, 2003)

I have to keep trying until I can boot in safe mode. Once in Safe mode I can then do a system restore even then it doesn't always work but after numerous attempt it finally goes and restarts. 

I am wondering at this point if I am better to save my stuff and just format the whole thing. Obviously there are issues and we are now going on 2 months of this. 

I am not sure how I feel about this Vipre program can you suggest another anitvirus program that might suit me better?


----------



## Cookiegal (Aug 27, 2003)

I have to agree that we seem to be getting nowhere. If you can back up your stuff and reformat then you'll start fresh.

Microsoft Security Essentials is a good option for your anti-virus and you should keep MalwareBytes and update and run it reguarly.


----------

