Spyware / Malware / Virus Removal

[Resolved] Virut 32? Terrified to use web.

12 min read

Looking for the outcome? Ask AI

Calibrator Topic Starter

Post #1April 2, 2009, 8:02 AM UTC last edited April 2, 2009, 8:41 AM UTC

Hi guys,

Downloaded virut 32 (I believe) and during cleansing with AVG it seems I may have had another resident virus, not sure which now. Anyway I found your site and am astounded at the level of assistance you can give, so maybe can you help me clean my machine.

Couple of issues, I do not have an installation disc for XP, OEM PC without CD although completely legit. I have run Dr Web Cure It which found and cleansed approximately 1400 infections, not sure if I should have but was panicking…

HJT Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:40:30, on 02/04/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Wireless LAN Utility\tiwlnsvc.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\VTTimer.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Wireless LAN Utility\TIWLANCu.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [TI WLAN] C:\Program Files\Wireless LAN Utility\TIWLANCu.exe
O4 - HKLM\..\Run: [WheelMouse] C:\Advanced Wheel Mouse\wh_exec.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: VisualRoute Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/betapit/PCPitStop.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1229158219187
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1229160138828
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} (PCPitstop Exam) - http://utilities.pcpitstop.com/optimize2/pcpitstop2.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avg8wd - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: TI Wlan Service (tiwlnsvc) - Unknown owner - C:\Program Files\Wireless LAN Utility\tiwlnsvc.exe

–
End of file - 6362 bytes

MALWAREBYTES LOG:

Malwarebytes' Anti-Malware 1.35
Database version: 1931
Windows 5.1.2600 Service Pack 3

02/04/2009 08:38:27
mbam-log-2009-04-02 (08-38-27).txt

Scan type: Quick Scan
Objects scanned: 68951
Time elapsed: 3 minute(s), 8 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 2
Folders Infected: 4
Files Infected: 12

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
C:\Documents and Settings\NetworkService\Application Data\wsnpoem (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrator\Application Data\RegistrySmart (Rogue.RegistrySmart) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrator\Application Data\RegistrySmart\Log (Rogue.RegistrySmart) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrator\Application Data\RegistrySmart\Registry Backups (Rogue.RegistrySmart) -> Quarantined and deleted successfully.

Files Infected:
C:\Documents and Settings\NetworkService\Application Data\wsnpoem\audio.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrator\Application Data\RegistrySmart\Registry Backups\2007-10-01_19-31-31.reg (Rogue.RegistrySmart) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\4.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\5.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\6.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\8.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\A.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\B.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\D.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\E.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\F.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\FInstall.sys (Backdoor.Bot) -> Quarantined and deleted successfully.

Any help would be greatly appreciated, I am terrified of using the PC / Web incase anything breaks!

CatByte

Post #2April 2, 2009, 12:06 PM UTC last edited April 2, 2009, 3:32 PM UTC

Hi and

Unfortunately if you are infected with virut, the only option is to reformat.

This virus infects and corrupts too many system files that nothing can really be fully cured nor can it be trusted again.

I suggest you to start backup all of your valuable data/documents/pictures/movies/songs/etc..
Do NOT backup any applications/installers and Do NOT backup any .exe/.scr/.htm/.html/.xml/.zip/.rar files…
This because these files may be infected as well. If you back them up and replace them afterwards, it will infect your computer again.

You will need to contact Microsoft and have them send you installation disks…if you have your serial numbers it shouldn't be an issue - they may charge a nominal fee for it.

Read here for instructions how to format and reinstall Windows:

Do you still have the log that Dr.Web produced? 1400 infections is a sure sign of virut - Dr. Web says 'cured' - but that generally isn't the case:

You can read more about virut HERE

This online scan will confirm if you have virut for certain:

Please do the following

Go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
  Mail databases
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As….
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.

Calibrator

Post #3April 2, 2009, 3:08 PM UTC

Hi CatByte, Unfortunately I do not have the Dr Web log. As requested Kaspersky Results: ——————————————————————————– KASPERSKY ONLINE SCANNER 7 REPORT Thursday, April 2, 2009 Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Thursday, April 02, 2009 14:16:16 Records in database: 1999521 ——————————————————————————– Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: A:\ C:\ D:\ E:\ Scan statistics: Files scanned: 101137 Threat name: 4 Infected objects: 20 Suspicious objects: 0 Duration of the scan: 02:14:16 File name / Threat name / Threats count C:\Documents and Settings\Administrator\DoctorWeb\Quarantine\Setup.exe Infected: not-a-virus:WebToolbar.Win32.Zango.bw 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\7.tmp.vir Infected: Packed.Win32.Krap.i 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\dxonool32.sys.vir Infected: Trojan.Win32.VB.mnr 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\tpszxyd.sys.vir Infected: Trojan-Downloader.Win32.Agent.bpew 1 C:\WINDOWS\system32\10.tmp Infected: Packed.Win32.Krap.i 1 C:\WINDOWS\system32\11.tmp Infected: Packed.Win32.Krap.i 1 C:\WINDOWS\system32\12.tmp Infected: Packed.Win32.Krap.i 1 C:\WINDOWS\system32\15.tmp Infected: Packed.Win32.Krap.i 1 C:\WINDOWS\system32\16.tmp Infected: Packed.Win32.Krap.i 1 C:\WINDOWS\system32\17.tmp Infected: Packed.Win32.Krap.i 1 C:\WINDOWS\system32\18.tmp Infected: Packed.Win32.Krap.i 1 C:\WINDOWS\system32\1A.tmp Infected: Packed.Win32.Krap.i 1 C:\WINDOWS\system32\1B.tmp Infected: Packed.Win32.Krap.i 1 C:\WINDOWS\system32\24.tmp Infected: Packed.Win32.Krap.i 1 C:\WINDOWS\system32\25.tmp Infected: Packed.Win32.Krap.i 1 C:\WINDOWS\system32\2C.tmp Infected: Packed.Win32.Krap.i 1 C:\WINDOWS\system32\2D.tmp Infected: Packed.Win32.Krap.i 1 C:\WINDOWS\system32\30.tmp Infected: Packed.Win32.Krap.i 1 C:\WINDOWS\system32\31.tmp Infected: Packed.Win32.Krap.i 1 C:\WINDOWS\system32\3B.tmp Infected: Packed.Win32.Krap.i 1 The selected area was scanned. Thanks for assisting! P.S. the Format/Re-Install link is broken

CatByte

Post #4April 2, 2009, 3:41 PM UTC

Hi,

Well good news and bad news

good news - kaspersky didn't find virut - bad news - machine is very heavily infected still.

Please do this:

Please download SDFix and save it to your Desktop.

You should print out these instructions, or copy them to a NotePad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site.

Double click on SDFix.exe. It should automatically extract a folder called SDFix to your system drive (usually C:\).
Please reboot your computer in Safe Mode by doing the following :

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key repeatedly;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual user account.

Open the SDFix folder and double click on RunThis.bat to start the script.
Type Y and press Enter to begin the script.
It will start cleaning your PC and then prompt you to press any key to Reboot.
Press any key to restart the PC.
Your system will take longer than normal to restart as the fixtool will be removing files.
When the desktop loads the Fixtool will complete the removal and display Finished.
Press any key to end the script and to load your desktop icons.
A text file should automatically open, so please copy the contents and post them here.

NEXT

Download ComboFix from one of these locations:
Link 1
Link 2
Link 3

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:
Do not mouse-click Combofix's window while it is running. That may cause it to stall.
Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please advise.
CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

In your next reply, please include

SDFix log
ComboFix log

I would also take this opportunity to back up your files as described in my previous post just in case.
(link is also fixed - sorry)

Calibrator

Post #5April 2, 2009, 4:53 PM UTC

SDFix Log:

SDFix: Version 1.240
Run by [removed] on 02/04/2009 at 17:24

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :

Restoring Default Security Values
Restoring Default Hosts File

Rebooting

Checking Files :

Trojan Files Found:

C:\WINDOWS\system32\20.tmp - Deleted
C:\WINDOWS\system32\21.tmp - Deleted
C:\WINDOWS\system32\22.tmp - Deleted
C:\WINDOWS\system32\23.tmp - Deleted
C:\WINDOWS\system32\24.tmp - Deleted
C:\WINDOWS\system32\25.tmp - Deleted
C:\WINDOWS\system32\26.tmp - Deleted
C:\WINDOWS\system32\27.tmp - Deleted
C:\WINDOWS\system32\28.tmp - Deleted
C:\WINDOWS\system32\29.tmp - Deleted
C:\WINDOWS\system32\2A.tmp - Deleted
C:\WINDOWS\system32\2B.tmp - Deleted
C:\WINDOWS\system32\2C.tmp - Deleted
C:\WINDOWS\system32\2D.tmp - Deleted
C:\WINDOWS\system32\2E.tmp - Deleted
C:\WINDOWS\system32\2F.tmp - Deleted
C:\WINDOWS\system32\10.tmp - Deleted
C:\WINDOWS\system32\11.tmp - Deleted
C:\WINDOWS\system32\12.tmp - Deleted
C:\WINDOWS\system32\13.tmp - Deleted
C:\WINDOWS\system32\14.tmp - Deleted
C:\WINDOWS\system32\15.tmp - Deleted
C:\WINDOWS\system32\16.tmp - Deleted
C:\WINDOWS\system32\17.tmp - Deleted
C:\WINDOWS\system32\18.tmp - Deleted
C:\WINDOWS\system32\19.tmp - Deleted
C:\WINDOWS\system32\1A.tmp - Deleted
C:\WINDOWS\system32\1B.tmp - Deleted
C:\WINDOWS\system32\1C.tmp - Deleted
C:\WINDOWS\system32\1D.tmp - Deleted
C:\WINDOWS\system32\1E.tmp - Deleted
C:\WINDOWS\system32\1F.tmp - Deleted

Removing Temp Files

ADS Check :

Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-02 17:47:55
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden services & system hive …

scanning hidden registry entries …

source file error: C:\Documents and Settings\Administrator\ntuser.dat
scanning hidden files …

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Remaining Services :

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Program Files\\Steam\\steamapps\\calibrator67\\half-life 2 deathmatch\\hl2.exe"="C:\\Program Files\\Steam\\steamapps\\calibrator67\\half-life 2 deathmatch\\hl2.exe:*:Enabled:hl2"
"C:\\Program Files\\Steam\\steamapps\\calibrator67\\counter-strike\\hl.exe"="C:\\Program Files\\Steam\\steamapps\\calibrator67\\counter-strike\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\WINDOWS\\system32\\sessmgr.exe"="C:\\WINDOWS\\system32\\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe"="C:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe:*:Enabled:mbam.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files :

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Sat 4 Aug 2007 4,348 ..SH. — "C:\Documents and Settings\All Users\DRM\DRMv1.bak"

Finished!

Will continue with Combofix

Cheers CatByte

Calibrator

Post #6April 2, 2009, 5:01 PM UTC

Sorry will read full reply next time, here is ComboFix Log:

ComboFix 09-04-01.01 - Administrator 2009-04-02 17:56:29.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1414 [GMT 1:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\explorer.exe . . . is infected!!

.
((((((((((((((((((((((((( Files Created from 2009-03-02 to 2009-04-02 )))))))))))))))))))))))))))))))
.

2009-04-02 17:23 . 2009-04-02 17:23 578,560 –a–c— c:\windows\system32\dllcache\user32.dll
2009-04-02 17:20 . 2009-04-02 17:21 d——– c:\windows\ERUNT
2009-04-02 17:15 . 2009-04-02 17:49 d——– C:\SDFix
2009-04-02 09:40 . 2009-04-02 09:40 d——– c:\program files\Trend Micro
2009-04-02 08:49 . 2009-04-02 08:49 d——– c:\program files\ERUNT
2009-04-02 08:30 . 2009-04-02 08:30 d——– c:\program files\Malwarebytes' Anti-Malware
2009-04-02 08:30 . 2009-04-02 08:30 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2009-04-02 08:30 . 2009-04-02 08:30 d——– c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-04-02 08:30 . 2009-03-26 16:49 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-02 08:30 . 2009-03-26 16:49 15,504 –a—— c:\windows\system32\drivers\mbam.sys
2009-04-02 07:42 . 2008-07-12 08:18 3,851,784 –a—— c:\windows\system32\D3DX9_39.dll
2009-04-02 07:42 . 2008-07-12 08:18 1,493,528 –a—— c:\windows\system32\D3DCompiler_39.dll
2009-04-02 07:42 . 2008-07-12 08:18 467,984 –a—— c:\windows\system32\d3dx10_39.dll
2009-04-02 07:41 . 2009-04-02 07:41 d——– c:\program files\PerformanceTest
2009-04-02 07:41 . 2009-04-02 07:41 d——– c:\documents and settings\All Users\Application Data\PassMark
2009-04-01 12:05 . 2009-04-01 12:05 d——– C:\Oscar
2009-03-30 11:46 . 2009-03-30 11:57 d——– c:\windows\SxsCaPendDel
2009-03-30 11:46 . 2009-03-30 11:46 d——– C:\45bb6b287e696ff21d8f8dae445d
2009-03-30 11:41 . 2008-06-17 20:02 8,461,312 —–c— c:\windows\system32\dllcache\shell32.dll
2009-03-30 11:41 . 2008-12-05 07:54 144,896 —–c— c:\windows\system32\dllcache\schannel.dll
2009-03-30 11:35 . 2008-06-20 12:51 361,600 —–c— c:\windows\system32\dllcache\tcpip.sys
2009-03-30 11:35 . 2008-06-20 18:46 245,248 —–c— c:\windows\system32\dllcache\mswsock.dll
2009-03-30 11:35 . 2008-06-20 12:08 225,856 —–c— c:\windows\system32\dllcache\tcpip6.sys
2009-03-30 11:35 . 2008-06-20 18:46 147,968 —–c— c:\windows\system32\dllcache\dnsapi.dll
2009-03-30 11:28 . 2009-03-30 11:28 d——– c:\program files\Sun
2009-03-30 11:28 . 2009-03-30 11:27 410,984 –a—— c:\windows\system32\deploytk.dll
2009-03-30 11:22 . 2009-03-30 11:25 d——– c:\documents and settings\Administrator\.SunDownloadManager
2009-03-28 12:04 . 2009-02-25 16:15 593,920 ——— c:\windows\system32\ati2sgag.exe
2009-03-28 07:38 . 2009-03-28 07:38 128 –a—— c:\windows\system32\32.tmp
2009-03-27 20:47 . 2009-03-27 20:48 28,672 –a—— c:\windows\system32\3B.tmp
2009-03-27 17:23 . 2009-03-27 17:23 28,672 –a—— c:\windows\system32\31.tmp
2009-03-27 15:01 . 2009-03-27 15:01 28,672 –a—— c:\windows\system32\30.tmp
2009-03-26 20:40 . 2009-03-28 08:05 d——– c:\documents and settings\Administrator\DoctorWeb
2009-03-24 21:55 . 2009-03-24 21:57 d——– c:\program files\Nexus Radio
2009-03-24 20:15 . 2009-03-24 20:15 d——– c:\windows\Replay Media Catcher
2009-03-24 20:15 . 2009-03-30 09:23 d——– c:\program files\Replay Media Catcher
2009-03-24 20:15 . 2009-03-30 08:58 323,584 –a—— c:\windows\system32\AUDIOGENIE2.DLL
2009-03-24 20:15 . 2009-03-30 08:58 237,568 –a—— c:\windows\system32\rmc_rtspdl.dll
2009-03-24 20:15 . 2009-03-30 08:58 156,672 –a—— c:\windows\system32\rmc_fixasf.exe
2009-03-24 19:44 . 2009-03-24 19:44 d——– c:\program files\Philips
2009-03-06 21:49 . 2009-03-06 21:49 d——– c:\documents and settings\Administrator\Application Data\Stellarium
2009-03-06 21:48 . 2009-03-06 21:49 d——– c:\program files\Stellarium

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-02 11:10 ——— d—–w c:\program files\Steam
2009-03-30 10:51 ——— d—–w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-03-30 10:27 ——— d—–w c:\program files\Java
2009-03-30 08:53 ——— d—–w c:\documents and settings\Administrator\Application Data\Spotify
2009-03-30 08:49 ——— d—–w c:\program files\Spotify
2009-03-28 08:50 ——— d—–w c:\program files\mIRC
2009-03-28 08:25 151,040 —-a-w c:\windows\pchealth\UploadLB\Binaries\uploadm.exe
2009-03-28 08:24 769,536 —-a-w c:\windows\pchealth\helpctr\binaries\helpctr.exe
2009-03-28 08:24 744,448 —-a-w c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2009-03-28 08:24 35,840 —-a-w c:\windows\pchealth\helpctr\binaries\notiflag.exe
2009-03-28 08:24 18,944 —-a-w c:\windows\pchealth\helpctr\binaries\hscupd.exe
2009-03-28 08:24 170,496 —-a-w c:\windows\pchealth\helpctr\binaries\msconfig.exe
2009-03-28 08:24 100,352 —-a-w c:\windows\pchealth\helpctr\binaries\HelpHost.exe
2009-03-28 08:00 966,656 —-a-w c:\windows\UNRecode.exe
2009-03-28 08:00 966,656 —-a-w c:\windows\UNNeroVision.exe
2009-03-28 08:00 966,656 —-a-w c:\windows\UNNeroShowTime.exe
2009-03-28 08:00 966,656 —-a-w c:\windows\UNNeroMediaHome.exe
2009-03-28 08:00 966,656 —-a-w c:\windows\UNNeroBackItUp.exe
2009-03-28 08:00 283,648 —-a-w c:\windows\winhlp32.exe
2009-03-26 19:54 8,704 —-a-w c:\windows\system32\winhlp32.exe
2009-03-26 19:53 98,816 —-a-w c:\windows\system32\verifier.exe
2009-03-26 19:52 9,728 —-a-w c:\windows\system32\subst.exe
2009-03-26 19:51 9,728 —-a-w c:\windows\system32\reset.exe
2009-03-26 19:50 86,016 —-a-w c:\windows\system32\netsh.exe
2009-03-26 19:49 9,728 —-a-w c:\windows\system32\label.exe
2009-03-26 19:48 9,216 —-a-w c:\windows\system32\finger.exe
2009-03-26 19:47 87,040 —-a-w c:\windows\system32\diantz.exe
2009-03-26 19:46 98,816 —-a-w c:\windows\system32\ahui.exe
2009-03-26 19:44 73,728 —-a-w c:\windows\system32\VTTimer.exe
2009-03-26 19:44 73,728 —-a-w c:\windows\system32\tlntsvr.exe
2009-03-26 19:44 289,792 —-a-w c:\windows\system32\vssvc.exe
2009-03-26 19:44 26,112 —-a-w c:\windows\system32\userinit.exe
2009-03-26 19:44 18,944 —-a-w c:\windows\system32\ups.exe
2009-03-26 18:07 ——— d—–w c:\documents and settings\All Users\Application Data\avg8
2009-03-26 18:06 325,128 —-a-w c:\windows\system32\drivers\avgldx86.sys
2009-03-26 18:06 10,520 —-a-w c:\windows\system32\avgrsstx.dll
2009-03-24 20:49 ——— d—–w c:\documents and settings\Administrator\Application Data\NCH Swift Sound
2009-03-24 20:48 ——— d—–w c:\program files\NCH Software
2009-03-24 18:44 ——— d–h–w c:\program files\InstallShield Installation Information
2009-03-20 17:04 ——— d—–w c:\documents and settings\All Users\Application Data\TrackMania
2009-02-25 22:58 3,565,568 —-a-w c:\windows\system32\drivers\ati2mtag.sys
2009-02-25 21:42 442,368 —-a-w c:\windows\system32\ATIDEMGX.dll
2009-02-25 21:41 325,120 —-a-w c:\windows\system32\ati2dvag.dll
2009-02-25 21:30 204,800 —-a-w c:\windows\system32\atipdlxx.dll
2009-02-25 21:30 11,841,536 —-a-w c:\windows\system32\atioglxx.dll
2009-02-25 21:29 43,520 —-a-w c:\windows\system32\ati2edxx.dll
2009-02-25 21:29 26,112 —-a-w c:\windows\system32\Ati2mdxx.exe
2009-02-25 21:29 155,648 —-a-w c:\windows\system32\Oemdspif.dll
2009-02-25 21:29 155,648 —-a-w c:\windows\system32\ati2evxx.dll
2009-02-25 21:27 602,112 —-a-w c:\windows\system32\ati2evxx.exe
2009-02-25 21:26 53,248 —-a-w c:\windows\system32\ATIDDC.DLL
2009-02-25 21:16 3,817,984 —-a-w c:\windows\system32\ati3duag.dll
2009-02-25 21:09 307,200 —-a-w c:\windows\system32\atiiiexx.dll
2009-02-25 20:59 2,670,080 —-a-w c:\windows\system32\ativvaxx.dll
2009-02-25 20:44 49,664 —-a-w c:\windows\system32\amdpcom32.dll
2009-02-25 20:40 475,136 —-a-w c:\windows\system32\atikvmag.dll
2009-02-25 20:38 17,408 —-a-w c:\windows\system32\atitvo32.dll
2009-02-25 20:38 126,976 —-a-w c:\windows\system32\atiadlxx.dll
2009-02-25 20:37 53,248 —-a-w c:\windows\system32\drivers\ati2erec.dll
2009-02-25 20:35 290,816 —-a-w c:\windows\system32\atiok3x2.dll
2009-02-25 20:32 626,688 —-a-w c:\windows\system32\ati2cqag.dll
2009-02-25 20:32 45,056 —-a-w c:\windows\system32\aticalrt.dll
2009-02-25 20:32 45,056 —-a-w c:\windows\system32\aticalcl.dll
2009-02-25 20:30 3,227,648 —-a-w c:\windows\system32\aticaldd.dll
2009-02-22 09:50 ——— d—–w c:\documents and settings\All Users\Application Data\NCH Swift Sound
2009-02-22 09:43 27,136 —-a-w c:\windows\system32\drivers\nchssvad.sys
2009-02-22 09:43 ——— d—–w c:\documents and settings\All Users\Application Data\NCH Software
2009-02-14 13:19 ——— d—–w c:\program files\AMD
2009-02-14 12:27 ——— d—–w c:\program files\TRUST 640U SILVERLINE HEADSET USB
2009-02-09 11:13 1,846,784 —-a-w c:\windows\system32\win32k.sys
2009-02-06 17:09 ——— d—–w c:\program files\Audio Recorder
2008-04-27 09:41 774,144 —-a-w c:\program files\RngInterstitial.dll
.

——- Sigcheck ——-

2009-03-26 20:43 1052672 c0e3ad1446ee377b603a767a551af1bf c:\windows\explorer.exe
2009-03-28 09:03 1033216 1dd6b3b2ac20843fa043009969ad62d3 c:\windows\$NtServicePackUninstall$\explorer.exe
2009-03-28 09:11 1033728 76afe06854aad9fb48834da6cdc44b42 c:\windows\$NtUninstallKB938828$\explorer.exe
2009-03-28 09:27 1033728 799770b46fa0a806a7a0f52e1a85e887 c:\windows\ServicePackFiles\i386\explorer.exe

2009-03-28 09:03 15360 edf00d5b9133d927adf802b1f7d7c259 c:\windows\$NtServicePackUninstall$\ctfmon.exe
2009-03-28 09:27 15360 6d550f617e0ab3629734c7363dcae628 c:\windows\ServicePackFiles\i386\ctfmon.exe
2009-03-26 20:43 33792 5e0ac7964c45114f5f117cf1a6978063 c:\windows\system32\ctfmon.exe

2009-03-28 09:09 25088 3ee9d7262239565fea14558f2cf81d68 c:\windows\$NtServicePackUninstall$\userinit.exe
2009-03-28 09:35 26624 1ff2ee91dd1b1bda034e56a03e633cef c:\windows\ServicePackFiles\i386\userinit.exe
2009-03-26 20:44 26112 f0dedd1728bb733a893f21f6061923ca c:\windows\system32\userinit.exe
.
((((((((((((((((((((((((((((( SnapShot@2009-03-30_10.32.58.21 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-12-13 09:46:22 69,120 —-a-w c:\windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
+ 2009-03-30 10:49:23 69,120 —-a-w c:\windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
- 2008-12-13 09:46:26 72,192 —-a-w c:\windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
+ 2009-03-30 10:49:25 72,192 —-a-w c:\windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
- 2008-12-13 09:47:40 151,552 —-a-w c:\windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Dtc.dll
+ 2009-03-30 10:46:52 163,840 —-a-w c:\windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Dtc.dll
- 2008-12-13 09:46:13 4,444,160 —-a-w c:\windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
+ 2009-03-30 10:49:28 4,546,560 —-a-w c:\windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
- 2008-12-13 09:47:43 4,174,336 —-a-w c:\windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\PresentationCore.dll
+ 2009-03-30 10:46:56 4,210,688 —-a-w c:\windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\PresentationCore.dll
- 2008-12-13 09:46:27 483,840 —-a-w c:\windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
+ 2009-03-30 10:49:29 486,400 —-a-w c:\windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
- 2008-12-13 09:46:18 3,036,160 —-a-w c:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
+ 2009-03-30 10:49:30 2,933,248 —-a-w c:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
- 2008-12-13 09:46:29 258,048 —-a-w c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
+ 2009-03-30 10:49:26 258,048 —-a-w c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
- 2008-12-13 09:46:29 113,664 —-a-w c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
+ 2009-03-30 10:49:26 113,664 —-a-w c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
- 2008-12-13 09:47:43 346,624 —-a-w c:\windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\System.Printing.dll
+ 2009-03-30 10:46:57 368,640 —-a-w c:\windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\System.Printing.dll
- 2008-12-13 09:46:26 261,120 —-a-w c:\windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
+ 2009-03-30 10:49:26 261,632 —-a-w c:\windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
- 2008-12-13 09:46:17 5,431,296 —-a-w c:\windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
+ 2009-03-30 10:49:20 5,242,880 —-a-w c:\windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
- 2008-12-13 09:46:21 10,752 —-a-w c:\windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
+ 2009-03-30 10:49:23 10,752 —-a-w c:\windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
- 2008-12-13 09:46:17 507,904 —-a-w c:\windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
+ 2009-03-30 10:49:20 507,904 —-a-w c:\windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
- 2008-12-13 09:46:22 13,312 —-a-w c:\windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
+ 2009-03-30 10:49:23 13,312 —-a-w c:\windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
- 2008-12-13 09:46:23 8,192 —-a-w c:\windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
+ 2009-03-30 10:49:23 8,192 —-a-w c:\windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
- 2008-12-13 09:46:24 77,824 —-a-w c:\windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
+ 2009-03-30 10:49:23 77,824 —-a-w c:\windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
- 2008-12-13 09:46:24 6,656 —-a-w c:\windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
+ 2009-03-30 10:49:24 6,656 —-a-w c:\windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
+ 2009-03-30 10:47:43 106,496 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Conversion.v3.5\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Conversion.v3.5.dll
- 2008-12-13 09:46:30 348,160 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
+ 2009-03-30 10:49:27 348,160 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
+ 2009-03-30 10:47:44 733,184 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Engine\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
- 2008-12-13 09:46:30 36,864 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
+ 2009-03-30 10:49:27 36,864 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
+ 2009-03-30 10:47:44 36,864 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Framework\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
+ 2009-03-30 10:47:44 802,816 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.v3.5\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.v3.5.dll
- 2008-12-13 09:46:30 655,360 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
+ 2009-03-30 10:49:28 655,360 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
+ 2009-03-30 10:47:45 94,208 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.v3.5.dll
- 2008-12-13 09:46:31 77,824 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
+ 2009-03-30 10:49:28 77,824 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
- 2008-12-13 09:46:24 749,568 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
+ 2009-03-30 10:49:25 749,568 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
- 2008-12-13 09:47:40 397,312 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\3.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.dll
+ 2009-03-30 10:46:52 397,312 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\3.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.dll
- 2008-12-13 09:46:24 110,592 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
+ 2009-03-30 10:49:25 110,592 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
- 2008-12-13 09:46:23 372,736 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
+ 2009-03-30 10:49:24 372,736 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
- 2008-12-13 09:46:27 28,672 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
+ 2009-03-30 10:49:26 28,672 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
- 2008-12-13 09:46:23 671,744 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
+ 2009-03-30 10:49:24 659,456 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
+ 2009-03-30 10:47:43 41,984 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\1.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.STLCLR.dll
- 2008-12-13 09:46:15 5,632 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
+ 2009-03-30 10:49:29 5,632 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
- 2008-12-13 09:46:29 12,800 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
+ 2009-03-30 10:49:26 12,800 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
- 2008-12-13 09:46:23 32,768 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
+ 2009-03-30 10:49:24 32,768 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
- 2008-12-13 09:46:22 7,168 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
+ 2009-03-30 10:49:24 7,168 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
- 2008-12-13 09:47:37 602,112 —-a-w c:\windows\assembly\GAC_MSIL\PresentationBuildTasks\3.0.0.0__31bf3856ad364e35\PresentationBuildTasks.dll
+ 2009-03-30 10:47:00 598,016 —-a-w c:\windows\assembly\GAC_MSIL\PresentationBuildTasks\3.0.0.0__31bf3856ad364e35\PresentationBuildTasks.dll
- 2008-12-13 09:47:43 32,768 —-a-w c:\windows\assembly\GAC_MSIL\PresentationCFFRasterizer\3.0.0.0__31bf3856ad364e35\PresentationCFFRasterizer.dll
+ 2009-03-30 10:46:56 32,768 —-a-w c:\windows\assembly\GAC_MSIL\PresentationCFFRasterizer\3.0.0.0__31bf3856ad364e35\PresentationCFFRasterizer.dll
+ 2009-03-30 10:47:00 46,104 —-a-w c:\windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe
- 2008-12-13 09:47:42 184,320 —-a-w c:\windows\assembly\GAC_MSIL\PresentationFramework.Aero\3.0.0.0__31bf3856ad364e35\PresentationFramework.Aero.dll
+ 2009-03-30 10:47:00 196,608 —-a-w c:\windows\assembly\GAC_MSIL\PresentationFramework.Aero\3.0.0.0__31bf3856ad364e35\PresentationFramework.Aero.dll
- 2008-12-13 09:47:42 131,072 —-a-w c:\windows\assembly\GAC_MSIL\PresentationFramework.Classic\3.0.0.0__31bf3856ad364e35\PresentationFramework.Classic.dll
+ 2009-03-30 10:47:00 139,264 —-a-w c:\windows\assembly\GAC_MSIL\PresentationFramework.Classic\3.0.0.0__31bf3856ad364e35\PresentationFramework.Classic.dll
- 2008-12-13 09:47:42 376,832 —-a-w c:\windows\assembly\GAC_MSIL\PresentationFramework.Luna\3.0.0.0__31bf3856ad364e35\PresentationFramework.Luna.dll
+ 2009-03-30 10:47:00 397,312 —-a-w c:\windows\assembly\GAC_MSIL\PresentationFramework.Luna\3.0.0.0__31bf3856ad364e35\PresentationFramework.Luna.dll
- 2008-12-13 09:47:42 151,552 —-a-w c:\windows\assembly\GAC_MSIL\PresentationFramework.Royale\3.0.0.0__31bf3856ad364e35\PresentationFramework.Royale.dll
+ 2009-03-30 10:47:00 163,840 —-a-w c:\windows\assembly\GAC_MSIL\PresentationFramework.Royale\3.0.0.0__31bf3856ad364e35\PresentationFramework.Royale.dll
- 2008-12-13 09:47:41 5,210,112 —-a-w c:\windows\assembly\GAC_MSIL\PresentationFramework\3.0.0.0__31bf3856ad364e35\PresentationFramework.dll
+ 2009-03-30 10:50:02 5,283,840 —-a-w c:\windows\assembly\GAC_MSIL\PresentationFramework\3.0.0.0__31bf3856ad364e35\PresentationFramework.dll
- 2008-12-13 09:47:41 897,024 —-a-w c:\windows\assembly\GAC_MSIL\PresentationUI\3.0.0.0__31bf3856ad364e35\PresentationUI.dll
+ 2009-03-30 10:47:01 864,256 —-a-w c:\windows\assembly\GAC_MSIL\PresentationUI\3.0.0.0__31bf3856ad364e35\PresentationUI.dll
- 2008-12-13 09:47:43 528,384 —-a-w c:\windows\assembly\GAC_MSIL\ReachFramework\3.0.0.0__31bf3856ad364e35\ReachFramework.dll
+ 2009-03-30 10:46:57 528,384 —-a-w c:\windows\assembly\GAC_MSIL\ReachFramework\3.0.0.0__31bf3856ad364e35\ReachFramework.dll
+ 2009-03-30 10:47:45 5,632 —-a-w c:\windows\assembly\GAC_MSIL\Sentinel.v3.5Client\3.5.0.0__b03f5f7f11d50a3a\Sentinel.v3.5Client.dll
- 2008-12-13 09:47:40 102,400 —-a-w c:\windows\assembly\GAC_MSIL\SMDiagnostics\3.0.0.0__b77a5c561934e089\SMdiagnostics.dll
+ 2009-03-30 10:46:52 110,592 —-a-w c:\windows\assembly\GAC_MSIL\SMDiagnostics\3.0.0.0__b77a5c561934e089\SMdiagnostics.dll
- 2008-12-13 09:46:25 110,592 —-a-w c:\windows\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
+ 2009-03-30 10:49:29 110,592 —-a-w c:\windows\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
- 2007-05-09 13:39:16 47,832 —-a-w c:\windows\assembly\GAC_MSIL\System.AddIn.Contract\2.0.0.0__b03f5f7f11d50a3a\System.AddIn.Contract.dll
+ 2009-03-30 10:47:45 45,056 —-a-w c:\windows\assembly\GAC_MSIL\System.AddIn.Contract\2.0.0.0__b03f5f7f11d50a3a\System.AddIn.Contract.dll
+ 2009-03-30 10:47:46 163,840 —-a-w c:\windows\assembly\GAC_MSIL\System.AddIn\3.5.0.0__b77a5c561934e089\System.AddIn.dll
+ 2009-03-30 10:47:51 57,344 —-a-w c:\windows\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\3.5.0.0__31bf3856ad364e35\System.ComponentModel.DataAnnotations.dll
- 2008-12-13 09:46:25 81,920 —-a-w c:\windows\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
+ 2009-03-30 10:49:29 81,920 —-a-w c:\windows\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
- 2008-12-13 09:46:18 425,984 —-a-w c:\windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
+ 2009-03-30 10:49:30 425,984 —-a-w c:\windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
+ 2009-03-30 10:47:47 667,648 —-a-w c:\windows\assembly\GAC_MSIL\System.Core\3.5.0.0__b77a5c561934e089\System.Core.dll
+ 2009-03-30 10:47:47 53,248 —-a-w c:\windows\assembly\GAC_MSIL\System.Data.DataSetExtensions\3.5.0.0__b77a5c561934e089\System.Data.DataSetExtensions.dll
+ 2009-03-30 10:47:47 229,376 —-a-w c:\windows\assembly\GAC_MSIL\System.Data.Entity.Design\3.5.0.0__b77a5c561934e089\System.Data.Entity.Design.dll
+ 2009-03-30 10:47:48 2,879,488 —-a-w c:\windows\assembly\GAC_MSIL\System.Data.Entity\3.5.0.0__b77a5c561934e089\System.Data.Entity.dll
+ 2009-03-30 10:47:42 684,032 —-a-w c:\windows\assembly\GAC_MSIL\System.Data.Linq\3.5.0.0__b77a5c561934e089\System.Data.Linq.dll
+ 2009-03-30 10:50:21 294,912 —-a-w c:\windows\assembly\GAC_MSIL\System.Data.Services.Client\3.5.0.0__b77a5c561934e089\System.Data.Services.Client.dll
+ 2009-03-30 10:47:41 114,688 —-a-w c:\windows\assembly\GAC_MSIL\System.Data.Services.Design\3.5.0.0__b77a5c561934e089\System.Data.Services.Design.dll
+ 2009-03-30 10:50:22 442,368 —-a-w c:\windows\assembly\GAC_MSIL\System.Data.Services\3.5.0.0__b77a5c561934e089\System.Data.Services.dll
- 2008-12-13 09:46:19 741,376 —-a-w c:\windows\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
+ 2009-03-30 10:49:30 745,472 —-a-w c:\windows\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
- 2008-12-13 09:46:19 933,888 —-a-w c:\windows\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
+ 2009-03-30 10:49:30 970,752 —-a-w c:\windows\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
- 2008-12-13 09:46:31 5,070,848 —-a-w c:\windows\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
+ 2009-03-30 10:49:22 5,062,656 —-a-w c:\windows\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
+ 2009-03-30 10:47:42 286,720 —-a-w c:\windows\assembly\GAC_MSIL\System.DirectoryServices.AccountManagement\3.5.0.0__b77a5c561934e089\System.DirectoryServices.AccountManagement.dll
- 2008-12-13 09:46:30 188,416 —-a-w c:\windows\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
+ 2009-03-30 10:49:22 188,416 —-a-w c:\windows\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
- 2008-12-13 09:46:21 401,408 —-a-w c:\windows\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
+ 2009-03-30 10:49:25 401,408 —-a-w c:\windows\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
- 2008-12-13 09:46:28 81,920 —-a-w c:\windows\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
+ 2009-03-30 10:49:22 81,920 —-a-w c:\windows\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
- 2008-12-13 09:46:16 630,784 —-a-w c:\windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
+ 2009-03-30 10:49:27 626,688 —-a-w c:\windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
- 2008-12-13 09:47:44 126,976 —-a-w c:\windows\assembly\GAC_MSIL\System.IdentityModel.Selectors\3.0.0.0__b77a5c561934e089\System.IdentityModel.Selectors.dll
+ 2009-03-30 10:47:02 126,976 —-a-w c:\windows\assembly\GAC_MSIL\System.IdentityModel.Selectors\3.0.0.0__b77a5c561934e089\System.IdentityModel.Selectors.dll
- 2008-12-13 09:47:44 430,080 —-a-w c:\windows\assembly\GAC_MSIL\System.IdentityModel\3.0.0.0__b77a5c561934e089\System.IdentityModel.dll
+ 2009-03-30 10:46:53 430,080 —-a-w c:\windows\assembly\GAC_MSIL\System.IdentityModel\3.0.0.0__b77a5c561934e089\System.IdentityModel.dll
- 2008-12-13 09:47:40 131,072 —-a-w c:\windows\assembly\GAC_MSIL\System.IO.Log\3.0.0.0__b03f5f7f11d50a3a\System.IO.Log.dll
+ 2009-03-30 10:46:53 131,072 —-a-w c:\windows\assembly\GAC_MSIL\System.IO.Log\3.0.0.0__b03f5f7f11d50a3a\System.IO.Log.dll
+ 2009-03-30 10:47:48 143,360 —-a-w c:\windows\assembly\GAC_MSIL\System.Management.Instrumentation\3.5.0.0__b77a5c561934e089\System.Management.Instrumentation.dll
- 2008-12-13 09:46:29 372,736 —-a-w c:\windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
+ 2009-03-30 10:49:28 372,736 —-a-w c:\windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
- 2008-12-13 09:46:28 258,048 —-a-w c:\windows\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
+ 2009-03-30 10:49:27 258,048 —-a-w c:\windows\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
+ 2009-03-30 10:47:51 233,472 —-a-w c:\windows\assembly\GAC_MSIL\System.Net\3.5.0.0__b03f5f7f11d50a3a\System.Net.dll
- 2008-12-13 09:46:27 299,008 —-a-w c:\windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
+ 2009-03-30 10:49:27 303,104 —-a-w c:\windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
- 2008-12-13 09:46:26 131,072 —-a-w c:\windows\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
+ 2009-03-30 10:49:27 131,072 —-a-w c:\windows\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
- 2008-12-13 09:47:40 929,792 —-a-w c:\windows\assembly\GAC_MSIL\System.Runtime.Serialization\3.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll
+ 2009-03-30 10:46:53 966,656 —-a-w c:\windows\assembly\GAC_MSIL\System.Runtime.Serialization\3.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll
- 2008-12-13 09:46:16 258,048 —-a-w c:\windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
+ 2009-03-30 10:49:26 258,048 —-a-w c:\windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
- 2008-12-13 09:47:38 159,744 —-a-w c:\windows\assembly\GAC_MSIL\System.ServiceModel.Install\3.0.0.0__b77a5c561934e089\System.ServiceModel.Install.dll
+ 2009-03-30 10:46:55 73,728 —-a-w c:\windows\assembly\GAC_MSIL\System.ServiceModel.Install\3.0.0.0__b77a5c561934e089\System.ServiceModel.Install.dll
- 2008-12-13 09:47:38 32,768 —-a-w c:\windows\assembly\GAC_MSIL\System.ServiceModel.WasHosting\3.0.0.0__b77a5c561934e089\System.ServiceModel.WasHosting.dll
+ 2009-03-30 10:46:56 32,768 —-a-w c:\windows\assembly\GAC_MSIL\System.ServiceModel.WasHosting\3.0.0.0__b77a5c561934e089\System.ServiceModel.WasHosting.dll
+ 2009-03-30 10:47:41 569,344 —-a-w c:\windows\assembly\GAC_MSIL\System.ServiceModel.Web\3.5.0.0__31bf3856ad364e35\System.ServiceModel.Web.dll
- 2008-12-13 09:47:38 5,971,968 —-a-w c:\windows\assembly\GAC_MSIL\System.ServiceModel\3.0.0.0__b77a5c561934e089\System.ServiceModel.dll
+ 2009-03-30 10:50:00 5,931,008 —-a-w c:\windows\assembly\GAC_MSIL\System.ServiceModel\3.0.0.0__b77a5c561934e089\System.ServiceModel.dll
- 2008-12-13 09:46:16 114,688 —-a-w c:\windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
+ 2009-03-30 10:49:24 114,688 —-a-w c:\windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
+ 2009-03-30 10:47:52 77,824 —-a-w c:\windows\assembly\GAC_MSIL\System.Web.Abstractions\3.5.0.0__31bf3856ad364e35\System.Web.Abstractions.dll
+ 2009-03-30 10:47:52 32,768 —-a-w c:\windows\assembly\GAC_MSIL\System.Web.DynamicData.Design\3.5.0.0__31bf3856ad364e35\System.Web.DynamicData.Design.dll
+ 2009-03-30 10:50:22 229,376 —-a-w c:\windows\assembly\GAC_MSIL\System.Web.DynamicData\3.5.0.0__31bf3856ad364e35\System.Web.DynamicData.dll
+ 2009-03-30 10:47:49 131,072 —-a-w c:\windows\assembly\GAC_MSIL\System.Web.Entity.Design\3.5.0.0__b77a5c561934e089\System.Web.Entity.Design.dll
+ 2009-03-30 10:50:22 139,264 —-a-w c:\windows\assembly\GAC_MSIL\System.Web.Entity\3.5.0.0__b77a5c561934e089\System.Web.Entity.dll
+ 2009-03-30 10:47:53 335,872 —-a-w c:\windows\assembly\GAC_MSIL\System.Web.Extensions.Design\3.5.0.0__31bf3856ad364e35\System.Web.Extensions.Design.dll
+ 2009-03-30 10:50:22 1,277,952 —-a-w c:\windows\assembly\GAC_MSIL\System.Web.Extensions\3.5.0.0__31bf3856ad364e35\System.Web.Extensions.dll
- 2008-12-13 09:46:20 884,736 —-a-w c:\windows\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
+ 2009-03-30 10:49:21 835,584 —-a-w c:\windows\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
- 2008-12-13 09:46:21 90,112 —-a-w c:\windows\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
+ 2009-03-30 10:49:21 77,824 —-a-w c:\windows\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
+ 2009-03-30 10:47:54 61,440 —-a-w c:\windows\assembly\GAC_MSIL\System.Web.Routing\3.5.0.0__31bf3856ad364e35\System.Web.Routing.dll
- 2008-12-13 09:46:20 839,680 —-a-w c:\windows\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
+ 2009-03-30 10:49:21 839,680 —-a-w c:\windows\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
- 2008-12-13 09:46:22 5,013,504 —-a-w c:\windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
+ 2009-03-30 10:49:21 5,025,792 —-a-w c:\windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
+ 2009-03-30 10:47:50 12,288 —-a-w c:\windows\assembly\GAC_MSIL\System.Windows.Presentation\3.5.0.0__b77a5c561934e089\System.Windows.Presentation.dll
- 2008-12-13 09:47:44 1,152,040 —-a-w c:\windows\assembly\GAC_MSIL\System.Workflow.Activities\3.0.0.0__31bf3856ad364e35\System.Workflow.Activities.dll
+ 2009-03-30 10:46:58 1,138,688 —-a-w c:\windows\assembly\GAC_MSIL\System.Workflow.Activities\3.0.0.0__31bf3856ad364e35\System.Workflow.Activities.dll
- 2008-12-13 09:47:44 1,635,376 —-a-w c:\windows\assembly\GAC_MSIL\System.Workflow.ComponentModel\3.0.0.0__31bf3856ad364e35\System.Workflow.ComponentModel.dll
+ 2009-03-30 10:46:59 1,630,208 —-a-w c:\windows\assembly\GAC_MSIL\System.Workflow.ComponentModel\3.0.0.0__31bf3856ad364e35\System.Workflow.ComponentModel.dll
- 2008-12-13 09:47:44 578,592 —-a-w c:\windows\assembly\GAC_MSIL\System.Workflow.Runtime\3.0.0.0__31bf3856ad364e35\System.Workflow.Runtime.dll
+ 2009-03-30 10:46:59 540,672 —-a-w c:\windows\assembly\GAC_MSIL\System.Workflow.Runtime\3.0.0.0__31bf3856ad364e35\System.Workflow.Runtime.dll
+ 2009-03-30 10:47:41 507,904 —-a-w c:\windows\assembly\GAC_MSIL\System.WorkflowServices\3.5.0.0__31bf3856ad364e35\System.WorkflowServices.dll
+ 2009-03-30 10:47:50 139,264 —-a-w c:\windows\assembly\GAC_MSIL\System.Xml.Linq\3.5.0.0__b77a5c561934e089\System.Xml.Linq.dll
- 2008-12-13 09:46:17 2,068,480 —-a-w c:\windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
+ 2009-03-30 10:49:31 2,048,000 —-a-w c:\windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
- 2008-12-13 09:46:19 3,076,096 —-a-w c:\windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
+ 2009-03-30 10:49:31 3,149,824 —-a-w c:\windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
- 2008-12-13 09:47:37 163,840 —-a-w c:\windows\assembly\GAC_MSIL\UIAutomationClient\3.0.0.0__31bf3856ad364e35\UIAutomationClient.dll
+ 2009-03-30 10:47:00 167,936 —-a-w c:\windows\assembly\GAC_MSIL\UIAutomationClient\3.0.0.0__31bf3856ad364e35\UIAutomationClient.dll
- 2008-12-13 09:47:37 372,736 —-a-w c:\windows\assembly\GAC_MSIL\UIAutomationClientsideProviders\3.0.0.0__31bf3856ad364e35\UIAutomationClientsideProviders.dll
+ 2009-03-30 10:47:00 385,024 —-a-w c:\windows\assembly\GAC_MSIL\UIAutomationClientsideProviders\3.0.0.0__31bf3856ad364e35\UIAutomationClientsideProviders.dll
- 2008-12-13 09:47:43 32,768 —-a-w c:\windows\assembly\GAC_MSIL\UIAutomationProvider\3.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll
+ 2009-03-30 10:46:57 40,960 —-a-w c:\windows\assembly\GAC_MSIL\UIAutomationProvider\3.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll
- 2008-12-13 09:47:43 86,016 —-a-w c:\windows\assembly\GAC_MSIL\UIAutomationTypes\3.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll
+ 2009-03-30 10:46:58 98,304 —-a-w c:\windows\assembly\GAC_MSIL\UIAutomationTypes\3.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll
- 2008-12-13 09:47:43 1,204,224 —-a-w c:\windows\assembly\GAC_MSIL\WindowsBase\3.0.0.0__31bf3856ad364e35\WindowsBase.dll
+ 2009-03-30 10:46:58 1,245,184 —-a-w c:\windows\assembly\GAC_MSIL\WindowsBase\3.0.0.0__31bf3856ad364e35\WindowsBase.dll
- 2008-12-13 09:47:37 81,920 —-a-w c:\windows\assembly\GAC_MSIL\WindowsFormsIntegration\3.0.0.0__31bf3856ad364e35\WindowsFormsIntegration.dll
+ 2009-03-30 10:47:00 94,208 —-a-w c:\windows\assembly\GAC_MSIL\WindowsFormsIntegration\3.0.0.0__31bf3856ad364e35\WindowsFormsIntegration.dll
+ 2009-03-30 10:51:20 25,600 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Accessibility\11eb4f6606ba01e5128805759121ea6c\Accessibility.ni.dll
+ 2009-03-30 13:58:25 842,240 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\b5b2feadc3943e3976daebc0bcd2b5e2\AspNetMMCExt.ni.dll
+ 2009-03-30 13:58:11 410,112 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\12629e2f3e315459bee67cbbaac85cb2\ComSvcConfig.ni.exe
+ 2009-03-30 13:58:48 220,672 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\9bea05938bee3555c5aa8763d89a68f9\CustomMarshalers.ni.dll
+ 2009-03-30 13:58:43 14,336 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\dfsvc\f4e38208e88cb4cc314a1d6543b9fcc6\dfsvc.ni.exe
+ 2009-04-02 09:11:03 57,856 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\DriversHQ.DriverDet#\0c3687c431b090b643b9cc774a070311\DriversHQ.DriverDetective.ExceptionLogging.ni.dll
+ 2009-04-02 09:11:01 3,406,848 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\DriversHQ.DriverDet#\26c693903aa62801a26ee7b5fc42a2dd\DriversHQ.DriverDetective.Client.ni.exe
+ 2009-04-02 09:11:02 233,472 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\DriversHQ.DriverDet#\34031dcbf400dee07dc3907790925717\DriversHQ.DriverDetective.Common.ni.dll
+ 2009-04-02 09:11:03 46,080 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\DriversHQ.DriverDet#\738c345666c0dbd20532315daa8e1d22\DriversHQ.DriverDetective.Client.DirectX.ni.dll
+ 2009-04-02 09:11:02 268,800 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\DriversHQ.DriverDet#\8c9a2a30b4e78ed0002eb41dca119157\DriversHQ.DriverDetective.Client.Communication.ni.dll
+ 2009-03-30 13:58:35 228,864 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Applicati#\e12b9d2ceec5bc574a22c6ca2b798d5a\Microsoft.ApplicationBlocks.Updater.ni.dll
+ 2009-03-30 13:58:49 222,720 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Con#\9b321ebf67587237f576df6104a32588\Microsoft.Build.Conversion.v3.5.ni.dll
+ 2009-03-30 13:58:47 1,888,768 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\6cfe582681724965fb817e8ece5f0909\Microsoft.Build.Engine.ni.dll
+ 2009-03-30 13:58:51 839,680 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\96825c34d7e1f7df1923ff2123bed8da\Microsoft.Build.Engine.ni.dll
+ 2009-03-30 13:58:45 74,752 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\28343d470d992f169ca0e7cdb3cc3117\Microsoft.Build.Framework.ni.dll
+ 2009-03-30 10:51:54 65,024 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\e9aba2eab90d647356f65e66053da02b\Microsoft.Build.Framework.ni.dll
+ 2009-03-30 13:58:57 1,966,080 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\a47100d8f4574bed2d49d83d0ab8964e\Microsoft.Build.Tasks.v3.5.ni.dll
+ 2009-03-30 13:58:54 1,620,992 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\bd241492d96db39f20e758c13c845033\Microsoft.Build.Tasks.ni.dll
+ 2009-03-30 13:58:58 175,104 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\4217124db1ea5de5f1a1f3eea75e8d32\Microsoft.Build.Utilities.v3.5.ni.dll
+ 2009-03-30 10:51:53 144,384 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\55b9eff9e23359faed4351386c062238\Microsoft.Build.Utilities.ni.dll
+ 2009-03-30 13:58:40 2,332,160 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.JScript\b261961046545831aa60963e84905968\Microsoft.JScript.ni.dll
+ 2009-03-30 13:58:36 309,248 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Practices#\4d108d28b77102331431221db386e830\Microsoft.Practices.EnterpriseLibrary.Common.ni.dll
+ 2009-03-30 13:58:42 148,480 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Practices#\bdb5091c1411c8abdcd0b98d35200ebd\Microsoft.Practices.EnterpriseLibrary.Security.Cryptography.ni.dll
+ 2009-03-30 13:58:41 304,128 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Practices#\ebb614fa2f067e418a4219f3bed05a64\Microsoft.Practices.ObjectBuilder.ni.dll
+ 2009-03-30 13:58:15 386,560 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\1820d6a012fc0e16c3e1d29d973cd2d0\Microsoft.Transactions.Bridge.Dtc.ni.dll
+ 2009-03-30 13:58:13 1,093,120 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\6b2f62f5e981913fce1d223f645d9ddf\Microsoft.Transactions.Bridge.ni.dll
+ 2009-03-30 13:59:00 1,712,128 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\1c86afc399d0fdd8e069266ffbe748d1\Microsoft.VisualBasic.ni.dll
+ 2009-03-30 10:51:22 15,872 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualC\ec83ec80653eb20ccc6ed42075c90aee\Microsoft.VisualC.ni.dll
+ 2009-03-30 13:58:41 55,296 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Vsa\790cf1edb17ee41b59be62ecbd59613b\Microsoft.Vsa.ni.dll
+ 2009-03-30 13:58:45 133,632 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\MSBuild\6d38e317128608bc4516ea46ab94590e\MSBuild.ni.exe
+ 2009-03-30 10:50:07 11,486,720 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\6d667f19d687361886990f3ca0f49816\mscorlib.ni.dll
+ 2009-03-30 10:51:52 1,451,008 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationBuildTa#\e634bc4c4a00635a0a254febab0e2e2c\PresentationBuildTasks.ni.dll
+ 2009-03-30 10:51:50 39,424 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCFFRast#\c8fd2d9233f8ea3031fb16f697635231\PresentationCFFRasterizer.ni.dll
+ 2009-03-30 10:51:48 12,216,320 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\956375d487cbef36165b3250030e3574\PresentationCore.ni.dll
+ 2009-03-30 10:50:45 47,104 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\2d7408a0232f2e2efd0d7adf5dfa733a\PresentationFontCache.ni.exe
+ 2009-03-30 10:53:25 258,048 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\2c980c9a5051d723c6ec2a78a3d0e2b3\PresentationFramework.Royale.ni.dll
+ 2009-03-30 10:53:21 368,128 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\59a67874d8d8475faa5be1d993083d12\PresentationFramework.Aero.ni.dll
+ 2009-03-30 10:53:24 539,648 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\8003abaf6bcf70f7eb620d06837e897b\PresentationFramework.Luna.ni.dll
+ 2009-03-30 10:52:24 14,327,808 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\96e710f47c601cba3f2348a8d11ddede\PresentationFramework.ni.dll
+ 2009-03-30 10:53:23 224,768 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\f475294d8c7dc2dd4febeef27bc0417e\PresentationFramework.Classic.ni.dll
+ 2009-03-30 10:52:29 1,657,856 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationUI\6bafb1a2a73794ddb9761cb321c9e7e2\PresentationUI.ni.dll
+ 2009-03-30 10:52:33 2,128,896 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\ReachFramework\4bfb3048bf200a6a8592d1b4ba861a7f\ReachFramework.ni.dll
+ 2009-03-30 13:58:16 320,512 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\ServiceModelReg\10a0c9707876fc1f65e64b811a28b020\ServiceModelReg.ni.exe
+ 2009-03-30 13:58:17 256,000 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\SMDiagnostics\9790551187e294b4ed3aaa1c221891c7\SMDiagnostics.ni.dll
+ 2009-03-30 13:58:19 366,080 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\SMSvcHost\045dd501b7257b1cc26083538ae69045\SMSvcHost.ni.exe
+ 2009-03-30 14:45:58 232,448 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\sysglobl\45067d0793a09d3431d26bfa55c5a76a\sysglobl.ni.dll
+ 2009-03-30 13:59:03 82,944 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.AddIn.Contra#\597b20e1b053d6a510cfe033c07a63e6\System.AddIn.Contract.ni.dll
+ 2009-03-30 13:59:02 633,856 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.AddIn\ce984d754e3c0b6be4504b785cc43574\System.AddIn.ni.dll
+ 2009-03-30 13:59:04 94,208 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.ComponentMod#\532438e2acfcadc469a4d468c51f8451\System.ComponentModel.DataAnnotations.ni.dll
+ 2009-03-30 10:51:03 141,312 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\de514e484e49b04b016949d57ffac03e\System.Configuration.Install.ni.dll
+ 2009-03-30 10:50:49 971,264 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\b82c00e2d24305ad6cb08556e3779b75\System.Configuration.ni.dll
+ 2009-03-30 10:53:30 2,295,296 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Core\47d87251e93256c635eb73403b8db33e\System.Core.ni.dll
+ 2009-03-30 13:59:05 135,680 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.DataSet#\1db495ff00bbd14df4af6680c4de0653\System.Data.DataSetExtensions.ni.dll
+ 2009-03-30 14:45:38 756,736 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Entity.#\392de34573f9f8ec885714f2f3e7f07f\System.Data.Entity.Design.ni.dll
+ 2009-03-30 14:45:35 9,924,096 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Entity\6479f975b105808a8d9e7a7fdc762551\System.Data.Entity.ni.dll
+ 2009-03-30 10:53:37 2,516,480 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Linq\0bbec79460b1137df5313f9baf7b246f\System.Data.Linq.ni.dll
+ 2009-03-30 10:53:19 1,115,136 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.OracleC#\283ecfbaa6a6fab76c8b544a4a89d5ce\System.Data.OracleClient.ni.dll
+ 2009-03-30 14:45:45 354,816 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\1cf3acad6553d6c59df576794f4e8bd6\System.Data.Services.Design.ni.dll
+ 2009-03-30 14:45:44 939,008 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\a4b887f476fa4b8746a93a9fc2208560\System.Data.Services.Client.ni.dll
+ 2009-03-30 14:45:42 1,328,128 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Services\956a513dcbd44d5a6801840ef2b0b47b\System.Data.Services.ni.dll
+ 2009-03-30 10:51:01 2,510,336 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.SqlXml\826b09ab0d0e36f4d631b4cd335df511\System.Data.SqlXml.ni.dll
+ 2009-03-30 10:52:44 6,616,576 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data\c70731047b0022638b3f9fb158948a03\System.Data.ni.dll
+ 2009-03-30 10:51:22 1,801,216 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Deployment\a6b58624486714fa71e5e35186850ff0\System.Deployment.ni.dll
+ 2009-03-30 10:53:16 10,683,392 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Design\8ee220bc3cce4f7bbd7818946519ed7f\System.Design.ni.dll
+ 2009-03-30 10:52:36 1,116,672 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\543aced762f6b0c3f8e037955941afc6\System.DirectoryServices.ni.dll
+ 2009-03-30 14:45:47 881,152 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\8b3bb7a2c2f3ffe94c866283f1cd5957\System.DirectoryServices.AccountManagement.ni.dll
+ 2009-03-30 10:53:20 455,680 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\c434a07332ce490711c27fd0edb7562f\System.DirectoryServices.Protocols.ni.dll
+ 2009-03-30 10:53:17 208,384 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing.Desi#\18bbe2b6717e7f1d1dd672526e9889ee\System.Drawing.Design.ni.dll
+ 2009-03-30 10:51:05 1,587,200 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\3da96ee075bab9202626ae44c18d226c\System.Drawing.ni.dll
+ 2009-03-30 10:52:47 627,712 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\4267bd908175603006c6c90bb5d900c7\System.EnterpriseServices.ni.dll
+ 2009-03-30 10:52:47 280,064 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\4267bd908175603006c6c90bb5d900c7\System.EnterpriseServices.Wrapper.dll
+ 2009-03-30 13:57:26 212,992 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.IdentityMode#\68e71147704ef0d34d9a4bece7767fc5\System.IdentityModel.Selectors.ni.dll
+ 2009-03-30 13:57:25 1,056,768 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\c2de8479e54852f56996f79bc93acb13\System.IdentityModel.ni.dll
+ 2009-03-30 13:57:28 381,440 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.IO.Log\7c367a96b10d626ec8cbf8149272d845\System.IO.Log.ni.dll
+ 2009-03-30 14:45:48 330,752 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Management.I#\1d3fbbd23ce1e8637ef4f40a8d23cd32\System.Management.Instrumentation.ni.dll
+ 2009-03-30 13:58:37 998,400 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Management\8642fdfbf02a6cb6f01169fe6fdb5d11\System.Management.ni.dll
+ 2009-03-30 14:46:33 593,408 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Messaging\f48e3419fb2cb012fd160ae801600ae7\System.Messaging.ni.dll
+ 2009-03-30 14:45:49 621,056 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Net\519d9c618341b136f9b963ffb7495308\System.Net.ni.dll
+ 2009-03-30 10:52:35 1,035,264 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Printing\646ab52eef343380aa002c220dc31e13\System.Printing.ni.dll
+ 2009-03-30 10:52:48 771,584 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\2abd876a3c8a6b088fa6d8d39d901e3c\System.Runtime.Remoting.ni.dll
+ 2009-03-30 13:57:33 2,338,304 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\034c91b133dee73d452652c52767b5ea\System.Runtime.Serialization.ni.dll
+ 2009-03-30 10:51:03 311,296 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\bfd6e16d8c3589cd2bd3f8d46f0a5402\System.Runtime.Serialization.Formatters.Soap.ni.dll
+ 2009-03-30 10:51:02 676,352 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Security\1c8df2da33222c048d683017f2095f04\System.Security.ni.dll
+ 2009-03-30 14:45:54 1,706,496 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel#\340cad17fe57947eacbc8fa2cea780da\System.ServiceModel.Web.ni.dll
+ 2009-03-30 13:58:08 17,317,888 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\4146033013edebd7e0cb604e504ebfee\System.ServiceModel.ni.dll
+ 2009-03-30 10:50:47 212,992 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\ea3366939280c1715f1c620e33ee3c8a\System.ServiceProcess.ni.dll
+ 2009-03-30 14:45:57 1,917,440 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Speech\63cf639b6e0a3c25c1643c85016e7422\System.Speech.ni.dll
+ 2009-03-30 10:52:46 627,200 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\5a555c9ae6984c40157cf940bb519f7c\System.Transactions.ni.dll
+ 2009-03-30 14:45:59 141,312 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Abstract#\00ec08741a765c707bd9169346064a81\System.Web.Abstractions.ni.dll
+ 2009-03-30 14:46:06 36,864 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\19ca1747c1ea18a3b639b302bca8df93\System.Web.DynamicData.Design.ni.dll
+ 2009-03-30 14:46:05 547,328 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\b7891f5659db299dbd1b3c72db7edb9f\System.Web.DynamicData.ni.dll
+ 2009-03-30 14:46:08 301,056 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity.D#\d3d65e34fa60f0b6c72ca0d12ec89933\System.Web.Entity.Design.ni.dll
+ 2009-03-30 14:46:07 328,704 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity\79c29ac85dd57dd485ab60118ac292ff\System.Web.Entity.ni.dll
+ 2009-03-30 14:46:10 859,648 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\58f62044fa702ea6f936071aa5520baa\System.Web.Extensions.Design.ni.dll
+ 2009-03-30 14:46:03 2,403,328 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\7f64c9d25471b72e1e957bdfe67947c8\System.Web.Extensions.ni.dll
+ 2009-03-30 14:46:13 2,209,280 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\81197e32ec931f439b3114e9031b65d6\System.Web.Mobile.ni.dll
+ 2009-03-30 10:53:19 202,240 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\6ee255220d90dcbe80c990e443051cc5\System.Web.RegularExpressions.ni.dll
+ 2009-03-30 14:46:00 129,536 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Routing\bb77ea11f46ab438b2b7ed7c180011a1\System.Web.Routing.ni.dll
+ 2009-03-30 10:53:05 1,840,640 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\b57bb002a655920cbfa2bee29d1e22b7\System.Web.Services.ni.dll
+ 2009-03-30 10:53:00 11,796,992 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web\3963ce03d445a8619abbf388d590134b\System.Web.ni.dll
+ 2009-03-30 10:51:19 12,430,848 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\63406259e94d5c0ff5b79401dfe113ce\System.Windows.Forms.ni.dll
+ 2009-03-30 14:46:17 37,888 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Pres#\423f794d1f4ed6e120fbb02e436491cb\System.Windows.Presentation.ni.dll
+ 2009-03-30 14:46:22 2,992,640 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Act#\cc99fbbac0b6e4e9ca62093e49b0c16b\System.Workflow.Activities.ni.dll
+ 2009-03-30 14:46:28 4,514,304 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Com#\693a8fbe6f7ad6e4e429052da4317e59\System.Workflow.ComponentModel.ni.dll
+ 2009-03-30 14:46:32 1,908,224 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Run#\d265da36954fcb4cb7ad5adc693ea0f2\System.Workflow.Runtime.ni.dll
+ 2009-03-30 14:46:38 1,356,288 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.WorkflowServ#\ac1750e78d79520dcf19195772eff1b6\System.WorkflowServices.ni.dll
+ 2009-03-30 14:46:39 400,896 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml.Linq\c338a470b14851ce5987bb0f0869c310\System.Xml.Linq.ni.dll
+ 2009-03-30 10:50:56 5,450,752 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\773a9786013451d3baaeff003dc4230f\System.Xml.ni.dll
+ 2009-03-30 10:50:42 7,868,416 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System\80978a322d7dd39f0a71be1251ae395a\System.ni.dll
+ 2009-03-30 10:49:00 1,530,880 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP1D0.tmp\System.Drawing.dll
+ 2009-03-30 10:53:39 447,488 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClient\5c028c3d8db6c0f0277673ea4a2d89fb\UIAutomationClient.ni.dll
+ 2009-03-30 10:53:41 1,049,600 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClients#\f3c7957351aec85f526a3350c9718b1e\UIAutomationClientsideProviders.ni.dll
+ 2009-03-30 10:51:49 60,928 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationProvider\a715aa442ef87ae99b3ade185599249d\UIAutomationProvider.ni.dll
+ 2009-03-30 10:51:50 187,904 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationTypes\a6d9503962d47c722231c1478f180695\UIAutomationTypes.ni.dll
+ 2009-03-30 10:51:27 3,313,664 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\14cd5f4b61d35f9b76327d6be9853755\WindowsBase.ni.dll
+ 2009-03-30 10:53:43 240,128 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\6a818099f0386e2356ae94f886a2196f\WindowsFormsIntegration.ni.dll
+ 2009-03-30 13:58:20 321,536 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\WsatConfig\2ef5bc3a2edd7570bb23886a4f32294a\WsatConfig.ni.exe
+ 2009-03-30 13:58:42 119,296 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\XPBurnComponent\99e485e0c3eb0435c1282ad4ef40b385\XPBurnComponent.ni.dll
+ 2008-07-06 12:06:10 89,088 ——w c:\windows\Driver Cache\i386\filterpipelineprintproc.dll
+ 2008-07-06 12:06:10 765,440 ——w c:\windows\Driver Cache\i386\mxdwdrv.dll
+ 2008-07-06 12:06:10 198,656 ——w c:\windows\Driver Cache\i386\mxdwdui.dll
+ 2008-07-06 12:06:10 373,248 ——w c:\windows\Driver Cache\i386\unidrv.dll
+ 2008-07-06 12:06:10 744,960 ——w c:\windows\Driver Cache\i386\unidrvui.dll
+ 2008-03-13 04:52:36 761,344 ——w c:\windows\Driver Cache\i386\unires.dll
+ 2005-10-20 11:02:28 163,328 —-a-w c:\windows\ERDNT\02-04-2009\ERDNT.EXE
+ 2009-04-02 07:50:22 53,567,488 —-a-w c:\windows\ERDNT\02-04-2009\Users\00000001\NTUSER.DAT
+ 2009-04-02 07:50:22 253,952 —-a-w c:\windows\ERDNT\02-04-2009\Users\00000002\UsrClass.dat
+ 2008-08-07 14:27:04 163,328 —-a-w c:\windows\ERUNT\SDFIX\ERDNT.EXE
+ 2009-04-02 16:21:39 53,665,792 —-a-w c:\windows\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
+ 2009-04-02 16:21:39 253,952 —-a-w c:\windows\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2008-08-07 14:27:04 163,328 —-a-w c:\windows\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2009-04-02 16:21:07 53,665,792 —-a-w c:\windows\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT
+ 2009-04-02 16:21:07 253,952 —-a-w c:\windows\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
+ 2008-10-16 20:38:34 124,928 -c—-w c:\windows\ie7updates\KB961260-IE7\advpack.dll
+ 2008-10-16 20:38:34 347,136 -c—-w c:\windows\ie7updates\KB961260-IE7\dxtmsft.dll
+ 2008-10-16 20:38:34 214,528 -c—-w c:\windows\ie7updates\KB961260-IE7\dxtrans.dll
+ 2008-10-16 20:38:35 133,120 -c—-w c:\windows\ie7updates\KB961260-IE7\extmgr.dll
+ 2008-10-16 20:38:35 63,488 -c—-w c:\windows\ie7updates\KB961260-IE7\icardie.dll
+ 2009-03-26 19:49:00 70,656 -c—-w c:\windows\ie7updates\KB961260-IE7\ie4uinit.exe
+ 2008-10-16 20:38:35 153,088 -c—-w c:\windows\ie7updates\KB961260-IE7\ieakeng.dll
+ 2008-10-16 20:38:35 230,400 -c—-w c:\windows\ie7updates\KB961260-IE7\ieaksie.dll
+ 2008-10-15 07:04:53 161,792 -c—-w c:\windows\ie7updates\KB961260-IE7\ieakui.dll
+ 2008-10-16 20:38:35 383,488 -c—-w c:\windows\ie7updates\KB961260-IE7\ieapfltr.dll
+ 2008-10-16 20:38:35 384,512 -c—-w c:\windows\ie7updates\KB961260-IE7\iedkcs32.dll
+ 2008-10-16 20:38:37 6,066,176 -c—-w c:\windows\ie7updates\KB961260-IE7\ieframe.dll
+ 2008-10-16 20:38:37 44,544 -c—-w c:\windows\ie7updates\KB961260-IE7\iernonce.dll
+ 2008-10-16 20:38:37 267,776 -c—-w c:\windows\ie7updates\KB961260-IE7\iertutil.dll
+ 2009-03-26 19:43:34 14,336 -c—-w c:\windows\ie7updates\KB961260-IE7\ieudinit.exe
+ 2008-10-15 07:06:26 633,632 -c—-w c:\windows\ie7updates\KB961260-IE7\iexplore.exe
+ 2008-10-16 20:38:37 27,648 -c—-w c:\windows\ie7updates\KB961260-IE7\jsproxy.dll
+ 2008-10-16 20:38:37 459,264 -c—-w c:\windows\ie7updates\KB961260-IE7\msfeeds.dll
+ 2008-10-16 20:38:37 52,224 -c—-w c:\windows\ie7updates\KB961260-IE7\msfeedsbs.dll
+ 2008-10-17 02:08:40 3,593,216 -c—-w c:\windows\ie7updates\KB961260-IE7\mshtml.dll
+ 2008-10-16 20:38:38 477,696 -c—-w c:\windows\ie7updates\KB961260-IE7\mshtmled.dll
+ 2008-10-16 20:38:38 193,024 -c—-w c:\windows\ie7updates\KB961260-IE7\msrating.dll
+ 2008-10-16 20:38:39 671,232 -c—-w c:\windows\ie7updates\KB961260-IE7\mstime.dll
+ 2008-10-16 20:38:39 102,912 -c—-w c:\windows\ie7updates\KB961260-IE7\occache.dll
+ 2008-10-16 20:38:39 44,544 -c—-w c:\windows\ie7updates\KB961260-IE7\pngfilt.dll
+ 2007-03-06 01:22:41 213,216 -c—-w c:\windows\ie7updates\KB961260-IE7\spuninst\spuninst.exe
+ 2007-03-06 01:23:51 371,424 -c—-w c:\windows\ie7updates\KB961260-IE7\spuninst\updspapi.dll
+ 2008-10-16 20:38:39 105,984 -c—-w c:\windows\ie7updates\KB961260-IE7\url.dll
+ 2008-10-16 20:38:39 1,160,192 -c—-w c:\windows\ie7updates\KB961260-IE7\urlmon.dll
+ 2008-10-16 20:38:39 233,472 -c—-w c:\windows\ie7updates\KB961260-IE7\webcheck.dll
+ 2008-10-16 20:38:40 826,368 -c—-w c:\windows\ie7updates\KB961260-IE7\wininet.dll
- 2008-12-13 09:52:02 1,165,584 —-a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\accicons.exe
+ 2009-03-30 10:51:34 1,165,584 —-a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\accicons.exe
- 2008-12-13 09:52:02 20,240 —-a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\cagicon.exe
+ 2009-03-30 10:51:35 20,240 —-a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\cagicon.exe
- 2008-12-13 09:52:02 159,504 —-a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\inficon.exe
+ 2009-03-30 10:51:34 159,504 —-a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\inficon.exe
- 2008-12-13 09:52:02 184,080 —-a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\joticon.exe
+ 2009-03-30 10:51:34 184,080 —-a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\joticon.exe
- 2008-12-13 09:52:02 217,864 —-a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\misc.exe
+ 2009-03-30 10:51:35 217,864 —-a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\misc.exe
- 2008-12-13 09:52:02 18,704 —-a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\mspicons.exe
+ 2009-03-30 10:51:35 18,704 —-a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\mspicons.exe
- 2008-12-13 09:52:03 35,088 —-a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\oisicon.exe
+ 2009-03-30 10:51:35 35,088 —-a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\oisicon.exe
- 2008-12-13 09:52:02 845,584 —-a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe
+ 2009-03-30 10:51:34 845,584 —-a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe
- 2008-12-13 09:52:02 922,384 —-a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pptico.exe
+ 2009-03-30 10:51:34 922,384 —-a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pptico.exe
- 2008-12-13 09:52:02 272,648 —-a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pubs.exe
+ 2009-03-30 10:51:35 272,648 —-a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pubs.exe
- 2008-12-13 09:52:03 888,080 —-a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\wordicon.exe
+ 2009-03-30 10:51:35 888,080 —-a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\wordicon.exe
- 2008-12-13 09:52:02 1,172,240 —-a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\xlicons.exe
+ 2009-03-30 10:51:34 1,172,240 —-a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\xlicons.exe
- 2007-10-24 01:47:38 82,944 —-a-w c:\windows\Microsoft.NET\Framework\NETFXSBS10.exe
+ 2008-07-25 10:16:58 82,944 —-a-w c:\windows\Microsoft.NET\Framework\NETFXSBS10.exe
- 2007-10-24 01:47:38 16,896 —-a-w c:\windows\Microsoft.NET\Framework\sbscmp10.dll
+ 2008-07-25 10:16:58 16,896 —-a-w c:\windows\Microsoft.NET\Framework\sbscmp10.dll
- 2007-10-24 01:47:40 16,896 —-a-w c:\windows\Microsoft.NET\Framework\sbscmp20_mscorwks.dll
+ 2008-07-25 10:17:02 16,896 —-a-w c:\windows\Microsoft.NET\Framework\sbscmp20_mscorwks.dll
- 2007-10-24 01:47:42 16,896 —-a-w c:\windows\Microsoft.NET\Framework\sbscmp20_perfcounter.dll
+ 2008-07-25 10:17:02 16,896 —-a-w c:\windows\Microsoft.NET\Framework\sbscmp20_perfcounter.dll
- 2007-10-24 01:47:40 16,896 —-a-w c:\windows\Microsoft.NET\Framework\SharedReg12.dll
+ 2008-07-25 10:17:02 16,896 —-a-w c:\windows\Microsoft.NET\Framework\SharedReg12.dll
- 2007-10-24 01:47:38 97,280 —-a-w c:\windows\Microsoft.NET\Framework\v1.0.3705\mscormmc.dll
+ 2008-07-25 10:16:58 96,768 —-a-w c:\windows\Microsoft.NET\Framework\v1.0.3705\mscormmc.dll
- 2007-10-24 01:47:26 28,672 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\alinkui.dll
+ 2008-07-25 10:16:42 28,672 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\alinkui.dll
- 2007-10-24 01:47:30 145,408 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\cscompui.dll
+ 2008-07-25 10:16:48 145,408 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\cscompui.dll
- 2007-10-24 01:47:32 13,824 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\CvtResUI.dll
+ 2008-07-25 10:16:50 13,824 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\CvtResUI.dll
- 2007-10-24 01:47:48 193,016 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\vbc7ui.dll
+ 2008-07-25 10:17:10 193,016 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\vbc7ui.dll
- 2007-10-24 01:47:20 218,112 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\Vsavb7rtUI.dll
+ 2008-07-25 10:16:36 218,112 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\Vsavb7rtUI.dll
- 2007-10-24 01:47:40 10,752 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Accessibility.dll
+ 2008-07-25 10:17:00 10,752 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Accessibility.dll
- 2007-10-24 01:47:42 147,968 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\AdoNetDiag.dll
+ 2008-07-25 10:17:02 147,968 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\AdoNetDiag.dll
- 2007-10-24 01:47:26 99,320 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\alink.dll
+ 2008-07-25 10:16:44 98,808 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\alink.dll
- 2007-10-24 01:47:42 59,392 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
+ 2008-07-25 10:17:02 58,880 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
- 2009-03-28 08:23:36 36,864 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
+ 2008-07-25 10:16:40 36,864 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
- 2007-10-24 01:47:22 22,024 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_filter.dll
+ 2008-07-25 10:16:40 22,024 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_filter.dll
- 2007-10-24 01:47:22 17,928 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll
+ 2008-07-25 10:16:40 17,416 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll
- 2007-10-24 01:47:22 33,288 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Aspnet_perf.dll
+ 2008-07-25 10:16:40 33,800 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Aspnet_perf.dll
- 2007-10-24 01:47:22 84,480 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_rc.dll
+ 2008-07-25 10:16:38 84,480 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_rc.dll
- 2009-03-28 08:23:37 24,576 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe
+ 2008-07-25 10:16:40 24,576 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe
- 2007-10-24 01:47:22 32,776 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe
+ 2008-07-25 10:16:40 33,288 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe
- 2009-03-28 08:23:38 106,496 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe
+ 2008-07-25 10:16:40 106,496 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe
- 2007-10-24 01:47:22 33,800 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
+ 2008-07-25 10:16:40 34,312 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
- 2007-10-24 01:47:22 33,280 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe
+ 2008-11-25 03:59:18 31,560 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe
- 2007-10-24 01:47:22 507,904 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\AspNetMMCExt.dll
+ 2008-07-25 10:16:40 507,904 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\AspNetMMCExt.dll
- 2009-03-28 08:23:40 106,496 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
+ 2008-07-25 10:17:00 106,496 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
- 2007-10-24 01:47:40 101,896 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\CORPerfMonExt.dll
+ 2008-07-25 10:17:00 89,608 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\CORPerfMonExt.dll
- 2007-10-24 01:47:30 80,376 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
+ 2008-07-25 10:16:50 80,376 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
- 2007-10-24 01:47:30 1,162,744 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\cscomp.dll
+ 2008-07-25 10:16:50 1,163,768 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\cscomp.dll
- 2007-10-24 01:47:30 13,312 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\cscompmgd.dll
+ 2008-07-25 10:16:50 13,312 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\cscompmgd.dll
- 2007-10-24 01:47:42 27,136 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
+ 2008-07-25 10:17:02 27,136 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
- 2007-10-24 01:47:40 69,120 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\CustomMarshalers.dll
+ 2008-07-25 10:17:00 69,120 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\CustomMarshalers.dll
- 2007-10-24 01:47:30 35,320 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
+ 2008-07-25 10:16:50 35,320 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
- 2007-10-24 01:47:28 66,552 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\dfdll.dll
+ 2008-07-25 10:16:46 62,968 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\dfdll.dll
- 2009-03-28 08:23:41 5,632 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe
+ 2008-07-25 10:16:46 5,120 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe
- 2007-10-24 01:47:54 572,936 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll
+ 2008-07-25 10:17:16 575,496 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll
- 2007-10-24 01:47:40 798,224 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll
+ 2008-07-25 10:17:00 798,224 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll
- 2007-10-24 01:47:36 18,936 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\fusion.dll
+ 2008-07-25 10:16:58 18,936 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\fusion.dll
- 2009-03-28 08:23:44 9,728 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe
+ 2008-07-25 10:17:00 9,728 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe
- 2007-10-24 01:47:40 8,192 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\IEExecRemote.dll
+ 2008-07-25 10:17:02 8,192 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\IEExecRemote.dll
- 2007-10-24 01:47:40 77,824 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\IEHost.dll
+ 2008-07-25 10:17:00 77,824 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\IEHost.dll
- 2007-10-24 01:47:40 6,656 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\IIEHost.dll
+ 2008-07-25 10:17:00 6,656 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\IIEHost.dll
- 2007-10-24 01:47:40 230,904 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe
+ 2008-07-25 10:17:00 230,904 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe
- 2009-03-28 08:23:45 28,672 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
+ 2008-07-25 10:17:00 28,672 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
- 2007-10-24 01:47:40 65,032 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\InstallUtilLib.dll
+ 2008-07-25 10:17:00 65,032 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\InstallUtilLib.dll
- 2007-10-24 01:47:40 72,192 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\ISymWrapper.dll
+ 2008-07-25 10:17:00 72,192 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\ISymWrapper.dll
- 2009-03-28 08:23:47 40,960 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe
+ 2008-07-25 10:16:54 40,960 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe
- 2007-10-24 01:47:36 348,160 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Engine.dll
+ 2008-07-25 10:16:56 348,160 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Engine.dll
- 2007-10-24 01:47:36 36,864 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Framework.dll
+ 2008-07-25 10:16:56 36,864 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Framework.dll
- 2007-10-24 01:47:36 655,360 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Tasks.dll
+ 2008-07-25 10:16:56 655,360 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Tasks.dll
- 2007-10-24 01:47:36 77,824 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Utilities.dll
+ 2008-07-25 10:16:56 77,824 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Utilities.dll
- 2007-10-24 01:47:34 749,568 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.JScript.dll
+ 2008-07-25 10:16:54 749,568 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.JScript.dll
- 2007-10-24 01:47:52 110,592 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Compatibility.Data.dll
+ 2008-07-25 10:17:14 110,592 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Compatibility.Data.dll
- 2007-10-24 01:47:52 372,736 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Compatibility.dll
+ 2008-07-25 10:17:14 372,736 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Compatibility.dll
- 2007-10-24 01:47:50 671,744 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.dll
+ 2008-07-25 10:17:12 659,456 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.dll
- 2007-10-24 01:47:20 28,672 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Vsa.dll
+ 2008-07-25 10:16:38 28,672 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Vsa.dll
- 2007-10-24 01:47:52 5,632 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualC.Dll
+ 2008-07-25 10:17:16 5,632 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualC.Dll
- 2007-10-24 01:47:20 32,768 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.dll
+ 2008-07-25 10:16:38 32,768 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.dll
- 2007-10-24 01:47:20 12,800 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
+ 2008-07-25 10:16:38 12,800 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
- 2007-10-24 01:47:20 7,168 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft_VsaVb.dll
+ 2008-07-25 10:16:38 7,168 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft_VsaVb.dll
- 2007-10-24 01:47:22 97,792 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\MmcAspExt.dll
+ 2008-07-25 10:16:40 97,792 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\MmcAspExt.dll
- 2009-03-28 08:23:49 69,632 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
+ 2008-07-25 10:16:56 69,632 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
- 2007-10-24 01:47:40 822,280 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscordacwks.dll
+ 2008-11-25 03:59:40 990,032 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscordacwks.dll
- 2007-10-24 01:47:40 83,456 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscordbc.dll
+ 2008-07-25 10:17:00 83,456 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscordbc.dll
- 2007-10-24 01:47:40 308,224 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscordbi.dll
+ 2008-07-25 10:17:00 308,224 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscordbi.dll
- 2007-10-24 01:47:40 47,104 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorie.dll
+ 2008-07-25 10:17:00 46,592 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorie.dll
- 2007-10-24 01:47:40 348,672 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
+ 2008-11-25 03:59:40 364,872 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
- 2007-10-24 01:47:40 94,208 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorld.dll
+ 2008-07-25 10:17:00 94,208 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorld.dll
- 2007-10-24 01:47:40 4,444,160 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll
+ 2008-11-25 03:59:40 4,546,560 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll
- 2007-10-24 01:47:40 114,688 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorpe.dll
+ 2008-07-25 10:17:00 114,176 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorpe.dll
- 2007-10-24 01:47:44 340,992 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll
+ 2008-07-25 10:17:04 345,600 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll
- 2007-10-24 01:47:40 77,312 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll
+ 2008-07-25 10:17:00 77,312 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll
- 2007-10-24 01:47:36 18,944 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsn.dll
+ 2008-07-25 10:16:58 18,944 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsn.dll
- 2007-10-24 01:47:40 242,688 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvc.dll
+ 2008-07-25 10:17:02 230,912 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvc.dll
- 2007-10-24 01:47:40 70,144 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
+ 2008-07-25 10:17:02 69,632 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
- 2007-10-24 01:47:40 19,456 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscortim.dll
+ 2008-07-25 10:17:02 19,456 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscortim.dll
- 2007-10-24 01:47:36 5,814,784 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
+ 2008-11-25 03:59:36 5,813,576 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
- 2007-10-24 01:47:44 31,744 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\MUI\0409\mscorsecr.dll
+ 2008-07-25 10:17:04 31,744 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\MUI\0409\mscorsecr.dll
- 2007-10-24 01:47:40 101,880 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe
+ 2008-07-25 10:17:02 100,856 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe
- 2007-10-24 01:47:40 24,584 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\normalization.dll
+ 2008-07-25 10:17:02 24,584 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\normalization.dll
- 2007-10-24 01:47:40 89,096 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\PerfCounter.dll
+ 2008-07-25 10:17:02 88,584 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\PerfCounter.dll
- 2007-10-24 01:47:36 144,896 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\peverify.dll
+ 2008-07-25 10:16:58 143,360 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\peverify.dll
- 2009-03-28 08:23:52 53,248 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
+ 2008-07-25 10:17:00 53,248 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
- 2009-03-28 08:23:53 32,768 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
+ 2008-07-25 10:17:00 32,768 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
- 2007-10-24 01:47:46 61,952 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\regtlibv12.exe
+ 2008-07-25 10:17:06 61,952 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\regtlibv12.exe
- 2007-10-24 01:47:42 16,896 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\sbscmp20_mscorlib.dll
+ 2008-07-25 10:17:02 16,896 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\sbscmp20_mscorlib.dll
- 2007-10-24 01:47:40 119,296 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\shfusion.dll
+ 2008-07-25 10:17:00 118,784 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\shfusion.dll
- 2007-10-24 01:47:44 95,232 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\ShFusRes.dll
+ 2008-07-25 10:17:04 95,232 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\ShFusRes.dll
- 2007-10-24 01:47:40 392,696 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\SOS.dll
+ 2008-07-25 10:17:02 392,184 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\SOS.dll
- 2007-10-24 01:47:40 110,592 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\sysglobl.dll
+ 2008-07-25 10:17:02 110,592 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\sysglobl.dll
- 2007-10-24 01:47:42 425,984 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.configuration.dll
+ 2008-07-25 10:17:02 425,984 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.configuration.dll
- 2007-10-24 01:47:40 81,920 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Configuration.Install.dll
+ 2008-07-25 10:17:00 81,920 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Configuration.Install.dll
- 2007-10-24 01:47:40 3,036,160 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Data.dll
+ 2008-07-25 10:17:00 2,933,248 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Data.dll
- 2007-10-24 01:47:40 483,840 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Data.OracleClient.dll
+ 2008-11-25 03:59:40 486,400 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Data.OracleClient.dll
- 2007-10-24 01:47:40 741,376 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Data.SqlXml.dll
+ 2008-07-25 10:17:02 745,472 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Data.SqlXml.dll
- 2007-10-24 01:47:28 933,888 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Deployment.dll
+ 2008-07-25 10:16:46 970,752 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Deployment.dll
- 2007-10-24 01:47:40 5,070,848 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Design.dll
+ 2008-07-25 10:17:00 5,062,656 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Design.dll
- 2007-10-24 01:47:40 401,408 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.dll
+ 2008-07-25 10:17:00 401,408 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.dll
- 2007-10-24 01:47:40 188,416 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.Protocols.dll
+ 2008-07-25 10:17:02 188,416 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.Protocols.dll
- 2007-10-24 01:47:40 3,076,096 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.dll
+ 2008-07-25 10:17:00 3,149,824 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.dll
- 2007-10-24 01:47:40 81,920 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Drawing.Design.dll
+ 2008-07-25 10:17:00 81,920 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Drawing.Design.dll
- 2007-10-24 01:47:40 630,784 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Drawing.dll
+ 2008-07-25 10:17:00 626,688 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Drawing.dll
- 2007-10-24 01:47:40 258,048 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.dll
+ 2008-07-25 10:17:02 258,048 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.dll
- 2007-10-24 01:47:40 57,392 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Thunk.dll
+ 2008-07-25 10:17:02 57,392 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Thunk.dll
- 2007-10-24 01:47:40 113,664 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Wrapper.dll
+ 2008-07-25 10:17:02 113,664 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Wrapper.dll
- 2007-10-24 01:47:40 372,736 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Management.dll
+ 2008-07-25 10:17:00 372,736 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Management.dll
- 2007-10-24 01:47:40 258,048 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Messaging.dll
+ 2008-07-25 10:17:00 258,048 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Messaging.dll
- 2007-10-24 01:47:40 299,008 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Remoting.dll
+ 2008-07-25 10:17:00 303,104 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Remoting.dll
- 2007-10-24 01:47:40 131,072 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Serialization.Formatters.Soap.dll
+ 2008-07-25 10:17:00 131,072 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Serialization.Formatters.Soap.dll
- 2007-10-24 01:47:40 258,048 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Security.dll
+ 2008-07-25 10:17:00 258,048 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Security.dll
- 2007-10-24 01:47:40 114,688 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.ServiceProcess.dll
+ 2008-07-25 10:17:00 114,688 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.ServiceProcess.dll
- 2007-10-24 01:47:40 261,120 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Transactions.dll
+ 2008-07-25 10:17:02 261,632 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Transactions.dll
- 2007-10-24 01:47:40 5,431,296 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.dll
+ 2008-11-25 03:59:40 5,242,880 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.dll
- 2007-10-24 01:47:40 884,736 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.Mobile.dll
+ 2008-07-25 10:17:02 835,584 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.Mobile.dll
- 2007-10-24 01:47:40 90,112 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.RegularExpressions.dll
+ 2008-07-25 10:17:02 77,824 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.RegularExpressions.dll
- 2007-10-24 01:47:40 839,680 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.Services.dll
+ 2008-07-25 10:17:00 839,680 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.Services.dll
- 2007-10-24 01:47:40 5,013,504 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Windows.Forms.dll
+ 2008-07-25 10:17:00 5,025,792 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Windows.Forms.dll
- 2007-10-24 01:47:40 2,068,480 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.XML.dll
+ 2008-11-25 03:59:40 2,048,000 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.XML.dll
- 2007-10-24 01:47:40 81,400 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\TLBREF.DLL
+ 2008-07-25 10:17:02 81,400 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\TLBREF.DLL
- 2007-10-24 01:47:48 1,172,472 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
+ 2008-07-25 10:17:10 1,172,472 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
- 2007-10-24 01:47:20 1,344,000 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\VsaVb7rt.dll
+ 2008-07-25 10:16:38 1,344,000 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\VsaVb7rt.dll
- 2007-10-24 01:47:22 434,688 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\webengine.dll
+ 2008-11-25 03:59:18 436,040 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\webengine.dll
- 2007-10-24 01:47:40 37,896 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\WMINet_Utils.dll
+ 2008-07-25 10:17:02 37,896 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\WMINet_Utils.dll
- 2009-03-28 08:24:06 159,744 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe
+ 2008-07-29 18:16:38 168,968 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe
- 2009-03-26 19:43:18 864,256 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
+ 2008-07-29 18:24:50 881,664 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
- 2007-10-11 09:55:12 397,312 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\Microsoft.Transactions.Bridge.dll
+ 2008-07-29 18:16:38 397,312 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\Microsoft.Transactions.Bridge.dll
- 2007-10-11 09:55:12 151,552 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\Microsoft.Transactions.Bridge.Dtc.dll
+ 2008-07-29 18:16:38 163,840 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\Microsoft.Transactions.Bridge.Dtc.dll
- 2007-10-11 09:55:14 2,560 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelEvents.dll
+ 2008-07-29 18:16:38 11,280 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelEvents.dll
- 2009-03-28 08:24:07 61,440 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe
+ 2008-07-29 18:16:38 156,688 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe
- 2007-10-11 09:55:14 11,264 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceMonikerSupport.dll
+ 2008-07-29 18:16:38 20,504 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceMonikerSupport.dll
- 2007-10-11 09:55:14 102,400 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMDiagnostics.dll
+ 2008-07-29 18:16:38 110,592 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMdiagnostics.dll
- 2009-03-26 19:43:19 122,880 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
+ 2008-07-29 18:16:38 132,096 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
- 2007-10-11 09:55:14 929,792 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\System.Runtime.Serialization.dll
+ 2008-07-29 18:16:38 966,656 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\System.Runtime.Serialization.dll
- 2007-10-11 09:55:14 5,971,968 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\System.ServiceModel.dll
+ 2008-12-05 19:12:12 5,931,008 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\System.ServiceModel.dll
- 2007-10-11 09:55:14 159,744 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\System.ServiceModel.Install.dll
+ 2008-07-29 18:16:38 73,728 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\System.ServiceModel.Install.dll
- 2007-10-11 09:55:14 32,768 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\System.ServiceModel.WasHosting.dll
+ 2008-07-29 18:16:38 32,768 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\System.ServiceModel.WasHosting.dll
+ 2008-07-29 18:16:38 152,576 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe
- 2007-10-06 03:18:12 16,936 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\PerformanceCounterInstaller.exe
+ 2008-07-29 18:32:52 17,448 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\PerformanceCounterInstaller.exe
- 2007-10-09 13:03:00 76,312 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\WPF\PenIMC.dll
+ 2008-07-29 20:10:04 71,160 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\WPF\PenIMC.dll
- 2007-10-09 12:58:12 32,768 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationCFFRasterizer.dll
+ 2008-07-29 18:59:58 32,768 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationCFFRasterizer.dll
- 2009-03-26 19:43:20 36,864 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
+ 2008-07-29 20:10:04 46,104 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
- 2007-10-09 13:03:08 121,368 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationHostDLL.dll
+ 2008-07-29 18:59:58 132,120 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationHostDLL.dll
- 2007-10-09 12:58:14 897,024 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationUI.dll
+ 2008-07-29 19:35:46 864,256 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationUI.dll
+ 2008-12-05 18:35:22 1,736,528 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\WPF\wpfgfx_v0300.dll
+ 2008-07-29 22:40:48 168,448 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\1033\cscompui.dll
+ 2008-07-29 22:40:48 233,976 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\1033\vbc7ui.dll
+ 2008-07-29 22:40:48 41,992 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\AddInProcess.exe
+ 2008-07-29 22:40:48 41,992 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe
+ 2008-07-29 22:40:48 41,984 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe
+ 2008-07-29 22:40:48 1,548,280 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\csc.exe
+ 2008-07-29 22:40:48 78,856 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe
+ 2008-07-29 22:40:48 95,224 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\EdmGen.exe
+ 2008-07-29 22:15:24 225,490 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\baseline.dat
+ 2008-07-29 17:47:34 97,280 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\DeleteTemp.exe
+ 2008-07-29 17:47:34 276,984 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\dlmgr.dll
+ 2008-07-29 17:47:34 1,064,448 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\gencomp.dll
+ 2008-07-29 17:47:34 177,152 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\HtmlLite.dll
+ 2008-07-29 17:47:34 269,304 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
+ 2008-07-29 17:47:34 113,152 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1025.dll
+ 2008-07-29 17:47:34 84,992 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1028.dll
+ 2008-07-29 17:47:34 125,440 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1029.dll
+ 2008-07-29 17:47:34 126,464 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1030.dll
+ 2008-07-29 17:47:34 130,048 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1031.dll
+ 2008-07-29 17:47:34 137,728 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1032.dll
+ 2008-07-29 17:47:34 122,368 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1035.dll
+ 2008-07-29 17:47:34 133,120 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1036.dll
+ 2008-07-29 17:47:34 111,104 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1037.dll
+ 2008-07-29 17:47:34 132,096 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1038.dll
+ 2008-07-29 17:47:34 128,512 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1040.dll
+ 2008-07-29 17:47:34 97,792 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1041.dll
+ 2008-07-29 17:47:34 94,720 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1042.dll
+ 2008-07-29 17:47:34 129,024 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1043.dll
+ 2008-07-29 17:47:34 121,856 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1044.dll
+ 2008-07-29 17:47:34 128,512 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1045.dll
+ 2008-07-29 17:47:34 122,880 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1046.dll
+ 2008-07-29 17:47:34 123,904 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1049.dll
+ 2008-07-29 17:47:34 121,344 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1053.dll
+ 2008-07-29 17:47:34 121,344 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1055.dll
+ 2008-07-29 17:47:34 84,480 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.2052.dll
+ 2008-07-29 17:47:34 131,072 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.2070.dll
+ 2008-07-29 17:47:34 131,584 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.3082.dll
+ 2008-07-29 17:47:34 110,080 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.dll
+ 2008-07-29 17:47:34 1,364,992 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\SITSetup.dll
+ 2008-07-29 17:47:34 1,054,208 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\vs_setup.dll
+ 2008-07-29 17:47:34 632,320 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\vs70uimgr.dll
+ 2008-07-29 17:47:34 413,184 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\vsbasereqs.dll
+ 2008-07-29 17:47:34 689,152 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\vsscenario.dll
+ 2008-07-29 17:47:34 102,904 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1025.dll
+ 2008-07-29 17:47:34 89,592 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1028.dll
+ 2008-07-29 17:47:34 108,536 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1029.dll
+ 2008-07-29 17:47:34 108,536 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1030.dll
+ 2008-07-29 17:47:34 111,608 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1031.dll
+ 2008-07-29 17:47:34 113,656 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1032.dll
+ 2008-07-29 17:47:34 106,488 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1035.dll
+ 2008-07-29 17:47:34 112,120 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1036.dll
+ 2008-07-29 17:47:34 101,368 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1037.dll
+ 2008-07-29 17:47:34 111,096 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1038.dll
+ 2008-07-29 17:47:34 110,072 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1040.dll
+ 2008-07-29 17:47:34 95,224 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1041.dll
+ 2008-07-29 17:47:34 92,664 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1042.dll
+ 2008-07-29 17:47:34 108,536 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1043.dll
+ 2008-07-29 17:47:34 106,488 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1044.dll
+ 2008-07-29 17:47:34 109,048 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1045.dll
+ 2008-07-29 17:47:34 107,512 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1046.dll
+ 2008-07-29 17:47:34 107,000 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1049.dll
+ 2008-07-29 17:47:34 105,976 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1053.dll
+ 2008-07-29 17:47:34 106,488 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1055.dll
+ 2008-07-29 17:47:34 89,080 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.2052.dll
+ 2008-07-29 17:47:34 110,072 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.2070.dll
+ 2008-07-29 17:47:34 111,096 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.3082.dll
+ 2008-07-29 17:47:34 107,512 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.dll
+ 2008-07-29 17:47:34 984,056 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapUI.dll
+ 2008-07-29 22:40:48 802,816 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft.Build.Tasks.v3.5.dll
+ 2008-07-29 22:40:48 40,960 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft.Data.Entity.Build.Tasks.dll
+ 2008-07-29 22:40:48 41,984 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft.VisualC.STLCLR.dll
+ 2008-07-29 22:40:48 91,136 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\MSBuild.exe
+ 2008-07-29 22:40:48 5,632 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Sentinel.v3.5Client.dll
+ 2008-07-29 22:40:48 1,720,824 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\vbc.exe
+ 2008-07-29 22:40:48 196,104 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe
+ 2008-07-29 22:40:48 70,648 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
- 2008-10-16 20:38:34 124,928 —-a-w c:\windows\system32\advpack.dll
+ 2008-12-20 23:15:11 124,928 —-a-w c:\windows\system32\advpack.dll
- 2007-10-24 01:47:28 96,760 —-a-w c:\windows\system32\dfshim.dll
+ 2008-07-25 10:16:46 96,760 —-a-w c:\windows\system32\dfshim.dll
- 2008-10-16 20:38:34 124,928 -c–a-w c:\windows\system32\dllcache\advpack.dll
+ 2008-12-20 23:15:11 124,928 -c–a-w c:\windows\system32\dllcache\advpack.dll
- 2008-10-16 20:38:34 347,136 -c–a-w c:\windows\system32\dllcache\dxtmsft.dll
+ 2008-12-20 23:15:12 347,136 -c–a-w c:\windows\system32\dllcache\dxtmsft.dll
- 2008-10-16 20:38:34 214,528 -c–a-w c:\windows\system32\dllcache\dxtrans.dll
+ 2008-12-20 23:15:13 214,528 -c–a-w c:\windows\system32\dllcache\dxtrans.dll
- 2008-10-16 20:38:35 133,120 -c–a-w c:\windows\system32\dllcache\extmgr.dll
+ 2008-12-20 23:15:13 133,120 -c–a-w c:\windows\system32\dllcache\extmgr.dll
- 2007-03-22 19:24:58 28,160 -c—-w c:\windows\system32\dllcache\FilterPipelinePrintProc.dll
+ 2008-07-06 12:06:10 89,088 -c–a-w c:\windows\system32\dllcache\filterpipelineprintproc.dll
- 2008-10-16 20:38:35 63,488 -c—-w c:\windows\system32\dllcache\icardie.dll
+ 2008-12-20 23:15:13 63,488 -c—-w c:\windows\system32\dllcache\icardie.dll
- 2009-03-28 08:41:19 71,168 -c–a-w c:\windows\system32\dllcache\ie4uinit.exe
+ 2008-12-19 09:10:15 70,656 -c–a-w c:\windows\system32\dllcache\ie4uinit.exe
- 2008-10-16 20:38:35 153,088 -c–a-w c:\windows\system32\dllcache\ieakeng.dll
+ 2008-12-20 23:15:14 153,088 -c–a-w c:\windows\system32\dllcache\ieakeng.dll
- 2008-10-16 20:38:35 230,400 -c–a-w c:\windows\system32\dllcache\ieaksie.dll
+ 2008-12-20 23:15:14 230,400 -c–a-w c:\windows\system32\dllcache\ieaksie.dll
- 2008-10-15 07:04:53 161,792 -c–a-w c:\windows\system32\dllcache\ieakui.dll
+ 2008-12-19 05:23:56 161,792 -c–a-w c:\windows\system32\dllcache\ieakui.dll
- 2008-10-16 20:38:35 383,488 -c—-w c:\windows\system32\dllcache\ieapfltr.dll
+ 2008-12-20 23:15:15 383,488 -c—-w c:\windows\system32\dllcache\ieapfltr.dll
- 2008-10-16 20:38:35 384,512 -c–a-w c:\windows\system32\dllcache\iedkcs32.dll
+ 2008-12-20 23:15:16 384,512 -c–a-w c:\windows\system32\dllcache\iedkcs32.dll
- 2008-10-16 20:38:37 6,066,176 -c—-w c:\windows\system32\dllcache\ieframe.dll
+ 2008-12-20 23:15:21 6,066,688 -c—-w c:\windows\system32\dllcache\ieframe.dll
- 2008-10-16 20:38:37 44,544 -c–a-w c:\windows\system32\dllcache\iernonce.dll
+ 2008-12-20 23:15:21 44,544 -c–a-w c:\windows\system32\dllcache\iernonce.dll
- 2008-10-16 20:38:37 267,776 -c—-w c:\windows\system32\dllcache\iertutil.dll
+ 2008-12-20 23:15:22 267,776 -c—-w c:\windows\system32\dllcache\iertutil.dll
- 2009-03-28 08:41:22 14,336 -c–a-w c:\windows\system32\dllcache\ieudinit.exe
+ 2008-12-19 09:10:15 13,824 -c–a-w c:\windows\system32\dllcache\ieudinit.exe
- 2008-10-15 07:06:26 633,632 -c–a-w c:\windows\system32\dllcache\iexplore.exe
+ 2008-12-19 05:25:25 634,024 -c–a-w c:\windows\system32\dllcache\iexplore.exe
- 2008-10-16 20:38:37 27,648 -c–a-w c:\windows\system32\dllcache\jsproxy.dll
+ 2008-12-20 23:15:23 27,648 -c–a-w c:\windows\system32\dllcache\jsproxy.dll
- 2008-10-16 20:38:37 459,264 -c—-w c:\windows\system32\dllcache\msfeeds.dll
+ 2008-12-20 23:15:23 459,264 -c—-w c:\windows\system32\dllcache\msfeeds.dll
- 2008-10-16 20:38:37 52,224 -c—-w c:\windows\system32\dllcache\msfeedsbs.dll
+ 2008-12-20 23:15:24 52,224 -c—-w c:\windows\system32\dllcache\msfeedsbs.dll
- 2008-10-17 02:08:40 3,593,216 -c–a-w c:\windows\system32\dllcache\mshtml.dll
+ 2009-01-16 20:35:14 3,594,752 -c–a-w c:\windows\system32\dllcache\mshtml.dll
- 2008-10-16 20:38:38 477,696 -c–a-w c:\windows\system32\dllcache\mshtmled.dll
+ 2008-12-20 23:15:30 477,696 -c–a-w c:\windows\system32\dllcache\mshtmled.dll
- 2008-10-16 20:38:38 193,024 -c–a-w c:\windows\system32\dllcache\msrating.dll
+ 2008-12-20 23:15:31 193,024 -c–a-w c:\windows\system32\dllcache\msrating.dll
- 2008-10-16 20:38:39 671,232 -c–a-w c:\windows\system32\dllcache\mstime.dll
+ 2008-12-20 23:15:32 671,232 -c–a-w c:\windows\system32\dllcache\mstime.dll
- 2008-10-16 20:38:39 102,912 -c–a-w c:\windows\system32\dllcache\occache.dll
+ 2008-12-20 23:15:38 102,912 -c–a-w c:\windows\system32\dllcache\occache.dll
- 2008-10-16 20:38:39 44,544 -c–a-w c:\windows\system32\dllcache\pngfilt.dll
+ 2008-12-20 23:15:38 44,544 -c–a-w c:\windows\system32\dllcache\pngfilt.dll
- 2009-03-28 08:42:34 677,888 -c–a-w c:\windows\system32\dllcache\PrintFilterPipelineSvc.exe
+ 2008-07-06 10:50:03 597,504 -c–a-w c:\windows\system32\dllcache\printfilterpipelinesvc.exe
- 2008-09-08 10:41:42 333,824 -c—-w c:\windows\system32\dllcache\srv.sys
+ 2008-12-11 10:57:09 333,952 -c—-w c:\windows\system32\dllcache\srv.sys
- 2008-10-16 20:38:39 105,984 -c–a-w c:\windows\system32\dllcache\url.dll
+ 2008-12-20 23:15:39 105,984 -c–a-w c:\windows\system32\dllcache\url.dll
- 2008-10-16 20:38:39 1,160,192 -c–a-w c:\windows\system32\dllcache\urlmon.dll
+ 2008-12-20 23:15:40 1,160,192 -c–a-w c:\windows\system32\dllcache\urlmon.dll
- 2008-10-16 20:38:39 233,472 -c–a-w c:\windows\system32\dllcache\webcheck.dll
+ 2008-12-20 23:15:40 233,472 -c–a-w c:\windows\system32\dllcache\webcheck.dll
- 2008-09-05 23:30:42 241,704 -c—-w c:\windows\system32\dllcache\wgaLogon.dll
+ 2009-03-10 21:18:00 239,496 -c—-w c:\windows\system32\dllcache\wgaLogon.dll
- 2008-09-05 23:29:58 917,032 -c—-w c:\windows\system32\dllcache\WgaTray.exe
+ 2009-03-10 21:18:14 934,792 -c—-w c:\windows\system32\dllcache\WgaTray.exe
- 2008-09-15 12:12:56 1,846,400 -c—-w c:\windows\system32\dllcache\win32k.sys
+ 2009-02-09 11:13:27 1,846,784 -c—-w c:\windows\system32\dllcache\win32k.sys
- 2008-10-16 20:38:40 826,368 -c–a-w c:\windows\system32\dllcache\wininet.dll
+ 2008-12-20 23:15:41 826,368 -c–a-w c:\windows\system32\dllcache\wininet.dll
- 2007-06-11 22:51:12 10,834,944 -c–a-w c:\windows\system32\dllcache\wmp.dll
+ 2008-11-11 17:34:42 10,838,016 -c–a-w c:\windows\system32\dllcache\wmp.dll
- 2007-03-23 05:07:54 583,504 -c—-w c:\windows\system32\dllcache\XPSSHHDR.dll
+ 2008-07-06 12:06:10 575,488 -c–a-w c:\windows\system32\dllcache\xpsshhdr.dll
- 2007-03-23 05:07:56 1,683,280 -c—-w c:\windows\system32\dllcache\XpsSvcs.dll
+ 2008-07-06 12:06:10 1,676,288 -c–a-w c:\windows\system32\dllcache\xpssvcs.dll
- 2008-04-14 00:11:52 147,968 —-a-w c:\windows\system32\dnsapi.dll
+ 2008-06-20 17:46:57 147,968 —-a-w c:\windows\system32\dnsapi.dll
- 2008-09-08 10:41:42 333,824 —-a-w c:\windows\system32\drivers\srv.sys
+ 2008-12-11 10:57:09 333,952 —-a-w c:\windows\system32\drivers\srv.sys
- 2008-04-13 19:20:16 361,344 —-a-w c:\windows\system32\drivers\tcpip.sys
+ 2008-06-20 11:51:12 361,600 —-a-w c:\windows\system32\drivers\tcpip.sys
- 2008-04-13 19:00:02 225,664 —-a-w c:\windows\system32\drivers\tcpip6.sys
+ 2008-06-20 11:08:27 225,856 —-a-w c:\windows\system32\drivers\tcpip6.sys
- 2008-10-16 20:38:34 347,136 —-a-w c:\windows\system32\dxtmsft.dll
+ 2008-12-20 23:15:12 347,136 —-a-w c:\windows\system32\dxtmsft.dll
- 2008-10-16 20:38:34 214,528 —-a-w c:\windows\system32\dxtrans.dll
+ 2008-12-20 23:15:13 214,528 —-a-w c:\windows\system32\dxtrans.dll
- 2008-10-16 20:38:35 133,120 —-a-w c:\windows\system32\extmgr.dll
+ 2008-12-20 23:15:13 133,120 —-a-w c:\windows\system32\extmgr.dll
- 2008-12-13 09:55:46 270,984 —-a-w c:\windows\system32\FNTCACHE.DAT
+ 2009-03-30 10:57:08 270,984 —-a-w c:\windows\system32\FNTCACHE.DAT
- 2007-10-11 09:55:10 579,584 —-a-w c:\windows\system32\icardagt.exe
+ 2008-07-29 18:24:50 622,080 —-a-w c:\windows\system32\icardagt.exe
- 2008-10-16 20:38:35 63,488 —-a-w c:\windows\system32\icardie.dll
+ 2008-12-20 23:15:13 63,488 —-a-w c:\windows\system32\icardie.dll
- 2007-10-11 09:55:10 11,776 —-a-w c:\windows\system32\icardres.dll
+ 2008-07-29 18:24:50 11,264 —-a-w c:\windows\system32\icardres.dll
- 2009-03-26 19:49:00 70,656 —-a-w c:\windows\system32\ie4uinit.exe
+ 2008-12-19 09:10:15 70,656 —-a-w c:\windows\system32\ie4uinit.exe
- 2008-10-16 20:38:35 153,088 —-a-w c:\windows\system32\ieakeng.dll
+ 2008-12-20 23:15:14 153,088 —-a-w c:\windows\system32\ieakeng.dll
- 2008-10-16 20:38:35 230,400 —-a-w c:\windows\system32\ieaksie.dll
+ 2008-12-20 23:15:14 230,400 —-a-w c:\windows\system32\ieaksie.dll
- 2008-10-15 07:04:53 161,792 —-a-w c:\windows\system32\ieakui.dll
+ 2008-12-19 05:23:56 161,792 —-a-w c:\windows\system32\ieakui.dll
- 2008-10-16 20:38:35 383,488 —-a-w c:\windows\system32\ieapfltr.dll
+ 2008-12-20 23:15:15 383,488 —-a-w c:\windows\system32\ieapfltr.dll
- 2008-10-16 20:38:35 384,512 —-a-w c:\windows\system32\iedkcs32.dll
+ 2008-12-20 23:15:16 384,512 —-a-w c:\windows\system32\iedkcs32.dll
- 2008-10-16 20:38:37 6,066,176 —-a-w c:\windows\system32\ieframe.dll
+ 2008-12-20 23:15:21 6,066,688 —-a-w c:\windows\system32\ieframe.dll
- 2008-10-16 20:38:37 44,544 —-a-w c:\windows\system32\iernonce.dll
+ 2008-12-20 23:15:21 44,544 —-a-w c:\windows\system32\iernonce.dll
- 2008-10-16 20:38:37 267,776 —-a-w c:\windows\system32\iertutil.dll
+ 2008-12-20 23:15:22 267,776 —-a-w c:\windows\system32\iertutil.dll
- 2009-03-26 19:43:34 14,336 —-a-w c:\windows\system32\ieudinit.exe
+ 2008-12-19 09:10:15 13,824 —-a-w c:\windows\system32\ieudinit.exe
- 2007-10-11 09:55:10 88,576 —-a-w c:\windows\system32\infocardapi.dll
+ 2008-07-29 18:24:50 97,800 —-a-w c:\windows\system32\infocardapi.dll
- 2009-03-26 19:49:12 135,168 —-a-w c:\windows\system32\java.exe
+ 2009-03-30 10:27:56 144,792 —-a-w c:\windows\system32\java.exe
- 2009-03-26 19:49:13 135,168 —-a-w c:\windows\system32\javaw.exe
+ 2009-03-30 10:27:56 144,792 —-a-w c:\windows\system32\javaw.exe
- 2009-03-26 19:49:14 139,264 —-a-w c:\windows\system32\javaws.exe
+ 2009-03-30 10:27:56 148,888 —-a-w c:\windows\system32\javaws.exe
- 2008-10-16 20:38:37 27,648 —-a-w c:\windows\system32\jsproxy.dll
+ 2008-12-20 23:15:23 27,648 —-a-w c:\windows\system32\jsproxy.dll
- 2008-09-05 23:30:06 1,480,232 —-a-w c:\windows\system32\LegitCheckControl.dll
+ 2009-03-10 21:18:20 1,482,112 —-a-w c:\windows\system32\LegitCheckControl.dll
- 2008-12-09 15:24:38 17,593,280 —-a-w c:\windows\system32\MRT.exe
+ 2009-02-25 11:55:00 24,768,960 —-a-w c:\windows\system32\MRT.exe
- 2007-10-24 01:47:38 282,112 —-a-w c:\windows\system32\mscoree.dll
+ 2008-07-25 10:16:58 282,112 —-a-w c:\windows\system32\mscoree.dll
- 2007-10-24 01:47:38 158,720 —-a-w c:\windows\system32\mscorier.dll
+ 2008-07-25 10:16:58 158,720 —-a-w c:\windows\system32\mscorier.dll
- 2007-10-24 01:47:38 84,480 —-a-w c:\windows\system32\mscories.dll
+ 2008-07-25 10:16:58 83,968 —-a-w c:\windows\system32\mscories.dll
- 2008-10-16 20:38:37 459,264 —-a-w c:\windows\system32\msfeeds.dll
+ 2008-12-20 23:15:23 459,264 —-a-w c:\windows\system32\msfeeds.dll
- 2008-10-16 20:38:37 52,224 —-a-w c:\windows\system32\msfeedsbs.dll
+ 2008-12-20 23:15:24 52,224 —-a-w c:\windows\system32\msfeedsbs.dll
- 2008-10-17 02:08:40 3,593,216 —-a-w c:\windows\system32\mshtml.dll
+ 2009-01-16 20:35:14 3,594,752 —-a-w c:\windows\system32\mshtml.dll
- 2008-10-16 20:38:38 477,696 —-a-w c:\windows\system32\mshtmled.dll
+ 2008-12-20 23:15:30 477,696 —-a-w c:\windows\system32\mshtmled.dll
- 2008-10-16 20:38:38 193,024 —-a-w c:\windows\system32\msrating.dll
+ 2008-12-20 23:15:31 193,024 —-a-w c:\windows\system32\msrating.dll
- 2008-10-16 20:38:39 671,232 —-a-w c:\windows\system32\mstime.dll
+ 2008-12-20 23:15:32 671,232 —-a-w c:\windows\system32\mstime.dll
- 2008-04-14 00:12:01 245,248 —-a-w c:\windows\system32\mswsock.dll
+ 2008-06-20 17:46:57 245,248 —-a-w c:\windows\system32\mswsock.dll
- 2007-10-24 01:47:44 15,360 —-a-w c:\windows\system32\mui\0409\mscorees.dll
+ 2008-07-25 10:17:04 15,360 —-a-w c:\windows\system32\mui\0409\mscorees.dll
- 2008-10-16 20:38:39 102,912 —-a-w c:\windows\system32\occache.dll
+ 2008-12-20 23:15:38 102,912 —-a-w c:\windows\system32\occache.dll
- 2009-03-30 09:10:44 79,322 —-a-w c:\windows\system32\perfc009.dat
+ 2009-04-02 16:50:59 79,074 —-a-w c:\windows\system32\perfc009.dat
- 2009-03-30 09:10:44 465,880 —-a-w c:\windows\system32\perfh009.dat
+ 2009-04-02 16:50:59 465,380 —-a-w c:\windows\system32\perfh009.dat
- 2008-10-16 20:38:39 44,544 —-a-w c:\windows\system32\pngfilt.dll
+ 2008-12-20 23:15:38 44,544 —-a-w c:\windows\system32\pngfilt.dll
- 2007-10-09 13:03:04 106,520 —-a-w c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
+ 2008-07-29 18:59:58 105,016 —-a-w c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
- 2007-10-09 13:03:08 350,744 —-a-w c:\windows\system32\PresentationHost.exe
+ 2008-07-29 19:35:46 326,160 —-a-w c:\windows\system32\PresentationHost.exe
- 2007-10-09 13:03:02 33,304 —-a-w c:\windows\system32\PresentationHostProxy.dll
+ 2008-07-29 18:59:58 43,544 —-a-w c:\windows\system32\PresentationHostProxy.dll
- 2007-10-09 13:03:12 779,800 —-a-w c:\windows\system32\PresentationNative_v0300.dll
+ 2008-07-29 18:59:58 781,344 —-a-w c:\windows\system32\PresentationNative_v0300.dll
- 2007-03-22 19:25:02 124,928 —-a-w c:\windows\system32\prntvpt.dll
+ 2008-07-06 12:06:10 117,760 —-a-w c:\windows\system32\prntvpt.dll
- 2008-04-14 00:12:05 144,384 —-a-w c:\windows\system32\schannel.dll
+ 2008-12-05 06:54:55 144,896 —-a-w c:\windows\system32\schannel.dll
- 2008-04-14 00:12:05 8,461,312 —-a-w c:\windows\system32\shell32.dll
+ 2008-06-17 19:02:19 8,461,312 —-a-w c:\windows\system32\shell32.dll
- 2007-11-30 12:39:22 17,272 ——w c:\windows\system32\spmsg.dll
+ 2007-07-27 08:41:40 16,760 ——w c:\windows\system32\spmsg.dll
- 2007-03-22 19:24:50 762,880 —-a-w c:\windows\system32\spool\drivers\w32x86\3\mxdwdrv.dll
+ 2008-07-06 12:06:10 765,440 —-a-w c:\windows\system32\spool\drivers\w32x86\3\mxdwdrv.dll
- 2007-03-22 19:24:34 131,584 —-a-w c:\windows\system32\spool\drivers\w32x86\3\mxdwdui.dll
+ 2008-07-06 12:06:10 198,656 —-a-w c:\windows\system32\spool\drivers\w32x86\3\mxdwdui.dll
- 2008-04-14 00:12:07 373,248 —-a-w c:\windows\system32\spool\drivers\w32x86\3\unidrv.dll
+ 2008-07-06 12:06:10 373,248 —-a-w c:\windows\system32\spool\drivers\w32x86\3\unidrv.dll
- 2008-04-14 00:12:07 744,448 —-a-w c:\windows\system32\spool\drivers\w32x86\3\unidrvui.dll
+ 2008-07-06 12:06:10 744,960 —-a-w c:\windows\system32\spool\drivers\w32x86\3\unidrvui.dll
- 2007-03-22 20:03:58 761,344 —-a-w c:\windows\system32\spool\drivers\w32x86\3\unires.dll
+ 2008-03-13 04:52:36 761,344 —-a-w c:\windows\system32\spool\drivers\w32x86\3\unires.dll
- 2007-03-23 05:07:56 1,683,280 —-a-w c:\windows\system32\spool\drivers\w32x86\3\XpsSvcs.dll
+ 2008-07-06 12:06:10 1,676,288 —-a-w c:\windows\system32\spool\drivers\w32x86\3\XpsSvcs.dll
- 2006-10-14 15:43:18 27,648 —-a-w c:\windows\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
+ 2008-07-06 12:06:10 89,088 —-a-w c:\windows\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
- 2009-03-28 08:47:05 677,376 —-a-w c:\windows\system32\spool\prtprocs\w32x86\PrintFilterPipelineSvc.exe
+ 2008-07-06 10:50:03 597,504 —-a-w c:\windows\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe
- 2006-10-14 16:13:02 34,304 —-a-w c:\windows\system32\spool\prtprocs\x64\filterpipelineprintproc.dll
+ 2008-07-06 12:06:10 147,456 —-a-w c:\windows\system32\spool\prtprocs\x64\filterpipelineprintproc.dll
- 2007-03-22 19:53:16 746,496 —-a-w c:\windows\system32\spool\XPSEP\amd64\amd64\mxdwdrv.dll
+ 2008-07-06 12:06:10 748,032 —-a-w c:\windows\system32\spool\XPSEP\amd64\amd64\mxdwdrv.dll
- 2007-03-22 19:59:24 2,932,224 —-a-w c:\windows\system32\spool\XPSEP\amd64\amd64\xpssvcs.dll
+ 2008-07-06 16:36:12 2,936,832 —-a-w c:\windows\system32\spool\XPSEP\amd64\amd64\xpssvcs.dll
- 2007-03-22 19:53:16 746,496 —-a-w c:\windows\system32\spool\XPSEP\amd64\mxdwdrv.dll
+ 2008-07-06 12:06:10 748,032 —-a-w c:\windows\system32\spool\XPSEP\amd64\mxdwdrv.dll
- 2007-03-22 19:59:24 2,932,224 —-a-w c:\windows\system32\spool\XPSEP\amd64\xpssvcs.dll
+ 2008-07-06 16:36:12 2,936,832 —-a-w c:\windows\system32\spool\XPSEP\amd64\xpssvcs.dll
- 2007-03-22 19:24:50 762,880 —-a-w c:\windows\system32\spool\XPSEP\i386\i386\mxdwdrv.dll
+ 2008-07-06 12:06:10 765,440 —-a-w c:\windows\system32\spool\XPSEP\i386\i386\mxdwdrv.dll
- 2007-03-23 05:07:56 1,683,280 —-a-w c:\windows\system32\spool\XPSEP\i386\i386\xpssvcs.dll
+ 2008-07-06 12:06:10 1,676,288 —-a-w c:\windows\system32\spool\XPSEP\i386\i386\xpssvcs.dll
- 2007-03-22 19:24:50 762,880 —-a-w c:\windows\system32\spool\XPSEP\i386\mxdwdrv.dll
+ 2008-07-06 12:06:10 765,440 —-a-w c:\windows\system32\spool\XPSEP\i386\mxdwdrv.dll
- 2007-03-23 05:07:56 1,683,280 —-a-w c:\windows\system32\spool\XPSEP\i386\xpssvcs.dll
+ 2008-07-06 12:06:10 1,676,288 —-a-w c:\windows\system32\spool\XPSEP\i386\xpssvcs.dll
- 2007-08-10 20:46:18 26,488 —-a-w c:\windows\system32\spupdsvc.exe
+ 2007-07-27 08:41:38 26,488 —-a-w c:\windows\system32\spupdsvc.exe
- 2008-10-16 20:38:39 105,984 —-a-w c:\windows\system32\url.dll
+ 2008-12-20 23:15:39 105,984 —-a-w c:\windows\system32\url.dll
- 2008-10-16 20:38:39 1,160,192 —-a-w c:\windows\system32\urlmon.dll
+ 2008-12-20 23:15:40 1,160,192 —-a-w c:\windows\system32\urlmon.dll
- 2008-10-16 20:38:39 233,472 —-a-w c:\windows\system32\webcheck.dll
+ 2008-12-20 23:15:40 233,472 —-a-w c:\windows\system32\webcheck.dll
- 2008-09-05 23:30:42 241,704 —-a-w c:\windows\system32\WgaLogon.dll
+ 2009-03-10 21:18:00 239,496 —-a-w c:\windows\system32\WgaLogon.dll
- 2008-09-05 23:29:58 917,032 —-a-w c:\windows\system32\WgaTray.exe
+ 2009-03-10 21:18:14 934,792 —-a-w c:\windows\system32\WgaTray.exe
- 2008-10-16 20:38:40 826,368 —-a-w c:\windows\system32\wininet.dll
+ 2008-12-20 23:15:41 826,368 —-a-w c:\windows\system32\wininet.dll
- 2007-06-11 22:51:12 10,834,944 —-a-w c:\windows\system32\wmp.dll
+ 2008-11-11 17:34:42 10,838,016 —-a-w c:\windows\system32\wmp.dll
- 2007-03-23 05:07:54 583,504 —-a-w c:\windows\system32\XPSSHHDR.dll
+ 2008-07-06 12:06:10 575,488 —-a-w c:\windows\system32\xpsshhdr.dll
- 2007-03-23 05:07:56 1,683,280 —-a-w c:\windows\system32\XpsSvcs.dll
+ 2008-07-06 12:06:10 1,676,288 —-a-w c:\windows\system32\xpssvcs.dll
- 2007-10-09 13:03:08 308,760 —-a-w c:\windows\system32\XPSViewer\XPSViewer.exe
+ 2008-07-29 20:26:06 301,568 —-a-w c:\windows\system32\XPSViewer\XPSViewer.exe
+ 2009-04-02 16:28:55 16,384 —-atw c:\windows\temp\Perflib_Perfdata_574.dat
- 2008-12-13 09:46:23 8,192 —-a-w c:\windows\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
+ 2009-03-30 10:49:23 8,192 —-a-w c:\windows\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
+ 2008-07-25 10:17:20 479,232 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcm80.dll
+ 2008-07-25 10:17:20 558,080 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcp80.dll
+ 2008-07-25 10:17:20 635,904 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcr80.dll
+ 2007-11-06 20:23:56 224,768 —-a-w c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcm90.dll
+ 2007-11-07 01:19:32 568,832 —-a-w c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcp90.dll
+ 2007-11-07 01:19:32 655,872 —-a-w c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcr90.dll
- 2008-12-13 09:46:29 258,048 —-a-w c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
+ 2009-03-30 10:49:26 258,048 —-a-w c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
- 2008-12-13 09:46:29 113,664 —-a-w c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
+ 2009-03-30 10:49:26 113,664 —-a-w c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2009-03-26 33792]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-03-26 1601304]
"TI WLAN"="c:\program files\Wireless LAN Utility\TIWLANCu.exe" [2009-03-26 1171456]
"WheelMouse"="c:\advanced wheel mouse\wh_exec.exe" [2009-03-26 98304]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"amd_dc_opt"="c:\program files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2009-03-26 77824]
"VTTimer"="VTTimer.exe" [2009-03-26 c:\windows\system32\VTTimer.exe]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2007-02-05 294400]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-03-26 19:06 10520 c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"3853b805"=rundll32.exe "c:\windows\system32\pqicgjmb.dll",b

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Steam\\steamapps\\calibrator67\\half-life 2 deathmatch\\hl2.exe"=
"c:\\Program Files\\Steam\\steamapps\\calibrator67\\counter-strike\\hl.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-07-19 325128]
R1 eusk2par;EUTRON SmartKey Parallel Driver;c:\windows\system32\drivers\eusk2par.sys [2008-03-21 24786]
R2 avg8wd;avg8wd;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-07-19 298264]
R3 TNET1130;802.11 WLAN;c:\windows\system32\drivers\TNET1130.sys [2008-08-17 438912]
S3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\windows\system32\drivers\AtiHdmi.sys [2007-07-20 84992]
S3 eusk3usb;SmartKey 3 USB;c:\windows\system32\drivers\eusk3usb.sys [2008-03-21 45534]
.
Contents of the 'Scheduled Tasks' folder

2009-03-30 c:\windows\Tasks\Uniblue SpeedUpMyPC Nag.job
- c:\program files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe []

2007-07-09 c:\windows\Tasks\Uniblue SpeedUpMyPC.job
- c:\program files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe []
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.co.uk/
uInternet Settings,ProxyOverride =
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\cgr16zu7.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk
FF - plugin: c:\program files\Mozilla Firefox\plugins\npyaxmpb.dll
FF - plugin: c:\program files\Real\RealArcade\Plugins\Mozilla\npracplug.dll
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-02 17:57:30
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-343818398-484763869-725345543-500\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(872)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-04-02 17:59:04
ComboFix-quarantined-files.txt 2009-04-02 16:59:02
ComboFix2.txt 2009-03-30 09:34:12

Pre-Run: 277,787,238,400 bytes free
Post-Run: 277,774,667,776 bytes free

1219

CatByte

Post #7April 2, 2009, 5:34 PM UTC

Hi,

From the ComboFix log:

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
c:\windows\explorer.exe . . . is infected!!

One of your core system files is infected - this is not good news.

I need you to submit a couple of files for analysis - please do the following:

Make sure to use Internet Explorer for this
Please go to VirSCAN.org FREE on-line scan service
Copy and paste the full file path one at a time, into the "Suspicious files to scan" box on the top of the page:
Please ensure the scan is completed and you have saved the results before submitting the next.

c:\windows\explorer.exe
Click on the Upload button
If a pop-up appears saying the file has been scanned already, please select the ReScan button.
Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard.
Paste the contents of the Clipboard in your next reply.

Do the same for these next files

C:\WINDOWS\system32\lsass.exe
c:\windows\system32\userinit.exe
c:\windows\ServicePackFiles\i386\ctfmon.exe

please identify which scan is for which file

Calibrator

Post #8April 2, 2009, 6:15 PM UTC

Hi CatByte

Each scan identified by (title) in header

Explorer ( title )

VirSCAN.org Scanned Report :
Scanned time : 2009/04/02 18:59:16 (BST)
Scanner results: 3% Scanner(1/37) found malware!
File Name : explorer.exe
File Size : 1052672 byte
File Type : PE32 executable for MS Windows (GUI) Intel 80386 32-bit
MD5 : c0e3ad1446ee377b603a767a551af1bf
SHA1 : 8bf213ceb6d287fbe5b79e692c86a599fcf28b63
Online report : http://virscan.org/report/51c57d04bb6607b1…de6b55f7c4.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.0.0.32 00040000000000 0004-00-00 0.37 -
AhnLab V3 2009.04.03.00 2009.04.03 2009-04-03 0.67 -
AntiVir 7.9.0.129 7.1.3.7 2009-04-02 2.02 -
Antiy 2.0.18 20090402.2269857 2009-04-02 0.13 -
Authentium 5.1.1 200904011755 2009-04-01 2.24 -
AVAST! 3.0.1 090402-0 2009-04-02 0.06 -
AVG 7.5.52.442 270.11.38/2037 2009-04-02 2.02 -
BitDefender 7.81008.2816341 7.24572 2009-04-02 2.63 -
CA (VET) 9.0.0.143 31.6.6432 2009-04-02 7.23 -
ClamAV 0.95 9198 2009-04-02 0.17 -
Comodo 3.8 1093 2009-04-01 1.02 -
CP Secure 1.1.0.715 2009.04.02 2009-04-02 7.98 -
Dr.Web 4.44.0.9170 2009.04.02 2009-04-02 4.61 -
F-Prot 4.4.4.56 20090401 2009-04-01 2.11 -
F-Secure 5.51.6100 2009.04.02.08 2009-04-02 0.07 -
Fortinet 2.81-3.117 10.232 2009-04-02 8.49 -
GData 19.4372/19.284 20090402 2009-04-02 5.52 -
ViRobot 20090401 2009.04.01 2009-04-01 0.71 -
Ikarus T3.1.01.49 2009.04.02.72513 2009-04-02 2.92 Trojan.Win32.Patched
JiangMin 11.0.706 2009.04.02 2009-04-02 1.96 -
Kaspersky 5.5.10 2009.04.02 2009-04-02 0.05 -
KingSoft 2009.2.5.15 2009.4.2.21 2009-04-02 0.59 -
McAfee 5.3.00 5572 2009-04-02 2.75 -
Microsoft 1.4502 2009.04.02 2009-04-02 4.34 -
mks_vir 2.01 2009.04.02 2009-04-02 2.74 -
Norman 6.00.06 6.00.00 2009-04-02 8.01 -
Panda 9.05.01 2009.04.02 2009-04-02 4.48 -
Trend Micro 8.700-1004 5.940.02 2009-04-02 0.05 -
Quick Heal 10.00 2009.03.31 2009-03-31 1.37 -
Rising 20.0 21.23.32.00 2009-04-02 1.06 -
Sophos 2.85.0 4.40 2009-04-03 2.04 -
Sunbelt 5073 5073 2009-04-01 0.74 -
Symantec 1.3.0.24 20090402.007 2009-04-02 0.22 -
nProtect 20090402.03 3397108 2009-04-02 4.21 -
The Hacker [removed] v00298 2009-04-01 0.61 -
VBA32 3.12.10.2 20090401.1027 2009-04-01 1.93 -
VirusBuster 4.5.11.10 10.102.31/1174007 2009-04-02 1.67 -

Lslass (title)

VirSCAN.org Scanned Report :
Scanned time : 2009/04/02 19:04:07 (BST)
Scanner results: All Scanners reported not find malware!
File Name : lsass.exe
File Size : 13312 byte
File Type : PE32 executable for MS Windows (GUI) Intel 80386 32-bit
MD5 : bf2466b3e18e970d8a976fb95fc1ca85
SHA1 : de5a73cbb5f51f64c53fb4277ef2c23e70db123f
Online report : http://virscan.org/report/c517512546297bbc…e0dff031ee.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.0.0.32 00040000000000 0004-00-00 0.36 -
AhnLab V3 2009.04.03.00 2009.04.03 2009-04-03 0.65 -
AntiVir 7.9.0.129 7.1.3.7 2009-04-02 1.99 -
Antiy 2.0.18 20090402.2269857 2009-04-02 0.00 -
Authentium 5.1.1 200904011755 2009-04-01 0.00 -
AVAST! 3.0.1 090402-0 2009-04-02 0.00 -
AVG 7.5.52.442 270.11.38/2037 2009-04-02 0.00 -
BitDefender 7.81008.2816341 7.24572 2009-04-02 0.00 -
CA (VET) 9.0.0.143 31.6.6432 2009-04-02 0.00 -
ClamAV 0.95 9198 2009-04-02 0.00 -
Comodo 3.8 1093 2009-04-01 0.00 -
CP Secure 1.1.0.715 2009.04.02 2009-04-02 0.00 -
Dr.Web 4.44.0.9170 2009.04.02 2009-04-02 0.00 -
F-Prot 4.4.4.56 20090401 2009-04-01 0.00 -
F-Secure 5.51.6100 2009.04.02.08 2009-04-02 0.00 -
Fortinet 2.81-3.117 10.233 2009-04-02 0.00 -
GData 19.4372/19.284 20090402 2009-04-02 0.00 -
ViRobot 20090401 2009.04.01 2009-04-01 0.00 -
Ikarus T3.1.01.49 2009.04.02.72513 2009-04-02 0.00 -
JiangMin 11.0.706 2009.04.02 2009-04-02 0.00 -
Kaspersky 5.5.10 2009.04.02 2009-04-02 0.00 -
KingSoft 2009.2.5.15 2009.4.2.21 2009-04-02 0.00 -
McAfee 5.3.00 5572 2009-04-02 0.00 -
Microsoft 1.4502 2009.04.02 2009-04-02 0.00 -
mks_vir 2.01 2009.04.02 2009-04-02 0.00 -
Norman 6.00.06 6.00.00 2009-04-02 0.00 -
Panda 9.05.01 2009.04.02 2009-04-02 0.00 -
Trend Micro 8.700-1004 5.940.02 2009-04-02 0.00 -
Quick Heal 10.00 2009.03.31 2009-03-31 0.00 -
Rising 20.0 21.23.32.00 2009-04-02 0.00 -
Sophos 2.85.0 4.40 2009-04-03 0.00 -
Sunbelt 5073 5073 2009-04-01 0.00 -
Symantec 1.3.0.24 20090402.007 2009-04-02 0.00 -
nProtect 20090402.03 3397108 2009-04-02 0.00 -
The Hacker [removed] v00298 2009-04-01 0.00 -
VBA32 3.12.10.2 20090401.1027 2009-04-01 0.00 -
VirusBuster 4.5.11.10 10.102.31/1174007 2009-04-02 0.00 -

UserInit.exe (title)

VirSCAN.org Scanned Report :
Scanned time : 2009/04/02 19:06:05 (BST)
Scanner results: All Scanners reported not find malware!
File Name : userinit.exe
File Size : 26112 byte
File Type : PE32 executable for MS Windows (GUI) Intel 80386 32-bit
MD5 : f0dedd1728bb733a893f21f6061923ca
SHA1 : 969150b1fe03a5ce15e835322e96ae161c1afb23
Online report : http://virscan.org/report/800b80572ad4930a…c62da1a0df.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.0.0.32 00040000000000 0004-00-00 0.36 -
AhnLab V3 2009.04.03.00 2009.04.03 2009-04-03 0.59 -
AntiVir 7.9.0.129 7.1.3.7 2009-04-02 1.96 -
Antiy 2.0.18 20090402.2269857 2009-04-02 0.12 -
Authentium 5.1.1 200904011755 2009-04-01 1.14 -
AVAST! 3.0.1 090402-0 2009-04-02 0.01 -
AVG 7.5.52.442 270.11.38/2037 2009-04-02 2.00 -
BitDefender 7.81008.2816341 7.24572 2009-04-02 2.61 -
CA (VET) 9.0.0.143 31.6.6432 2009-04-02 3.92 -
ClamAV 0.95 9198 2009-04-02 0.01 -
Comodo 3.8 1093 2009-04-01 0.54 -
CP Secure 1.1.0.715 2009.04.02 2009-04-02 7.87 -
Dr.Web 4.44.0.9170 2009.04.02 2009-04-02 4.32 -
F-Prot 4.4.4.56 20090401 2009-04-01 1.13 -
F-Secure 5.51.6100 2009.04.02.08 2009-04-02 5.07 -
Fortinet 2.81-3.117 10.233 2009-04-02 0.18 -
GData 19.4372/19.284 20090402 2009-04-02 3.84 -
ViRobot 20090401 2009.04.01 2009-04-01 0.41 -
Ikarus T3.1.01.49 2009.04.02.72513 2009-04-02 2.97 -
JiangMin 11.0.706 2009.04.02 2009-04-02 1.65 -
Kaspersky 5.5.10 2009.04.02 2009-04-02 0.07 -
KingSoft 2009.2.5.15 2009.4.2.21 2009-04-02 0.58 -
McAfee 5.3.00 5572 2009-04-02 2.69 -
Microsoft 1.4502 2009.04.02 2009-04-02 4.19 -
mks_vir 2.01 2009.04.02 2009-04-02 2.70 -
Norman 6.00.06 6.00.00 2009-04-02 8.01 -
Panda 9.05.01 2009.04.02 2009-04-02 1.58 -
Trend Micro 8.700-1004 5.940.02 2009-04-02 0.03 -
Quick Heal 10.00 2009.03.31 2009-03-31 1.12 -
Rising 20.0 21.23.32.00 2009-04-02 0.92 -
Sophos 2.85.0 4.40 2009-04-03 1.99 -
Sunbelt 5073 5073 2009-04-01 0.72 -
Symantec 1.3.0.24 20090402.007 2009-04-02 0.05 -
nProtect 20090402.03 3397108 2009-04-02 4.14 -
The Hacker [removed] v00298 2009-04-01 0.57 -
VBA32 3.12.10.2 20090401.1027 2009-04-01 1.95 -
VirusBuster 4.5.11.10 10.102.31/1174007 2009-04-02 1.44 -

ctfmon.exe (title)

VirSCAN.org Scanned Report :
Scanned time : 2009/04/02 19:09:25 (BST)
Scanner results: 3% Scanner(1/37) found malware!
File Name : ctfmon.exe
File Size : 15360 byte
File Type : PE32 executable for MS Windows (GUI) Intel 80386 32-bit
MD5 : 6d550f617e0ab3629734c7363dcae628
SHA1 : d2992312642f42f11ba42d566d6558253d644472
Online report : http://virscan.org/report/a76235cfd844d950…4cccdee169.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.0.0.32 00040000000000 0004-00-00 0.36 -
AhnLab V3 2009.04.03.00 2009.04.03 2009-04-03 0.59 -
AntiVir 7.9.0.129 7.1.3.7 2009-04-02 2.01 -
Antiy 2.0.18 20090402.2269857 2009-04-02 0.12 -
Authentium 5.1.1 200904011755 2009-04-01 1.13 -
AVAST! 3.0.1 090402-0 2009-04-02 0.00 -
AVG 7.5.52.442 270.11.38/2037 2009-04-02 2.02 -
BitDefender 7.81008.2816341 7.24572 2009-04-02 2.61 -
CA (VET) 9.0.0.143 31.6.6432 2009-04-02 2.37 -
ClamAV 0.95 9198 2009-04-02 0.01 -
Comodo 3.8 1093 2009-04-01 0.54 -
CP Secure 1.1.0.715 2009.04.02 2009-04-02 7.83 -
Dr.Web 4.44.0.9170 2009.04.02 2009-04-02 4.37 -
F-Prot 4.4.4.56 20090401 2009-04-01 1.14 -
F-Secure 5.51.6100 2009.04.02.08 2009-04-02 5.10 -
Fortinet 2.81-3.117 10.233 2009-04-02 0.17 -
GData 19.4372/19.284 20090402 2009-04-02 5.26 -
ViRobot 20090401 2009.04.01 2009-04-01 0.47 -
Ikarus T3.1.01.49 2009.04.02.72513 2009-04-02 2.88 Backdoor.Win32.Popwin
JiangMin 11.0.706 2009.04.02 2009-04-02 2.38 -
Kaspersky 5.5.10 2009.04.02 2009-04-02 0.07 -
KingSoft 2009.2.5.15 2009.4.2.21 2009-04-02 0.57 -
McAfee 5.3.00 5572 2009-04-02 2.69 -
Microsoft 1.4502 2009.04.02 2009-04-02 5.54 -
mks_vir 2.01 2009.04.02 2009-04-02 2.68 -
Norman 6.00.06 6.00.00 2009-04-02 10.01 -
Panda 9.05.01 2009.04.02 2009-04-02 1.44 -
Trend Micro 8.700-1004 5.940.02 2009-04-02 0.03 -
Quick Heal 10.00 2009.03.31 2009-03-31 1.05 -
Rising 20.0 21.23.32.00 2009-04-02 0.85 -
Sophos 2.85.0 4.40 2009-04-03 1.99 -
Sunbelt 5073 5073 2009-04-01 0.95 -
Symantec 1.3.0.24 20090402.007 2009-04-02 0.05 -
nProtect 20090402.03 3397108 2009-04-02 4.75 -
The Hacker [removed] v00298 2009-04-01 1.23 -
VBA32 3.12.10.2 20090401.1027 2009-04-01 1.91 -
VirusBuster 4.5.11.10 10.102.31/1174007 2009-04-02 1.46 -

CatByte

Post #9April 2, 2009, 6:22 PM UTC

Hi, This is interesting…all the indications are there for virut, but nothing is coming up… it will take me a little while to work out a script fix as there is a lot of information to go through, so I will post back later with further instructions Thanks for your patience. CB

CatByte

Post #10April 2, 2009, 6:49 PM UTC

Hi,

I'd like you to run Dr.Web again and copy/past the report:

Please do the following:

Download Dr.Web CureIt to the desktop:

Doubleclick the drweb-cureit icon to start the program.
press start
Allow the program to run the initial express scan
This will scan the files currently running in memory. If something is found, click the YES button when it asks you if you want to cure it. This is only a short scan.
Note: A pop up may appear during this phase suggesting you purchase their program - click the X at the top right corner of this pop-up to close it.
Once the short scan has finished, check the Complete scan box on the left side, even if nothing was found on the initial scan.
Then click the small green arrow button on the right under the Dr.Web Antivirus picture to start the complete scan. (This scan will take several hours)
During this complete scan - if Dr.Web finds an infection a window will pop up requesting your attention. Select the Cure button.
- Note:(If the file cannot be cured, Dr.Web will automatically delete the file)
Once the scan is complete, on the menu bar, click file and choose report list.
Save the report to your desktop. The report will be called DrWeb.csv
Note:this report will need to be renamed to Dr.Web.txt in order to post it on the forum.
Close Dr.Web Cureit.
Please post the Dr.Web.txt report in your next reply

Calibrator

Post #11April 3, 2009, 2:01 AM UTC

Hi CatByte, Dr Web Log: ComboFix.exe/data002\32788R22FWJFW\c.bat;C:\Documents and Settings\Administrator\Desktop\ComboFix.exe/data002;Probably BATCH.Virus;; ComboFix.exe/data002\32788R22FWJFW\psexec.cfexe;C:\Documents and Settings\Administrator\Desktop\ComboFix.exe/data002;Program.PsExec.171;; data002;C:\Documents and Settings\Administrator\Desktop;Archive contains infected objects;; ComboFix.exe;C:\Documents and Settings\Administrator\Desktop;Container contains infected objects;Moved.; SDFix.exe\SDFix\apps\Process.exe;C:\Documents and Settings\Administrator\Desktop\Virus Stuff\SDFix.exe;Tool.Prockill;; SDFix.exe;C:\Documents and Settings\Administrator\Desktop\Virus Stuff;Archive contains infected objects;Moved.; Process.exe;C:\SDFix\apps;Tool.Prockill;; A0236986.bat;C:\System Volume Information\_restore{97A74ED6-A9D8-42C9-9B21-E61C9697D6D2}\RP659;Probably BATCH.Virus;; A0237131.exe/data002\32788R22FWJFW\c.bat;C:\System Volume Information\_restore{97A74ED6-A9D8-42C9-9B21-E61C9697D6D2}\RP659\A0237131.exe/data002;Probably BATCH.Virus;; A0237131.exe/data002\32788R22FWJFW\psexec.cfexe;C:\System Volume Information\_restore{97A74ED6-A9D8-42C9-9B21-E61C9697D6D2}\RP659\A0237131.exe/data002;Program.PsExec.171;; data002;C:\System Volume Information\_restore{97A74ED6-A9D8-42C9-9B21-E61C9697D6D2}\RP659;Archive contains infected objects;; A0237131.exe;C:\System Volume Information\_restore{97A74ED6-A9D8-42C9-9B21-E61C9697D6D2}\RP659;Container contains infected objects;Moved.; A0237132.exe\SDFix\apps\Process.exe;C:\System Volume Information\_restore{97A74ED6-A9D8-42C9-9B21-E61C9697D6D2}\RP659\A0237132.exe;Tool.Prockill;; A0237132.exe;C:\System Volume Information\_restore{97A74ED6-A9D8-42C9-9B21-E61C9697D6D2}\RP659;Archive contains infected objects;Moved.;

CatByte

Post #12April 3, 2009, 2:32 AM UTC

Hi,

Were you ever able to find the old Dr.Web log showing the 1400 infections…it should have been named DrWeb.csv in the same folder as the Dr.Web program.

Which program detected virut Dr.Web or AVG?….

Please do the following.

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

KillAll::

FCopy::
c:\windows\ServicePackFiles\i386\explorer.exe | c:\windows\explorer.exe 
c:\windows\ServicePackFiles\i386\ctfmon.exe | c:\windows\system32\ctfmon.exe
c:\windows\ServicePackFiles\i386\userinit.exe | c:\windows\system32\userinit.exe

File::
c:\windows\system32\32.tmp
c:\windows\system32\31.tmp
c:\windows\system32\3B.tmp
c:\windows\system32\30.tmp
c:\windows\system32\pqicgjmb.dll

Folder::

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"3853b805"=-

Driver::

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

* Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
* ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
* When finished, it shall produce a log for you.
* Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

NOTE: CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

NEXT

Please click here to download AVP Tool by Kaspersky.

Save it to your desktop.
Reboot your computer into SafeMode.

You can do this by restarting your computer and continually tapping the F8 key until a menu appears.
Use your up arrow key to highlight SafeMode then hit enter.
Double click the setup file to run it.
Click Next to continue.
It will by default install it to your desktop folder. Click Next.
Hit OK at the prompt for scanning in Safe Mode.
It will then open a box. There will be a tab that says Automatic scan.
Under Automatic scan make sure these are checked.

System Memory
Startup Objects
Disk Boot Sectors.
My Computer.
Also any other drives (Removable that you may have)

Then click on Scan at the top right hand Corner.
It will automatically Neutralize any objects found.
If some objects are left unneutralized then click the button that says Neutralize all
If it says it cannot be Neutralized then choose the delete option when prompted.
After that is done click on the reports button at the bottom and save it to file, name it Kas.
Save it to your desktop and just post only the detected Virus\malware in the report it will be at the very top under Detected post those results in your next reply.

Note: This tool will self uninstall when you close it so please save the log before closing it.

In your next reply please include

combofix log
AVP log
Fresh HJT log

CatByte

Post #13April 3, 2009, 8:54 AM UTC

Note: If the combofix script fails to run as directed, it may be because Dr.Web didn't like it and has 'moved it'. If that is the case, please delete the old combofix from your desktop and download a fresh copy to run the script…Thank-you.

Calibrator

Post #14April 3, 2009, 9:10 AM UTC

Hi CatByte, Seems to be OK, I have been running the Kaspersky VRT since 5:30 this morning but it's not due to end until around 14:00…… Will then do the HJT and report the 3 log files. Shaun

CatByte

Post #15April 3, 2009, 9:34 AM UTC

Thats good yes the Kaspersky scan can take hours…. thanks for being patient…

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Virut 32? Terrified to use web.

✨ Ask AI

Ask AI