[Resolved] Malwarebytes Finds 2 hijack.windowsupdates files

jacory Topic Starter

Post #1December 8, 2009, 4:38 PM UTC

this virus infection has ravaged my computer every six months or so. i would have just formatted the entire hard drive, and reinstalled, but it is a dell inspiron and did not come with recovery CD's, instead it has that hidden partition and its not working. i've been able to get rid of most everything on my computer by uninstalling all virus software (they had been disabled by viruses), downloading the latest version and updates of Malwarebytes, PC Tools Spyware Docter, and SAS. then ran computer in smart mode w/ internet disconnected. all that is left are these 2 entries in Malwarebytes: Registry Data Items Infected: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\BITS\ImagePath (Hijack.WindowsUpdates) -> Bad: (%fystemRoot%\system32\svchost.exe -k netsvcs) Good: (%SystemRoot%\System32\svchost.exe -k netsvcs) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\wuauserv\ImagePath (Hijack.WindowsUpdates) -> Bad: (%fystemroot%\system32\svchost.exe -k netsvcs) Good: (%SystemRoot%\System32\svchost.exe -k netsvcs) -> Quarantined and deleted successfully. every time it is run, these 2 are found, quarantined and deleted. the one other big problem is that i can't run any microsoft updates. i've done everything that microsoft thinks it could be, but nothing works. either my doing it manually or using their automated updater. i think this has been disabled or infected also. any help would be very much appreciated!

Attachments:

📎mbam_log_2009_12_08__11_29_05_.txt

CatByte

Post #2December 11, 2009, 7:34 PM UTC

Hi,

Please do the following:

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.

Disable any script blocking protection
Double click dds.pif to run the tool.
When done, two DDS.txt's will open.
Save both reports to your desktop.

—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.

NEXT

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.

Extract the contents of the zipped file to desktop.
Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

[external image: Posted Image]
Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following …
- Sections
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and post it in your next reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

jacory

Post #3December 12, 2009, 7:47 AM UTC

hi catbyte, much thanks for the help.

DDS.TXT

DDS (Ver_09-12-01.01) - NTFSx86
Run by [removed] at 22:41:26.57 on Fri 12/11/2009
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.503.178 [GMT -5:00]

AV: Spyware Doctor with AntiVirus *On-access scanning disabled* (Updated) {D3C23B96-C9DC-477F-8EF1-69AF17A6EFF6}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\Twain_32\Samsung\CLX3170\Scan2pc.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Twice Bitten\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uSearch Page = hxxp://www.google.com
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearch Bar = hxxp://www.google.com/ie
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Connection Wizard,ShellNext = https://login.live.com/ppsecure/md5auth.srf?lc=1033
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\mi1933~1\office12\GRA8E1~1.DLL
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.2.4204.1700\swg.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
uRun: [Startup Manager] "startUp manager.exe"
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
uRun: [SUPERAntiSpyware] c:\program files\virus software\SUPERAntiSpyware.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [Apoint] c:\program files\apoint\Apoint.exe
mRun: [GrooveMonitor] c:\program files\microsoft office\office12\GrooveMonitor.exe
mRun: [MaxMenuMgr] "c:\program files\seagate\seagatemanager\freeagent status\StxMenuMgr.exe"
mRun: [3170 Scan2PC] "c:\windows\twain_32\samsung\clx3170\Scan2pc.exe"
dRunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe
dPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
IE: - Download &this page with WebCloner - c:\program files\webtools\productsfoundry\webcloner standard 2.4\addthis.htm
IE: - Download all &images with WebCloner - c:\program files\webtools\productsfoundry\webcloner standard 2.4\addimg.htm
IE: - Download all &links with WebCloner - c:\program files\webtools\productsfoundry\webcloner standard 2.4\addurl.htm
IE: - Download selected links with WebCloner - c:\program files\webtools\productsfoundry\webcloner standard 2.4\addsellinks.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Append to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Download selected images with WebCloner - c:\program files\webtools\productsfoundry\webcloner standard 2.4\addselimgs.htm
IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office12\EXCEL.EXE/3000
IE: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - c:\program files\pokerstars\PokerStarsUpdate.exe
IE: {ADFCCE65-DF10-46fd-B04A-53CCBE2A0795} - c:\program files\webtools\productsfoundry\webcloner standard 2.4\WebCloner.exe
IE: {d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\twice bitten\start menu\programs\im\imvu\Run IMVU.lnk
IE: {fb5f1910-f110-11d2-bb9e-00c04f795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\mi1933~1\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8942.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1258511260325
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1258531215093
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {E856B973-45FD-4559-8F82-EAB539144667} - hxxp://pccheckup.dellfix.com/rel/35/install/gtdownde.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\mi1933~1\office12\GR99D3~1.DLL
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: !SASWinLogon - c:\program files\virus software\SASWINLO.dll
Notify: igfxcui - igfxdev.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\mi1933~1\office12\GRA8E1~1.DLL
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\virus software\SASSEH.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\twiceb~1\applic~1\mozilla\firefox\profiles\3d2gasfs.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - GOOGLE.COM
FF - component: c:\documents and settings\twice bitten\application data\mozilla\firefox\profiles\3d2gasfs.default\extensions\{0b457caa-602d-484a-8fe7-c1d894a011ba}\platform\winnt_x86-msvc\components\SSSLauncher.dll
FF - component: c:\documents and settings\twice bitten\application data\mozilla\firefox\profiles\3d2gasfs.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - plugin: c:\documents and settings\twice bitten\application data\mozilla\firefox\profiles\3d2gasfs.default\extensions\[removed]\platform\winnt_x86-msvc\plugins\npmnqmp07061050.dll
FF - plugin: c:\progra~1\imtools\yahoo!\common\npyaxmpb.dll
FF - plugin: c:\program files\google\google updater\2.4.1739.5352\npCIDetect13.dll
FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJava11.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJava12.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJava13.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJava14.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJava32.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJPI150_06.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPOJI610.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npmnqmp07010901.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npmozax.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll
FF - HiddenExtension: XUL Cache: {3AD65D72-F7CC-437B-B9CB-4A0A73D8A1FA} - c:\documents and settings\twice bitten\local settings\application data\{3AD65D72-F7CC-437B-B9CB-4A0A73D8A1FA}
FF - HiddenExtension: XUL Cache: {3308312C-CD57-4D81-94B3-239D698519C2} - c:\documents and settings\your name\local settings\application data\{3308312C-CD57-4D81-94B3-239D698519C2}

—- FIREFOX POLICIES —-
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-2-17 64160]
R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-11-30 207280]
R1 SASDIFSV;SASDIFSV;c:\program files\virus software\sasdifsv.sys [2009-11-23 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\virus software\SASKUTIL.SYS [2009-11-23 74480]
R2 FreeAgentGoNext Service;Seagate Service;c:\program files\seagate\seagatemanager\sync\FreeAgentService.exe [2009-9-25 189736]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2008-1-11 24652]
R3 SASENUM;SASENUM;c:\program files\virus software\SASENUM.SYS [2009-11-23 7408]
S2 SSPORT;SSPORT;\??\c:\windows\system32\drivers\ssport.sys –> c:\windows\system32\drivers\SSPORT.sys [?]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2009-11-30 358600]
S3 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2009-11-30 1141200]
S3 XIRLINK;Veo PC Camera;c:\windows\system32\drivers\ucdnt.sys [2008-3-17 899884]

=============== Created Last 30 ================

2009-12-02 06:25:40 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-02 06:25:37 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-12-02 06:01:12 0 d—–w- c:\program files\common files\Wise Installation Wizard
2009-12-01 10:14:17 0 d—–w- c:\docume~1\twiceb~1\applic~1\Registry Mechanic
2009-12-01 10:06:15 9482240 —-a-w- c:\documents and settings\twice bitten\s-1-5-21-746137067-220523388-839522115-1006.rrr
2009-11-30 20:39:06 7387 —-a-w- c:\windows\system32\drivers\pctgntdi.cat
2009-11-30 20:39:05 229304 —-a-w- c:\windows\system32\drivers\pctgntdi.sys
2009-11-30 20:39:00 87784 —-a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2009-11-30 20:39:00 7412 —-a-w- c:\windows\system32\drivers\PCTAppEvent.cat
2009-11-30 20:39:00 7383 —-a-w- c:\windows\system32\drivers\pctcore.cat
2009-11-30 20:39:00 207280 —-a-w- c:\windows\system32\drivers\PCTCore.sys
2009-11-30 20:38:44 7383 —-a-w- c:\windows\system32\drivers\pctplsg.cat
2009-11-30 20:38:44 70408 —-a-w- c:\windows\system32\drivers\pctplsg.sys
2009-11-30 20:37:37 0 d—–w- c:\program files\common files\PC Tools
2009-11-30 20:37:36 0 d—–w- c:\program files\Spyware Doctor
2009-11-30 20:37:36 0 d—–w- c:\docume~1\twiceb~1\applic~1\PC Tools
2009-11-30 20:37:36 0 d—–w- c:\docume~1\alluse~1.win\applic~1\PC Tools
2009-11-30 19:51:44 0 d—–w- c:\docume~1\twiceb~1\applic~1\Malwarebytes
2009-11-30 19:51:35 0 d—–w- c:\docume~1\alluse~1.win\applic~1\Malwarebytes
2009-11-30 19:09:59 0 d—–w- c:\windows\system32\wbem\Repository
2009-11-19 01:52:02 216064 —-a-w- c:\windows\system32\CNMLM8U.DLL
2009-11-19 01:51:03 188416 —-a-w- c:\windows\system32\CNC470O.DLL
2009-11-19 01:51:02 98304 —-a-w- c:\windows\system32\CNC470I.DLL
2009-11-19 01:51:02 200704 —-a-w- c:\windows\system32\CNC470L.DLL
2009-11-19 01:51:02 1400832 —-a-w- c:\windows\system32\CNC470C.DLL
2009-11-17 20:18:39 13312 —-a-w- c:\windows\system32\BRMFPMON.DLL
2009-11-15 17:44:03 482408 —-a-w- c:\windows\ssndii.exe
2009-11-15 17:44:01 512000 —-a-w- c:\windows\system32\ssmgr.cpl
2009-11-15 17:43:55 113768 —-a-w- c:\windows\Wiainst.exe
2009-11-15 17:43:19 5430 ——w- c:\windows\AnyWeb Print.ico
2009-11-15 17:43:13 87552 —-a-w- c:\windows\system32\SaXPSTI.dll
2009-11-15 17:43:13 7409 —-a-w- c:\windows\system32\WIAUISTR.loc
2009-11-15 17:43:13 57344 —-a-w- c:\windows\system32\Ssdevm.dll
2009-11-15 17:43:13 49152 —-a-w- c:\windows\system32\Ssusbpn.dll
2009-11-15 17:43:13 143872 —-a-w- c:\windows\system32\SaXPWIA.dll
2009-11-15 17:43:13 139776 —-a-w- c:\windows\system32\SaXPEH.dll
2009-11-15 17:43:13 138240 —-a-w- c:\windows\system32\SaXPUIEx.dll
2009-11-15 17:43:13 116736 —-a-w- c:\windows\system32\SaXPIPH.dll

==================== Find3M ====================

2009-10-28 19:37:29 1735 —-a-w- c:\windows\Chexogijanileri.dat
2009-10-28 19:29:16 1719 —-a-w- c:\windows\oyunehoh.dll
2009-10-28 18:23:16 1719 —-a-w- c:\windows\usazaboc.dll
2009-10-28 17:17:16 1719 —-a-w- c:\windows\ecatexete.dll
2009-10-28 16:11:16 1719 —-a-w- c:\windows\apudoyat.dll
2009-10-28 07:42:33 1719 —-a-w- c:\windows\okexepod.dll
2009-10-28 06:36:28 1719 —-a-w- c:\windows\ulunovek.dll
2009-10-28 05:30:22 1719 —-a-w- c:\windows\ojaqogunew.dll
2009-10-28 04:24:21 1719 —-a-w- c:\windows\ojiqesac.dll
2009-10-28 03:18:22 1719 —-a-w- c:\windows\azuzucocalir.dll
2009-10-28 02:12:22 1719 —-a-w- c:\windows\opeyeyog.dll
2009-10-28 01:06:22 1719 —-a-w- c:\windows\irohawag.dll
2009-10-28 00:00:23 1719 —-a-w- c:\windows\ifiqofol.dll
2009-10-27 22:54:22 1719 —-a-w- c:\windows\avivolov.dll
2009-10-27 21:48:22 1719 —-a-w- c:\windows\imuxufapif.dll
2009-10-27 20:42:23 1719 —-a-w- c:\windows\uzuwulaqocubale.dll
2009-10-27 19:36:25 1719 —-a-w- c:\windows\ejeguluk.dll
2009-10-27 18:30:25 1719 —-a-w- c:\windows\ebarohije.dll
2009-10-27 17:24:25 1719 —-a-w- c:\windows\urijeleh.dll
2009-10-27 16:18:28 1719 —-a-w- c:\windows\usuyuvas.dll
2009-10-27 09:19:50 1719 —-a-w- c:\windows\omunizokizi.dll
2009-10-27 08:13:50 1719 —-a-w- c:\windows\uyofifinohaz.dll
2009-10-27 07:07:50 1719 —-a-w- c:\windows\olodazayujupi.dll
2009-10-27 06:01:49 1719 —-a-w- c:\windows\epuyumogavimov.dll
2009-10-27 04:55:50 1719 —-a-w- c:\windows\ijunuresiqaquz.dll
2009-10-27 03:49:50 1719 —-a-w- c:\windows\ahorizazowe.dll
2009-10-27 02:43:50 1719 —-a-w- c:\windows\oqihofus.dll
2009-10-27 01:37:50 1719 —-a-w- c:\windows\ufosozid.dll
2009-10-27 00:31:50 1719 —-a-w- c:\windows\egibozerahemi.dll
2009-10-26 23:25:50 1719 —-a-w- c:\windows\ipufewoqanedev.dll
2009-10-26 22:19:50 1719 —-a-w- c:\windows\arepazopesiqaso.dll
2009-10-26 21:13:50 1719 —-a-w- c:\windows\ogoyuwam.dll
2009-10-26 20:07:59 1719 —-a-w- c:\windows\ajiwaruy.dll
2009-10-26 19:01:54 1719 —-a-w- c:\windows\uhelozug.dll
2009-10-26 17:55:53 1719 —-a-w- c:\windows\erohirewap.dll
2009-10-26 16:49:50 1719 —-a-w- c:\windows\olelevef.dll
2009-10-26 15:43:51 1719 —-a-w- c:\windows\efogugek.dll
2009-10-26 14:37:50 1719 —-a-w- c:\windows\unokodur.dll
2009-10-26 13:31:53 1719 —-a-w- c:\windows\ozugapuqaz.dll
2009-10-26 02:03:01 1719 —-a-w- c:\windows\uqizuxawodafuv.dll
2009-10-26 00:57:01 1719 —-a-w- c:\windows\agitekud.dll
2009-10-25 23:51:01 1719 —-a-w- c:\windows\emodevipejidedu.dll
2009-10-25 22:45:04 1719 —-a-w- c:\windows\amegaxel.dll
2009-10-25 21:39:01 1719 —-a-w- c:\windows\exisovuni.dll
2009-10-25 20:33:14 1719 —-a-w- c:\windows\uviroviqo.dll
2009-10-25 19:27:01 1719 —-a-w- c:\windows\obipikebeg.dll
2009-10-25 18:21:01 1719 —-a-w- c:\windows\anigipamepo.dll
2009-10-25 17:15:01 1719 —-a-w- c:\windows\ilivukoviker.dll
2009-10-25 16:09:05 1719 —-a-w- c:\windows\ocafukif.dll
2009-10-25 07:18:57 1719 —-a-w- c:\windows\onayahejozugi.dll
2009-10-25 06:12:57 1719 —-a-w- c:\windows\evizocohof.dll
2009-10-25 05:06:57 1719 —-a-w- c:\windows\ukicohotucejaqa.dll
2009-10-25 04:00:57 1719 —-a-w- c:\windows\adaleqayisadoqe.dll
2009-10-25 02:54:57 1719 —-a-w- c:\windows\ohesicog.dll
2009-10-25 01:48:57 1719 —-a-w- c:\windows\ipufapoyo.dll
2009-10-25 00:42:57 1719 —-a-w- c:\windows\owecucafuv.dll
2009-10-24 23:36:57 1719 —-a-w- c:\windows\atupucusez.dll
2009-10-24 22:30:57 1719 —-a-w- c:\windows\ecemazekudegem.dll
2009-10-24 21:25:07 1719 —-a-w- c:\windows\atuxowal.dll
2009-10-24 20:19:00 1719 —-a-w- c:\windows\okanelan.dll
2009-10-24 19:12:56 1719 —-a-w- c:\windows\ejeferoc.dll
2009-10-24 18:06:56 1719 —-a-w- c:\windows\omecuraq.dll
2009-10-24 17:00:57 1719 —-a-w- c:\windows\amiyuyebi.dll
2009-10-24 15:54:57 1719 —-a-w- c:\windows\eyuyodege.dll
2009-10-24 14:48:57 1719 —-a-w- c:\windows\eluwasilare.dll
2009-10-24 06:59:34 1719 —-a-w- c:\windows\ixamuked.dll
2009-10-24 05:28:01 1719 —-a-w- c:\windows\eximuvaponameve.dll
2009-10-24 04:22:01 1719 —-a-w- c:\windows\ezuweweciqus.dll
2009-10-24 03:16:01 1719 —-a-w- c:\windows\ozuqazej.dll
2009-10-24 02:10:01 1719 —-a-w- c:\windows\ovufepohe.dll
2009-10-24 01:04:01 1719 —-a-w- c:\windows\ebudukem.dll
2009-10-23 22:49:08 1719 —-a-w- c:\windows\ewevopebasu.dll
2009-10-23 21:43:12 1719 —-a-w- c:\windows\ehijekumibol.dll
2009-10-23 20:37:09 1719 —-a-w- c:\windows\esudekos.dll
2009-10-23 17:24:38 1719 —-a-w- c:\windows\ikazaxifiv.dll
2009-10-23 16:18:37 1719 —-a-w- c:\windows\osiziqowu.dll
2009-10-23 08:49:58 1719 —-a-w- c:\windows\ahukopositadux.dll
2009-10-23 07:43:58 1719 —-a-w- c:\windows\igaboxagijo.dll
2009-10-23 06:37:58 1719 —-a-w- c:\windows\uhocezafiteq.dll
2009-10-23 05:55:56 1719 —-a-w- c:\windows\afoqoqiw.dll
2009-10-22 23:51:59 1719 —-a-w- c:\windows\uvevurijanoxoz.dll
2009-10-22 22:45:59 1719 —-a-w- c:\windows\orukizicesojolo.dll
2009-10-22 21:40:00 1719 —-a-w- c:\windows\ikaloputuyezevu.dll
2009-10-22 20:33:59 1719 —-a-w- c:\windows\ucafoqesodamape.dll
2009-10-22 19:28:00 1719 —-a-w- c:\windows\edovekeg.dll
2009-10-22 18:21:59 1719 —-a-w- c:\windows\axetudiw.dll
2009-10-22 17:16:00 1719 —-a-w- c:\windows\odipuwow.dll
2009-10-22 16:10:00 1719 —-a-w- c:\windows\iwapuhidon.dll
2009-10-22 15:04:00 1719 —-a-w- c:\windows\ucixopakenupiy.dll
2009-10-22 07:28:52 1719 —-a-w- c:\windows\omefonutuliv.dll
2009-10-22 06:22:52 1719 —-a-w- c:\windows\uxohiqopu.dll
2009-10-22 05:16:52 1719 —-a-w- c:\windows\ikozikequwamoh.dll
2009-10-22 04:10:55 1719 —-a-w- c:\windows\izupegogaj.dll
2009-10-22 03:04:53 1719 —-a-w- c:\windows\ominamisuno.dll
2009-10-22 01:58:58 1719 —-a-w- c:\windows\iroqazefijocif.dll
2009-10-22 00:52:55 1719 —-a-w- c:\windows\uxafebos.dll
2009-10-21 23:46:54 1719 —-a-w- c:\windows\uvixifokelod.dll
2009-10-21 22:40:55 1719 —-a-w- c:\windows\izewilojihume.dll
2009-10-21 21:34:54 1719 —-a-w- c:\windows\ukemuguxavigam.dll
2009-10-21 20:29:03 1719 —-a-w- c:\windows\ijifapiti.dll

============= FINISH: 22:42:27.56 ===============

jacory

Post #4December 12, 2009, 7:51 AM UTC

ATTACH.TXT UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT DDS (Ver_09-12-01.01) Microsoft Windows XP Home Edition Boot Device: \Device\HarddiskVolume1 Install Date: 3/4/2009 3:22:23 PM System Uptime: 12/10/2009 9:53:24 AM (37 hours ago) Motherboard: Dell Inc. | | 0W9260 Processor: Intel® Pentium® M processor 1.60GHz | Microprocessor | 797/133mhz ==== Disk Partitions ========================= C: is FIXED (NTFS) - 52 GiB total, 4.211 GiB free. D: is CDROM () E: is Removable ==== Disabled Device Manager Items ============= ==== System Restore Points =================== RP142: 11/8/2009 7:13:40 AM - System Checkpoint RP143: 11/8/2009 11:22:44 AM - Cleaned registry with Windows Live OneCare safety scanner RP144: 11/8/2009 11:27:27 PM - Cleaned registry with Windows Live OneCare safety scanner RP145: 11/10/2009 12:04:42 AM - System Checkpoint RP146: 11/11/2009 12:22:15 AM - System Checkpoint RP147: 11/12/2009 12:46:21 AM - System Checkpoint RP148: 11/13/2009 1:28:40 AM - System Checkpoint RP149: 11/14/2009 6:06:22 AM - System Checkpoint RP150: 11/15/2009 11:29:35 AM - System Checkpoint RP151: 11/16/2009 12:56:17 PM - System Checkpoint RP152: 11/17/2009 4:05:17 PM - System Checkpoint RP153: 11/18/2009 4:59:29 PM - System Checkpoint RP154: 11/20/2009 9:54:36 AM - System Checkpoint RP155: 11/21/2009 10:30:31 AM - System Checkpoint RP156: 11/22/2009 10:47:43 AM - System Checkpoint RP157: 11/23/2009 11:47:44 AM - System Checkpoint RP158: 11/24/2009 2:51:08 PM - System Checkpoint RP159: 11/25/2009 2:54:41 PM - System Checkpoint RP160: 11/26/2009 4:51:25 PM - System Checkpoint RP161: 11/27/2009 2:02:37 PM - Removed AutoCAD 2007 - English RP162: 11/27/2009 3:00:51 PM - Installed DirectX 9.0 RP163: 11/27/2009 3:31:56 PM - Removed AutoCAD Express Tools Volumes 1-9 RP164: 11/27/2009 3:33:34 PM - Installed AutoCAD 2007 - English RP165: 11/28/2009 4:01:04 PM - System Checkpoint RP166: 11/29/2009 4:11:53 PM - System Checkpoint RP167: 11/30/2009 8:23:28 AM - Restore Operation RP168: 11/30/2009 8:35:34 AM - Restore Operation RP169: 11/30/2009 1:33:04 PM - Restore Operation RP170: 11/30/2009 1:53:42 PM - Restore Operation RP171: 11/30/2009 2:19:26 PM - Removed AutoCAD 2007 - English RP172: 11/30/2009 3:48:48 PM - Spyware Doctor: Cleaning Threats RP173: 11/30/2009 8:17:14 PM - Spyware Doctor: Cleaning Threats RP174: 11/30/2009 11:38:23 PM - Installed Windows XP KB884020. RP175: 12/1/2009 12:01:32 AM - Installed Windows Installer KB893803v2. RP176: 12/1/2009 1:13:03 AM - Installed Windows XP KB889673. RP177: 12/1/2009 1:43:36 AM - Revo Uninstaller's restore point - Advanced System Optimizer RP178: 12/1/2009 4:35:22 AM - Spyware Doctor: Cleaning Threats RP179: 12/1/2009 5:04:26 AM - Made by Registry Mechanic O RP180: 12/1/2009 1:44:25 PM - Installed Windows XP KB889673. RP181: 12/1/2009 11:48:30 PM - Revo Uninstaller's restore point - Ad-Aware RP182: 12/2/2009 12:07:53 AM - Revo Uninstaller's restore point - Spybot - Search & Destroy RP183: 12/2/2009 12:17:22 AM - Revo Uninstaller's restore point - Registry Mechanic 9.0 RP184: 12/2/2009 12:47:48 AM - Revo Uninstaller's restore point - Malwarebytes' Anti-Malware RP185: 12/2/2009 1:01:03 AM - Removed SUPERAntiSpyware Free Edition RP186: 12/2/2009 1:04:10 AM - Installed SUPERAntiSpyware Free Edition RP187: 12/2/2009 1:10:38 AM - Revo Uninstaller's restore point - Malwarebytes' Anti-Malware RP188: 12/6/2009 11:20:17 AM - System Checkpoint RP189: 12/10/2009 6:46:41 PM - System Checkpoint RP190: 12/11/2009 7:24:40 PM - System Checkpoint ==== Installed Programs ====================== Absolute Patience Adobe Acrobat 8 Professional - English, Français, Deutsch Adobe Acrobat 8.1.0 Professional Adobe AIR Adobe Anchor Service CS4 Adobe Bridge CS4 Adobe CMaps CS4 Adobe Color - Photoshop Specific CS4 Adobe Color EU Extra Settings CS4 Adobe Color JA Extra Settings CS4 Adobe Color NA Recommended Settings CS4 Adobe Color Video Profiles CS CS4 Adobe Creative Suite Adobe CSI CS4 Adobe Default Language CS4 Adobe Device Central CS4 Adobe Dreamweaver CS4 Adobe Drive CS4 Adobe ExtendScript Toolkit CS4 Adobe Extension Manager CS4 Adobe Flash Player 10 ActiveX Adobe Flash Player 10 Plugin Adobe Fonts All Adobe Illustrator CS Adobe Linguistics CS4 Adobe Media Player Adobe Output Module Adobe PDF Library Files CS4 Adobe Photoshop CS4 Adobe Photoshop CS4 Support Adobe Photoshop Lightroom 2.2 Adobe Search for Help Adobe Service Manager Extension Adobe Setup Adobe Shockwave Player Adobe SVG Viewer 3.0 Adobe Type Support CS4 Adobe Update Manager CS4 Adobe WinSoft Linguistics Plugin Adobe XMP Panels CS4 AdobeColorCommonSetCMYK AdobeColorCommonSetRGB AIM 6 ALPS Touch Pad Driver American Express Publishing Corporation TravelDesk AOL Uninstaller (Choose which Products to Remove) Apple Mobile Device Support ARABIC in 10 minutes a day® AutoCAD 2004 AutoCAD Express Tools Volumes 1-9 Autodesk Architectural 2004 Object Enabler Autodesk DWF Viewer Bonjour Broadcom 440x 10/100 Integrated Controller C-Major Audio Canon iP1600 Canon MP470 series CleanUp! Conexant D110 MDC V.92 Modem Connect Delta Flight Schedules DivX Content Uploader DivX Web Player EPSON Printer Software FileZilla Client [removed] Flickr Uploadr 3.0.5 Footprints Free&Easy Font Viewer 2.0 GiPo@FileUtilities 3.2 Google Earth Google Updater Heads Up Poker Calculator HighMAT Extension to Microsoft Windows XP CD Writing Wizard Hotfix for Windows XP (KB915865) hp officejet g series Intel® Graphics Media Accelerator Driver for Mobile Intel® PROSet/Wireless Software Internal Network Card Power Management Ipswitch WS_FTP LE IrfanView (remove only) iTunes J2SE Runtime Environment 5.0 Update 6 kuler LADSPA_plugins-win-0.4.15 LG USB Drivers Malwarebytes' Anti-Malware mCore mDriver mDrWiFi mHlpDell Microsoft .NET Framework 1.1 Microsoft .NET Framework 2.0 Microsoft Internationalized Domain Names Mitigation APIs Microsoft National Language Support Downlevel APIs Microsoft Office Access MUI (English) 2007 Microsoft Office Access Setup Metadata MUI (English) 2007 Microsoft Office Enterprise 2007 Microsoft Office Excel MUI (English) 2007 Microsoft Office Groove MUI (English) 2007 Microsoft Office Groove Setup Metadata MUI (English) 2007 Microsoft Office InfoPath MUI (English) 2007 Microsoft Office OneNote MUI (English) 2007 Microsoft Office Outlook MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office PowerPoint Viewer 2007 (English) Microsoft Office Project MUI (English) 2007 Microsoft Office Project Professional 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Publisher MUI (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Word MUI (English) 2007 Microsoft Software Update for Web Folders (English) 12 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 mIWA mIWCA mLogView mMHouse Mozilla Firefox (3.5.5) mPfMgr mPfWiz mProSafe mSSO MSXML 6.0 Parser mToolkit mWlsSafe mXML mZConfig National Fire Codes - 2005 Fall Revision Cycle Nokia Multimedia Player PDF Settings CS4 Photoshop Camera Raw Picasa 3 PokerStars Police Call CD-ROM PurePlay Poker QuickSet QuickTime RealPlayer Revo Uninstaller 1.83 Ringo Uploader RSD_LITE_2_5 SafeCast Shared Components Samsung CLX-3170 Series Seagate Manager Installer Security Update for Microsoft .NET Framework 2.0 (KB917283) Skype™ 4.1 Spyware Doctor 7.0 Suite Shared Configuration CS4 SUPERAntiSpyware Free Edition Texas Holdem Hand Calculator United Airlines Timetable Update Application United TravelDesk US Airways V CAST Music V CAST Music Essentials Manager Veo Connect VideoLAN VLC media player 0.8.4a Viewpoint Media Player Visual 2.05.0000 Visual C++ 2008 x86 Runtime - (v9.0.30729) Visual C++ 2008 x86 Runtime - v9.0.30729.01 WebFldrs XP Windows Genuine Advantage v1.3.0254.0 Windows Installer 3.1 (KB893803) Windows Internet Explorer 7 Windows Live Messenger Windows Live OneCare safety scanner Windows Media Format Runtime Windows Media Player 10 Windows XP Hotfix - KB884020 Windows XP Hotfix - KB889673 WinRAR archiver XviD 1.1 final uninstall Yahoo! Messenger ==== Event Viewer Messages From Past Week ======== 12/9/2009 11:06:40 AM, error: PSched [14103] - QoS [Adapter {1C634973-3DBF-470A-8943-B09EB473429B}]: The netcard driver failed the query for OID_GEN_LINK_SPEED. 12/8/2009 2:44:26 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD APPDRV Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss SASDIFSV SASKUTIL Tcpip WS2IFSL 12/8/2009 2:44:26 AM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning. 12/8/2009 2:44:26 AM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning. 12/8/2009 2:44:26 AM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning. 12/8/2009 2:44:26 AM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning. 12/8/2009 2:44:26 AM, error: Service Control Manager [7001] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning. 12/8/2009 2:44:03 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E} 12/8/2009 2:44:03 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} 12/8/2009 11:30:26 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811} 12/6/2009 10:19:58 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM Service service to connect. 12/6/2009 10:19:58 AM, error: Service Control Manager [7000] - The IMAPI CD-Burning COM Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 12/6/2009 10:18:09 AM, error: Service Control Manager [7000] - The SSPORT service failed to start due to the following error: The system cannot find the file specified. 12/6/2009 10:18:09 AM, error: Service Control Manager [7000] - The DgiVecp service failed to start due to the following error: The system cannot find the device specified. 12/6/2009 10:18:09 AM, error: Service Control Manager [7000] - The Automatic Updates service failed to start due to the following error: The system cannot find the file specified. 12/6/2009 10:18:09 AM, error: Service Control Manager [7000] - The ASCTRM service failed to start due to the following error: The system cannot find the file specified. 12/6/2009 10:18:07 AM, error: Print [23] - Printer Lexmark X1100 Series failed to initialize because a suitable Lexmark X1100 Series driver could not be found. 12/10/2009 9:55:36 AM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751) ==== End Of File ===========================

jacory

Post #5December 12, 2009, 7:56 AM UTC

GMER.TXT (pt1) towards the end of the scan (or did it possibly just end early because of the errors?) it started throwing up several errors about not being able to write properly. it also had some rootkit errors like you warned about, but that also was not until the end of the scan.

GMER 1.0.15.15279 - http://www.gmer.net
Rootkit scan 2009-12-12 00:59:28
Windows 5.1.2600 Service Pack 2
Running: gmer.exe; Driver: C:\DOCUME~1\TWICEB~1\LOCALS~1\Temp\pxtdqpow.sys

—- System - GMER 1.0.15 —-

SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateKey [0xF841DE22]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcess [0xF83FECDC]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcessEx [0xF83FEECE]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwDeleteKey [0xF841E610]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwDeleteValueKey [0xF841E8C4]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwOpenKey [0xF841CB14]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwRenameKey [0xF841ED30]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwSetValueKey [0xF841E0E2]
SSDT \??\C:\Program Files\Virus Software\SASKUTIL.sys (SASKUTIL.SYS/SUPERAdBlocker.com and SUPERAntiSpyware.com) ZwTerminateProcess [0xAAECF0B0]

—- Devices - GMER 1.0.15 —-

Device Ntfs.sys (NT File System Driver/Microsoft Corporation)
Device Fastfat.SYS (Fast FAT File System Driver/Microsoft Corporation)
Device mrxsmb.sys (Windows NT SMB Minirdr/Microsoft Corporation)

AttachedDevice fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 2
Reg HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 7
Reg HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 35
Reg HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E969-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 4
Reg HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E969-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E96A-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 4
Reg HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E96A-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E97B-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 4
Reg HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E97B-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E980-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 7
Reg HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E980-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\CurrentControlSet\Services\MRxDAV\EncryptedDirectories@
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys@start 1
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys@type 1
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys@imagepath \systemroot\system32\drivers\UACdvqiqibp.sys
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys@group file system
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@UACd
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@UACc
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@uacsr
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@uaclog
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@uacmask
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@uacbbr
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@UACproc
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@uacurls
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@uacerrors
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys@start 1
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys@type 1
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys@imagepath \systemroot\system32\drivers\UACdvqiqibp.sys
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys@group file system
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@UACd
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@UACc
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uacsr
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uaclog
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uacmask
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uacbbr
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@UACproc
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uacurls
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uacerrors
Reg HKLM\SYSTEM\controlset004\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 2
Reg HKLM\SYSTEM\controlset004\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\controlset004\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 7
Reg HKLM\SYSTEM\controlset004\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\controlset004\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 35
Reg HKLM\SYSTEM\controlset004\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\controlset004\Control\Class\{4D36E969-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 4
Reg HKLM\SYSTEM\controlset004\Control\Class\{4D36E969-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\controlset004\Control\Class\{4D36E96A-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 4
Reg HKLM\SYSTEM\controlset004\Control\Class\{4D36E96A-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\controlset004\Control\Class\{4D36E97B-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 4
Reg HKLM\SYSTEM\controlset004\Control\Class\{4D36E97B-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\controlset004\Control\Class\{4D36E980-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 7
Reg HKLM\SYSTEM\controlset004\Control\Class\{4D36E980-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\controlset004\Services\MRxDAV\EncryptedDirectories@
Reg HKLM\SYSTEM\controlset005\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 2
Reg HKLM\SYSTEM\controlset005\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\controlset005\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 7
Reg HKLM\SYSTEM\controlset005\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\controlset005\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 35
Reg HKLM\SYSTEM\controlset005\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\controlset005\Control\Class\{4D36E969-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 4
Reg HKLM\SYSTEM\controlset005\Control\Class\{4D36E969-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\controlset005\Control\Class\{4D36E96A-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 4
Reg HKLM\SYSTEM\controlset005\Control\Class\{4D36E96A-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\controlset005\Control\Class\{4D36E97B-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 4
Reg HKLM\SYSTEM\controlset005\Control\Class\{4D36E97B-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\controlset005\Control\Class\{4D36E980-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 7
Reg HKLM\SYSTEM\controlset005\Control\Class\{4D36E980-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\controlset005\Services\MRxDAV\EncryptedDirectories@
Reg HKLM\SYSTEM\controlset006\Services\MRxDAV\EncryptedDirectories@

—- Files - GMER 1.0.15 —-

File C:\WINDOWS\Temp\Perflib_Perfdata_2ac.dat 16384 bytes
File C:\WINDOWS\Temp\Perflib_Perfdata_2b0.dat 16384 bytes
File C:\WINDOWS\Temp\Perflib_Perfdata_2fc.dat 16384 bytes
File C:\WINDOWS\Temp\Perflib_Perfdata_368.dat 16384 bytes
File C:\WINDOWS\Temp\Perflib_Perfdata_36c.dat 16384 bytes
File C:\WINDOWS\Temp\Perflib_Perfdata_448.dat 16384 bytes
File C:\WINDOWS\Temp\Perflib_Perfdata_4dc.dat 16384 bytes
File C:\WINDOWS\Temp\Perflib_Perfdata_54c.dat 16384 bytes
File C:\WINDOWS\Temp\Perflib_Perfdata_73c.dat 16384 bytes
File C:\WINDOWS\Temp\Perflib_Perfdata_ab0.dat 16384 bytes
File C:\WINDOWS\Temp\Perflib_Perfdata_da4.dat 16384 bytes
File C:\WINDOWS\Temp\hsperfdata_SYSTEM 0 bytes
File C:\WINDOWS\Temp\hsperfdata_SYSTEM\3480 65536 bytes
File C:\WINDOWS\Temp\libFNP_events.log 4976 bytes
File C:\WINDOWS\Temp\Perflib_Perfdata_248.dat 16384 bytes
File C:\WINDOWS\Temp\Perflib_Perfdata_270.dat 16384 bytes
File C:\WINDOWS\Temp\Perflib_Perfdata_2a0.dat 16384 bytes
File C:\WINDOWS\Temp\Perflib_Perfdata_2a4.dat 16384 bytes
File C:\WINDOWS\pchealth\helpctr\System\images\16x16\arrow_blue_normal_shadow.bmp 2358 bytes
File C:\WINDOWS\pchealth\helpctr\System\images\16x16\arrow_green_normal_shadow.bmp 2358 bytes
File C:\WINDOWS\pchealth\helpctr\System\images\16x16\compat.bmp 1078 bytes
File C:\WINDOWS\pchealth\helpctr\System\images\16x16\errmsg.bmp 1078 bytes
File C:\WINDOWS\pchealth\helpctr\System\images\16x16\support.bmp 1078 bytes
File C:\WINDOWS\pchealth\helpctr\System\images\16x16\tools.bmp 1078 bytes
File C:\WINDOWS\pchealth\helpctr\System\images\16x16\update.bmp 1078 bytes
File C:\WINDOWS\pchealth\helpctr\System\images\16x16\warning.gif 600 bytes
File C:\WINDOWS\pchealth\helpctr\System\images\24x24\arrow_green_mousedown.bmp 2358 bytes
File C:\WINDOWS\pchealth\helpctr\System\images\24x24\arrow_green_mouseover.bmp 2358 bytes
File C:\WINDOWS\pchealth\helpctr\System\images\24x24\arrow_green_normal.bmp 2358 bytes
File C:\WINDOWS\pchealth\helpctr\System\images\32x32\logo.bmp 2358 bytes
File C:\WINDOWS\pchealth\helpctr\System\images\48x48\desktop_icon_01.bmp 9270 bytes
File C:\WINDOWS\pchealth\helpctr\System\images\48x48\desktop_icon_02.bmp 9270 bytes
File C:\WINDOWS\pchealth\helpctr\System\images\48x48\desktop_icon_03.bmp 9270 bytes
File C:\WINDOWS\pchealth\helpctr\System\images\48x48\desktop_icon_04.bmp 9270 bytes
File C:\WINDOWS\pchealth\helpctr\System\images\48x48\desktop_icon_generic.bmp 9270 bytes
File C:\WINDOWS\pchealth\helpctr\System\images\Centers\blue_arrow.gif 674 bytes
File C:\WINDOWS\pchealth\helpctr\System\images\Centers\Connect.gif 1383 bytes
File C:\WINDOWS\pchealth\helpctr\System\images\Centers\IULogo.gif 1839 bytes
File C:\WINDOWS\pchealth\helpctr\System\images\Centers\Uabrand.gif 1525 bytes
File C:\WINDOWS\pchealth\helpctr\System\images\Expando\collapsed.gif 139 bytes
File C:\WINDOWS\pchealth\helpctr\System\images\Expando\endnode.gif 136 bytes
File C:\WINDOWS\pchealth\helpctr\System\images\Expando\expanded.gif 135 bytes
File C:\WINDOWS\pchealth\helpctr\System\images\Expando\helpdoc.gif 207 bytes
File C:\WINDOWS\pchealth\helpctr\System\NetDiag\dglogs.htm 55709 bytes
File C:\WINDOWS\pchealth\helpctr\System\NetDiag\dglogshelp.htm 2654 bytes
File C:\WINDOWS\pchealth\helpctr\System\panels\AdvSearch.htm 19520 bytes
File C:\WINDOWS\pchealth\helpctr\System\panels\blank.htm 608 bytes
File C:\WINDOWS\pchealth\helpctr\System\panels\Context.htm 9174 bytes
File C:\WINDOWS\pchealth\helpctr\System\panels\firstpage.htm 714 bytes
File C:\WINDOWS\pchealth\helpctr\System\panels\HHWrapper.htm 713 bytes
File C:\WINDOWS\pchealth\helpctr\System\panels\MiniNavBar.htm 4764 bytes
File C:\WINDOWS\pchealth\helpctr\System\panels\MiniNavBar.xml 1990 bytes
File C:\WINDOWS\pchealth\helpctr\System\panels\NavBar.htm 20832 bytes
File C:\WINDOWS\pchealth\helpctr\System\panels\NavBar.xml 2513 bytes
File C:\WINDOWS\pchealth\helpctr\System\panels\Options.htm 4418 bytes
File C:\WINDOWS\pchealth\helpctr\System\panels\RemoteHelp.htm 43111 bytes
File C:\WINDOWS\pchealth\helpctr\System\panels\ShareHelp.htm 4553 bytes
File C:\WINDOWS\pchealth\helpctr\System\panels\subpanels 0 bytes
File C:\WINDOWS\pchealth\helpctr\System\panels\subpanels\Channels.htm 8494 bytes
File C:\WINDOWS\pchealth\helpctr\System\panels\subpanels\Favorites.htm 8522 bytes
File C:\WINDOWS\pchealth\helpctr\System\panels\subpanels\History.htm 5369 bytes
File C:\WINDOWS\pchealth\helpctr\System\panels\subpanels\Index.htm 2911 bytes
File C:\WINDOWS\pchealth\helpctr\System\panels\subpanels\Options.htm 3465 bytes
File C:\WINDOWS\pchealth\helpctr\System\panels\subpanels\Search.htm 37469 bytes
File C:\WINDOWS\pchealth\helpctr\System\panels\subpanels\Subsite.htm 6520 bytes
File C:\WINDOWS\pchealth\helpctr\System\panels\Topics.htm 5547 bytes
File C:\WINDOWS\pchealth\helpctr\System\rc\rcRequest.htm 2367 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Common 0 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Common\common.js 5231 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Common\ConnIssue.htm 5403 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Common\constants.js 2151 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Common\icon_information_32x.gif 234 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Common\icon_warning_32x.gif 219 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Common\LearnInternet.htm 1633 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Common\RAHelp.htm 2317 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Common\RCMoreInfo.htm 2981 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Css 0 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Css\RAChat.css 1369 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Css\rc.css 2442 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Css\rcbuddy.css 1308 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\ding.wav 80856 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\helpeeaccept.htm 3907 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction 0 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Client 0 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Client\Animation.gif 4756 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Client\combobox_line.gif 59 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Client\connected.gif 1094 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Client\DividerBar.gif 1024 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Client\DividerBar.htm 346 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Client\DownArrow.gif 838 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Client\RAChatClient.htm 8969 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Client\RAClient.htm 45530 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Client\RAClient.js 11254 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Client\RAStatusBar.htm 7140 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Client\RAToolBar.htm 11187 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Client\RAToolBar.xml 3172 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Client\rcscreen6_head.htm 1290 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Client\rctoolScreen1.htm 2496 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Client\setting.htm 6552 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Client\TakeControl.bmp 3898 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Client\TakeControl.gif 861 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Client\UpArrow.gif 834 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Common 0 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Common\attentioninteraction.gif 690 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Common\ErrorMsgs.htm 2086 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Common\HelpCenter.bmp 3898 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Common\HelpCenter.gif 845 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Common\hide-chat.gif 379 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Common\info.gif 227 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Common\Options.bmp 3898 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Common\Options.gif 713 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Common\Quit.bmp 3898 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Common\Quit.gif 750 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Common\RAControl.js 15709 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Common\RCFileXfer.htm 30918 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Common\SendChat.gif 1041 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Common\SendFile.bmp 3898 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Common\SendFile.gif 694 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Common\SendVoice.bmp 3898 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Common\SendVoice.gif 692 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Common\SendVoiceOn.gif 994 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Common\show-chat.gif 380 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Common\voicefirewallmsg.htm 3226 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Common\VOIPMsgs.htm 2333 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Server 0 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Server\DividerBar1.htm 341 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Server\DividerBar2.htm 353 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Server\ESC_key.gif 2818 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Server\Helpee_line.gif 75 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Server\RAChatServer.htm 8095 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Server\RAServer.htm 21049 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Server\RAServer.js 5158 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Server\RAServerToolBar.htm 14557 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Server\SettingServer.htm 4797 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Server\StopControl.bmp 3898 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Server\StopControl.gif 640 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Server\TakeControlMsgs.htm 3210 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\RAClientLayout.xml 540 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\RAHelpeeAcceptLayout.xml 666 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\RAIMLayout.xml 587 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\RAStartPage.htm 3493 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\RAURA.xml 569 bytes
File C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\rcBuddy.htm 5980 bytes
File C:\WINDOWS\pchealth\helpctr\System\scripts\Common.js 3159 bytes
File C:\WINDOWS\pchealth\helpctr\System\scripts\HomePage__DESKTOP.js 3445 bytes
File C:\WINDOWS\pchealth\helpctr\System\scripts\HomePage__SERVER.js 8844 bytes
File C:\WINDOWS\pchealth\helpctr\System\scripts\HomePage__SHARED.js 4609 bytes
File C:\WINDOWS\pchealth\helpctr\System\scripts\wrapperparam.js 2954 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\commonFunc.js 32141 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics 0 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\33x16pie 0 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\33x16pie\0_chart.gif 734 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\33x16pie\100_chart.gif 741 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\33x16pie\10_chart.gif 784 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\33x16pie\15_chart.gif 778 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\33x16pie\20_chart.gif 775 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\33x16pie\25_chart.gif 781 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\33x16pie\30_chart.gif 782 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\33x16pie\35_chart.gif 793 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\33x16pie\40_chart.gif 789 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\33x16pie\45_chart.gif 785 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\33x16pie\50_chart.gif 762 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\33x16pie\55_chart.gif 777 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\33x16pie\5_chart.gif 773 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\33x16pie\60_chart.gif 789 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\33x16pie\65_chart.gif 1199 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\33x16pie\70_chart.gif 1190 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\33x16pie\75_chart.gif 1194 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\33x16pie\80_chart.gif 1196 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\33x16pie\85_chart.gif 1190 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\33x16pie\90_chart.gif 1196 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\33x16pie\95_chart.gif 1207 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\47x24pie 0 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\47x24pie\0_chart.gif 1345 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\47x24pie\100_chart.gif 1358 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\47x24pie\10_chart.gif 1443 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\47x24pie\15_chart.gif 1435 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\47x24pie\20_chart.gif 1421 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\47x24pie\25_chart.gif 1423 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\47x24pie\30_chart.gif 1428 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\47x24pie\35_chart.gif 1441 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\47x24pie\40_chart.gif 1446 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\47x24pie\45_chart.gif 1446 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\47x24pie\50_chart.gif 1412 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\47x24pie\55_chart.gif 1430 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\47x24pie\5_chart.gif 1413 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\47x24pie\60_chart.gif 1446 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\47x24pie\65_chart.gif 1445 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\47x24pie\70_chart.gif 1435 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\47x24pie\75_chart.gif 1442 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\47x24pie\80_chart.gif 1447 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\47x24pie\85_chart.gif 1426 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\47x24pie\90_chart.gif 1442 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\47x24pie\95_chart.gif 1445 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\alert.gif 118 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\BArrow.gif 674 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\card.gif 162 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\cd.gif 257 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\check.gif 145 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\chip.gif 102 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\down.bmp 1498 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\drive.gif 139 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\error.gif 107 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\floppy.gif 159 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\GArrow.gif 682 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\gears.gif 135 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\greendot.jpg 677 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\info.gif 99 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\monitor.gif 129 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\personalizing.gif 181 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\PieChart.gif 1135 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\PieGrey.gif 67 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\PieWhite.gif 67 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\printer.gif 136 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\r1_c1.gif 114 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\r1_c2.gif 107 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\r1_c3.gif 106 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\r3_c2.gif 107 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\spacer.gif 43 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\system.gif 404 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\Untitled.gif 1135 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\up.bmp 1498 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\usb.gif 262 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\windows.gif 569 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\loc_strings.xml 26520 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\msinfo.htm 2501 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\msinfo.xml 371 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\msinfohss.css 582 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\RSoP.htm 56540 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\RSoP.js 56777 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\sysComponentInfo.htm 25050 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\sysComponentInfo.js 27910 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\sysConfigLaunch.htm 1323 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\sysDiskTS.htm 2537 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\sysEvtLogInfo.htm 10312 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\sysHealthInfo.htm 13556 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\sysHealthInfo.js 20083 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\sysInfoLaunch.htm 4132 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\sysinfomain.htm 4150 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\sysinfosum.htm 16097 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\sysRemoteInfo.htm 1864 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\sysServicesInfo.htm 10136 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\sysSoftwareInfo.htm 7840 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\sysSoftwareInfo.js 9506 bytes
File C:\WINDOWS\pchealth\helpctr\System\sysinfo\wmi_data.js 14129 bytes
File C:\WINDOWS\pchealth\helpctr\System\UpdateCtr\AboutWU.htm 4113 bytes
File C:\WINDOWS\pchealth\helpctr\System\UpdateCtr\Learn.htm 2059 bytes
File C:\WINDOWS\pchealth\helpctr\System\UpdateCtr\LearnInternet.htm 2500 bytes
File C:\WINDOWS\pchealth\helpctr\System\UpdateCtr\learnWU.htm 2518 bytes
File C:\WINDOWS\pchealth\helpctr\System\UpdateCtr\updatecenter.htm 1132 bytes
File C:\WINDOWS\pchealth\helpctr\System_OEM\DellSystem.htm 11372 bytes
File C:\WINDOWS\pchealth\helpctr\System_OEM\dell_content.htm 1965 bytes
File C:\WINDOWS\pchealth\helpctr\System_OEM\dell_content1.htm 1969 bytes
File C:\WINDOWS\pchealth\helpctr\System_OEM\dell_content2.htm 1975 bytes
File C:\WINDOWS\pchealth\helpctr\System_OEM\dell_content3.htm 1971 bytes
File C:\WINDOWS\pchealth\helpctr\System_OEM\images 0 bytes
File C:\WINDOWS\pchealth\helpctr\System_OEM\images\Dell_icon.bmp 9270 bytes
File C:\WINDOWS\pchealth\helpctr\System_OEM\images\Desktop_icon.gif 2542 bytes
File C:\WINDOWS\pchealth\helpctr\System_OEM\images\portable_icon.gif 2457 bytes
File C:\WINDOWS\pchealth\helpctr\System_OEM\XMLs 0 bytes
File C:\WINDOWS\pchealth\helpctr\System_OEM\XMLs\locxml.xml 5102 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US 0 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Connection.htm 627 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\GArrow.gif 682 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\GRect.gif 311 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Info_Icon.gif 213 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\OfflineDC.htm 13050 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\OfflineOptions.htm 2722 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\PSS.css 781 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\pssmachinesnapshot-less.xml 7098 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\pssmachinesnapshot-wo-com.xml 10755 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\pssmachinesnapshot.xml 10912 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\pss_getting_worldwide_help.htm 30494 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\r1_c1.gif 114 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\r1_c2.gif 107 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\r1_c3.gif 106 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\r3_c2.gif 107 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance 0 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common 0 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\common.js 5231 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\ConnIssue.htm 5403 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\constants.js 2151 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\icon_information_32x.gif 234 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\icon_warning_32x.gif 219 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\LearnInternet.htm 1633 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\RAHelp.htm 2317 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\RCMoreInfo.htm 5930 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\confirm.htm 2843 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Css 0 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Css\RAChat.css 1369 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Css\rc.css 2442 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Css\rcbuddy.css 1308 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation 0 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common 0 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\address_book.gif 102 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\arrow.gif 1074 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\attention.gif 690 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\buddy.gif 387 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\buddy_attention.gif 608 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\buddy_away.gif 382 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\buddy_busy.gif 373 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\buddy_none.gif 910 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\buddy_offline.gif 384 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\Envelope.gif 111 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\floppy.gif 159 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\generic_mail.gif 1047 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\icon_extweb.gif 321 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\IM_icon.gif 139 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\info.gif 227 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\logon_anim.gif 3169 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\messenger_big.gif 1473 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\monitor_left.gif 7066 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\monitor_right.gif 8509 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\outlook.gif 180 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\outlook_express.gif 410 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\rcConnection.htm 3332 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\rcscreen1.htm 2630 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\rcscreen2.htm 4437 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\rcscreen3.htm 321 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\Remote_Assistance_Graphic.png 53542 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\square_bullet.gif 51 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email 0 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\check.gif 137 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\escalationhelp.htm 3425 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\help.gif 254 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcDetails.htm 4805 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcInviteStatus.htm 5207 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcscreen4.htm 4374 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcscreen5.htm 14765 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcscreen6.htm 30465 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcscreen6_head.htm 1290 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcscreen7.htm 8096 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcscreen8.htm 7662 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcscreen9.htm 8445 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcscreenshot3.gif 14603 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\ShieldsUpMsg.htm 3282 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Unsolicited 0 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Unsolicited\UnSolicitedRCUI.htm 13433 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\rcstatus.htm 16167 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\spacer.gif 43 bytes
File C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\status_ok.gif 232 bytes
File C:\WINDOWS\ShellNew\EXCEL12.XLSX 8714 bytes
File C:\WINDOWS\ShellNew\MSPROJ11.MPP 140800 bytes
File C:\WINDOWS\ShellNew\MSPUB.PUB 59904 bytes
File C:\WINDOWS\ShellNew\PWRPNT12.PPTX 27140 bytes
File C:\WINDOWS\twain_32\MP470 series\SCRPRMV.DLL 118784 bytes executable
File C:\WINDOWS\twain_32\MP470 series\SGRES_PL.DLL 1048576 bytes executable
File C:\WINDOWS\twain_32\MP470 series\AG.DLL 73728 bytes executable
File C:\WINDOWS\twain_32\MP470 series\BaLCo.dll 57344 bytes executable
File C:\WINDOWS\twain_32\MP470 series\CAPS.DLL 86016 bytes executable
File C:\WINDOWS\twain_32\MP470 series\CFine2.dll 126976 bytes executable
File C:\WINDOWS\twain_32\MP470 series\CISDS.DS 73728 bytes executable
File C:\WINDOWS\twain_32\MP470 series\CNC470.DAT 3724256 bytes
File C:\WINDOWS\twain_32\MP470 series\CNC470M.DAT 376 bytes
File C:\WINDOWS\twain_32\MP470 series\CNC470P.DAT 49224 bytes
File C:\WINDOWS\twain_32\MP470 series\CUBS.DLL 143360 bytes executable
File C:\WINDOWS\twain_32\MP470 series\HSL.DLL 53248 bytes executable
File C:\WINDOWS\twain_32\MP470 series\IJFSHLIB.DLL 53248 bytes executable
File C:\WINDOWS\twain_32\MP470 series\IOP.DLL 184320 bytes executable
File C:\WINDOWS\twain_32\MP470 series\IPM.DAT 39187 bytes
File C:\WINDOWS\twain_32\MP470 series\IPM.DLL 135168 bytes executable
File C:\WINDOWS\twain_32\MP470 series\ITLIB32.DLL 114688 bytes executable
File C:\WINDOWS\twain_32\MP470 series\libBLC.dll 290816 bytes executable
File C:\WINDOWS\twain_32\MP470 series\MC2.DLL 122880 bytes executable
File C:\WINDOWS\twain_32\MP470 series\RSTCOL.DLL 73728 bytes executable
File C:\WINDOWS\twain_32\MP470 series\SCANINTF.DLL 147456 bytes executable
File C:\WINDOWS\twain_32\MP470 series\SGCFLTR.DLL 1159168 bytes
File C:\WINDOWS\twain_32\MP470 series\SGRES_AR.DLL 1040384 bytes executable
File C:\WINDOWS\twain_32\MP470 series\SGRES_CN.DLL 1040384 bytes executable
File C:\WINDOWS\twain_32\MP470 series\SGRES_CZ.DLL 1044480 bytes executable
File C:\WINDOWS\twain_32\MP470 series\SGRES_DE.DLL 1052672 bytes executable
File C:\WINDOWS\twain_32\MP470 series\SGRES_DK.DLL 1044480 bytes executable
File C:\WINDOWS\twain_32\MP470 series\SGRES_ES.DLL 1056768 bytes executable
File C:\WINDOWS\twain_32\MP470 series\SGRES_FI.DLL 1040384 bytes executable
File C:\WINDOWS\twain_32\MP470 series\SGRES_FR.DLL 1052672 bytes executable
File C:\WINDOWS\twain_32\MP470 series\SGRES_GR.DLL 1056768 bytes executable
File C:\WINDOWS\twain_32\MP470 series\SGRES_HU.DLL 1048576 bytes executable
File C:\WINDOWS\twain_32\MP470 series\SGRES_ID.DLL 1044480 bytes executable
File C:\WINDOWS\twain_32\MP470 series\SGRES_IT.DLL 1056768 bytes executable
File C:\WINDOWS\twain_32\MP470 series\SGRES_JP.DLL 1011712 bytes executable
File C:\WINDOWS\twain_32\MP470 series\SGRES_KR.DLL 1040384 bytes executable
File C:\WINDOWS\twain_32\MP470 series\SGRES_NL.DLL 1052672 bytes executable
File C:\WINDOWS\twain_32\MP470 series\SGRES_NO.DLL 1040384 bytes executable
File C:\WINDOWS\twain_32\MP470 series\SGRES_PT.DLL 1048576 bytes executable
File C:\WINDOWS\twain_32\MP470 series\SGRES_RU.DLL 1044480 bytes executable
File C:\WINDOWS\twain_32\MP470 series\SGRES_SE.DLL 1044480 bytes executable
File C:\WINDOWS\twain_32\MP470 series\SGRES_TH.DLL 1040384 bytes executable
File C:\WINDOWS\twain_32\MP470 series\SGRES_TR.DLL 1040384 bytes executable
File C:\WINDOWS\twain_32\MP470 series\SGRES_TW.DLL 1040384 bytes executable
File C:\WINDOWS\twain_32\MP470 series\SGRES_US.DLL 1040384 bytes executable
File C:\WINDOWS\twain_32\MP470 series\SGUI.DLL 1175552 bytes executable
File C:\WINDOWS\twain_32\MP470 series\softfare.dll 98304 bytes executable
File C:\WINDOWS\twain_32\MP470 series\TPM.DLL 524288 bytes executable
File C:\WINDOWS\twain_32\MP470 series\USDRESAR.DLL 4608 bytes executable
File C:\WINDOWS\twain_32\MP470 series\USDRESCN.DLL 4608 bytes executable
File C:\WINDOWS\twain_32\MP470 series\USDRESCZ.DLL 4608 bytes executable
File C:\WINDOWS\twain_32\MP470 series\USDRESDE.DLL 4608 bytes executable
File C:\WINDOWS\twain_32\MP470 series\USDRESDK.DLL 4608 bytes executable
File C:\WINDOWS\twain_32\MP470 series\USDRESES.DLL 4608 bytes executable
File C:\WINDOWS\twain_32\MP470 series\USDRESFI.DLL 5120 bytes executable
File C:\WINDOWS\twain_32\MP470 series\USDRESFR.DLL 4608 bytes executable
File C:\WINDOWS\twain_32\MP470 series\USDRESGR.DLL 4608 bytes executable
File C:\WINDOWS\twain_32\MP470 series\USDRESHU.DLL 4608 bytes executable
File C:\WINDOWS\twain_32\MP470 series\USDRESID.DLL 4608 bytes executable
File C:\WINDOWS\twain_32\MP470 series\USDRESIT.DLL 4608 bytes executable
File C:\WINDOWS\twain_32\MP470 series\USDRESJP.DLL 4096 bytes executable
File C:\WINDOWS\twain_32\MP470 series\USDRESKR.DLL 4608 bytes executable
File C:\WINDOWS\twain_32\MP470 series\USDRESNL.DLL 4608 bytes executable
File C:\WINDOWS\twain_32\MP470 series\USDRESNO.DLL 4608 bytes executable
File C:\WINDOWS\twain_32\MP470 series\USDRESPL.DLL 4608 bytes executable
File C:\WINDOWS\twain_32\MP470 series\USDRESPT.DLL 4608 bytes executable
File C:\WINDOWS\twain_32\MP470 series\USDRESRU.DLL 5120 bytes executable
File C:\WINDOWS\twain_32\MP470 series\USDRESSE.DLL 4608 bytes executable
File C:\WINDOWS\twain_32\MP470 series\USDRESTH.DLL 4608 bytes executable
File C:\WINDOWS\twain_32\MP470 series\USDRESTR.DLL 4608 bytes executable
File C:\WINDOWS\twain_32\MP470 series\USDRESTW.DLL 4608 bytes executable
File C:\WINDOWS\twain_32\MP470 series\USDRESUS.DLL 4608 bytes executable
File C:\WINDOWS\twain_32\MP470 series\USIP.DLL 258048 bytes executable
File C:\WINDOWS\twain_32\MP470 series\_SETSCN_.INI 209 bytes
File C:\WINDOWS\Downloaded Installations\Gibinsoft Installations\fileutil.msi 1486848 bytes
File C:\WINDOWS\Downloaded Installations\{37E99DC2-5BE8-4E21-9305-EFB593C83F84}\HMTCDWizard.msi 1863168 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\1035.mst 412672 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\0x0404.ini 3787 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\0x0406.ini 5745 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\0x0407.ini 6285 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\0x0409.ini 5515 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\0x040a.ini 6287 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\0x040b.ini 5606 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\0x040c.ini 6419 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\0x0410.ini 6180 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\0x0411.ini 5909 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\0x0412.ini 5065 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\0x0413.ini 6109 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\0x0414.ini 5714 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\0x041d.ini 5505 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\0x0804.ini 3858 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\1028.mst 393728 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\1030.mst 418304 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\1031.mst 426496 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\1033.mst 384512 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\1034.mst 422912 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\fr.lproj 0 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\fr.lproj\About iTunes.rtf 7835 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\fr.lproj\banner.bmp 383346 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\fr.lproj\license.txt 28718 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\iPod.cab 245023 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\ISScript11.Msi 982016 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\it.lproj 0 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\it.lproj\About iTunes.rtf 6978 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\it.lproj\banner.bmp 383346 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\it.lproj\license.txt 28984 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\iTunes.cab 11604817 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\iTunes.msi 9934848 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\iTunesSetup.exe 274433 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\ja.lproj 0 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\ja.lproj\About iTunes.rtf 19166 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\ja.lproj\banner.bmp 383348 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\ja.lproj\license.txt 23192 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\ko.lproj 0 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\ko.lproj\About iTunes.rtf 17232 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\ko.lproj\banner.bmp 383348 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\ko.lproj\license.txt 24625 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\nb.lproj 0 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\nb.lproj\About iTunes.rtf 6603 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\nb.lproj\banner.bmp 383346 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\nb.lproj\license.txt 26802 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\nl.lproj 0 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\nl.lproj\About iTunes.rtf 7645 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\nl.lproj\banner.bmp 383346 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\nl.lproj\license.txt 31772 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\QuickTimeInstaller.exe 35177616 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\Setup.ini 1949 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\setup.log 32 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\sv.lproj 0 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\sv.lproj\About iTunes.rtf 6644 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\sv.lproj\banner.bmp 383346 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\sv.lproj\license.txt 25983 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\zh_CN.lproj 0 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\zh_CN.lproj\About iTunes.rtf 11732 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\zh_CN.lproj\banner.bmp 383348 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\zh_CN.lproj\license.txt 14680 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\zh_TW.lproj 0 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\zh_TW.lproj\About iTunes.rtf 12140 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\zh_TW.lproj\banner.bmp 383346 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\zh_TW.lproj\license.txt 14987 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\1036.mst 420864 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\1040.mst 420864 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\1041.mst 414208 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\1042.mst 411648 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\1043.mst 428032 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\1044.mst 208896 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\1053.mst 417280 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\2052.mst 393728 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\CDDB.cab 177871 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\CD_SOF~1.cab 19488 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\da.lproj 0 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\da.lproj\About iTunes.rtf 6538 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\da.lproj\banner.bmp 383346 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\da.lproj\license.txt 26614 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\de.lproj 0 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\de.lproj\About iTunes.rtf 6816 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\de.lproj\banner.bmp 383348 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\de.lproj\license.txt 29608 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\Drivers.cab 77936 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\en.lproj 0 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\en.lproj\About iTunes.rtf 5578 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\en.lproj\banner.bmp 383348 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\en.lproj\license.txt 24880 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\es.lproj 0 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\es.lproj\About iTunes.rtf 7086 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\es.lproj\banner.bmp 383346 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\es.lproj\license.txt 28407 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\fi.lproj 0 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\fi.lproj\About iTunes.rtf 6984 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\fi.lproj\banner.bmp 383346 bytes
File C:\WINDOWS\Downloaded Installations\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\fi.lproj\license.txt 24589 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\1035.mst 412672 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\0x0404.ini 3787 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\0x0406.ini 5745 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\0x0407.ini 6285 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\0x0409.ini 5515 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\0x040a.ini 6287 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\0x040b.ini 5606 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\0x040c.ini 6419 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\0x0410.ini 6180 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\0x0411.ini 5909 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\0x0412.ini 5065 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\0x0413.ini 6109 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\0x0414.ini 5714 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\0x041d.ini 5505 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\0x0804.ini 3858 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\1028.mst 393728 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\1030.mst 418304 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\1031.mst 426496 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\1033.mst 384512 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\1034.mst 422912 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\fr.lproj 0 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\fr.lproj\About iTunes.rtf 6347 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\fr.lproj\banner.bmp 383346 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\fr.lproj\license.txt 28718 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\iPod.cab 243105 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\ISScript11.Msi 982016 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\it.lproj 0 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\it.lproj\About iTunes.rtf 5952 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\it.lproj\banner.bmp 383346 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\it.lproj\license.txt 28984 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\iTunes.cab 11401453 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\iTunes.msi 9934848 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\iTunesSetup.exe 274433 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\ja.lproj 0 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\ja.lproj\About iTunes.rtf 14850 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\ja.lproj\banner.bmp 383348 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\ja.lproj\license.txt 23192 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\ko.lproj 0 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\ko.lproj\About iTunes.rtf 16956 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\ko.lproj\banner.bmp 383348 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\ko.lproj\license.txt 24625 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\nl.lproj 0 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\nl.lproj\About iTunes.rtf 6530 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\nl.lproj\banner.bmp 383346 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\nl.lproj\license.txt 31772 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\no.lproj 0 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\no.lproj\About iTunes.rtf 5325 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\no.lproj\banner.bmp 383346 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\no.lproj\license.txt 26802 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\QuickTimeInstaller.exe 34321552 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\Setup.ini 1948 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\setup.log 32 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\sv.lproj 0 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\sv.lproj\About iTunes.rtf 5879 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\sv.lproj\banner.bmp 383346 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\sv.lproj\license.txt 25983 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\zh_CN.lproj 0 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\zh_CN.lproj\About iTunes.rtf 9461 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\zh_CN.lproj\banner.bmp 383348 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\zh_CN.lproj\license.txt 14680 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\zh_TW.lproj 0 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\zh_TW.lproj\About iTunes.rtf 9881 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\zh_TW.lproj\banner.bmp 383346 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\zh_TW.lproj\license.txt 14987 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\1036.mst 424960 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\1040.mst 424960 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\1041.mst 414208 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\1042.mst 411648 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\1043.mst 428032 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\1044.mst 418816 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\1053.mst 417280 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\2052.mst 393728 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\CDDB.cab 177871 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\CD_SOF~1.cab 19488 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\da.lproj 0 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\da.lproj\About iTunes.rtf 9729 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\da.lproj\banner.bmp 383346 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\da.lproj\license.txt 26614 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\de.lproj 0 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\de.lproj\About iTunes.rtf 5727 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\de.lproj\banner.bmp 383348 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\de.lproj\license.txt 29608 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\Drivers.cab 77936 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\en.lproj 0 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\en.lproj\About iTunes.rtf 4634 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\en.lproj\banner.bmp 383348 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\en.lproj\license.txt 24880 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\es.lproj 0 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\es.lproj\About iTunes.rtf 6359 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\es.lproj\banner.bmp 383346 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\es.lproj\license.txt 28407 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\fi.lproj 0 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\fi.lproj\About iTunes.rtf 5284 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\fi.lproj\banner.bmp 383346 bytes
File C:\WINDOWS\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\fi.lproj\license.txt 24589 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\1035.mst 386560 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\0x0404.ini 3787 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\0x0406.ini 5745 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\0x0407.ini 6285 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\0x0409.ini 5515 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\0x040a.ini 6287 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\0x040b.ini 5606 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\0x040c.ini 6419 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\0x0410.ini 6180 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\0x0411.ini 5909 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\0x0412.ini 5065 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\0x0413.ini 6109 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\0x0414.ini 5714 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\0x041d.ini 5505 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\0x0804.ini 3858 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\1028.mst 378368 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\1030.mst 390656 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\1031.mst 396288 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\1033.mst 358912 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\1034.mst 393216 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\fr.lproj 0 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\fr.lproj\About iTunes.rtf 5841 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\fr.lproj\banner.bmp 383346 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\fr.lproj\license.txt 28718 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\iPod.cab 242987 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\ISScript11.Msi 982016 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\it.lproj 0 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\it.lproj\About iTunes.rtf 5368 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\it.lproj\banner.bmp 383346 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\it.lproj\license.txt 28984 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\iTunes.cab 10554367 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\iTunes.msi 9935872 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\iTunesSetup.exe 274433 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\ja.lproj 0 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\ja.lproj\About iTunes.rtf 14182 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\ja.lproj\banner.bmp 383348 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\ja.lproj\license.txt 23192 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\ko.lproj 0 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\ko.lproj\About iTunes.rtf 10747 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\ko.lproj\banner.bmp 383348 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\ko.lproj\license.txt 24625 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\nl.lproj 0 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\nl.lproj\About iTunes.rtf 5957 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\nl.lproj\banner.bmp 383346 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\nl.lproj\license.txt 31772 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\no.lproj 0 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\no.lproj\About iTunes.rtf 5005 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\no.lproj\banner.bmp 383346 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\no.lproj\license.txt 26802 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\QuickTimeInstaller.exe 33147536 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\Setup.ini 1948 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\sv.lproj 0 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\sv.lproj\About iTunes.rtf 5394 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\sv.lproj\banner.bmp 383346 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\sv.lproj\license.txt 25983 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\zh_CN.lproj 0 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\zh_CN.lproj\About iTunes.rtf 9059 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\zh_CN.lproj\banner.bmp 383348 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\zh_CN.lproj\license.txt 14680 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\zh_TW.lproj 0 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\zh_TW.lproj\About iTunes.rtf 9866 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\zh_TW.lproj\banner.bmp 383346 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\zh_TW.lproj\license.txt 14987 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\1036.mst 395264 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\1040.mst 395264 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\1041.mst 390144 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\1042.mst 386048 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\1043.mst 395264 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\1044.mst 390656 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\1053.mst 390144 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\2052.mst 378880 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\CDDB.cab 177871 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\CD_SOF~1.cab 19402 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\da.lproj 0 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\da.lproj\About iTunes.rtf 5327 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\da.lproj\banner.bmp 383346 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\da.lproj\license.txt 26614 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\de.lproj 0 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\de.lproj\About iTunes.rtf 5456 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\de.lproj\banner.bmp 383348 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\de.lproj\license.txt 29608 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\Drivers.cab 77936 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\en.lproj 0 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\en.lproj\About iTunes.rtf 4424 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\en.lproj\banner.bmp 383348 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\en.lproj\License.txt 24880 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\es.lproj 0 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\es.lproj\About iTunes.rtf 6045 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\es.lproj\banner.bmp 383346 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\es.lproj\license.txt 28407 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\fi.lproj 0 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\fi.lproj\About iTunes.rtf 4999 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\fi.lproj\banner.bmp 383346 bytes
File C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\fi.lproj\license.txt 24589 bytes
File C:\WINDOWS\Downloaded Installations\{E3517A03-6F67-4816-BB6E-A93D3F4FEB05}\PurePlayPokerFBSetup.msi 6957056 bytes
File C:\WINDOWS\Downloaded Program Files\install.log 3027 bytes
File C:\WINDOWS\Downloaded Program Files\tscan1.dat 56829 bytes
File C:\WINDOWS\Downloaded Program Files\ampAx3.0.84.2.dll 841304 bytes executable
File C:\WINDOWS\Downloaded Program Files\catalog.dat 2504 bytes
File C:\WINDOWS\Downloaded Program Files\desktop.ini 65 bytes
File C:\WINDOWS\Downloaded Program Files\ecbootil.vxd 6899 bytes
File C:\WINDOWS\Downloaded Program Files\ecmsvr32.dll 288424 bytes executable
File C:\WINDOWS\Downloaded Program Files\FP_AX_CAB_INSTALLER.exe 1523536 bytes executable
File C:\WINDOWS\Downloaded Program Files\gtdownde_110.inf 1264 bytes
File C:\WINDOWS\Downloaded Program Files\IDrop.ocx 283296 bytes executable
File C:\WINDOWS\Downloaded Program Files\IDropENU.dll 114280 bytes executable
File C:\WINDOWS\Downloaded Program Files\LegitCheckControl.inf 495 bytes
File C:\WINDOWS\Downloaded Program Files\muweb.inf 295 bytes
File C:\WINDOWS\Downloaded Program Files\naveng32.dll 124584 bytes executable
File C:\WINDOWS\Downloaded Program Files\navex32a.dll 837288 bytes executable
File C:\WINDOWS\Downloaded Program Files\scrauth.dat 97504 bytes
File C:\WINDOWS\Downloaded Program Files\swflash.inf 247 bytes
File C:\WINDOWS\Downloaded Program Files\symaveng.cat 8145 bytes
File C:\WINDOWS\Downloaded Program Files\symaveng.inf 901 bytes
File C:\WINDOWS\Downloaded Program Files\tcdefs.dat 48128 bytes
File C:\WINDOWS\Downloaded Program Files\tcscan7.dat 820470 bytes
File C:\WINDOWS\Downloaded Program Files\tcscan8.dat 304624 bytes
File C:\WINDOWS\Downloaded Program Files\tcscan9.dat 634818 bytes
File C:\WINDOWS\Downloaded Program Files\tinf.dat 453 bytes
File C:\WINDOWS\Downloaded Program Files\tinfidx.dat 148 bytes
File C:\WINDOWS\Downloaded Program Files\tinfl.dat 1957 bytes
File C:\WINDOWS\Downloaded Program Files\tscan1hd.dat 3027 bytes
File C:\WINDOWS\Downloaded Program Files\unagiuninst.exe 38428 bytes executable
File C:\WINDOWS\Downloaded Program Files\v.grd 5516 bytes
File C:\WINDOWS\Downloaded Program Files\v.sig 2249 bytes
File C:\WINDOWS\Downloaded Program Files\virscan.inf 106244 bytes
File C:\WINDOWS\Downloaded Program Files\virscan1.dat 961593 bytes
File C:\WINDOWS\Downloaded Program Files\virscan2.dat 569646 bytes
File C:\WINDOWS\Downloaded Program Files\virscan3.dat 146396 bytes
File C:\WINDOWS\Downloaded Program Files\virscan4.dat 320105 bytes
File C:\WINDOWS\Downloaded Program Files\virscan5.dat 2550443 bytes
File C:\WINDOWS\Downloaded Program Files\virscan6.dat 389041 bytes
File C:\WINDOWS\Downloaded Program Files\virscan7.dat 3921718 bytes
File C:\WINDOWS\Downloaded Program Files\virscan8.dat 1569212 bytes
File C:\WINDOWS\Downloaded Program Files\virscan9.dat 3441711 bytes
File C:\WINDOWS\Downloaded Program Files\virscant.dat 32 bytes
File C:\WINDOWS\Downloaded Program Files\wlscBase.dll 452488 bytes executable
File C:\WINDOWS\Downloaded Program Files\wlscBase.inf 321 bytes
File C:\WINDOWS\Downloaded Program Files\wuweb.inf 293 bytes
File C:\WINDOWS\Downloaded Program Files\zdone.dat 224 bytes
File C:\WINDOWS\Driver Cache\i386 0 bytes
File C:\WINDOWS\Driver Cache\i386\driver.cab 63044788 bytes
File C:\WINDOWS\Driver Cache\i386\hal.dll 105344 bytes executable
File C:\WINDOWS\Driver Cache\i386\halaacpi.dll 131712 bytes executable
File C:\WINDOWS\Driver Cache\i386\halacpi.dll 81152 bytes executable
File C:\WINDOWS\Driver Cache\i386\halapic.dll 150400 bytes executable
File C:\WINDOWS\Driver Cache\i386\halmacpi.dll 134272 bytes executable
File C:\WINDOWS\Driver Cache\i386\halmps.dll 152576 bytes executable
File C:\WINDOWS\Driver Cache\i386\halsp.dll 77696 bytes executable
File C:\WINDOWS\Driver Cache\i386\sp2.cab 18738937 bytes
File C:\WINDOWS\security\Database 0 bytes
File C:\WINDOWS\security\Database\secedit.sdb 1056768 bytes
File C:\WINDOWS\security\logs 0 bytes
File C:\WINDOWS\security\logs\backup.log 3002 bytes
File C:\WINDOWS\security\logs\scecomp.old 28690 bytes
File C:\WINDOWS\security\logs\SceRoot.log 1328 bytes
File C:\WINDOWS\security\logs\scesetup.log 125598 bytes
File C:\WINDOWS\security\templates 0 bytes
File C:\WINDOWS\security\templates\hisecdc.inf 7784 bytes
File C:\WINDOWS\security\templates\hisecws.inf 8015 bytes
File C:\WINDOWS\security\templates\setup security.inf 193888 bytes
File C:\WINDOWS\setup.pss\setupupd 0 bytes
File C:\WINDOWS\setup.pss\setupupd\temp 0 bytes
File C:\WINDOWS\Adobe Illustrator CS\Adobe Illustrator CS.log 130 bytes
File C:\WINDOWS\AiOTemp\AiO_Progress_Log.txt 13135 bytes
File C:\WINDOWS\AiOTemp\autorun.inf 1601 bytes
File C:\WINDOWS\AiOTemp\hpoins08.dat 20447 bytes
File C:\WINDOWS\AiOTemp\hposcr01.exe 655360 bytes executable
File C:\WINDOWS\AiOTemp\hpoSW.dat 23782 bytes
File C:\WINDOWS\AiOTemp\setup_msi_install_log.txt 231286 bytes
File C:\WINDOWS\$NtUninstallKB884020$\spuninst 0 bytes
File C:\WINDOWS\$NtUninstallKB884020$\spuninst\spuninst.exe 169984 bytes executable
File C:\WINDOWS\$NtUninstallKB884020$\spuninst\spuninst.inf 7817 bytes
File C:\WINDOWS\$NtUninstallKB884020$\spuninst\spuninst.txt 187 bytes
File C:\WINDOWS\$NtUninstallKB884020$\tcpip.sys 359040 bytes executable
File C:\WINDOWS\$NtUninstallKB889673$\hal.dll 131968 bytes executable
File C:\WINDOWS\$NtUninstallKB889673$\spuninst 0 bytes
File C:\WINDOWS\$NtUninstallKB889673$\spuninst\spuninst.exe 169984 bytes executable
File C:\WINDOWS\$NtUninstallKB889673$\spuninst\spuninst.inf 8586 bytes
File C:\WINDOWS\$NtUninstallKB889673$\spuninst\spuninst.txt 419 bytes
File C:\WINDOWS\$NtUninstallKB890046_0$\agentdpv.dll 58880 bytes executable
File C:\WINDOWS\$NtUninstallKB890046_0$\reg00001 8192 bytes
File C:\WINDOWS\$NtUninstallKB890046_0$\spuninst 0 bytes
File C:\WINDOWS\$NtUninstallKB890046_0$\spuninst\spuninst.exe 209632 bytes executable
File C:\WINDOWS\$NtUninstallKB890046_0$\spuninst\spuninst.inf 4537 bytes
File C:\WINDOWS\$NtUninstallKB890046_0$\spuninst\spuninst.txt 231 bytes
File C:\WINDOWS\$NtUninstallKB890046_0$\spuninst\updspapi.dll 371936 bytes executable
File C:\WINDOWS\$NtUninstallKB893086$\spuninst 0 bytes
File C:\WINDOWS\$NtUninstallKB896727$\spuninst 0 bytes
File C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst 0 bytes
File C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe 213216 bytes executable
File C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.inf 5400 bytes
File C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.txt 444 bytes
File C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\updspapi.dll 371424 bytes executable
File C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst 0 bytes
File C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe 213216 bytes executable
File C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.inf 4814 bytes
File C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.txt 204 bytes
File C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\updspapi.dll 371424 bytes executable
File C:\WINDOWS\ime\imejp\applets 0 bytes
File C:\WINDOWS\inf\IEM\0409 0 bytes
File C:\WINDOWS\inf\IEM\0409\inetcorp.iem 13696 bytes
File C:\WINDOWS\inf\IEM\0409\inetset.iem 37836 bytes
File C:\WINDOWS\Installer\$PatchCache$ 0 bytes
File C:\WINDOWS\Installer\$PatchCache$\Managed 0 bytes
File C:\WINDOWS\Installer\$PatchCache$\Managed\D6461317C3DC4F04799BDCE9E42626FE 0 bytes
File C:\WINDOWS\Installer\$PatchCache$\Managed\D6461317C3DC4F04799BDCE9E42626FE\2.0.50727 0 bytes
File C:\WINDOWS\Installer\$PatchCache$\Managed\D6461317C3DC4F04799BDCE9E42626FE\2.0.50727\FL_aspnet_filter_dll_____X86.3643236F_FC70_11D3_A536_0090278A1BB8 10752 bytes executable
File C:\WINDOWS\Installer\$PatchCache$\Managed\D6461317C3DC4F04799BDCE9E42626FE\CacheSize.txt 4 bytes
File C:\WINDOWS\Installer\11e32842.msi 1713152 bytes
File C:\WINDOWS\Installer\11e32847.msi 2022912 bytes
File C:\WINDOWS\Installer\11e3284c.msi 1640960 bytes
File C:\WINDOWS\Installer\11e32854.msi 1647616 bytes
File C:\WINDOWS\Installer\11e32859.msi 501248 bytes
File C:\WINDOWS\Installer\11e3285e.msi 2319872 bytes
File C:\WINDOWS\Installer\11e3286f.msi 1652736 bytes
File C:\WINDOWS\Installer\11e32874.msi 1652736 bytes
File C:\WINDOWS\Installer\11e32879.msi 1652736 bytes
File C:\WINDOWS\Installer\11e3287e.msi 501248 bytes
File C:\WINDOWS\Installer\11e32883.msi 1640960 bytes
File C:\WINDOWS\Installer\11e32bdb.msi 18181632 bytes
File C:\WINDOWS\Installer\14070549.msi 4947968 bytes
File C:\WINDOWS\Installer\17d9dbae.msi 399872 bytes
File C:\WINDOWS\Installer\18a7ea.msi 3684352 bytes
File C:\WINDOWS\Installer\18a7ef.msi 958464 bytes
File C:\WINDOWS\Installer\18fe74.msi 360448 bytes
File C:\WINDOWS\Installer\1a41590d.msi 138240 bytes
File C:\WINDOWS\Installer\1a57d61.msi 658432 bytes
File C:\WINDOWS\Installer\1ad293f.msi 612864 bytes
File C:\WINDOWS\Installer\{00010409-78E1-11D2-B60F-006097C998E7} 0 bytes
File C:\WINDOWS\Installer\{00010409-78E1-11D2-B60F-006097C998E7}\accicons.exe 155136 bytes executable
File C:\WINDOWS\Installer\{00010409-78E1-11D2-B60F-006097C998E7}\graph9.ico 766 bytes
File C:\WINDOWS\Installer\{00ADFB20-AE75-46F4-AD2C-F48B15AC3100} 0 bytes
File C:\WINDOWS\Installer\{00ADFB20-AE75-46F4-AD2C-F48B15AC3100}\en_US.mst 3584 bytes
File C:\WINDOWS\Installer\{075473F5-846A-448B-BCB3-104AA1760205} 0 bytes
File C:\WINDOWS\Installer\{09DA4F91-2A09-4232-AB8C-6BC740096DE3} 0 bytes
File C:\WINDOWS\Installer\{0D09E359-0C98-4D93-B6F9-1FF68ED4B27C} 0 bytes
File C:\WINDOWS\Installer\{0D09E359-0C98-4D93-B6F9-1FF68ED4B27C}\ARPPRODUCTICON.exe 65536 bytes executable
File C:\WINDOWS\Installer\{0D09E359-0C98-4D93-B6F9-1FF68ED4B27C}\NewShortcut1.exe 65536 bytes executable
File C:\WINDOWS\Installer\{0D6013AB-A0C7-41DC-973C-E93129C9A29F} 0 bytes
File C:\WINDOWS\Installer\{0D6013AB-A0C7-41DC-973C-E93129C9A29F}\en_US.mst 3584 bytes
File C:\WINDOWS\Installer\{0EB5D9B7-8E6C-4A9E-B74F-16B7EE89A67B} 0 bytes
File C:\WINDOWS\Installer\{35D94F92-1D3A-43C5-8605-EA268B1A7BD9} 0 bytes
File C:\WINDOWS\Installer\{35D94F92-1D3A-43C5-8605-EA268B1A7BD9}\en_US.mst 3584 bytes
File C:\WINDOWS\Installer\{4192EAC0-6B36-4723-B216-D0E86E7757AC} 0 bytes
File C:\WINDOWS\Installer\{52504CE6-E909-4113-B232-4AFEC6543A61} 0 bytes
File C:\WINDOWS\Installer\{52504CE6-E909-4113-B232-4AFEC6543A61}\1033.MST 15872 bytes
File C:\WINDOWS\Installer\{52504CE6-E909-4113-B232-4AFEC6543A61}\ARPPRODUCTICON.exe 3262 bytes
File C:\WINDOWS\Installer\{548EEA8E-8299-497F-8057-811D2D7097DC} 0 bytes
File C:\WINDOWS\Installer\{54C0D94A-F467-4ABC-9D02-6E58748668D4} 0 bytes
File C:\WINDOWS\Installer\{54C0D94A-F467-4ABC-9D02-6E58748668D4}\NewShortcut4_8C3BCD70236347B8A53EEE8A82FD5C78.exe 131072 bytes executable
File C:\WINDOWS\Installer\{5570C7F0-43D0-4916-8A9E-AEDD52FA86F4} 0 bytes
File C:\WINDOWS\Installer\{5570C7F0-43D0-4916-8A9E-AEDD52FA86F4}\en_US.mst 3584 bytes
File C:\WINDOWS\Installer\{571700F0-DB9D-4B3A-B03D-35A14BB5939F} 0 bytes
File C:\WINDOWS\Installer\{571700F0-DB9D-4B3A-B03D-35A14BB5939F}\MsblIco.Exe 29926 bytes
File C:\WINDOWS\Installer\{5783F2D7-0201-0409-0002-0060B0CE6BBA} 0 bytes
File C:\WINDOWS\Installer\{5783F2D7-0201-0409-0002-0060B0CE6BBA}\AcadDWGAssoc.ico 4710 bytes
File C:\WINDOWS\Installer\{5783F2D7-0201-0409-0002-0060B0CE6BBA}\AcadDWTAssoc.ico 1078 bytes
File C:\WINDOWS\Installer\{5783F2D7-0201-0409-0002-0060B0CE6BBA}\AcadDXFAssoc.ico 1078 bytes
File C:\WINDOWS\Installer\{5783F2D7-0201-0409-0002-0060B0CE6BBA}\Acad_icon.exe 42144 bytes executable
File C:\WINDOWS\Installer\{5783F2D7-0201-0409-0002-0060B0CE6BBA}\HH_f0.31FBAB5E_27C2_4FBB_9794_DCE5EFF689AA 4846 bytes
File C:\WINDOWS\Installer\{5783F2D7-0201-0409-0002-0060B0CE6BBA}\IT_f0.ABC75200_F41A_4929_91C8_2ECE93ED3449 10134 bytes
File C:\WINDOWS\Installer\{5905F42D-3F5F-4916-ADA6-94A3646AEE76} 0 bytes
File C:\WINDOWS\Installer\8532f.msi 483328 bytes
File C:\WINDOWS\Installer\85334.msi 403968 bytes
File C:\WINDOWS\Installer\89e99e.msi 3174400 bytes
File C:\WINDOWS\Installer\89e9a3.msi 3070976 bytes
File C:\WINDOWS\Installer\89e9a8.msi 3228160 bytes
File C:\WINDOWS\Installer\89e9ad.msi 3079680 bytes
File C:\WINDOWS\Installer\89e9b2.msi 3076096 bytes
File C:\WINDOWS\Installer\89e9b7.msi 3178496 bytes
File C:\WINDOWS\Installer\89e9bc.msi 3110912 bytes
File C:\WINDOWS\Installer\89e9c1.msi 3273216 bytes
File C:\WINDOWS\Installer\89e9c7.msi 3073024 bytes
File C:\WINDOWS\Installer\89e9cc.msi 3094016 bytes
File C:\WINDOWS\Installer\89e9d1.msi 3186176 bytes
File C:\WINDOWS\Installer\89e9d6.msi 3087360 bytes
File C:\WINDOWS\Installer\89e9db.msi 3083776 bytes
File C:\WINDOWS\Installer\89e9e0.msi 3150848 bytes
File C:\WINDOWS\Installer\89e9e5.msi 3146240 bytes
File C:\WINDOWS\Installer\89e9ea.msi 3078656 bytes
File C:\WINDOWS\Installer\89e9ef.msi 3089408 bytes
File C:\WINDOWS\Installer\1f9ff.msi 20480 bytes
File C:\WINDOWS\Installer\7110cf2.msi 501248 bytes
File C:\WINDOWS\Installer\8532a.msi 483840 bytes
File C:\WINDOWS\Installer\89e9f4.msi 3075072 bytes
File C:\WINDOWS\Installer\9e0802.msi 236032 bytes
File C:\WINDOWS\Installer\{1206EF92-2E83-4859-ACCB-2048C3CB7DA6} 0 bytes
File C:\WINDOWS\Installer\{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227} 0 bytes
File C:\WINDOWS\Installer\{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}\places.exe 166912 bytes executable
File C:\WINDOWS\Installer\{59C4F14F-7590-45FC-BE9F-A67AB3590709} 0 bytes
File C:\WINDOWS\Installer\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\NewShortcut4_8C3BCD70236347B8A53EEE8A82FD5C78.exe 131072 bytes executable
File C:\WINDOWS\Installer\{78C496B9-5A6B-4692-8C2E-AFFFC34E4961} 0 bytes
File C:\WINDOWS\Installer\{95120000-00AF-0409-0000-0000000FF1CE} 0 bytes
File C:\WINDOWS\Installer\{95120000-00AF-0409-0000-0000000FF1CE}\ppvwicon.exe 49936 bytes executable
File C:\WINDOWS\Installer\{7A3F0566-5E05-4919-9C98-456F6B5CF831} 0 bytes
File C:\WINDOWS\Installer\{80B894AC-E0F4-42B2-9233-C492F03AC975} 0 bytes
File C:\WINDOWS\Installer\{80B894AC-E0F4-42B2-9233-C492F03AC975}\ARPPRODUCTICON.exe 40960 bytes executable
File C:\WINDOWS\Installer\{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959} 0 bytes
File C:\WINDOWS\Installer\{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}\Installer.ico 2238 bytes
File C:\WINDOWS\Installer\{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}\PrntWzrdIco.exe 86016 bytes executable
File C:\WINDOWS\Installer\{8DC42D05-680B-41B0-8878-6C14D24602DB} 0 bytes
File C:\WINDOWS\Installer\{8DC42D05-680B-41B0-8878-6C14D24602DB}\Installer.ico 22486 bytes
File C:\WINDOWS\Installer\{8DC42D05-680B-41B0-8878-6C14D24602DB}\PictureViewer.ico 22486 bytes
File C:\WINDOWS\Installer\{8DC42D05-680B-41B0-8878-6C14D24602DB}\QTPlayer.ico 22486 bytes
File C:\WINDOWS\Installer\{8DC42D05-680B-41B0-8878-6C14D24602DB}\QTUninstaller.ico 22486 bytes
File C:\WINDOWS\Installer\{8DC42D05-680B-41B0-8878-6C14D24602DB}\RichText.ico 766 bytes
File C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE} 0 bytes
File C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\accicons.exe 1165584 bytes executable
File C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\cagicon.exe 20240 bytes executable
File C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\graph.ico 766 bytes
File C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\GrooveIcon.ico 293950 bytes
File C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\inficon.exe 159504 bytes executable
File C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\joticon.exe 184080 bytes executable
File C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\misc.exe 217864 bytes executable
File C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\mspicons.exe 18704 bytes executable
File C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\oisicon.exe 35088 bytes executable
File C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe 845584 bytes executable
File C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pptico.exe 922384 bytes executable
File C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pubs.exe 272648 bytes executable
File C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\ShellUI.MST 61952 bytes
File C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\wordicon.exe 888080 bytes executable
File C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\xlicons.exe 1172240 bytes executable
File C:\WINDOWS\Installer\{90120000-003B-0000-0000-0000000FF1CE} 0 bytes
File C:\WINDOWS\Installer\{90120000-003B-0000-0000-0000000FF1CE}\cagicon.exe 20240 bytes executable
File C:\WINDOWS\Installer\{90120000-003B-0000-0000-0000000FF1CE}\misc.exe 217864 bytes executable
File C:\WINDOWS\Installer\{90120000-003B-0000-0000-0000000FF1CE}\mspicons.exe 18704 bytes executable
File C:\WINDOWS\Installer\{90120000-003B-0000-0000-0000000FF1CE}\oisicon.exe 35088 bytes executable
File C:\WINDOWS\Installer\{90120000-003B-0000-0000-0000000FF1CE}\pj11icon.exe 239376 bytes executable
File C:\WINDOWS\Installer\{90120000-003B-0000-0000-0000000FF1CE}\ShellUI.MST 61952 bytes
File C:\WINDOWS\Installer\{90120000-006E-0409-0000-0000000FF1CE} 0 bytes
File C:\WINDOWS\Installer\{90120000-006E-0409-0000-0000000FF1CE}\misc.exe 217864 bytes executable
File C:\WINDOWS\Installer\{929408E6-D265-4174-805F-81D1D914E2A4} 0 bytes
File C:\WINDOWS\Installer\{929408E6-D265-4174-805F-81D1D914E2A4}\QuickTimePlayer_ico.exe 22486 bytes
File C:\WINDOWS\Installer\{5FD0FE06-4316-4558-B7A8-793910B5FC53} 0 bytes
File C:\WINDOWS\Installer\{62BD0AE0-4EB1-4BBB-8F43-B6400C8FEB2C} 0 bytes
File C:\WINDOWS\Installer\{64A77F14-0E08-4A97-A859-E93CFF428756} 0 bytes
File C:\WINDOWS\Installer\{67F0E67A-8E93-4C2C-B29D-47C48262738A} 0 bytes
File C:\WINDOWS\Installer\{67F0E67A-8E93-4C2C-B29D-47C48262738A}\Adobe_ID0EFNAC 295606 bytes
File C:\WINDOWS\Installer\{67F0E67A-8E93-4C2C-B29D-47C48262738A}\Adobe_ID0EJMAC 50231 bytes
File C:\WINDOWS\Installer\{67F0E67A-8E93-4C2C-B29D-47C48262738A}\Adobe_ID0ENLAC 56479 bytes
File C:\WINDOWS\Installer\{67F0E67A-8E93-4C2C-B29D-47C48262738A}\Adobe_ID0ERKAC 53423 bytes
File C:\WINDOWS\Installer\{67F0E67A-8E93-4C2C-B29D-47C48262738A}\Adobe_ID0EVJAC 42624 bytes
File C:\WINDOWS\Installer\{67F0E67A-8E93-4C2C-B29D-47C48262738A}\en_US.mst 3584 bytes
File C:\WINDOWS\Installer\{6E45BA47-383C-4C1E-8ED0-0D4845C293D7} 0 bytes
File C:\WINDOWS\Installer\{7148F0A8-6813-11D6-A77B-00B0D0142030} 0 bytes
File C:\WINDOWS\Installer\{728278A1-0BB7-45E4-AC5E-91D7C0FD1EDE} 0 bytes
File C:\WINDOWS\Installer\{74F7662C-B1DB-489E-A8AC-07A06B24978B} 0 bytes
File C:\WINDOWS\Installer\{AF06CAE4-C134-44B1-B699-14FBDB63BD37} 0 bytes
File C:\WINDOWS\Installer\{AF19F291-F22F-4798-9662-525305AE9E48} 0 bytes
File C:\WINDOWS\Installer\{B12665F4-4E93-4AB4-B7FC-37053B524629} 0 bytes
File C:\WINDOWS\Installer\{C21D5524-A970-42FA-AC8A-59B8C7CDCA31} 0 bytes
File C:\WINDOWS\Installer\{C21D5524-A970-42FA-AC8A-59B8C7CDCA31}\QuickTimePlayer_ico.exe 22486 bytes
File C:\WINDOWS\Installer\{C52E3EC1-048C-45E1-8D53-10B0C6509683} 0 bytes
File C:\WINDOWS\Installer\{C52E3EC1-048C-45E1-8D53-10B0C6509683}\en_US.mst 4096 bytes
File C:\WINDOWS\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA} 0 bytes
File C:\WINDOWS\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF13.exe 18944 bytes executable
File C:\WINDOWS\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF15.exe 65024 bytes executable
File C:\WINDOWS\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF16.exe 5120 bytes executable
File C:\WINDOWS\Installer\{CEB3A11A-03EA-11DA-BFBD-00065BBDC0B5} 0 bytes
File C:\WINDOWS\Installer\{D103C4BA-F905-437A-8049-DB24763BBE36} 0 bytes
File C:\WINDOWS\Installer\{D103C4BA-F905-437A-8049-DB24763BBE36}\SkypeIcon.exe 371272 bytes executable
File C:\WINDOWS\Installer\{DDDE0BE3-0CBE-4BF6-B75A-E3F69C947843} 0 bytes
File C:\WINDOWS\Installer\{DDDE0BE3-0CBE-4BF6-B75A-E3F69C947843}\Installer.ico 90126 bytes
File C:\WINDOWS\Installer\{DDDE0BE3-0CBE-4BF6-B75A-E3F69C947843}\iTunesIco.exe 102400 bytes executable
File C:\WINDOWS\Installer\{DDDE0BE3-0CBE-4BF6-B75A-E3F69C947843}\RichText.ico 766 bytes
File C:\WINDOWS\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF} 0 bytes
File C:\WINDOWS\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\cons5cWebUpdate2dWin2k.ico0.ico 318 bytes
File C:\WINDOWS\Installer\{E2B64929-B616-4235-B10E-D26D686296F9} 0 bytes
File C:\WINDOWS\Installer\{E2B64929-B616-4235-B10E-D26D686296F9}\Icon8FD64119.exe 55808 bytes executable
File C:\WINDOWS\Installer\{E2B64929-B616-4235-B10E-D26D686296F9}\Icon8FD641192.chm 49152 bytes executable
File C:\WINDOWS\Installer\{E2B64929-B616-4235-B10E-D26D686296F9}\Icon8FD641193.url 106496 bytes executable
File C:\WINDOWS\Installer\{E2B64929-B616-4235-B10E-D26D686296F9}\Icon8FD641194.exe 14336 bytes executable
File C:\WINDOWS\Installer\{E2B64929-B616-4235-B10E-D26D686296F9}\IconD233FA33.chm 3584 bytes executable
File C:\WINDOWS\Installer\{E2B64929-B616-4235-B10E-D26D686296F9}\IconD233FA331.exe 14336 bytes executable
File C:\WINDOWS\Installer\{E2B64929-B616-4235-B10E-D26D686296F9}\IconE1E241C7.chm 28672 bytes executable
File C:\WINDOWS\Installer\{E4848436-0345-47E2-B648-8B522FCDA623} 0 bytes
File C:\WINDOWS\Installer\{E4848436-0345-47E2-B648-8B522FCDA623}\en_US.mst 3584 bytes
File C:\WINDOWS\Installer\{F07B861C-72B9-40A4-8B1A-AAED4C06A7E8} 0 bytes
File C:\WINDOWS\Installer\{F07B861C-72B9-40A4-8B1A-AAED4C06A7E8}\QTPlayer.ico 22486 bytes
File C:\WINDOWS\Installer\{F543B12A-13F5-487E-9314-F7D25E1BBE3E} 0 bytes
File C:\WINDOWS\Installer\7110cf7.msi 1664000 bytes
File C:\WINDOWS\Installer\7110cfc.msi 513024 bytes
File C:\WINDOWS\Installer\7110d02.msi 516608 bytes
File C:\WINDOWS\Installer\7110d08.msi 506880 bytes
File C:\WINDOWS\Installer\7110d0d.msi 501248 bytes
File C:\WINDOWS\Installer\7110d15.msi 48128 bytes
File C:\WINDOWS\Installer\7110d28.msi 5594112 bytes
File C:\WINDOWS\Installer\852e4.msi 5029888 bytes
File C:\WINDOWS\Installer\852e9.msi 438272 bytes
File C:\WINDOWS\Installer\852ee.msi 546304 bytes
File C:\WINDOWS\Installer\852f3.msi 398336 bytes
File C:\WINDOWS\Installer\852f8.msi 398848 bytes
File C:\WINDOWS\Installer\852fd.msi 676864 bytes
File C:\WINDOWS\Installer\85302.msi 7137792 bytes
File C:\WINDOWS\Installer\85307.msi 477696 bytes
File C:\WINDOWS\Installer\8530c.msi 483328 bytes
File C:\WINDOWS\Installer\85311.msi 523776 bytes
File C:\WINDOWS\Installer\85316.msi 485376 bytes
File C:\WINDOWS\Installer\8531b.msi 484352 bytes
File C:\WINDOWS\Installer\85320.msi 401920 bytes
File C:\WINDOWS\Installer\85325.msi 483328 bytes
File C:\WINDOWS\Installer\a8ff3da.msp 17455616 bytes
File C:\WINDOWS\Installer\acfde28.msp 17455616 bytes
File C:\WINDOWS\Installer\b0c25f.msi 171008 bytes
File C:\WINDOWS\Installer\c0ad41d.msi 4077568 bytes
File C:\WINDOWS\Installer\c9af1.msi 3443712 bytes
File C:\WINDOWS\Installer\d5335.msi 228352 bytes
File C:\WINDOWS\Installer\dc7e6c.msi 1376256 bytes
File C:\WINDOWS\Installer\de3ec.msi 916480 bytes
File C:\WINDOWS\Installer\de3f8.msi 2109440 bytes
File C:\WINDOWS\Installer\dfcef7d.msi 1565696 bytes
File C:\WINDOWS\Installer\iProData 0 bytes
File C:\WINDOWS\Installer\iProData\iconvrtr.exe 147456 bytes executable
File C:\WINDOWS\Installer\iProData\mCore.msi 3217920 bytes
File C:\WINDOWS\Installer\iProData\mDriver.msi 2523648 bytes
File C:\WINDOWS\Installer\iProData\mDrWiFi.msi 824320 bytes
File C:\WINDOWS\Installer\iProData\mEOU.msi 1775104 bytes
File C:\WINDOWS\Installer\iProData\mGina.msi 556032 bytes
File C:\WINDOWS\Installer\iProData\mHlpDell.msi 4938720 bytes
File C:\WINDOWS\Installer\iProData\mIWA.msi 2045440 bytes
File C:\WINDOWS\Installer\iProData\mIWCA.msi 566784 bytes
File C:\WINDOWS\Installer\iProData\mLogView.msi 759808 bytes
File C:\WINDOWS\Installer\iProData\mMHouse.msi 1264640 bytes
File C:\WINDOWS\Installer\iProData\mPfMgr.msi 962560 bytes
File C:\WINDOWS\Installer\iProData\mPfWiz.msi 1668608 bytes
File C:\WINDOWS\Installer\iProData\mProSafe.msi 400072 bytes
File C:\WINDOWS\Installer\iProData\mSSO.msi 850432 bytes
File C:\WINDOWS\Installer\iProData\mToolkit.msi 792064 bytes
File C:\WINDOWS\Installer\iProData\mWlsSafe.msi 401104 bytes
File C:\WINDOWS\Installer\iProData\mXML.msi 8445440 bytes
File C:\WINDOWS\Installer\iProData\mZConfig.msi 981504 bytes
File C:\WINDOWS\Installer\iProData\verfile.tic 13 bytes
File C:\WINDOWS\Installer\iProInst.bmp 270428 bytes
File C:\WINDOWS\Installer\iProInst.exe 479232 bytes
File C:\WINDOWS\Installer\MSN Messenger 7.5.0306 0 bytes
File C:\WINDOWS\Installer\MSN Messenger 7.5.0311 0 bytes
File C:\WINDOWS\Installer\MSN Messenger 8.1.0178 0 bytes
File C:\WINDOWS\Installer\MSN Messenger 8.1.0178\MsnMsgs.Msi 16633344 bytes
File C:\WINDOWS\Installer\89e9f9.msi 26112 bytes
File C:\WINDOWS\Installer\89ea00.msi 3073536 bytes
File C:\WINDOWS\Installer\89ea06.msi 3073024 bytes
File C:\WINDOWS\Installer\89ea0c.msi 3074048 bytes
File C:\WINDOWS\Installer\89ea12.msi 3073536 bytes
File C:\WINDOWS\Installer\89ea17.msi 3073024 bytes
File C:\WINDOWS\Installer\89ea1d.msi 3831808 bytes
File C:\WINDOWS\Installer\89ea22.msi 3095552 bytes
File C:\WINDOWS\Installer\89ea27.msi 3117056 bytes
File C:\WINDOWS\Installer\89ea32.msi 23552 bytes
File C:\WINDOWS\Installer\89ea37.msi 3076608 bytes
File C:\WINDOWS\Installer\89ea3c.msi 3076608 bytes
File C:\WINDOWS\Installer\89ea48.msi 4915200 bytes
File C:\WINDOWS\Installer\89ea52.msi 4908544 bytes
File C:\WINDOWS\Installer\89ea64.msi 3096064 bytes
File C:\WINDOWS\Installer\89ea69.msi 3174400 bytes
File C:\WINDOWS\Installer\89ea6e.msi 3285504 bytes
File C:\WINDOWS\Installer\89ea74.msi 3085824 bytes
File C:\WINDOWS\Installer\89ea79.msi 3573248 bytes
File C:\WINDOWS\Installer\962f2dd.msi 870400 bytes
File C:\WINDOWS\Installer\962f2ed.msi 331264 bytes
File C:\WINDOWS\Installer\962f4dd.msi 3668992 bytes
File C:\WINDOWS\Installer\{9541FED0-327F-4DF0-8B96-EF57EF622F19} 0 bytes
File C:\WINDOWS\Installer\{976C2B2A-CE59-4AB3-83FB-BF895E28F2E6} 0 bytes
File C:\WINDOWS\Installer\{976C2B2A-CE59-4AB3-83FB-BF895E28F2E6}\Installer.ico 287190 bytes
File C:\WINDOWS\Installer\{A277460B-2F77-4C8C-8E5F-76B4723435E2} 0 bytes
File C:\WINDOWS\Installer\{A277460B-2F77-4C8C-8E5F-76B4723435E2}\ARPPRODUCTICON.exe 53248 bytes executable

jacory

Post #6December 12, 2009, 7:58 AM UTC

GMER.TXT (pt 2) i was pretty surprised how big this file was! File C:\WINDOWS\Installer\{A277460B-2F77-4C8C-8E5F-76B4723435E2}\NewShortcut1_7CD22B65921A4E498E3E3DDBA3665BE6.exe 53248 bytes executable File C:\WINDOWS\Installer\{A277460B-2F77-4C8C-8E5F-76B4723435E2}\NewShortcut2_7CD22B65921A4E498E3E3DDBA3665BE6.exe 53248 bytes executable File C:\WINDOWS\Installer\{A43BF6A5-D5F0-4AAA-BF41-65995063EC44} 0 bytes File C:\WINDOWS\Installer\{A43BF6A5-D5F0-4AAA-BF41-65995063EC44}\ARPIco 5430 bytes File C:\WINDOWS\Installer\{A4EE4223-98B1-4874-BA6E-E8A574F9C0FF} 0 bytes File C:\WINDOWS\Installer\{A4EE4223-98B1-4874-BA6E-E8A574F9C0FF}\1033.MST 3584 bytes File C:\WINDOWS\Installer\{A4EE4223-98B1-4874-BA6E-E8A574F9C0FF}\ARPPRODUCTICON.exe 292878 bytes File C:\WINDOWS\Installer\{A4EE4223-98B1-4874-BA6E-E8A574F9C0FF}\NewShortcut4_C2C2101F05384548B5AF39E0D3B3CB50.exe 292878 bytes File C:\WINDOWS\Installer\{A4EE4223-98B1-4874-BA6E-E8A574F9C0FF}\RunLightroom313212_C2C2101F05384548B5AF39E0D3B3CB50.exe 292878 bytes File C:\WINDOWS\Installer\{A4EE4223-98B1-4874-BA6E-E8A574F9C0FF}\_08E7D196_C2F3_4A5A_9FC6_F00E19EFA6C9 292878 bytes File C:\WINDOWS\Installer\{A4EE4223-98B1-4874-BA6E-E8A574F9C0FF}\_09283753_EEA5_406D_8959_4321D1A11191 292878 bytes File C:\WINDOWS\Installer\{A4EE4223-98B1-4874-BA6E-E8A574F9C0FF}\_42596BB0_B454_45A0_9940_DA57D70A9E5F 292878 bytes File C:\WINDOWS\Installer\{A4EE4223-98B1-4874-BA6E-E8A574F9C0FF}\_AAE3A65B_BFC8_49CF_B609_592DAA9A9E96 292878 bytes File C:\WINDOWS\Installer\{A4EE4223-98B1-4874-BA6E-E8A574F9C0FF}\_B271EB84_5455_4730_B392_92297A683540 292878 bytes File C:\WINDOWS\Installer\{A4EE4223-98B1-4874-BA6E-E8A574F9C0FF}\_B5E48224_EF16_4AB8_8F73_7446A97F4AA8 292878 bytes File C:\WINDOWS\Installer\{A4EE4223-98B1-4874-BA6E-E8A574F9C0FF}\_D0A52574_24AB_48D8_964C_2CE7A82B172B 292878 bytes File C:\WINDOWS\Installer\{A4EE4223-98B1-4874-BA6E-E8A574F9C0FF}\_F6016719_38E7_43AE_8F94_77A5F398DFBF 292878 bytes File C:\WINDOWS\Installer\{AB708C9B-97C8-4AC9-899B-DBF226AC9382} 0 bytes File C:\WINDOWS\Installer\{AC76BA86-0000-0000-0000-6028747ADE01} 0 bytes File C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000001} 0 bytes File C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000001}\BatchPDFIndex.ico 23558 bytes File C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000001}\FormsDocument.ico 23558 bytes File C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000001}\PDFIndex.ico 23558 bytes File C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000001}\PortableDocumentFormat.ico 23558 bytes File C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000001}\RightsManagementFile.ico 5222 bytes File C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000001}\SC_Acrobat_Standard_DT.ico 23558 bytes File C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000001}\SC_ELEMENTS_DT.ico 23558 bytes File C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000001}\XDPFileType.ico 23558 bytes File C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000001}\XFDFileType.ico 23558 bytes File C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000001}\XMLFormsDocument.ico 23558 bytes File C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003} 0 bytes File C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\1033.mst 3584 bytes File C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\SC_Designer_PFM.70DBED24_B579_40CB_AB0B_F1221A3E9EC5.exe 23558 bytes File C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_03C542E0_AC6D_46AE_A8C9_32C0CCC5E23B 23558 bytes File C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_37A0D036_9547_48DC_84A1_19CE2F8C1F00 23558 bytes File C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_709E9E16_6FB8_47BD_9731_F4F9B318C9CB 65536 bytes executable File C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_APIFile.ico 295606 bytes File C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_BatchPDFIndex.ico 295606 bytes File C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_C6F25057_E43E_401F_ 65536 bytes executable File C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_FormsDocument.ico 295606 bytes File C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_PDFFile.ico 295606 bytes File C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_PDFIndex.ico 295606 bytes File C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_PostScript.ico 295606 bytes File C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_RightsManagementFile.ico 25214 bytes File C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Acrobat.exe 295606 bytes File C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Acrobat_3D.exe 295606 bytes File C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Acrobat_Standard.exe 295606 bytes File C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Distiller.exe 25214 bytes File C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_ELEMENTS_DT.exe 7278 bytes File C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Synchronizer.ico 25214 bytes File C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SecStoreFile.ico 295606 bytes File C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SequenceFile.ico 295606 bytes File C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_XDPFileType.ico 295606 bytes File C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_XFDFileType.ico 23558 bytes File C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_XMLFormsDocument.ico 295606 bytes File C:\WINDOWS\Installer\{AC76BA86-7AD7-1033-7B44-A00000000001} 0 bytes File C:\WINDOWS\Installer\2198966.msi 1043456 bytes File C:\WINDOWS\Installer\23f57.msi 264704 bytes File C:\WINDOWS\Installer\255935e1.msp 1629184 bytes File C:\WINDOWS\Installer\2ba069.msi 3174400 bytes File C:\WINDOWS\Installer\2ba06f.msi 4057088 bytes File C:\WINDOWS\Installer\2d799f.msi 1583616 bytes File C:\WINDOWS\Installer\30fbb8b.msi 1631744 bytes File C:\WINDOWS\Installer\321827a.msi 3152384 bytes File C:\WINDOWS\Installer\32184ae.msi 8990208 bytes File C:\WINDOWS\Installer\32184b3.msi 1652224 bytes File C:\WINDOWS\Installer\3218589.msi 3771904 bytes File C:\WINDOWS\Installer\4e2400.msi 4604928 bytes File C:\WINDOWS\Installer\5609aae.msi 10796032 bytes File C:\WINDOWS\Installer\5609aaf.msp 37983232 bytes File C:\WINDOWS\Installer\628747d.msi 697856 bytes File C:\WINDOWS\Installer\7110ced.msi 2397184 bytes File C:\WINDOWS\Installer\{17334AAF-C9E7-483B-9F45-E3FCAF07FFA7} 0 bytes File C:\WINDOWS\Installer\{2642BE09-1F9F-4E18-AAD4-0258B9BCE611} 0 bytes File C:\WINDOWS\Installer\{2642BE09-1F9F-4E18-AAD4-0258B9BCE611}\Installer.exe 3774 bytes File C:\WINDOWS\Installer\{2A30052B-831C-41D3-8044-3C0388066350} 0 bytes File C:\WINDOWS\Installer\{2A30052B-831C-41D3-8044-3C0388066350}\1033.MST 12288 bytes File C:\WINDOWS\Installer\{2A30052B-831C-41D3-8044-3C0388066350}\ARPPRODUCTICON.exe 87376 bytes executable File C:\WINDOWS\Installer\{2A30052B-831C-41D3-8044-3C0388066350}\NewShortcut1_68F918D3F91F411B8936985CC2BD4192.exe 50512 bytes executable File C:\WINDOWS\Installer\{2A30052B-831C-41D3-8044-3C0388066350}\NewShortcut2_B7AA0888E8864144BA725EAA61DC15D5.exe 87376 bytes executable File C:\WINDOWS\Installer\{2A30052B-831C-41D3-8044-3C0388066350}\NewShortcut3_3AA20A2C6BEF43A6A3B4F09C5D78D1D4.exe 87376 bytes executable File C:\WINDOWS\Installer\{30465B6C-B53F-49A1-9EBA-A3F187AD502E} 0 bytes File C:\WINDOWS\Installer\{30C8AA56-4088-426F-91D1-0EDFD3A25678} 0 bytes File C:\WINDOWS\Installer\{30C8AA56-4088-426F-91D1-0EDFD3A25678}\en_US.mst 3584 bytes File C:\WINDOWS\Installer\{3248F0A8-6813-11D6-A77B-00B0D0150060} 0 bytes File C:\WINDOWS\Installer\{3248F0A8-6813-11D6-A77B-00B0D0150060}\sp1033.MST 605184 bytes File C:\WINDOWS\Installer\{3249FD43-B24B-413F-B786-F8FEA32FA747} 0 bytes File C:\WINDOWS\Installer\{3249FD43-B24B-413F-B786-F8FEA32FA747}\ARPPRODUCTICON.exe 29926 bytes File C:\WINDOWS\Installer\{3249FD43-B24B-413F-B786-F8FEA32FA747}\NewShortcut1_3249FD43B24B413FB786F8FEA32FA747.exe 69632 bytes executable File C:\WINDOWS\Installer\{3249FD43-B24B-413F-B786-F8FEA32FA747}\NewShortcut31_3249FD43B24B413FB786F8FEA32FA747 29926 bytes File C:\WINDOWS\Installer\{3249FD43-B24B-413F-B786-F8FEA32FA747}\NewShortcut3_3249FD43B24B413FB786F8FEA32FA747.exe 29926 bytes File C:\WINDOWS\McAfee.com\FreeScan 0 bytes File C:\WINDOWS\McAfee.com\FreeScan\avdat.exe 24576 bytes executable File C:\WINDOWS\McAfee.com\FreeScan\mcfscan.dll 116288 bytes executable File C:\WINDOWS\McAfee.com\FreeScan\mcscan32.dll 1949766 bytes executable File C:\WINDOWS\McAfee.com\FreeScan\names.DAT 724604 bytes File C:\WINDOWS\McAfee.com\FreeScan\rwabs16.dll 7449 bytes File C:\WINDOWS\McAfee.com\FreeScan\rwabs32.dll 16921 bytes executable File C:\WINDOWS\McAfee.com\FreeScan\scan.DAT 7446971 bytes File C:\WINDOWS\McAfee.com\FreeScan\signlic.txt 5645 bytes File C:\WINDOWS\Media\Windows XP Hardware Remove.wav 36538 bytes File C:\WINDOWS\Media\chimes.wav 55776 bytes File C:\WINDOWS\Media\chord.wav 97016 bytes File C:\WINDOWS\Media\CSSAMP1.MID 31081 bytes File C:\WINDOWS\Media\Defsound.wav 15920 bytes File C:\WINDOWS\Media\ding.wav 80856 bytes File C:\WINDOWS\Media\flourish.mid 24253 bytes File C:\WINDOWS\Media\Microsoft Office 2000 0 bytes File C:\WINDOWS\Media\notify.wav 119384 bytes File C:\WINDOWS\Media\onestop.mid 40075 bytes File C:\WINDOWS\Media\recycle.wav 25434 bytes File C:\WINDOWS\Media\ringin.wav 10026 bytes File C:\WINDOWS\Media\ringout.wav 5212 bytes File C:\WINDOWS\Media\start.wav 1192 bytes File C:\WINDOWS\Media\tada.wav 171100 bytes File C:\WINDOWS\Media\town.mid 22097 bytes File C:\WINDOWS\Media\Windows Feed Discovered.wav 8636 bytes File C:\WINDOWS\Media\Windows Information Bar.wav 20336 bytes File C:\WINDOWS\Media\Windows Navigation Start.wav 2202 bytes File C:\WINDOWS\Media\Windows Pop-up Blocked.wav 29444 bytes File C:\WINDOWS\Media\Windows XP Balloon.wav 6400 bytes File C:\WINDOWS\Media\Windows XP Battery Critical.wav 36910 bytes File C:\WINDOWS\Media\Windows XP Battery Low.wav 53864 bytes File C:\WINDOWS\Media\Windows XP Critical Stop.wav 39382 bytes File C:\WINDOWS\Media\Windows XP Default.wav 24530 bytes File C:\WINDOWS\Media\Windows XP Ding.wav 17132 bytes File C:\WINDOWS\Media\Windows XP Error.wav 44136 bytes File C:\WINDOWS\Media\Windows XP Exclamation.wav 42576 bytes File C:\WINDOWS\Media\Windows XP Hardware Fail.wav 36614 bytes File C:\WINDOWS\Media\Windows XP Hardware Insert.wav 36636 bytes File C:\WINDOWS\Media\Windows XP Information Bar.wav 20336 bytes File C:\WINDOWS\Media\Windows XP Logoff Sound.wav 179704 bytes File C:\WINDOWS\Media\Windows XP Logon Sound.wav 190208 bytes File C:\WINDOWS\Media\Windows XP Menu Command.wav 1404 bytes File C:\WINDOWS\Media\Windows XP Minimize.wav 22580 bytes File C:\WINDOWS\Media\Windows XP Notify.wav 48988 bytes File C:\WINDOWS\Media\Windows XP Pop-up Blocked.wav 29444 bytes File C:\WINDOWS\Media\Windows XP Print complete.wav 43762 bytes File C:\WINDOWS\Media\Windows XP Recycle.wav 22816 bytes File C:\WINDOWS\Media\Windows XP Restore.wav 19458 bytes File C:\WINDOWS\Media\Windows XP Ringin.wav 38930 bytes File C:\WINDOWS\Media\Windows XP Ringout.wav 22070 bytes File C:\WINDOWS\Media\Windows XP Shutdown.wav 282608 bytes File C:\WINDOWS\Media\Windows XP Start.wav 2202 bytes File C:\WINDOWS\Media\Windows XP Startup.wav 424644 bytes File C:\WINDOWS\Microsoft.NET\DirectX for Managed Code 0 bytes File C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0 0 bytes File C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectInput.xml 345509 bytes File C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.AudioVideoPlayback.dll 53248 bytes executable File C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.AudioVideoPlayback.xml 33914 bytes File C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Diagnostics.dll 12800 bytes executable File C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Diagnostics.xml 10439 bytes File C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Direct3D.dll 473600 bytes executable File C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Direct3D.xml 849122 bytes File C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectDraw.dll 145920 bytes executable File C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectDraw.xml 755962 bytes File C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectInput.dll 159232 bytes executable File C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectPlay.dll 364544 bytes executable File C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectPlay.xml 1252798 bytes File C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectSound.dll 178176 bytes executable File C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectSound.xml 348085 bytes File C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.dll 223232 bytes executable File C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.xml 265390 bytes File C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2907.0 0 bytes File C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2907.0\Microsoft.DirectX.Direct3DX.dll 577024 bytes executable File C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2907.0\Microsoft.DirectX.Direct3DX.xml 1437695 bytes File C:\WINDOWS\Microsoft.NET\Framework 0 bytes File C:\WINDOWS\Microsoft.NET\Framework\NETFXSBS10.exe 72704 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\NETFXSBS10.hkf 36354 bytes File C:\WINDOWS\Microsoft.NET\Framework\netfxsbs12.hkf 41392 bytes File C:\WINDOWS\Microsoft.NET\Framework\sbscmp10.dll 7680 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\sbscmp20_mscorwks.dll 7680 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\sbscmp20_perfcounter.dll 7680 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\sbs_diasymreader.dll 5120 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\sbs_iehost.dll 5120 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\sbs_microsoft.jscript.dll 5120 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\sbs_microsoft.vsa.vb.codedomprocessor.dll 5632 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\sbs_mscordbi.dll 5120 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\sbs_mscorrc.dll 5120 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\sbs_mscorsec.dll 5120 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\sbs_system.configuration.install.dll 5120 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\sbs_system.data.dll 5120 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\sbs_system.enterpriseservices.dll 5120 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\sbs_VsaVb7rt.dll 5120 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\sbs_wminet_utils.dll 5120 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\SharedReg12.dll 7680 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705 0 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\installutil.exe.config 353 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\mscormmc.cfg 5201 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\mscormmc.dll 86528 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\regsvcs.exe.config 351 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\regsvcs.exe.rtm.config 351 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322 0 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\UninstallPersistSqlState.sql 1419 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\UninstallSqlState.sql 1931 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates 0 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M886903 0 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\vbc.exe 737280 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\vbc.exe.config 163 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\vsavb7.olb 4096 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\VsaVb7rt.dll 1032192 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\WMINet_Utils.dll 31744 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\xjis.nlp 28288 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\XPThemes.manifest 476 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\_dataperfcounters.h 829 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\_dataperfcounters.ini 3722 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\_NetworkingPerfCounters.h 811 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\_Networkingperfcounters.ini 56596 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Microsoft.Vsa.tlb 22528 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Microsoft.Vsa.Vb.CodeDOMProcessor.dll 11264 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Microsoft.Vsa.Vb.CodeDOMProcessor.tlb 6144 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Microsoft_VsaVb.dll 6656 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\MigPol.exe 49152 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\MigPolWin.exe 49152 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorcfg.dll 1564672 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorcfg.msc 47104 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscordbc.dll 77824 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscordbi.dll 233472 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscoree.tlb 17920 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorie.dll 86016 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorjit.dll 311296 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorlib.dll 2088960 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorlib.ldo 10736 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorlib.tlb 458752 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscormmc.dll 131072 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscormmc11.cfg 5201 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorpe.dll 65536 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorrc.dll 143360 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsec.dll 81920 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsn.dll 77824 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll 2494464 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscortim.dll 9216 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll 2482176 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\msvcr71.dll 348160 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mtxoci8.dll 20480 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\MUI 0 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\MUI\0409 0 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\MUI\0409\mscorsecr.dll 22528 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ndpsetup.ico 1078 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ngen.exe 73728 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\PerfCounter.dll 90112 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\prc.nlp 83748 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\prcp.nlp 83748 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\RegAsm.exe 28672 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\fusion.dll 282624 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\gacutil.exe.config 140 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\IEExec.exe 7680 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ieexec.exe.config 140 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\IEExecRemote.dll 7168 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\IEHost.dll 32768 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\IIEHost.dll 4608 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ilasm.exe 196608 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ilasm.exe.config 353 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\InstallPersistSqlState.sql 30359 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\InstallSqlState.sql 30989 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\InstallUtil.exe 15872 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\InstallUtilLib.dll 40960 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ISymWrapper.dll 26112 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\jsc.exe 40960 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\jsc.exe.config 163 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ksc.nlp 116756 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\l_except.nlp 168 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\l_intl.nlp 7720 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Microsoft.JScript.dll 716800 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Microsoft.JScript.tlb 49152 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Microsoft.VisualBasic.dll 299008 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Microsoft.VisualBasic.Vsa.dll 28672 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Microsoft.VisualC.Dll 6144 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Configuration.Install.dll 77824 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Data.dll 1290240 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Data.OracleClient.dll 299008 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Design.dll 1699840 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Design.ldo 2580 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.DirectoryServices.dll 86016 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.dll 1216512 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Drawing.Design.dll 65536 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Drawing.dll 466944 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\system.drawing.ldo 4208 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Drawing.tlb 7168 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.EnterpriseServices.dll 241664 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.EnterpriseServices.Thunk.dll 64000 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.EnterpriseServices.tlb 45056 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.ldo 11524 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Management.dll 368640 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Messaging.dll 241664 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ASP.NETClientFiles 0 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ASP.NETClientFiles\SmartNav.htm 15 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ASP.NETClientFiles\SmartNav.js 8728 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ASP.NETClientFiles\WebUIValidation.js 14426 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\CONFIG 0 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\CONFIG\DefaultWsdlHelpGenerator.aspx 61724 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\CONFIG\enterprisesec.config 21768 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\CONFIG\enterprisesec.config.cch 45670 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\CONFIG\machine.config 226636 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\CONFIG\security.config 29001 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\CONFIG\security.config.cch 62399 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\CONFIG\web_hightrust.config 12200 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\CONFIG\web_hightrust.config.default 12200 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\CONFIG\web_lowtrust.config 8707 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\CONFIG\web_lowtrust.config.default 8707 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\CONFIG\web_mediumtrust.config 11445 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\CONFIG\web_mediumtrust.config.default 11445 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\CONFIG\web_minimaltrust.config 7646 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\CONFIG\web_minimaltrust.config.default 7646 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Microsoft.Vsa.dll 32768 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorld.dll 98304 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\regasm.exe.config 353 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Runtime.Remoting.dll 323584 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Runtime.Serialization.Formatters.Soap.dll 131072 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Security.dll 77824 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.ServiceProcess.dll 126976 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.tlb 73728 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Web.dll 1245184 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Web.Mobile.dll 819200 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Web.RegularExpressions.dll 57344 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Web.Services.dll 569344 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Windows.Forms.dll 2039808 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Windows.Forms.ldo 17328 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Windows.Forms.tlb 57344 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.XML.dll 1335296 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Xml.ldo 15700 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Temporary ASP.NET Files 0 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Temporary ASP.NET Files\Bind Logs 0 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet.config 728 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet.mof 1115 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet.mof.uninstall 395 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_filter.dll 24576 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_isapi.dll 253952 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_perf.h 4297 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_perf.ini 534160 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_perf2.ini 532396 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_rc.dll 40960 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_regiis.exe 20480 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe 32768 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe 32768 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\big5.nlp 66728 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\bopomofo.nlp 82172 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\CasPol.exe 94208 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\caspol.exe.config 353 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\CharInfo.nlp 11302 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\RegCode.dll 32768 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\region.nlp 8014 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\RegSvcs.exe 12288 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\regsvcs.exe.config 353 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\shfusion.dll 253952 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\shfusres.dll 122880 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\sortkey.nlp 262148 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\sorttbls.nlp 21164 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SOS.dll 319488 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ConfigWizards.exe 49152 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ConfigWizards.exe.config 353 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ConsumerCommands.xml 666 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\CORPerfMonExt.dll 77824 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\CORPerfMonSymbols.h 6067 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\corperfmonsymbols.ini 2435148 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\csc.exe 49152 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\csc.exe.config 163 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\csc.rsp 833 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\cscomp.dll 626688 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\cscompmgd.dll 12288 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ctype.nlp 6804 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\culture.nlp 105160 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\CustomMarshalers.dll 33792 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\cvtres.exe 28672 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\cvtres.exe.config 353 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\c_g18030.dll 219136 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\diasymreader.dll 524288 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\EULA.rtf 11923 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\EventLogMessages.dll 798720 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\1033 0 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\1033\alinkui.dll 16896 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\1033\cscompui.dll 94208 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\1033\repairRedist.htm 5127 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\1033\SetupENU1.txt 38 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\1033\SetupENU2.txt 38 bytes File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\1033\vbc7ui.dll 131072 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\1033\Vsavb7rtUI.dll 155648 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Accessibility.dll 7680 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\alink.dll 98304 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727 0 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033 0 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\alinkui.dll 18944 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\cscompui.dll 136192 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\CvtResUI.dll 4608 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\vbc7ui.dll 183808 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\Vsavb7rtUI.dll 208896 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Accessibility.dll 10752 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\AdoNetDiag.dll 138240 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\adonetdiag.mof 6011 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\alink.dll 87552 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe 55488 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles 0 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images 0 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif 328 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif 952 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg 22500 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif 121 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif 2030 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg 8260 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif 61 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif 914 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif 90 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif 90 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg 1409 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif 1420 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif 162 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif 586 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif 124 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.jpg 49 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_1x1.gif 49 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif 65 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif 65 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg 8683 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif 65 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif 65 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif 880 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig 0 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\AppConfigHome.aspx 8100 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\AppSetting.ascx 3733 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\App_LocalResources 0 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\AppConfigHome.aspx.resx 3806 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\AppSetting.ascx.resx 1367 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\CreateAppSetting.aspx.resx 1539 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\DebugAndTrace.aspx.resx 2829 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\DefineErrorPage.aspx.resx 2457 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\EditAppSetting.aspx.resx 1110 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\ManageAppSettings.aspx.resx 3097 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\SmtpSettings.aspx.resx 3351 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\CreateAppSetting.aspx 3669 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\DebugAndTrace.aspx 12253 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\DefineErrorPage.aspx 18173 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\EditAppSetting.aspx 2304 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\ManageAppSettings.aspx 15196 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\SmtpSettings.aspx 17787 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_Code 0 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_Code\ApplicationConfigurationPage.cs 949 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_Code\NavigationBar.cs 886 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_Code\PasswordValueTextBox.cs 1188 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_Code\ProvidersPage.cs 4977 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_Code\SecurityPage.cs 2677 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_Code\WebAdminPage.cs 48683 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_Code\WizardPage.cs 825 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_Data 0 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_Data\GroupedProviders.xml 317 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_GlobalResources 0 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_GlobalResources\AppConfigCommon.resx 777 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_GlobalResources\GlobalResources.resx 4348 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources 0 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\default.aspx.resx 2095 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\error.aspx.resx 1366 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\home0.aspx.resx 1204 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\home1.aspx.resx 859 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\home2.aspx.resx 1169 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\navigationBar.ascx.resx 827 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\WebAdminHelp.aspx.resx 11802 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\WebAdminHelp_Application.aspx.resx 22286 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\WebAdminHelp_Internals.aspx.resx 6345 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\WebAdminHelp_Provider.aspx.resx 10532 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\WebAdminHelp_Security.aspx.resx 18221 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\default.aspx 4349 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\error.aspx 6801 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\home0.aspx 1361 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\home1.aspx 740 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\home2.aspx 1042 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\navigationBar.ascx 8912 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Providers 0 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Providers\App_LocalResources 0 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Providers\App_LocalResources\chooseProviderManagement.aspx.resx 1559 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Providers\App_LocalResources\manageconsolidatedProviders.aspx.resx 1412 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Providers\App_LocalResources\manageProviders.aspx.resx 2320 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Providers\App_LocalResources\providerList.ascx.resx 1011 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Providers\chooseProviderManagement.aspx 2462 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Providers\ManageConsolidatedProviders.aspx 12595 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Providers\ManageProviders.aspx 9713 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Providers\ProviderList.ascx 9089 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security 0 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\App_LocalResources 0 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\App_LocalResources\security.aspx.resx 3736 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\App_LocalResources\security0.aspx.resx 1383 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\App_LocalResources\setUpAuthentication.aspx.resx 1696 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Permissions 0 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Permissions\App_LocalResources 0 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Permissions\App_LocalResources\createPermission.aspx.resx 2292 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Permissions\App_LocalResources\managePermissions.aspx.resx 2665 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Permissions\createPermission.aspx 11000 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Permissions\managePermissions.aspx 21603 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Roles 0 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Roles\App_LocalResources 0 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Roles\App_LocalResources\manageAllRoles.aspx.resx 2132 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Roles\App_LocalResources\manageSingleRole.aspx.resx 2034 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Roles\manageAllRoles.aspx 7206 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Roles\manageSingleRole.aspx 9526 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\security.aspx 10094 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\security0.aspx 1447 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\setUpAuthentication.aspx 2564 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Users 0 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\addUser.aspx 5300 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\App_LocalResources 0 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\App_LocalResources\addUser.aspx.resx 1539 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\App_LocalResources\editUser.aspx.resx 3276 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\App_LocalResources\findUsers.aspx.resx 1988 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\App_LocalResources\manageUsers.aspx.resx 3549 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\editUser.aspx 12006 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\findUsers.aspx 7979 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\manageUsers.aspx 15187 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard 0 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources 0 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\confirmation.ascx.resx 775 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizard.aspx.resx 2070 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizardAddUser.ascx.resx 1175 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizardAuthentication.ascx.resx 1867 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizardCreateRoles.ascx.resx 2298 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizardFinish.ascx.resx 917 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizardInit.ascx.resx 1550 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizardPermission.ascx.resx 3645 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizardProviderInfo.ascx.resx 1157 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\confirmation.ascx 2367 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\wizard.aspx 10930 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\wizardAddUser.ascx 1682 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\wizardAuthentication.ascx 2668 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\wizardCreateRoles.ascx 7720 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\wizardFinish.ascx 271 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\wizardInit.ascx 491 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\wizardPermission.ascx 25124 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\wizardProviderInfo.ascx 1714 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\web.config 716 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\webAdmin.master 2502 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\webAdminButtonRow.master 2097 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp.aspx 6738 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Application.aspx 13571 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Internals.aspx 4076 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Provider.aspx 6701 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Security.aspx 10563 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\webAdminNoButtonRow.master 761 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\webAdminNoNavBar.master 19 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\WebAdminStyles.css 12964 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\WebAdminWithConfirmation.master 3826 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\WebAdminWithConfirmationNoButtonRow.master 3638 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Aspnet.config 323 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet.mof 34112 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet.mof.uninstall 481 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\AspNetMMCExt.dll 503808 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe 36864 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_filter.dll 10752 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll 8192 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\_DataOracleClientPerfCounters_shared12_neutral.ini 98498 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\_DataPerfCounters.h 829 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\_DataPerfCounters.ini 53772 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\_dataperfcounters_shared12_neutral.h 444 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\_dataperfcounters_shared12_neutral.ini 98642 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\_NetworkingPerfCounters.h 811 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\_Networkingperfcounters.ini 56802 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_perf.h 6089 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_perf.ini 777284 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_perf2.ini 775688 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_rc.dll 70656 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe 13824 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe 26824 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe 106496 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Aspnet_regsql.exe.config 205 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe 29896 bytes executable <– ROOTKIT !!! File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state_perf.h 318 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state_perf.ini 42868 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe 29888 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\big5.nlp 66728 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\bopomofo.nlp 82172 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CasPol.exe 106496 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\caspol.exe.config 181 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CLR.mof 11083 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CLR.mof.uninstall 638 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Aspnet_perf.dll 23552 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\dfdll.dll 52736 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Utilities.dll 73728 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.Vb.CodeDOMProcessor.tlb 6144 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscordbc.dll 73216 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\normnfc.nlp 42918 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.OracleClient.dll 482304 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Messaging.dll 258048 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\UninstallRoles.sql 5869 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\_DataOracleClientPerfCounters_shared12_neutral.h 444 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG 0 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\Browsers 0 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\Browsers\avantgo.browser 5763 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\Browsers\cassio.browser 4097 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\Browsers\Default.browser 12848 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\Browsers\docomo.browser 62790 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\Browsers\ericsson.browser 30330 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\Browsers\EZWap.browser 2299 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\Browsers\gateway.browser 9761 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\Browsers\generic.browser 801 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\Browsers\goAmerica.browser 16742 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\Browsers\ie.browser 18396 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\Browsers\Jataayu.browser 3636 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\Browsers\jphone.browser 21509 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\Browsers\legend.browser 2888 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\Browsers\MME.browser 15311 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\Browsers\mozilla.browser 13047 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\Browsers\netscape.browser 6408 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\Browsers\nokia.browser 63449 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\Browsers\openwave.browser 154500 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\Browsers\opera.browser 13328 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\Browsers\palm.browser 26371 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\Browsers\panasonic.browser 7274 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\Browsers\pie.browser 25919 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\Browsers\webtv.browser 2719 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\Browsers\winwap.browser 3321 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\Browsers\xiino.browser 3140 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\DefaultWsdlHelpGenerator.aspx 70433 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config 19852 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config.comments 42927 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config.default 19852 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\web.config 30002 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\web.config.comments 56960 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\web.config.default 30002 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\web_hightrust.config 12537 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\web_hightrust.config.default 12537 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\web_lowtrust.config 8176 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\web_lowtrust.config.default 8176 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\web_mediumtrust.config 11318 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\web_mediumtrust.config.default 11318 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\web_minimaltrust.config 7122 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\web_minimaltrust.config.default 7122 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CORPerfMonExt.dll 88576 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CORPerfMonSymbols.h 6067 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\corperfmonsymbols.ini 1508088 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\csc.exe 76984 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\csc.exe.config 221 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\csc.rsp 976 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\cscomp.dll 1144832 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\cscompmgd.dll 13312 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll 17920 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CustomMarshalers.dll 68608 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\cvtres.exe 31936 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe 4608 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll 547840 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\dv_aspnetmmc.chm 115131 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll 788992 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fusion.dll 9216 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IEExec.exe 9728 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ieexec.exe.config 181 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IEExecRemote.dll 8192 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IEHost.dll 36864 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IIEHost.dll 5632 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ilasm.exe 224952 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ilasm.exe.config 181 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallCommon.sql 24603 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallMembership.sql 55833 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallPersistSqlState.sql 52339 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallPersonalization.sql 34950 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallProfile.SQL 20891 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallRoles.sql 34264 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallSqlState.sql 52123 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallSqlStateTemplate.sql 53895 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe 28672 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallUtilLib.dll 55296 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallWebEventSqlProvider.sql 6457 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ISymWrapper.dll 72192 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\jsc.exe 40960 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\jsc.exe.config 221 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ksc.nlp 116756 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0 0 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\eula.1037.txt 5410 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1029.dll 82944 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\eula.1025.txt 6188 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\eula.1028.txt 2564 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\eula.1029.txt 7330 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\eula.1030.txt 7414 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\eula.1031.txt 8516 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\eula.1032.txt 8532 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\eula.1033.txt 6996 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\eula.1035.txt 7214 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\eula.1036.txt 7946 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\eula.1038.txt 7982 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\eula.1040.txt 8606 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\eula.1041.txt 3868 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\eula.1042.txt 3904 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\eula.1043.txt 8042 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\eula.1044.txt 7072 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\eula.1045.txt 8414 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\eula.1046.txt 7990 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\eula.1049.txt 8584 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\eula.1053.txt 6986 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\eula.1055.txt 6924 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\eula.2052.txt 2500 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\eula.2070.txt 8218 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\eula.3076.txt 2564 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\eula.3082.txt 8370 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe 609472 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.ini 4585 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1025.dll 80896 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1028.dll 80896 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1030.dll 81920 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1031.dll 85504 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1032.dll 87552 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1033.dll 80896 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1035.dll 81408 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1036.dll 86016 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1037.dll 80896 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1038.dll 83968 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1040.dll 84480 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1041.dll 80896 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1042.dll 80896 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1043.dll 83456 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1044.dll 81920 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1045.dll 83456 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1046.dll 82432 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1049.dll 82432 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1053.dll 81920 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1055.dll 80896 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.2052.dll 80896 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.2070.dll 84480 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.3076.dll 80896 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.3082.dll 85504 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\netfx.bmp 5686 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\netfx.msi 24863744 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\unicows.dll 245408 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Engine.dll 413696 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Framework.dll 36864 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Tasks.dll 647168 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft_VsaVb.dll 7168 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MmcAspExt.dll 87552 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MSBuild 0 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MSBuild\Microsoft.Build.Commontypes.xsd 99497 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MSBuild\Microsoft.Build.Core.xsd 24170 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe 69632 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\msbuild.exe.config 559 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MSBuild.rsp 732 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscordacwks.dll 800768 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscordbi.dll 288768 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscoree.tlb 36864 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorie.dll 36864 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll 326144 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorld.dll 81408 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll 4308992 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorlib.tlb 524288 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorpe.dll 102400 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll 330752 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll 67072 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsn.dll 9216 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvc.dll 226816 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 66240 bytes executable <– ROOTKIT !!! File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscortim.dll 10240 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll 5615616 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MUI 0 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MUI\0409 0 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MUI\0409\mscorsecr.dll 22528 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ndpsetup.ico 25214 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ngen.exe 96440 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ngen.log 52236 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ngen_service.log 92296 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\normalization.dll 14848 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\normidna.nlp 59342 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\normnfd.nlp 36644 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\normnfkc.nlp 63176 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\normnfkd.nlp 57150 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\PerfCounter.dll 78336 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\peverify.dll 136192 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\prc.nlp 83748 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\prcp.nlp 83748 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RedistList 0 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RedistList\FrameworkList.xml 11023 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe 53248 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\regasm.exe.config 181 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe 32768 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\regsvcs.exe.config 181 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\regtlibv12.exe 59072 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\sbscmp20_mscorlib.dll 7680 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\shfusion.chm 101499 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\shfusion.dll 107520 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ShFusRes.dll 85504 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\sortkey.nlp 262148 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\sorttbls.nlp 20320 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\SOS.dll 377344 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\sysglobl.dll 110592 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.configuration.dll 389120 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Configuration.Install.dll 81920 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.dll 2878976 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.SqlXml.dll 716800 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Deployment.dll 884736 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Design.dll 5050368 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.dll 397312 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.Protocols.dll 188416 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.dll 3018752 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Drawing.Design.dll 81920 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Drawing.dll 700416 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Drawing.tlb 8192 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.dll 258048 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Thunk.dll 47616 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.tlb 40960 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Wrapper.dll 114176 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Management.dll 368640 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Remoting.dll 299008 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Serialization.Formatters.Soap.dll 131072 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Security.dll 258048 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.ServiceProcess.dll 114688 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.tlb 81920 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Transactions.dll 260096 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.dll 5025792 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.Mobile.dll 835584 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.RegularExpressions.dll 86016 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.Services.dll 823296 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.tlb 6656 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Windows.Forms.dll 5316608 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Windows.Forms.tlb 94208 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.XML.dll 2035712 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files 0 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\TLBREF.DLL 71680 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\UninstallCommon.sql 3890 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\UninstallMembership.sql 6909 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\UninstallPersistSqlState.sql 10195 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\UninstallPersonalization.sql 7489 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\UnInstallProfile.SQL 4760 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\UninstallSqlState.sql 9691 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\UninstallSqlStateTemplate.sql 11797 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\UninstallWebEventSqlProvider.sql 3006 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe 1140920 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe.config 221 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.rsp 1070 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vsavb7.olb 4096 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\VsaVb7rt.dll 1306624 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\webengine.dll 298496 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\WMINet_Utils.dll 28160 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\xjis.nlp 28288 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\XPThemes.manifest 474 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.xsd 2355 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Common.targets 177457 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Common.Tasks 6676 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.CSharp.targets 9184 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.JScript.dll 745472 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.JScript.tlb 53248 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Compatibility.Data.dll 110592 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Compatibility.dll 372736 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.dll 667648 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.targets 9836 bytes File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Vsa.dll 28672 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualC.Dll 5632 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.dll 32768 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.tlb 23040 bytes executable File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.Vb.CodeDOMProcessor.dll 12800 bytes executable File C:\WINDOWS\$NtUninstallKB899588$\spuninst 0 bytes File C:\WINDOWS\$NtUninstallKB915865$\spuninst 0 bytes File C:\WINDOWS\$NtUninstallKB915865$\spuninst\spuninst.exe 213216 bytes executable File C:\WINDOWS\$NtUninstallKB915865$\spuninst\spuninst.inf 5453 bytes File C:\WINDOWS\$NtUninstallKB915865$\spuninst\spuninst.txt 218 bytes File C:\WINDOWS\$NtUninstallKB915865$\spuninst\updspapi.dll 371424 bytes executable File C:\WINDOWS\.jagex_cache_32\random.dat 24 bytes File C:\WINDOWS\.jagex_cache_32\runescape 0 bytes File C:\WINDOWS\.jagex_cache_32\runescape\main_file_cache.idx12 5742 bytes File C:\WINDOWS\.jagex_cache_32\runescape\main_file_cache.dat0 323292 bytes File C:\WINDOWS\.jagex_cache_32\runescape\main_file_cache.dat2 21168127 bytes File C:\WINDOWS\.jagex_cache_32\runescape\main_file_cache.idx0 13476 bytes File C:\WINDOWS\.jagex_cache_32\runescape\main_file_cache.idx1 12132 bytes File C:\WINDOWS\.jagex_cache_32\runescape\main_file_cache.idx10 12 bytes File C:\WINDOWS\.jagex_cache_32\runescape\main_file_cache.idx13 4920 bytes File C:\WINDOWS\.jagex_cache_32\runescape\main_file_cache.idx14 3282 bytes File C:\WINDOWS\.jagex_cache_32\runescape\main_file_cache.idx15 774 bytes File C:\WINDOWS\.jagex_cache_32\runescape\main_file_cache.idx16 726 bytes File C:\WINDOWS\.jagex_cache_32\runescape\main_file_cache.idx17 36 bytes File C:\WINDOWS\.jagex_cache_32\runescape\main_file_cache.idx18 366 bytes File C:\WINDOWS\.jagex_cache_32\runescape\main_file_cache.idx19 312 bytes File C:\WINDOWS\.jagex_cache_32\runescape\main_file_cache.idx2 162 bytes File C:\WINDOWS\.jagex_cache_32\runescape\main_file_cache.idx20 432 bytes File C:\WINDOWS\.jagex_cache_32\runescape\main_file_cache.idx21 42 bytes File C:\WINDOWS\.jagex_cache_32\runescape\main_file_cache.idx22 30 bytes File C:\WINDOWS\.jagex_cache_32\runescape\main_file_cache.idx255 144 bytes File C:\WINDOWS\.jagex_cache_32\runescape\main_file_cache.idx3 4404 bytes File C:\WINDOWS\.jagex_cache_32\runescape\main_file_cache.idx4 28776 bytes File C:\WINDOWS\.jagex_cache_32\runescape\main_file_cache.idx5 12564 bytes File C:\WINDOWS\.jagex_cache_32\runescape\main_file_cache.idx6 6 bytes File C:\WINDOWS\.jagex_cache_32\runescape\main_file_cache.idx7 199572 bytes File C:\WINDOWS\.jagex_cache_32\runescape\main_file_cache.idx8 7452 bytes File C:\WINDOWS\.jagex_cache_32\runescape\main_file_cache.idx9 6 bytes File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Networking.RtcDll_6595b64144ccf1df_5.2.2.3_x-ww_d6bd8b95 0 bytes File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Networking.RtcDll_6595b64144ccf1df_5.2.2.3_x-ww_d6bd8b95\rtcdll.dll 991232 bytes executable File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Networking.RtcRes_6595b64144ccf1df_5.2.2.3_en_16a24bc 0 0 bytes File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Networking.RtcRes_6595b64144ccf1df_5.2.2.3_en_16a24bc 0\rtcres.dll 132096 bytes executable File C:\WINDOWS\WinSxS\InstallTemp 0 bytes File C:\WINDOWS\WinSxS\InstallTemp\49796 0 bytes File C:\WINDOWS\WinSxS\InstallTemp\49796\comctl32.dll 921088 bytes executable File C:\WINDOWS\WinSxS\InstallTemp\67829 0 bytes File C:\WINDOWS\WinSxS\Manifests 0 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.0.0_x-ww_ff9986d7.cat 7232 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.0.0_x-ww_ff9986d7.Manifest 1819 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.SystemCompatible_6595b64144ccf1df_5.1.0.0_x-ww_fc342b0b.cat 7236 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.SystemCompatible_6595b64144ccf1df_5.1.0.0_x-ww_fc342b0b.Manifest 640 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.SystemCompatible_6595b64144ccf1df_5.1.2600.2000_x-ww_bcc9a281.cat 7431 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.SystemCompatible_6595b64144ccf1df_5.1.2600.2000_x-ww_bcc9a281.Manifest 1237 bytes File C:\WINDOWS\WinSxS\Manifests\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790.manifest 8173 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.2180_x-ww_522f9f82.cat 7431 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.2180_x-ww_522f9f82.Manifest 397 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_5.2.2.3_x-ww_468466a7.cat 7429 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_5.2.2.3_x-ww_468466a7.Manifest 1877 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.Networking.RtcDll_6595b64144ccf1df_5.2.2.3_x-ww_d6bd8b95.cat 7429 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.Networking.RtcDll_6595b64144ccf1df_5.2.2.3_x-ww_d6bd8b95.Manifest 1177 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.Networking.RtcRes_6595b64144ccf1df_5.2.2.3_en_16a24bc 0.cat 7429 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_6e805841.cat 7423 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0.manifest 1238 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_d01483b2.cat 9749 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a.Manifest 1784 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.0.0_x-ww_8d353f13.Manifest 391 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.Networking.RtcRes_6595b64144ccf1df_5.2.2.3_en_16a24bc 0.Manifest 460 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9.cat 7433 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9.Manifest 1862 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a.cat 7238 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a.Manifest 494 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9.cat 7433 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9.Manifest 500 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.0.0_x-ww_8d353f13.cat 7236 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_6e805841.manifest 464 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474.cat 8335 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474.manifest 465 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb.cat 8335 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb.manifest 1869 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd.cat 7423 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd.manifest 1868 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700.cat 8335 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700.manifest 1869 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0.cat 7436 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303.cat 8348 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303.manifest 1239 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_39049d00.cat 8335 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_39049d00.manifest 2371 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2.cat 7423 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2.manifest 2370 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05.cat 8335 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05.manifest 2371 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0ee63867.cat 7436 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0ee63867.manifest 467 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a.cat 8348 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a.manifest 468 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_d01483b2.manifest 853 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e.cat 9749 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e.manifest 1857 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC90.DebugCRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_f863c71f.cat 9770 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC90.DebugCRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_f863c71f.manifest 1865 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC90.DebugMFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_c94a3a24.cat 9770 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC90.DebugMFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_c94a3a24.manifest 2363 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03.cat 9762 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03.manifest 5879 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943.cat 9749 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943.manifest 2354 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_ecc42bd1.cat 10749 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_ecc42bd1.manifest 858 bytes File C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a.cat 7238 bytes File C:\WINDOWS\WinSxS\Policies 0 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_x-ww_caeee150 0 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_x-ww_caeee150\8.0.50727.42.cat 7447 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_x-ww_caeee150\8.0.50727.42.policy 718 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_x-ww_caeee150\8.0.50727.762.cat 8361 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_x-ww_caeee150\8.0.50727.762.policy 806 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.1.0.Microsoft.Windows.GdiPlus_6595b64144ccf1df_x-ww_4e8510ac 0 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.1.0.Microsoft.Windows.GdiPlus_6595b64144ccf1df_x-ww_4e8510ac\1.0.2600.2180.cat 7431 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.1.0.Microsoft.Windows.GdiPlus_6595b64144ccf1df_x-ww_4e8510ac\1.0.2600.2180.Policy 605 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.5.1.Microsoft.Windows.SystemCompatible_6595b64144ccf1df_x-ww_a0111510 0 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.5.1.Microsoft.Windows.SystemCompatible_6595b64144ccf1df_x-ww_a0111510\5.1.2600.2000.cat 7431 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.5.1.Microsoft.Windows.SystemCompatible_6595b64144ccf1df_x-ww_a0111510\5.1.2600.2000.Policy 623 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.5.2.Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_x-ww_362e60dd 0 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.5.2.Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_x-ww_362e60dd\5.2.2.3.cat 7429 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.5.2.Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_x-ww_362e60dd\5.2.2.3.Policy 641 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.5.2.Microsoft.Windows.Networking.Rtcdll_6595b64144ccf1df_x-ww_c7b7206f 0 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.5.2.Microsoft.Windows.Networking.Rtcdll_6595b64144ccf1df_x-ww_c7b7206f\5.2.2.3.cat 7429 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.5.2.Microsoft.Windows.Networking.Rtcdll_6595b64144ccf1df_x-ww_c7b7206f\5.2.2.3.Policy 641 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.6.0.Microsoft.Windows.Common-Controls_6595b64144ccf1df_x-ww_5ddad775 0 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.6.0.Microsoft.Windows.Common-Controls_6595b64144ccf1df_x-ww_5ddad775\6.0.2600.2180.cat 7429 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.6.0.Microsoft.Windows.Common-Controls_6595b64144ccf1df_x-ww_5ddad775\6.0.2600.2180.Policy 621 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.7.0.Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_x-ww_a317e4b3 0 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.7.0.Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_x-ww_a317e4b3\7.0.2600.2180.cat 7433 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.7.0.Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_x-ww_a317e4b3\7.0.2600.2180.Policy 623 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_x-ww_5f0bbcff 0 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_x-ww_5f0bbcff\8.0.50727.42.cat 7441 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_x-ww_5f0bbcff\8.0.50727.42.policy 712 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_x-ww_5f0bbcff\8.0.50727.762.cat 8355 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_x-ww_5f0bbcff\8.0.50727.762.policy 800 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773 0 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.163.cat 8355 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.163.policy 786 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.42.cat 7441 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.42.policy 712 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.762.cat 8355 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.762.policy 800 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_x-ww_0f75c32e 0 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_x-ww_0f75c32e\8.0.50727.163.cat 8355 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_x-ww_0f75c32e\8.0.50727.163.policy 786 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_x-ww_0f75c32e\8.0.50727.42.cat 7441 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_x-ww_0f75c32e\8.0.50727.42.policy 712 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_x-ww_0f75c32e\8.0.50727.762.cat 8355 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_x-ww_0f75c32e\8.0.50727.762.policy 800 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_x-ww_7d81c9f9 0 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_x-ww_7d81c9f9\8.0.50727.42.cat 7447 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_x-ww_7d81c9f9\8.0.50727.42.policy 718 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_x-ww_7d81c9f9\8.0.50727.762.cat 8361 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_x-ww_7d81c9f9\8.0.50727.762.policy 806 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_x-ww_9e7eb501 0 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_x-ww_9e7eb501\9.0.30729.1.cat 9798 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_x-ww_9e7eb501\9.0.30729.1.policy 752 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_x-ww_b7353f75 0 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_x-ww_b7353f75\9.0.30729.1.cat 9798 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_x-ww_b7353f75\9.0.30729.1.policy 752 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.DebugCRT_1fc8b3b9a1e18e3b_x-ww_037be232 0 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.DebugCRT_1fc8b3b9a1e18e3b_x-ww_037be232\9.0.30729.1.cat 9818 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.DebugCRT_1fc8b3b9a1e18e3b_x-ww_037be232\9.0.30729.1.policy 762 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.DebugMFC_1fc8b3b9a1e18e3b_x-ww_9b2f5ded 0 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.DebugMFC_1fc8b3b9a1e18e3b_x-ww_9b2f5ded\9.0.30729.1.cat 9818 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.DebugMFC_1fc8b3b9a1e18e3b_x-ww_9b2f5ded\9.0.30729.1.policy 762 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_x-ww_b8438ace 0 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_x-ww_b8438ace\9.0.30729.1.cat 9810 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_x-ww_b8438ace\9.0.30729.1.policy 758 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_x-ww_4ee8bb30 0 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_x-ww_4ee8bb30\9.0.30729.1.cat 9798 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_x-ww_4ee8bb30\9.0.30729.1.policy 752 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_x-ww_6ad67377 0 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_x-ww_6ad67377\9.0.21022.8.cat 10797 bytes File C:\WINDOWS\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_x-ww_6ad67377\9.0.21022.8.policy 668 bytes File C:\WINDOWS\WinSxS\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a 0 bytes File C:\WINDOWS\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.1.0.0_x-ww_b319d8da 0 bytes File C:\WINDOWS\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9818.0_x-ww_8ff50c5d 0 bytes File C:\WINDOWS\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.0.0_x-ww_ff9986d7 0 bytes File C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_6e805841 0 bytes File C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474 0 bytes File C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb 0 bytes —- Services - GMER 1.0.15 —- Service C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (Microsoft ASP.NET State Server/Microsoft Corporation) [MANUAL] aspnet_state <– ROOTKIT !!! Service C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (.NET Runtime Optimization Service/Microsoft Corporation) [MANUAL] clr_optimization_v2.0.50727_32 <– ROOTKIT !!! —- EOF - GMER 1.0.15 —-

CatByte

Post #7December 12, 2009, 2:29 PM UTC

Hi,

Please do the following:

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

jacory

Post #8December 12, 2009, 5:58 PM UTC

COMBOFIX.TXT

ComboFix 09-12-11.05 - Twice Bitten 12/12/2009 12:27:56.3.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.503.142 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Spyware Doctor with AntiVirus *On-access scanning disabled* (Updated) {D3C23B96-C9DC-477F-8EF1-69AF17A6EFF6}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Guest\Local Settings\Application Data\{76960496-3CE2-4F6B-B419-CFFEF12E7BDA}
c:\documents and settings\Guest\Local Settings\Application Data\{76960496-3CE2-4F6B-B419-CFFEF12E7BDA}\chrome.manifest
c:\documents and settings\Guest\Local Settings\Application Data\{76960496-3CE2-4F6B-B419-CFFEF12E7BDA}\chrome\content\_cfg.js
c:\documents and settings\Guest\Local Settings\Application Data\{76960496-3CE2-4F6B-B419-CFFEF12E7BDA}\chrome\content\c.js
c:\documents and settings\Guest\Local Settings\Application Data\{76960496-3CE2-4F6B-B419-CFFEF12E7BDA}\chrome\content\overlay.xul
c:\documents and settings\Guest\Local Settings\Application Data\{76960496-3CE2-4F6B-B419-CFFEF12E7BDA}\install.rdf
c:\documents and settings\Twice Bitten\Local Settings\Application Data\{3AD65D72-F7CC-437B-B9CB-4A0A73D8A1FA}
c:\documents and settings\Twice Bitten\Local Settings\Application Data\{3AD65D72-F7CC-437B-B9CB-4A0A73D8A1FA}\chrome.manifest
c:\documents and settings\Twice Bitten\Local Settings\Application Data\{3AD65D72-F7CC-437B-B9CB-4A0A73D8A1FA}\chrome\content\_cfg.js
c:\documents and settings\Twice Bitten\Local Settings\Application Data\{3AD65D72-F7CC-437B-B9CB-4A0A73D8A1FA}\chrome\content\c.js
c:\documents and settings\Twice Bitten\Local Settings\Application Data\{3AD65D72-F7CC-437B-B9CB-4A0A73D8A1FA}\chrome\content\overlay.xul
c:\documents and settings\Twice Bitten\Local Settings\Application Data\{3AD65D72-F7CC-437B-B9CB-4A0A73D8A1FA}\install.rdf
c:\windows\axarewerilupavid.dll
c:\windows\ikibuworu.dll
c:\windows\ukiteroy.dll

.
((((((((((((((((((((((((( Files Created from 2009-11-12 to 2009-12-12 )))))))))))))))))))))))))))))))
.

2009-12-09 00:54 . 2009-12-09 04:07 ——– d—–w- c:\documents and settings\Administrator.WORK\Local Settings\Application Data\Adobe
2009-12-09 00:53 . 2009-12-09 00:53 155928 —-a-w- c:\documents and settings\Administrator.WORK\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-03 05:23 . 2009-12-03 05:23 ——– d—–w- c:\documents and settings\Guest\Local Settings\Application Data\S2PC
2009-12-02 08:40 . 2009-12-02 08:40 ——– d—–w- c:\documents and settings\Administrator.WORK\Application Data\Malwarebytes
2009-12-02 06:36 . 2009-12-02 06:36 117760 —-a-w- c:\documents and settings\Administrator.WORK\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-12-02 06:36 . 2009-12-02 06:36 ——– d—–w- c:\documents and settings\Administrator.WORK\Application Data\SUPERAntiSpyware.com
2009-12-02 06:25 . 2009-09-10 19:54 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-02 06:25 . 2009-09-10 19:53 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-12-02 06:04 . 2009-12-02 06:29 117760 —-a-w- c:\documents and settings\Twice Bitten\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-12-02 06:01 . 2009-12-02 06:01 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2009-12-01 18:40 . 2009-12-01 18:40 ——– d—–w- c:\documents and settings\Your Name\Application Data\Malwarebytes
2009-12-01 10:14 . 2009-12-01 10:14 ——– d—–w- c:\documents and settings\Twice Bitten\Application Data\Registry Mechanic
2009-12-01 03:49 . 2009-11-19 16:48 43008 —-a-w- c:\documents and settings\Twice Bitten\Application Data\Mozilla\Firefox\Profiles\3d2gasfs.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
2009-12-01 03:49 . 2009-11-19 16:48 340480 —-a-w- c:\documents and settings\Twice Bitten\Application Data\Mozilla\Firefox\Profiles\3d2gasfs.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll
2009-12-01 03:49 . 2009-11-19 16:48 346624 —-a-w- c:\documents and settings\Twice Bitten\Application Data\Mozilla\Firefox\Profiles\3d2gasfs.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll
2009-12-01 03:49 . 2009-11-19 16:48 872960 —-a-w- c:\documents and settings\Twice Bitten\Application Data\Mozilla\Firefox\Profiles\3d2gasfs.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
2009-11-30 20:39 . 2009-09-24 13:55 229304 —-a-w- c:\windows\system32\drivers\pctgntdi.sys
2009-11-30 20:39 . 2009-10-06 21:31 87784 —-a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2009-11-30 20:39 . 2009-09-23 21:10 207280 —-a-w- c:\windows\system32\drivers\PCTCore.sys
2009-11-30 20:38 . 2009-09-03 14:45 70408 —-a-w- c:\windows\system32\drivers\pctplsg.sys
2009-11-30 20:37 . 2009-12-02 06:14 ——– d—–w- c:\program files\Common Files\PC Tools
2009-11-30 20:37 . 2009-12-12 17:18 ——– d—–w- c:\program files\Spyware Doctor
2009-11-30 20:37 . 2009-11-30 20:37 ——– d—–w- c:\documents and settings\Twice Bitten\Application Data\PC Tools
2009-11-30 20:37 . 2009-11-30 20:37 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\PC Tools
2009-11-30 20:37 . 2009-12-12 17:18 ——– d—a-w- c:\documents and settings\All Users.WINDOWS\Application Data\TEMP
2009-11-30 20:35 . 2009-11-30 20:35 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Google Updater
2009-11-30 19:51 . 2009-11-30 19:51 ——– d—–w- c:\documents and settings\Twice Bitten\Application Data\Malwarebytes
2009-11-30 19:51 . 2009-11-30 19:51 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes
2009-11-30 19:09 . 2009-11-30 19:09 ——– d—–w- c:\windows\system32\wbem\Repository
2009-11-30 19:01 . 2009-11-30 19:01 ——– d–h–w- c:\windows\system32\CanonIJ Uninstaller Information
2009-11-19 01:52 . 2007-04-02 10:00 69632 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\CNMPP8U.DLL
2009-11-19 01:52 . 2007-04-02 10:00 27136 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\CNMPD8U.DLL
2009-11-19 01:52 . 2008-02-06 10:00 216064 —-a-w- c:\windows\system32\CNMLM8U.DLL
2009-11-19 01:51 . 2007-03-15 19:12 188416 —-a-w- c:\windows\system32\CNC470O.DLL
2009-11-19 01:51 . 2007-03-23 21:30 1400832 —-a-w- c:\windows\system32\CNC470C.DLL
2009-11-19 01:51 . 2007-03-23 21:29 98304 —-a-w- c:\windows\system32\CNC470I.DLL
2009-11-19 01:51 . 2007-03-19 15:21 200704 —-a-w- c:\windows\system32\CNC470L.DLL
2009-11-19 01:50 . 2009-11-19 01:50 ——– d–h–w- c:\program files\CanonBJ
2009-11-18 08:01 . 2009-11-18 08:01 ——– d—–w- c:\documents and settings\Your Name\Local Settings\Application Data\S2PC
2009-11-17 20:18 . 2001-08-18 03:36 13312 —-a-w- c:\windows\system32\BRMFPMON.DLL
2009-11-15 17:44 . 2009-11-15 17:44 ——– d—–w- c:\documents and settings\Twice Bitten\Local Settings\Application Data\S2PC
2009-11-15 17:44 . 2009-09-22 07:30 482408 —-a-w- c:\windows\ssndii.exe
2009-11-15 17:43 . 2009-09-22 07:30 113768 —-a-w- c:\windows\Wiainst.exe
2009-11-15 17:43 . 2009-05-12 00:00 143872 —-a-w- c:\windows\system32\SaXPWIA.dll
2009-11-15 17:43 . 2009-05-12 00:00 138240 —-a-w- c:\windows\system32\SaXPUIEx.dll
2009-11-15 17:43 . 2009-05-12 00:00 87552 —-a-w- c:\windows\system32\SaXPSTI.dll
2009-11-15 17:43 . 2009-05-12 00:00 116736 —-a-w- c:\windows\system32\SaXPIPH.dll
2009-11-15 17:43 . 2009-05-12 00:00 139776 —-a-w- c:\windows\system32\SaXPEH.dll
2009-11-15 17:43 . 2007-08-14 07:22 49152 —-a-w- c:\windows\system32\Ssusbpn.dll
2009-11-15 17:43 . 2007-08-14 07:22 57344 —-a-w- c:\windows\system32\Ssdevm.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-02 06:25 . 2007-03-22 13:48 ——– d—–w- c:\program files\Virus Software
2009-12-02 06:14 . 2006-04-24 22:18 ——– d—–w- c:\program files\Utilities
2009-12-02 06:04 . 2009-03-04 05:34 ——– d—–w- c:\documents and settings\Twice Bitten\Application Data\SUPERAntiSpyware.com
2009-12-02 05:09 . 2006-08-03 21:46 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2009-12-01 04:41 . 2006-05-02 16:22 155928 —-a-w- c:\documents and settings\Twice Bitten\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-30 20:35 . 2009-04-07 23:05 ——– d—–w- c:\program files\Google
2009-11-30 20:18 . 2005-10-21 03:32 ——– d—–w- c:\program files\LimeWire
2009-11-30 19:21 . 2006-04-17 14:19 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Autodesk
2009-11-30 19:21 . 2007-07-13 22:15 ——– d—–w- c:\program files\AutoCAD 2007
2009-11-30 19:21 . 2006-04-17 14:19 ——– d—–w- c:\program files\Common Files\Autodesk Shared
2009-11-30 19:05 . 2009-11-08 08:09 ——– d—–w- c:\program files\Windows Live Safety Center
2009-11-27 20:32 . 2006-04-17 14:19 ——– d—–w- c:\program files\AutoCAD 2004
2009-11-18 08:02 . 2005-11-05 23:50 157504 —-a-w- c:\documents and settings\Your Name\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-17 20:11 . 2006-11-26 22:20 ——– d—–w- c:\program files\Printers
2009-11-17 06:20 . 2009-03-09 20:24 ——– d—–w- c:\documents and settings\Twice Bitten\Application Data\SiteClasses
2009-11-05 01:37 . 2008-02-29 23:45 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft Help
2009-11-02 06:16 . 2006-12-10 17:22 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Yahoo!
2009-10-30 15:34 . 2005-08-18 18:52 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-10-30 15:27 . 2009-10-30 15:27 ——– d—–w- c:\program files\Seagate
2009-10-30 15:27 . 2009-10-30 15:27 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Seagate
2009-10-30 15:25 . 2009-10-30 15:25 ——– d—–w- c:\program files\MSXML 6.0
2009-10-28 19:37 . 2009-04-08 16:35 1735 —-a-w- c:\windows\Chexogijanileri.dat
2009-10-28 19:29 . 2009-10-28 19:29 1719 —-a-w- c:\windows\oyunehoh.dll
2009-10-28 18:23 . 2009-10-28 18:23 1719 —-a-w- c:\windows\usazaboc.dll
2009-10-28 17:17 . 2009-10-28 17:17 1719 —-a-w- c:\windows\ecatexete.dll
2009-10-28 16:11 . 2009-10-28 16:11 1719 —-a-w- c:\windows\apudoyat.dll
2009-10-28 07:42 . 2009-10-28 07:42 1719 —-a-w- c:\windows\okexepod.dll
2009-10-28 07:17 . 2008-03-11 20:47 ——– d—–w- c:\documents and settings\Twice Bitten\Application Data\Skype
2009-10-28 06:36 . 2009-10-28 06:36 1719 —-a-w- c:\windows\ulunovek.dll
2009-10-28 06:29 . 2008-03-11 20:59 ——– d—–w- c:\documents and settings\Twice Bitten\Application Data\skypePM
2009-10-28 05:30 . 2009-10-28 05:30 1719 —-a-w- c:\windows\ojaqogunew.dll
2009-10-28 04:24 . 2009-10-28 04:24 1719 —-a-w- c:\windows\ojiqesac.dll
2009-10-28 03:18 . 2009-10-28 03:18 1719 —-a-w- c:\windows\azuzucocalir.dll
2009-10-28 02:12 . 2009-10-28 02:12 1719 —-a-w- c:\windows\opeyeyog.dll
2009-10-28 01:06 . 2009-10-28 01:06 1719 —-a-w- c:\windows\irohawag.dll
2009-10-28 00:00 . 2009-10-28 00:00 1719 —-a-w- c:\windows\ifiqofol.dll
2009-10-27 22:54 . 2009-10-27 22:54 1719 —-a-w- c:\windows\avivolov.dll
2009-10-27 21:48 . 2009-10-27 21:48 1719 —-a-w- c:\windows\imuxufapif.dll
2009-10-27 20:42 . 2009-10-27 20:42 1719 —-a-w- c:\windows\uzuwulaqocubale.dll
2009-10-27 19:36 . 2009-10-27 19:36 1719 —-a-w- c:\windows\ejeguluk.dll
2009-10-27 18:30 . 2009-10-27 18:30 1719 —-a-w- c:\windows\ebarohije.dll
2009-10-27 17:24 . 2009-10-27 17:24 1719 —-a-w- c:\windows\urijeleh.dll
2009-10-27 16:18 . 2009-10-27 16:18 1719 —-a-w- c:\windows\usuyuvas.dll
2009-10-27 09:19 . 2009-10-27 09:19 1719 —-a-w- c:\windows\omunizokizi.dll
2009-10-27 08:13 . 2009-10-27 08:13 1719 —-a-w- c:\windows\uyofifinohaz.dll
2009-10-27 07:07 . 2009-10-27 07:07 1719 —-a-w- c:\windows\olodazayujupi.dll
2009-10-27 06:01 . 2009-10-27 06:01 1719 —-a-w- c:\windows\epuyumogavimov.dll
2009-10-27 04:55 . 2009-10-27 04:55 1719 —-a-w- c:\windows\ijunuresiqaquz.dll
2009-10-27 03:49 . 2009-10-27 03:49 1719 —-a-w- c:\windows\ahorizazowe.dll
2009-10-27 02:43 . 2009-10-27 02:43 1719 —-a-w- c:\windows\oqihofus.dll
2009-10-27 01:37 . 2009-10-27 01:37 1719 —-a-w- c:\windows\ufosozid.dll
2009-10-27 00:31 . 2009-10-27 00:31 1719 —-a-w- c:\windows\egibozerahemi.dll
2009-10-26 23:25 . 2009-10-26 23:25 1719 —-a-w- c:\windows\ipufewoqanedev.dll
2009-10-26 22:19 . 2009-10-26 22:19 1719 —-a-w- c:\windows\arepazopesiqaso.dll
2009-10-26 21:13 . 2009-10-26 21:13 1719 —-a-w- c:\windows\ogoyuwam.dll
2009-10-26 20:07 . 2009-10-26 20:07 1719 —-a-w- c:\windows\ajiwaruy.dll
2009-10-26 19:01 . 2009-10-26 19:01 1719 —-a-w- c:\windows\uhelozug.dll
2009-10-26 17:55 . 2009-10-26 17:55 1719 —-a-w- c:\windows\erohirewap.dll
2009-10-26 16:49 . 2009-10-26 16:49 1719 —-a-w- c:\windows\olelevef.dll
2009-10-26 15:43 . 2009-10-26 15:43 1719 —-a-w- c:\windows\efogugek.dll
2009-10-26 14:37 . 2009-10-26 14:37 1719 —-a-w- c:\windows\unokodur.dll
2009-10-26 13:31 . 2009-10-26 13:31 1719 —-a-w- c:\windows\ozugapuqaz.dll
2009-10-26 02:03 . 2009-10-26 02:03 1719 —-a-w- c:\windows\uqizuxawodafuv.dll
2009-10-26 00:57 . 2009-10-26 00:57 1719 —-a-w- c:\windows\agitekud.dll
2009-10-25 23:51 . 2009-10-25 23:51 1719 —-a-w- c:\windows\emodevipejidedu.dll
2009-10-25 22:45 . 2009-10-25 22:45 1719 —-a-w- c:\windows\amegaxel.dll
2009-10-25 21:39 . 2009-10-25 21:39 1719 —-a-w- c:\windows\exisovuni.dll
2009-10-25 20:33 . 2009-10-25 20:33 1719 —-a-w- c:\windows\uviroviqo.dll
2009-10-25 19:27 . 2009-10-25 19:27 1719 —-a-w- c:\windows\obipikebeg.dll
2009-10-25 18:21 . 2009-10-25 18:21 1719 —-a-w- c:\windows\anigipamepo.dll
2009-10-25 17:15 . 2009-10-25 17:15 1719 —-a-w- c:\windows\ilivukoviker.dll
2009-10-25 16:09 . 2009-10-25 16:09 1719 —-a-w- c:\windows\ocafukif.dll
2009-10-25 07:18 . 2009-10-25 07:18 1719 —-a-w- c:\windows\onayahejozugi.dll
2009-10-25 06:12 . 2009-10-25 06:12 1719 —-a-w- c:\windows\evizocohof.dll
2009-10-25 05:06 . 2009-10-25 05:06 1719 —-a-w- c:\windows\ukicohotucejaqa.dll
2009-10-25 04:00 . 2009-10-25 04:00 1719 —-a-w- c:\windows\adaleqayisadoqe.dll
2009-10-25 02:54 . 2009-10-25 02:54 1719 —-a-w- c:\windows\ohesicog.dll
2009-10-25 01:48 . 2009-10-25 01:48 1719 —-a-w- c:\windows\ipufapoyo.dll
2009-10-25 00:42 . 2009-10-25 00:42 1719 —-a-w- c:\windows\owecucafuv.dll
2009-10-24 23:36 . 2009-10-24 23:36 1719 —-a-w- c:\windows\atupucusez.dll
2009-10-24 22:30 . 2009-10-24 22:30 1719 —-a-w- c:\windows\ecemazekudegem.dll
2009-10-24 21:25 . 2009-10-24 21:25 1719 —-a-w- c:\windows\atuxowal.dll
2009-10-24 20:19 . 2009-10-24 20:19 1719 —-a-w- c:\windows\okanelan.dll
2009-10-24 19:12 . 2009-10-24 19:12 1719 —-a-w- c:\windows\ejeferoc.dll
2009-10-24 18:06 . 2009-10-24 18:06 1719 —-a-w- c:\windows\omecuraq.dll
2009-10-24 17:00 . 2009-10-24 17:00 1719 —-a-w- c:\windows\amiyuyebi.dll
2009-10-24 15:54 . 2009-10-24 15:54 1719 —-a-w- c:\windows\eyuyodege.dll
2009-10-24 14:48 . 2009-10-24 14:48 1719 —-a-w- c:\windows\eluwasilare.dll
2009-10-24 06:59 . 2009-10-24 06:59 1719 —-a-w- c:\windows\ixamuked.dll
2009-10-24 05:28 . 2009-10-24 05:28 1719 —-a-w- c:\windows\eximuvaponameve.dll
2009-10-24 04:22 . 2009-10-24 04:22 1719 —-a-w- c:\windows\ezuweweciqus.dll
2009-10-24 03:16 . 2009-10-24 03:16 1719 —-a-w- c:\windows\ozuqazej.dll
2009-10-24 02:10 . 2009-10-24 02:10 1719 —-a-w- c:\windows\ovufepohe.dll
2009-10-24 01:04 . 2009-10-24 01:04 1719 —-a-w- c:\windows\ebudukem.dll
2009-10-23 22:49 . 2009-10-23 22:49 1719 —-a-w- c:\windows\ewevopebasu.dll
2009-10-23 21:43 . 2009-10-23 21:43 1719 —-a-w- c:\windows\ehijekumibol.dll
2009-10-23 20:37 . 2009-10-23 20:37 1719 —-a-w- c:\windows\esudekos.dll
2009-10-23 17:24 . 2009-10-23 17:24 1719 —-a-w- c:\windows\ikazaxifiv.dll
2009-10-23 16:18 . 2009-10-23 16:18 1719 —-a-w- c:\windows\osiziqowu.dll
2009-10-23 08:49 . 2009-10-23 08:49 1719 —-a-w- c:\windows\ahukopositadux.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-11-30 39408]
"SUPERAntiSpyware"="c:\program files\Virus Software\SUPERAntiSpyware.exe" [2009-11-23 2001648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-10-14 114688]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2005-10-07 176128]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]
"MaxMenuMgr"="c:\program files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe" [2009-09-26 185640]
"3170 Scan2PC"="c:\windows\Twain_32\Samsung\CLX3170\Scan2pc.exe" [2009-06-12 503808]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-12 44544]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\Virus Software\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 19:21 548352 —-a-w- c:\program files\Virus Software\SASWINLO.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Acrobat Assistant.lnk]
backup=c:\windows\pss\Acrobat Assistant.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^AutoCAD Startup Accelerator.lnk]
path=c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\AutoCAD Startup Accelerator.lnk
backup=c:\windows\pss\AutoCAD Startup Accelerator.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^nqpbf.exe]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Ringo Launcher.lnk]
backup=c:\windows\pss\Ringo Launcher.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Twice Bitten^Start Menu^Programs^Startup^United Airlines Timetable Update Application.lnk]
path=c:\documents and settings\Twice Bitten\Start Menu\Programs\Startup\United Airlines Timetable Update Application.lnk
backup=c:\windows\pss\United Airlines Timetable Update Application.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Twice Bitten^Start Menu^Programs^Startup^Z_Start.lnk]
backup=c:\windows\pss\Z_Start.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Your Name^Start Menu^Programs^Startup^Internet Explorer.lnk]
path=c:\documents and settings\Your Name\Start Menu\Programs\Startup\Internet Explorer.lnk
backup=c:\windows\pss\Internet Explorer.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ShowLOMControl]
[X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
2007-05-11 02:46 624248 —-a-w- c:\program files\Adobe\Acrobat 8.0\Acrobat\acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
2006-05-10 00:24 50760 —-a-w- c:\program files\Common Files\AOL\1145568053\ee\aolsoftware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IPHSend]
2006-02-17 16:59 124520 —-a-w- c:\program files\Common Files\AOL\IPHSend\IPHSend.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2008-10-01 23:57 289576 —-a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2008-09-06 20:09 413696 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2005-11-10 19:03 36975 —-a-w- c:\program files\Java\jre1.5.0_06\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPodService"=3 (0x3)
"Dpsixrnt"=3 (0x3)
"iPod Service"=3 (0x3)
"ewido anti-spyware 4.0 guard"=2 (0x2)
"LexBceS"=3 (0x3)
"AVG Anti-Spyware Guard"=2 (0x2)
"RegSrvc"=2 (0x2)
"IDriverT"=3 (0x3)
"Autodesk Licensing Service"=3 (0x3)
"Apple Mobile Device"=2 (0x2)
"Lavasoft Ad-Aware Service"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\1145568053\\ee\\aolsoftware.exe"=
"c:\\Program Files\\Common Files\\AOL\\1145568053\\ee\\aim6.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Motorola\\RSD Lite\\SDL.exe"=
"c:\\Program Files\\IMTools\\Trillian\\trillian.exe"=
"c:\\Program Files\\IMTools\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Adobe\\Adobe Dreamweaver CS4\\Dreamweaver.exe"=
"c:\\Program Files\\Adobe\\Adobe Photoshop Lightroom 2\\lightroom.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\WINDOWS\\twain_32\\Samsung\\ScanMgr.exe"=
"c:\\WINDOWS\\twain_32\\Samsung\\CLX3170\\Scan2Pc.exe"=
"c:\\WINDOWS\\twain_32\\Samsung\\CLX3170\\Sscan2io.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2/17/2009 2:06 AM 64160]
R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [11/30/2009 3:39 PM 207280]
R1 SASDIFSV;SASDIFSV;c:\program files\Virus Software\sasdifsv.sys [11/23/2009 8:43 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\Virus Software\SASKUTIL.SYS [11/23/2009 8:43 AM 74480]
R2 FreeAgentGoNext Service;Seagate Service;c:\program files\Seagate\SeagateManager\Sync\FreeAgentService.exe [9/25/2009 11:32 PM 189736]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [1/11/2008 3:05 PM 24652]
R3 SASENUM;SASENUM;c:\program files\Virus Software\SASENUM.SYS [11/23/2009 8:43 AM 7408]
S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys –> c:\windows\system32\Drivers\SSPORT.sys [?]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [11/30/2009 3:37 PM 358600]
S3 XIRLINK;Veo PC Camera;c:\windows\system32\drivers\ucdnt.sys [3/17/2008 12:01 PM 899884]
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Connection Wizard,ShellNext = https://login.live.com/ppsecure/md5auth.srf?lc=1033
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: - Download &this page with WebCloner - c:\program files\WebTools\ProductsFoundry\WebCloner Standard 2.4\addthis.htm
IE: - Download all &images with WebCloner - c:\program files\WebTools\ProductsFoundry\WebCloner Standard 2.4\addimg.htm
IE: - Download all &links with WebCloner - c:\program files\WebTools\ProductsFoundry\WebCloner Standard 2.4\addurl.htm
IE: - Download selected links with WebCloner - c:\program files\WebTools\ProductsFoundry\WebCloner Standard 2.4\addsellinks.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Download selected images with WebCloner - c:\program files\WebTools\ProductsFoundry\WebCloner Standard 2.4\addselimgs.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
IE: {{ADFCCE65-DF10-46fd-B04A-53CCBE2A0795} - c:\program files\WebTools\ProductsFoundry\WebCloner Standard 2.4\WebCloner.exe
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\Twice Bitten\Start Menu\Programs\IM\IMVU\Run IMVU.lnk
FF - ProfilePath - c:\documents and settings\Twice Bitten\Application Data\Mozilla\Firefox\Profiles\3d2gasfs.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - GOOGLE.COM
FF - component: c:\documents and settings\Twice Bitten\Application Data\Mozilla\Firefox\Profiles\3d2gasfs.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\platform\WINNT_x86-msvc\components\SSSLauncher.dll
FF - component: c:\documents and settings\Twice Bitten\Application Data\Mozilla\Firefox\Profiles\3d2gasfs.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - plugin: c:\documents and settings\Twice Bitten\Application Data\Mozilla\Firefox\Profiles\3d2gasfs.default\extensions\[removed]\platform\WINNT_x86-msvc\plugins\npmnqmp07061050.dll
FF - plugin: c:\progra~1\IMTools\Yahoo!\Common\npyaxmpb.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1739.5352\npCIDetect13.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJPI150_06.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPOJI610.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmnqmp07010901.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
FF - HiddenExtension: XUL Cache: {3308312C-CD57-4D81-94B3-239D698519C2} - c:\documents and settings\Your Name\Local Settings\Application Data\{3308312C-CD57-4D81-94B3-239D698519C2}

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Startup Manager - startUp manager.exe
SafeBoot-AVG Anti-Spyware Driver
SafeBoot-AVG Anti-Spyware Guard

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-12 12:39
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(980)
c:\program files\Virus Software\SASWINLO.dll
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
c:\windows\system32\igfxdev.dll
.
Completion time: 2009-12-12 12:46:07
ComboFix-quarantined-files.txt 2009-12-12 17:45
ComboFix2.txt 2009-04-02 23:20

Pre-Run: 4,461,686,784 bytes free
Post-Run: 4,492,795,904 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4,5,6
- - End Of File - - EB151EB07499A93D98370405E3E95633

CatByte

Post #9December 12, 2009, 6:21 PM UTC

Hi,

Please do the following:

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

http://forums.whatthetech.com/Malwarebytes_Finds_2_hijack_windowsupdates_files_t108742.html&view=findpost&p=617159#entry617159

Collect::
c:\windows\Chexogijanileri.dat
c:\windows\oyunehoh.dll
c:\windows\usazaboc.dll
c:\windows\ecatexete.dll
c:\windows\apudoyat.dll
c:\windows\okexepod.dll
c:\windows\ulunovek.dll
c:\windows\ojaqogunew.dll
c:\windows\ojiqesac.dll
c:\windows\azuzucocalir.dll
c:\windows\opeyeyog.dll
c:\windows\irohawag.dll
c:\windows\ifiqofol.dll
c:\windows\avivolov.dll
c:\windows\imuxufapif.dll
c:\windows\uzuwulaqocubale.dll
c:\windows\ejeguluk.dll
c:\windows\ebarohije.dll
c:\windows\urijeleh.dll
c:\windows\usuyuvas.dll
c:\windows\omunizokizi.dll
c:\windows\uyofifinohaz.dll
c:\windows\olodazayujupi.dll
c:\windows\epuyumogavimov.dll
c:\windows\ijunuresiqaquz.dll
c:\windows\ahorizazowe.dll
c:\windows\oqihofus.dll
c:\windows\ufosozid.dll
c:\windows\egibozerahemi.dll
c:\windows\ipufewoqanedev.dll
c:\windows\arepazopesiqaso.dll
c:\windows\ogoyuwam.dll
c:\windows\ajiwaruy.dll
c:\windows\uhelozug.dll
c:\windows\erohirewap.dll
c:\windows\olelevef.dll
c:\windows\efogugek.dll
c:\windows\unokodur.dll
c:\windows\ozugapuqaz.dll
c:\windows\uqizuxawodafuv.dll
c:\windows\agitekud.dll
c:\windows\emodevipejidedu.dll
c:\windows\amegaxel.dll
c:\windows\exisovuni.dll
c:\windows\uviroviqo.dll
c:\windows\obipikebeg.dll
c:\windows\anigipamepo.dll
c:\windows\ilivukoviker.dll
c:\windows\ocafukif.dll
c:\windows\onayahejozugi.dll
c:\windows\evizocohof.dll
c:\windows\ukicohotucejaqa.dll
c:\windows\adaleqayisadoqe.dll
c:\windows\ohesicog.dll
c:\windows\ipufapoyo.dll
c:\windows\owecucafuv.dll
c:\windows\atupucusez.dll
c:\windows\ecemazekudegem.dll
c:\windows\atuxowal.dll
c:\windows\okanelan.dll
c:\windows\ejeferoc.dll
c:\windows\omecuraq.dll
c:\windows\amiyuyebi.dll
c:\windows\eyuyodege.dll
c:\windows\eluwasilare.dll
c:\windows\ixamuked.dll
c:\windows\eximuvaponameve.dll
c:\windows\ezuweweciqus.dll
c:\windows\ozuqazej.dll
c:\windows\ovufepohe.dll
c:\windows\ebudukem.dll
c:\windows\ewevopebasu.dll
c:\windows\ehijekumibol.dll
c:\windows\esudekos.dll
c:\windows\ikazaxifiv.dll
c:\windows\osiziqowu.dll
c:\windows\ahukopositadux.dll

FireFox::
FF - ProfilePath - c:\documents and settings\Twice Bitten\Application Data\Mozilla\Firefox\Profiles\3d2gasfs.default\
FF - HiddenExtension: XUL Cache: {3308312C-CD57-4D81-94B3-239D698519C2} - c:\documents and settings\Your Name\Local Settings\Application Data\{3308312C-CD57-4D81-94B3-239D698519C2}

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you.
Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

**Note**
When CF finishes running, the ComboFix log will open along with a message box–do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.

Ensure you are connected to the internet and click OK on the message box.

jacory

Post #10December 12, 2009, 8:13 PM UTC

2ndary ComboFix.txt (with script instructions)

ComboFix 09-12-11.05 - Twice Bitten 12/12/2009 14:44:41.4.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.503.157 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Twice Bitten\Desktop\CFScript.txt
AV: Spyware Doctor with AntiVirus *On-access scanning disabled* (Updated) {D3C23B96-C9DC-477F-8EF1-69AF17A6EFF6}

file zipped: c:\windows\adaleqayisadoqe.dll
file zipped: c:\windows\agitekud.dll
file zipped: c:\windows\ahorizazowe.dll
file zipped: c:\windows\ahukopositadux.dll
file zipped: c:\windows\ajiwaruy.dll
file zipped: c:\windows\amegaxel.dll
file zipped: c:\windows\amiyuyebi.dll
file zipped: c:\windows\anigipamepo.dll
file zipped: c:\windows\apudoyat.dll
file zipped: c:\windows\arepazopesiqaso.dll
file zipped: c:\windows\atupucusez.dll
file zipped: c:\windows\atuxowal.dll
file zipped: c:\windows\avivolov.dll
file zipped: c:\windows\azuzucocalir.dll
file zipped: c:\windows\Chexogijanileri.dat
file zipped: c:\windows\ebarohije.dll
file zipped: c:\windows\ebudukem.dll
file zipped: c:\windows\ecatexete.dll
file zipped: c:\windows\ecemazekudegem.dll
file zipped: c:\windows\efogugek.dll
file zipped: c:\windows\egibozerahemi.dll
file zipped: c:\windows\ehijekumibol.dll
file zipped: c:\windows\ejeferoc.dll
file zipped: c:\windows\ejeguluk.dll
file zipped: c:\windows\eluwasilare.dll
file zipped: c:\windows\emodevipejidedu.dll
file zipped: c:\windows\epuyumogavimov.dll
file zipped: c:\windows\erohirewap.dll
file zipped: c:\windows\esudekos.dll
file zipped: c:\windows\evizocohof.dll
file zipped: c:\windows\ewevopebasu.dll
file zipped: c:\windows\eximuvaponameve.dll
file zipped: c:\windows\exisovuni.dll
file zipped: c:\windows\eyuyodege.dll
file zipped: c:\windows\ezuweweciqus.dll
file zipped: c:\windows\ifiqofol.dll
file zipped: c:\windows\ijunuresiqaquz.dll
file zipped: c:\windows\ikazaxifiv.dll
file zipped: c:\windows\ilivukoviker.dll
file zipped: c:\windows\imuxufapif.dll
file zipped: c:\windows\ipufapoyo.dll
file zipped: c:\windows\ipufewoqanedev.dll
file zipped: c:\windows\irohawag.dll
file zipped: c:\windows\ixamuked.dll
file zipped: c:\windows\obipikebeg.dll
file zipped: c:\windows\ocafukif.dll
file zipped: c:\windows\ogoyuwam.dll
file zipped: c:\windows\ohesicog.dll
file zipped: c:\windows\ojaqogunew.dll
file zipped: c:\windows\ojiqesac.dll
file zipped: c:\windows\okanelan.dll
file zipped: c:\windows\okexepod.dll
file zipped: c:\windows\olelevef.dll
file zipped: c:\windows\olodazayujupi.dll
file zipped: c:\windows\omecuraq.dll
file zipped: c:\windows\omunizokizi.dll
file zipped: c:\windows\onayahejozugi.dll
file zipped: c:\windows\opeyeyog.dll
file zipped: c:\windows\oqihofus.dll
file zipped: c:\windows\osiziqowu.dll
file zipped: c:\windows\ovufepohe.dll
file zipped: c:\windows\owecucafuv.dll
file zipped: c:\windows\oyunehoh.dll
file zipped: c:\windows\ozugapuqaz.dll
file zipped: c:\windows\ozuqazej.dll
file zipped: c:\windows\ufosozid.dll
file zipped: c:\windows\uhelozug.dll
file zipped: c:\windows\ukicohotucejaqa.dll
file zipped: c:\windows\ulunovek.dll
file zipped: c:\windows\unokodur.dll
file zipped: c:\windows\uqizuxawodafuv.dll
file zipped: c:\windows\urijeleh.dll
file zipped: c:\windows\usazaboc.dll
file zipped: c:\windows\usuyuvas.dll
file zipped: c:\windows\uviroviqo.dll
file zipped: c:\windows\uyofifinohaz.dll
file zipped: c:\windows\uzuwulaqocubale.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Your Name\Local Settings\Application Data\{3308312C-CD57-4D81-94B3-239D698519C2}
c:\documents and settings\Your Name\Local Settings\Application Data\{3308312C-CD57-4D81-94B3-239D698519C2}\chrome.manifest
c:\documents and settings\Your Name\Local Settings\Application Data\{3308312C-CD57-4D81-94B3-239D698519C2}\chrome\content\_cfg.js
c:\documents and settings\Your Name\Local Settings\Application Data\{3308312C-CD57-4D81-94B3-239D698519C2}\chrome\content\c.js
c:\documents and settings\Your Name\Local Settings\Application Data\{3308312C-CD57-4D81-94B3-239D698519C2}\chrome\content\overlay.xul
c:\documents and settings\Your Name\Local Settings\Application Data\{3308312C-CD57-4D81-94B3-239D698519C2}\install.rdf
c:\windows\adaleqayisadoqe.dll
c:\windows\agitekud.dll
c:\windows\ahorizazowe.dll
c:\windows\ahukopositadux.dll
c:\windows\ajiwaruy.dll
c:\windows\amegaxel.dll
c:\windows\amiyuyebi.dll
c:\windows\anigipamepo.dll
c:\windows\apudoyat.dll
c:\windows\arepazopesiqaso.dll
c:\windows\atupucusez.dll
c:\windows\atuxowal.dll
c:\windows\avivolov.dll
c:\windows\azuzucocalir.dll
c:\windows\Chexogijanileri.dat
c:\windows\ebarohije.dll
c:\windows\ebudukem.dll
c:\windows\ecatexete.dll
c:\windows\ecemazekudegem.dll
c:\windows\efogugek.dll
c:\windows\egibozerahemi.dll
c:\windows\ehijekumibol.dll
c:\windows\ejeferoc.dll
c:\windows\ejeguluk.dll
c:\windows\eluwasilare.dll
c:\windows\emodevipejidedu.dll
c:\windows\epuyumogavimov.dll
c:\windows\erohirewap.dll
c:\windows\esudekos.dll
c:\windows\evizocohof.dll
c:\windows\ewevopebasu.dll
c:\windows\eximuvaponameve.dll
c:\windows\exisovuni.dll
c:\windows\eyuyodege.dll
c:\windows\ezuweweciqus.dll
c:\windows\ifiqofol.dll
c:\windows\ijunuresiqaquz.dll
c:\windows\ikazaxifiv.dll
c:\windows\ilivukoviker.dll
c:\windows\imuxufapif.dll
c:\windows\ipufapoyo.dll
c:\windows\ipufewoqanedev.dll
c:\windows\irohawag.dll
c:\windows\ixamuked.dll
c:\windows\obipikebeg.dll
c:\windows\ocafukif.dll
c:\windows\ogoyuwam.dll
c:\windows\ohesicog.dll
c:\windows\ojaqogunew.dll
c:\windows\ojiqesac.dll
c:\windows\okanelan.dll
c:\windows\okexepod.dll
c:\windows\olelevef.dll
c:\windows\olodazayujupi.dll
c:\windows\omecuraq.dll
c:\windows\omunizokizi.dll
c:\windows\onayahejozugi.dll
c:\windows\opeyeyog.dll
c:\windows\oqihofus.dll
c:\windows\osiziqowu.dll
c:\windows\ovufepohe.dll
c:\windows\owecucafuv.dll
c:\windows\oyunehoh.dll
c:\windows\ozugapuqaz.dll
c:\windows\ozuqazej.dll
c:\windows\ufosozid.dll
c:\windows\uhelozug.dll
c:\windows\ukicohotucejaqa.dll
c:\windows\ulunovek.dll
c:\windows\unokodur.dll
c:\windows\uqizuxawodafuv.dll
c:\windows\urijeleh.dll
c:\windows\usazaboc.dll
c:\windows\usuyuvas.dll
c:\windows\uviroviqo.dll
c:\windows\uyofifinohaz.dll
c:\windows\uzuwulaqocubale.dll

.
((((((((((((((((((((((((( Files Created from 2009-11-12 to 2009-12-12 )))))))))))))))))))))))))))))))
.

2009-12-09 00:54 . 2009-12-09 04:07 ——– d—–w- c:\documents and settings\Administrator.WORK\Local Settings\Application Data\Adobe
2009-12-09 00:53 . 2009-12-09 00:53 155928 —-a-w- c:\documents and settings\Administrator.WORK\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-03 05:23 . 2009-12-03 05:23 ——– d—–w- c:\documents and settings\Guest\Local Settings\Application Data\S2PC
2009-12-02 08:40 . 2009-12-02 08:40 ——– d—–w- c:\documents and settings\Administrator.WORK\Application Data\Malwarebytes
2009-12-02 06:36 . 2009-12-02 06:36 117760 —-a-w- c:\documents and settings\Administrator.WORK\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-12-02 06:36 . 2009-12-02 06:36 ——– d—–w- c:\documents and settings\Administrator.WORK\Application Data\SUPERAntiSpyware.com
2009-12-02 06:25 . 2009-09-10 19:54 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-02 06:25 . 2009-09-10 19:53 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-12-02 06:04 . 2009-12-02 06:29 117760 —-a-w- c:\documents and settings\Twice Bitten\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-12-02 06:01 . 2009-12-02 06:01 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2009-12-01 18:40 . 2009-12-01 18:40 ——– d—–w- c:\documents and settings\Your Name\Application Data\Malwarebytes
2009-12-01 10:14 . 2009-12-01 10:14 ——– d—–w- c:\documents and settings\Twice Bitten\Application Data\Registry Mechanic
2009-12-01 03:49 . 2009-11-19 16:48 43008 —-a-w- c:\documents and settings\Twice Bitten\Application Data\Mozilla\Firefox\Profiles\3d2gasfs.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
2009-12-01 03:49 . 2009-11-19 16:48 340480 —-a-w- c:\documents and settings\Twice Bitten\Application Data\Mozilla\Firefox\Profiles\3d2gasfs.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll
2009-12-01 03:49 . 2009-11-19 16:48 346624 —-a-w- c:\documents and settings\Twice Bitten\Application Data\Mozilla\Firefox\Profiles\3d2gasfs.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll
2009-12-01 03:49 . 2009-11-19 16:48 872960 —-a-w- c:\documents and settings\Twice Bitten\Application Data\Mozilla\Firefox\Profiles\3d2gasfs.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
2009-11-30 20:39 . 2009-09-24 13:55 229304 —-a-w- c:\windows\system32\drivers\pctgntdi.sys
2009-11-30 20:39 . 2009-10-06 21:31 87784 —-a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2009-11-30 20:39 . 2009-09-23 21:10 207280 —-a-w- c:\windows\system32\drivers\PCTCore.sys
2009-11-30 20:38 . 2009-09-03 14:45 70408 —-a-w- c:\windows\system32\drivers\pctplsg.sys
2009-11-30 20:37 . 2009-12-02 06:14 ——– d—–w- c:\program files\Common Files\PC Tools
2009-11-30 20:37 . 2009-12-12 17:18 ——– d—–w- c:\program files\Spyware Doctor
2009-11-30 20:37 . 2009-11-30 20:37 ——– d—–w- c:\documents and settings\Twice Bitten\Application Data\PC Tools
2009-11-30 20:37 . 2009-11-30 20:37 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\PC Tools
2009-11-30 20:37 . 2009-12-12 17:18 ——– d—a-w- c:\documents and settings\All Users.WINDOWS\Application Data\TEMP
2009-11-30 20:35 . 2009-11-30 20:35 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Google Updater
2009-11-30 19:51 . 2009-11-30 19:51 ——– d—–w- c:\documents and settings\Twice Bitten\Application Data\Malwarebytes
2009-11-30 19:51 . 2009-11-30 19:51 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes
2009-11-30 19:09 . 2009-11-30 19:09 ——– d—–w- c:\windows\system32\wbem\Repository
2009-11-30 19:01 . 2009-11-30 19:01 ——– d–h–w- c:\windows\system32\CanonIJ Uninstaller Information
2009-11-19 01:52 . 2007-04-02 10:00 69632 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\CNMPP8U.DLL
2009-11-19 01:52 . 2007-04-02 10:00 27136 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\CNMPD8U.DLL
2009-11-19 01:52 . 2008-02-06 10:00 216064 —-a-w- c:\windows\system32\CNMLM8U.DLL
2009-11-19 01:51 . 2007-03-15 19:12 188416 —-a-w- c:\windows\system32\CNC470O.DLL
2009-11-19 01:51 . 2007-03-23 21:30 1400832 —-a-w- c:\windows\system32\CNC470C.DLL
2009-11-19 01:51 . 2007-03-23 21:29 98304 —-a-w- c:\windows\system32\CNC470I.DLL
2009-11-19 01:51 . 2007-03-19 15:21 200704 —-a-w- c:\windows\system32\CNC470L.DLL
2009-11-19 01:50 . 2009-11-19 01:50 ——– d–h–w- c:\program files\CanonBJ
2009-11-18 08:01 . 2009-11-18 08:01 ——– d—–w- c:\documents and settings\Your Name\Local Settings\Application Data\S2PC
2009-11-17 20:18 . 2001-08-18 03:36 13312 —-a-w- c:\windows\system32\BRMFPMON.DLL
2009-11-15 17:44 . 2009-11-15 17:44 ——– d—–w- c:\documents and settings\Twice Bitten\Local Settings\Application Data\S2PC
2009-11-15 17:44 . 2009-09-22 07:30 482408 —-a-w- c:\windows\ssndii.exe
2009-11-15 17:43 . 2009-09-22 07:30 113768 —-a-w- c:\windows\Wiainst.exe
2009-11-15 17:43 . 2009-05-12 00:00 143872 —-a-w- c:\windows\system32\SaXPWIA.dll
2009-11-15 17:43 . 2009-05-12 00:00 138240 —-a-w- c:\windows\system32\SaXPUIEx.dll
2009-11-15 17:43 . 2009-05-12 00:00 87552 —-a-w- c:\windows\system32\SaXPSTI.dll
2009-11-15 17:43 . 2009-05-12 00:00 116736 —-a-w- c:\windows\system32\SaXPIPH.dll
2009-11-15 17:43 . 2009-05-12 00:00 139776 —-a-w- c:\windows\system32\SaXPEH.dll
2009-11-15 17:43 . 2007-08-14 07:22 49152 —-a-w- c:\windows\system32\Ssusbpn.dll
2009-11-15 17:43 . 2007-08-14 07:22 57344 —-a-w- c:\windows\system32\Ssdevm.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-02 06:25 . 2007-03-22 13:48 ——– d—–w- c:\program files\Virus Software
2009-12-02 06:14 . 2006-04-24 22:18 ——– d—–w- c:\program files\Utilities
2009-12-02 06:04 . 2009-03-04 05:34 ——– d—–w- c:\documents and settings\Twice Bitten\Application Data\SUPERAntiSpyware.com
2009-12-02 05:09 . 2006-08-03 21:46 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2009-12-01 04:41 . 2006-05-02 16:22 155928 —-a-w- c:\documents and settings\Twice Bitten\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-30 20:35 . 2009-04-07 23:05 ——– d—–w- c:\program files\Google
2009-11-30 20:18 . 2005-10-21 03:32 ——– d—–w- c:\program files\LimeWire
2009-11-30 19:21 . 2006-04-17 14:19 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Autodesk
2009-11-30 19:21 . 2007-07-13 22:15 ——– d—–w- c:\program files\AutoCAD 2007
2009-11-30 19:21 . 2006-04-17 14:19 ——– d—–w- c:\program files\Common Files\Autodesk Shared
2009-11-30 19:05 . 2009-11-08 08:09 ——– d—–w- c:\program files\Windows Live Safety Center
2009-11-27 20:32 . 2006-04-17 14:19 ——– d—–w- c:\program files\AutoCAD 2004
2009-11-18 08:02 . 2005-11-05 23:50 157504 —-a-w- c:\documents and settings\Your Name\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-17 20:11 . 2006-11-26 22:20 ——– d—–w- c:\program files\Printers
2009-11-17 06:20 . 2009-03-09 20:24 ——– d—–w- c:\documents and settings\Twice Bitten\Application Data\SiteClasses
2009-11-05 01:37 . 2008-02-29 23:45 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft Help
2009-11-02 06:16 . 2006-12-10 17:22 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Yahoo!
2009-10-30 15:34 . 2005-08-18 18:52 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-10-30 15:27 . 2009-10-30 15:27 ——– d—–w- c:\program files\Seagate
2009-10-30 15:27 . 2009-10-30 15:27 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Seagate
2009-10-30 15:25 . 2009-10-30 15:25 ——– d—–w- c:\program files\MSXML 6.0
2009-10-28 07:17 . 2008-03-11 20:47 ——– d—–w- c:\documents and settings\Twice Bitten\Application Data\Skype
2009-10-28 06:29 . 2008-03-11 20:59 ——– d—–w- c:\documents and settings\Twice Bitten\Application Data\skypePM
2009-10-23 07:43 . 2009-10-23 07:43 1719 —-a-w- c:\windows\igaboxagijo.dll
2009-10-23 06:37 . 2009-10-23 06:37 1719 —-a-w- c:\windows\uhocezafiteq.dll
2009-10-23 05:55 . 2009-10-23 05:55 1719 —-a-w- c:\windows\afoqoqiw.dll
2009-10-22 23:51 . 2009-10-22 23:51 1719 —-a-w- c:\windows\uvevurijanoxoz.dll
2009-10-22 22:45 . 2009-10-22 22:45 1719 —-a-w- c:\windows\orukizicesojolo.dll
2009-10-22 21:40 . 2009-10-22 21:40 1719 —-a-w- c:\windows\ikaloputuyezevu.dll
2009-10-22 20:33 . 2009-10-22 20:33 1719 —-a-w- c:\windows\ucafoqesodamape.dll
2009-10-22 19:28 . 2009-10-22 19:28 1719 —-a-w- c:\windows\edovekeg.dll
2009-10-22 18:21 . 2009-10-22 18:21 1719 —-a-w- c:\windows\axetudiw.dll
2009-10-22 17:16 . 2009-10-22 17:15 1719 —-a-w- c:\windows\odipuwow.dll
2009-10-22 16:57 . 2009-10-22 16:57 ——– d—–w- c:\program files\Samsung
2009-10-22 16:10 . 2009-10-22 16:10 1719 —-a-w- c:\windows\iwapuhidon.dll
2009-10-22 15:04 . 2009-10-22 15:04 1719 —-a-w- c:\windows\ucixopakenupiy.dll
2009-10-22 07:28 . 2009-10-22 07:28 1719 —-a-w- c:\windows\omefonutuliv.dll
2009-10-22 06:22 . 2009-10-22 06:22 1719 —-a-w- c:\windows\uxohiqopu.dll
2009-10-22 05:16 . 2009-10-22 05:16 1719 —-a-w- c:\windows\ikozikequwamoh.dll
2009-10-22 04:10 . 2009-10-22 04:10 1719 —-a-w- c:\windows\izupegogaj.dll
2009-10-22 03:04 . 2009-10-22 03:04 1719 —-a-w- c:\windows\ominamisuno.dll
2009-10-22 01:58 . 2009-10-22 01:58 1719 —-a-w- c:\windows\iroqazefijocif.dll
2009-10-22 00:52 . 2009-10-22 00:52 1719 —-a-w- c:\windows\uxafebos.dll
2009-10-21 23:46 . 2009-10-21 23:46 1719 —-a-w- c:\windows\uvixifokelod.dll
2009-10-21 22:40 . 2009-10-21 22:40 1719 —-a-w- c:\windows\izewilojihume.dll
2009-10-21 21:34 . 2009-10-21 21:34 1719 —-a-w- c:\windows\ukemuguxavigam.dll
2009-10-21 20:29 . 2009-10-21 20:29 1719 —-a-w- c:\windows\ijifapiti.dll
2009-10-21 19:22 . 2009-10-21 19:22 1719 —-a-w- c:\windows\ahehujeh.dll
2009-10-21 18:16 . 2009-10-21 18:16 1719 —-a-w- c:\windows\uxosovomadoyado.dll
2009-10-21 16:19 . 2009-10-21 16:19 1719 —-a-w- c:\windows\eregilim.dll
2009-10-21 15:13 . 2009-10-21 15:13 1719 —-a-w- c:\windows\ulareweh.dll
2009-10-21 14:07 . 2009-10-21 14:07 1719 —-a-w- c:\windows\opiwizuter.dll
2009-10-21 13:01 . 2009-10-21 13:01 1719 —-a-w- c:\windows\efirowigesi.dll
2009-10-21 11:55 . 2009-10-21 11:55 1719 —-a-w- c:\windows\ejuzowem.dll
2009-10-21 10:49 . 2009-10-21 10:49 1719 —-a-w- c:\windows\esexasux.dll
2009-10-21 09:43 . 2009-10-21 09:43 1719 —-a-w- c:\windows\exebuworu.dll
2009-10-21 08:37 . 2009-10-21 08:37 1719 —-a-w- c:\windows\usozixoci.dll
2009-10-21 07:31 . 2009-10-21 07:31 1719 —-a-w- c:\windows\ecefixipugofo.dll
2009-10-20 20:06 . 2009-10-20 20:06 1715 —-a-w- c:\windows\ejoxesakorilowad.dll
2009-10-20 19:00 . 2009-10-20 19:00 1715 —-a-w- c:\windows\iviweraxi.dll
2009-10-20 17:54 . 2009-10-20 17:54 1715 —-a-w- c:\windows\idevevukov.dll
2009-10-20 16:48 . 2009-10-20 16:48 1715 —-a-w- c:\windows\iqacilucipihax.dll
2009-10-20 15:42 . 2009-10-20 15:42 1715 —-a-w- c:\windows\eyufujahozazohec.dll
2009-10-20 07:59 . 2009-10-20 07:59 1715 —-a-w- c:\windows\akufuvahohilof.dll
2009-10-20 06:53 . 2009-10-20 06:53 1715 —-a-w- c:\windows\ehuwoxut.dll
2009-10-20 05:47 . 2009-10-20 05:47 1715 —-a-w- c:\windows\apigakusa.dll
2009-10-20 04:41 . 2009-10-20 04:41 1715 —-a-w- c:\windows\oqahajileso.dll
2009-10-20 00:54 . 2009-10-20 00:54 1715 —-a-w- c:\windows\egogegob.dll
2009-10-19 23:48 . 2009-10-19 23:48 1715 —-a-w- c:\windows\isizobesitefes.dll
2009-10-19 22:42 . 2009-10-19 22:42 1715 —-a-w- c:\windows\evunugaz.dll
2009-10-19 21:36 . 2009-10-19 21:36 1715 —-a-w- c:\windows\uwabubov.dll
2009-10-19 20:30 . 2009-10-19 20:30 1715 —-a-w- c:\windows\aximanapoxuba.dll
2009-10-19 19:24 . 2009-10-19 19:24 1715 —-a-w- c:\windows\epixunaka.dll
2009-10-19 18:18 . 2009-10-19 18:18 1715 —-a-w- c:\windows\iniqejej.dll
2009-10-19 17:12 . 2009-10-19 17:12 1715 —-a-w- c:\windows\irumenip.dll
2009-10-19 16:06 . 2009-10-19 16:06 1715 —-a-w- c:\windows\ilogesagubinago.dll
2009-10-19 15:00 . 2009-10-19 15:00 1715 —-a-w- c:\windows\axikawasaxov.dll
2009-10-19 13:54 . 2009-10-19 13:54 1715 —-a-w- c:\windows\inijosifa.dll
2009-10-19 12:48 . 2009-10-19 12:48 1715 —-a-w- c:\windows\etiwebew.dll
2009-10-19 11:42 . 2009-10-19 11:42 1715 —-a-w- c:\windows\ohezebaz.dll
2009-10-19 10:36 . 2009-10-19 10:36 1715 —-a-w- c:\windows\ofoxoyiv.dll
2009-10-19 09:30 . 2009-10-19 09:30 1715 —-a-w- c:\windows\ezebibid.dll
2009-10-19 08:24 . 2009-10-19 08:24 1715 —-a-w- c:\windows\unofesujoxumu.dll
2009-10-19 07:18 . 2009-10-19 07:18 1715 —-a-w- c:\windows\akilesoqa.dll
2009-10-19 06:12 . 2009-10-19 06:12 1715 —-a-w- c:\windows\ekenewoh.dll
2009-10-19 05:06 . 2009-10-19 05:06 1715 —-a-w- c:\windows\igibuyutomobuni.dll
2009-10-19 04:00 . 2009-10-19 04:00 1715 —-a-w- c:\windows\ofajifig.dll
2009-10-19 02:54 . 2009-10-19 02:54 1715 —-a-w- c:\windows\ulowuwuleve.dll
2009-10-19 01:48 . 2009-10-19 01:48 1715 —-a-w- c:\windows\ekahazoz.dll
2009-10-19 00:42 . 2009-10-19 00:42 1715 —-a-w- c:\windows\opegocel.dll
2009-10-18 20:37 . 2009-10-18 20:37 1715 —-a-w- c:\windows\izikolakefup.dll
2009-10-18 19:26 . 2009-10-18 19:26 1715 —-a-w- c:\windows\oquhapuh.dll
2009-10-18 08:11 . 2009-10-18 08:11 1715 —-a-w- c:\windows\ecoziqowu.dll
2009-10-18 07:05 . 2009-10-18 07:05 1715 —-a-w- c:\windows\irayozewahatewis.dll
2009-10-17 09:01 . 2009-10-17 09:01 3085 —-a-w- c:\windows\ekabubovidogosix.dll
2009-10-17 07:55 . 2009-10-17 07:55 3085 —-a-w- c:\windows\amogubix.dll
2009-10-17 06:49 . 2009-10-17 06:49 3085 —-a-w- c:\windows\ikujivanoq.dll
2009-10-17 05:43 . 2009-10-17 05:43 3085 —-a-w- c:\windows\edojebuqagetey.dll
2009-10-17 04:37 . 2009-10-17 04:37 3085 —-a-w- c:\windows\ucumenipavuroge.dll
2009-10-17 03:31 . 2009-10-17 03:31 3085 —-a-w- c:\windows\aqogesagubinago.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-11-30 39408]
"SUPERAntiSpyware"="c:\program files\Virus Software\SUPERAntiSpyware.exe" [2009-11-23 2001648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-10-14 114688]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2005-10-07 176128]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]
"MaxMenuMgr"="c:\program files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe" [2009-09-26 185640]
"3170 Scan2PC"="c:\windows\Twain_32\Samsung\CLX3170\Scan2pc.exe" [2009-06-12 503808]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-12 44544]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\Virus Software\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 19:21 548352 —-a-w- c:\program files\Virus Software\SASWINLO.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Acrobat Assistant.lnk]
backup=c:\windows\pss\Acrobat Assistant.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^AutoCAD Startup Accelerator.lnk]
path=c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\AutoCAD Startup Accelerator.lnk
backup=c:\windows\pss\AutoCAD Startup Accelerator.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^nqpbf.exe]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Ringo Launcher.lnk]
backup=c:\windows\pss\Ringo Launcher.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Twice Bitten^Start Menu^Programs^Startup^United Airlines Timetable Update Application.lnk]
path=c:\documents and settings\Twice Bitten\Start Menu\Programs\Startup\United Airlines Timetable Update Application.lnk
backup=c:\windows\pss\United Airlines Timetable Update Application.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Twice Bitten^Start Menu^Programs^Startup^Z_Start.lnk]
backup=c:\windows\pss\Z_Start.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Your Name^Start Menu^Programs^Startup^Internet Explorer.lnk]
path=c:\documents and settings\Your Name\Start Menu\Programs\Startup\Internet Explorer.lnk
backup=c:\windows\pss\Internet Explorer.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ShowLOMControl]
[X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
2007-05-11 02:46 624248 —-a-w- c:\program files\Adobe\Acrobat 8.0\Acrobat\acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
2006-05-10 00:24 50760 —-a-w- c:\program files\Common Files\AOL\1145568053\ee\aolsoftware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IPHSend]
2006-02-17 16:59 124520 —-a-w- c:\program files\Common Files\AOL\IPHSend\IPHSend.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2008-10-01 23:57 289576 —-a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2008-09-06 20:09 413696 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2005-11-10 19:03 36975 —-a-w- c:\program files\Java\jre1.5.0_06\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPodService"=3 (0x3)
"Dpsixrnt"=3 (0x3)
"iPod Service"=3 (0x3)
"ewido anti-spyware 4.0 guard"=2 (0x2)
"LexBceS"=3 (0x3)
"AVG Anti-Spyware Guard"=2 (0x2)
"RegSrvc"=2 (0x2)
"IDriverT"=3 (0x3)
"Autodesk Licensing Service"=3 (0x3)
"Apple Mobile Device"=2 (0x2)
"Lavasoft Ad-Aware Service"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\1145568053\\ee\\aolsoftware.exe"=
"c:\\Program Files\\Common Files\\AOL\\1145568053\\ee\\aim6.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Motorola\\RSD Lite\\SDL.exe"=
"c:\\Program Files\\IMTools\\Trillian\\trillian.exe"=
"c:\\Program Files\\IMTools\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Adobe\\Adobe Dreamweaver CS4\\Dreamweaver.exe"=
"c:\\Program Files\\Adobe\\Adobe Photoshop Lightroom 2\\lightroom.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\WINDOWS\\twain_32\\Samsung\\ScanMgr.exe"=
"c:\\WINDOWS\\twain_32\\Samsung\\CLX3170\\Scan2Pc.exe"=
"c:\\WINDOWS\\twain_32\\Samsung\\CLX3170\\Sscan2io.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2/17/2009 2:06 AM 64160]
R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [11/30/2009 3:39 PM 207280]
R1 SASDIFSV;SASDIFSV;c:\program files\Virus Software\sasdifsv.sys [11/23/2009 8:43 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\Virus Software\SASKUTIL.SYS [11/23/2009 8:43 AM 74480]
R2 FreeAgentGoNext Service;Seagate Service;c:\program files\Seagate\SeagateManager\Sync\FreeAgentService.exe [9/25/2009 11:32 PM 189736]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [1/11/2008 3:05 PM 24652]
R3 SASENUM;SASENUM;c:\program files\Virus Software\SASENUM.SYS [11/23/2009 8:43 AM 7408]
S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys –> c:\windows\system32\Drivers\SSPORT.sys [?]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [11/30/2009 3:37 PM 358600]
S3 XIRLINK;Veo PC Camera;c:\windows\system32\drivers\ucdnt.sys [3/17/2008 12:01 PM 899884]
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Connection Wizard,ShellNext = https://login.live.com/ppsecure/md5auth.srf?lc=1033
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: - Download &this page with WebCloner - c:\program files\WebTools\ProductsFoundry\WebCloner Standard 2.4\addthis.htm
IE: - Download all &images with WebCloner - c:\program files\WebTools\ProductsFoundry\WebCloner Standard 2.4\addimg.htm
IE: - Download all &links with WebCloner - c:\program files\WebTools\ProductsFoundry\WebCloner Standard 2.4\addurl.htm
IE: - Download selected links with WebCloner - c:\program files\WebTools\ProductsFoundry\WebCloner Standard 2.4\addsellinks.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Download selected images with WebCloner - c:\program files\WebTools\ProductsFoundry\WebCloner Standard 2.4\addselimgs.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
IE: {{ADFCCE65-DF10-46fd-B04A-53CCBE2A0795} - c:\program files\WebTools\ProductsFoundry\WebCloner Standard 2.4\WebCloner.exe
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\Twice Bitten\Start Menu\Programs\IM\IMVU\Run IMVU.lnk
FF - ProfilePath - c:\documents and settings\Twice Bitten\Application Data\Mozilla\Firefox\Profiles\3d2gasfs.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - GOOGLE.COM
FF - component: c:\documents and settings\Twice Bitten\Application Data\Mozilla\Firefox\Profiles\3d2gasfs.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\platform\WINNT_x86-msvc\components\SSSLauncher.dll
FF - component: c:\documents and settings\Twice Bitten\Application Data\Mozilla\Firefox\Profiles\3d2gasfs.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - plugin: c:\documents and settings\Twice Bitten\Application Data\Mozilla\Firefox\Profiles\3d2gasfs.default\extensions\[removed]\platform\WINNT_x86-msvc\plugins\npmnqmp07061050.dll
FF - plugin: c:\progra~1\IMTools\Yahoo!\Common\npyaxmpb.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1739.5352\npCIDetect13.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJPI150_06.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPOJI610.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmnqmp07010901.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-12 14:56
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(980)
c:\program files\Virus Software\SASWINLO.dll
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
c:\windows\system32\igfxdev.dll
.
Completion time: 2009-12-12 15:01:20
ComboFix-quarantined-files.txt 2009-12-12 20:01
ComboFix2.txt 2009-12-12 17:46
ComboFix3.txt 2009-04-02 23:20

Pre-Run: 4,556,992,512 bytes free
Post-Run: 4,538,851,328 bytes free

Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4,5,6
- - End Of File - - 9400964E1184A431BC2B01CBC0494265
Upload was successful

CatByte

Post #11December 12, 2009, 9:08 PM UTC last edited December 13, 2009, 8:05 PM UTC

Hi,

More work to do unfortunately,

Please do the following:

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

http://forums.whatthetech.com/Malwarebytes_Finds_2_hijack_windowsupdates_files_t108742.html&view=findpost&p=617203#entry617203

Collect::
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\nqpbf.exe

File::
c:\windows\igaboxagijo.dll
c:\windows\uhocezafiteq.dll
c:\windows\afoqoqiw.dll
c:\windows\uvevurijanoxoz.dll
c:\windows\orukizicesojolo.dll
c:\windows\ikaloputuyezevu.dll
c:\windows\ucafoqesodamape.dll
c:\windows\edovekeg.dll
c:\windows\axetudiw.dll
c:\windows\odipuwow.dll
c:\windows\iwapuhidon.dll
c:\windows\ucixopakenupiy.dll
c:\windows\omefonutuliv.dll
c:\windows\uxohiqopu.dll
c:\windows\ikozikequwamoh.dll
c:\windows\izupegogaj.dll
c:\windows\ominamisuno.dll
c:\windows\iroqazefijocif.dll
c:\windows\uxafebos.dll
c:\windows\uvixifokelod.dll
c:\windows\izewilojihume.dll
c:\windows\ukemuguxavigam.dll
c:\windows\ijifapiti.dll
c:\windows\ahehujeh.dll
c:\windows\uxosovomadoyado.dll
c:\windows\eregilim.dll
c:\windows\ulareweh.dll
c:\windows\opiwizuter.dll
c:\windows\efirowigesi.dll
c:\windows\ejuzowem.dll
c:\windows\esexasux.dll
c:\windows\exebuworu.dll
c:\windows\usozixoci.dll
c:\windows\ecefixipugofo.dll
c:\windows\ejoxesakorilowad.dll
c:\windows\iviweraxi.dll
c:\windows\idevevukov.dll
c:\windows\iqacilucipihax.dll
c:\windows\eyufujahozazohec.dll
c:\windows\akufuvahohilof.dll
c:\windows\ehuwoxut.dll
c:\windows\apigakusa.dll
c:\windows\oqahajileso.dll
c:\windows\egogegob.dll
c:\windows\isizobesitefes.dll
c:\windows\evunugaz.dll
c:\windows\uwabubov.dll
c:\windows\aximanapoxuba.dll
c:\windows\epixunaka.dll
c:\windows\iniqejej.dll
c:\windows\irumenip.dll
c:\windows\ilogesagubinago.dll
c:\windows\axikawasaxov.dll
c:\windows\inijosifa.dll
c:\windows\etiwebew.dll
c:\windows\ohezebaz.dll
c:\windows\ofoxoyiv.dll
c:\windows\ezebibid.dll
c:\windows\unofesujoxumu.dll
c:\windows\akilesoqa.dll
c:\windows\ekenewoh.dll
c:\windows\igibuyutomobuni.dll
c:\windows\ofajifig.dll
c:\windows\ulowuwuleve.dll
c:\windows\ekahazoz.dll
c:\windows\opegocel.dll
c:\windows\izikolakefup.dll
c:\windows\oquhapuh.dll
c:\windows\ecoziqowu.dll
c:\windows\irayozewahatewis.dll
c:\windows\ekabubovidogosix.dll
c:\windows\amogubix.dll
c:\windows\ikujivanoq.dll
c:\windows\edojebuqagetey.dll
c:\windows\ucumenipavuroge.dll
c:\windows\aqogesagubinago.dll

Registry::
[-HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^nqpbf.exe]

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you.
Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

**Note**
When CF finishes running, the ComboFix log will open along with a message box–do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.

Ensure you are connected to the internet and click OK on the message box.

jacory

Post #12December 12, 2009, 10:02 PM UTC last edited December 13, 2009, 8:07 PM UTC

3rd ComboFix.txt thanks for all the help here. i'm quite curious as to what is actually going on and what ComboFix is doing. would you mind explaining a little about what we are actually doing?

ComboFix 09-12-11.05 - Twice Bitten 12/12/2009 16:38:30.5.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.503.145 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Twice Bitten\Desktop\CFScript.txt
AV: Spyware Doctor with AntiVirus *On-access scanning disabled* (Updated) {D3C23B96-C9DC-477F-8EF1-69AF17A6EFF6}

FILE ::
"c:\windows\afoqoqiw.dll"
"c:\windows\ahehujeh.dll"
"c:\windows\akilesoqa.dll"
"c:\windows\akufuvahohilof.dll"
"c:\windows\amogubix.dll"
"c:\windows\apigakusa.dll"
"c:\windows\aqogesagubinago.dll"
"c:\windows\axetudiw.dll"
"c:\windows\axikawasaxov.dll"
"c:\windows\aximanapoxuba.dll"
"c:\windows\ecefixipugofo.dll"
"c:\windows\ecoziqowu.dll"
"c:\windows\edojebuqagetey.dll"
"c:\windows\edovekeg.dll"
"c:\windows\efirowigesi.dll"
"c:\windows\egogegob.dll"
"c:\windows\ehuwoxut.dll"
"c:\windows\ejoxesakorilowad.dll"
"c:\windows\ejuzowem.dll"
"c:\windows\ekabubovidogosix.dll"
"c:\windows\ekahazoz.dll"
"c:\windows\ekenewoh.dll"
"c:\windows\epixunaka.dll"
"c:\windows\eregilim.dll"
"c:\windows\esexasux.dll"
"c:\windows\etiwebew.dll"
"c:\windows\evunugaz.dll"
"c:\windows\exebuworu.dll"
"c:\windows\eyufujahozazohec.dll"
"c:\windows\ezebibid.dll"
"c:\windows\idevevukov.dll"
"c:\windows\igaboxagijo.dll"
"c:\windows\igibuyutomobuni.dll"
"c:\windows\ijifapiti.dll"
"c:\windows\ikaloputuyezevu.dll"
"c:\windows\ikozikequwamoh.dll"
"c:\windows\ikujivanoq.dll"
"c:\windows\ilogesagubinago.dll"
"c:\windows\inijosifa.dll"
"c:\windows\iniqejej.dll"
"c:\windows\iqacilucipihax.dll"
"c:\windows\irayozewahatewis.dll"
"c:\windows\iroqazefijocif.dll"
"c:\windows\irumenip.dll"
"c:\windows\isizobesitefes.dll"
"c:\windows\iviweraxi.dll"
"c:\windows\iwapuhidon.dll"
"c:\windows\izewilojihume.dll"
"c:\windows\izikolakefup.dll"
"c:\windows\izupegogaj.dll"
"c:\windows\odipuwow.dll"
"c:\windows\ofajifig.dll"
"c:\windows\ofoxoyiv.dll"
"c:\windows\ohezebaz.dll"
"c:\windows\omefonutuliv.dll"
"c:\windows\ominamisuno.dll"
"c:\windows\opegocel.dll"
"c:\windows\opiwizuter.dll"
"c:\windows\oqahajileso.dll"
"c:\windows\oquhapuh.dll"
"c:\windows\orukizicesojolo.dll"
"c:\windows\ucafoqesodamape.dll"
"c:\windows\ucixopakenupiy.dll"
"c:\windows\ucumenipavuroge.dll"
"c:\windows\uhocezafiteq.dll"
"c:\windows\ukemuguxavigam.dll"
"c:\windows\ulareweh.dll"
"c:\windows\ulowuwuleve.dll"
"c:\windows\unofesujoxumu.dll"
"c:\windows\usozixoci.dll"
"c:\windows\uvevurijanoxoz.dll"
"c:\windows\uvixifokelod.dll"
"c:\windows\uwabubov.dll"
"c:\windows\uxafebos.dll"
"c:\windows\uxohiqopu.dll"
"c:\windows\uxosovomadoyado.dll"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\afoqoqiw.dll
c:\windows\ahehujeh.dll
c:\windows\akilesoqa.dll
c:\windows\akufuvahohilof.dll
c:\windows\amogubix.dll
c:\windows\apigakusa.dll
c:\windows\aqogesagubinago.dll
c:\windows\axetudiw.dll
c:\windows\axikawasaxov.dll
c:\windows\aximanapoxuba.dll
c:\windows\ecefixipugofo.dll
c:\windows\ecoziqowu.dll
c:\windows\edojebuqagetey.dll
c:\windows\edovekeg.dll
c:\windows\efirowigesi.dll
c:\windows\egogegob.dll
c:\windows\ehuwoxut.dll
c:\windows\ejoxesakorilowad.dll
c:\windows\ejuzowem.dll
c:\windows\ekabubovidogosix.dll
c:\windows\ekahazoz.dll
c:\windows\ekenewoh.dll
c:\windows\epixunaka.dll
c:\windows\eregilim.dll
c:\windows\esexasux.dll
c:\windows\etiwebew.dll
c:\windows\evunugaz.dll
c:\windows\exebuworu.dll
c:\windows\eyufujahozazohec.dll
c:\windows\ezebibid.dll
c:\windows\idevevukov.dll
c:\windows\igaboxagijo.dll
c:\windows\igibuyutomobuni.dll
c:\windows\ijifapiti.dll
c:\windows\ikaloputuyezevu.dll
c:\windows\ikozikequwamoh.dll
c:\windows\ikujivanoq.dll
c:\windows\ilogesagubinago.dll
c:\windows\inijosifa.dll
c:\windows\iniqejej.dll
c:\windows\iqacilucipihax.dll
c:\windows\irayozewahatewis.dll
c:\windows\iroqazefijocif.dll
c:\windows\irumenip.dll
c:\windows\isizobesitefes.dll
c:\windows\iviweraxi.dll
c:\windows\iwapuhidon.dll
c:\windows\izewilojihume.dll
c:\windows\izikolakefup.dll
c:\windows\izupegogaj.dll
c:\windows\odipuwow.dll
c:\windows\ofajifig.dll
c:\windows\ofoxoyiv.dll
c:\windows\ohezebaz.dll
c:\windows\omefonutuliv.dll
c:\windows\ominamisuno.dll
c:\windows\opegocel.dll
c:\windows\opiwizuter.dll
c:\windows\oqahajileso.dll
c:\windows\oquhapuh.dll
c:\windows\orukizicesojolo.dll
c:\windows\ucafoqesodamape.dll
c:\windows\ucixopakenupiy.dll
c:\windows\ucumenipavuroge.dll
c:\windows\uhocezafiteq.dll
c:\windows\ukemuguxavigam.dll
c:\windows\ulareweh.dll
c:\windows\ulowuwuleve.dll
c:\windows\unofesujoxumu.dll
c:\windows\usozixoci.dll
c:\windows\uvevurijanoxoz.dll
c:\windows\uvixifokelod.dll
c:\windows\uwabubov.dll
c:\windows\uxafebos.dll
c:\windows\uxohiqopu.dll
c:\windows\uxosovomadoyado.dll

.
((((((((((((((((((((((((( Files Created from 2009-11-12 to 2009-12-12 )))))))))))))))))))))))))))))))
.

2009-12-09 00:54 . 2009-12-09 04:07 ——– d—–w- c:\documents and settings\Administrator.WORK\Local Settings\Application Data\Adobe
2009-12-09 00:53 . 2009-12-09 00:53 155928 —-a-w- c:\documents and settings\Administrator.WORK\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-03 05:23 . 2009-12-03 05:23 ——– d—–w- c:\documents and settings\Guest\Local Settings\Application Data\S2PC
2009-12-02 08:40 . 2009-12-02 08:40 ——– d—–w- c:\documents and settings\Administrator.WORK\Application Data\Malwarebytes
2009-12-02 06:36 . 2009-12-02 06:36 117760 —-a-w- c:\documents and settings\Administrator.WORK\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-12-02 06:36 . 2009-12-02 06:36 ——– d—–w- c:\documents and settings\Administrator.WORK\Application Data\SUPERAntiSpyware.com
2009-12-02 06:25 . 2009-09-10 19:54 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-02 06:25 . 2009-09-10 19:53 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-12-02 06:04 . 2009-12-02 06:29 117760 —-a-w- c:\documents and settings\Twice Bitten\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-12-02 06:01 . 2009-12-02 06:01 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2009-12-01 18:40 . 2009-12-01 18:40 ——– d—–w- c:\documents and settings\Your Name\Application Data\Malwarebytes
2009-12-01 10:14 . 2009-12-01 10:14 ——– d—–w- c:\documents and settings\Twice Bitten\Application Data\Registry Mechanic
2009-12-01 03:49 . 2009-11-19 16:48 43008 —-a-w- c:\documents and settings\Twice Bitten\Application Data\Mozilla\Firefox\Profiles\3d2gasfs.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
2009-12-01 03:49 . 2009-11-19 16:48 340480 —-a-w- c:\documents and settings\Twice Bitten\Application Data\Mozilla\Firefox\Profiles\3d2gasfs.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll
2009-12-01 03:49 . 2009-11-19 16:48 346624 —-a-w- c:\documents and settings\Twice Bitten\Application Data\Mozilla\Firefox\Profiles\3d2gasfs.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll
2009-12-01 03:49 . 2009-11-19 16:48 872960 —-a-w- c:\documents and settings\Twice Bitten\Application Data\Mozilla\Firefox\Profiles\3d2gasfs.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
2009-11-30 20:39 . 2009-09-24 13:55 229304 —-a-w- c:\windows\system32\drivers\pctgntdi.sys
2009-11-30 20:39 . 2009-10-06 21:31 87784 —-a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2009-11-30 20:39 . 2009-09-23 21:10 207280 —-a-w- c:\windows\system32\drivers\PCTCore.sys
2009-11-30 20:38 . 2009-09-03 14:45 70408 —-a-w- c:\windows\system32\drivers\pctplsg.sys
2009-11-30 20:37 . 2009-12-02 06:14 ——– d—–w- c:\program files\Common Files\PC Tools
2009-11-30 20:37 . 2009-12-12 17:18 ——– d—–w- c:\program files\Spyware Doctor
2009-11-30 20:37 . 2009-11-30 20:37 ——– d—–w- c:\documents and settings\Twice Bitten\Application Data\PC Tools
2009-11-30 20:37 . 2009-11-30 20:37 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\PC Tools
2009-11-30 20:37 . 2009-12-12 17:18 ——– d—a-w- c:\documents and settings\All Users.WINDOWS\Application Data\TEMP
2009-11-30 20:35 . 2009-11-30 20:35 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Google Updater
2009-11-30 19:51 . 2009-11-30 19:51 ——– d—–w- c:\documents and settings\Twice Bitten\Application Data\Malwarebytes
2009-11-30 19:51 . 2009-11-30 19:51 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes
2009-11-30 19:09 . 2009-11-30 19:09 ——– d—–w- c:\windows\system32\wbem\Repository
2009-11-30 19:01 . 2009-11-30 19:01 ——– d–h–w- c:\windows\system32\CanonIJ Uninstaller Information
2009-11-19 01:52 . 2007-04-02 10:00 69632 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\CNMPP8U.DLL
2009-11-19 01:52 . 2007-04-02 10:00 27136 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\CNMPD8U.DLL
2009-11-19 01:52 . 2008-02-06 10:00 216064 —-a-w- c:\windows\system32\CNMLM8U.DLL
2009-11-19 01:51 . 2007-03-15 19:12 188416 —-a-w- c:\windows\system32\CNC470O.DLL
2009-11-19 01:51 . 2007-03-23 21:30 1400832 —-a-w- c:\windows\system32\CNC470C.DLL
2009-11-19 01:51 . 2007-03-23 21:29 98304 —-a-w- c:\windows\system32\CNC470I.DLL
2009-11-19 01:51 . 2007-03-19 15:21 200704 —-a-w- c:\windows\system32\CNC470L.DLL
2009-11-19 01:50 . 2009-11-19 01:50 ——– d–h–w- c:\program files\CanonBJ
2009-11-18 08:01 . 2009-11-18 08:01 ——– d—–w- c:\documents and settings\Your Name\Local Settings\Application Data\S2PC
2009-11-17 20:18 . 2001-08-18 03:36 13312 —-a-w- c:\windows\system32\BRMFPMON.DLL
2009-11-15 17:44 . 2009-11-15 17:44 ——– d—–w- c:\documents and settings\Twice Bitten\Local Settings\Application Data\S2PC
2009-11-15 17:44 . 2009-09-22 07:30 482408 —-a-w- c:\windows\ssndii.exe
2009-11-15 17:43 . 2009-09-22 07:30 113768 —-a-w- c:\windows\Wiainst.exe
2009-11-15 17:43 . 2009-05-12 00:00 143872 —-a-w- c:\windows\system32\SaXPWIA.dll
2009-11-15 17:43 . 2009-05-12 00:00 138240 —-a-w- c:\windows\system32\SaXPUIEx.dll
2009-11-15 17:43 . 2009-05-12 00:00 87552 —-a-w- c:\windows\system32\SaXPSTI.dll
2009-11-15 17:43 . 2009-05-12 00:00 116736 —-a-w- c:\windows\system32\SaXPIPH.dll
2009-11-15 17:43 . 2009-05-12 00:00 139776 —-a-w- c:\windows\system32\SaXPEH.dll
2009-11-15 17:43 . 2007-08-14 07:22 49152 —-a-w- c:\windows\system32\Ssusbpn.dll
2009-11-15 17:43 . 2007-08-14 07:22 57344 —-a-w- c:\windows\system32\Ssdevm.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-02 06:25 . 2007-03-22 13:48 ——– d—–w- c:\program files\Virus Software
2009-12-02 06:14 . 2006-04-24 22:18 ——– d—–w- c:\program files\Utilities
2009-12-02 06:04 . 2009-03-04 05:34 ——– d—–w- c:\documents and settings\Twice Bitten\Application Data\SUPERAntiSpyware.com
2009-12-02 05:09 . 2006-08-03 21:46 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2009-12-01 04:41 . 2006-05-02 16:22 155928 —-a-w- c:\documents and settings\Twice Bitten\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-30 20:35 . 2009-04-07 23:05 ——– d—–w- c:\program files\Google
2009-11-30 20:18 . 2005-10-21 03:32 ——– d—–w- c:\program files\LimeWire
2009-11-30 19:21 . 2006-04-17 14:19 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Autodesk
2009-11-30 19:21 . 2007-07-13 22:15 ——– d—–w- c:\program files\AutoCAD 2007
2009-11-30 19:21 . 2006-04-17 14:19 ——– d—–w- c:\program files\Common Files\Autodesk Shared
2009-11-30 19:05 . 2009-11-08 08:09 ——– d—–w- c:\program files\Windows Live Safety Center
2009-11-27 20:32 . 2006-04-17 14:19 ——– d—–w- c:\program files\AutoCAD 2004
2009-11-18 08:02 . 2005-11-05 23:50 157504 —-a-w- c:\documents and settings\Your Name\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-17 20:11 . 2006-11-26 22:20 ——– d—–w- c:\program files\Printers
2009-11-17 06:20 . 2009-03-09 20:24 ——– d—–w- c:\documents and settings\Twice Bitten\Application Data\SiteClasses
2009-11-05 01:37 . 2008-02-29 23:45 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft Help
2009-11-02 06:16 . 2006-12-10 17:22 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Yahoo!
2009-10-30 15:34 . 2005-08-18 18:52 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-10-30 15:27 . 2009-10-30 15:27 ——– d—–w- c:\program files\Seagate
2009-10-30 15:27 . 2009-10-30 15:27 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Seagate
2009-10-30 15:25 . 2009-10-30 15:25 ——– d—–w- c:\program files\MSXML 6.0
2009-10-28 07:17 . 2008-03-11 20:47 ——– d—–w- c:\documents and settings\Twice Bitten\Application Data\Skype
2009-10-28 06:29 . 2008-03-11 20:59 ——– d—–w- c:\documents and settings\Twice Bitten\Application Data\skypePM
2009-10-22 16:57 . 2009-10-22 16:57 ——– d—–w- c:\program files\Samsung
2009-10-17 02:25 . 2009-10-17 02:25 3085 —-a-w- c:\windows\onikawasaxov.dll
2009-10-17 01:19 . 2009-10-17 01:19 3085 —-a-w- c:\windows\azijosifa.dll
2009-10-17 00:13 . 2009-10-17 00:13 3085 —-a-w- c:\windows\afihaqevemi.dll
2009-10-16 23:07 . 2009-10-16 23:07 3085 —-a-w- c:\windows\ujolukel.dll
2009-10-16 22:01 . 2009-10-16 22:01 3085 —-a-w- c:\windows\ejoxoyiv.dll
2009-10-16 20:55 . 2009-10-16 20:55 3085 —-a-w- c:\windows\opebibidovugiyar.dll
2009-10-16 19:49 . 2009-10-16 19:49 3085 —-a-w- c:\windows\ezofesujo.dll
2009-10-16 18:43 . 2009-10-16 18:43 3085 —-a-w- c:\windows\iyilesoq.dll
2009-10-16 17:37 . 2009-10-16 17:37 3085 —-a-w- c:\windows\acadiwoniqivu.dll
2009-10-16 01:54 . 2009-10-16 01:54 3085 —-a-w- c:\windows\ifazalebinurifuc.dll
2009-10-16 00:48 . 2009-10-16 00:48 3085 —-a-w- c:\windows\icesuram.dll
2009-10-15 23:42 . 2009-10-15 23:42 3085 —-a-w- c:\windows\egilofos.dll
2009-10-15 22:36 . 2009-10-15 22:36 3085 —-a-w- c:\windows\aloyosegef.dll
2009-10-15 21:30 . 2009-10-15 21:30 3085 —-a-w- c:\windows\efafepovax.dll
2009-10-15 20:24 . 2009-10-15 20:24 3085 —-a-w- c:\windows\inulepix.dll
2009-10-15 19:18 . 2009-10-15 19:18 3085 —-a-w- c:\windows\ilukokoxevo.dll
2009-10-15 18:12 . 2009-10-15 18:12 3085 —-a-w- c:\windows\uhuvedidaki.dll
2009-10-15 09:37 . 2009-10-15 09:37 3085 —-a-w- c:\windows\ucevujepopepacu.dll
2009-10-15 08:31 . 2009-10-15 08:31 3085 —-a-w- c:\windows\ekuyidadotib.dll
2009-10-15 07:25 . 2009-10-15 07:25 3085 —-a-w- c:\windows\ofexuyodege.dll
2009-10-15 06:19 . 2009-10-15 06:19 3085 —-a-w- c:\windows\udicadic.dll
2009-10-15 05:13 . 2009-10-15 05:13 3085 —-a-w- c:\windows\ugahadehipenox.dll
2009-10-15 04:05 . 2009-10-15 04:05 3085 —-a-w- c:\windows\uwuzojazijuluca.dll
2009-10-15 02:59 . 2009-10-15 02:59 3085 —-a-w- c:\windows\asuhugew.dll
2009-10-15 01:53 . 2009-10-15 01:53 3085 —-a-w- c:\windows\ayesubukaqib.dll
2009-10-15 00:47 . 2009-10-15 00:47 3085 —-a-w- c:\windows\utiyimaxeqayofi.dll
2009-10-14 23:41 . 2009-10-14 23:41 3085 —-a-w- c:\windows\izefiyacikofe.dll
2009-10-14 22:35 . 2009-10-14 22:35 3085 —-a-w- c:\windows\uxicufoti.dll
2009-10-14 21:29 . 2009-10-14 21:29 3085 —-a-w- c:\windows\erowuseh.dll
2009-10-14 20:23 . 2009-10-14 20:23 3085 —-a-w- c:\windows\idisuzog.dll
2009-10-14 19:17 . 2009-10-14 19:17 3085 —-a-w- c:\windows\enijofoyejejifi.dll
2009-10-14 12:12 . 2009-10-14 12:12 3085 —-a-w- c:\windows\oyaqaguvimupa.dll
2009-10-14 11:06 . 2009-10-14 11:06 3085 —-a-w- c:\windows\awuziyeq.dll
2009-10-14 10:00 . 2009-10-14 10:00 3085 —-a-w- c:\windows\atipejucohotuce.dll
2009-10-14 08:11 . 2009-10-14 08:11 3085 —-a-w- c:\windows\alikawepazuco.dll
2009-10-14 05:40 . 2009-10-14 05:40 3085 —-a-w- c:\windows\iyoraqesa.dll
2009-10-14 05:11 . 2009-10-14 05:11 3085 —-a-w- c:\windows\akozetijokilomi.dll
2009-10-14 04:05 . 2009-10-14 04:05 3085 —-a-w- c:\windows\asoxuges.dll
2009-10-14 02:59 . 2009-10-14 02:59 3085 —-a-w- c:\windows\eganowet.dll
2009-10-14 00:13 . 2009-10-14 00:13 3085 —-a-w- c:\windows\ajuxuqugaroro.dll
2009-10-13 23:07 . 2009-10-13 23:07 3085 —-a-w- c:\windows\oqinevif.dll
2009-10-13 22:01 . 2009-10-13 22:01 3085 —-a-w- c:\windows\ilevigulus.dll
2009-10-13 20:55 . 2009-10-13 20:55 3085 —-a-w- c:\windows\ubixobed.dll
2009-10-13 17:37 . 2009-10-13 17:37 3085 —-a-w- c:\windows\aduxafuj.dll
2009-10-13 08:23 . 2009-10-13 08:23 3085 —-a-w- c:\windows\otodigipamepo.dll
2009-10-13 06:11 . 2009-10-13 06:11 3085 —-a-w- c:\windows\epeqemej.dll
2009-10-08 15:31 . 2009-11-04 08:46 3204096 —-a-w- c:\documents and settings\Twice Bitten\Application Data\Mozilla\Firefox\Profiles\3d2gasfs.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\library\SSS.dll
2009-10-07 23:06 . 2009-11-04 08:46 106496 —-a-w- c:\documents and settings\Twice Bitten\Application Data\Mozilla\Firefox\Profiles\3d2gasfs.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\library\FSAddin.dll
2009-10-06 04:55 . 2009-07-28 01:39 0 —-a-w- c:\windows\Cmowe.bin
2009-09-24 02:29 . 2009-11-04 08:46 28672 —-a-w- c:\documents and settings\Twice Bitten\Application Data\Mozilla\Firefox\Profiles\3d2gasfs.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\platform\WINNT_x86-msvc\components\SSSLauncher.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-11-30 39408]
"SUPERAntiSpyware"="c:\program files\Virus Software\SUPERAntiSpyware.exe" [2009-11-23 2001648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-10-14 114688]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2005-10-07 176128]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]
"MaxMenuMgr"="c:\program files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe" [2009-09-26 185640]
"3170 Scan2PC"="c:\windows\Twain_32\Samsung\CLX3170\Scan2pc.exe" [2009-06-12 503808]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-12 44544]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\Virus Software\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 19:21 548352 —-a-w- c:\program files\Virus Software\SASWINLO.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Acrobat Assistant.lnk]
backup=c:\windows\pss\Acrobat Assistant.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^AutoCAD Startup Accelerator.lnk]
path=c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\AutoCAD Startup Accelerator.lnk
backup=c:\windows\pss\AutoCAD Startup Accelerator.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Ringo Launcher.lnk]
backup=c:\windows\pss\Ringo Launcher.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Twice Bitten^Start Menu^Programs^Startup^United Airlines Timetable Update Application.lnk]
path=c:\documents and settings\Twice Bitten\Start Menu\Programs\Startup\United Airlines Timetable Update Application.lnk
backup=c:\windows\pss\United Airlines Timetable Update Application.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Twice Bitten^Start Menu^Programs^Startup^Z_Start.lnk]
backup=c:\windows\pss\Z_Start.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Your Name^Start Menu^Programs^Startup^Internet Explorer.lnk]
path=c:\documents and settings\Your Name\Start Menu\Programs\Startup\Internet Explorer.lnk
backup=c:\windows\pss\Internet Explorer.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ShowLOMControl]
[X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
2007-05-11 02:46 624248 —-a-w- c:\program files\Adobe\Acrobat 8.0\Acrobat\acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
2006-05-10 00:24 50760 —-a-w- c:\program files\Common Files\AOL\1145568053\ee\aolsoftware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IPHSend]
2006-02-17 16:59 124520 —-a-w- c:\program files\Common Files\AOL\IPHSend\IPHSend.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2008-10-01 23:57 289576 —-a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2008-09-06 20:09 413696 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2005-11-10 19:03 36975 —-a-w- c:\program files\Java\jre1.5.0_06\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPodService"=3 (0x3)
"Dpsixrnt"=3 (0x3)
"iPod Service"=3 (0x3)
"ewido anti-spyware 4.0 guard"=2 (0x2)
"LexBceS"=3 (0x3)
"AVG Anti-Spyware Guard"=2 (0x2)
"RegSrvc"=2 (0x2)
"IDriverT"=3 (0x3)
"Autodesk Licensing Service"=3 (0x3)
"Apple Mobile Device"=2 (0x2)
"Lavasoft Ad-Aware Service"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\1145568053\\ee\\aolsoftware.exe"=
"c:\\Program Files\\Common Files\\AOL\\1145568053\\ee\\aim6.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Motorola\\RSD Lite\\SDL.exe"=
"c:\\Program Files\\IMTools\\Trillian\\trillian.exe"=
"c:\\Program Files\\IMTools\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Adobe\\Adobe Dreamweaver CS4\\Dreamweaver.exe"=
"c:\\Program Files\\Adobe\\Adobe Photoshop Lightroom 2\\lightroom.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\WINDOWS\\twain_32\\Samsung\\ScanMgr.exe"=
"c:\\WINDOWS\\twain_32\\Samsung\\CLX3170\\Scan2Pc.exe"=
"c:\\WINDOWS\\twain_32\\Samsung\\CLX3170\\Sscan2io.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2/17/2009 2:06 AM 64160]
R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [11/30/2009 3:39 PM 207280]
R1 SASDIFSV;SASDIFSV;c:\program files\Virus Software\sasdifsv.sys [11/23/2009 8:43 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\Virus Software\SASKUTIL.SYS [11/23/2009 8:43 AM 74480]
R2 FreeAgentGoNext Service;Seagate Service;c:\program files\Seagate\SeagateManager\Sync\FreeAgentService.exe [9/25/2009 11:32 PM 189736]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [1/11/2008 3:05 PM 24652]
R3 SASENUM;SASENUM;c:\program files\Virus Software\SASENUM.SYS [11/23/2009 8:43 AM 7408]
S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys –> c:\windows\system32\Drivers\SSPORT.sys [?]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [11/30/2009 3:37 PM 358600]
S3 XIRLINK;Veo PC Camera;c:\windows\system32\drivers\ucdnt.sys [3/17/2008 12:01 PM 899884]
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Connection Wizard,ShellNext = https://login.live.com/ppsecure/md5auth.srf?lc=1033
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: - Download &this page with WebCloner - c:\program files\WebTools\ProductsFoundry\WebCloner Standard 2.4\addthis.htm
IE: - Download all &images with WebCloner - c:\program files\WebTools\ProductsFoundry\WebCloner Standard 2.4\addimg.htm
IE: - Download all &links with WebCloner - c:\program files\WebTools\ProductsFoundry\WebCloner Standard 2.4\addurl.htm
IE: - Download selected links with WebCloner - c:\program files\WebTools\ProductsFoundry\WebCloner Standard 2.4\addsellinks.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Download selected images with WebCloner - c:\program files\WebTools\ProductsFoundry\WebCloner Standard 2.4\addselimgs.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
IE: {{ADFCCE65-DF10-46fd-B04A-53CCBE2A0795} - c:\program files\WebTools\ProductsFoundry\WebCloner Standard 2.4\WebCloner.exe
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\Twice Bitten\Start Menu\Programs\IM\IMVU\Run IMVU.lnk
FF - ProfilePath - c:\documents and settings\Twice Bitten\Application Data\Mozilla\Firefox\Profiles\3d2gasfs.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - GOOGLE.COM
FF - component: c:\documents and settings\Twice Bitten\Application Data\Mozilla\Firefox\Profiles\3d2gasfs.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\platform\WINNT_x86-msvc\components\SSSLauncher.dll
FF - component: c:\documents and settings\Twice Bitten\Application Data\Mozilla\Firefox\Profiles\3d2gasfs.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - plugin: c:\documents and settings\Twice Bitten\Application Data\Mozilla\Firefox\Profiles\3d2gasfs.default\extensions\[removed]\platform\WINNT_x86-msvc\plugins\npmnqmp07061050.dll
FF - plugin: c:\progra~1\IMTools\Yahoo!\Common\npyaxmpb.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1739.5352\npCIDetect13.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJPI150_06.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPOJI610.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmnqmp07010901.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-12 16:50
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(980)
c:\program files\Virus Software\SASWINLO.dll
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
c:\windows\system32\igfxdev.dll
.
Completion time: 2009-12-12 16:55:39
ComboFix-quarantined-files.txt 2009-12-12 21:55
ComboFix2.txt 2009-12-12 20:02
ComboFix3.txt 2009-12-12 17:46
ComboFix4.txt 2009-04-02 23:20

Pre-Run: 4,552,175,616 bytes free
Post-Run: 4,534,190,080 bytes free

Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4,5,6
- - End Of File - - 7E990B608A3D2F369845883EB5296283

CatByte

Post #13December 12, 2009, 10:51 PM UTC

Hi,

We are deleting all the bad files I have identified on your system.

Each log is bringing out more, so we keep going till I get them all

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

File::
c:\windows\onikawasaxov.dll
c:\windows\azijosifa.dll
c:\windows\afihaqevemi.dll
c:\windows\ujolukel.dll
c:\windows\ejoxoyiv.dll
c:\windows\opebibidovugiyar.dll
c:\windows\ezofesujo.dll
c:\windows\iyilesoq.dll
c:\windows\acadiwoniqivu.dll
c:\windows\ifazalebinurifuc.dll
c:\windows\icesuram.dll
c:\windows\egilofos.dll
c:\windows\aloyosegef.dll
c:\windows\efafepovax.dll
c:\windows\inulepix.dll
c:\windows\ilukokoxevo.dll
c:\windows\uhuvedidaki.dll
c:\windows\ucevujepopepacu.dll
c:\windows\ekuyidadotib.dll
c:\windows\ofexuyodege.dll
c:\windows\udicadic.dll
c:\windows\ugahadehipenox.dll
c:\windows\uwuzojazijuluca.dll
c:\windows\asuhugew.dll
c:\windows\ayesubukaqib.dll
c:\windows\utiyimaxeqayofi.dll
c:\windows\izefiyacikofe.dll
c:\windows\uxicufoti.dll
c:\windows\erowuseh.dll
c:\windows\idisuzog.dll
c:\windows\enijofoyejejifi.dll
c:\windows\oyaqaguvimupa.dll
c:\windows\awuziyeq.dll
c:\windows\atipejucohotuce.dll
c:\windows\alikawepazuco.dll
c:\windows\iyoraqesa.dll
c:\windows\akozetijokilomi.dll
c:\windows\asoxuges.dll
c:\windows\eganowet.dll
c:\windows\ajuxuqugaroro.dll
c:\windows\oqinevif.dll
c:\windows\ilevigulus.dll
c:\windows\ubixobed.dll
c:\windows\aduxafuj.dll
c:\windows\otodigipamepo.dll
c:\windows\epeqemej.dll
c:\windows\Cmowe.bin

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you.
Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

jacory

Post #14December 12, 2009, 11:52 PM UTC

ah, ok. so ComboFix can find the root level viruses that the other scanners miss? and when given specific instructions, can delete them also?

4th ComboFix log

ComboFix 09-12-11.05 - Twice Bitten 12/12/2009 18:06:26.6.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.503.140 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Twice Bitten\Desktop\CFScript.txt
AV: Spyware Doctor with AntiVirus *On-access scanning disabled* (Updated) {D3C23B96-C9DC-477F-8EF1-69AF17A6EFF6}

FILE ::
"c:\windows\acadiwoniqivu.dll"
"c:\windows\aduxafuj.dll"
"c:\windows\afihaqevemi.dll"
"c:\windows\ajuxuqugaroro.dll"
"c:\windows\akozetijokilomi.dll"
"c:\windows\alikawepazuco.dll"
"c:\windows\aloyosegef.dll"
"c:\windows\asoxuges.dll"
"c:\windows\asuhugew.dll"
"c:\windows\atipejucohotuce.dll"
"c:\windows\awuziyeq.dll"
"c:\windows\ayesubukaqib.dll"
"c:\windows\azijosifa.dll"
"c:\windows\Cmowe.bin"
"c:\windows\efafepovax.dll"
"c:\windows\eganowet.dll"
"c:\windows\egilofos.dll"
"c:\windows\ejoxoyiv.dll"
"c:\windows\ekuyidadotib.dll"
"c:\windows\enijofoyejejifi.dll"
"c:\windows\epeqemej.dll"
"c:\windows\erowuseh.dll"
"c:\windows\ezofesujo.dll"
"c:\windows\icesuram.dll"
"c:\windows\idisuzog.dll"
"c:\windows\ifazalebinurifuc.dll"
"c:\windows\ilevigulus.dll"
"c:\windows\ilukokoxevo.dll"
"c:\windows\inulepix.dll"
"c:\windows\iyilesoq.dll"
"c:\windows\iyoraqesa.dll"
"c:\windows\izefiyacikofe.dll"
"c:\windows\ofexuyodege.dll"
"c:\windows\onikawasaxov.dll"
"c:\windows\opebibidovugiyar.dll"
"c:\windows\oqinevif.dll"
"c:\windows\otodigipamepo.dll"
"c:\windows\oyaqaguvimupa.dll"
"c:\windows\ubixobed.dll"
"c:\windows\ucevujepopepacu.dll"
"c:\windows\udicadic.dll"
"c:\windows\ugahadehipenox.dll"
"c:\windows\uhuvedidaki.dll"
"c:\windows\ujolukel.dll"
"c:\windows\utiyimaxeqayofi.dll"
"c:\windows\uwuzojazijuluca.dll"
"c:\windows\uxicufoti.dll"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\acadiwoniqivu.dll
c:\windows\aduxafuj.dll
c:\windows\afihaqevemi.dll
c:\windows\ajuxuqugaroro.dll
c:\windows\akozetijokilomi.dll
c:\windows\alikawepazuco.dll
c:\windows\aloyosegef.dll
c:\windows\asoxuges.dll
c:\windows\asuhugew.dll
c:\windows\atipejucohotuce.dll
c:\windows\awuziyeq.dll
c:\windows\ayesubukaqib.dll
c:\windows\azijosifa.dll
c:\windows\Cmowe.bin
c:\windows\efafepovax.dll
c:\windows\eganowet.dll
c:\windows\egilofos.dll
c:\windows\ejoxoyiv.dll
c:\windows\ekuyidadotib.dll
c:\windows\enijofoyejejifi.dll
c:\windows\epeqemej.dll
c:\windows\erowuseh.dll
c:\windows\ezofesujo.dll
c:\windows\icesuram.dll
c:\windows\idisuzog.dll
c:\windows\ifazalebinurifuc.dll
c:\windows\ilevigulus.dll
c:\windows\ilukokoxevo.dll
c:\windows\inulepix.dll
c:\windows\iyilesoq.dll
c:\windows\iyoraqesa.dll
c:\windows\izefiyacikofe.dll
c:\windows\ofexuyodege.dll
c:\windows\onikawasaxov.dll
c:\windows\opebibidovugiyar.dll
c:\windows\oqinevif.dll
c:\windows\otodigipamepo.dll
c:\windows\oyaqaguvimupa.dll
c:\windows\ubixobed.dll
c:\windows\ucevujepopepacu.dll
c:\windows\udicadic.dll
c:\windows\ugahadehipenox.dll
c:\windows\uhuvedidaki.dll
c:\windows\ujolukel.dll
c:\windows\utiyimaxeqayofi.dll
c:\windows\uwuzojazijuluca.dll
c:\windows\uxicufoti.dll

.
((((((((((((((((((((((((( Files Created from 2009-11-12 to 2009-12-12 )))))))))))))))))))))))))))))))
.

2009-12-09 00:54 . 2009-12-09 04:07 ——– d—–w- c:\documents and settings\Administrator.WORK\Local Settings\Application Data\Adobe
2009-12-09 00:53 . 2009-12-09 00:53 155928 —-a-w- c:\documents and settings\Administrator.WORK\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-03 05:23 . 2009-12-03 05:23 ——– d—–w- c:\documents and settings\Guest\Local Settings\Application Data\S2PC
2009-12-02 08:40 . 2009-12-02 08:40 ——– d—–w- c:\documents and settings\Administrator.WORK\Application Data\Malwarebytes
2009-12-02 06:36 . 2009-12-02 06:36 117760 —-a-w- c:\documents and settings\Administrator.WORK\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-12-02 06:36 . 2009-12-02 06:36 ——– d—–w- c:\documents and settings\Administrator.WORK\Application Data\SUPERAntiSpyware.com
2009-12-02 06:25 . 2009-09-10 19:54 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-02 06:25 . 2009-09-10 19:53 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-12-02 06:04 . 2009-12-02 06:29 117760 —-a-w- c:\documents and settings\Twice Bitten\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-12-02 06:01 . 2009-12-02 06:01 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2009-12-01 18:40 . 2009-12-01 18:40 ——– d—–w- c:\documents and settings\Your Name\Application Data\Malwarebytes
2009-12-01 10:14 . 2009-12-01 10:14 ——– d—–w- c:\documents and settings\Twice Bitten\Application Data\Registry Mechanic
2009-12-01 03:49 . 2009-11-19 16:48 43008 —-a-w- c:\documents and settings\Twice Bitten\Application Data\Mozilla\Firefox\Profiles\3d2gasfs.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
2009-12-01 03:49 . 2009-11-19 16:48 340480 —-a-w- c:\documents and settings\Twice Bitten\Application Data\Mozilla\Firefox\Profiles\3d2gasfs.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll
2009-12-01 03:49 . 2009-11-19 16:48 346624 —-a-w- c:\documents and settings\Twice Bitten\Application Data\Mozilla\Firefox\Profiles\3d2gasfs.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll
2009-12-01 03:49 . 2009-11-19 16:48 872960 —-a-w- c:\documents and settings\Twice Bitten\Application Data\Mozilla\Firefox\Profiles\3d2gasfs.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
2009-11-30 20:39 . 2009-09-24 13:55 229304 —-a-w- c:\windows\system32\drivers\pctgntdi.sys
2009-11-30 20:39 . 2009-10-06 21:31 87784 —-a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2009-11-30 20:39 . 2009-09-23 21:10 207280 —-a-w- c:\windows\system32\drivers\PCTCore.sys
2009-11-30 20:38 . 2009-09-03 14:45 70408 —-a-w- c:\windows\system32\drivers\pctplsg.sys
2009-11-30 20:37 . 2009-12-02 06:14 ——– d—–w- c:\program files\Common Files\PC Tools
2009-11-30 20:37 . 2009-12-12 17:18 ——– d—–w- c:\program files\Spyware Doctor
2009-11-30 20:37 . 2009-11-30 20:37 ——– d—–w- c:\documents and settings\Twice Bitten\Application Data\PC Tools
2009-11-30 20:37 . 2009-11-30 20:37 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\PC Tools
2009-11-30 20:37 . 2009-12-12 17:18 ——– d—a-w- c:\documents and settings\All Users.WINDOWS\Application Data\TEMP
2009-11-30 20:35 . 2009-11-30 20:35 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Google Updater
2009-11-30 19:51 . 2009-11-30 19:51 ——– d—–w- c:\documents and settings\Twice Bitten\Application Data\Malwarebytes
2009-11-30 19:51 . 2009-11-30 19:51 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes
2009-11-30 19:09 . 2009-11-30 19:09 ——– d—–w- c:\windows\system32\wbem\Repository
2009-11-30 19:01 . 2009-11-30 19:01 ——– d–h–w- c:\windows\system32\CanonIJ Uninstaller Information
2009-11-19 01:52 . 2007-04-02 10:00 69632 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\CNMPP8U.DLL
2009-11-19 01:52 . 2007-04-02 10:00 27136 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\CNMPD8U.DLL
2009-11-19 01:52 . 2008-02-06 10:00 216064 —-a-w- c:\windows\system32\CNMLM8U.DLL
2009-11-19 01:51 . 2007-03-15 19:12 188416 —-a-w- c:\windows\system32\CNC470O.DLL
2009-11-19 01:51 . 2007-03-23 21:30 1400832 —-a-w- c:\windows\system32\CNC470C.DLL
2009-11-19 01:51 . 2007-03-23 21:29 98304 —-a-w- c:\windows\system32\CNC470I.DLL
2009-11-19 01:51 . 2007-03-19 15:21 200704 —-a-w- c:\windows\system32\CNC470L.DLL
2009-11-19 01:50 . 2009-11-19 01:50 ——– d–h–w- c:\program files\CanonBJ
2009-11-18 08:01 . 2009-11-18 08:01 ——– d—–w- c:\documents and settings\Your Name\Local Settings\Application Data\S2PC
2009-11-17 20:18 . 2001-08-18 03:36 13312 —-a-w- c:\windows\system32\BRMFPMON.DLL
2009-11-15 17:44 . 2009-11-15 17:44 ——– d—–w- c:\documents and settings\Twice Bitten\Local Settings\Application Data\S2PC
2009-11-15 17:44 . 2009-09-22 07:30 482408 —-a-w- c:\windows\ssndii.exe
2009-11-15 17:43 . 2009-09-22 07:30 113768 —-a-w- c:\windows\Wiainst.exe
2009-11-15 17:43 . 2009-05-12 00:00 143872 —-a-w- c:\windows\system32\SaXPWIA.dll
2009-11-15 17:43 . 2009-05-12 00:00 138240 —-a-w- c:\windows\system32\SaXPUIEx.dll
2009-11-15 17:43 . 2009-05-12 00:00 87552 —-a-w- c:\windows\system32\SaXPSTI.dll
2009-11-15 17:43 . 2009-05-12 00:00 116736 —-a-w- c:\windows\system32\SaXPIPH.dll
2009-11-15 17:43 . 2009-05-12 00:00 139776 —-a-w- c:\windows\system32\SaXPEH.dll
2009-11-15 17:43 . 2007-08-14 07:22 49152 —-a-w- c:\windows\system32\Ssusbpn.dll
2009-11-15 17:43 . 2007-08-14 07:22 57344 —-a-w- c:\windows\system32\Ssdevm.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-02 06:25 . 2007-03-22 13:48 ——– d—–w- c:\program files\Virus Software
2009-12-02 06:14 . 2006-04-24 22:18 ——– d—–w- c:\program files\Utilities
2009-12-02 06:04 . 2009-03-04 05:34 ——– d—–w- c:\documents and settings\Twice Bitten\Application Data\SUPERAntiSpyware.com
2009-12-02 05:09 . 2006-08-03 21:46 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2009-12-01 04:41 . 2006-05-02 16:22 155928 —-a-w- c:\documents and settings\Twice Bitten\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-30 20:35 . 2009-04-07 23:05 ——– d—–w- c:\program files\Google
2009-11-30 20:18 . 2005-10-21 03:32 ——– d—–w- c:\program files\LimeWire
2009-11-30 19:21 . 2006-04-17 14:19 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Autodesk
2009-11-30 19:21 . 2007-07-13 22:15 ——– d—–w- c:\program files\AutoCAD 2007
2009-11-30 19:21 . 2006-04-17 14:19 ——– d—–w- c:\program files\Common Files\Autodesk Shared
2009-11-30 19:05 . 2009-11-08 08:09 ——– d—–w- c:\program files\Windows Live Safety Center
2009-11-27 20:32 . 2006-04-17 14:19 ——– d—–w- c:\program files\AutoCAD 2004
2009-11-18 08:02 . 2005-11-05 23:50 157504 —-a-w- c:\documents and settings\Your Name\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-17 20:11 . 2006-11-26 22:20 ——– d—–w- c:\program files\Printers
2009-11-17 06:20 . 2009-03-09 20:24 ——– d—–w- c:\documents and settings\Twice Bitten\Application Data\SiteClasses
2009-11-05 01:37 . 2008-02-29 23:45 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft Help
2009-11-02 06:16 . 2006-12-10 17:22 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Yahoo!
2009-10-30 15:34 . 2005-08-18 18:52 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-10-30 15:27 . 2009-10-30 15:27 ——– d—–w- c:\program files\Seagate
2009-10-30 15:27 . 2009-10-30 15:27 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Seagate
2009-10-30 15:25 . 2009-10-30 15:25 ——– d—–w- c:\program files\MSXML 6.0
2009-10-28 07:17 . 2008-03-11 20:47 ——– d—–w- c:\documents and settings\Twice Bitten\Application Data\Skype
2009-10-28 06:29 . 2008-03-11 20:59 ——– d—–w- c:\documents and settings\Twice Bitten\Application Data\skypePM
2009-10-22 16:57 . 2009-10-22 16:57 ——– d—–w- c:\program files\Samsung
2009-10-08 15:31 . 2009-11-04 08:46 3204096 —-a-w- c:\documents and settings\Twice Bitten\Application Data\Mozilla\Firefox\Profiles\3d2gasfs.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\library\SSS.dll
2009-10-07 23:06 . 2009-11-04 08:46 106496 —-a-w- c:\documents and settings\Twice Bitten\Application Data\Mozilla\Firefox\Profiles\3d2gasfs.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\library\FSAddin.dll
2009-09-24 02:29 . 2009-11-04 08:46 28672 —-a-w- c:\documents and settings\Twice Bitten\Application Data\Mozilla\Firefox\Profiles\3d2gasfs.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\platform\WINNT_x86-msvc\components\SSSLauncher.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-11-30 39408]
"SUPERAntiSpyware"="c:\program files\Virus Software\SUPERAntiSpyware.exe" [2009-11-23 2001648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-10-14 114688]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2005-10-07 176128]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]
"MaxMenuMgr"="c:\program files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe" [2009-09-26 185640]
"3170 Scan2PC"="c:\windows\Twain_32\Samsung\CLX3170\Scan2pc.exe" [2009-06-12 503808]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-12 44544]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\Virus Software\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 19:21 548352 —-a-w- c:\program files\Virus Software\SASWINLO.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Acrobat Assistant.lnk]
backup=c:\windows\pss\Acrobat Assistant.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^AutoCAD Startup Accelerator.lnk]
path=c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\AutoCAD Startup Accelerator.lnk
backup=c:\windows\pss\AutoCAD Startup Accelerator.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Ringo Launcher.lnk]
backup=c:\windows\pss\Ringo Launcher.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Twice Bitten^Start Menu^Programs^Startup^United Airlines Timetable Update Application.lnk]
path=c:\documents and settings\Twice Bitten\Start Menu\Programs\Startup\United Airlines Timetable Update Application.lnk
backup=c:\windows\pss\United Airlines Timetable Update Application.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Twice Bitten^Start Menu^Programs^Startup^Z_Start.lnk]
backup=c:\windows\pss\Z_Start.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Your Name^Start Menu^Programs^Startup^Internet Explorer.lnk]
path=c:\documents and settings\Your Name\Start Menu\Programs\Startup\Internet Explorer.lnk
backup=c:\windows\pss\Internet Explorer.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ShowLOMControl]
[X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
2007-05-11 02:46 624248 —-a-w- c:\program files\Adobe\Acrobat 8.0\Acrobat\acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
2006-05-10 00:24 50760 —-a-w- c:\program files\Common Files\AOL\1145568053\ee\aolsoftware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IPHSend]
2006-02-17 16:59 124520 —-a-w- c:\program files\Common Files\AOL\IPHSend\IPHSend.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2008-10-01 23:57 289576 —-a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2008-09-06 20:09 413696 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2005-11-10 19:03 36975 —-a-w- c:\program files\Java\jre1.5.0_06\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPodService"=3 (0x3)
"Dpsixrnt"=3 (0x3)
"iPod Service"=3 (0x3)
"ewido anti-spyware 4.0 guard"=2 (0x2)
"LexBceS"=3 (0x3)
"AVG Anti-Spyware Guard"=2 (0x2)
"RegSrvc"=2 (0x2)
"IDriverT"=3 (0x3)
"Autodesk Licensing Service"=3 (0x3)
"Apple Mobile Device"=2 (0x2)
"Lavasoft Ad-Aware Service"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\1145568053\\ee\\aolsoftware.exe"=
"c:\\Program Files\\Common Files\\AOL\\1145568053\\ee\\aim6.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Motorola\\RSD Lite\\SDL.exe"=
"c:\\Program Files\\IMTools\\Trillian\\trillian.exe"=
"c:\\Program Files\\IMTools\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Adobe\\Adobe Dreamweaver CS4\\Dreamweaver.exe"=
"c:\\Program Files\\Adobe\\Adobe Photoshop Lightroom 2\\lightroom.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\WINDOWS\\twain_32\\Samsung\\ScanMgr.exe"=
"c:\\WINDOWS\\twain_32\\Samsung\\CLX3170\\Scan2Pc.exe"=
"c:\\WINDOWS\\twain_32\\Samsung\\CLX3170\\Sscan2io.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2/17/2009 2:06 AM 64160]
R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [11/30/2009 3:39 PM 207280]
R1 SASDIFSV;SASDIFSV;c:\program files\Virus Software\sasdifsv.sys [11/23/2009 8:43 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\Virus Software\SASKUTIL.SYS [11/23/2009 8:43 AM 74480]
R2 FreeAgentGoNext Service;Seagate Service;c:\program files\Seagate\SeagateManager\Sync\FreeAgentService.exe [9/25/2009 11:32 PM 189736]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [1/11/2008 3:05 PM 24652]
R3 SASENUM;SASENUM;c:\program files\Virus Software\SASENUM.SYS [11/23/2009 8:43 AM 7408]
S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys –> c:\windows\system32\Drivers\SSPORT.sys [?]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [11/30/2009 3:37 PM 358600]
S3 XIRLINK;Veo PC Camera;c:\windows\system32\drivers\ucdnt.sys [3/17/2008 12:01 PM 899884]
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Connection Wizard,ShellNext = https://login.live.com/ppsecure/md5auth.srf?lc=1033
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: - Download &this page with WebCloner - c:\program files\WebTools\ProductsFoundry\WebCloner Standard 2.4\addthis.htm
IE: - Download all &images with WebCloner - c:\program files\WebTools\ProductsFoundry\WebCloner Standard 2.4\addimg.htm
IE: - Download all &links with WebCloner - c:\program files\WebTools\ProductsFoundry\WebCloner Standard 2.4\addurl.htm
IE: - Download selected links with WebCloner - c:\program files\WebTools\ProductsFoundry\WebCloner Standard 2.4\addsellinks.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Download selected images with WebCloner - c:\program files\WebTools\ProductsFoundry\WebCloner Standard 2.4\addselimgs.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
IE: {{ADFCCE65-DF10-46fd-B04A-53CCBE2A0795} - c:\program files\WebTools\ProductsFoundry\WebCloner Standard 2.4\WebCloner.exe
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\Twice Bitten\Start Menu\Programs\IM\IMVU\Run IMVU.lnk
FF - ProfilePath - c:\documents and settings\Twice Bitten\Application Data\Mozilla\Firefox\Profiles\3d2gasfs.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - GOOGLE.COM
FF - component: c:\documents and settings\Twice Bitten\Application Data\Mozilla\Firefox\Profiles\3d2gasfs.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\platform\WINNT_x86-msvc\components\SSSLauncher.dll
FF - component: c:\documents and settings\Twice Bitten\Application Data\Mozilla\Firefox\Profiles\3d2gasfs.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - plugin: c:\documents and settings\Twice Bitten\Application Data\Mozilla\Firefox\Profiles\3d2gasfs.default\extensions\[removed]\platform\WINNT_x86-msvc\plugins\npmnqmp07061050.dll
FF - plugin: c:\progra~1\IMTools\Yahoo!\Common\npyaxmpb.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1739.5352\npCIDetect13.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJPI150_06.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPOJI610.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmnqmp07010901.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-12 18:18
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(980)
c:\program files\Virus Software\SASWINLO.dll
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
c:\windows\system32\igfxdev.dll
.
Completion time: 2009-12-12 18:23:20
ComboFix-quarantined-files.txt 2009-12-12 23:23
ComboFix2.txt 2009-12-12 21:55
ComboFix3.txt 2009-12-12 20:02
ComboFix4.txt 2009-12-12 17:46
ComboFix5.txt 2009-12-12 23:04

Pre-Run: 4,553,687,040 bytes free
Post-Run: 4,535,889,920 bytes free

Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4,5,6
- - End Of File - - 49B8ED2DF49F8AF83741DBADFC9CA1C1

CatByte

Post #15December 13, 2009, 12:08 AM UTC

Hi,

Please do the following:

Please open your MalwareBytes AntiMalware Program
Click the Update Tab and search for updates
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish, so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected. <– very important
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

NEXT

Run an on-line scan with Kaspersky

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:

Close any open programs
Turn off the real time scanner of any existing antivirus program while performing the online scan

3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.

Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View scan report at the bottom.

[external image: Posted Image]
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

In your next reply please include

MBAM Log
Kaspersky report

[Resolved] Malwarebytes Finds 2 hijack.windowsupdates files

✨ Ask AI

Ask AI