Hijacked Search Engines

+ 2010-05-28 08:51 . 2011-03-19 05:31 245760 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2009-07-14 04:54 . 2011-03-19 06:45 131072 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-09-21 01:04 . 2010-09-20 01:38 196608 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012010092020100921\index.dat
+ 2010-09-21 01:04 . 2010-09-20 01:38 507904 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012010091320100920\index.dat
+ 2010-09-17 01:03 . 2010-09-17 01:02 376832 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012010090620100913\index.dat
+ 2009-07-14 04:54 . 2011-03-19 06:45 409600 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-08-08 00:20 . 2010-08-08 00:20 262144 c:\windows\SysWOW64\config\RegBack\NTUSER.DAT
+ 2010-08-08 00:20 . 2010-08-08 00:20 262144 c:\windows\SysWOW64\config\Journal\NTUSER.DAT
+ 2009-07-13 23:44 . 2009-07-14 01:15 584704 c:\windows\SysWOW64\comuid.dll
+ 2009-07-13 23:44 . 2009-07-14 01:15 220160 c:\windows\SysWOW64\comsnap.dll
+ 2009-07-14 00:19 . 2009-07-14 01:15 276480 c:\windows\SysWOW64\compstui.dll
+ 2011-03-12 08:53 . 2010-11-20 12:18 485888 c:\windows\SysWOW64\comdlg32.dll
+ 2011-03-12 08:53 . 2010-11-20 12:18 530432 c:\windows\SysWOW64\comctl32.dll
+ 2009-07-13 23:44 . 2009-07-14 01:15 201216 c:\windows\SysWOW64\com\comadmin.dll
+ 2009-07-13 23:25 . 2009-07-14 01:15 606208 c:\windows\SysWOW64\colorui.dll
+ 2009-07-14 00:07 . 2009-07-14 01:15 153600 c:\windows\SysWOW64\COLORCNV.DLL
+ 2009-07-13 23:16 . 2009-07-14 01:15 304640 c:\windows\SysWOW64\cmipnpinstall.dll
+ 2009-07-13 23:54 . 2009-07-14 01:15 484352 c:\windows\SysWOW64\cmdial32.dll
+ 2011-03-12 08:53 . 2010-11-20 12:17 302592 c:\windows\SysWOW64\cmd.exe
+ 2011-03-12 08:52 . 2010-11-20 12:18 230912 c:\windows\SysWOW64\clusapi.dll
+ 2009-07-13 23:40 . 2009-07-14 01:14 212480 c:\windows\SysWOW64\cleanmgr.exe
+ 2009-07-13 23:44 . 2009-07-14 01:15 522240 c:\windows\SysWOW64\clbcatq.dll
+ 2009-07-13 23:29 . 2009-07-14 01:15 172544 c:\windows\SysWOW64\cic.dll
+ 2009-07-13 23:41 . 2009-07-14 01:14 155136 c:\windows\SysWOW64\charmap.exe
+ 2011-03-12 08:52 . 2010-11-20 12:18 145920 c:\windows\SysWOW64\cfgmgr32.dll
+ 2009-07-14 00:06 . 2009-07-14 01:15 210432 c:\windows\SysWOW64\cewmdm.dll
+ 2009-07-13 23:33 . 2009-07-14 01:14 889856 c:\windows\SysWOW64\certutil.exe
+ 2009-07-13 23:33 . 2009-07-14 01:14 263168 c:\windows\SysWOW64\certreq.exe
+ 2009-07-13 23:33 . 2009-07-14 01:15 271872 c:\windows\SysWOW64\CertEnrollUI.dll
+ 2009-07-13 23:32 . 2009-07-14 01:15 122880 c:\windows\SysWOW64\certCredProvider.dll
+ 2011-03-12 08:54 . 2010-11-20 12:18 342016 c:\windows\SysWOW64\certcli.dll
+ 2011-03-12 08:52 . 2010-11-20 12:18 805376 c:\windows\SysWOW64\cdosys.dll
+ 2009-06-18 18:58 . 2009-06-18 18:58 808440 c:\windows\SysWOW64\CDDBUI.dll
+ 2009-06-18 18:58 . 2009-06-18 18:58 103928 c:\windows\SysWOW64\CddbLangNL.dll
+ 2009-06-18 18:58 . 2009-06-18 18:58 108024 c:\windows\SysWOW64\CddbLangIT.dll
+ 2009-06-18 18:58 . 2009-06-18 18:58 103928 c:\windows\SysWOW64\CddbLangFR.dll
+ 2009-06-18 18:58 . 2009-06-18 18:58 103928 c:\windows\SysWOW64\CddbLangES.dll
+ 2009-06-18 18:58 . 2009-06-18 18:58 103928 c:\windows\SysWOW64\CddbLangDE.dll
+ 2009-06-18 18:58 . 2009-06-18 18:58 796152 c:\windows\SysWOW64\CDDBControl.dll
+ 2009-07-13 23:44 . 2009-07-14 01:15 487936 c:\windows\SysWOW64\catsrvut.dll
+ 2009-07-13 23:44 . 2009-07-14 01:15 449024 c:\windows\SysWOW64\catsrv.dll
+ 2009-05-11 04:27 . 2009-05-11 04:27 484496 c:\windows\SysWOW64\capicom.dll
+ 2011-03-12 08:53 . 2010-11-20 12:16 776192 c:\windows\SysWOW64\calc.exe
+ 2011-03-12 08:53 . 2010-11-20 12:18 132608 c:\windows\SysWOW64\cabview.dll
+ 2009-07-13 23:15 . 2009-07-14 01:15 221696 c:\windows\SysWOW64\C_G18030.DLL
+ 2011-03-12 08:52 . 2010-11-20 12:16 878592 c:\windows\SysWOW64\Bubbles.scr
+ 2010-12-15 19:38 . 2010-12-15 19:38 719360 c:\windows\SysWOW64\bmutil.dll
+ 2010-12-15 19:38 . 2010-12-15 19:38 471040 c:\windows\SysWOW64\bmnet.dll
+ 2010-12-15 19:38 . 2010-12-15 19:38 126976 c:\windows\SysWOW64\bmdumpd.bin
+ 2011-03-12 08:52 . 2010-11-20 12:18 743424 c:\windows\SysWOW64\blackbox.dll
+ 2011-03-12 08:52 . 2010-11-20 12:16 186368 c:\windows\SysWOW64\bitsadmin.exe
+ 2009-07-13 23:37 . 2009-07-14 01:14 171520 c:\windows\SysWOW64\BioCredProv.dll
+ 2009-07-13 23:33 . 2009-07-14 01:17 249680 c:\windows\SysWOW64\bcryptprimitives.dll
+ 2011-03-12 08:52 . 2010-11-20 12:18 740864 c:\windows\SysWOW64\batmeter.dll
+ 2011-03-12 08:53 . 2010-11-20 12:23 144768 c:\windows\SysWOW64\basecsp.dll
+ 2011-03-12 08:52 . 2010-11-20 12:18 314368 c:\windows\SysWOW64\azroleui.dll
+ 2011-03-12 08:53 . 2010-11-20 12:18 762880 c:\windows\SysWOW64\azroles.dll
+ 2011-03-12 08:53 . 2010-11-20 12:18 665600 c:\windows\SysWOW64\AuxiliaryDisplayCpl.dll
+ 2009-07-13 23:45 . 2009-07-14 01:14 119808 c:\windows\SysWOW64\AuxiliaryDisplayApi.dll
+ 2011-03-12 08:52 . 2010-11-20 12:18 146944 c:\windows\SysWOW64\autoplay.dll
+ 2011-03-12 08:53 . 2010-11-20 12:16 658944 c:\windows\SysWOW64\autofmt.exe
+ 2011-03-12 08:53 . 2010-11-20 12:16 679424 c:\windows\SysWOW64\autoconv.exe
+ 2011-03-12 08:53 . 2010-11-20 12:16 668160 c:\windows\SysWOW64\autochk.exe
+ 2009-07-13 22:11 . 2009-07-14 01:20 126976 c:\windows\SysWOW64\AuthFWWizFwk.dll
+ 2009-07-13 23:52 . 2009-07-14 01:14 297472 c:\windows\SysWOW64\AuthFWGP.dll
+ 2009-07-13 23:52 . 2009-07-14 01:14 334336 c:\windows\SysWOW64\authfwcfg.dll
+ 2010-09-18 06:13 . 2005-02-24 20:21 458752 c:\windows\SysWOW64\AudPlayer.dll
+ 2010-09-18 06:13 . 2005-02-24 17:11 479232 c:\windows\SysWOW64\AudioVisu.dll
+ 2011-03-12 08:53 . 2010-11-20 12:18 195584 c:\windows\SysWOW64\AudioSes.dll
+ 2010-09-18 06:13 . 2005-03-10 21:00 454656 c:\windows\SysWOW64\AudioRecord.dll
+ 2009-07-14 00:41 . 2009-07-14 01:16 442880 c:\windows\SysWOW64\AUDIOKSE.dll
+ 2010-07-27 06:29 . 2010-07-27 06:29 323584 c:\windows\SysWOW64\AUDIOGENIE2.DLL
+ 2009-07-14 00:03 . 2009-07-14 01:14 374784 c:\windows\SysWOW64\AudioEng.dll
+ 2011-03-12 08:52 . 2010-11-20 12:18 243712 c:\windows\SysWOW64\audiodev.dll
+ 2007-09-28 22:25 . 2006-06-11 13:36 114688 c:\windows\SysWOW64\audiocov.dll
+ 2010-09-18 06:13 . 2005-02-24 17:10 417792 c:\windows\SysWOW64\AudDisplay.dll
+ 2009-07-14 00:12 . 2009-07-14 01:14 200192 c:\windows\SysWOW64\apss.dll
+ 2011-03-12 08:53 . 2010-11-20 12:18 295936 c:\windows\SysWOW64\apphelp.dll
+ 2009-07-14 00:12 . 2009-07-14 01:14 221184 c:\windows\SysWOW64\apircl.dll
+ 2009-07-13 23:42 . 2009-07-14 01:14 126464 c:\windows\SysWOW64\advpack.dll
+ 2011-03-12 08:53 . 2010-11-20 12:18 640512 c:\windows\SysWOW64\advapi32.dll
+ 2009-07-14 00:12 . 2009-07-14 01:16 151040 c:\windows\SysWOW64\AdvancedInstallers\OEMHelpIns.dll
+ 2011-03-12 08:51 . 2010-11-20 12:18 120320 c:\windows\SysWOW64\AdvancedInstallers\cmiadapter.dll
+ 2009-07-13 23:11 . 2009-07-14 01:03 680448 c:\windows\SysWOW64\adtschema.dll
+ 2009-07-13 23:38 . 2009-07-14 01:14 260608 c:\windows\SysWOW64\adsnt.dll
+ 2009-07-13 23:38 . 2009-07-14 01:14 202752 c:\windows\SysWOW64\adsldpc.dll
+ 2011-03-12 08:52 . 2010-11-20 12:18 186880 c:\windows\SysWOW64\adsldp.dll
+ 2011-03-12 08:53 . 2010-11-20 12:18 309760 c:\windows\SysWOW64\actxprxy.dll
+ 2007-09-28 22:25 . 2007-05-09 17:22 238592 c:\windows\SysWOW64\ActSoft-Videos.dll
+ 2011-03-12 08:52 . 2010-11-20 12:18 202752 c:\windows\SysWOW64\activeds.dll
+ 2011-03-12 08:52 . 2010-11-20 12:18 537600 c:\windows\SysWOW64\ActionCenterCPL.dll
+ 2011-03-12 08:52 . 2010-11-20 12:18 744448 c:\windows\SysWOW64\ActionCenter.dll
+ 2009-07-13 23:41 . 2009-07-14 01:14 125440 c:\windows\SysWOW64\aclui.dll
+ 2011-03-12 08:53 . 2010-11-20 12:18 131584 c:\windows\SysWOW64\aaclient.dll
- 2009-07-14 02:36 . 2011-03-19 05:23 624178 c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2011-03-19 06:49 624178 c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2011-03-19 06:49 106522 c:\windows\system32\perfc009.dat
- 2009-07-14 02:36 . 2011-03-19 05:23 106522 c:\windows\system32\perfc009.dat
+ 2009-07-14 05:35 . 2009-06-10 21:52 720147 c:\windows\Speech\Engines\SR\en-US\tn1033.bin
+ 2009-07-14 05:35 . 2009-06-10 21:52 720833 c:\windows\Speech\Engines\SR\en-GB\tn2057.bin
+ 2008-08-07 15:50 . 2008-08-07 15:50 1261568 c:\windows\SysWOW64\ZDImage2pdf7.dll
+ 2011-03-12 08:53 . 2010-11-20 12:21 1712640 c:\windows\SysWOW64\xpsservices.dll
+ 2009-07-14 00:24 . 2009-07-14 01:14 3405312 c:\windows\SysWOW64\xpsrchvw.exe
+ 2011-03-12 08:53 . 2010-11-20 12:21 1175040 c:\windows\SysWOW64\WsmSvc.dll
+ 2009-07-13 23:29 . 2009-07-14 01:16 1294336 c:\windows\SysWOW64\wsecedit.dll
+ 2011-03-12 08:53 . 2010-11-20 12:21 2311168 c:\windows\SysWOW64\wpdshext.dll
+ 2009-07-14 00:09 . 2009-07-14 01:16 1568768 c:\windows\SysWOW64\WMVENCOD.DLL
+ 2011-03-12 08:53 . 2010-11-20 12:21 1619456 c:\windows\SysWOW64\WMVDECOD.DLL
+ 2011-03-12 08:53 . 2010-11-20 12:20 2504192 c:\windows\SysWOW64\WMVCORE.DLL
+ 2009-07-14 00:08 . 2009-07-14 01:16 1325056 c:\windows\SysWOW64\WMSPDMOE.DLL
+ 2011-03-12 08:53 . 2010-11-20 12:21 1624064 c:\windows\SysWOW64\WMPEncEn.dll
+ 2011-03-12 08:53 . 2010-11-20 12:21 1003008 c:\windows\SysWOW64\WMNetMgr.dll
+ 2011-03-12 08:53 . 2010-11-20 12:21 1326592 c:\windows\SysWOW64\wlanpref.dll
+ 2011-03-12 08:53 . 2010-11-20 12:21 1010688 c:\windows\SysWOW64\WindowsCodecs.dll
+ 2011-03-12 08:53 . 2010-11-20 12:21 1227776 c:\windows\SysWOW64\wdc.dll
+ 2011-03-12 08:54 . 2010-11-20 12:21 1128448 c:\windows\SysWOW64\vssapi.dll
+ 2010-02-16 08:51 . 2009-07-17 01:06 4961800 c:\windows\SysWOW64\vcredist_x64.exe
+ 2009-07-14 00:13 . 2009-07-14 01:14 1397248 c:\windows\SysWOW64\Utilman.exe
+ 2011-03-12 08:54 . 2010-11-20 12:21 1229824 c:\windows\SysWOW64\urlmon.dll
+ 2011-03-12 08:52 . 2010-11-20 12:07 1164800 c:\windows\SysWOW64\UIRibbonRes.dll
+ 2011-03-12 08:53 . 2010-11-20 12:21 2983424 c:\windows\SysWOW64\UIRibbon.dll
+ 2010-04-23 10:22 . 2010-04-23 10:22 2898232 c:\windows\SysWOW64\TVUAx\npTVUAx.dll
+ 2006-10-16 10:44 . 2006-10-16 10:44 1028096 c:\windows\SysWOW64\TVUAx\libeay32.dll
+ 2011-03-12 08:54 . 2010-11-20 12:21 1548288 c:\windows\SysWOW64\tquery.dll
+ 2011-03-12 08:53 . 2010-11-20 12:21 2755072 c:\windows\SysWOW64\themeui.dll
+ 2011-03-12 08:53 . 2010-11-20 12:21 2157568 c:\windows\SysWOW64\themecpl.dll
+ 2011-03-12 08:53 . 2010-11-20 12:21 2146304 c:\windows\SysWOW64\SyncCenter.dll
+ 2009-07-13 23:17 . 2009-07-14 01:10 8338432 c:\windows\SysWOW64\spwizimg.dll
+ 2009-07-13 23:36 . 2009-07-14 01:16 1111552 c:\windows\SysWOW64\sppcext.dll
+ 2011-03-12 08:52 . 2010-11-20 12:21 1202176 c:\windows\SysWOW64\Speech\Common\sapi.dll
+ 2011-03-12 08:53 . 2010-11-20 12:21 1667584 c:\windows\SysWOW64\setupapi.dll
+ 2011-03-12 08:53 . 2010-11-20 12:21 2202624 c:\windows\SysWOW64\SensorsCpl.dll
+ 2010-08-26 09:32 . 1999-10-15 16:50 1056768 c:\windows\SysWOW64\ROBOEX32.DLL
+ 2011-03-12 08:54 . 2010-11-20 12:21 1115136 c:\windows\SysWOW64\RacEngn.dll
+ 2011-03-12 08:53 . 2010-11-20 12:21 1363456 c:\windows\SysWOW64\Query.dll
+ 2011-03-12 08:53 . 2010-11-20 12:20 1328128 c:\windows\SysWOW64\quartz.dll
+ 2011-03-12 08:53 . 2010-11-20 12:20 1750528 c:\windows\SysWOW64\pnidui.dll
+ 2011-03-12 08:53 . 2010-11-20 12:20 1508864 c:\windows\SysWOW64\pla.dll
+ 2009-07-14 00:41 . 2009-07-14 01:16 1234944 c:\windows\SysWOW64\pidgenx.dll
+ 2011-03-12 08:52 . 2010-11-20 12:20 1160192 c:\windows\SysWOW64\OpcServices.dll
+ 2011-03-12 08:52 . 2010-11-20 12:20 1111552 c:\windows\SysWOW64\onexui.dll
+ 2011-03-12 08:54 . 2010-11-20 12:20 1414144 c:\windows\SysWOW64\ole32.dll
+ 2009-07-13 23:28 . 2009-07-14 01:16 1106944 c:\windows\SysWOW64\ogldrv.dll
+ 2011-03-12 08:54 . 2010-11-20 12:30 3911040 c:\windows\SysWOW64\ntoskrnl.exe
+ 2011-03-12 08:54 . 2010-11-20 12:30 3966848 c:\windows\SysWOW64\ntkrnlpa.exe
+ 2011-03-12 08:54 . 2010-11-20 12:24 1292096 c:\windows\SysWOW64\ntdll.dll
+ 2009-07-14 00:13 . 2009-07-14 01:09 5071872 c:\windows\SysWOW64\NlsModels0011.dll
+ 2009-07-14 00:13 . 2009-07-14 01:08 6917120 c:\windows\SysWOW64\NlsLexicons0c1a.dll
+ 2009-07-14 00:13 . 2009-07-14 01:08 7042560 c:\windows\SysWOW64\NlsLexicons081a.dll
+ 2009-07-14 00:13 . 2009-07-14 01:08 5031936 c:\windows\SysWOW64\NlsLexicons0816.dll
+ 2009-07-14 00:13 . 2009-07-14 01:08 5090816 c:\windows\SysWOW64\NlsLexicons0416.dll
+ 2009-07-14 00:13 . 2009-07-14 01:08 4616192 c:\windows\SysWOW64\NlsLexicons0414.dll
+ 2009-07-14 00:13 . 2009-07-14 01:08 1972736 c:\windows\SysWOW64\NlsLexicons004e.dll
+ 2009-07-14 00:13 . 2009-07-14 01:08 4093440 c:\windows\SysWOW64\NlsLexicons004c.dll
+ 2009-07-14 00:13 . 2009-07-14 01:08 1702912 c:\windows\SysWOW64\NlsLexicons004b.dll
+ 2009-07-14 00:13 . 2009-07-14 01:08 3419136 c:\windows\SysWOW64\NlsLexicons004a.dll
+ 2009-07-14 00:13 . 2009-07-14 01:08 1558016 c:\windows\SysWOW64\NlsLexicons0049.dll
+ 2009-07-14 00:13 . 2009-07-14 01:08 1411072 c:\windows\SysWOW64\NlsLexicons0047.dll
+ 2009-07-14 00:13 . 2009-07-14 01:08 1808896 c:\windows\SysWOW64\NlsLexicons0046.dll
+ 2009-07-14 00:13 . 2009-07-14 01:08 1793536 c:\windows\SysWOW64\NlsLexicons0045.dll
+ 2009-07-14 00:13 . 2009-07-14 01:08 4045824 c:\windows\SysWOW64\NlsLexicons003e.dll
+ 2009-07-14 00:13 . 2009-07-14 01:08 1782272 c:\windows\SysWOW64\NlsLexicons0039.dll
+ 2009-07-14 00:13 . 2009-07-14 01:08 6224896 c:\windows\SysWOW64\NlsLexicons0027.dll
+ 2009-07-14 00:13 . 2009-07-14 01:08 5791232 c:\windows\SysWOW64\NlsLexicons0026.dll
+ 2009-07-14 00:13 . 2009-07-14 01:08 7964672 c:\windows\SysWOW64\NlsLexicons0024.dll
+ 2009-07-14 00:13 . 2009-07-14 01:08 5499904 c:\windows\SysWOW64\NlsLexicons0022.dll
+ 2009-07-14 00:13 . 2009-07-14 01:08 2136064 c:\windows\SysWOW64\NlsLexicons0021.dll
+ 2009-07-14 00:13 . 2009-07-14 01:08 1236992 c:\windows\SysWOW64\NlsLexicons0020.dll
+ 2009-07-14 00:13 . 2009-07-14 01:08 6346240 c:\windows\SysWOW64\NlsLexicons001d.dll
+ 2009-07-14 00:13 . 2009-07-14 01:08 6585856 c:\windows\SysWOW64\NlsLexicons001b.dll
+ 2009-07-14 00:13 . 2009-07-14 01:08 6014976 c:\windows\SysWOW64\NlsLexicons001a.dll
+ 2009-07-14 00:13 . 2009-07-14 01:08 6781440 c:\windows\SysWOW64\NlsLexicons0019.dll
+ 2009-07-14 00:13 . 2009-07-14 01:08 3331072 c:\windows\SysWOW64\NlsLexicons0018.dll
+ 2009-07-14 00:13 . 2009-07-14 01:08 4981248 c:\windows\SysWOW64\NlsLexicons0013.dll
+ 2009-07-14 00:13 . 2009-07-14 01:08 2466816 c:\windows\SysWOW64\NlsLexicons0011.dll
+ 2009-07-14 00:13 . 2009-07-14 01:08 4175872 c:\windows\SysWOW64\NlsLexicons0010.dll
+ 2009-07-14 00:13 . 2009-07-14 01:08 5654528 c:\windows\SysWOW64\NlsLexicons000f.dll
+ 2009-07-14 00:13 . 2009-07-14 01:08 1722368 c:\windows\SysWOW64\NlsLexicons000d.dll
+ 2009-07-14 00:13 . 2009-07-14 01:08 6237696 c:\windows\SysWOW64\NlsLexicons000c.dll
+ 2009-07-14 00:13 . 2009-07-14 01:08 9892864 c:\windows\SysWOW64\NlsLexicons000a.dll
+ 2009-07-14 00:13 . 2009-07-14 01:08 2628608 c:\windows\SysWOW64\NlsLexicons0009.dll
+ 2009-07-14 00:13 . 2009-07-14 01:08 1452544 c:\windows\SysWOW64\NlsLexicons0003.dll
+ 2009-07-14 00:13 . 2009-07-14 01:08 4164096 c:\windows\SysWOW64\NlsLexicons0002.dll
+ 2009-07-14 00:13 . 2009-07-14 01:16 1977856 c:\windows\SysWOW64\NlsData0c1a.dll
+ 2009-07-14 00:13 . 2009-07-14 01:16 1977856 c:\windows\SysWOW64\NlsData081a.dll
+ 2009-07-14 00:13 . 2009-07-14 01:16 4507648 c:\windows\SysWOW64\NlsData0816.dll
+ 2009-07-14 00:13 . 2009-07-14 01:16 4507648 c:\windows\SysWOW64\NlsData0416.dll
+ 2009-07-14 00:13 . 2009-07-14 01:16 4507648 c:\windows\SysWOW64\NlsData0414.dll
+ 2009-07-14 00:13 . 2009-07-14 01:16 3116544 c:\windows\SysWOW64\NlsData004e.dll
+ 2009-07-14 00:13 . 2009-07-14 01:16 3116544 c:\windows\SysWOW64\NlsData004c.dll
+ 2009-07-14 00:13 . 2009-07-14 01:16 3116544 c:\windows\SysWOW64\NlsData004b.dll
+ 2009-07-14 00:13 . 2009-07-14 01:16 3116544 c:\windows\SysWOW64\NlsData004a.dll
+ 2009-07-14 00:13 . 2009-07-14 01:16 3116544 c:\windows\SysWOW64\NlsData0049.dll
+ 2009-07-14 00:13 . 2009-07-14 01:16 3116544 c:\windows\SysWOW64\NlsData0047.dll
+ 2009-07-14 00:13 . 2009-07-14 01:16 3116544 c:\windows\SysWOW64\NlsData0046.dll
+ 2009-07-14 00:13 . 2009-07-14 01:16 3116544 c:\windows\SysWOW64\NlsData0045.dll
+ 2009-07-14 00:13 . 2009-07-14 01:16 1811968 c:\windows\SysWOW64\NlsData003e.dll
+ 2009-07-14 00:13 . 2009-07-14 01:16 3116544 c:\windows\SysWOW64\NlsData0039.dll
+ 2009-07-14 00:13 . 2009-07-14 01:16 1811968 c:\windows\SysWOW64\NlsData002a.dll
+ 2009-07-14 00:13 . 2009-07-14 01:16 1979392 c:\windows\SysWOW64\NlsData0027.dll
+ 2009-07-14 00:13 . 2009-07-14 01:16 1977856 c:\windows\SysWOW64\NlsData0026.dll
+ 2009-07-14 00:13 . 2009-07-14 01:16 1977856 c:\windows\SysWOW64\NlsData0024.dll
+ 2009-07-14 00:13 . 2009-07-14 01:16 1811968 c:\windows\SysWOW64\NlsData0022.dll
+ 2009-07-14 00:13 . 2009-07-14 01:16 1811968 c:\windows\SysWOW64\NlsData0021.dll
+ 2009-07-14 00:13 . 2009-07-14 01:16 3116544 c:\windows\SysWOW64\NlsData0020.dll
+ 2009-07-14 00:13 . 2009-07-14 01:16 4507648 c:\windows\SysWOW64\NlsData001d.dll
+ 2009-07-14 00:13 . 2009-07-14 01:16 1977856 c:\windows\SysWOW64\NlsData001b.dll
+ 2009-07-14 00:13 . 2009-07-14 01:16 1977856 c:\windows\SysWOW64\NlsData001a.dll
+ 2009-07-14 00:13 . 2009-07-14 01:16 4509696 c:\windows\SysWOW64\NlsData0019.dll
+ 2009-07-14 00:13 . 2009-07-14 01:16 1977856 c:\windows\SysWOW64\NlsData0018.dll
+ 2009-07-14 00:13 . 2009-07-14 01:16 3476480 c:\windows\SysWOW64\NlsData0013.dll
+ 2009-07-14 00:13 . 2009-07-14 01:16 2670592 c:\windows\SysWOW64\NlsData0011.dll
+ 2009-07-14 00:13 . 2009-07-14 01:16 4507648 c:\windows\SysWOW64\NlsData0010.dll
+ 2009-07-14 00:13 . 2009-07-14 01:16 1977856 c:\windows\SysWOW64\NlsData000f.dll
+ 2009-07-14 00:13 . 2009-07-14 01:16 2353152 c:\windows\SysWOW64\NlsData000d.dll
+ 2009-07-14 00:13 . 2009-07-14 01:16 2654208 c:\windows\SysWOW64\NlsData000c.dll
+ 2009-07-14 00:13 . 2009-07-14 01:16 4888576 c:\windows\SysWOW64\NlsData0009.dll
+ 2009-07-14 00:13 . 2009-07-14 01:16 2255360 c:\windows\SysWOW64\NlsData0007.dll
+ 2009-07-14 00:13 . 2009-07-14 01:16 1977856 c:\windows\SysWOW64\NlsData0003.dll
+ 2009-07-14 00:13 . 2009-07-14 01:16 1977856 c:\windows\SysWOW64\NlsData0002.dll
+ 2009-07-14 00:13 . 2009-07-14 01:16 2609664 c:\windows\SysWOW64\NlsData0001.dll
+ 2009-07-14 00:13 . 2009-07-14 01:16 1537536 c:\windows\SysWOW64\NlsData0000.dll
+ 2011-03-12 08:52 . 2010-11-20 12:20 2130944 c:\windows\SysWOW64\networkmap.dll
+ 2011-03-12 08:52 . 2010-11-20 12:20 1661440 c:\windows\SysWOW64\networkexplorer.dll
+ 2011-03-12 08:53 . 2010-11-20 12:20 2494464 c:\windows\SysWOW64\netshell.dll
+ 2011-03-12 08:52 . 2010-11-20 12:20 1644032 c:\windows\SysWOW64\netcenter.dll
+ 2010-09-19 02:40 . 2005-05-18 15:52 1212416 c:\windows\SysWOW64\NCTAudioInformation2.dll
+ 2010-09-19 02:40 . 2005-05-17 16:37 1986560 c:\windows\SysWOW64\NCTAudioFile2.dll
+ 2011-03-12 08:54 . 2010-11-20 12:19 1390080 c:\windows\SysWOW64\msxml6.dll
+ 2009-07-21 05:05 . 2009-07-21 05:05 1348432 c:\windows\SysWOW64\msxml4.dll
+ 2011-03-12 08:53 . 2010-11-20 12:19 1236992 c:\windows\SysWOW64\msxml3.dll
+ 2011-03-12 08:53 . 2010-11-20 12:19 2291712 c:\windows\SysWOW64\MSVidCtl.dll
+ 2009-06-10 21:38 . 2009-07-14 01:15 1386496 c:\windows\SysWOW64\msvbvm60.dll
+ 2011-03-12 08:54 . 2010-11-20 12:19 3215872 c:\windows\SysWOW64\mstscax.dll
+ 2011-03-12 08:54 . 2010-11-20 12:17 1049600 c:\windows\SysWOW64\mstsc.exe
+ 2011-03-12 08:54 . 2010-11-20 12:19 1401344 c:\windows\SysWOW64\mssrch.dll
+ 2009-07-13 23:43 . 2009-07-14 01:14 6376960 c:\windows\SysWOW64\mspaint.exe
+ 2009-06-10 21:41 . 2009-07-14 01:15 2134016 c:\windows\SysWOW64\msmpeg2vdec.dll
+ 2009-07-13 21:03 . 2009-07-14 01:15 1589248 c:\windows\SysWOW64\msjet40.dll
+ 2011-03-12 08:53 . 2010-11-20 12:19 2341376 c:\windows\SysWOW64\msi.dll
+ 2011-02-10 08:26 . 2011-01-07 07:46 5980672 c:\windows\SysWOW64\mshtml.dll
+ 2009-07-14 00:04 . 2009-07-14 01:06 9053696 c:\windows\SysWOW64\mmres.dll
+ 2011-03-12 08:53 . 2010-11-20 12:19 2151936 c:\windows\SysWOW64\mmcndmgr.dll
+ 2009-07-13 23:32 . 2009-07-14 01:14 1401344 c:\windows\SysWOW64\mmc.exe
+ 2011-03-12 08:53 . 2010-11-20 12:19 8826880 c:\windows\SysWOW64\migwiz\wet.dll
+ 2009-07-13 23:17 . 2009-06-10 21:44 1445052 c:\windows\SysWOW64\migwiz\SFLISTXP.dat
+ 2009-06-10 21:44 . 2009-06-10 21:44 2119152 c:\windows\SysWOW64\migwiz\SFLISTW7.dat
+ 2009-07-13 23:17 . 2009-06-10 21:44 3225610 c:\windows\SysWOW64\migwiz\SFLISTLH.dat
+ 2011-03-12 08:54 . 2010-11-20 12:19 5766144 c:\windows\SysWOW64\migwiz\migcore.dll
+ 2010-02-16 09:08 . 2009-06-25 02:19 1047552 c:\windows\SysWOW64\MFC71u.dll
+ 2010-02-16 09:08 . 2009-06-25 02:19 1060864 c:\windows\SysWOW64\MFC71.dll
+ 2011-03-12 08:53 . 2010-11-20 12:19 1163264 c:\windows\SysWOW64\mfc42u.dll
+ 2009-07-14 00:14 . 2009-07-14 01:15 1136640 c:\windows\SysWOW64\mfc42.dll
+ 2011-03-12 08:54 . 2010-11-20 12:19 3207680 c:\windows\SysWOW64\mf.dll
+ 2010-01-27 01:07 . 2011-03-07 10:52 6053536 c:\windows\SysWOW64\Macromed\Flash\NPSWF32.dll
+ 2011-02-13 02:57 . 2006-12-20 23:06 1224704 c:\windows\SysWOW64\lxczserv.dll
+ 2007-04-05 07:59 . 2007-04-05 07:59 1187840 c:\windows\SysWOW64\ippvmv8-5.2.dll
+ 2007-04-05 09:07 . 2007-04-05 09:07 1314816 c:\windows\SysWOW64\ippvcv8-5.2.dll
+ 2007-04-05 07:27 . 2007-04-05 07:27 2658304 c:\windows\SysWOW64\ippsv8-5.2.dll
+ 2007-04-05 08:32 . 2007-04-05 08:32 1843200 c:\windows\SysWOW64\ippsrv8-5.2.dll
+ 2007-04-05 08:36 . 2007-04-05 08:36 1744896 c:\windows\SysWOW64\ippscv8-5.2.dll
+ 2007-04-05 09:00 . 2007-04-05 09:00 7442432 c:\windows\SysWOW64\ippmv8-5.2.dll
+ 2007-04-06 15:41 . 2007-04-06 15:41 6361088 c:\windows\SysWOW64\ippiv8-5.2.dll
+ 2007-04-05 08:55 . 2007-04-05 08:55 2859008 c:\windows\SysWOW64\ippcvv8-5.2.dll
+ 2007-04-05 08:53 . 2007-04-05 08:53 1347584 c:\windows\SysWOW64\ippccv8-5.2.dll
+ 2009-07-13 23:47 . 2009-07-14 01:07 7392768 c:\windows\SysWOW64\IME\IMETC10\applets\MSHWCHTRIME.dll
+ 2009-07-13 23:47 . 2009-07-14 01:07 7390208 c:\windows\SysWOW64\IME\imekr8\applets\mshwkorrIME.dll
+ 2011-03-12 08:52 . 2010-11-20 12:19 1013760 c:\windows\SysWOW64\IME\IMEJP10\IMJPTIP.DLL
+ 2009-07-13 23:26 . 2009-07-14 01:15 1300480 c:\windows\SysWOW64\IME\IMEJP10\imjpcus.dll
+ 2009-07-13 23:47 . 2009-07-14 01:07 7378432 c:\windows\SysWOW64\IME\IMEJP10\APPLETS\mshwjpnrIME.dll
+ 2010-02-16 10:23 . 2009-06-03 03:09 4231168 c:\windows\SysWOW64\igdumd32.dll
+ 2010-02-16 10:23 . 2009-06-03 02:56 3646464 c:\windows\SysWOW64\igd10umd32.dll
+ 2010-02-16 10:23 . 2009-06-03 02:41 6042112 c:\windows\SysWOW64\ig4icd32.dll
+ 2010-02-16 10:23 . 2009-06-03 02:42 3838976 c:\windows\SysWOW64\ig4dev32.dll
+ 2011-03-12 08:54 . 2010-11-20 12:19 2064384 c:\windows\SysWOW64\iertutil.dll
+ 2009-06-10 21:13 . 2009-06-10 21:13 3698584 c:\windows\SysWOW64\ieapfltr.dat
+ 2004-05-04 17:53 . 2004-05-04 17:53 1645320 c:\windows\SysWOW64\gdiplus.dll
+ 2009-07-13 23:42 . 2009-07-14 01:05 4240384 c:\windows\SysWOW64\GameUXLegacyGDFs.dll
+ 2011-03-12 08:53 . 2010-11-20 12:19 2576384 c:\windows\SysWOW64\gameux.dll
+ 2010-02-20 21:20 . 2010-02-20 21:20 1207144 c:\windows\SysWOW64\FM20.DLL
+ 2011-03-12 08:54 . 2010-11-20 12:19 1493504 c:\windows\SysWOW64\ExplorerFrame.dll
+ 2011-03-12 08:54 . 2010-11-20 12:17 2616320 c:\windows\SysWOW64\explorer.exe
+ 2011-03-12 08:54 . 2010-11-20 12:19 1698816 c:\windows\SysWOW64\esent.dll
+ 2009-07-14 05:35 . 2009-07-14 02:12 1617920 c:\windows\SysWOW64\en\AuthFWSnapIn.Resources.dll
+ 2011-03-12 08:53 . 2010-11-20 12:18 1400320 c:\windows\SysWOW64\DxpTaskSync.dll
+ 2011-03-12 08:54 . 2010-11-20 12:18 1371136 c:\windows\SysWOW64\dwmcore.dll
+ 2011-03-12 08:53 . 2010-11-20 12:18 1040384 c:\windows\SysWOW64\Display.dll
+ 2009-07-13 23:39 . 2009-07-14 01:15 1502720 c:\windows\SysWOW64\diskcopy.dll
+ 2011-03-12 08:54 . 2010-11-05 01:58 1130824 c:\windows\SysWOW64\dfshim.dll
+ 2009-07-13 23:23 . 2009-07-14 01:15 6278656 c:\windows\SysWOW64\DDORes.dll
+ 2011-03-12 08:53 . 2010-11-20 12:18 2522624 c:\windows\SysWOW64\dbgeng.dll
+ 1997-10-29 14:20 . 1997-10-29 14:20 1473808 c:\windows\SysWOW64\danim.dll
+ 2010-05-28 07:14 . 2009-09-04 21:29 1892184 c:\windows\SysWOW64\D3DX9_42.dll
+ 2010-02-16 09:13 . 2006-11-29 19:06 3426072 c:\windows\SysWOW64\d3dx9_32.dll
+ 2010-05-28 07:14 . 2006-09-28 20:05 2414360 c:\windows\SysWOW64\d3dx9_31.dll
+ 2010-07-11 19:47 . 2010-07-11 19:47 1846632 c:\windows\SysWOW64\D3DCompiler_41.dll
+ 2011-03-12 08:54 . 2010-11-20 12:18 1828352 c:\windows\SysWOW64\d3d9.dll
+ 2009-07-13 23:28 . 2009-07-14 01:15 1036800 c:\windows\SysWOW64\d3d8.dll
+ 2011-03-12 08:54 . 2010-11-20 12:18 1171456 c:\windows\SysWOW64\d3d10warp.dll
+ 2009-07-13 23:28 . 2009-07-14 01:15 1030144 c:\windows\SysWOW64\d3d10.dll
+ 2011-03-12 08:52 . 2010-11-20 12:18 1003520 c:\windows\SysWOW64\cryptui.dll
+ 2011-03-12 08:54 . 2010-11-20 12:18 1154048 c:\windows\SysWOW64\crypt32.dll
+ 2009-07-13 23:52 . 2009-07-14 01:15 1344512 c:\windows\SysWOW64\connect.dll
+ 2009-07-14 04:54 . 2011-03-19 06:45 3309568 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-13 23:45 . 2009-07-14 01:15 1242112 c:\windows\SysWOW64\comsvcs.dll
+ 2009-07-13 23:44 . 2009-07-14 01:04 1297408 c:\windows\SysWOW64\comres.dll
+ 2009-07-14 00:11 . 2009-07-14 01:15 6103040 c:\windows\SysWOW64\chtbrkr.dll
+ 2009-07-14 00:11 . 2009-07-14 01:15 1672192 c:\windows\SysWOW64\chsbrkr.dll
+ 2011-03-12 08:53 . 2010-11-20 12:18 1555456 c:\windows\SysWOW64\certmgr.dll
+ 2011-03-12 08:54 . 2010-11-20 12:18 1334272 c:\windows\SysWOW64\CertEnroll.dll
+ 2011-03-12 08:53 . 2010-11-20 12:18 1792000 c:\windows\SysWOW64\authui.dll
+ 2011-03-12 08:54 . 2010-11-20 12:32 5066752 c:\windows\SysWOW64\AuthFWSnapin.dll
+ 2010-09-18 06:13 . 2005-02-24 17:11 1212416 c:\windows\SysWOW64\AudioInfos.dll
+ 2010-09-18 06:13 . 2005-03-11 22:37 1986560 c:\windows\SysWOW64\AudFile.dll
+ 2010-09-18 06:13 . 2005-02-24 17:10 2084864 c:\windows\SysWOW64\AudDesign.dll
+ 2009-07-14 00:12 . 2009-07-14 01:14 1739776 c:\windows\SysWOW64\apds.dll
+ 2011-03-12 08:51 . 2010-11-20 12:18 2041344 c:\windows\SysWOW64\AdvancedInstallers\cmiv2.dll
+ 2011-03-12 08:52 . 2010-11-20 12:18 3727872 c:\windows\SysWOW64\accessibilitycpl.dll
+ 2011-03-12 08:52 . 2010-11-20 12:08 12625408 c:\windows\SysWOW64\wmploc.DLL
+ 2011-03-12 08:54 . 2010-11-20 12:21 11410432 c:\windows\SysWOW64\wmp.dll
+ 2011-03-12 08:54 . 2010-11-20 12:21 12872192 c:\windows\SysWOW64\shell32.dll
+ 2009-07-14 00:13 . 2009-07-14 01:08 12038656 c:\windows\SysWOW64\NlsLexicons0007.dll
+ 2009-07-14 00:13 . 2009-07-14 01:08 11722752 c:\windows\SysWOW64\NlsLexicons0001.dll
+ 2009-07-14 00:13 . 2009-07-14 01:16 10240512 c:\windows\SysWOW64\NlsData000a.dll
+ 2009-07-13 23:42 . 2009-07-14 01:06 20268032 c:\windows\SysWOW64\imageres.dll
+ 2011-03-12 08:54 . 2010-11-20 12:19 10990080 c:\windows\SysWOW64\ieframe.dll
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SharingPrivate]
@="{08244EE6-92F0-47f2-9FC9-929BAA2E7235}"
[HKEY_CLASSES_ROOT\CLSID\{08244EE6-92F0-47f2-9FC9-929BAA2E7235}]
2010-11-20 12:20 442880 —-a-w- c:\windows\System32\ntshrui.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"DellSupportCenter"="c:\program files (x86)\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
"VirtualCloneDrive"="c:\program files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2009-06-17 85160]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-09-08 421888]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"Nuance OmniPage 17-reminder"="c:\program files (x86)\Nuance\OmniPage17\Ereg\Ereg.exe" [2008-11-03 54560]
"Sprint SmartView"="c:\program files (x86)\Sprint\Sprint SmartView\SprintSV.exe" [2010-12-15 75072]
"RDVCHG"="c:\program files (x86)\Sprint\Sprint SmartView\RDVCHG.exe" [2010-12-15 316736]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-12-20 443728]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-02-23 3451496]
"PDFHook"="c:\program files (x86)\Nuance\PDF Professional 6\pdfpro6hook.exe" [2009-07-01 1273856]
"PDF6 Registry Controller"="c:\program files (x86)\Nuance\PDF Professional 6\RegistryController.exe" [2009-06-30 111904]
"Nuance PDF Professional 6-reminder"="c:\program files (x86)\Nuance\PDF Professional 6\Ereg\Ereg.exe" [2008-11-03 54560]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\program files (x86)\Dell DataSafe Local Backup\Components\scheduler\Launcher.exe" [2010-07-21 165184]
.
c:\users\TJ54\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-9-21 1316192]
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files (x86)\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
OpenOffice.org 3.3.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-9-21 1316192]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\EFS]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Power]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\RpcEptMapper]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]
@="IEEE 1394 Bus host controllers"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]
@="SBP2 IEEE 1394 Devices"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]
@="SecurityDevices"
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 MMCSS;Multimedia Class Scheduler;c:\windows\system32\svchost.exe [2009-07-14 27136]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
R2 sppsvc;Software Protection;c:\windows\system32\sppsvc.exe [x]
R3 1394ohci;1394 OHCI Compliant Host Controller;c:\windows\system32\drivers\1394ohci.sys [x]
R3 AcpiPmi;ACPI Power Meter Driver;c:\windows\system32\drivers\acpipmi.sys [x]
R3 adp94xx;adp94xx;c:\windows\system32\DRIVERS\adp94xx.sys [x]
R3 adpahci;adpahci;c:\windows\system32\DRIVERS\adpahci.sys [x]
R3 amdsata;amdsata;c:\windows\system32\drivers\amdsata.sys [x]
R3 amdsbs;amdsbs;c:\windows\system32\DRIVERS\amdsbs.sys [x]
R3 AppID;AppID Driver;c:\windows\system32\drivers\appid.sys [x]
R3 AppIDSvc;Application Identity;c:\windows\system32\svchost.exe [2009-07-14 27136]
R3 Appinfo;Application Information;c:\windows\system32\svchost.exe [2009-07-14 27136]
R3 appliand;Applian Network Service;c:\windows\system32\DRIVERS\appliand.sys [x]
R3 arcsas;arcsas;c:\windows\system32\DRIVERS\arcsas.sys [x]
R3 b06bdrv;Broadcom NetXtreme II VBD;c:\windows\system32\DRIVERS\bxvbda.sys [x]
R3 b57nd60a;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\b57nd60a.sys [x]
R3 BDESVC;BitLocker Drive Encryption Service;c:\windows\System32\svchost.exe [2009-07-14 27136]
R3 BrFiltLo;Brother USB Mass-Storage Lower Filter Driver;c:\windows\system32\DRIVERS\BrFiltLo.sys [x]
R3 BrFiltUp;Brother USB Mass-Storage Upper Filter Driver;c:\windows\system32\DRIVERS\BrFiltUp.sys [x]
R3 Brserid;Brother MFC Serial Port Interface Driver (WDM);c:\windows\System32\Drivers\Brserid.sys [x]
R3 BrSerWdm;Brother WDM Serial driver;c:\windows\System32\Drivers\BrSerWdm.sys [x]
R3 BrUsbMdm;Brother MFC USB Fax Only Modem;c:\windows\System32\Drivers\BrUsbMdm.sys [x]
R3 CASprint;Sprint Con App Svc;c:\program files (x86)\Sprint\Sprint SmartView\ConAppsSvc.exe [2010-12-15 124224]
R3 CertPropSvc;Certificate Propagation;c:\windows\system32\svchost.exe [2009-07-14 27136]
R3 circlass;Consumer IR Devices;c:\windows\system32\DRIVERS\circlass.sys [x]
R3 defragsvc;Disk Defragmenter;c:\windows\system32\svchost.exe [2009-07-14 27136]
R3 ebdrv;Broadcom NetXtreme II 10 GigE VBD;c:\windows\system32\DRIVERS\evbda.sys [x]
R3 elxstor;elxstor;c:\windows\system32\DRIVERS\elxstor.sys [x]
R3 fdPHost;Function Discovery Provider Host;c:\windows\system32\svchost.exe [2009-07-14 27136]
R3 FDResPub;Function Discovery Resource Publication;c:\windows\system32\svchost.exe [2009-07-14 27136]
R3 Filetrace;Filetrace;c:\windows\system32\drivers\filetrace.sys [x]
R3 FsDepends;File System Dependency Minifilter;c:\windows\system32\drivers\FsDepends.sys [x]
R3 hcw85cir;Hauppauge Consumer Infrared Receiver;c:\windows\system32\drivers\hcw85cir.sys [x]
R3 HomeGroupListener;HomeGroup Listener;c:\windows\System32\svchost.exe [2009-07-14 27136]
R3 HomeGroupProvider;HomeGroup Provider;c:\windows\System32\svchost.exe [2009-07-14 27136]
R3 HpSAMD;HpSAMD;c:\windows\system32\drivers\HpSAMD.sys [x]
R3 iaStorV;Intel RAID Controller Windows 7;c:\windows\system32\drivers\iaStorV.sys [x]
R3 IPBusEnum;PnP-X IP Bus Enumerator;c:\windows\system32\svchost.exe [2009-07-14 27136]
R3 IPMIDRV;IPMIDRV;c:\windows\system32\drivers\IPMIDrv.sys [x]
R3 iScsiPrt;iScsiPort Driver;c:\windows\system32\drivers\msiscsi.sys [x]
R3 JakNDis;Jaksta Service;c:\windows\system32\DRIVERS\JakNDis.sys [x]
R3 KtmRm;KtmRm for Distributed Transaction Coordinator;c:\windows\System32\svchost.exe [2009-07-14 27136]
R3 lltdsvc;Link-Layer Topology Discovery Mapper;c:\windows\System32\svchost.exe [2009-07-14 27136]
R3 LSI_FC;LSI_FC;c:\windows\system32\DRIVERS\lsi_fc.sys [x]
R3 LSI_SAS;LSI_SAS;c:\windows\system32\DRIVERS\lsi_sas.sys [x]
R3 LSI_SAS2;LSI_SAS2;c:\windows\system32\DRIVERS\lsi_sas2.sys [x]
R3 LSI_SCSI;LSI_SCSI;c:\windows\system32\DRIVERS\lsi_scsi.sys [x]
R3 megasas;megasas;c:\windows\system32\DRIVERS\megasas.sys [x]
R3 mpio;Microsoft Multi-Path Bus Driver;c:\windows\system32\drivers\mpio.sys [x]
R3 msahci;msahci;c:\windows\system32\drivers\msahci.sys [x]
R3 msdsm;Microsoft Multi-Path Device Specific Module;c:\windows\system32\drivers\msdsm.sys [x]
R3 mshidkmdf;Pass-through HID to KMDF Filter Driver;c:\windows\System32\drivers\mshidkmdf.sys [x]
R3 MSiSCSI;Microsoft iSCSI Initiator Service;c:\windows\system32\svchost.exe [2009-07-14 27136]
R3 MsRPC;MsRPC; [x]
R3 MTConfig;Microsoft Input Configuration Driver;c:\windows\system32\DRIVERS\MTConfig.sys [x]
R3 NdisCap;NDIS Capture LightWeight Filter;c:\windows\system32\DRIVERS\ndiscap.sys [x]
R3 nfrd960;nfrd960;c:\windows\system32\DRIVERS\nfrd960.sys [x]
R3 nvstor;nvstor;c:\windows\system32\drivers\nvstor.sys [x]
R3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver;c:\windows\system32\DRIVERS\nwusbser2.sys [x]
R3 PCASp50a64;PCASp50a64 NDIS Protocol Driver;c:\windows\system32\Drivers\PCASp50a64.sys [2009-03-31 41280]
R3 PCTINDIS5X64;PCTINDIS5X64 NDIS Protocol Driver;c:\windows\system32\PCTINDIS5X64.SYS [x]
R3 PerfHost;Performance Counter DLL Host;c:\windows\SysWow64\perfhost.exe [2009-07-14 20992]
R3 pla;Performance Logs & Alerts;c:\windows\System32\svchost.exe [2009-07-14 27136]
R3 PNRPAutoReg;PNRP Machine Name Publication Service;c:\windows\System32\svchost.exe [2009-07-14 27136]
R3 ql2300;ql2300;c:\windows\system32\DRIVERS\ql2300.sys [x]
R3 ql40xx;ql40xx;c:\windows\system32\DRIVERS\ql40xx.sys [x]
R3 rdpbus;Remote Desktop Device Redirector Bus Driver;c:\windows\system32\DRIVERS\rdpbus.sys [x]
R3 scfilter;Smart card PnP Class Filter Driver;c:\windows\system32\DRIVERS\scfilter.sys [x]
R3 SCPolicySvc;Smart Card Removal Policy;c:\windows\system32\svchost.exe [2009-07-14 27136]
R3 SDRSVC;Windows Backup;c:\windows\system32\svchost.exe [2009-07-14 27136]
R3 SensrSvc;Adaptive Brightness;c:\windows\system32\svchost.exe [2009-07-14 27136]
R3 SessionEnv;Remote Desktop Configuration;c:\windows\System32\svchost.exe [2009-07-14 27136]
R3 sffp_mmc;SFF Storage Protocol Driver for MMC;c:\windows\system32\drivers\sffp_mmc.sys [x]
R3 SiSRaid4;SiSRaid4;c:\windows\system32\DRIVERS\sisraid4.sys [x]
R3 Smb;Message-oriented TCP/IP and TCP/IPv6 Protocol (SMB session);c:\windows\system32\DRIVERS\smb.sys [x]
R3 sppuinotify;SPP Notification Service;c:\windows\system32\svchost.exe [2009-07-14 27136]
R3 stexstor;stexstor;c:\windows\system32\DRIVERS\stexstor.sys [x]
R3 TabletInputService;Tablet PC Input Service;c:\windows\System32\svchost.exe [2009-07-14 27136]
R3 TBS;TPM Base Services;c:\windows\System32\svchost.exe [2009-07-14 27136]
R3 THREADORDER;Thread Ordering Server;c:\windows\system32\svchost.exe [2009-07-14 27136]
R3 TrustedInstaller;Windows Modules Installer;c:\windows\servicing\TrustedInstaller.exe [2010-11-20 194048]
R3 tssecsrv;Remote Desktop Services Security Filter Driver;c:\windows\system32\DRIVERS\tssecsrv.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 UI0Detect;Interactive Services Detection;c:\windows\system32\UI0Detect.exe [x]
R3 uliagpkx;Uli AGP Bus Filter;c:\windows\system32\drivers\uliagpkx.sys [x]
R3 usbcir;eHome Infrared Receiver (USBCIR);c:\windows\system32\drivers\usbcir.sys [x]
R3 VaultSvc;Credential Manager;c:\windows\system32\lsass.exe [x]
R3 vhdmp;vhdmp;c:\windows\system32\drivers\vhdmp.sys [x]
R3 vsmraid;vsmraid;c:\windows\system32\DRIVERS\vsmraid.sys [x]
R3 vwifibus;Virtual WiFi Bus Driver;c:\windows\system32\DRIVERS\vwifibus.sys [x]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
R3 WacomPen;Wacom Serial Pen HID Driver;c:\windows\system32\DRIVERS\wacompen.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 wbengine;Block Level Backup Engine Service;c:\windows\system32\wbengine.exe [x]
R3 WbioSrvc;Windows Biometric Service;c:\windows\system32\svchost.exe [2009-07-14 27136]
R3 wcncsvc;Windows Connect Now - Config Registrar;c:\windows\System32\svchost.exe [2009-07-14 27136]
R3 WcsPlugInService;Windows Color System;c:\windows\system32\svchost.exe [2009-07-14 27136]
R3 Wd;Wd;c:\windows\system32\DRIVERS\wd.sys [x]
R3 Wecsvc;Windows Event Collector;c:\windows\system32\svchost.exe [2009-07-14 27136]
R3 wercplsupport;Problem Reports and Solutions Control Panel Support;c:\windows\System32\svchost.exe [2009-07-14 27136]
R3 WerSvc;Windows Error Reporting Service;c:\windows\System32\svchost.exe [2009-07-14 27136]
R3 WIMMount;WIMMount;c:\windows\system32\drivers\wimmount.sys [2009-07-14 22096]
R3 WinRM;Windows Remote Management (WS-Management);c:\windows\System32\svchost.exe [2009-07-14 27136]
R3 WPCSvc;Parental Controls;c:\windows\system32\svchost.exe [2009-07-14 27136]
R3 WPDBusEnum;Portable Device Enumerator Service;c:\windows\system32\svchost.exe [2009-07-14 27136]
R3 WwanSvc;WWAN AutoConfig;c:\windows\system32\svchost.exe [2009-07-14 27136]
R4 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64;c:\windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [2009-06-10 89920]
R4 Mcx2Svc;Media Center Extender Service;c:\windows\system32\svchost.exe [2009-07-14 27136]
R4 WinDefend;Windows Defender;c:\windows\System32\svchost.exe [2009-07-14 27136]
S0 amdxata;amdxata;c:\windows\system32\drivers\amdxata.sys [x]
S0 CLFS;Common Log (CLFS);c:\windows\System32\CLFS.sys [x]
S0 CNG;CNG;c:\windows\System32\Drivers\cng.sys [x]
S0 FileInfo;File Information FS MiniFilter;c:\windows\system32\drivers\fileinfo.sys [x]
S0 fvevol;Bitlocker Drive Encryption Filter Driver;c:\windows\System32\DRIVERS\fvevol.sys [x]
S0 hwpolicy;Hardware Policy Driver;c:\windows\System32\drivers\hwpolicy.sys [x]
S0 KSecPkg;KSecPkg;c:\windows\System32\Drivers\ksecpkg.sys [x]
S0 msisadrv;msisadrv;c:\windows\system32\drivers\msisadrv.sys [x]
S0 pcw;Performance Counters for Windows Driver;c:\windows\System32\drivers\pcw.sys [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]
S0 rdyboost;ReadyBoost;c:\windows\System32\drivers\rdyboost.sys [x]
S0 spldr;Security Processor Loader Driver; [x]
S0 vdrvroot;Microsoft Virtual Drive Enumerator Driver;c:\windows\system32\drivers\vdrvroot.sys [x]
S0 volmgr;Volume Manager Driver;c:\windows\system32\drivers\volmgr.sys [x]
S0 volmgrx;Dynamic Volume Manager;c:\windows\System32\drivers\volmgrx.sys [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 blbdrive;blbdrive;c:\windows\system32\DRIVERS\blbdrive.sys [x]
S1 DfsC;DFS Namespace Client Driver;c:\windows\system32\Drivers\dfsc.sys [x]
S1 discache;System Attribute Cache;c:\windows\system32\drivers\discache.sys [x]
S1 nsiproxy;NSI proxy service driver.;c:\windows\system32\drivers\nsiproxy.sys [x]
S1 RDPENCDD;RDP Encoder Mirror Driver;c:\windows\system32\drivers\rdpencdd.sys [x]
S1 RDPREFMP;Reflector Display Driver used to gain access to graphics data;c:\windows\system32\drivers\rdprefmp.sys [x]
S1 tdx;NetIO Legacy TDI Support Driver;c:\windows\system32\DRIVERS\tdx.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S1 Wanarpv6;Remote Access IPv6 ARP Driver;c:\windows\system32\DRIVERS\wanarp.sys [x]
S1 WfpLwf;WFP Lightweight Filter;c:\windows\system32\DRIVERS\wfplwf.sys [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [x]
S2 AudioEndpointBuilder;Windows Audio Endpoint Builder;c:\windows\System32\svchost.exe [2009-07-14 27136]
S2 BFE;Base Filtering Engine;c:\windows\system32\svchost.exe [2009-07-14 27136]
S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2009-06-09 155648]
S2 DPS;Diagnostic Policy Service;c:\windows\System32\svchost.exe [2009-07-14 27136]
S2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe [2009-07-14 27136]
S2 gpsvc;Group Policy Client;c:\windows\system32\svchost.exe [2009-07-14 27136]
S2 IKEEXT;IKE and AuthIP IPsec Keying Modules;c:\windows\system32\svchost.exe [2009-07-14 27136]
S2 iphlpsvc;IP Helper;c:\windows\System32\svchost.exe [2009-07-14 27136]
S2 lltdio;Link-Layer Topology Discovery Mapper I/O Driver;c:\windows\system32\DRIVERS\lltdio.sys [x]
S2 luafv;UAC File Virtualization;c:\windows\system32\drivers\luafv.sys [x]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2010-12-20 363344]
S2 MpsSvc;Windows Firewall;c:\windows\system32\svchost.exe [2009-07-14 27136]
S2 NlaSvc;Network Location Awareness;c:\windows\System32\svchost.exe [2009-07-14 27136]
S2 nsi;Network Store Interface Service;c:\windows\system32\svchost.exe [2009-07-14 27136]
S2 NvtlService;NovaCore SDK Service;c:\program files (x86)\Novatel Wireless\Novacore\Server\NvtlSrvr.exe [2010-01-11 82944]
S2 PcaSvc;Program Compatibility Assistant Service;c:\windows\system32\svchost.exe [2009-07-14 27136]
S2 PDFProFiltSrv;PDFProFiltSrv;c:\program files (x86)\Nuance\PDF Professional 6\PDFProFiltSrv.exe [2009-06-30 134944]
S2 PEAUTH;PEAUTH;c:\windows\system32\drivers\peauth.sys [x]
S2 Power;Power;c:\windows\system32\svchost.exe [2009-07-14 27136]
S2 ProfSvc;User Profile Service;c:\windows\system32\svchost.exe [2009-07-14 27136]
S2 RpcEptMapper;RPC Endpoint Mapper;c:\windows\system32\svchost.exe [2009-07-14 27136]
S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2010-08-20 689472]
S2 SysMain;Superfetch;c:\windows\system32\svchost.exe [2009-07-14 27136]
S2 tcpipreg;TCP/IP Registry Compatibility;c:\windows\system32\drivers\tcpipreg.sys [x]
S2 UxSms;Desktop Window Manager Session Manager;c:\windows\System32\svchost.exe [2009-07-14 27136]
S2 Wlansvc;WLAN AutoConfig;c:\windows\system32\svchost.exe [2009-07-14 27136]
S3 appliandMP;appliandMP;c:\windows\system32\DRIVERS\appliand.sys [x]
S3 bowser;Browser Support Driver;c:\windows\system32\DRIVERS\bowser.sys [x]
S3 CompositeBus;Composite Bus Enumerator Driver;c:\windows\system32\drivers\CompositeBus.sys [x]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [x]
S3 DXGKrnl;LDDM Graphics Subsystem;c:\windows\System32\drivers\dxgkrnl.sys [x]
S3 JakNDisMP;JakNDisMP;c:\windows\system32\DRIVERS\JakNDis.sys [x]
S3 KeyIso;CNG Key Isolation;c:\windows\system32\lsass.exe [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 monitor;Microsoft Monitor Class Function Driver Service;c:\windows\system32\DRIVERS\monitor.sys [x]
S3 mpsdrv;Windows Firewall Authorization Driver;c:\windows\system32\drivers\mpsdrv.sys [x]
S3 mrxsmb10;SMB 1.x MiniRedirector;c:\windows\system32\DRIVERS\mrxsmb10.sys [x]
S3 mrxsmb20;SMB 2.0 MiniRedirector;c:\windows\system32\DRIVERS\mrxsmb20.sys [x]
S3 NativeWifiP;NativeWiFi Filter;c:\windows\system32\DRIVERS\nwifi.sys [x]
S3 netprofm;Network List Service;c:\windows\System32\svchost.exe [2009-07-14 27136]
S3 RasAgileVpn;WAN Miniport (IKEv2);c:\windows\system32\DRIVERS\AgileVpn.sys [x]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
S3 srv2;Server SMB 2.xxx Driver;c:\windows\system32\DRIVERS\srv2.sys [x]
S3 srvnet;srvnet;c:\windows\system32\DRIVERS\srvnet.sys [x]
S3 tunnel;Microsoft Tunnel Miniport Adapter Driver;c:\windows\system32\DRIVERS\tunnel.sys [x]
S3 umbus;UMBus Enumerator Driver;c:\windows\system32\drivers\umbus.sys [x]
S3 WdiServiceHost;Diagnostic Service Host;c:\windows\System32\svchost.exe [2009-07-14 27136]
S3 WdiSystemHost;Diagnostic System Host;c:\windows\System32\svchost.exe [2009-07-14 27136]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA
LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr TBS QWAVE wcncsvc
DcomLaunch REG_MULTI_SZ Power PlugPlay DcomLaunch
wcssvc REG_MULTI_SZ WcsPlugInService
.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
AeLookupSvc
CertPropSvc
SCPolicySvc
lanmanserver
gpsvc
AudioSrv
FastUserSwitchingCompatibility
Nla
NWCWorkstation
SRService
Wmi
WmdmPmSp
TermService
wuauserv
BITS
ShellHWDetection
LogonHours
PCAudit
helpsvc
uploadmgr
iphlpsvc
msiscsi
schedule
SessionEnv
winmgmt
.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
sppuinotify
.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - LocalServiceNetworkRestricted
BthHFSrv
.
.
Contents of the 'Scheduled Tasks' folder
.
2011-03-18 c:\windows\Tasks\Defraggler Volume C Task.job
- c:\program files\Defraggler\df64.exe [2010-05-17 19:13]
.
.
——— x86-64 ———–
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-02-23 15:04 134384 —-a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SharingPrivate]
@="{08244EE6-92F0-47f2-9FC9-929BAA2E7235}"
[HKEY_CLASSES_ROOT\CLSID\{08244EE6-92F0-47f2-9FC9-929BAA2E7235}]
2010-11-20 13:27 509952 —-a-w- c:\windows\System32\ntshrui.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2009-01-23 305664]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2009-06-29 444416]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-06-30 165912]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-06-30 385560]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-06-30 365080]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-05 186904]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
"lxczbmgr.exe"="c:\program files (x86)\Lexmark 1200 Series\lxczbmgr.exe" [2009-04-27 74408]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
AeLookupSvc
CertPropSvc
SCPolicySvc
lanmanserver
gpsvc
IKEEXT
AudioSrv
FastUserSwitchingCompatibility
Nla
NWCWorkstation
SRService
Wmi
WmdmPmSp
TermService
wuauserv
BITS
ShellHWDetection
LogonHours
PCAudit
helpsvc
uploadmgr
iphlpsvc
seclogon
AppInfo
msiscsi
MMCSS
winmgmt
SessionEnv
browser
EapHost
schedule
hkmsvc
wercplsupport
ProfSvc
Themes
BDESVC
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalSystemNetworkRestricted
homegrouplistener
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
WdiServiceHost
sppuinotify
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetworkService
lanmanworkstation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalServiceNetworkRestricted
BthHFSrv
homegroupprovider
.
——- Supplementary Scan ——-
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.mtv.com/news/#music/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: &Download by Orbit - c:\program files (x86)\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files (x86)\Orbitdownloader\orbitmxt.dll/204
IE: &Winamp Search - c:\programdata\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
IE: Append the content of the link to existing PDF file - c:\program files (x86)\Nuance\PDF Professional 6\Bin\ZeonIEFavClient.dll/ZeonIEAppend.HTML
IE: Append the content of the selected links to existing PDF file - c:\program files (x86)\Nuance\PDF Professional 6\Bin\ZeonIEFavClient.dll/ZeonIEAppendSelLinks.HTML
IE: Append to existing PDF file - c:\program files (x86)\Nuance\PDF Professional 6\Bin\ZeonIEFavClient.dll/ZeonIEAppend.HTML
IE: Create PDF file - c:\program files (x86)\Nuance\PDF Professional 6\Bin\ZeonIEFavClient.dll/ZeonIECapture.HTML
IE: Create PDF file from the content of the link - c:\program files (x86)\Nuance\PDF Professional 6\Bin\ZeonIEFavClient.dll/ZeonIECapture.HTML
IE: Create PDF files from the selected links - c:\program files (x86)\Nuance\PDF Professional 6\Bin\ZeonIEFavClient.dll/ZeonIECaptureSelLinks.HTML
IE: Do&wnload selected by Orbit - c:\program files (x86)\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files (x86)\Orbitdownloader\orbitmxt.dll/202
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office14\EXCEL.EXE/3000
IE: Open with Nuance PDF Converter 6.0 - c:\program files (x86)\Nuance\PDF Professional 6\cnvres_eng.dll /100
IE: Open with PDF Professional 6 - c:\program files (x86)\Nuance\PDF Professional 6\Bin\PlusIEContextMenu.dll/PlusIEContextMenu.htm
IE: Se&nd to OneNote - c:\progra~2\MICROS~2\Office14\ONBttnIE.dll/105
FF - ProfilePath - c:\users\TJ54\AppData\Roaming\Mozilla\Firefox\Profiles\qa2l9ajt.default\
FF - prefs.js: browser.search.selectedEngine - Creative Commons
FF - prefs.js: browser.startup.homepage - hxxp://www.mtv.com/news/
FF - prefs.js: network.proxy.type - 4
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: WebMail Notifier: {37fa1426-b82d-11db-8314-0800200c9a66} - %profile%\extensions\{37fa1426-b82d-11db-8314-0800200c9a66}
FF - Ext: Winamp Toolbar: {0b38152b-1b20-484d-a11f-5e04a9b0661f} - %profile%\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
FF - Ext: Stop Autoplay: {2e61e246-e640-4c56-b1ed-f146dbed48cd} - %profile%\extensions\{2e61e246-e640-4c56-b1ed-f146dbed48cd}
FF - Ext: TVU Web Player: [removed] - %profile%\extensions\[removed]
FF - Ext: avast! WebRep: [removed] - c:\program files\AVAST Software\Avast\WebRep\FF
user_pref('capability.policy.policynames', 'localfilelinks');user_pref('capability.policy.localfilelinks.sites', 'hxxp://www.webmynd.com http://www.bing.com http://search.yahoo.com http://www.google.com');user_pref('…ri.enabled', 'allAccess');
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
.
.
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Drivers32]
@Denied: (Read) (Administrators)
@Denied: (B E 1 4 5) (Administrators)
"vidc.mrle"="msrle32.dll"
"vidc.msvc"="msvidc32.dll"
"msacm.imaadpcm"="imaadp32.acm"
"msacm.msg711"="msg711.acm"
"msacm.msgsm610"="msgsm32.acm"
"msacm.msadpcm"="msadp32.acm"
"midimapper"="midimap.dll"
"wavemapper"="msacm32.drv"
"VIDC.UYVY"="msyuv.dll"
"VIDC.YUY2"="msyuv.dll"
"VIDC.YVYU"="msyuv.dll"
"VIDC.IYUV"="iyuv_32.dll"
"vidc.i420"="iyuv_32.dll"
"VIDC.YVU9"="tsbyuv.dll"
"msacm.l3acm"="c:\\Windows\\System32\\l3codeca.acm"
"MSVideo8"="VfWWDM32.dll"
"wave"="wdmaud.drv"
"midi"="wdmaud.drv"
"mixer"="wdmaud.drv"
"vidc.tscc"="c:\\Windows\\SysWOW64\\tsccvid64.dll"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2011-03-19 02:57:00
ComboFix-quarantined-files.txt 2011-03-19 06:57
ComboFix2.txt 2011-03-19 05:41
.
Pre-Run: 156,119,085,056 bytes free
Post-Run: 156,047,937,536 bytes free
.
- - End Of File - - 21BD2F1674749A623BF29DDD88747A90

Hi Persia,

Great! Now let's clean up.

Please delete the following tools from your desktop: DDS, GMER, TDSSKiller.

===================================================

Follow these steps to uninstall Combofix

• Click START then RUN
• Now copy/paste Combofix /uninstall into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]

===================================================

Clean up with OTL:

• Double-click OTL.exe to start the program.
• Close all other programs apart from OTL as this step will require a reboot
• On the OTL main screen, press the CLEANUP button
• Say Yes to the prompt and then allow the program to reboot your computer.

===================================================

Here are some tips to reduce the potential for spyware infection in the future:

1. Make your Internet Explorer More Secure

• Click Start > Run
• Type Inetcpl.cpl and click OK
• Click on the Security tab
• Click Reset all zones to default level
• Make sure the Internet Zone is selected and Click Custom level
• In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to Prompt, and ("Initialize and Script ActiveX controls not marked as safe") to Disable.
• Next Click OK, then Apply button and then OK to exit the Internet Properties page.

2. Update your Anti-Virus Software - I can not overemphasize the need for you to update your Anti-virus application on a regular basis.  With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.

3. Make sure you keep your Windows OS current by visiting Windows update   regularly to download and install any critical updates and service packs. Without these you are leaving the back door open.

4. Consider a custom hosts file such as MVPS HOSTS. This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
For information on how to download and install, please read this tutorial by WinHelp2002
Note: Be sure to follow the instructions to disable the DNS Client service before installing a custom hosts file.

5. Finally, I strongly recommend that you read TonyKlein's good advice So how did I get infected in the first place?

Do you have any further questions?