[Resolved] Google redirect malware, kills spybot, Malwarebytes, H

Ok, now we are talking….. I am seeing some changes……progress.

Ok, Merged your last registry update and some different things happened. For one, the computer actually rebooted without me having to press the PC power button. Next, I deleted the file and it did not come back. I deleted the Combo Fix corpses on the desktop and downloaded a new one, and it actually ran. I noticed in the Log, the sceli.dll is mentioned as still gone in the Combo Fix Log.

So, with so much progress, I performed a search, and the random search garbage is gone.

You Nuked that ######. I still have a few dead programs (access denied), but clearly we may be over the hump here. I have attached the Combo Fix log:


ComboFix 09-08-10.06 - Russ Barrow 08/11/2009 16:55.9.1 - NTFSx86
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
FW: R-Firewall *enabled* {0B117206-430C-4407-9271-1E0D2CBD661F}
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.



.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226ED}
——-\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226EE}


((((((((((((((((((((((((( Files Created from 2009-07-11 to 2009-08-11 )))))))))))))))))))))))))))))))
.

2009-08-10 01:40 . 2009-08-10 01:40 ——– d—–w- c:\program files\Malwarebytes1
2009-08-10 01:38 . 2009-08-10 01:38 3942048 —-a-w- c:\program files\mbam-setup.exe
2009-08-09 21:25 . 2009-08-09 21:25 79960 —-a-w- c:\program files\CCSkeys.exe
2009-08-09 17:21 . 2009-08-09 17:21 ——– d—–w- C:\_OTM
2009-08-08 21:02 . 2009-08-08 21:02 791393 —-a-w- c:\program files\erunt-setup.exe
2009-08-08 16:37 . 2009-08-08 20:41 724952 —-a-w- c:\program files\avenger.zip
2009-08-07 01:40 . 2009-08-07 01:40 ——– d—–w- c:\program files\Bonjour
2009-08-03 23:23 . 2009-08-11 22:54 ——– d—–w- c:\windows\system32\CatRoot
2009-07-28 00:48 . 2009-07-28 00:48 354396 —-a-w- c:\program files\SysProt.zip
2009-07-27 00:04 . 2009-07-27 00:04 4626422 —-a-w- c:\program files\avz4.zip
2009-07-26 22:04 . 2009-07-26 22:04 ——– d—–w- c:\documents and settings\Russ Barrow\DoctorWeb
2009-07-25 17:00 . 2009-07-25 17:00 50688 —-a-w- c:\program files\ATF_Cleaner.exe
2009-07-25 16:54 . 2009-07-25 16:54 ——– d—–w- c:\program files\SmitFraudFix
2009-07-25 16:52 . 2009-07-25 16:52 1826038 —-a-w- c:\program files\SmitfraudFix.zip
2009-07-25 02:21 . 2009-07-25 02:21 117760 —-a-w- c:\documents and settings\Russ Barrow\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-07-25 02:20 . 2009-07-25 02:20 ——– d—–w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-07-25 02:20 . 2009-07-25 02:20 ——– d—–w- c:\program files\SUPERAntiSpyware
2009-07-25 02:20 . 2009-07-25 02:20 ——– d—–w- c:\documents and settings\Russ Barrow\Application Data\SUPERAntiSpyware.com
2009-07-25 02:19 . 2009-07-25 02:19 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2009-07-25 02:17 . 2009-08-03 19:36 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-25 02:17 . 2009-08-03 19:36 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-07-25 02:17 . 2009-07-25 02:17 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-07-25 01:04 . 2009-07-25 01:04 92672 —-a-w- c:\program files\KillBox.exe
2009-07-25 01:04 . 2009-07-25 16:40 ——– d—–w- C:\!KillBox
2009-07-24 20:44 . 2009-07-24 20:45 ——– d—–w- c:\program files\Spybot - Search & Destroy
2009-07-24 05:13 . 2009-07-24 05:13 291328 —-a-w- c:\windows\system32\_qagentrt.dll_.vir
2009-07-24 02:31 . 2008-04-14 11:42 50176 —-a-w- c:\windows\system32\proquota.exe
2009-07-24 02:31 . 2008-04-14 11:42 50176 —-a-w- c:\windows\system32\dllcache\proquota.exe
2009-07-24 02:23 . 2009-07-24 02:23 204 —-a-w- c:\windows\prxid93ps.dat
2009-07-14 22:01 . 2009-07-24 04:46 ——– d—–w- c:\documents and settings\Russ Barrow\Application Data\SoftPerfect Personal Firewall
2009-07-14 21:58 . 2009-07-14 21:58 ——– d—–w- c:\program files\SoftPerfect Personal Firewall
2009-07-14 21:58 . 2008-05-21 03:00 30784 —-a-w- c:\windows\system32\drivers\spfdrv.sys
2009-07-13 23:43 . 2009-07-13 23:43 ——– d—–w- c:\program files\R-TT
2009-07-13 23:18 . 2009-07-25 16:40 ——– d—–w- c:\program files\Spybot
2009-07-13 23:18 . 2009-07-24 22:35 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-11 23:06 . 2009-05-16 14:47 664 —-a-w- c:\windows\system32\d3d9caps.dat
2009-08-11 23:06 . 2008-03-19 01:55 ——– d—–w- c:\documents and settings\Russ Barrow\Application Data\DNA
2009-08-11 23:06 . 2008-03-19 01:55 ——– d—–w- c:\program files\DNA
2009-08-07 01:31 . 2005-11-19 22:03 ——– d—–w- c:\documents and settings\Russ Barrow\Application Data\Apple Computer
2009-07-26 21:49 . 2007-11-14 02:56 ——– d—–w- c:\documents and settings\Russ Barrow\Application Data\BitTorrent
2009-07-26 05:25 . 2009-02-18 04:12 81400 —-a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-26 03:08 . 2008-01-05 01:41 ——– d—–w- c:\program files\AdorageI-SAL
2009-07-26 03:07 . 2006-11-17 01:30 ——– d—–w- c:\program files\TI
2009-07-26 01:33 . 2007-09-08 04:49 ——– d—–w- c:\program files\Stella
2009-07-25 16:37 . 2009-06-28 03:36 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-07-24 22:37 . 2003-12-01 02:46 ——– d—–w- c:\program files\Google
2009-07-24 03:06 . 2009-06-29 00:34 3150436 —-a-r- c:\program files\Combo-Fix.exe
2009-07-15 17:49 . 2003-03-31 23:36 81400 —-a-w- c:\documents and settings\Russ Barrow\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-13 23:46 . 2009-06-28 03:44 ——– d—–w- c:\program files\COMODO
2009-07-13 23:46 . 2004-09-14 01:11 ——– d—–w- c:\program files\CyberArmor
2009-07-13 23:36 . 2003-12-25 20:28 ——– d—–w- c:\program files\Roxio
2009-07-13 23:36 . 2008-04-05 21:24 ——– d—–w- c:\documents and settings\All Users\Application Data\Roxio
2009-07-13 23:36 . 2003-12-25 20:13 ——– d—–w- c:\program files\Common Files\Roxio Shared
2009-07-13 23:28 . 2008-04-05 21:17 ——– d—–w- c:\program files\Common Files\Research In Motion
2009-07-01 01:35 . 2009-07-01 01:35 ——– d—–w- c:\documents and settings\Russ Barrow\Application Data\Malwarebytes
2009-07-01 01:35 . 2009-07-01 01:35 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-07-01 01:17 . 2009-07-01 01:17 ——– d—–w- c:\documents and settings\Russ Barrow\Application Data\AT&T
2009-07-01 01:17 . 2009-07-01 01:17 ——– d—–w- c:\documents and settings\NetworkService\Application Data\Bytemobile
2009-07-01 01:15 . 2009-07-01 01:15 ——– d—–w- c:\documents and settings\LocalService\Application Data\Bytemobile
2009-07-01 01:14 . 2003-03-27 16:28 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-07-01 01:14 . 2009-07-01 01:14 ——– d—–w- c:\documents and settings\Russ Barrow\Application Data\DBUpdater
2009-07-01 01:14 . 2009-07-01 01:14 ——– d—–w- c:\program files\Common Files\Motorola Shared
2009-07-01 01:11 . 2009-07-01 01:11 ——– d—–w- c:\program files\AT&T
2009-07-01 01:11 . 2009-07-01 01:11 ——– d—–w- c:\documents and settings\All Users\Application Data\AT&T
2009-07-01 01:10 . 2009-07-01 01:10 ——– d—–w- c:\program files\Option
2009-07-01 01:08 . 2009-07-01 01:12 25736 —-a-w- c:\windows\system32\drivers\swmsflt.sys
2009-07-01 01:08 . 2009-07-01 01:08 ——– d—–w- c:\program files\Sierra Wireless Inc
2009-07-01 01:08 . 2009-07-01 01:08 ——– d—–w- c:\documents and settings\Russ Barrow\Application Data\Sierra Wireless
2009-06-29 23:52 . 2009-06-29 23:52 ——– d—–w- c:\documents and settings\Russ Barrow\Application Data\Auslogics
2009-06-29 23:52 . 2009-06-29 23:52 ——– d—–w- c:\program files\Auslogics
2009-06-29 23:31 . 2009-06-29 23:44 1868904 —-a-w- c:\program files\disk-defrag-setup.exe
2009-06-29 23:29 . 2009-06-29 23:44 265216 —-a-w- c:\program files\TFC.exe
2009-06-28 17:10 . 2003-03-27 16:31 ——– d—–w- c:\program files\Britannica
2009-06-28 03:36 . 2009-06-28 03:36 ——– d—–w- c:\program files\SpywareBlaster
2009-06-28 03:16 . 2009-06-28 03:16 ——– d—–w- c:\program files\Trend Micro
2009-06-28 02:58 . 2009-06-28 01:13 11314 —-a-w- c:\program files\hijackthis.log
2009-06-28 02:56 . 2009-06-28 02:56 ——– d—–w- c:\program files\ERUNT
2009-06-28 02:21 . 2002-09-03 14:58 78843 —-a-w- c:\windows\PCHealth\HelpCtr\OfflineCache\index.dat
2009-06-28 01:41 . 2009-06-28 01:41 ——– d—–w- c:\program files\backups
2009-06-28 01:10 . 2009-06-28 01:13 218112 —-a-w- c:\program files\HijackThis.exe
2009-06-27 22:14 . 2009-06-27 21:44 692168 —-a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-06-27 21:56 . 2009-06-27 21:56 ——– dc-h–w- c:\documents and settings\All Users\Application Data\{A613CA96-150A-4A1D-90CE-67F81379DF8C}
2009-06-27 21:54 . 2009-06-27 21:54 ——– d—–w- c:\documents and settings\Russ Barrow\Application Data\uniblue
2009-06-27 21:54 . 2009-06-27 21:54 ——– d—–w- c:\program files\Uniblue
2009-06-27 21:43 . 2009-06-27 21:43 ——– d—–w- c:\program files\MSBuild
2009-06-27 21:43 . 2009-06-27 21:43 ——– d—–w- c:\program files\Reference Assemblies
2009-06-27 21:31 . 2008-01-18 03:01 ——– d—–w- c:\program files\Ashampoo
2009-06-27 21:26 . 2009-06-27 21:31 2327856 —-a-w- c:\program files\speedupmypc3plc.exe
2004-06-23 18:55 . 2004-09-11 01:47 20480 —-a-w- c:\program files\ProcManager.exe
2002-07-26 23:02 . 2008-01-05 01:58 153088 —-a-w- c:\program files\UNWISE.EXE
.

——- Sigcheck ——-

[-] 2004-08-04 04:56 14336 8F078AE4ED187AAABC0A305146DE6716 c:\windows\$NtServicePackUninstall$\svchost.exe
[-] 2008-04-14 11:42 14336 27C6D03BCDB8CFEB96B716F3D8BE3E18 c:\windows\ServicePackFiles\i386\svchost.exe
[-] 2004-08-04 07:56 14336 8F078AE4ED187AAABC0A305146DE6716 c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\svchost.exe
[-] 2004-08-04 04:56 14336 8F078AE4ED187AAABC0A305146DE6716 c:\windows\SoftwareDistribution\Download\2d8407673ea9865ef7cd775540e3a36b\backup\svchost.exe
[-] 2008-04-14 11:42 14336 27C6D03BCDB8CFEB96B716F3D8BE3E18 c:\windows\SYSTEM32\svchost.exe
[-] 2008-04-14 11:42 14336 27C6D03BCDB8CFEB96B716F3D8BE3E18 c:\windows\SYSTEM32\DLLCACHE\svchost.exe
[-] 2008-04-14 11:42 14336 27C6D03BCDB8CFEB96B716F3D8BE3E18 c:\windows\SYSTEM32\DLLCACHE\cache\svchost.exe

[-] 2007-03-08 15:48 578048 7AA4F6C00405DFC4B70ED4214E7D687B c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll
[-] 2007-03-08 15:36 577536 B409909F6E2E8A7067076ED748ABF1E7 c:\windows\$NtServicePackUninstall$\user32.dll
[-] 2005-03-02 18:09 577024 DE2DB164BBB35DB061AF0997E4499054 c:\windows\$NtUninstallKB925902$\user32.dll
[-] 2008-04-14 11:42 578560 B26B135FF1B9F60C9388B4A7D16F600B c:\windows\ServicePackFiles\i386\user32.dll
[-] 2004-08-04 07:56 577024 C72661F8552ACE7C5C85E16A3CF505C4 c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\user32.dll
[-] 2005-03-02 18:09 577024 DE2DB164BBB35DB061AF0997E4499054 c:\windows\SoftwareDistribution\Download\2d8407673ea9865ef7cd775540e3a36b\backup\user32.dll
[-] 2008-04-14 11:42 578560 B26B135FF1B9F60C9388B4A7D16F600B c:\windows\SYSTEM32\user32.dll
[-] 2008-04-14 11:42 578560 B26B135FF1B9F60C9388B4A7D16F600B c:\windows\SYSTEM32\DLLCACHE\cache\user32.dll

[-] 2004-08-04 04:56 82944 2ED0B7F12A60F90092081C50FA0EC2B2 c:\windows\$NtServicePackUninstall$\ws2_32.dll
[-] 2008-04-14 11:42 82432 2CCC474EB85CEAA3E1FA1726580A3E5A c:\windows\ServicePackFiles\i386\ws2_32.dll
[-] 2004-08-04 07:56 82944 2ED0B7F12A60F90092081C50FA0EC2B2 c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\ws2_32.dll
[-] 2004-08-04 04:56 82944 2ED0B7F12A60F90092081C50FA0EC2B2 c:\windows\SoftwareDistribution\Download\2d8407673ea9865ef7cd775540e3a36b\backup\ws2_32.dll
[-] 2008-04-14 11:42 82432 2CCC474EB85CEAA3E1FA1726580A3E5A c:\windows\SYSTEM32\ws2_32.dll
[-] 2008-04-14 11:42 82432 2CCC474EB85CEAA3E1FA1726580A3E5A c:\windows\SYSTEM32\DLLCACHE\cache\ws2_32.dll

[-] 2009-04-29 04:49 828928 62CCA075F44015147B8971DAFFBCFF76 c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\wininet.dll
[-] 2006-10-23 15:34 664576 231EF4179ACABE486376B5CA893F1076 c:\windows\ie7\wininet.dll
[-] 2006-11-08 03:03 818688 92995334F993E6E49C25C6D02EC04401 c:\windows\ie7updates\KB928090-IE7\wininet.dll
[-] 2007-01-12 15:27 822784 BE43D00D802C92F01C8CC952C6F483F8 c:\windows\ie7updates\KB969897-IE7\wininet.dll
[-] 2008-04-14 11:42 666112 7A4F775ABB2F1C97DEF3E73AFA2FAEDD c:\windows\ServicePackFiles\i386\wininet.dll
[-] 2004-08-04 07:56 656384 C0823FC5469663BA63E7DB88F9919D70 c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\wininet.dll
[-] 2008-12-20 23:15 826368 A82935D32D0672E8FF4E91AE398E901C c:\windows\SoftwareDistribution\Download\21b9c2f7b1db683e3d83bfb825d32092\SP2GDR\wininet.dll
[-] 2008-12-20 23:56 827904 044E0A4E9FE97C0FB9AFE9C89E2A82E6 c:\windows\SoftwareDistribution\Download\21b9c2f7b1db683e3d83bfb825d32092\SP2QFE\wininet.dll
[-] 2004-08-04 07:56 656384 C0823FC5469663BA63E7DB88F9919D70 c:\windows\SoftwareDistribution\Download\2d8407673ea9865ef7cd775540e3a36b\backup\wininet.dll
[-] 2009-04-29 04:56 827392 8E2D471157B0DF329D8D0EA5D83B0DDB c:\windows\SYSTEM32\wininet.dll
[-] 2009-04-29 04:56 827392 8E2D471157B0DF329D8D0EA5D83B0DDB c:\windows\SYSTEM32\DLLCACHE\wininet.dll
[-] 2009-04-29 04:56 827392 8E2D471157B0DF329D8D0EA5D83B0DDB c:\windows\SYSTEM32\DLLCACHE\cache\wininet.dll

[-] 2008-06-20 11:51 361600 9AEFA14BD6B182D61E3119FA5F436D3D c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
[-] 2008-06-20 11:59 361600 AD978A1B783B5719720CFF204B666C8E c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[-] 2008-06-20 10:44 360960 744E57C99232201AE98C49168B918F48 c:\windows\$NtServicePackUninstall$\tcpip.sys
[-] 2008-04-14 06:50 361344 93EA8D04EC73A85DB02EB8805988F733 c:\windows\$NtUninstallKB951748$\tcpip.sys
[-] 2006-04-20 12:18 360576 B2220C618B42A2212A59D91EBD6FC4B4 c:\windows\$NtUninstallKB951748_0$\tcpip.sys
[-] 2008-04-14 06:50 361344 93EA8D04EC73A85DB02EB8805988F733 c:\windows\ServicePackFiles\i386\tcpip.sys
[-] 2004-08-04 06:14 359040 9F4B36614A0FC234525BA224957DE55C c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\tcpip.sys
[-] 2004-08-04 06:14 359040 9F4B36614A0FC234525BA224957DE55C c:\windows\SoftwareDistribution\Download\2d8407673ea9865ef7cd775540e3a36b\backup\tcpip.sys
[-] 2008-06-20 11:51 361600 9AEFA14BD6B182D61E3119FA5F436D3D c:\windows\SYSTEM32\DLLCACHE\tcpip.sys
[-] 2008-06-20 11:51 361600 9AEFA14BD6B182D61E3119FA5F436D3D c:\windows\SYSTEM32\DLLCACHE\cache\tcpip.sys
[-] 2008-06-20 11:51 361600 9AEFA14BD6B182D61E3119FA5F436D3D c:\windows\SYSTEM32\DRIVERS\tcpip.sys

[-] 2004-08-04 04:56 502272 01C3346C241652F43AED8E2149881BFE c:\windows\$NtServicePackUninstall$\winlogon.exe
[-] 2008-04-14 11:42 507904 ED0EF0A136DEC83DF69F04118870003E c:\windows\ServicePackFiles\i386\winlogon.exe
[-] 2004-08-04 07:56 502272 01C3346C241652F43AED8E2149881BFE c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\winlogon.exe
[-] 2004-08-04 04:56 502272 01C3346C241652F43AED8E2149881BFE c:\windows\SoftwareDistribution\Download\2d8407673ea9865ef7cd775540e3a36b\backup\winlogon.exe
[-] 2008-04-14 11:42 507904 ED0EF0A136DEC83DF69F04118870003E c:\windows\SYSTEM32\winlogon.exe
[-] 2008-04-14 11:42 507904 ED0EF0A136DEC83DF69F04118870003E c:\windows\SYSTEM32\DLLCACHE\cache\winlogon.exe

[-] 2004-08-04 03:14 182912 558635D3AF1C7546D26067D5D9B6959E c:\windows\$NtServicePackUninstall$\ndis.sys
[-] 2008-04-14 06:50 182656 1DF7F42665C94B825322FAE71721130D c:\windows\ServicePackFiles\i386\ndis.sys
[-] 2004-08-04 06:14 182912 558635D3AF1C7546D26067D5D9B6959E c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\ndis.sys
[-] 2004-08-04 03:14 182912 558635D3AF1C7546D26067D5D9B6959E c:\windows\SoftwareDistribution\Download\2d8407673ea9865ef7cd775540e3a36b\backup\ndis.sys
[-] 2008-04-14 06:50 182656 1DF7F42665C94B825322FAE71721130D c:\windows\SYSTEM32\DLLCACHE\cache\ndis.sys
[-] 2008-04-14 06:50 182656 1DF7F42665C94B825322FAE71721130D c:\windows\SYSTEM32\DRIVERS\ndis.sys

[-] 2004-08-04 03:00 29056 4448006B6BC60E6C027932CFC38D6855 c:\windows\$NtServicePackUninstall$\ip6fw.sys
[-] 2008-04-14 06:23 36608 3BB22519A194418D5FEC05D800A19AD0 c:\windows\ServicePackFiles\i386\ip6fw.sys
[-] 2004-08-04 06:00 29056 4448006B6BC60E6C027932CFC38D6855 c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\ip6fw.sys
[-] 2004-08-04 03:00 29056 4448006B6BC60E6C027932CFC38D6855 c:\windows\SoftwareDistribution\Download\2d8407673ea9865ef7cd775540e3a36b\backup\ip6fw.sys
[-] 2008-04-14 06:23 36608 3BB22519A194418D5FEC05D800A19AD0 c:\windows\SYSTEM32\DLLCACHE\cache\ip6fw.sys
[-] 2008-04-14 06:23 36608 3BB22519A194418D5FEC05D800A19AD0 c:\windows\SYSTEM32\DRIVERS\ip6fw.sys

[-] 2006-12-19 16:12 2059392 BA4B97C00A437C1CC3DA365D93EE1E9D c:\windows\$hf_mig$\KB929338\SP2QFE\ntkrnlpa.exe
[-] 2007-02-28 09:15 2059392 4D3DBDCCBF97F5BA1E74F322B155C3BA c:\windows\$hf_mig$\KB931784\SP2QFE\ntkrnlpa.exe
[-] 2009-02-06 09:49 2062976 9D832AF3FD1917DB0E1E8B2F000A2E3A c:\windows\$hf_mig$\KB956572\SP2QFE\ntkrnlpa.exe
[-] 2009-02-08 01:02 2066048 5BA7F2141BC6DB06100D0E5A732C617A c:\windows\$hf_mig$\KB956572\SP3GDR\ntkrnlpa.exe
[-] 2009-02-06 10:30 2066176 607352B9CB3D708C67F6039097801B5A c:\windows\$hf_mig$\KB956572\SP3QFE\ntkrnlpa.exe
[-] 2009-02-06 16:49 2057728 3006410E24772CC6953F0B5C01BEB35F c:\windows\$NtServicePackUninstall$\ntkrnlpa.exe
[-] 2005-03-02 00:34 2056832 81013F36B21C7F72CF784CC6731E0002 c:\windows\$NtUninstallKB929338$\ntkrnlpa.exe
[-] 2006-12-19 12:55 2057600 1D659BFB788ED2BA45075624B748D249 c:\windows\$NtUninstallKB931784$\ntkrnlpa.exe
[-] 2008-04-14 06:01 2065792 109F8E3E3C82E337BB71B6BC9B895D61 c:\windows\$NtUninstallKB956572$\ntkrnlpa.exe
[-] 2007-02-28 08:38 2057600 515D30E2C90A3665A2739309334C9283 c:\windows\$NtUninstallKB956572_0$\ntkrnlpa.exe
[-] 2009-02-08 01:02 2066048 5BA7F2141BC6DB06100D0E5A732C617A c:\windows\Driver Cache\I386\ntkrnlpa.exe
[-] 2008-04-14 06:01 2065792 109F8E3E3C82E337BB71B6BC9B895D61 c:\windows\ServicePackFiles\i386\ntkrnlpa.exe
[-] 2004-08-04 05:58 2056832 947FB1D86D14AFCFFDB54BF837EC25D0 c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\ntkrnlpa.exe
[-] 2005-03-02 00:34 2056832 81013F36B21C7F72CF784CC6731E0002 c:\windows\SoftwareDistribution\Download\2d8407673ea9865ef7cd775540e3a36b\backup\ntkrnlpa.exe
[-] 2009-02-08 01:02 2066048 5BA7F2141BC6DB06100D0E5A732C617A c:\windows\SYSTEM32\ntkrnlpa.exe
[-] 2009-02-08 01:02 2066048 5BA7F2141BC6DB06100D0E5A732C617A c:\windows\SYSTEM32\DLLCACHE\ntkrnlpa.exe
[-] 2009-02-08 01:02 2066048 5BA7F2141BC6DB06100D0E5A732C617A c:\windows\SYSTEM32\DLLCACHE\cache\ntkrnlpa.exe

[-] 2006-12-19 16:51 2182016 CEF243F6DEFD20BE4ADDE26C7ECACB54 c:\windows\$hf_mig$\KB929338\SP2QFE\ntoskrnl.exe
[-] 2007-02-28 09:55 2182144 5A5C8DB4AA962C714C8371FBDF189FC9 c:\windows\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe
[-] 2009-02-06 10:32 2186112 6A936E9D7BADAF3CAAEED1E1966EC1B0 c:\windows\$hf_mig$\KB956572\SP2QFE\ntoskrnl.exe
[-] 2009-02-06 11:08 2189056 7A95B10A73737EBF24139AAA63F5212B c:\windows\$hf_mig$\KB956572\SP3GDR\ntoskrnl.exe
[-] 2009-02-08 01:35 2189184 EFE8EACE83EAAD5849A7A548FB75B584 c:\windows\$hf_mig$\KB956572\SP3QFE\ntoskrnl.exe
[-] 2009-02-06 17:24 2180480 FACEBB0CA3154F77009CDFEE78A00BBB c:\windows\$NtServicePackUninstall$\ntoskrnl.exe
[-] 2005-03-02 00:59 2179328 4D4CF2C14550A4B7718E94A6E581856E c:\windows\$NtUninstallKB929338$\ntoskrnl.exe
[-] 2006-12-19 14:17 2180352 8F0DEAB1F81FB83F9C5995853CE48B9F c:\windows\$NtUninstallKB931784$\ntoskrnl.exe
[-] 2008-04-14 06:57 2188928 0C89243C7C3EE199B96FCC16990E0679 c:\windows\$NtUninstallKB956572$\ntoskrnl.exe
[-] 2007-02-28 09:10 2180352 582A8DBAA58C3B1F176EB2817DAEE77C c:\windows\$NtUninstallKB956572_0$\ntoskrnl.exe
[-] 2009-02-06 11:08 2189056 7A95B10A73737EBF24139AAA63F5212B c:\windows\Driver Cache\I386\ntoskrnl.exe
[-] 2008-04-14 06:57 2188928 0C89243C7C3EE199B96FCC16990E0679 c:\windows\ServicePackFiles\i386\ntoskrnl.exe
[-] 2004-08-04 06:19 2180992 CE218BC7088681FAA06633E218596CA7 c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\ntoskrnl.exe
[-] 2005-03-02 00:59 2179328 4D4CF2C14550A4B7718E94A6E581856E c:\windows\SoftwareDistribution\Download\2d8407673ea9865ef7cd775540e3a36b\backup\ntoskrnl.exe
[-] 2009-02-06 11:08 2189056 7A95B10A73737EBF24139AAA63F5212B c:\windows\SYSTEM32\ntoskrnl.exe
[-] 2009-02-06 11:08 2189056 7A95B10A73737EBF24139AAA63F5212B c:\windows\SYSTEM32\DLLCACHE\ntoskrnl.exe
[-] 2009-02-06 11:08 2189056 7A95B10A73737EBF24139AAA63F5212B c:\windows\SYSTEM32\DLLCACHE\cache\ntoskrnl.exe

[-] 2008-04-14 11:42 1033728 12896823FB95BFB3DC9B46BCAEDC9923 c:\windows\explorer.exe
[-] 2004-08-04 04:56 1032192 A0732187050030AE399B241436565E64 c:\windows\$NtServicePackUninstall$\explorer.exe
[-] 2008-04-14 11:42 1033728 12896823FB95BFB3DC9B46BCAEDC9923 c:\windows\ServicePackFiles\i386\explorer.exe
[-] 2004-08-04 07:56 1032192 A0732187050030AE399B241436565E64 c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\explorer.exe
[-] 2004-08-04 04:56 1032192 A0732187050030AE399B241436565E64 c:\windows\SoftwareDistribution\Download\2d8407673ea9865ef7cd775540e3a36b\backup\explorer.exe
[-] 2008-04-14 11:42 1033728 12896823FB95BFB3DC9B46BCAEDC9923 c:\windows\SYSTEM32\DLLCACHE\cache\explorer.exe

[-] 2009-02-06 10:22 110592 4712531AB7A01B7EE059853CA17D39BD c:\windows\$hf_mig$\KB956572\SP2QFE\services.exe
[-] 2009-02-06 11:11 110592 65DF52F5B8B6E9BBD183505225C37315 c:\windows\$hf_mig$\KB956572\SP3GDR\services.exe
[-] 2009-02-06 11:06 110592 020CEAAEDC8EB655B6506B8C70D53BB6 c:\windows\$hf_mig$\KB956572\SP3QFE\services.exe
[-] 2009-02-06 17:14 110592 37561F8D4160D62DA86D24AE41FAE8DE c:\windows\$NtServicePackUninstall$\services.exe
[-] 2008-04-14 11:42 108544 0E776ED5F7CC9F94299E70461B7B8185 c:\windows\$NtUninstallKB956572$\services.exe
[-] 2004-08-04 04:56 108032 C6CE6EEC82F187615D1002BB3BB50ED4 c:\windows\$NtUninstallKB956572_0$\services.exe
[-] 2008-04-14 11:42 108544 0E776ED5F7CC9F94299E70461B7B8185 c:\windows\ServicePackFiles\i386\services.exe
[-] 2004-08-04 07:56 108032 C6CE6EEC82F187615D1002BB3BB50ED4 c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\services.exe
[-] 2004-08-04 04:56 108032 C6CE6EEC82F187615D1002BB3BB50ED4 c:\windows\SoftwareDistribution\Download\2d8407673ea9865ef7cd775540e3a36b\backup\services.exe
[-] 2009-02-06 11:11 110592 65DF52F5B8B6E9BBD183505225C37315 c:\windows\SYSTEM32\services.exe
[-] 2009-02-06 11:11 110592 65DF52F5B8B6E9BBD183505225C37315 c:\windows\SYSTEM32\DLLCACHE\services.exe
[-] 2009-02-06 11:11 110592 65DF52F5B8B6E9BBD183505225C37315 c:\windows\SYSTEM32\DLLCACHE\cache\services.exe

[-] 2004-08-04 04:56 13312 84885F9B82F4D55C6146EBF6065D75D2 c:\windows\$NtServicePackUninstall$\lsass.exe
[-] 2008-04-14 11:42 13312 BF2466B3E18E970D8A976FB95FC1CA85 c:\windows\ServicePackFiles\i386\lsass.exe
[-] 2004-08-04 07:56 13312 84885F9B82F4D55C6146EBF6065D75D2 c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\lsass.exe
[-] 2004-08-04 04:56 13312 84885F9B82F4D55C6146EBF6065D75D2 c:\windows\SoftwareDistribution\Download\2d8407673ea9865ef7cd775540e3a36b\backup\lsass.exe
[-] 2008-04-14 11:42 13312 BF2466B3E18E970D8A976FB95FC1CA85 c:\windows\SYSTEM32\lsass.exe
[-] 2008-04-14 11:42 13312 BF2466B3E18E970D8A976FB95FC1CA85 c:\windows\SYSTEM32\DLLCACHE\cache\lsass.exe

[-] 2004-08-04 04:56 15360 24232996A38C0B0CF151C2140AE29FC8 c:\windows\$NtServicePackUninstall$\ctfmon.exe
[-] 2008-04-14 11:42 15360 5F1D5F88303D4A4DBC8E5F97BA967CC3 c:\windows\ServicePackFiles\i386\ctfmon.exe
[-] 2004-08-04 07:56 15360 24232996A38C0B0CF151C2140AE29FC8 c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\ctfmon.exe
[-] 2004-08-04 04:56 15360 24232996A38C0B0CF151C2140AE29FC8 c:\windows\SoftwareDistribution\Download\2d8407673ea9865ef7cd775540e3a36b\backup\ctfmon.exe
[-] 2008-04-14 11:42 15360 5F1D5F88303D4A4DBC8E5F97BA967CC3 c:\windows\SYSTEM32\ctfmon.exe
[-] 2008-04-14 11:42 15360 5F1D5F88303D4A4DBC8E5F97BA967CC3 c:\windows\SYSTEM32\DLLCACHE\cache\ctfmon.exe

[-] 2005-06-10 23:53 57856 DA81EC57ACD4CDC3D4C51CF3D409AF9F c:\windows\$NtServicePackUninstall$\spoolsv.exe
[-] 2008-04-14 11:42 57856 D8E14A61ACC1D4A6CD0D38AEBAC7FA3B c:\windows\ServicePackFiles\i386\spoolsv.exe
[-] 2004-08-04 07:56 57856 7435B108B935E42EA92CA94F59C8E717 c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\spoolsv.exe
[-] 2005-06-10 23:53 57856 DA81EC57ACD4CDC3D4C51CF3D409AF9F c:\windows\SoftwareDistribution\Download\2d8407673ea9865ef7cd775540e3a36b\backup\spoolsv.exe
[-] 2008-04-14 11:42 57856 D8E14A61ACC1D4A6CD0D38AEBAC7FA3B c:\windows\SYSTEM32\spoolsv.exe
[-] 2008-04-14 11:42 57856 D8E14A61ACC1D4A6CD0D38AEBAC7FA3B c:\windows\SYSTEM32\DLLCACHE\cache\spoolsv.exe

[-] 2004-08-04 04:56 24576 39B1FFB03C2296323832ACBAE50D2AFF c:\windows\$NtServicePackUninstall$\userinit.exe
[-] 2008-04-14 11:42 26112 A93AEE1928A9D7CE3E16D24EC7380F89 c:\windows\ServicePackFiles\i386\userinit.exe
[-] 2004-08-04 07:56 24576 39B1FFB03C2296323832ACBAE50D2AFF c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\userinit.exe
[-] 2004-08-04 04:56 24576 39B1FFB03C2296323832ACBAE50D2AFF c:\windows\SoftwareDistribution\Download\2d8407673ea9865ef7cd775540e3a36b\backup\userinit.exe
[-] 2008-04-14 11:42 26112 A93AEE1928A9D7CE3E16D24EC7380F89 c:\windows\SYSTEM32\userinit.exe
[-] 2008-04-14 11:42 26112 A93AEE1928A9D7CE3E16D24EC7380F89 c:\windows\SYSTEM32\DLLCACHE\cache\userinit.exe

[-] 2004-08-04 04:56 295424 B60C877D16D9C880B952FDA04ADF16E6 c:\windows\$NtServicePackUninstall$\termsrv.dll
[-] 2008-04-14 11:42 295424 FF3477C03BE7201C294C35F684B3479F c:\windows\ServicePackFiles\i386\termsrv.dll
[-] 2004-08-04 07:56 295424 B60C877D16D9C880B952FDA04ADF16E6 c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\termsrv.dll
[-] 2004-08-04 04:56 295424 B60C877D16D9C880B952FDA04ADF16E6 c:\windows\SoftwareDistribution\Download\2d8407673ea9865ef7cd775540e3a36b\backup\termsrv.dll
[-] 2008-04-14 11:42 295424 FF3477C03BE7201C294C35F684B3479F c:\windows\SYSTEM32\termsrv.dll
[-] 2008-04-14 11:42 295424 FF3477C03BE7201C294C35F684B3479F c:\windows\SYSTEM32\DLLCACHE\cache\termsrv.dll

[-] 2009-03-21 13:54 989184 80202858D245FF07DAA1739C57A3E19B c:\windows\$hf_mig$\KB959426\SP2QFE\kernel32.dll
[-] 2009-03-21 14:06 989696 B921FB870C9AC0D509B2CCABBBBE95F3 c:\windows\$hf_mig$\KB959426\SP3GDR\kernel32.dll
[-] 2009-03-21 13:59 991744 DA11D9D6ECBDF0F93436A4B7C13F7BEC c:\windows\$hf_mig$\KB959426\SP3QFE\kernel32.dll
[-] 2009-03-21 14:18 986112 B6ACAED7588295129791E0E6A2B0FADE c:\windows\$NtServicePackUninstall$\kernel32.dll
[-] 2008-04-14 11:41 989696 C24B983D211C34DA8FCC1AC38477971D c:\windows\$NtUninstallKB959426$\kernel32.dll
[-] 2006-07-05 10:55 984064 D8DB5397DE07577C1CB50BA6D23B3AD4 c:\windows\$NtUninstallKB959426_0$\kernel32.dll
[-] 2008-04-14 11:41 989696 C24B983D211C34DA8FCC1AC38477971D c:\windows\ServicePackFiles\i386\kernel32.dll
[-] 2004-08-04 07:56 983552 888190E31455FAD793312F8D087146EB c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\kernel32.dll
[-] 2006-07-05 10:55 984064 D8DB5397DE07577C1CB50BA6D23B3AD4 c:\windows\SoftwareDistribution\Download\2d8407673ea9865ef7cd775540e3a36b\backup\kernel32.dll
[-] 2009-03-21 14:06 989696 B921FB870C9AC0D509B2CCABBBBE95F3 c:\windows\SYSTEM32\kernel32.dll
[-] 2009-03-21 14:06 989696 B921FB870C9AC0D509B2CCABBBBE95F3 c:\windows\SYSTEM32\DLLCACHE\kernel32.dll
[-] 2009-03-21 14:06 989696 B921FB870C9AC0D509B2CCABBBBE95F3 c:\windows\SYSTEM32\DLLCACHE\cache\kernel32.dll

[-] 2004-08-04 04:56 17408 1B5F6923ABB450692E9FE0672C897AED c:\windows\$NtServicePackUninstall$\powrprof.dll
[-] 2008-04-14 11:42 17408 50A166237A0FA771261275A405646CC0 c:\windows\ServicePackFiles\i386\powrprof.dll
[-] 2004-08-04 07:56 17408 1B5F6923ABB450692E9FE0672C897AED c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\powrprof.dll
[-] 2004-08-04 04:56 17408 1B5F6923ABB450692E9FE0672C897AED c:\windows\SoftwareDistribution\Download\2d8407673ea9865ef7cd775540e3a36b\backup\powrprof.dll
[-] 2008-04-14 11:42 17408 50A166237A0FA771261275A405646CC0 c:\windows\SYSTEM32\powrprof.dll
[-] 2008-04-14 11:42 17408 50A166237A0FA771261275A405646CC0 c:\windows\SYSTEM32\DLLCACHE\cache\powrprof.dll

[-] 2004-08-04 04:56 110080 87CA7CE6469577F059297B9D6556D66D c:\windows\$NtServicePackUninstall$\imm32.dll
[-] 2008-04-14 11:41 110080 0DA85218E92526972A821587E6A8BF8F c:\windows\ServicePackFiles\i386\imm32.dll
[-] 2004-08-04 07:56 110080 87CA7CE6469577F059297B9D6556D66D c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\imm32.dll
[-] 2004-08-04 04:56 110080 87CA7CE6469577F059297B9D6556D66D c:\windows\SoftwareDistribution\Download\2d8407673ea9865ef7cd775540e3a36b\backup\imm32.dll
[-] 2008-04-14 11:41 110080 0DA85218E92526972A821587E6A8BF8F c:\windows\SYSTEM32\imm32.dll
[-] 2008-04-14 11:41 110080 0DA85218E92526972A821587E6A8BF8F c:\windows\SYSTEM32\DLLCACHE\cache\imm32.dll


[-] 2009-04-29 04:49 3598336 C6FD770D518FB024245A0EE217D72BC1 c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\mshtml.dll
[-] 2006-10-23 15:34 3061248 88E1C15BB1A9ED3CBA4D6F2F408D5010 c:\windows\ie7\mshtml.dll
[-] 2006-11-08 03:03 3577856 CBF04597F9CF7739E572276A2698FDD3 c:\windows\ie7updates\KB928090-IE7\mshtml.dll
[-] 2007-01-12 15:27 3580416 5D45318804A30CE9D6EA83066E84B4A7 c:\windows\ie7updates\KB969897-IE7\mshtml.dll
[-] 2008-04-14 11:42 3066880 A706E122B398FE1AB85CB9B75D044223 c:\windows\ServicePackFiles\i386\mshtml.dll
[-] 2004-08-04 07:56 3003392 376E0843B2356CA91CEC8D9837A56FF7 c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\mshtml.dll
[-] 2009-01-17 03:35 3594752 3B413267DA8AE71C20E5EF3E54F74728 c:\windows\SoftwareDistribution\Download\21b9c2f7b1db683e3d83bfb825d32092\SP2GDR\mshtml.dll
[-] 2009-01-16 16:24 3596288 CC9D001B7370B292C35B366CA05B12B4 c:\windows\SoftwareDistribution\Download\21b9c2f7b1db683e3d83bfb825d32092\SP2QFE\mshtml.dll
[-] 2004-08-04 07:56 3003392 376E0843B2356CA91CEC8D9837A56FF7 c:\windows\SoftwareDistribution\Download\2d8407673ea9865ef7cd775540e3a36b\backup\mshtml.dll
[-] 2009-04-29 04:56 3596288 2B4315EC9E3124408A2A5074C4B97700 c:\windows\SYSTEM32\mshtml.dll
[-] 2009-04-29 04:56 3596288 2B4315EC9E3124408A2A5074C4B97700 c:\windows\SYSTEM32\DLLCACHE\mshtml.dll

[-] 2004-08-04 02:58 24576 EBDEE8A2EE5393890A1ACEE971C4C246 c:\windows\$NtServicePackUninstall$\kbdclass.sys
[-] 2008-04-14 06:09 24576 463C1EC80CD17420A542B7F36A36F128 c:\windows\ServicePackFiles\i386\kbdclass.sys
[-] 2004-08-04 05:58 24576 EBDEE8A2EE5393890A1ACEE971C4C246 c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\kbdclass.sys
[-] 2004-08-04 02:58 24576 EBDEE8A2EE5393890A1ACEE971C4C246 c:\windows\SoftwareDistribution\Download\2d8407673ea9865ef7cd775540e3a36b\backup\kbdclass.sys
[-] 2008-04-14 06:09 24576 463C1EC80CD17420A542B7F36A36F128 c:\windows\SYSTEM32\DLLCACHE\cache\kbdclass.sys
[-] 2008-04-14 06:09 24576 463C1EC80CD17420A542B7F36A36F128 c:\windows\SYSTEM32\DRIVERS\kbdclass.sys

[-] 2004-08-04 04:56 792064 6728270CB7DBB776ED086F5AC4C82310 c:\windows\$NtServicePackUninstall$\comres.dll
[-] 2008-04-14 11:41 792064 1280A158C722FA95A80FB7AEBE78FA7D c:\windows\ServicePackFiles\i386\comres.dll
[-] 2004-08-04 07:56 792064 6728270CB7DBB776ED086F5AC4C82310 c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\comres.dll
[-] 2004-08-04 04:56 792064 6728270CB7DBB776ED086F5AC4C82310 c:\windows\SoftwareDistribution\Download\2d8407673ea9865ef7cd775540e3a36b\backup\comres.dll
[-] 2008-04-14 11:41 792064 1280A158C722FA95A80FB7AEBE78FA7D c:\windows\SYSTEM32\comres.dll
[-] 2008-04-14 11:41 792064 1280A158C722FA95A80FB7AEBE78FA7D c:\windows\SYSTEM32\DLLCACHE\cache\comres.dll

[-] 2004-08-04 04:56 22016 74D66B3DE265E8789153414E75175F26 c:\windows\$NtServicePackUninstall$\lpk.dll
[-] 2008-04-14 11:41 22016 012DF358CEBAA23ACB26D82077820817 c:\windows\ServicePackFiles\i386\lpk.dll
[-] 2004-08-04 07:56 22016 74D66B3DE265E8789153414E75175F26 c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\lpk.dll
[-] 2004-08-04 04:56 22016 74D66B3DE265E8789153414E75175F26 c:\windows\SoftwareDistribution\Download\2d8407673ea9865ef7cd775540e3a36b\backup\lpk.dll
[-] 2008-04-14 11:41 22016 012DF358CEBAA23ACB26D82077820817 c:\windows\SYSTEM32\lpk.dll
[-] 2008-04-14 11:41 22016 012DF358CEBAA23ACB26D82077820817 c:\windows\SYSTEM32\DLLCACHE\cache\lpk.dll

[-] 2002-08-29 11:00 4224 DA1F27D85E0D1525F6621372E7B685E9 c:\windows\SYSTEM32\DLLCACHE\cache\BEEP.SYS
[-] 2002-08-29 11:00 4224 DA1F27D85E0D1525F6621372E7B685E9 c:\windows\SYSTEM32\DRIVERS\BEEP.SYS

[-] 2002-08-29 11:00 2944 73C1E1F395918BC2C6DD67AF7591A3AD c:\windows\SYSTEM32\DLLCACHE\cache\NULL.SYS
[-] 2002-08-29 11:00 2944 73C1E1F395918BC2C6DD67AF7591A3AD c:\windows\SYSTEM32\DRIVERS\NULL.SYS

[-] 2006-02-15 00:22 142464 1EE7B434BA961EF845DE136224C30FEC c:\windows\$NtServicePackUninstall$\aec.sys
[-] 2008-04-14 04:09 142592 8BED39E3C35D6A489438B8141717A557 c:\windows\ServicePackFiles\i386\aec.sys
[-] 2004-08-04 05:39 142464 841F385C6CFAF66B58FBD898722BB4F0 c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\aec.sys
[-] 2006-02-15 00:22 142464 1EE7B434BA961EF845DE136224C30FEC c:\windows\SoftwareDistribution\Download\2d8407673ea9865ef7cd775540e3a36b\backup\aec.sys
[-] 2008-04-14 04:09 142592 8BED39E3C35D6A489438B8141717A557 c:\windows\SYSTEM32\DRIVERS\aec.sys

[-] 2006-11-01 19:17 927504 925F8B61ED301A317BA850EBEECBDAA0 c:\windows\$NtServicePackUninstall$\mfc40u.dll
[-] 2002-08-29 11:00 924432 DDF8D47ACF8FC3FE5F7F2B95C4D4D136 c:\windows\$NtUninstallKB924667$\mfc40u.dll
[-] 2008-04-14 11:41 927504 CDDD4416B2B4C7295FE3FDB6DDE57E4E c:\windows\ServicePackFiles\i386\mfc40u.dll
[-] 2002-08-29 11:00 924432 DDF8D47ACF8FC3FE5F7F2B95C4D4D136 c:\windows\SoftwareDistribution\Download\2d8407673ea9865ef7cd775540e3a36b\backup\mfc40u.dll
[-] 2008-04-14 11:41 927504 CDDD4416B2B4C7295FE3FDB6DDE57E4E c:\windows\SYSTEM32\mfc40u.dll
[-] 2008-04-14 11:41 927504 CDDD4416B2B4C7295FE3FDB6DDE57E4E c:\windows\SYSTEM32\DLLCACHE\cache\mfc40u.dll

[-] 2005-04-28 19:35 396288 DA383FB39A6F1C445F3AFC94B3EB1248 c:\windows\$hf_mig$\KB894391\SP2QFE\rpcss.dll
[-] 2009-02-09 10:01 401408 24B5D53B9ACCC1E2EDCF0A878D6659D4 c:\windows\$hf_mig$\KB956572\SP2QFE\rpcss.dll
[-] 2009-02-09 12:10 401408 6B27A5C03DFB94B4245739065431322C c:\windows\$hf_mig$\KB956572\SP3GDR\rpcss.dll
[-] 2009-02-09 10:56 401408 9222562D44021B988B9F9F62207FB6F2 c:\windows\$hf_mig$\KB956572\SP3QFE\rpcss.dll
[-] 2009-02-09 10:20 399360 01095FEBF33BEEA00C2A0730B9B3EC28 c:\windows\$NtServicePackUninstall$\rpcss.dll
[-] 2008-04-14 11:42 399360 2589FE6015A316C0F5D5112B4DA7B509 c:\windows\$NtUninstallKB956572$\rpcss.dll
[-] 2005-07-26 04:39 397824 CE94A2BD25E3E9F4D46A7373FF455C6D c:\windows\$NtUninstallKB956572_0$\rpcss.dll
[-] 2008-04-14 11:42 399360 2589FE6015A316C0F5D5112B4DA7B509 c:\windows\ServicePackFiles\i386\rpcss.dll
[-] 2004-08-04 07:56 395776 5C83A4408604F737717AB96371201680 c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\rpcss.dll
[-] 2005-07-26 04:39 397824 CE94A2BD25E3E9F4D46A7373FF455C6D c:\windows\SoftwareDistribution\Download\2d8407673ea9865ef7cd775540e3a36b\backup\rpcss.dll
[-] 2009-02-09 12:10 401408 6B27A5C03DFB94B4245739065431322C c:\windows\SYSTEM32\rpcss.dll
[-] 2009-02-09 12:10 401408 6B27A5C03DFB94B4245739065431322C c:\windows\SYSTEM32\DLLCACHE\rpcss.dll
[-] 2009-02-09 12:10 401408 6B27A5C03DFB94B4245739065431322C c:\windows\SYSTEM32\DLLCACHE\cache\rpcss.dll

[-] 2004-08-04 04:56 33792 95FD808E4AC22ABA025A7B3EAC0375D2 c:\windows\$NtServicePackUninstall$\msgsvc.dll
[-] 2008-04-14 11:42 33792 986B1FF5814366D71E0AC5755C88F2D3 c:\windows\ServicePackFiles\i386\msgsvc.dll
[-] 2004-08-04 07:56 33792 95FD808E4AC22ABA025A7B3EAC0375D2 c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\msgsvc.dll
[-] 2004-08-04 04:56 33792 95FD808E4AC22ABA025A7B3EAC0375D2 c:\windows\SoftwareDistribution\Download\2d8407673ea9865ef7cd775540e3a36b\backup\msgsvc.dll
[-] 2008-04-14 11:42 33792 986B1FF5814366D71E0AC5755C88F2D3 c:\windows\SYSTEM32\msgsvc.dll
[-] 2008-04-14 11:42 33792 986B1FF5814366D71E0AC5755C88F2D3 c:\windows\SYSTEM32\DLLCACHE\cache\msgsvc.dll

[-] 2006-08-25 15:45 617472 B0124CB21D28B1C9F678B566B6B57D92 c:\windows\$NtServicePackUninstall$\comctl32.dll
[-] 2008-04-14 11:41 617472 06F247492BC786CE5C24A23E178C711A c:\windows\ServicePackFiles\i386\comctl32.dll
[-] 2004-08-04 07:56 611328 A77DFB85FAEE49D66C74DA6024EBC69B c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\comctl32.dll
[-] 2004-08-04 07:57 1050624 5AF68A5E44734A082442668E9C787743 c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\asms\60\msft\windows\common\controls\comctl32.dll
[-] 2004-08-04 07:56 611328 A77DFB85FAEE49D66C74DA6024EBC69B c:\windows\SoftwareDistribution\Download\2d8407673ea9865ef7cd775540e3a36b\backup\comctl32.dll
[-] 2004-08-04 07:57 1050624 5AF68A5E44734A082442668E9C787743 c:\windows\SoftwareDistribution\Download\2d8407673ea9865ef7cd775540e3a36b\backup\asms\60\msft\windows\common\controls\comctl32.dll
[-] 2008-04-14 11:41 617472 06F247492BC786CE5C24A23E178C711A c:\windows\SYSTEM32\comctl32.dll
[-] 2008-04-14 11:41 617472 06F247492BC786CE5C24A23E178C711A c:\windows\SYSTEM32\DLLCACHE\cache\comctl32.dll
[-] 2002-08-29 11:00 921088 AEF3D788DBF40C7C4D204EA45EB0C505 c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\COMCTL32.DLL
[-] 2002-08-29 11:00 921600 76B90BD220F1B1CC9E183C6B1AE9FBB4 c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.10.0_x-ww_f7fb5805\COMCTL32.DLL
[-] 2004-08-20 20:01 921600 FC13804088C77CCA6B6C9B26BA5BDECB c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1579_x-ww_7bbf8d08\comctl32.dll
[-] 2004-12-21 17:55 921600 865CF4B7CA471E4E9E4EC3F3CE60FE9E c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1612_x-ww_7c379b08\comctl32.dll
[-] 2005-03-11 22:51 925184 F6A21D5476C7B4CA9873D97BD246D6EB c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1643_x-ww_7c3a9bc6\comctl32.dll
[-] 2005-09-01 00:49 925184 A93B7C3B08B9AC15B4DCDC96A50E4C2C c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1740_x-ww_7cb8ab44\comctl32.dll
[-] 2004-08-04 04:57 1050624 5AF68A5E44734A082442668E9C787743 c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
[-] 2006-08-25 15:45 1054208 C4E80875C1CF1222FC5EFD0314AE5C01 c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll
[-] 2008-04-14 11:42 1054208 BD38D1EBE24A46BD3EDA059560AFBA12 c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll

[-] 2002-08-29 11:00 11648 9859C0F6936E723E4892D7141B1327D5 c:\windows\SYSTEM32\DLLCACHE\cache\ACPIEC.SYS
[-] 2002-08-29 11:00 11648 9859C0F6936E723E4892D7141B1327D5 c:\windows\SYSTEM32\DRIVERS\ACPIEC.SYS

[-] 2004-08-04 04:56 5120 E8A12A12EA9088B4327D49EDCA3ADD3E c:\windows\$NtServicePackUninstall$\sfc.dll
[-] 2008-04-14 11:42 5120 96E1C926F22EE1BFBAE82901A35F6BF3 c:\windows\ServicePackFiles\i386\sfc.dll
[-] 2004-08-04 07:56 5120 E8A12A12EA9088B4327D49EDCA3ADD3E c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\sfc.dll
[-] 2004-08-04 04:56 5120 E8A12A12EA9088B4327D49EDCA3ADD3E c:\windows\SoftwareDistribution\Download\2d8407673ea9865ef7cd775540e3a36b\backup\sfc.dll
[-] 2008-04-14 11:42 5120 96E1C926F22EE1BFBAE82901A35F6BF3 c:\windows\SYSTEM32\sfc.dll
[-] 2008-04-14 11:42 5120 96E1C926F22EE1BFBAE82901A35F6BF3 c:\windows\SYSTEM32\DLLCACHE\cache\sfc.dll

[-] 2004-08-04 04:56 407040 96353FCECBA774BB8DA74A1C6507015A c:\windows\$NtServicePackUninstall$\netlogon.dll
[-] 2008-04-14 11:42 407040 1B7F071C51B77C272875C3A23E1E4550 c:\windows\ServicePackFiles\i386\netlogon.dll
[-] 2004-08-04 07:56 407040 96353FCECBA774BB8DA74A1C6507015A c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\netlogon.dll
[-] 2004-08-04 04:56 407040 96353FCECBA774BB8DA74A1C6507015A c:\windows\SoftwareDistribution\Download\2d8407673ea9865ef7cd775540e3a36b\backup\netlogon.dll
[-] 2008-04-14 11:42 407040 1B7F071C51B77C272875C3A23E1E4550 c:\windows\SYSTEM32\netlogon.dll

[-] 2004-08-04 04:56 382464 2C69EC7E5A311334D10DD95F338FCCEA c:\windows\$NtServicePackUninstall$\qmgr.dll
[-] 2008-04-14 11:42 409088 574738F61FCA2935F5265DC4E5691314 c:\windows\ServicePackFiles\i386\qmgr.dll
[-] 2004-08-04 07:56 382464 2C69EC7E5A311334D10DD95F338FCCEA c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\qmgr.dll
[-] 2004-08-04 04:56 382464 2C69EC7E5A311334D10DD95F338FCCEA c:\windows\SoftwareDistribution\Download\2d8407673ea9865ef7cd775540e3a36b\backup\qmgr.dll
[-] 2008-04-14 11:42 409088 574738F61FCA2935F5265DC4E5691314 c:\windows\SYSTEM32\qmgr.dll
[-] 2008-04-14 11:42 409088 574738F61FCA2935F5265DC4E5691314 c:\windows\SYSTEM32\bits\qmgr.dll

[-] 2004-08-04 04:56 180224 0F78E27F563F2AAF74B91A49E2ABF19A c:\windows\$NtServicePackUninstall$\scecli.dll
[-] 2008-04-14 11:42 181248 A86BB5E61BF3E39B62AB4C7E7085A084 c:\windows\ServicePackFiles\i386\scecli.dll
[-] 2004-08-04 07:56 180224 0F78E27F563F2AAF74B91A49E2ABF19A c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\scecli.dll
[-] 2004-08-04 04:56 180224 0F78E27F563F2AAF74B91A49E2ABF19A c:\windows\SoftwareDistribution\Download\2d8407673ea9865ef7cd775540e3a36b\backup\scecli.dll

[-] 2004-08-04 03:05 14336 02000ABF34AF4C218C35D257024807D6 c:\windows\$NtServicePackUninstall$\asyncmac.sys
[-] 2008-04-14 06:27 14336 B153AFFAC761E7F5FCFA822B9C4E97BC c:\windows\ServicePackFiles\i386\asyncmac.sys
[-] 2004-08-04 06:05 14336 02000ABF34AF4C218C35D257024807D6 c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\asyncmac.sys
[-] 2004-08-04 03:05 14336 02000ABF34AF4C218C35D257024807D6 c:\windows\SoftwareDistribution\Download\2d8407673ea9865ef7cd775540e3a36b\backup\asyncmac.sys
[-] 2008-04-14 06:27 14336 B153AFFAC761E7F5FCFA822B9C4E97BC c:\windows\SYSTEM32\DRIVERS\asyncmac.sys

[-] 2004-08-04 03:15 574592 B78BE402C3F63DD55521F73876951CDD c:\windows\$NtServicePackUninstall$\ntfs.sys
[-] 2008-04-14 06:45 574976 78A08DD6A8D65E697C18E1DB01C5CDCA c:\windows\ServicePackFiles\i386\ntfs.sys
[-] 2004-08-04 06:15 574592 B78BE402C3F63DD55521F73876951CDD c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\ntfs.sys
[-] 2004-08-04 03:15 574592 B78BE402C3F63DD55521F73876951CDD c:\windows\SoftwareDistribution\Download\2d8407673ea9865ef7cd775540e3a36b\backup\ntfs.sys
[-] 2008-04-14 06:45 574976 78A08DD6A8D65E697C18E1DB01C5CDCA c:\windows\SYSTEM32\DRIVERS\ntfs.sys

[-] 2004-08-04 04:56 170496 92BDF74F12D6CBEC43C94D4B7F804838 c:\windows\$NtServicePackUninstall$\srsvc.dll
[-] 2008-04-14 11:42 171008 3805DF0AC4296A34BA4BF93B346CC378 c:\windows\ServicePackFiles\i386\srsvc.dll
[-] 2004-08-04 07:56 170496 92BDF74F12D6CBEC43C94D4B7F804838 c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\srsvc.dll
[-] 2004-08-04 04:56 170496 92BDF74F12D6CBEC43C94D4B7F804838 c:\windows\SoftwareDistribution\Download\2d8407673ea9865ef7cd775540e3a36b\backup\srsvc.dll
[-] 2008-04-14 11:42 171008 3805DF0AC4296A34BA4BF93B346CC378 c:\windows\SYSTEM32\srsvc.dll

[-] 2004-08-04 04:56 13824 49911DD39E023BB6C45E4E436CFBD297 c:\windows\$NtServicePackUninstall$\wscntfy.exe
[-] 2008-04-14 11:42 13824 F92E1076C42FCD6DB3D72D8CFE9816D5 c:\windows\ServicePackFiles\i386\wscntfy.exe
[-] 2004-08-04 07:56 13824 49911DD39E023BB6C45E4E436CFBD297 c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\wscntfy.exe
[-] 2004-08-04 04:56 13824 49911DD39E023BB6C45E4E436CFBD297 c:\windows\SoftwareDistribution\Download\2d8407673ea9865ef7cd775540e3a36b\backup\wscntfy.exe
[-] 2008-04-14 11:42 13824 F92E1076C42FCD6DB3D72D8CFE9816D5 c:\windows\SYSTEM32\wscntfy.exe

[-] 2004-08-04 04:56 435200 B62F29C00AC55A761B2E45877D85EA0F c:\windows\$NtServicePackUninstall$\ntmssvc.dll
[-] 2008-04-14 11:42 435200 156F64A3345BD23C600655FB4D10BC08 c:\windows\ServicePackFiles\i386\ntmssvc.dll
[-] 2004-08-04 07:56 435200 B62F29C00AC55A761B2E45877D85EA0F c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\ntmssvc.dll
[-] 2004-08-04 04:56 435200 B62F29C00AC55A761B2E45877D85EA0F c:\windows\SoftwareDistribution\Download\2d8407673ea9865ef7cd775540e3a36b\backup\ntmssvc.dll
[-] 2008-04-14 11:42 435200 156F64A3345BD23C600655FB4D10BC08 c:\windows\SYSTEM32\ntmssvc.dll
[-] 2008-04-14 11:42 435200 156F64A3345BD23C600655FB4D10BC08 c:\windows\SYSTEM32\DLLCACHE\cache\ntmssvc.dll

[-] 2004-08-04 04:56 89088 44DB7A9BDD2FB58747D123FBF1D35ADB c:\windows\$NtServicePackUninstall$\rasauto.dll
[-] 2008-04-14 11:42 88576 AD188BE7BDF94E8DF4CA0A55C00A5073 c:\windows\ServicePackFiles\i386\rasauto.dll
[-] 2004-08-04 07:56 89088 44DB7A9BDD2FB58747D123FBF1D35ADB c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\rasauto.dll
[-] 2004-08-04 04:56 89088 44DB7A9BDD2FB58747D123FBF1D35ADB c:\windows\SoftwareDistribution\Download\2d8407673ea9865ef7cd775540e3a36b\backup\rasauto.dll
[-] 2008-04-14 11:42 88576 AD188BE7BDF94E8DF4CA0A55C00A5073 c:\windows\SYSTEM32\rasauto.dll
[-] 2008-04-14 11:42 88576 AD188BE7BDF94E8DF4CA0A55C00A5073 c:\windows\SYSTEM32\DLLCACHE\cache\rasauto.dll

[-] 2004-08-04 04:56 1580544 30A609E00BD1D4FFC49D6B5A432BE7F2 c:\windows\$NtServicePackUninstall$\sfcfiles.dll
[-] 2008-04-14 11:42 1614848 9DD07AF82244867CA36681EA2D29CE79 c:\windows\ServicePackFiles\i386\sfcfiles.dll
[-] 2004-08-04 07:56 1580544 30A609E00BD1D4FFC49D6B5A432BE7F2 c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\sfcfiles.dll
[-] 2004-08-04 04:56 1580544 30A609E00BD1D4FFC49D6B5A432BE7F2 c:\windows\SoftwareDistribution\Download\2d8407673ea9865ef7cd775540e3a36b\backup\sfcfiles.dll
[-] 2008-04-14 11:42 1614848 9DD07AF82244867CA36681EA2D29CE79 c:\windows\SYSTEM32\sfcfiles.dll
[-] 2008-04-14 11:42 1614848 9DD07AF82244867CA36681EA2D29CE79 c:\windows\SYSTEM32\DLLCACHE\sfcfiles.dll
[-] 2008-04-14 11:42 1614848 9DD07AF82244867CA36681EA2D29CE79 c:\windows\SYSTEM32\DLLCACHE\cache\sfcfiles.dll

c:\windows\system32\appmgmts.dll … is missing !!
c:\windows\system32\scecli.dll … is missing !!
.
((((((((((((((((((((((((((((( SnapShot_2009-07-13_21.50.21 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-03-02 14:39 . 2005-03-02 14:39 90432 c:\windows\SYSTEM32\RFWNT.SYS
- 2003-03-27 16:13 . 2009-07-04 01:28 67370 c:\windows\SYSTEM32\PERFC009.DAT
+ 2003-03-27 16:13 . 2009-08-11 22:46 67370 c:\windows\SYSTEM32\PERFC009.DAT
- 2008-08-29 15:53 . 2008-08-29 15:53 61440 c:\windows\SYSTEM32\dnssd.dll
+ 2008-12-12 17:11 . 2008-12-12 17:11 61440 c:\windows\SYSTEM32\dnssd.dll
+ 2008-12-12 17:18 . 2008-12-12 17:18 87336 c:\windows\SYSTEM32\dns-sd.exe
- 2008-08-29 16:18 . 2008-08-29 16:18 87336 c:\windows\SYSTEM32\dns-sd.exe
+ 2009-07-24 22:37 . 2009-07-24 22:37 24064 c:\windows\Installer\ec9577.msi
+ 2009-07-25 02:20 . 2009-07-25 02:20 65024 c:\windows\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF15.exe
+ 2009-07-25 02:20 . 2009-07-25 02:20 18944 c:\windows\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF13.exe
+ 2009-08-07 01:40 . 2009-08-07 01:40 86016 c:\windows\Installer\{07287123-B8AC-41CE-8346-3D777245C35B}\PrntWzrdIco.exe
+ 2009-08-11 23:03 . 2009-08-11 23:03 8192 c:\windows\ERDNT\subs\Users\00000004\UsrClass.dat
+ 2009-08-11 23:03 . 2009-08-11 23:03 8192 c:\windows\ERDNT\subs\Users\00000002\UsrClass.dat
+ 2009-08-10 01:25 . 2009-08-10 01:25 8192 c:\windows\ERDNT\8-9-2009\Users\00000006\UsrClass.dat
+ 2009-08-10 01:25 . 2009-08-10 01:25 8192 c:\windows\ERDNT\8-9-2009\Users\00000002\UsrClass.dat
+ 2002-08-29 11:00 . 2008-04-14 11:42 181248 c:\windows\SYSTEM32\sceclt.dll
+ 2003-03-27 16:13 . 2009-08-11 22:46 432796 c:\windows\SYSTEM32\PERFH009.DAT
- 2003-03-27 16:13 . 2009-07-04 01:28 432796 c:\windows\SYSTEM32\PERFH009.DAT
+ 2002-09-03 15:05 . 2009-08-08 02:18 269392 c:\windows\SYSTEM32\FNTCACHE.DAT
+ 2009-08-11 23:03 . 2009-08-11 23:03 122880 c:\windows\ERDNT\subs\Users\00000006\UsrClass.dat
+ 2009-08-11 23:03 . 2009-08-11 23:03 233472 c:\windows\ERDNT\subs\Users\00000003\ntuser.dat
+ 2009-08-11 23:03 . 2009-08-11 23:03 233472 c:\windows\ERDNT\subs\Users\00000001\NTUSER.DAT
+ 2009-08-09 17:27 . 2009-08-09 17:27 122880 c:\windows\ERDNT\AutoBackup\8-9-2009\Users\00000002\UsrClass.dat
+ 2009-08-09 17:27 . 2005-10-20 18:02 163328 c:\windows\ERDNT\AutoBackup\8-9-2009\ERDNT.EXE
+ 2009-08-08 16:43 . 2009-08-08 16:43 122880 c:\windows\ERDNT\AutoBackup\8-8-2009\Users\00000002\UsrClass.dat
+ 2009-08-08 16:43 . 2005-10-20 18:02 163328 c:\windows\ERDNT\AutoBackup\8-8-2009\ERDNT.EXE
+ 2009-08-08 02:19 . 2009-08-08 02:19 122880 c:\windows\ERDNT\AutoBackup\8-7-2009\Users\00000002\UsrClass.dat
+ 2009-08-08 02:19 . 2005-10-20 18:02 163328 c:\windows\ERDNT\AutoBackup\8-7-2009\ERDNT.EXE
+ 2009-08-07 01:49 . 2009-08-07 01:49 122880 c:\windows\ERDNT\AutoBackup\8-6-2009\Users\00000002\UsrClass.dat
+ 2009-08-07 01:49 . 2005-10-20 18:02 163328 c:\windows\ERDNT\AutoBackup\8-6-2009\ERDNT.EXE
+ 2009-08-05 23:53 . 2009-08-05 23:53 122880 c:\windows\ERDNT\AutoBackup\8-5-2009\Users\00000002\UsrClass.dat
+ 2009-08-05 23:53 . 2005-10-20 18:02 163328 c:\windows\ERDNT\AutoBackup\8-5-2009\ERDNT.EXE
+ 2009-08-03 23:24 . 2009-08-03 23:24 122880 c:\windows\ERDNT\AutoBackup\8-3-2009\Users\00000002\UsrClass.dat
+ 2009-08-03 23:24 . 2005-10-20 18:02 163328 c:\windows\ERDNT\AutoBackup\8-3-2009\ERDNT.EXE
+ 2009-08-11 22:43 . 2009-08-11 22:43 122880 c:\windows\ERDNT\AutoBackup\8-11-2009\Users\00000002\UsrClass.dat
+ 2009-08-11 22:43 . 2005-10-20 18:02 163328 c:\windows\ERDNT\AutoBackup\8-11-2009\ERDNT.EXE
+ 2009-07-29 01:47 . 2009-07-29 01:47 122880 c:\windows\ERDNT\AutoBackup\7-28-2009\Users\00000002\UsrClass.dat
+ 2009-07-29 01:47 . 2005-10-20 18:02 163328 c:\windows\ERDNT\AutoBackup\7-28-2009\ERDNT.EXE
+ 2009-07-26 17:16 . 2009-07-26 17:16 122880 c:\windows\ERDNT\AutoBackup\7-26-2009\Users\00000002\UsrClass.dat
+ 2009-07-26 17:16 . 2005-10-20 18:02 163328 c:\windows\ERDNT\AutoBackup\7-26-2009\ERDNT.EXE
+ 2009-07-24 15:17 . 2009-07-24 15:17 122880 c:\windows\ERDNT\AutoBackup\7-24-2009\Users\00000002\UsrClass.dat
+ 2009-07-24 15:17 . 2005-10-20 18:02 163328 c:\windows\ERDNT\AutoBackup\7-24-2009\ERDNT.EXE
+ 2009-07-23 15:42 . 2009-07-23 15:42 122880 c:\windows\ERDNT\AutoBackup\7-23-2009\Users\00000002\UsrClass.dat
+ 2009-07-23 15:42 . 2005-10-20 18:02 163328 c:\windows\ERDNT\AutoBackup\7-23-2009\ERDNT.EXE
+ 2009-07-20 15:30 . 2009-07-20 15:30 122880 c:\windows\ERDNT\AutoBackup\7-20-2009\Users\00000002\UsrClass.dat
+ 2009-07-20 15:30 . 2005-10-20 18:02 163328 c:\windows\ERDNT\AutoBackup\7-20-2009\ERDNT.EXE
+ 2009-07-14 22:01 . 2009-07-14 22:01 122880 c:\windows\ERDNT\AutoBackup\7-14-2009\Users\00000002\UsrClass.dat
+ 2009-07-14 22:01 . 2005-10-20 18:02 163328 c:\windows\ERDNT\AutoBackup\7-14-2009\ERDNT.EXE
+ 2009-08-10 01:25 . 2009-08-10 01:25 233472 c:\windows\ERDNT\8-9-2009\Users\00000005\ntuser.dat
+ 2009-08-10 01:25 . 2009-08-10 01:25 122880 c:\windows\ERDNT\8-9-2009\Users\00000004\UsrClass.dat
+ 2009-08-10 01:25 . 2009-08-10 01:25 233472 c:\windows\ERDNT\8-9-2009\Users\00000001\NTUSER.DAT
+ 2009-08-09 17:14 . 2005-10-20 18:02 163328 c:\windows\ERDNT\8-9-2009\ERDNT.EXE
+ 2008-09-15 11:57 . 2008-09-15 11:57 1846016 c:\windows\SYSTEM32\win32k.sys
+ 2009-08-07 01:40 . 2009-08-07 01:40 1659392 c:\windows\Installer\59be7eb.msi
+ 2009-07-25 02:20 . 2009-07-25 02:20 1516544 c:\windows\Installer\4dfac7.msi
+ 2009-08-11 23:03 . 2009-08-11 23:03 16130048 c:\windows\ERDNT\subs\Users\00000005\ntuser.dat
+ 2009-08-09 17:27 . 2009-08-09 17:27 16117760 c:\windows\ERDNT\AutoBackup\8-9-2009\Users\00000001\ntuser.dat
+ 2009-08-08 16:43 . 2009-08-08 16:43 16089088 c:\windows\ERDNT\AutoBackup\8-8-2009\Users\00000001\ntuser.dat
+ 2009-08-08 02:19 . 2009-08-08 02:19 16089088 c:\windows\ERDNT\AutoBackup\8-7-2009\Users\00000001\ntuser.dat
+ 2009-08-07 01:49 . 2009-08-07 01:49 16089088 c:\windows\ERDNT\AutoBackup\8-6-2009\Users\00000001\ntuser.dat
+ 2009-08-05 23:53 . 2009-08-05 23:53 16089088 c:\windows\ERDNT\AutoBackup\8-5-2009\Users\00000001\ntuser.dat
+ 2009-08-03 23:24 . 2009-08-03 23:24 16072704 c:\windows\ERDNT\AutoBackup\8-3-2009\Users\00000001\ntuser.dat
+ 2009-08-11 22:43 . 2009-08-11 22:43 16130048 c:\windows\ERDNT\AutoBackup\8-11-2009\Users\00000001\ntuser.dat
+ 2009-07-29 01:47 . 2009-07-29 01:47 16072704 c:\windows\ERDNT\AutoBackup\7-28-2009\Users\00000001\ntuser.dat
+ 2009-07-26 17:16 . 2009-07-26 17:16 16027648 c:\windows\ERDNT\AutoBackup\7-26-2009\Users\00000001\ntuser.dat
+ 2009-07-24 15:17 . 2009-07-24 15:17 16007168 c:\windows\ERDNT\AutoBackup\7-24-2009\Users\00000001\ntuser.dat
+ 2009-07-23 15:42 . 2009-07-23 15:42 16007168 c:\windows\ERDNT\AutoBackup\7-23-2009\Users\00000001\ntuser.dat
+ 2009-07-20 15:30 . 2009-07-20 15:30 16007168 c:\windows\ERDNT\AutoBackup\7-20-2009\Users\00000001\ntuser.dat
+ 2009-07-14 22:01 . 2009-07-14 22:01 15982592 c:\windows\ERDNT\AutoBackup\7-14-2009\Users\00000001\ntuser.dat
+ 2009-08-10 01:25 . 2009-08-10 01:25 16130048 c:\windows\ERDNT\8-9-2009\Users\00000003\ntuser.dat
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-06-11 318272]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-07-24 39408]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-06-23 1830128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"vptray"="c:\progra~1\SYMANT~1\SYMANT~1\vptray.exe" [2004-02-12 90224]
"USB2Check"="c:\windows\system32\PCLECoInst.dll" [2005-12-21 73728]
"USBToolTip"="c:\program files\Pinnacle\Shared Files\\Programs\USBTip\USBTip.exe" [2006-01-23 196608]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-15 644696]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-04 1603152]
"EverioService"="c:\program files\CyberLink\PCM4Everio\EverioService.exe" [2008-05-22 151552]
"CgaViewer"="c:\progra~1\CYBERG~1\cgav.exe" [2005-04-14 81976]
"CgaHelper"="c:\progra~1\CYBERG~1\cgahelp.exe" [2005-04-14 90174]
"AT&T Communication Manager"="c:\program files\AT&T\Communication Manager\ATTCM.exe" [2007-09-19 33280]
"SoftPerfect Personal Firewall"="c:\program files\SoftPerfect Personal Firewall\fw.exe" [2008-08-02 1083904]
"Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-07-24 122368]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]

c:\documents and settings\Russ Barrow\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
F1U201.401.lnk - c:\program files\Belkin\F1U201.401\usbshare.exe [2008-5-5 135168]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 18:05 356352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\AT&T\\Communication Manager\\SwiApiMux.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8085:TCP"= 8085:TCP:sfx

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-04 13592]
R3 ATTRcAppSvc;AT&T RcAppSvc;c:\program files\AT&T\Communication Manager\RcAppSvc.exe [2007-09-18 109080]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-06-23 7408]
R3 SWNC8U56;Sierra Wireless MUX NDIS Driver (UMTS56);c:\windows\system32\DRIVERS\swnc8u56.sys [2007-06-27 101248]
R3 SWUMX56;Sierra Wireless USB MUX Driver (UMTS56);c:\windows\system32\DRIVERS\swumx56.sys [2007-06-27 73856]
R4 DistRestart;DistRestart;c:\windows\srvany.exe [x]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2009-06-23 9968]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2009-06-23 72944]
S2 CGAgent;CyberGatekeeper Agent;c:\progra~1\CYBERG~1\cgasvc.exe [2005-04-14 73788]
S2 ndserv;ndserv;c:\program files\netDeploy\Launcher\ndserv.exe [2000-10-24 859648]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc
.
Contents of the 'Scheduled Tasks' folder

2009-08-08 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 18:34]

2009-08-11 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 00:20]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://thepiratebay.org/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mStart Page = hxxp://www.google.com
mWindow Title = Microsoft Internet Explorer provided by Comcast High-Speed Internet
uInternet Settings,ProxyServer = ftp=wwwgate.ti.com:80;gopher=wwwgate.ti.com:80;http=wwwgate.ti.com:80;https=wwwg
ate.ti.com:81;socks=wwwgate.ti.com:80
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
LSP: bmnet.dll
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-11 17:06
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4C74-92FE-5B863F82066B}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD\000.fcl"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-541624744-611074163-757372905-1006\Software\Microsoft\Driver Signing]
@Denied: (2) (Administrators)
@Allowed: (2) (Administrators)
"Policy"=dword:00000000

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:e2,63,26,f1,3f,c8,ff,68,05,e2,68,f8,d9,
b5,59,16,c8,28,51,af,b0,29,a3,98,34,39,f5,6b,75,33,37,0c,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:6a,9c,d6,61,af,45,84,18,87,8c,40,05,cf,
3a,36,e2,71,3b,04,66,8b,46,0d,96,93,08,f8,51,66,4b,dc,27,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:25,da,ec,7e,55,20,c9,26,d9,cf,ac,7e,8e,
ca,81,80,25,da,ec,7e,55,20,c9,26,e7,37,4c,cc,df,1a,cf,90,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:86,8c,21,01,be,91,eb,e7,6d,29,d3,30,f7,
8b,a7,98,3e,1e,9e,e0,57,5a,93,61,9a,1e,6a,2a,47,4e,d0,ca,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,24,e2,e0,be,69,
76,fc,94,cd,44,cd,b9,a6,33,6c,cd,4e,54,a6,30,20,8d,5f,8d,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:df,20,58,62,78,6b,cf,c8,32,cc,1a,58,c2,
d6,a7,55,b0,18,ed,a7,3f,8d,37,a4,51,31,e7,0c,26,2f,06,42,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:fb,a7,78,e6,12,2f,9a,ea,fe,f4,d0,10,e1,
46,c3,46,31,77,e1,ba,b1,f8,68,02,40,e3,a3,18,52,13,e1,22,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:01,3a,48,fc,e8,04,4a,f1,a7,f1,18,f4,61,
80,84,c4,83,6c,56,8b,a0,85,96,ab,55,88,ed,27,79,3b,af,55,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:f6,0f,4e,58,98,5b,89,c9,da,d3,92,fe,ad,
d5,81,8d,51,fa,6e,91,28,9e,14,cc,10,10,aa,87,b4,76,33,82,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,82,54,1e,ca,3f,
3e,29,9f,b1,cd,45,5a,a8,c4,f8,b9,51,66,7c,85,19,68,11,1d,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:2a,b7,cc,b5,b9,7f,41,e7,80,3c,cf,31,21,
ac,36,10,e3,0e,66,d5,eb,bc,2f,6b,ee,f5,c7,f5,5a,21,7e,50,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:fa,ea,66,7f,d4,3b,6b,70,01,bd,df,a9,08,
80,ec,f4,fa,ea,66,7f,d4,3b,6b,70,55,93,81,f5,e0,f7,07,03,6c,43,2d,1e,aa,22,\

[HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,79,00,73,00,\

[HKEY_LOCAL_MACHINE\software\Microsoft\Internet Explorer\Main\FeatureControl]
@DACL=(02 0000)
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1012)
c:\program files\SUPERAntiSpyware\SASWINLO.dll

- - - - - - - > 'explorer.exe'(280)
c:\program files\Google\Quick Search Box\bin\1.2.1137.3514\qsb.dll
c:\windows\system32\mshtml.dll
c:\program files\Microsoft Office\Office10\msohev.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Exceed.nt\HESHELL.DLL
c:\program files\Exceed.nt\hclftpoa.dll
c:\program files\Exceed.nt\hclFTPx.dll
c:\program files\Exceed.nt\hclFTPx.nls
c:\program files\Exceed.nt\HESHELL.NLS
c:\program files\Exceed.nt\ftpseui.dll
c:\program files\Exceed.nt\ftpseui.nls
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\SYSTEM32\bmwebcfg.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\progra~1\CYBERG~1\cgagent.exe
c:\program files\Cisco Systems\VPN Client\cvpnd.exe
c:\progra~1\SYMANT~1\SYMANT~1\DefWatch.exe
c:\windows\SYSTEM32\Hummbird\inetd32.exe
c:\program files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
c:\progra~1\SYMANT~1\SYMANT~1\Rtvscan.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\windows\SYSTEM32\TCPSVCS.EXE
c:\windows\SYSTEM32\MsPMSPSv.exe
.
**************************************************************************
.
Completion time: 2009-08-11 17:16 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-11 23:16
ComboFix2.txt 2009-07-26 17:53
ComboFix3.txt 2009-07-24 20:30
ComboFix4.txt 2009-07-24 17:06
ComboFix5.txt 2009-08-11 22:54

Pre-Run: 25,297,645,568 bytes free
Post-Run: 25,265,774,592 bytes free

708 — E O F — 2009-07-13 19:25


You are the man,

Russ