kaylove
Topic Starter
I was browsing a website when AVG popped up and showed that Trojan horse SHeur2.btys was detected. It's in my virus vault but I dont know if i should keep it there or delete. I read that this Trojan can recreate itself and become troublesome so I'm a little nervous. I just got done paying the Geeksquad way too much money to install a new hard drive and all of that good stuff so I wont be too excited if I have to go back. Everythings fine so far, no pop ups or anything but I'm scared to turn my laptop off. I did all of the steps, but I have a feeling I didnt do something right lol
ROOTREPEAL © AD, 2007-2009
==================================================
Scan Start Time: 2009/12/14 22:28
Program Version: Version 1.3.5.0
Windows Version: Windows Vista SP2
==================================================
Drivers
——————-
Name: dump_atapi.sys
Image Path: C:\Windows\System32\Drivers\dump_atapi.sys
Address: 0x8B352000 Size: 32768 File Visible: No Signed: -
Status: -
Name: dump_dumpata.sys
Image Path: C:\Windows\System32\Drivers\dump_dumpata.sys
Address: 0x8B347000 Size: 45056 File Visible: No Signed: -
Status: -
Name: rootrepeal.sys
Image Path: C:\Windows\system32\drivers\rootrepeal.sys
Address: 0x985D9000 Size: 49152 File Visible: No Signed: -
Status: -
Processes
——————-
Path: System
PID: 4 Status: Locked to the Windows API!
Path: C:\Windows\System32\audiodg.exe
PID: 1456 Status: Locked to the Windows API!
==EOF==
DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 22:10:03.38 on Mon 12/14/2009
Internet Explorer: 8.0.6001.18865
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.958.138 [GMT -8:00]
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
============== Running Processes ===============
C:\Windows\system32\wininit.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Windows\system32\lsm.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\rundll32.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Vongo\VongoService.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\AVG\AVG9\avgemc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\AVG\AVG9\avgtray.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\AVG\AVG9\avgui.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Robert\Downloads\dds.scr
============== Pseudo HJT Report ===============
uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=laptop
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=laptop
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=laptop
BHO: MRI_DISABLED - No File
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0\bin\ssv.dll
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [QPService] "c:\program files\hp\quickplay\QPService.exe"
mRun: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
mRun: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
mRun: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\mri_di~1\adober~1.lnk - c:\program files\adobe\reader 8.0\reader\reader_sl.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\mri_di~1\adober~2.lnk - c:\program files\adobe\reader 8.0\reader\AdobeCollabSync.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\mri_di~1\vongot~1.lnk - c:\windows\installer\{8c3ae2d1-854d-4650-a73d-c7cc7ee36b80}\NewShortcut2_DB7E00C96DEF489A8112D8F81614F45A.exe
uPolicies-explorer: NoDesktopCleanupWizard = 1 (0x1)
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0\bin\ssv.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
AppInit_DLLs: avgrsstx.dll
================= FIREFOX ===================
FF - ProfilePath - c:\users\robert\appdata\roaming\mozilla\firefox\profiles\rd1bme7z.default\
FF - component: c:\program files\avg\avg9\firefox\components\avgssff.dll
FF - plugin: c:\program files\java\jre1.6.0\bin\npjava11.dll
FF - plugin: c:\program files\java\jre1.6.0\bin\npjava12.dll
FF - plugin: c:\program files\java\jre1.6.0\bin\npjava13.dll
FF - plugin: c:\program files\java\jre1.6.0\bin\npjava14.dll
FF - plugin: c:\program files\java\jre1.6.0\bin\npjava32.dll
FF - plugin: c:\program files\java\jre1.6.0\bin\npjpi160.dll
FF - plugin: c:\program files\java\jre1.6.0\bin\npoji610.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
—- FIREFOX POLICIES —-
c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\mozilla firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
============= SERVICES / DRIVERS ===============
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-12-8 333192]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-12-8 360584]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\avg\avg9\avgemc.exe [2009-12-8 906520]
R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2009-12-8 285392]
S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2009-12-7 21504]
=============== Created Last 30 ================
2009-12-14 21:28 –d—– c:\program files\CleanUp!
2009-12-13 21:46 a-d—– c:\programdata\TEMP
2009-12-13 21:46 86,683 a——- c:\windows\system32\pthreadGC2.dll
2009-12-13 21:46 –d—– c:\program files\AoA Audio Extractor
2009-12-13 21:37 –d—– c:\users\robert\dwhelper
2009-12-12 16:21 –d—– c:\programdata\NVIDIA
2009-12-12 16:21 27,934 a——- c:\programdata\nvModes.dat
2009-12-12 16:21 27,934 a——- c:\progra~2\nvModes.dat
2009-12-12 13:38 24,064 a——- c:\windows\system32\nshhttp.dll
2009-12-12 13:38 411,648 a——- c:\windows\system32\drivers\http.sys
2009-12-12 13:38 30,720 a——- c:\windows\system32\httpapi.dll
2009-12-11 16:42 –d—– c:\program files\Windows Portable Devices
2009-12-11 16:42 0 a—h— c:\windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf
2009-12-11 16:17 2,048 a——- c:\windows\system32\tzres.dll
2009-12-11 16:16 1,164,800 a——- c:\windows\system32\UIRibbonRes.dll
2009-12-11 16:16 92,672 a——- c:\windows\system32\UIAnimation.dll
2009-12-11 16:16 3,023,360 a——- c:\windows\system32\UIRibbon.dll
2009-12-11 16:13 555,520 a——- c:\windows\system32\UIAutomationCore.dll
2009-12-11 16:13 234,496 a——- c:\windows\system32\oleacc.dll
2009-12-11 16:13 4,096 a——- c:\windows\system32\oleaccrc.dll
2009-12-11 16:10 –d—– c:\program files\Microsoft CAPICOM 2.1.0.2
2009-12-10 18:02 27,430 a——- c:\users\robert\appdata\roaming\nvModes.dat
2009-12-09 14:27 1,401,856 a——- c:\windows\system32\msxml6.dll
2009-12-09 14:27 1,248,768 a——- c:\windows\system32\msxml3.dll
2009-12-09 14:27 377,344 a——- c:\windows\system32\winhttp.dll
2009-12-09 14:27 71,680 a——- c:\windows\system32\atl.dll
2009-12-09 14:27 3,600,456 a——- c:\windows\system32\ntkrnlpa.exe
2009-12-09 14:27 3,548,216 a——- c:\windows\system32\ntoskrnl.exe
2009-12-09 14:27 714,240 a——- c:\windows\system32\timedate.cpl
2009-12-09 14:24 355,328 a——- c:\windows\system32\WSDApi.dll
2009-12-09 14:24 604,672 a——- c:\windows\system32\WMSPDMOD.DLL
2009-12-09 14:24 310,784 a——- c:\windows\system32\unregmp2.exe
2009-12-09 14:24 8,147,456 a——- c:\windows\system32\wmploc.DLL
2009-12-09 14:02 –d—– c:\program files\MSXML 4.0
2009-12-08 17:02 –d-h— C:\$AVG
2009-12-08 17:02 12,464 a——- c:\windows\system32\avgrsstx.dll
2009-12-08 17:02 360,584 a——- c:\windows\system32\drivers\avgtdix.sys
2009-12-08 17:02 333,192 a——- c:\windows\system32\drivers\avgldx86.sys
2009-12-08 17:02 –d—– c:\windows\system32\drivers\Avg
2009-12-08 17:01 –d—– c:\program files\AVG
2009-12-08 17:01 –d—– c:\programdata\avg9
2009-12-08 17:01 –d—– c:\progra~2\avg9
2009-12-08 16:35 –d—– c:\program files\CASIO
2009-12-08 16:10 –d—– c:\windows\system32\Service
2009-12-08 16:00 16 a——- c:\windows\system32\coh.cache
2009-12-07 21:36 57,667 a——- c:\windows\system32\ieuinit.inf
2009-12-07 21:29 –d—– c:\programdata\Geek Squad
2009-12-07 21:29 –d—– c:\progra~2\Geek Squad
2009-12-07 21:24 60,928 a——- c:\windows\system32\msasn1.dll
2009-12-07 21:24 218,624 a——- c:\windows\system32\msv1_0.dll
2009-12-07 21:23 43,520 a——- c:\windows\system32\msdxm.tlb
2009-12-07 21:23 18,432 a——- c:\windows\system32\amcompat.tlb
2009-12-07 21:23 4,096 a——- c:\windows\system32\msdxm.ocx
2009-12-07 21:23 4,096 a——- c:\windows\system32\dxmasf.dll
2009-12-07 21:23 7,680 a——- c:\windows\system32\spwmp.dll
2009-12-07 21:23 313,344 a——- c:\windows\system32\wmpdxm.dll
2009-12-07 21:22 28,672 a——- c:\windows\system32\Apphlpdm.dll
2009-12-07 21:22 4,240,384 a——- c:\windows\system32\GameUXLegacyGDFs.dll
2009-12-07 21:22 127,488 a——- c:\windows\system32\L2SecHC.dll
2009-12-07 21:21 2,501,921 a——- c:\windows\system32\wlan.tmf
2009-12-07 21:21 302,592 a——- c:\windows\system32\wlansec.dll
2009-12-07 21:21 293,376 a——- c:\windows\system32\wlanmsm.dll
2009-12-07 21:21 65,024 a——- c:\windows\system32\wlanapi.dll
2009-12-07 21:21 513,536 a——- c:\windows\system32\wlansvc.dll
2009-12-07 21:20 11,264 a——- c:\windows\system32\MRINFO.EXE
2009-12-07 21:20 17,920 a——- c:\windows\system32\netevent.dll
2009-12-07 21:20 27,136 a——- c:\windows\system32\NETSTAT.EXE
2009-12-07 21:20 19,968 a——- c:\windows\system32\ARP.EXE
2009-12-07 21:20 17,920 a——- c:\windows\system32\ROUTE.EXE
2009-12-07 21:20 10,240 a——- c:\windows\system32\finger.exe
2009-12-07 21:20 8,704 a——- c:\windows\system32\HOSTNAME.EXE
2009-12-07 21:20 105,984 a——- c:\windows\system32\netiohlp.dll
2009-12-07 21:20 30,720 a——- c:\windows\system32\drivers\tcpipreg.sys
2009-12-07 21:20 9,728 a——- c:\windows\system32\TCPSVCS.EXE
2009-12-07 21:20 904,776 a——- c:\windows\system32\drivers\tcpip.sys
2009-12-07 21:19 2,868,224 a——- c:\windows\system32\mf.dll
2009-12-07 21:18 1,259,008 a——- c:\windows\system32\lsasrv.dll
2009-12-07 21:18 499,712 a——- c:\windows\system32\kerberos.dll
2009-12-07 21:18 439,864 a——- c:\windows\system32\drivers\ksecdd.sys
2009-12-07 21:18 9,728 a——- c:\windows\system32\lsass.exe
2009-12-07 21:18 270,848 a——- c:\windows\system32\schannel.dll
2009-12-07 21:18 175,104 a——- c:\windows\system32\wdigest.dll
2009-12-07 21:18 72,704 a——- c:\windows\system32\secur32.dll
2009-12-07 21:17 289,792 a——- c:\windows\system32\atmfd.dll
2009-12-07 21:17 156,672 a——- c:\windows\system32\t2embed.dll
2009-12-07 21:17 72,704 a——- c:\windows\system32\fontsub.dll
2009-12-07 21:17 23,552 a——- c:\windows\system32\lpk.dll
2009-12-07 21:17 10,240 a——- c:\windows\system32\dciman32.dll
2009-12-07 21:17 2,066,432 a——- c:\windows\system32\mstscax.dll
2009-12-07 21:16 160,256 a——- c:\windows\system32\wkssvc.dll
2009-12-07 21:16 91,136 a——- c:\windows\system32\avifil32.dll
2009-12-07 21:14 784,896 a——- c:\windows\system32\rpcrt4.dll
2009-12-07 21:13 623,616 a——- c:\windows\system32\localspl.dll
2009-12-07 21:08 2,421,760 a——- c:\windows\system32\wucltux.dll
2009-12-07 21:08 87,552 a——- c:\windows\system32\wudriver.dll
2009-12-07 21:08 171,608 a——- c:\windows\system32\wuwebv.dll
2009-12-07 21:08 33,792 a——- c:\windows\system32\wuapp.exe
2009-12-07 20:40 –d—– c:\windows\system32\eu-ES
2009-12-07 20:40 –d—– c:\windows\system32\ca-ES
2009-12-07 20:40 –d—– c:\windows\system32\vi-VN
2009-12-07 20:37 0 a—h— c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2009-12-07 20:31 –d—– c:\windows\system32\SPReview
2009-12-07 20:19 928,768 a——- c:\windows\system32\scavenge.dll
2009-12-07 20:19 57,856 a——- c:\windows\system32\compcln.exe
2009-12-07 20:17 208,896 a——- c:\windows\system32\mfplat.dll
2009-12-07 20:15 –d—– c:\windows\system32\EventProviders
2009-12-07 19:50 –d—– C:\PerfLogs
2009-12-07 19:07 193,024 a——- c:\windows\system32\recdisc.exe
2009-12-07 19:07 6,656 a——- c:\windows\system32\sdspres.dll
2009-12-07 19:05 227,840 a——- c:\windows\system32\msconfig.exe
2009-12-07 19:04 1,118,720 a——- c:\windows\system32\WMADMOE.DLL
2009-12-07 19:02 6,656 a——- c:\windows\system32\kbd106n.dll
2009-12-07 19:00 49,152 a——- c:\windows\SPInstall.etl
2009-12-07 18:46 0 a–shr– c:\windows\system32\drivers\103C_HP_cNB_Pavilion dv6500 Notebook PC_Y5335KV_0U_QCNF7461SZ9_E445841-003_4A_I30CF_SQuanta_V85.17_F.07_T070809_WV3-0_L409_M959_J500_7AMD_8F81_91.80_#091207_N10DE054C_(GS662UA#ABA)_XMOBILE_CN10_Z_
2Rev 1.MRK
2009-12-07 18:40 81 a——- c:\windows\system32\LOG
2009-12-07 18:40 –d—– c:\users\Robert
2009-12-07 17:21 69,632 a——- c:\windows\system32\javacpl.cpl
2009-12-07 17:14 –d—– c:\programdata\Hewlett-Packard
2009-12-07 17:05 8,704 a——- c:\windows\system32\hccoin.dll
2009-12-07 17:04 22,632 a——- c:\windows\system32\streamci.dll
2009-12-07 17:02 272,384 a——- c:\windows\system32\ShellvRTF64.dll
2009-12-07 17:02 237,568 a——- c:\windows\system32\ShellvRTF.dll
2009-12-07 17:02 –d—– c:\windows\SMINST
2009-12-07 17:02 –d—– c:\program files\HPQ
2009-12-07 17:01 9,472 a——- c:\windows\system32\drivers\CPQBttn.sys
2009-12-07 17:01 8,192 a——- c:\windows\system32\drivers\eabfiltr.sys
2009-12-07 17:01 1,560,576 a——- c:\windows\system32\BttnCmns_64.dll
2009-12-07 17:01 1,560,576 a——- c:\windows\system32\BttnCmns.dll
2009-12-07 17:01 987,136 a——- c:\windows\system32\BttnCmn.dll
2009-12-07 17:00 –d—– c:\program files\Rhapsody
2009-12-07 16:55 –d—– c:\program files\Vongo
2009-12-07 16:55 –d—– c:\windows\Downloaded Installations
2009-12-07 16:54 –d—– c:\program files\muvee Technologies
2009-12-07 16:54 –d—– c:\program files\common files\muvee Technologies
2009-12-07 16:46 –d—– c:\programdata\WildTangent
2009-12-07 16:46 –d—– c:\program files\HP Games
2009-12-07 16:46 –d—– c:\progra~2\WildTangent
2009-12-07 16:45 –d—– c:\program files\Yahoo!
2009-12-07 16:43 –d—– c:\program files\earthlink totalaccess
2009-12-07 16:43 –d—– c:\program files\Online Services
2009-12-07 16:42 –d—– c:\programdata\Adobe
2009-12-07 16:41 –d—– c:\program files\common files\HP
2009-12-07 16:40 103,437 a——- c:\windows\hpqins13.dat
2009-12-07 16:40 –d—– c:\programdata\HP
2009-12-07 16:32 221,215 a——- c:\windows\system32\Divxdec.ax
2009-12-07 16:32 –d—– c:\programdata\CyberLink
2009-12-07 16:31 44,544 a——- c:\windows\system32\msxml4a.dll
2009-12-07 16:31 –d—– c:\program files\HP
2009-12-07 16:30 –d—– c:\programdata\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}
2009-12-07 16:30 –d—– c:\progra~2\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}
2009-12-07 16:30 –d—– c:\program files\Activation Assistant for the 2007 Microsoft Office suites
2009-12-07 16:29 32,592 a——- c:\windows\system32\msonpmon.dll
2009-12-07 16:28 –d—– c:\windows\PCHEALTH
2009-12-07 16:27 –d—– c:\programdata\Microsoft Help
2009-12-07 16:12 –d—– c:\programdata\Symantec
2009-12-07 16:12 –d—– c:\progra~2\Symantec
2009-12-07 16:12 –d—– c:\program files\common files\Symantec Shared
2009-12-07 16:12 –d—– c:\program files\common files\SureThing Shared
2009-12-07 16:10 –d—– c:\programdata\Roxio
2009-12-07 16:06 –d—– c:\program files\common files\Sonic Shared
2009-12-07 16:06 –d—– c:\programdata\Sonic
2009-12-07 16:06 –d—– c:\program files\Roxio
2009-12-07 15:48 –dsh— c:\windows\Installer
2009-12-07 15:41 –dsh— C:\$RECYCLE.BIN
2009-12-07 15:34 0 a—h— c:\windows\system32\drivers\Msft_Kernel_SynTP_01000.Wdf
2009-12-07 15:33 –d—– c:\program files\Synaptics
2009-12-07 15:31 1,732 a——- c:\windows\system32\drivers\nvphy.bin
2009-12-07 15:31 –d—– c:\program files\CONEXANT
2009-12-07 15:19 –d—– c:\windows\panther
2009-12-07 15:18 –d-h— C:\HP
==================== Find3M ====================
2009-12-12 13:41 143,360 a——- c:\windows\inf\infstrng.dat
2009-12-12 13:41 51,200 a——- c:\windows\inf\infpub.dat
2009-12-12 13:41 86,016 a——- c:\windows\inf\infstor.dat
2009-12-11 16:42 665,600 a——- c:\windows\inf\drvindex.dat
2009-12-07 20:04 174 a–sh— c:\program files\desktop.ini
2009-12-07 19:30 101,888 a——- c:\windows\system32\ifxcardm.dll
2009-12-07 19:30 82,432 a——- c:\windows\system32\axaltocm.dll
2009-11-20 22:40 916,480 a——- c:\windows\system32\wininet.dll
2009-11-20 22:34 109,056 a——- c:\windows\system32\iesysprep.dll
2009-11-20 22:34 71,680 a——- c:\windows\system32\iesetup.dll
2009-11-20 20:59 133,632 a——- c:\windows\system32\ieUnatt.exe
2009-10-07 03:36 243,712 a——- c:\windows\system32\rastls.dll
2009-09-30 17:02 2,537,472 a——- c:\windows\system32\wpdshext.dll
2009-09-30 17:02 30,208 a——- c:\windows\system32\WPDShextAutoplay.exe
2009-09-30 17:02 334,848 a——- c:\windows\system32\PortableDeviceApi.dll
2009-09-30 17:02 87,552 a——- c:\windows\system32\WPDShServiceObj.dll
2009-09-30 17:02 31,232 a——- c:\windows\system32\BthMtpContextHandler.dll
2009-09-30 17:01 546,816 a——- c:\windows\system32\wpd_ci.dll
2009-09-30 17:01 160,256 a——- c:\windows\system32\PortableDeviceTypes.dll
2009-09-30 17:01 350,208 a——- c:\windows\system32\WPDSp.dll
2009-09-30 17:01 196,608 a——- c:\windows\system32\PortableDeviceWMDRM.dll
2009-09-30 17:01 100,864 a——- c:\windows\system32\PortableDeviceClassExtension.dll
2009-09-30 17:01 60,928 a——- c:\windows\system32\PortableDeviceConnectApi.dll
2009-09-30 17:01 81,920 a——- c:\windows\system32\wpdbusenum.dll
2009-09-24 18:10 974,848 a——- c:\windows\system32\WindowsCodecs.dll
2009-09-24 18:07 189,440 a——- c:\windows\system32\WindowsCodecsExt.dll
2009-09-24 18:04 321,024 a——- c:\windows\system32\PhotoMetadataHandler.dll
2009-09-24 17:49 1,554,432 a——- c:\windows\system32\xpsservices.dll
2009-09-24 17:48 351,232 a——- c:\windows\system32\XpsPrint.dll
2009-09-24 17:38 847,360 a——- c:\windows\system32\OpcServices.dll
2009-09-24 17:36 280,064 a——- c:\windows\system32\XpsGdiConverter.dll
2009-09-24 17:35 135,680 a——- c:\windows\system32\XpsRasterService.dll
2009-09-24 17:33 195,584 a——- c:\windows\system32\dxdiagn.dll
2009-09-24 17:33 829,440 a——- c:\windows\system32\d3d10warp.dll
2009-09-24 17:33 369,664 a——- c:\windows\system32\WMPhoto.dll
2009-09-24 17:32 252,928 a——- c:\windows\system32\dxdiag.exe
2009-09-24 17:31 519,680 a——- c:\windows\system32\d3d11.dll
2009-09-24 17:31 486,912 a——- c:\windows\system32\d3d10level9.dll
2009-09-24 17:31 161,280 a——- c:\windows\system32\d3d10_1.dll
2009-09-24 17:31 218,112 a——- c:\windows\system32\d3d10_1core.dll
2009-09-24 17:31 1,030,144 a——- c:\windows\system32\d3d10.dll
2009-09-24 17:31 828,928 a——- c:\windows\system32\d2d1.dll
2009-09-24 17:30 481,792 a——- c:\windows\system32\dxgi.dll
2009-09-24 17:30 190,464 a——- c:\windows\system32\d3d10core.dll
2009-09-24 17:27 1,064,448 a——- c:\windows\system32\DWrite.dll
2009-09-24 17:27 793,088 a——- c:\windows\system32\FntCache.dll
2009-09-24 17:27 37,888 a——- c:\windows\system32\cdd.dll
2009-09-24 14:54 258,048 a——- c:\windows\system32\winspool.drv
2009-09-24 14:54 667,648 a——- c:\windows\system32\printfilterpipelinesvc.exe
2009-09-24 14:54 26,112 a——- c:\windows\system32\printfilterpipelineprxy.dll
2006-11-02 04:42 287,440 a——- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 04:42 287,440 a——- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 04:42 30,674 a——- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 04:42 30,674 a——- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 01:20 287,440 a——- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 01:20 287,440 a——- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 01:20 30,674 a——- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 01:20 30,674 a——- c:\windows\inf\perflib\0000\perfc.dat
============= FINISH: 22:11:48.39 ===============
