Spyware / Malware / Virus Removal

iYogiSupportDock Module [Closed]

33 min read

Looking for the outcome? Ask AI

Satchfan

Post #31December 29, 2011, 8:57 AM UTC

No problem

AD4GP - Sean O

Post #32December 30, 2011, 9:54 PM UTC

Hi Satchfan:

Yes, I did have a nice Christmas. We had my Mother-In-Law's Sister, her husband and their friend to come up and we had Christmas lunch here. Nothing fancy at all…….just the way I like it

How was your Christmas? Was Santa good to you…….or should I say, were you a good lad? In any case, I pray you had a Merry Christmas and will have a very Happy New Year.

Thank you also for giving me until today to reply to your last post.

Below you will find the results of the ComboFix.exe log.

Thanks my friend.

Sean.

====================================================================

ComboFix 11-12-30.01 - Home 12/30/2011 4:12.7.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1013.280 [GMT -8:00]
Running from: c:\users\[removed]\Downloads\ComboFix.exe
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2011-11-28 to 2011-12-30 )))))))))))))))))))))))))))))))
.
.
2011-12-30 12:21 . 2011-12-30 12:21 ——– d—–w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2011-12-30 12:21 . 2011-12-30 12:21 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-12-30 12:21 . 2011-12-30 12:21 ——– d—–w- c:\users\Administrator\AppData\Local\temp
2011-12-30 09:27 . 2011-12-30 09:27 56200 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{D84E796B-7990-4D23-9359-D9B3F9511F90}\offreg.dll
2011-12-27 17:11 . 2011-11-21 10:47 6823496 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{D84E796B-7990-4D23-9359-D9B3F9511F90}\mpengine.dll
2011-12-26 18:32 . 2011-12-26 18:32 ——– d—–w- c:\users\Home\AppData\Local\Apple
2011-12-25 00:30 . 2011-12-25 00:30 ——– d—–w- c:\program files\FileHippo.com
2011-12-25 00:18 . 2011-12-26 04:22 ——– d—–w- c:\program files\Common Files\Adobe
2011-12-23 04:25 . 2011-12-26 04:22 ——– d—–w- c:\users\Home\AppData\Local\Adobe
2011-12-21 20:35 . 2011-12-22 17:13 ——– d—–w- c:\users\Home\AppData\Local\Apple Computer
2011-12-21 20:11 . 2011-12-30 12:21 ——– d—–w- c:\users\Home\AppData\Local\temp
2011-12-20 21:57 . 2011-12-20 21:57 ——– d—–w- c:\programdata\Ask
2011-12-20 21:38 . 2006-12-12 17:01 155648 —-a-w- c:\windows\system32\igfxres.dll
2011-12-20 00:53 . 2011-12-20 00:54 ——– d—–w- c:\program files\iTunes
2011-12-19 12:00 . 2009-12-30 18:21 27192 —-a-w- c:\windows\system32\drivers\revoflt.sys
2011-12-14 15:39 . 2011-10-27 08:01 3602816 —-a-w- c:\windows\system32\ntkrnlpa.exe
2011-12-14 15:39 . 2011-10-27 08:01 3550080 —-a-w- c:\windows\system32\ntoskrnl.exe
2011-12-14 15:39 . 2011-10-14 16:02 429056 —-a-w- c:\windows\system32\EncDec.dll
2011-12-14 15:39 . 2011-11-23 13:37 2043904 —-a-w- c:\windows\system32\win32k.sys
2011-12-14 15:39 . 2011-11-08 12:10 2409784 —-a-w- c:\program files\Windows Mail\OESpamFilter.dat
2011-12-14 15:39 . 2011-10-25 15:56 49152 —-a-w- c:\windows\system32\csrsrv.dll
2011-12-14 15:39 . 2011-11-08 14:42 2048 —-a-w- c:\windows\system32\tzres.dll
2011-12-14 05:04 . 2011-12-14 05:04 677136 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-12-10 22:43 . 2011-12-10 23:14 ——– d—–w- C:\STOMP35
2011-12-10 22:43 . 2011-12-10 22:43 ——– d—–w- c:\program files\MVAPPS
2011-12-10 22:43 . 2011-12-10 23:14 ——– d—–w- c:\windows\MVUNINST
2011-12-03 04:29 . 2011-12-03 04:29 ——– d—–w- c:\windows\system32\config\systemprofile\AppData\Local\Yahoo
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-18 20:20 . 2011-02-25 16:50 6278328 —-a-w- c:\users\Administrator\AppData\Roaming\wruninstall.exe
2011-11-12 21:58 . 2011-06-28 20:14 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-10 13:54 . 2010-06-26 02:04 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-10-24 22:29 . 2011-10-24 22:29 94208 —-a-w- c:\windows\system32\QuickTimeVR.qtx
2011-10-24 22:29 . 2011-10-24 22:29 69632 —-a-w- c:\windows\system32\QuickTime.qts
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-10-27 39408]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"FileHippo.com"="c:\program files\FileHippo.com\UpdateChecker.exe" [2010-08-09 248832]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-04-27 865840]
"WPCUMI"="c:\windows\system32\WpcUmi.exe" [2006-11-02 176128]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-12-12 98304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-12-12 106496]
"Persistence"="c:\windows\system32\igfxpers.exe" [2006-12-12 81920]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-10-06 59240]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-02 59240]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-12-08 421736]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2008-01-19 40072]
.
c:\users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Uninstall Webroot RunOnce.lnk - c:\users\Administrator\AppData\Roaming\wruninstall.exe [2011-2-25 6278328]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Device Monitor 3.lnk - c:\program files\PIXELA\Everio MediaBrowser 3\MBCameraMonitor.exe [2011-9-28 542064]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
.
[HKLM\~\startupfolder\C:^Users^Home^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^ZooskMessenger.lnk]
backup=c:\windows\pss\ZooskMessenger.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2011-10-06 09:52 59240 —-a-w- c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATT-SST_McciTrayApp]
2010-07-27 10:15 1573888 —-a-w- c:\program files\ATT-SST\McciTrayApp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Camera Assistant Software]
2007-09-13 21:09 638976 —-a-w- c:\program files\Camera Assistant Software for Gateway\traybar.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
2010-06-23 16:18 30192 —-a-w- c:\program files\Google\Google Desktop Search\GoogleDesktop.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2011-10-24 22:28 421888 —-a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-10-27 18:33 39408 —-a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateFlow.ATT-SST]
2010-07-27 10:15 1057792 —-a-w- c:\program files\ATT-SST\McciBrowser.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-10 135664]
R3 acfva;acfva;c:\windows\system32\DRIVERS\ACFVA32.sys [2007-06-29 86656]
R3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [2011-03-01 183560]
R3 dgcfltr;DGC Filter Driver;c:\windows\system32\DRIVERS\ACFDCP32.sys [2007-07-10 28800]
R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2010-06-23 30192]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-10 135664]
R3 NETw2v32;Intel® PRO/Wireless 2200BG Network Connection Driver for Windows Vista;c:\windows\system32\DRIVERS\NETw2v32.sys [2006-11-02 2589184]
R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys [2009-12-30 27192]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R3 wrssweep;Webroots Volume Access Driver;c:\progra~1\Webroot\Security\Current\plugins\cleanup\wrssweep.sys [x]
S2 lxbl_device;lxbl_device;c:\windows\system32\lxblcoms.exe [2007-04-20 537520]
S2 NSL;Norton Safe Web Lite;c:\program files\Norton Safe Web Lite\Engine\1.0.1.8\ccSvcHst.exe [2010-05-23 126904]
S3 RTL8187;Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8187.sys [2007-01-31 205312]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
.
2011-04-03 c:\windows\Tasks\Driver Robot.job
- c:\program files\Driver Robot\1.1.0.14\DriverRobot.exe [2009-10-30 00:51]
.
2011-12-30 c:\windows\Tasks\DriverCure.job
- c:\program files\ParetoLogic\DriverCure\DriverCure.exe [2010-06-17 21:28]
.
2011-12-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-10 16:42]
.
2011-12-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-10 16:42]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: EarthLink Google Search - c:\program files\EarthLink\Toolbar\SearchUI.dll/search.html
Trusted Zone: motive.com\patttbc.att
TCP: DhcpNameServer = 10.0.0.1
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-12-30 04:21
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Services\NSL]
"ImagePath"="\"c:\program files\Norton Safe Web Lite\Engine\1.0.1.8\ccSvcHst.exe\" /s \"NSL\" /m \"c:\program files\Norton Safe Web Lite\Engine\1.0.1.8\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:26,b4,25,a3,22,13,cc,01
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Completion time: 2011-12-30 04:25:51
ComboFix-quarantined-files.txt 2011-12-30 12:25
ComboFix2.txt 2011-12-21 20:11
.
Pre-Run: 58,811,318,272 bytes free
Post-Run: 58,577,645,568 bytes free
.
- - End Of File - - 7CEDC394829DFF421196A339A898B2B9

Satchfan

Post #33December 30, 2011, 11:24 PM UTC

we had Christmas lunch here. Nothing fancy at all

I also had a very simple day with family plus a very relaxed and much-needed couple of days to follow (too much good food and a few drinks!)

=========================================

I think that the iYogi presence is not a problem as it is no longer installed on your computer.

The problem with watching videos is because of a different infection. Although some of the bad files have been removed there still seems to be a problem that I can’t yet see.

Let’s see if this can shed some light:

Download Malwarebytes-Anti-Malware

Click here

double-click mbam-setup.exe and follow the prompts to install the program.
at the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware. and Launch Malwarebytes' Anti-Malware, then click Finish..
if an update is found, it will download and install the latest version.
once the program has loaded, select Perform quick scan, then click Scan.
when the scan is complete, click OK, then Show Results to view the results.
be sure that everything is checked, and click Remove Selected.
when removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
the log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
copy and paste the contents of that report in your next reply and exit MBAM.

NOTE: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Satchfan

AD4GP - Sean O

Post #34December 31, 2011, 12:21 AM UTC

Satchfan, I think I just screwed up. When I got to the site of the malwarebytes-anti-malware location, I selected "save" instead of "run". I closed all browsers, then went to directory where the program was saved and double-clicked the .exe file. I got the following error message: Error ShellExecuteEx failed; code 267 The directory name is invalid I decided to go back to the website of the program and clicked "run" this time and got the same error message as above. I'm sorry Satchfan. Sean.

Satchfan

Post #35December 31, 2011, 8:51 AM UTC last edited December 31, 2011, 8:53 AM UTC

Go to where Malwarebytes is saved, right-click on it, choose Properties, Unblock and then try running it again.

AD4GP - Sean O

Post #36December 31, 2011, 3:09 PM UTC last edited December 31, 2011, 3:10 PM UTC

Top of the mornin' to you Satchfan. Thanks for your patience. Below are the results. Ok, I got 2 different logs after running the Malwarebyts-Anti-Malware program. Sean ================================================================== Malwarebytes Anti-Malware (Trial) 1.60.0.1800 www.malwarebytes.org Database version: v2011.12.31.03 Windows Vista Service Pack 2 x86 NTFS Internet Explorer 9.0.8112.16421 Home :: HOME-PC [administrator] Protection: Enabled 12/31/2011 09:19:59 mbam-log-2011-12-31 (09-19-59).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 204589 Time elapsed: 8 minute(s), 19 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 2 HKCU\Software\AppDataLow\gvtl (Adware.GameVance) -> Quarantined and deleted successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully. Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) =============================================================== 2011/12/31 09:19:38 -0800 HOME-PC Home MESSAGE Starting protection 2011/12/31 09:19:42 -0800 HOME-PC Home MESSAGE Protection started successfully 2011/12/31 09:19:45 -0800 HOME-PC Home MESSAGE Starting IP protection 2011/12/31 09:19:48 -0800 HOME-PC Home MESSAGE IP Protection started successfully 2011/12/31 09:44:05 -0800 HOME-PC Home MESSAGE Starting protection 2011/12/31 09:44:11 -0800 HOME-PC Home MESSAGE Protection started successfully 2011/12/31 09:44:14 -0800 HOME-PC Home MESSAGE Starting IP protection 2011/12/31 09:44:17 -0800 HOME-PC Home MESSAGE IP Protection started successfully 2011/12/31 09:53:57 -0800 HOME-PC Home MESSAGE Starting protection 2011/12/31 09:54:03 -0800 HOME-PC Home MESSAGE Protection started successfully 2011/12/31 09:54:06 -0800 HOME-PC Home MESSAGE Starting IP protection 2011/12/31 09:54:10 -0800 HOME-PC Home MESSAGE IP Protection started successfully

Satchfan

Post #37January 1, 2012, 10:04 AM UTC last edited January 1, 2012, 10:58 AM UTC

Hi Sean and a Happy New Year

IMPORTANT – ComboFix is still not on your desktop, it is in a Downloads folder. Please make sure it is directly on your desktop and run it again.

Re-run SystemLook

Please delete SystemLook.txt from your desktop.

Double-click SystemLook.exe to run it.

Copy the content of the following codebox into the main textfield:

:filefind *SmartGeare* *instr.ini* *VD7f0_2326.exe* *c_726535.nls* *spoof.avi* *fred32.dll :folderfind *7f0924* *ip*

Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

Satchfan

AD4GP - Sean O

Post #38January 2, 2012, 1:17 AM UTC

Hi Satchfan:

And a Very Happy New Year to you too my friend. I hope this year will be a great one for you.

You did not tell me to post the ComboFix.txt file in this reply, but I did anyway just in case.

The SystemLook.txt file follows the ComboFix.txt.

Take care Satchfan,

Sean.

================================================================================
=============

ComboFix 12-01-01.06 - Home 01/01/2012 16:40:18.8.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1013.419 [GMT -8:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2011-12-02 to 2012-01-02 )))))))))))))))))))))))))))))))
.
.
2012-01-02 00:50 . 2012-01-02 00:50 ——– d—–w- c:\users\I Yogi Test\AppData\Local\temp
2012-01-02 00:50 . 2012-01-02 00:50 ——– d—–w- c:\users\Default\AppData\Local\temp
2012-01-02 00:50 . 2012-01-02 00:50 ——– d—–w- c:\users\Administrator\AppData\Local\temp
2012-01-01 16:40 . 2012-01-02 00:21 56200 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{188B2810-88AE-4C4B-A457-BB04B663234F}\offreg.dll
2011-12-31 17:18 . 2011-12-31 17:18 ——– d—–w- c:\users\Home\AppData\Roaming\Malwarebytes
2011-12-31 17:18 . 2011-12-31 17:18 ——– d—–w- c:\programdata\Malwarebytes
2011-12-31 17:18 . 2011-12-31 17:53 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2011-12-31 17:18 . 2011-12-10 23:24 20464 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-12-30 22:14 . 2011-11-21 10:47 6823496 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{188B2810-88AE-4C4B-A457-BB04B663234F}\mpengine.dll
2011-12-26 18:32 . 2011-12-26 18:32 ——– d—–w- c:\users\Home\AppData\Local\Apple
2011-12-25 00:30 . 2011-12-25 00:30 ——– d—–w- c:\program files\FileHippo.com
2011-12-25 00:18 . 2011-12-26 04:22 ——– d—–w- c:\program files\Common Files\Adobe
2011-12-23 04:25 . 2011-12-26 04:22 ——– d—–w- c:\users\Home\AppData\Local\Adobe
2011-12-21 20:35 . 2011-12-22 17:13 ——– d—–w- c:\users\Home\AppData\Local\Apple Computer
2011-12-21 20:11 . 2012-01-02 00:50 ——– d—–w- c:\users\Home\AppData\Local\temp
2011-12-20 21:57 . 2011-12-20 21:57 ——– d—–w- c:\programdata\Ask
2011-12-20 21:38 . 2006-12-12 17:01 155648 —-a-w- c:\windows\system32\igfxres.dll
2011-12-20 00:53 . 2011-12-20 00:54 ——– d—–w- c:\program files\iTunes
2011-12-19 12:00 . 2009-12-30 18:21 27192 —-a-w- c:\windows\system32\drivers\revoflt.sys
2011-12-14 15:39 . 2011-10-27 08:01 3602816 —-a-w- c:\windows\system32\ntkrnlpa.exe
2011-12-14 15:39 . 2011-10-27 08:01 3550080 —-a-w- c:\windows\system32\ntoskrnl.exe
2011-12-14 15:39 . 2011-10-14 16:02 429056 —-a-w- c:\windows\system32\EncDec.dll
2011-12-14 15:39 . 2011-11-23 13:37 2043904 —-a-w- c:\windows\system32\win32k.sys
2011-12-14 15:39 . 2011-11-08 12:10 2409784 —-a-w- c:\program files\Windows Mail\OESpamFilter.dat
2011-12-14 15:39 . 2011-10-25 15:56 49152 —-a-w- c:\windows\system32\csrsrv.dll
2011-12-14 15:39 . 2011-11-08 14:42 2048 —-a-w- c:\windows\system32\tzres.dll
2011-12-14 05:04 . 2011-12-14 05:04 677136 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-12-10 22:43 . 2011-12-10 23:14 ——– d—–w- C:\STOMP35
2011-12-10 22:43 . 2011-12-10 22:43 ——– d—–w- c:\program files\MVAPPS
2011-12-10 22:43 . 2011-12-10 23:14 ——– d—–w- c:\windows\MVUNINST
2011-12-03 04:29 . 2011-12-03 04:29 ——– d—–w- c:\windows\system32\config\systemprofile\AppData\Local\Yahoo
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-18 20:20 . 2011-02-25 16:50 6278328 —-a-w- c:\users\Administrator\AppData\Roaming\wruninstall.exe
2011-11-12 21:58 . 2011-06-28 20:14 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-10 13:54 . 2010-06-26 02:04 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-10-24 22:29 . 2011-10-24 22:29 94208 —-a-w- c:\windows\system32\QuickTimeVR.qtx
2011-10-24 22:29 . 2011-10-24 22:29 69632 —-a-w- c:\windows\system32\QuickTime.qts
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-10-27 39408]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"FileHippo.com"="c:\program files\FileHippo.com\UpdateChecker.exe" [2010-08-09 248832]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-04-27 865840]
"WPCUMI"="c:\windows\system32\WpcUmi.exe" [2006-11-02 176128]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-12-12 98304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-12-12 106496]
"Persistence"="c:\windows\system32\igfxpers.exe" [2006-12-12 81920]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-10-06 59240]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-02 59240]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-12-08 421736]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-12-25 460872]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2008-01-19 40072]
.
c:\users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Uninstall Webroot RunOnce.lnk - c:\users\Administrator\AppData\Roaming\wruninstall.exe [2011-2-25 6278328]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Device Monitor 3.lnk - c:\program files\PIXELA\Everio MediaBrowser 3\MBCameraMonitor.exe [2011-9-28 542064]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
.
[HKLM\~\startupfolder\C:^Users^Home^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^ZooskMessenger.lnk]
backup=c:\windows\pss\ZooskMessenger.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2011-10-06 09:52 59240 —-a-w- c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATT-SST_McciTrayApp]
2010-07-27 10:15 1573888 —-a-w- c:\program files\ATT-SST\McciTrayApp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Camera Assistant Software]
2007-09-13 21:09 638976 —-a-w- c:\program files\Camera Assistant Software for Gateway\traybar.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
2010-06-23 16:18 30192 —-a-w- c:\program files\Google\Google Desktop Search\GoogleDesktop.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2011-10-24 22:28 421888 —-a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-10-27 18:33 39408 —-a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateFlow.ATT-SST]
2010-07-27 10:15 1057792 —-a-w- c:\program files\ATT-SST\McciBrowser.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-10 135664]
R3 acfva;acfva;c:\windows\system32\DRIVERS\ACFVA32.sys [2007-06-29 86656]
R3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [2011-03-01 183560]
R3 dgcfltr;DGC Filter Driver;c:\windows\system32\DRIVERS\ACFDCP32.sys [2007-07-10 28800]
R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2010-06-23 30192]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-10 135664]
R3 NETw2v32;Intel® PRO/Wireless 2200BG Network Connection Driver for Windows Vista;c:\windows\system32\DRIVERS\NETw2v32.sys [2006-11-02 2589184]
R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys [2009-12-30 27192]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R3 wrssweep;Webroots Volume Access Driver;c:\progra~1\Webroot\Security\Current\plugins\cleanup\wrssweep.sys [x]
S2 lxbl_device;lxbl_device;c:\windows\system32\lxblcoms.exe [2007-04-20 537520]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-12-25 652872]
S2 NSL;Norton Safe Web Lite;c:\program files\Norton Safe Web Lite\Engine\1.0.1.8\ccSvcHst.exe [2010-05-23 126904]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-12-10 20464]
S3 RTL8187;Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8187.sys [2007-01-31 205312]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
.
2011-04-03 c:\windows\Tasks\Driver Robot.job
- c:\program files\Driver Robot\1.1.0.14\DriverRobot.exe [2009-10-30 00:51]
.
2011-12-30 c:\windows\Tasks\DriverCure.job
- c:\program files\ParetoLogic\DriverCure\DriverCure.exe [2010-06-17 21:28]
.
2012-01-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-10 16:42]
.
2012-01-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-10 16:42]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: EarthLink Google Search - c:\program files\EarthLink\Toolbar\SearchUI.dll/search.html
Trusted Zone: motive.com\patttbc.att
TCP: DhcpNameServer = 10.0.0.1
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-01-01 16:50
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Services\NSL]
"ImagePath"="\"c:\program files\Norton Safe Web Lite\Engine\1.0.1.8\ccSvcHst.exe\" /s \"NSL\" /m \"c:\program files\Norton Safe Web Lite\Engine\1.0.1.8\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:26,b4,25,a3,22,13,cc,01
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Completion time: 2012-01-01 16:56:37
ComboFix-quarantined-files.txt 2012-01-02 00:56
ComboFix2.txt 2011-12-30 12:25
ComboFix3.txt 2011-12-21 20:11
.
Pre-Run: 55,747,481,600 bytes free
Post-Run: 55,711,420,416 bytes free
.
- - End Of File - - 658110457995C21C222E53B27D3A9691

================================================================================
===============

SystemLook 30.07.11 by jpshortstuff
Log created at 17:02 on 01/01/2012 by Home
Administrator - Elevation successful

========== filefind ==========

Searching for "*SmartGeare*"
No files found.

Searching for "*instr.ini*"
No files found.

Searching for "*VD7f0_2326.exe*"
No files found.

Searching for "*c_726535.nls*"
No files found.

Searching for "*spoof.avi*"
No files found.

Searching for "*fred32.dll"
No files found.

========== folderfind ==========

Searching for "*7f0924*"
No folders found.

Searching for "*ip*"
C:\Documents\Books\The Holy Bible\2 The New Testament\11 - Philippians d—— [10:46 16/09/2011]
C:\Documents\Seán's Pics\05.23.11 Trip to New Bern, NC d—— [06:20 22/07/2011]
C:\Documents\Seán's Pics\2008 June Trip to Savannah with Thomas d—— [23:01 22/09/2011]
C:\Documents\Seán's Pics\October 2008 Camping Trip with Thomas d—— [23:06 22/09/2011]
C:\Program Files\FileHippo.com d—— [00:30 25/12/2011]
C:\Program Files\iPod d—— [22:13 28/10/2009]
C:\Program Files\Adobe\Reader 9.0\Reader\Javascripts d—— [00:18 25/12/2011]
C:\Program Files\ATT-HSI\McciScripts d—— [02:06 10/02/2010]
C:\Program Files\ATT-SST\OCB\McciScripts d—— [03:08 10/02/2010]
C:\Program Files\ATT-SST\OCB\92742abc-bcb6-4b1d-a7f1-5464ffcb5202\scripts d—— [13:16 09/09/2010]
C:\Program Files\ATT-SST\OCB\92742abc-bcb6-4b1d-a7f1-5464ffcb5202\ConnectivityFlow\scripts d—— [13:15 09/09/2010]
C:\Program Files\ATT-SST\OCB\92742abc-bcb6-4b1d-a7f1-5464ffcb5202\ConnectivityFlow\Flow\scripts d—— [13:15 09/09/2010]
C:\Program Files\ATT-SST\OCB\92742abc-bcb6-4b1d-a7f1-5464ffcb5202\CPE\scripts d—— [13:15 09/09/2010]
C:\Program Files\ATT-SST\OCB\92742abc-bcb6-4b1d-a7f1-5464ffcb5202\scripts\scriptaculous d—— [13:16 09/09/2010]
C:\Program Files\ATT-SST\OCB\92742abc-bcb6-4b1d-a7f1-5464ffcb5202\wcc\scripts d—— [13:16 09/09/2010]
C:\Program Files\ATT-SST\OCB\92742abc-bcb6-4b1d-a7f1-5464ffcb5202\WirelessFlow\Flow\scripts d—— [13:15 09/09/2010]
C:\Program Files\ATT-SST\OCB\McciScripts\McciProfiler d—— [03:08 10/02/2010]
C:\Program Files\Common Files\Apple\Apple Application Support\JavaScriptCore.resources d—— [15:44 05/07/2010]
C:\Program Files\Common Files\InstallShield\IScript d—— [21:15 25/10/2009]
C:\Program Files\Common Files\microsoft shared\THEMES12\ECLIPSE d—— [00:08 09/01/2010]
C:\Program Files\Common Files\microsoft shared\THEMES12\RIPPLE d—— [00:08 09/01/2010]
C:\Program Files\Common Files\microsoft shared\THEMES12\SUMIPNTG d—— [00:08 09/01/2010]
C:\Program Files\Gateway Games\FATE\TIPS d—— [21:31 25/10/2009]
C:\Program Files\Gateway Games\Polar Bowler\media\actors\powerup_multiplier d—— [21:32 25/10/2009]
C:\Program Files\Gateway Games\Tradewinds\assets\graphics\combatview\ships d—— [21:32 25/10/2009]
C:\Program Files\iPod\iPod Updater 2006-06-28 d—— [22:13 28/10/2009]
C:\Program Files\iPod\bin\iPodService.Resources d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunesMiniPlayer.Resources d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\cs.lproj\iPhoneRestore.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\cs.lproj\iPhoneSetup.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\cs.lproj\iPhoneWelcome.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\cs.lproj\iPhoneWelcomeOffline.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\cs.lproj\iPodRestore.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\cs.lproj\iPodSetup.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\cs.lproj\iPodSetupAssist.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\cs.lproj\iPodWelcome.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\cs.lproj\iPodWelcomeOffline.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\da.lproj\iPhoneRestore.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\da.lproj\iPhoneSetup.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\da.lproj\iPhoneWelcome.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\da.lproj\iPhoneWelcomeOffline.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\da.lproj\iPodRestore.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\da.lproj\iPodSetup.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\da.lproj\iPodSetupAssist.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\da.lproj\iPodWelcome.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\da.lproj\iPodWelcomeOffline.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\de.lproj\iPhoneRestore.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\de.lproj\iPhoneSetup.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\de.lproj\iPhoneWelcome.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\de.lproj\iPhoneWelcomeOffline.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\de.lproj\iPodRestore.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\de.lproj\iPodSetup.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\de.lproj\iPodSetupAssist.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\de.lproj\iPodWelcome.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\de.lproj\iPodWelcomeOffline.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\en.lproj\iPhoneRestore.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\en.lproj\iPhoneSetup.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\en.lproj\iPhoneWelcome.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\en.lproj\iPhoneWelcomeOffline.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\en.lproj\iPodRestore.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\en.lproj\iPodSetup.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\en.lproj\iPodSetupAssist.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\en.lproj\iPodWelcome.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\en.lproj\iPodWelcomeOffline.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\en_GB.lproj\iPhoneRestore.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\en_GB.lproj\iPhoneSetup.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\en_GB.lproj\iPhoneWelcome.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\en_GB.lproj\iPhoneWelcomeOffline.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\en_GB.lproj\iPodRestore.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\en_GB.lproj\iPodSetup.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\en_GB.lproj\iPodSetupAssist.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\en_GB.lproj\iPodWelcome.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\en_GB.lproj\iPodWelcomeOffline.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\es.lproj\iPhoneRestore.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\es.lproj\iPhoneSetup.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\es.lproj\iPhoneWelcome.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\es.lproj\iPhoneWelcomeOffline.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\es.lproj\iPodRestore.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\es.lproj\iPodSetup.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\es.lproj\iPodSetupAssist.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\es.lproj\iPodWelcome.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\es.lproj\iPodWelcomeOffline.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\fi.lproj\iPhoneRestore.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\fi.lproj\iPhoneSetup.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\fi.lproj\iPhoneWelcome.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\fi.lproj\iPhoneWelcomeOffline.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\fi.lproj\iPodRestore.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\fi.lproj\iPodSetup.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\fi.lproj\iPodSetupAssist.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\fi.lproj\iPodWelcome.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\fi.lproj\iPodWelcomeOffline.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\fr.lproj\iPhoneRestore.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\fr.lproj\iPhoneSetup.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\fr.lproj\iPhoneWelcome.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\fr.lproj\iPhoneWelcomeOffline.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\fr.lproj\iPodRestore.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\fr.lproj\iPodSetup.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\fr.lproj\iPodSetupAssist.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\fr.lproj\iPodWelcome.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\fr.lproj\iPodWelcomeOffline.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\hu.lproj\iPhoneRestore.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\hu.lproj\iPhoneSetup.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\hu.lproj\iPhoneWelcome.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\hu.lproj\iPhoneWelcomeOffline.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\hu.lproj\iPodRestore.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\hu.lproj\iPodSetup.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\hu.lproj\iPodSetupAssist.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\hu.lproj\iPodWelcome.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\hu.lproj\iPodWelcomeOffline.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\it.lproj\iPhoneRestore.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\it.lproj\iPhoneSetup.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\it.lproj\iPhoneWelcome.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\it.lproj\iPhoneWelcomeOffline.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\it.lproj\iPodRestore.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\it.lproj\iPodSetup.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\it.lproj\iPodSetupAssist.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\it.lproj\iPodWelcome.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\it.lproj\iPodWelcomeOffline.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\ja.lproj\iPhoneRestore.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\ja.lproj\iPhoneSetup.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\ja.lproj\iPhoneWelcome.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\ja.lproj\iPhoneWelcomeOffline.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\ja.lproj\iPodRestore.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\ja.lproj\iPodSetup.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\ja.lproj\iPodSetupAssist.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\ja.lproj\iPodWelcome.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\ja.lproj\iPodWelcomeOffline.nib d—— [00:53 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\ko.lproj\iPhoneRestore.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\ko.lproj\iPhoneSetup.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\ko.lproj\iPhoneWelcome.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\ko.lproj\iPhoneWelcomeOffline.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\ko.lproj\iPodRestore.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\ko.lproj\iPodSetup.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\ko.lproj\iPodSetupAssist.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\ko.lproj\iPodWelcome.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\ko.lproj\iPodWelcomeOffline.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\nb.lproj\iPhoneRestore.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\nb.lproj\iPhoneSetup.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\nb.lproj\iPhoneWelcome.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\nb.lproj\iPhoneWelcomeOffline.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\nb.lproj\iPodRestore.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\nb.lproj\iPodSetup.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\nb.lproj\iPodSetupAssist.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\nb.lproj\iPodWelcome.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\nb.lproj\iPodWelcomeOffline.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\nl.lproj\iPhoneRestore.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\nl.lproj\iPhoneSetup.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\nl.lproj\iPhoneWelcome.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\nl.lproj\iPhoneWelcomeOffline.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\nl.lproj\iPodRestore.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\nl.lproj\iPodSetup.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\nl.lproj\iPodSetupAssist.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\nl.lproj\iPodWelcome.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\nl.lproj\iPodWelcomeOffline.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\pl.lproj\iPhoneRestore.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\pl.lproj\iPhoneSetup.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\pl.lproj\iPhoneWelcome.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\pl.lproj\iPhoneWelcomeOffline.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\pl.lproj\iPodRestore.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\pl.lproj\iPodSetup.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\pl.lproj\iPodSetupAssist.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\pl.lproj\iPodWelcome.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\pl.lproj\iPodWelcomeOffline.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\pt.lproj\iPhoneRestore.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\pt.lproj\iPhoneSetup.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\pt.lproj\iPhoneWelcome.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\pt.lproj\iPhoneWelcomeOffline.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\pt.lproj\iPodRestore.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\pt.lproj\iPodSetup.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\pt.lproj\iPodSetupAssist.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\pt.lproj\iPodWelcome.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\pt.lproj\iPodWelcomeOffline.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\pt_PT.lproj\iPhoneRestore.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\pt_PT.lproj\iPhoneSetup.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\pt_PT.lproj\iPhoneWelcome.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\pt_PT.lproj\iPhoneWelcomeOffline.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\pt_PT.lproj\iPodRestore.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\pt_PT.lproj\iPodSetup.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\pt_PT.lproj\iPodSetupAssist.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\pt_PT.lproj\iPodWelcome.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\pt_PT.lproj\iPodWelcomeOffline.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\ru.lproj\iPhoneRestore.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\ru.lproj\iPhoneSetup.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\ru.lproj\iPhoneWelcome.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\ru.lproj\iPhoneWelcomeOffline.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\ru.lproj\iPodRestore.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\ru.lproj\iPodSetup.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\ru.lproj\iPodSetupAssist.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\ru.lproj\iPodWelcome.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\ru.lproj\iPodWelcomeOffline.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\sv.lproj\iPhoneRestore.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\sv.lproj\iPhoneSetup.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\sv.lproj\iPhoneWelcome.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\sv.lproj\iPhoneWelcomeOffline.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\sv.lproj\iPodRestore.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\sv.lproj\iPodSetup.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\sv.lproj\iPodSetupAssist.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\sv.lproj\iPodWelcome.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\sv.lproj\iPodWelcomeOffline.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\tr.lproj\iPhoneRestore.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\tr.lproj\iPhoneSetup.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\tr.lproj\iPhoneWelcome.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\tr.lproj\iPhoneWelcomeOffline.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\tr.lproj\iPodRestore.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\tr.lproj\iPodSetup.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\tr.lproj\iPodSetupAssist.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\tr.lproj\iPodWelcome.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\tr.lproj\iPodWelcomeOffline.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\zh_CN.lproj\iPhoneRestore.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\zh_CN.lproj\iPhoneSetup.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\zh_CN.lproj\iPhoneWelcome.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\zh_CN.lproj\iPhoneWelcomeOffline.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\zh_CN.lproj\iPodRestore.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\zh_CN.lproj\iPodSetup.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\zh_CN.lproj\iPodSetupAssist.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\zh_CN.lproj\iPodWelcome.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\zh_CN.lproj\iPodWelcomeOffline.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\zh_TW.lproj\iPhoneRestore.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\zh_TW.lproj\iPhoneSetup.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\zh_TW.lproj\iPhoneWelcome.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\zh_TW.lproj\iPhoneWelcomeOffline.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\zh_TW.lproj\iPodRestore.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\zh_TW.lproj\iPodSetup.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\zh_TW.lproj\iPodSetupAssist.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\zh_TW.lproj\iPodWelcome.nib d—— [00:54 20/12/2011]
C:\Program Files\iTunes\iTunes.Resources\zh_TW.lproj\iPodWelcomeOffline.nib d—— [00:54 20/12/2011]
C:\Program Files\Microsoft\BingBar\scripts d—— [17:15 13/03/2011]
C:\Program Files\Microsoft Publisher\Clipart d—— [23:02 13/11/2009]
C:\Program Files\Movie Maker\Shared\DvdStyles\FlipPage d—— [12:37 02/11/2006]
C:\Program Files\ProVenture\Business Cards\Clipart d—— [00:16 24/01/2010]
C:\Program Files\ProVenture\Business Cards\Program\Help\scripts d—— [00:17 24/01/2010]
C:\Program Files\ProVenture\Business Cards\Program\Help\wwhelp\wwhimpl\common\scripts d—— [00:17 24/01/2010]
C:\Program Files\ProVenture\Business Cards\Program\Help\wwhelp\wwhimpl\java\scripts d—— [00:17 24/01/2010]
C:\Program Files\ProVenture\Business Cards\Program\Help\wwhelp\wwhimpl\js\scripts d—— [00:17 24/01/2010]
C:\Program Files\Safari\Safari.resources\SnippetEditor d—— [21:18 05/03/2010]
C:\ProgramData\Geek Squad\MRI\System File Backups\FFS Backups\TCP IP Reset - 2010.11.19_0301PM d—— [23:01 19/11/2010]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iPod d—— [22:13 28/10/2009]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iPod\iPod Updater 2006-06-28 d—— [22:13 28/10/2009]
C:\ProgramData\WildTangent\Gateway Game Console\UI\htdocs2\Common\product\ancienttripeaks d—— [21:33 25/10/2009]
C:\ProgramData\WildTangent\Gateway Game Console\UI\htdocs2\Common\product\ancienttripeaks2 d—— [21:33 25/10/2009]
C:\ProgramData\WildTangent\Gateway Game Console\UI\htdocs2\Common\product\battleship3d d—— [21:33 25/10/2009]
C:\ProgramData\WildTangent\Gateway Game Console\UI\htdocs2\Common\product\fliporflop d—— [21:33 25/10/2009]
C:\ProgramData\WildTangent\Gateway Game Console\UI\htdocs2\Common\product\flipwit d—— [21:33 25/10/2009]
C:\ProgramData\WildTangent\Gateway Game Console\UI\htdocs2\Common\product\flipwords d—— [21:33 25/10/2009]
C:\ProgramData\WildTangent\Gateway Game Console\UI\htdocs2\Common\product\flipwords2 d—— [21:33 25/10/2009]
C:\ProgramData\WildTangent\Gateway Game Console\UI\htdocs2\Common\product\pipsoh d—— [21:33 25/10/2009]
C:\ProgramData\WildTangent\Gateway Game Console\UI\htdocs2\Common\product\popspipes d—— [21:33 25/10/2009]
C:\ProgramData\WildTangent\Gateway Game Console\UI\htdocs2\Common\product\sandscript d—— [21:33 25/10/2009]
C:\ProgramData\WildTangent\Gateway Game Console\UI\htdocs2\Common\product\snowyspacetrip d—— [21:33 25/10/2009]
C:\STOMP35\CLIPART d—— [23:14 10/12/2011]
C:\STOMP35\CLIPART\miscclip d—— [23:14 10/12/2011]
C:\Users\Administrator\AppData\Local\Microsoft\Toolbar\IsolatedStorage\SearchApp\VersionIndependent\CEIP d—— [16:25 27/11/2010]
C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\AntiPhishing d—— [16:23 27/11/2010]
C:\Users\All Users\Geek Squad\MRI\System File Backups\FFS Backups\TCP IP Reset - 2010.11.19_0301PM d—— [23:01 19/11/2010]
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\iPod d—— [22:13 28/10/2009]
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\iPod\iPod Updater 2006-06-28 d—— [22:13 28/10/2009]
C:\Users\All Users\WildTangent\Gateway Game Console\UI\htdocs2\Common\product\ancienttripeaks d—— [21:33 25/10/2009]
C:\Users\All Users\WildTangent\Gateway Game Console\UI\htdocs2\Common\product\ancienttripeaks2 d—— [21:33 25/10/2009]
C:\Users\All Users\WildTangent\Gateway Game Console\UI\htdocs2\Common\product\battleship3d d—— [21:33 25/10/2009]
C:\Users\All Users\WildTangent\Gateway Game Console\UI\htdocs2\Common\product\fliporflop d—— [21:33 25/10/2009]
C:\Users\All Users\WildTangent\Gateway Game Console\UI\htdocs2\Common\product\flipwit d—— [21:33 25/10/2009]
C:\Users\All Users\WildTangent\Gateway Game Console\UI\htdocs2\Common\product\flipwords d—— [21:33 25/10/2009]
C:\Users\All Users\WildTangent\Gateway Game Console\UI\htdocs2\Common\product\flipwords2 d—— [21:33 25/10/2009]
C:\Users\All Users\WildTangent\Gateway Game Console\UI\htdocs2\Common\product\pipsoh d—— [21:33 25/10/2009]
C:\Users\All Users\WildTangent\Gateway Game Console\UI\htdocs2\Common\product\popspipes d—— [21:33 25/10/2009]
C:\Users\All Users\WildTangent\Gateway Game Console\UI\htdocs2\Common\product\sandscript d—— [21:33 25/10/2009]
C:\Users\All Users\WildTangent\Gateway Game Console\UI\htdocs2\Common\product\snowyspacetrip d—— [21:33 25/10/2009]
C:\Users\Home\AppData\Local\Microsoft\Toolbar\IsolatedStorage\SearchApp\VersionIndependent\CEIP d—— [16:12 03/11/2010]
C:\Users\Home\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing d—— [02:45 06/11/2011]
C:\Users\Home\AppData\Roaming\Adobe\Acrobat\8.0\JavaScripts d—— [00:47 11/10/2011]
C:\Users\Home\AppData\Roaming\Apple Computer\iTunes\iPod Software Updates d—— [12:35 01/01/2010]
C:\Users\Home\AppData\Roaming\Apple Computer\iTunes\iPod Updater Logs d—— [12:13 05/06/2010]
C:\Users\Home\AppData\Roaming\Microsoft\Internet Explorer\UserData\YCIPE57B d–hs– [00:29 30/01/2011]
C:\Users\Home\Music\iTunes\iPod Games d—— [00:26 26/12/2009]
C:\Users\Home\Music\iTunes\iTunes Music\Philip Aaberg d—— [21:14 21/08/2011]
C:\WINDOWS\assembly\GAC_MSIL\ehiPlay dr—– [12:37 02/11/2006]
C:\WINDOWS\assembly\GAC_MSIL\ehiProxy dr—– [12:37 02/11/2006]
C:\WINDOWS\assembly\GAC_MSIL\Microsoft.JScript dr—– [11:18 02/11/2006]
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\ehiPlay d—— [11:30 24/06/2010]
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\ehiProxy d—— [11:30 24/06/2010]
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.JScript d—— [11:31 24/06/2010]
C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Microsoft.JScript d—— [17:07 15/10/2011]
C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript d—— [16:41 15/10/2011]
C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Input.Manipulations d—— [16:42 15/10/2011]
C:\WINDOWS\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\Description Documents d—— [18:47 27/10/2009]
C:\WINDOWS\Setup\scripts d—— [21:35 25/10/2009]
C:\WINDOWS\System32\Printing_Admin_Scripts d—— [12:42 02/11/2006]
C:\WINDOWS\System32\DriverStore\FileRepository\atipcie.inf_cb6ecbd0 d—— [20:55 25/10/2009]
C:\WINDOWS\System32\DriverStore\FileRepository\cxraptor_philipstuv1236d_ibv32.inf_bd8980bd d—— [11:18 02/11/2006]
C:\WINDOWS\System32\DriverStore\FileRepository\ipmidrv.inf_a46ca46a d—— [12:16 13/12/2009]
C:\WINDOWS\System32\DriverStore\FileRepository\ipmidrv.inf_d7eee31d d—— [11:18 02/11/2006]
C:\WINDOWS\System32\DriverStore\FileRepository\ipmidrv.inf_dabf9271 d—— [02:30 21/01/2008]
C:\WINDOWS\System32\DriverStore\FileRepository\multiprt.inf_32702db1 d—— [11:18 02/11/2006]
C:\WINDOWS\System32\DriverStore\FileRepository\pwipf6.inf_165b449d d—— [18:57 25/02/2011]
C:\WINDOWS\System32\DriverStore\FileRepository\pwipf6.inf_5d9d5e17 d—— [17:02 27/11/2010]
C:\WINDOWS\System32\DriverStore\FileRepository\pwipf6.inf_7d6dfe7a d—— [03:54 11/05/2011]
C:\WINDOWS\System32\Tasks\Microsoft\Windows\Tcpip d—— [12:52 02/11/2006]
C:\WINDOWS\winsxs\msil_ehiplay_31bf3856ad364e35_6.0.6000.16386_none_87a2cac8471f924a d—— [12:35 02/11/2006]
C:\WINDOWS\winsxs\msil_ehiproxy_31bf3856ad364e35_6.0.6001.18000_none_91f5a3297bfa7858 d—— [02:25 21/01/2008]
C:\WINDOWS\winsxs\msil_microsoft.jscript_b03f5f7f11d50a3a_6.0.6000.16386_none_d2587d1982b7832
4 d—— [11:18 02/11/2006]
C:\WINDOWS\winsxs\msil_microsoft.jscript_b03f5f7f11d50a3a_6.0.6000.16720_none_d253037d82bc529
8 d—— [11:39 31/10/2009]
C:\WINDOWS\winsxs\msil_microsoft.jscript_b03f5f7f11d50a3a_6.0.6000.20883_none_bb8b1a219c5e978
b d—— [11:39 31/10/2009]
C:\WINDOWS\winsxs\msil_microsoft.jscript_b03f5f7f11d50a3a_6.0.6001.18000_none_d22cfed5830f2bf
0 d—— [02:24 21/01/2008]
C:\WINDOWS\winsxs\msil_microsoft.jscript_b03f5f7f11d50a3a_6.0.6001.18111_none_d22de833830e5f3
9 d—— [11:38 31/10/2009]
C:\WINDOWS\winsxs\msil_microsoft.jscript_b03f5f7f11d50a3a_6.0.6001.22230_none_bb6258cf9cb3d84
c d—— [11:38 31/10/2009]
C:\WINDOWS\winsxs\msil_microsoft.jscript_b03f5f7f11d50a3a_6.0.6002.18005_none_d20884118360c00
4 d—— [11:46 13/12/2009]
C:\WINDOWS\winsxs\x86_cxraptor_philipstuv..ibv32.inf.resources_31bf3856ad364e35_6.0.6000.1638
6_en-us_dcd8630889d09ef8 d—— [12:41 02/11/2006]
C:\WINDOWS\winsxs\x86_ipbusenum.resources_31bf3856ad364e35_6.0.6000.16386_en-us_af802592fc1716c2 d—— [12:41 02/11/2006]
C:\WINDOWS\winsxs\x86_ipbusenumproxy_31bf3856ad364e35_6.0.6000.16386_none_332541590f3a0b51 d—— [11:18 02/11/2006]
C:\WINDOWS\winsxs\x86_ipbusenum_31bf3856ad364e35_6.0.6001.18000_none_6a04905e611b35a9 d—— [02:19 21/01/2008]
C:\WINDOWS\winsxs\x86_ipmidrv.inf.resources_31bf3856ad364e35_6.0.6000.16386_en-us_45dc57afbeb061ae d—— [12:41 02/11/2006]
C:\WINDOWS\winsxs\x86_ipmidrv.inf_31bf3856ad364e35_6.0.6001.18000_none_fba8f1f1eb9259da d—— [02:23 21/01/2008]
C:\WINDOWS\winsxs\x86_ipmidrv.inf_31bf3856ad364e35_6.0.6002.18005_none_fd946afde8b42526 d—— [11:42 13/12/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-cipher.resources_31bf3856ad364e35_6.0.6000.16386_en-us_9ddc205df4d0be9e d—— [12:41 02/11/2006]
C:\WINDOWS\winsxs\x86_microsoft-windows-cipher_31bf3856ad364e35_6.0.6001.18000_none_ad167f5aa518a33b d—— [02:24 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-cipher_31bf3856ad364e35_6.0.6002.18005_none_af01f866a23a6e87 d—— [11:46 13/12/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-clip.resources_31bf3856ad364e35_6.0.6000.16386_en-us_f731cdfcddb47041 d—— [12:41 02/11/2006]
C:\WINDOWS\winsxs\x86_microsoft-windows-clipsinthelibrary_31bf3856ad364e35_6.0.6001.18000_none_3dfdfe30a8179be4 d—— [02:23 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-clipsinthelibrary_31bf3856ad364e35_6.0.6002.18005_none_3fe9773ca5396730 d—— [11:43 13/12/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-clip_31bf3856ad364e35_6.0.6000.16386_none_a5a520211f165ebc d—— [11:18 02/11/2006]
C:\WINDOWS\winsxs\x86_microsoft-windows-d..e-coretipjpnprofile_31bf3856ad364e35_6.0.6001.18000_none_e1da04a4fdfcc2df d—— [02:25 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-d..e-coretipjpnprofile_31bf3856ad364e35_6.0.6002.18005_none_e3c57db0fb1e8e2b d—— [11:47 13/12/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-d..e-zipcodedictionary_31bf3856ad364e35_6.0.6001.18000_none_cab6ddc8a8dfafda d—— [02:24 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-d..e-zipcodedictionary_31bf3856ad364e35_6.0.6002.18005_none_cca256d4a6017b26 d—— [11:46 13/12/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.0.6001.18000_none_79f6912a88d63336 d—— [02:24 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.0.6002.18005_none_7be20a3685f7fe82 d—— [11:46 13/12/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-f..ruetype-segoescript_31bf3856ad364e35_6.0.6000.16386_none_d28e16a1f0238f53 d—— [11:18 02/11/2006]
C:\WINDOWS\winsxs\x86_microsoft-windows-gpupipeline_31bf3856ad364e35_6.0.6001.18000_none_fc2c21776f5b3026 d—— [02:20 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-help-ripbsyn.resources_31bf3856ad364e35_6.0.6000.16386_en-us_e0b716c4b1427176 d—— [12:41 02/11/2006]
C:\WINDOWS\winsxs\x86_microsoft-windows-help-ripbsyn.resources_31bf3856ad364e35_6.0.6001.18000_en-us_e2edd8c0ae2d824a d—— [08:05 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-help-sniptoo.resources_31bf3856ad364e35_6.0.6000.16386_en-us_98045108bba1aef1 d—— [12:41 02/11/2006]
C:\WINDOWS\winsxs\x86_microsoft-windows-help-sniptoo.resources_31bf3856ad364e35_6.0.6001.18000_en-us_9a3b1304b88cbfc5 d—— [08:05 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-help-vidclip.resources_31bf3856ad364e35_6.0.6000.16386_en-us_b827e1dee61ba994 d—— [12:41 02/11/2006]
C:\WINDOWS\winsxs\x86_microsoft-windows-help-vidclip.resources_31bf3856ad364e35_6.0.6001.18000_en-us_ba5ea3dae306ba68 d—— [08:05 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-i..-chinese-tipprofile_31bf3856ad364e35_6.0.6001.18000_none_89c2606b0d9356b5 d—— [02:23 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-i..-chinese-tipprofile_31bf3856ad364e35_6.0.6002.18005_none_8badd9770ab52201 d—— [11:44 13/12/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-i..chinese-tip_profile_31bf3856ad364e35_6.0.6001.18000_none_d43a65fd78a9b553 d—— [02:24 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-i..chinese-tip_profile_31bf3856ad364e35_6.0.6002.18005_none_d625df0975cb809f d—— [11:45 13/12/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-i..cyscripts.resources_31bf3856ad364e35_6.0.6000.16386_en-us_15f6b4320d83f0e8 d—— [12:41 02/11/2006]
C:\WINDOWS\winsxs\x86_microsoft-windows-i..cyscripts.resources_31bf3856ad364e35_6.0.6001.18000_en-us_182d762e0a6f01bc d—— [02:21 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-i..ementscriptingtools_31bf3856ad364e35_6.0.6001.18000_none_026dac186ddda69b d—— [02:25 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-i..ementscriptingtools_31bf3856ad364e35_6.0.6002.18005_none_045925246aff71e7 d—— [11:47 13/12/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-ie-antiphishfilter_31bf3856ad364e35_6.0.6000.16890_none_f94a8c316ee0f10f d—— [20:58 28/10/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-ie-antiphishfilter_31bf3856ad364e35_6.0.6000.16916_none_f9a70f336e9aa6b8 d—— [12:43 04/11/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-ie-antiphishfilter_31bf3856ad364e35_6.0.6000.21089_none_f9e7d3a487ee8c39 d—— [20:58 28/10/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-ie-antiphishfilter_31bf3856ad364e35_6.0.6000.21116_none_fa30842087b879c4 d—— [12:43 04/11/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-ie-antiphishfilter_31bf3856ad364e35_6.0.6001.18000_none_fb9216576bbe8c39 d—— [02:24 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-ie-antiphishfilter_31bf3856ad364e35_6.0.6001.18319_none_fb904eb76bbe83ae d—— [12:43 04/11/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-ie-antiphishfilter_31bf3856ad364e35_6.0.6001.22508_none_fc23bd0a84d4eb57 d—— [12:43 04/11/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-ie-antiphishfilter_31bf3856ad364e35_6.0.6002.18005_none_fd7d8f6368e05785 d—— [19:13 01/11/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-ie-antiphishfilter_31bf3856ad364e35_6.0.6002.18100_none_fd788fd768e4d5f9 d—— [12:43 04/11/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-ie-antiphishfilter_31bf3856ad364e35_6.0.6002.22212_none_fdf95d4a8208c462 d—— [12:43 04/11/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-ie-antiphishfilter_31bf3856ad364e35_8.0.6001.18702_none_de7d38b18189fc96 d—— [23:57 15/11/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-ie-antiphishfilter_31bf3856ad364e35_9.1.8112.16421_none_bb855147a9a2d24b d—— [16:27 15/05/2011]
C:\WINDOWS\winsxs\x86_microsoft-windows-ie-jscriptdebugui_31bf3856ad364e35_8.0.6001.18702_none_9d577137e370ad2c d—— [23:57 15/11/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-ie-jscriptdebugui_31bf3856ad364e35_9.1.8112.16421_none_7a5f89ce0b8982e1 d—— [16:27 15/05/2011]
C:\WINDOWS\winsxs\x86_microsoft-windows-iis-ipsecuritybinaries_31bf3856ad364e35_6.0.6001.18000_none_4086409065f3a890 d—— [02:25 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-iis-legacyscripts_31bf3856ad364e35_6.0.6001.18000_none_7e466ce97736febd d—— [02:20 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-ime-korean-tipprofile_31bf3856ad364e35_6.0.6001.18000_none_91cd4c61de2d2bcf d—— [02:24 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-ime-korean-tipprofile_31bf3856ad364e35_6.0.6002.18005_none_93b8c56ddb4ef71b d—— [11:46 13/12/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-installer-sip_31bf3856ad364e35_6.0.6001.18000_none_332fc8fb18444ddf d—— [02:23 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-installer-sip_31bf3856ad364e35_6.0.6002.18005_none_351b42071566192b d—— [11:44 13/12/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-ipconfig.resources_31bf3856ad364e35_6.0.6000.16386_en-us_c5a66cf000cde1e0 d—— [12:40 02/11/2006]
C:\WINDOWS\winsxs\x86_microsoft-windows-ipconfig.resources_31bf3856ad364e35_6.0.6001.18000_en-us_c7dd2eebfdb8f2b4 d—— [02:25 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-ipconfig_31bf3856ad364e35_6.0.6001.18000_none_4c39f10017eea251 d—— [02:23 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-ipconfig_31bf3856ad364e35_6.0.6002.18005_none_4e256a0c15106d9d d—— [11:44 13/12/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-ipnat.resources_31bf3856ad364e35_6.0.6000.16386_en-us_e211aaf58f27d647 d—— [12:41 02/11/2006]
C:\WINDOWS\winsxs\x86_microsoft-windows-ipnat_31bf3856ad364e35_6.0.6001.18000_none_5b1817987b5bdc28 d—— [02:24 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-l..istry-support-tcpip_31bf3856ad364e35_6.0.6001.18000_none_861d3607056cfa8c d—— [02:23 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-l..istry-support-tcpip_31bf3856ad364e35_6.0.6002.18005_none_8808af13028ec5d8 d—— [11:44 13/12/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-l..istry-support-tcpip_31bf3856ad364e35_6.0.6002.18091_none_87a35e9f02db5bf5 d—— [21:20 28/10/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-l..istry-support-tcpip_31bf3856ad364e35_6.0.6002.18160_none_87c2cfff02c3ebf2 d—— [11:01 10/02/2010]
C:\WINDOWS\winsxs\x86_microsoft-windows-l..istry-support-tcpip_31bf3856ad364e35_6.0.6002.22200_none_888d4c521bb0e416 d—— [21:20 28/10/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-l..istry-support-tcpip_31bf3856ad364e35_6.0.6002.22283_none_8839cdd01bef0fa3 d—— [11:01 10/02/2010]
C:\WINDOWS\winsxs\x86_microsoft-windows-l..istry-support-tcpip_31bf3856ad364e35_6.0.6002.22341_none_88630ed21bd06a58 d—— [15:50 15/04/2010]
C:\WINDOWS\winsxs\x86_microsoft-windows-l..istry-support-tcpip_31bf3856ad364e35_6.0.6002.22377_none_8848a0ca1be35635 d—— [15:47 25/02/2011]
C:\WINDOWS\winsxs\x86_microsoft-windows-l..istry-support-tcpip_31bf3856ad364e35_6.0.6002.22425_none_887cb1b81bbc94f9 d—— [11:33 14/08/2010]
C:\WINDOWS\winsxs\x86_microsoft-windows-l..istry-support-tcpip_31bf3856ad364e35_6.0.6002.22662_none_884e74f61bdfb306 d—— [04:17 14/08/2011]
C:\WINDOWS\winsxs\x86_microsoft-windows-l..istry-support-tcpip_31bf3856ad364e35_6.0.6002.22719_none_888b887e1bb0d5d9 d—— [17:41 10/11/2011]
C:\WINDOWS\winsxs\x86_microsoft-windows-mssip32-dll_31bf3856ad364e35_6.0.6000.16386_none_742a74a49c937f96 d—— [11:19 02/11/2006]
C:\WINDOWS\winsxs\x86_microsoft-windows-o..disc-style-flippage_31bf3856ad364e35_6.0.6000.16386_none_b0edbdc100c73abe d—— [12:36 02/11/2006]
C:\WINDOWS\winsxs\x86_microsoft-windows-p..inscripts.resources_31bf3856ad364e35_6.0.6000.16386_en-us_0c769dfa4f6541a8 d—— [12:40 02/11/2006]
C:\WINDOWS\winsxs\x86_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_6.0.6000.16830_none_29a6eeebde589a97 d—— [18:58 27/10/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_6.0.6000.21023_none_2a3e34a2f76b9db7 d—— [18:58 27/10/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_6.0.6001.18000_none_2bad9989db66dd67 d—— [02:20 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_6.0.6001.18226_none_2b9dff39db71a7a1 d—— [18:58 27/10/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_6.0.6001.22389_none_2be9bd5af4bd3b16 d—— [18:58 27/10/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_6.0.6002.18005_none_2d991295d888a8b3 d—— [19:15 01/11/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_6.0.6002.18060_none_2d53319bd8bdd1a6 d—— [11:06 16/12/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_6.0.6002.18392_none_2d34c81dd8d44f9c d—— [18:22 08/02/2011]
C:\WINDOWS\winsxs\x86_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_6.0.6002.22164_none_2de0cf8ef1d7d6cc d—— [11:06 16/12/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_6.0.6002.22573_none_2dd506f0f1e0ce02 d—— [18:22 08/02/2011]
C:\WINDOWS\winsxs\x86_microsoft-windows-p..rpipeline.resources_31bf3856ad364e35_6.0.6000.16386_en-us_f5bab0b2fe0b6810 d—— [12:41 02/11/2006]
C:\WINDOWS\winsxs\x86_microsoft-windows-powershell-sip_31bf3856ad364e35_7.0.6001.18181_none_59899ff38dd96759 d—— [15:29 25/02/2011]
C:\WINDOWS\winsxs\x86_microsoft-windows-qedwipes_31bf3856ad364e35_6.0.6000.16386_none_554896b3ad5ff268 d—— [12:34 02/11/2006]
C:\WINDOWS\winsxs\x86_microsoft-windows-r..-miniport.resources_31bf3856ad364e35_6.0.6000.16386_en-us_b421a5842b8c8760 d—— [12:40 02/11/2006]
C:\WINDOWS\winsxs\x86_microsoft-windows-rasipfilter_31bf3856ad364e35_6.0.6001.18000_none_e76983e8bf2f6fb9 d—— [02:24 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-rasriplistener_31bf3856ad364e35_6.0.6000.16386_none_f97caf5c5fe6262f d—— [12:36 02/11/2006]
C:\WINDOWS\winsxs\x86_microsoft-windows-rndis-miniport_31bf3856ad364e35_6.0.6001.18000_none_e12eafad8be55cb9 d—— [02:24 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-rndis-miniport_31bf3856ad364e35_6.0.6002.18005_none_e31a28b989072805 d—— [11:46 13/12/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-s..-msscript.resources_31bf3856ad364e35_6.0.6000.16386_en-us_cc9da755bc489be4 d—— [12:41 02/11/2006]
C:\WINDOWS\winsxs\x86_microsoft-windows-s..-vbscript.resources_31bf3856ad364e35_6.0.6000.16386_en-us_0da52890732b4e36 d—— [12:41 02/11/2006]
C:\WINDOWS\winsxs\x86_microsoft-windows-s..-vbscript.resources_31bf3856ad364e35_8.0.6001.18702_en-us_f2c70ce685e1cf67 d—— [23:57 15/11/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-s..-vbscript.resources_31bf3856ad364e35_9.1.8112.16421_en-us_cfcf257cadfaa51c d—— [16:28 15/05/2011]
C:\WINDOWS\winsxs\x86_microsoft-windows-s..g-jscript.resources_31bf3856ad364e35_6.0.6000.16386_en-us_51bfc95f897f5142 d—— [12:41 02/11/2006]
C:\WINDOWS\winsxs\x86_microsoft-windows-s..g-jscript.resources_31bf3856ad364e35_8.0.6001.18702_en-us_36e1adb59c35d273 d—— [23:57 15/11/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-s..g-jscript.resources_31bf3856ad364e35_9.1.8112.16421_en-us_13e9c64bc44ea828 d—— [16:28 15/05/2011]
C:\WINDOWS\winsxs\x86_microsoft-windows-s..gevolumewmiprovider_31bf3856ad364e35_6.0.6001.18000_none_17d3c60709ecb009 d—— [02:18 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-s..iprovider.resources_31bf3856ad364e35_6.0.6000.16386_en-us_d2246b757cb7f4c0 d—— [12:41 02/11/2006]
C:\WINDOWS\winsxs\x86_microsoft-windows-s..iprovider.resources_31bf3856ad364e35_6.0.6000.16386_en-us_d454d93ca12388cc d—— [12:41 02/11/2006]
C:\WINDOWS\winsxs\x86_microsoft-windows-s..restore-wmiprovider_31bf3856ad364e35_6.0.6001.18000_none_b78c1dfecce0b61c d—— [02:21 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-scripting-jscript_31bf3856ad364e35_6.0.6000.16865_none_80bdcfa6fa29e6c3 d—— [21:01 28/10/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-scripting-jscript_31bf3856ad364e35_6.0.6000.21061_none_8143436c134b5473 d—— [21:01 28/10/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-scripting-jscript_31bf3856ad364e35_6.0.6001.18000_none_82dfe896f724570d d—— [02:24 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-scripting-jscript_31bf3856ad364e35_6.0.6001.18068_none_82a70b5ef74dc96b d—— [20:55 28/10/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-scripting-jscript_31bf3856ad364e35_6.0.6001.18266_none_82a50e96f74f910b d—— [21:01 28/10/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-scripting-jscript_31bf3856ad364e35_6.0.6001.22175_none_8322d76010763921 d—— [20:55 28/10/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-scripting-jscript_31bf3856ad364e35_6.0.6001.22443_none_83414c42105faa15 d—— [21:01 28/10/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-scripting-jscript_31bf3856ad364e35_6.0.6002.18005_none_84cb61a2f4462259 d—— [11:47 13/12/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-scripting-jscript_31bf3856ad364e35_6.0.6002.18045_none_84a021f2f466921d d—— [21:01 28/10/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-scripting-jscript_31bf3856ad364e35_6.0.6002.22146_none_852abf080d834b3e d—— [21:01 28/10/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-scripting-jscript_31bf3856ad364e35_8.0.6001.18702_none_65cb0af10cefc76a d—— [23:57 15/11/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-scripting-jscript_31bf3856ad364e35_8.0.6001.18795_none_656cbc830d360ee8 d—— [15:34 17/11/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-scripting-jscript_31bf3856ad364e35_8.0.6001.18869_none_65912f550d1a1d98 d—— [12:43 25/02/2010]
C:\WINDOWS\winsxs\x86_microsoft-windows-scripting-jscript_31bf3856ad364e35_8.0.6001.19046_none_65a3a8570d0cca1a d—— [13:47 13/04/2011]
C:\WINDOWS\winsxs\x86_microsoft-windows-scripting-jscript_31bf3856ad364e35_8.0.6001.22886_none_66022984264aac18 d—— [15:34 17/11/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-scripting-jscript_31bf3856ad364e35_8.0.6001.22960_none_6611c986263fd953 d—— [12:43 25/02/2010]
C:\WINDOWS\winsxs\x86_microsoft-windows-scripting-jscript_31bf3856ad364e35_8.0.6001.23141_none_662843b0262eeb31 d—— [13:47 13/04/2011]
C:\WINDOWS\winsxs\x86_microsoft-windows-scripting-jscript_31bf3856ad364e35_9.1.8112.16421_none_42d3238735089d1f d—— [16:27 15/05/2011]
C:\WINDOWS\winsxs\x86_microsoft-windows-scripting-jscript_31bf3856ad364e35_9.1.8112.16430_none_42c7535135119fb9 d—— [18:48 16/06/2011]
C:\WINDOWS\winsxs\x86_microsoft-windows-scripting-jscript_31bf3856ad364e35_9.1.8112.16434_none_42cb5479350e0515 d—— [04:51 14/08/2011]
C:\WINDOWS\winsxs\x86_microsoft-windows-scripting-jscript_31bf3856ad364e35_9.1.8112.16437_none_42ce5557350b511a d—— [16:50 15/10/2011]
C:\WINDOWS\winsxs\x86_microsoft-windows-scripting-jscript_31bf3856ad364e35_9.1.8112.16440_none_42bc83653519bbaa d—— [19:42 15/12/2011]
C:\WINDOWS\winsxs\x86_microsoft-windows-scripting-jscript_31bf3856ad364e35_9.1.8112.20530_none_4350f01c4e2f3f83 d—— [18:48 16/06/2011]
C:\WINDOWS\winsxs\x86_microsoft-windows-scripting-jscript_31bf3856ad364e35_9.1.8112.20534_none_4354f1444e2ba4df d—— [04:51 14/08/2011]
C:\WINDOWS\winsxs\x86_microsoft-windows-scripting-jscript_31bf3856ad364e35_9.1.8112.20537_none_4357f2224e28f0e4 d—— [16:50 15/10/2011]
C:\WINDOWS\winsxs\x86_microsoft-windows-scripting-jscript_31bf3856ad364e35_9.1.8112.20544_none_434a21584e33c0d0 d—— [19:42 15/12/2011]
C:\WINDOWS\winsxs\x86_microsoft-windows-scripting-msscript_31bf3856ad364e35_6.0.6001.18000_none_9061c334a3bae187 d—— [02:24 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-scripting-vbscript_31bf3856ad364e35_6.0.6001.18000_none_485a034f2de70349 d—— [02:24 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-scripting-vbscript_31bf3856ad364e35_6.0.6001.18068_none_482126172e1075a7 d—— [20:55 28/10/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-scripting-vbscript_31bf3856ad364e35_6.0.6001.22175_none_489cf2184738e55d d—— [20:55 28/10/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-scripting-vbscript_31bf3856ad364e35_6.0.6002.18005_none_4a457c5b2b08ce95 d—— [11:44 13/12/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-scripting-vbscript_31bf3856ad364e35_8.0.6001.18702_none_2b4525a943b273a6 d—— [23:57 15/11/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-scripting-vbscript_31bf3856ad364e35_8.0.6001.18909_none_2b4c2b7b43ac1f55 d—— [15:54 15/04/2010]
C:\WINDOWS\winsxs\x86_microsoft-windows-scripting-vbscript_31bf3856ad364e35_8.0.6001.19046_none_2b1dc30f43cf7656 d—— [13:47 13/04/2011]
C:\WINDOWS\winsxs\x86_microsoft-windows-scripting-vbscript_31bf3856ad364e35_8.0.6001.23000_none_2bcc9be85cd2112b d—— [15:54 15/04/2010]
C:\WINDOWS\winsxs\x86_microsoft-windows-scripting-vbscript_31bf3856ad364e35_8.0.6001.23141_none_2ba25e685cf1976d d—— [13:47 13/04/2011]
C:\WINDOWS\winsxs\x86_microsoft-windows-scripting-vbscript_31bf3856ad364e35_9.1.8112.16421_none_084d3e3f6bcb495b d—— [16:27 15/05/2011]
C:\WINDOWS\winsxs\x86_microsoft-windows-scripting.resources_31bf3856ad364e35_6.0.6000.16386_en-us_88f5df135a8895c8 d—— [12:41 02/11/2006]
C:\WINDOWS\winsxs\x86_microsoft-windows-scripting_31bf3856ad364e35_6.0.6001.18000_none_486853160059f17b d—— [02:23 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-scripting_31bf3856ad364e35_6.0.6001.18068_none_482f75de008363d9 d—— [18:47 27/10/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-scripting_31bf3856ad364e35_6.0.6001.22175_none_48ab41df19abd38f d—— [20:55 28/10/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-scripting_31bf3856ad364e35_6.0.6002.18005_none_4a53cc21fd7bbcc7 d—— [19:15 01/11/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-scripto.resources_31bf3856ad364e35_6.0.6000.16386_en-us_6bcc96798fb997ab d—— [12:41 02/11/2006]
C:\WINDOWS\winsxs\x86_microsoft-windows-scripto_31bf3856ad364e35_6.0.6000.16386_none_3fabc387d4b1774a d—— [11:19 02/11/2006]
C:\WINDOWS\winsxs\x86_microsoft-windows-shadowcopywmiprovider_31bf3856ad364e35_6.0.6001.18000_none_b03d117d41ff717b d—— [02:19 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-syshiper_31bf3856ad364e35_6.0.6002.18005_none_77fb27ec5025e18b d—— [11:44 13/12/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-t..etip6-pro.resources_31bf3856ad364e35_6.0.6000.16386_en-us_623f6c806c5904a8 d—— [12:41 02/11/2006]
C:\WINDOWS\winsxs\x86_microsoft-windows-t..niportdisplaydriver_31bf3856ad364e35_6.0.6001.18000_none_d4db241b3e3ef7e4 d—— [02:24 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-t..tcpip-pro.resources_31bf3856ad364e35_6.0.6000.16386_en-us_b428f65d6ad5e02f d—— [12:41 02/11/2006]
C:\WINDOWS\winsxs\x86_microsoft-windows-tabletpc-snippingtool_31bf3856ad364e35_6.0.6001.18000_none_cfb2f7da0cc08338 d—— [02:25 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-tabletpc-snippingtool_31bf3856ad364e35_6.0.6002.18005_none_d19e70e609e24e84 d—— [11:48 13/12/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18000_none_b31e1252666640f6 d—— [02:25 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18063_none_b2e033a8669434a1 d—— [21:16 28/10/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18311_none_b3144862666d6db3 d—— [21:20 28/10/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18377_none_b2d96a966698ad63 d—— [11:01 10/02/2010]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18427_none_b30f7c1866701ed5 d—— [15:50 15/04/2010]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18493_none_b2bfcb7c66ac7d10 d—— [11:33 14/08/2010]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22167_none_b36dd19b7fae39c7 d—— [21:16 28/10/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22497_none_b34d67897fc6850f d—— [21:20 28/10/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22577_none_b36309477fb64a54 d—— [11:01 10/02/2010]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22636_none_b38d4a937f96be60 d—— [15:50 15/04/2010]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22665_none_b36bda857faff8dc d—— [15:47 25/02/2011]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22713_none_b39feb737f8937a0 d—— [11:33 14/08/2010]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.18005_none_b5098b5e63880c42 d—— [11:48 13/12/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.18091_none_b4a43aea63d4a25f d—— [21:20 28/10/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.18160_none_b4c3ac4a63bd325c d—— [11:02 10/02/2010]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.18209_none_b50d905263846bec d—— [15:50 15/04/2010]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.18272_none_b4baded863c37e22 d—— [11:33 14/08/2010]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.18484_none_b4b2134c63c9c70f d—— [04:17 14/08/2011]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.18519_none_b502c618638c7f52 d—— [17:41 10/11/2011]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.22200_none_b58e289d7caa2a80 d—— [21:20 28/10/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.22283_none_b53aaa1b7ce8560d d—— [11:01 10/02/2010]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.22341_none_b563eb1d7cc9b0c2 d—— [15:50 15/04/2010]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.22377_none_b5497d157cdc9c9f d—— [15:47 25/02/2011]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.22425_none_b57d8e037cb5db63 d—— [11:33 14/08/2010]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.22662_none_b54f51417cd8f970 d—— [04:17 14/08/2011]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.22719_none_b58c64c97caa1c43 d—— [17:41 10/11/2011]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-mof_31bf3856ad364e35_6.0.6000.16386_none_35a721da88047d1b d—— [11:19 02/11/2006]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-netip6-pro_31bf3856ad364e35_6.0.6001.18000_none_608dea625a3e349f d—— [02:24 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-nettcpip-pro_31bf3856ad364e35_6.0.6001.18000_none_a85cb9fcd0270d9e d—— [02:24 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.0.6000.16908_none_30e8bd0651b053ef d—— [21:20 28/10/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.0.6000.21108_none_317231f36ace26fb d—— [21:20 28/10/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.0.6001.18000_none_32c6f3aa4ede22b3 d—— [02:19 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.0.6001.18311_none_32bd29ba4ee54f70 d—— [21:20 28/10/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.0.6001.22497_none_32f648e1683e66cc d—— [21:20 28/10/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.0.6002.18005_none_34b26cb64bffedff d—— [19:12 01/11/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.0.6002.18091_none_344d1c424c4c841c d—— [21:20 28/10/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.0.6002.22200_none_353709f565220c3d d—— [21:20 28/10/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip.resources_31bf3856ad364e35_6.0.6000.16386_en-us_ca0bb75cd038edc9 d—— [12:41 02/11/2006]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip.resources_31bf3856ad364e35_6.0.6001.18000_en-us_cc427958cd23fe9d d—— [02:21 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.16908_none_5fa75f38922bdbf4 d—— [21:20 28/10/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.16973_none_5f56ae52926920d8 d—— [11:02 10/02/2010]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.17021_none_5f8a957c924295b7 d—— [15:50 15/04/2010]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.21108_none_6030d425ab49af00 d—— [21:20 28/10/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.21175_none_5fe223d3ab852692 d—— [11:02 10/02/2010]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.21226_none_6019359fab5bb15b d—— [15:50 15/04/2010]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6001.18000_none_618595dc8f59aab8 d—— [02:24 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6002.18005_none_63710ee88c7b7604 d—— [19:14 01/11/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-tdi-over-tcpip_31bf3856ad364e35_6.0.6001.18000_none_ea3dc84bdc15a8b7 d—— [02:24 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-tdi-over-tcpip_31bf3856ad364e35_6.0.6002.18005_none_ec294157d9377403 d—— [11:46 13/12/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-vistasp1ceip_31bf3856ad364e35_6.0.6001.18000_none_1e7ab8a6aee223ea d—— [02:23 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-w..per-tcpip.resources_31bf3856ad364e35_6.0.6000.16386_en-us_60f743aba221897b d—— [12:41 02/11/2006]
C:\WINDOWS\winsxs\x86_microsoft-windows-wfpipsechelperclasses_31bf3856ad364e35_6.0.6001.18000_none_729d8d62fbfaddc9 d—— [02:25 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-winsock-helper-tcpip_31bf3856ad364e35_6.0.6001.18000_none_cbb305c23187855a d—— [02:24 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-wmi-cmiplugin_31bf3856ad364e35_6.0.6001.18000_none_bd028ce72c07ccb6 d—— [02:24 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-wmi-cmiplugin_31bf3856ad364e35_6.0.6001.18551_none_bccd87132c2f6385 d—— [11:28 15/12/2010]
C:\WINDOWS\winsxs\x86_microsoft-windows-wmi-cmiplugin_31bf3856ad364e35_6.0.6001.22791_none_bd2be614456d703a d—— [11:28 15/12/2010]
C:\WINDOWS\winsxs\x86_microsoft-windows-wmi-cmiplugin_31bf3856ad364e35_6.0.6002.18005_none_beee05f329299802 d—— [11:44 13/12/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-wmi-cmiplugin_31bf3856ad364e35_6.0.6002.18342_none_bebfcb17294cb336 d—— [11:28 15/12/2010]
C:\WINDOWS\winsxs\x86_microsoft-windows-wmi-cmiplugin_31bf3856ad364e35_6.0.6002.22519_none_bf70db92424badb5 d—— [11:28 15/12/2010]
C:\WINDOWS\winsxs\x86_microsoft-windows-wmi-iproute-provider_31bf3856ad364e35_6.0.6001.18000_none_4d22da062788010c d—— [02:18 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-wmi-scripting_31bf3856ad364e35_6.0.6001.18000_none_61113896f2bd382d d—— [02:20 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-wmiperf_31bf3856ad364e35_6.0.6001.18000_none_9f9a1428b257d5d0 d—— [02:20 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-wmiperf_31bf3856ad364e35_6.0.6002.18005_none_a1858d34af79a11c d—— [19:14 01/11/2009]
C:\WINDOWS\winsxs\x86_microsoft-windows-zipfldr.resources_31bf3856ad364e35_6.0.6000.16386_en-us_1140f77a81614226 d—— [12:41 02/11/2006]
C:\WINDOWS\winsxs\x86_microsoft-windows-zipfldr.resources_31bf3856ad364e35_6.0.6001.18000_en-us_1377b9767e4c52fa d—— [02:25 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-zipfldr_31bf3856ad364e35_6.0.6001.18000_none_78064a3c3548869b d—— [02:18 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft-windows-zipfldr_31bf3856ad364e35_6.0.6002.18005_none_79f1c348326a51e7 d—— [19:12 01/11/2009]
C:\WINDOWS\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16386_none_9ea0ac9e
c96e7127 d—— [11:19 02/11/2006]
C:\WINDOWS\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072e
c96e0be7 d—— [21:06 28/10/2009]
C:\WINDOWS\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.20966_none_87d10496
e317a014 d—— [21:06 28/10/2009]
C:\WINDOWS\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18000_none_9e752e5a
c9c619f3 d—— [02:24 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18175_none_9e7bbe54
c9c04bca d—— [21:06 28/10/2009]
C:\WINDOWS\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18551_none_9e7a1850
c9c1b3dc d—— [13:46 13/04/2011]
C:\WINDOWS\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.22319_none_87a7ba94
e36d7a9b d—— [21:06 28/10/2009]
C:\WINDOWS\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.22791_none_87b07294
e365798f d—— [13:46 13/04/2011]
C:\WINDOWS\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396
ca17ae07 d—— [11:46 13/12/2009]
C:\WINDOWS\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aa
ca13c773 d—— [13:46 13/04/2011]
C:\WINDOWS\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.22519_none_8783b170
e3be8f2c d—— [13:46 13/04/2011]
C:\WINDOWS\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.6000.16386_none_8df21b83
62744ace d—— [11:19 02/11/2006]
C:\WINDOWS\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.6000.16782_none_8df27613
6273e58e d—— [21:06 28/10/2009]
C:\WINDOWS\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.6000.20966_none_7722737b
7c1d79bb d—— [21:06 28/10/2009]
C:\WINDOWS\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.6001.18000_none_8dc69d3f
62cbf39a d—— [02:24 21/01/2008]
C:\WINDOWS\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.6001.18175_none_8dcd2d39
62c62571 d—— [21:06 28/10/2009]
C:\WINDOWS\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.6001.18551_none_8dcb8735
62c78d83 d—— [13:46 13/04/2011]
C:\WINDOWS\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.6001.22319_none_76f92979
7c735442 d—— [21:06 28/10/2009]
C:\WINDOWS\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.6001.22791_none_7701e179
7c6b5336 d—— [13:46 13/04/2011]
C:\WINDOWS\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.6002.18005_none_8da2227b
631d87ae d—— [11:45 13/12/2009]
C:\WINDOWS\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.6002.18342_none_8da6678f
6319a11a d—— [13:46 13/04/2011]
C:\WINDOWS\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.6002.22519_none_76d52055
7cc468d3 d—— [13:46 13/04/2011]
C:\WINDOWS\winsxs\x86_multiprt.inf.resources_31bf3856ad364e35_6.0.6000.16386_en-us_d3f353b526c0eb36 d—— [12:40 02/11/2006]
C:\WINDOWS\winsxs\x86_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.0.6000.16386_none_6d91925650a9ecab d—— [11:19 02/11/2006]
C:\WINDOWS\winsxs\x86_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.0.6000.16720_none_6d8c18ba50aebc1f d—— [11:34 31/10/2009]
C:\WINDOWS\winsxs\x86_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.0.6000.20883_none_56c42f5e6a510112 d—— [11:34 31/10/2009]
C:\WINDOWS\winsxs\x86_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.0.6001.18111_none_6d66fd705100c8c0 d—— [11:33 31/10/2009]
C:\WINDOWS\winsxs\x86_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.0.6001.22230_none_569b6e0c6aa641d3 d—— [11:33 31/10/2009]
C:\WINDOWS\winsxs\x86_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.0.6002.18005_none_6d41994e5153298b d—— [19:10 01/11/2009]
C:\WINDOWS\winsxs\x86_netfx-sbs_microsoft_jscript_dll_31bf3856ad364e35_6.0.6000.16720_none_fadb1f7894625625 d—— [11:39 31/10/2009]
C:\WINDOWS\winsxs\x86_netfx-sbs_microsoft_jscript_dll_31bf3856ad364e35_6.0.6000.20883_none_fb26dd99adade99a d—— [11:39 31/10/2009]
C:\WINDOWS\winsxs\x86_netfx-sbs_microsoft_jscript_dll_31bf3856ad364e35_6.0.6001.18000_none_fcd6fc109178b20d d—— [02:24 21/01/2008]
C:\WINDOWS\winsxs\x86_netfx-sbs_microsoft_jscript_dll_31bf3856ad364e35_6.0.6001.18111_none_fccd2e54917fe47c d—— [11:38 31/10/2009]
C:\WINDOWS\winsxs\x86_netfx-sbs_microsoft_jscript_dll_31bf3856ad364e35_6.0.6001.22230_none_fd402afdaaaea2d1 d—— [11:38 31/10/2009]
C:\WINDOWS\winsxs\x86_netfx-scripting_engine_tlb_b03f5f7f11d50a3a_6.0.6000.16386_none_b5b391c3d7076eb5 d—— [11:19 02/11/2006]
C:\WINDOWS\winsxs\x86_netfx-scripting_engine_tlb_b03f5f7f11d50a3a_6.0.6000.16720_none_b5ae1827d70c3e29 d—— [11:39 31/10/2009]
C:\WINDOWS\winsxs\x86_netfx-scripting_engine_tlb_b03f5f7f11d50a3a_6.0.6000.20883_none_9ee62ecbf0ae831c d—— [11:39 31/10/2009]
C:\WINDOWS\winsxs\x86_netfx-scripting_engine_tlb_b03f5f7f11d50a3a_6.0.6001.18111_none_b588fcddd75e4aca d—— [11:38 31/10/2009]
C:\WINDOWS\winsxs\x86_netfx-scripting_engine_tlb_b03f5f7f11d50a3a_6.0.6001.22230_none_9ebd6d79f103c3dd d—— [11:38 31/10/2009]
C:\WINDOWS\winsxs\x86_server-help-chm.ipsecmonitor.resources_31bf3856ad364e35_6.0.6000.16386_en-us_bce99d8815851cfc d—— [12:41 02/11/2006]
C:\WINDOWS\winsxs\x86_server-help-chm.ipsecmonitor.resources_31bf3856ad364e35_6.0.6001.18000_en-us_bf205f8412702dd0 d—— [08:05 21/01/2008]
C:\WINDOWS\winsxs\x86_server-help-chm.ipsecpolicy.resources_31bf3856ad364e35_6.0.6000.16386_en-us_550779ac931fec04 d—— [12:41 02/11/2006]
C:\WINDOWS\winsxs\x86_server-help-chm.ipsecpolicy.resources_31bf3856ad364e35_6.0.6001.18000_en-us_573e3ba8900afcd8 d—— [08:05 21/01/2008]
C:\WINDOWS\winsxs\x86_server-help-chm.tcpip.resources_31bf3856ad364e35_6.0.6000.16386_en-us_2360d422b69f0e36 d—— [12:41 02/11/2006]
C:\WINDOWS\winsxs\x86_server-help-chm.tcpip.resources_31bf3856ad364e35_6.0.6001.18000_en-us_2597961eb38a1f0a d—— [08:05 21/01/2008]

-= EOF =-

Satchfan

Post #39January 2, 2012, 11:25 PM UTC

I see no signs of malware left in your logs Sean. Can you tell me exactly what problems remain. If you still cannot access videos, please explain which kind and what happens when you try to watch them. Satchfan

AD4GP - Sean O

Post #40January 3, 2012, 9:16 PM UTC

Hi Satchfan: At this point I do not appear to be experiencing any significant problems with my computer. I think it works better than ever. Even that freakin "Codec" popup is even gone

Everything seems to be working fine. I even seem to be able to watch videos without them sticking, freezing, etc. The only thing I am concerned about is that "iYogi" folder: "C:\Users\I Yogi Test\…" If you tell me that I have nothing to worry about with it being there, then I will except your professional opinion. If my next reply from you states that you have met your's and my objectives, then I want to express my sincerest gratitude for your patience, help, time, commitment, professionalism, expertise, and all that other stuff

Seriously Satchfan, thank you! Take care and God's speed. Sean.

Satchfan

Post #41January 3, 2012, 11:02 PM UTC

Hi Sean

You've done a good job and it looks like between us we have sorted things out.

The only thing I am concerned about is that "iYogi" folder: "C:\Users\I Yogi Test\…" If you tell me that I have nothing to worry about with it being there, then I will except your professional opinion

The “I Yogi Test” can do no harm from where it is but it would satisfy us both if it was no longer there..

Open ComboFix

Please do the following:

close any open browsers.
close/disable all anti virus and anti malware programs so that they do not interfere with the running of ComboFix.
open notepad and copy/paste the text in the codebox below into it:

Folder:: C:\Users\I Yogi Test

Save this as "CFScript.txt", and as Type: All Files (*.*) in the same location as ComboFix.exe

[external image: Posted Image]

Referring to the picture above, drag CFScript into ComboFix.exe

When finished, it produces a log at C:\ComboFix.txt. Post the contents of Combofix.txt in your next reply.

Satchfan

AD4GP - Sean O

Post #42January 4, 2012, 4:07 AM UTC

Hello Satchfan:

Sorry it took so long to get back with you. Thanks, by the way

Below is the log for ComboFix Log from NotePad.

Sean.

=============================================================

ComboFix 12-01-03.08 - Home 01/03/2012 22:46:10.9.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1013.487 [GMT -8:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\Home\Desktop\CFScript.txt
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2011-12-04 to 2012-01-04 )))))))))))))))))))))))))))))))
.
.
2012-01-04 06:56 . 2012-01-04 06:56 ——– d—–w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2012-01-04 06:56 . 2012-01-04 06:56 ——– d—–w- c:\users\I Yogi Test\AppData\Local\temp
2012-01-04 06:56 . 2012-01-04 06:56 ——– d—–w- c:\users\Default\AppData\Local\temp
2012-01-04 06:56 . 2012-01-04 06:56 ——– d—–w- c:\users\Administrator\AppData\Local\temp
2012-01-03 22:29 . 2012-01-03 22:29 56200 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{BCA1FF75-BFD1-4B32-BBC7-BF1FC4D3D1F2}\offreg.dll
2012-01-03 22:29 . 2011-11-21 10:47 6823496 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{BCA1FF75-BFD1-4B32-BBC7-BF1FC4D3D1F2}\mpengine.dll
2011-12-31 17:18 . 2011-12-31 17:18 ——– d—–w- c:\users\Home\AppData\Roaming\Malwarebytes
2011-12-31 17:18 . 2011-12-31 17:18 ——– d—–w- c:\programdata\Malwarebytes
2011-12-31 17:18 . 2011-12-31 17:53 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2011-12-31 17:18 . 2011-12-10 23:24 20464 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-12-26 18:32 . 2011-12-26 18:32 ——– d—–w- c:\users\Home\AppData\Local\Apple
2011-12-25 00:30 . 2011-12-25 00:30 ——– d—–w- c:\program files\FileHippo.com
2011-12-25 00:18 . 2011-12-26 04:22 ——– d—–w- c:\program files\Common Files\Adobe
2011-12-23 04:25 . 2011-12-26 04:22 ——– d—–w- c:\users\Home\AppData\Local\Adobe
2011-12-21 20:35 . 2012-01-02 06:29 ——– d—–w- c:\users\Home\AppData\Local\Apple Computer
2011-12-21 20:11 . 2012-01-04 06:56 ——– d—–w- c:\users\Home\AppData\Local\temp
2011-12-20 21:57 . 2011-12-20 21:57 ——– d—–w- c:\programdata\Ask
2011-12-20 21:38 . 2006-12-12 17:01 155648 —-a-w- c:\windows\system32\igfxres.dll
2011-12-20 00:53 . 2011-12-20 00:54 ——– d—–w- c:\program files\iTunes
2011-12-19 12:00 . 2009-12-30 18:21 27192 —-a-w- c:\windows\system32\drivers\revoflt.sys
2011-12-14 15:39 . 2011-10-27 08:01 3602816 —-a-w- c:\windows\system32\ntkrnlpa.exe
2011-12-14 15:39 . 2011-10-27 08:01 3550080 —-a-w- c:\windows\system32\ntoskrnl.exe
2011-12-14 15:39 . 2011-10-14 16:02 429056 —-a-w- c:\windows\system32\EncDec.dll
2011-12-14 15:39 . 2011-11-23 13:37 2043904 —-a-w- c:\windows\system32\win32k.sys
2011-12-14 15:39 . 2011-11-08 12:10 2409784 —-a-w- c:\program files\Windows Mail\OESpamFilter.dat
2011-12-14 15:39 . 2011-10-25 15:56 49152 —-a-w- c:\windows\system32\csrsrv.dll
2011-12-14 15:39 . 2011-11-08 14:42 2048 —-a-w- c:\windows\system32\tzres.dll
2011-12-14 05:04 . 2011-12-14 05:04 677136 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-12-10 22:43 . 2011-12-10 23:14 ——– d—–w- C:\STOMP35
2011-12-10 22:43 . 2011-12-10 22:43 ——– d—–w- c:\program files\MVAPPS
2011-12-10 22:43 . 2011-12-10 23:14 ——– d—–w- c:\windows\MVUNINST
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-18 20:20 . 2011-02-25 16:50 6278328 —-a-w- c:\users\Administrator\AppData\Roaming\wruninstall.exe
2011-11-12 21:58 . 2011-06-28 20:14 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-10 13:54 . 2010-06-26 02:04 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-10-24 22:29 . 2011-10-24 22:29 94208 —-a-w- c:\windows\system32\QuickTimeVR.qtx
2011-10-24 22:29 . 2011-10-24 22:29 69632 —-a-w- c:\windows\system32\QuickTime.qts
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-10-27 39408]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"FileHippo.com"="c:\program files\FileHippo.com\UpdateChecker.exe" [2010-08-09 248832]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-04-27 865840]
"WPCUMI"="c:\windows\system32\WpcUmi.exe" [2006-11-02 176128]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-12-12 98304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-12-12 106496]
"Persistence"="c:\windows\system32\igfxpers.exe" [2006-12-12 81920]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-10-06 59240]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-02 59240]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-12-08 421736]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-12-25 460872]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2008-01-19 40072]
.
c:\users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Uninstall Webroot RunOnce.lnk - c:\users\Administrator\AppData\Roaming\wruninstall.exe [2011-2-25 6278328].
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Device Monitor 3.lnk - c:\program files\PIXELA\Everio MediaBrowser 3\MBCameraMonitor.exe [2011-9-28 542064]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
.
[HKLM\~\startupfolder\C:^Users^Home^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^ZooskMessenger.lnk]
backup=c:\windows\pss\ZooskMessenger.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2011-10-06 09:52 59240 —-a-w- c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATT-SST_McciTrayApp]
2010-07-27 10:15 1573888 —-a-w- c:\program files\ATT-SST\McciTrayApp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Camera Assistant Software]
2007-09-13 21:09 638976 —-a-w- c:\program files\Camera Assistant Software for Gateway\traybar.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
2010-06-23 16:18 30192 —-a-w- c:\program files\Google\Google Desktop Search\GoogleDesktop.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2011-10-24 22:28 421888 —-a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-10-27 18:33 39408 —-a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateFlow.ATT-SST]
2010-07-27 10:15 1057792 —-a-w- c:\program files\ATT-SST\McciBrowser.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
R3 acfva;acfva;c:\windows\system32\DRIVERS\ACFVA32.sys [2007-06-29 86656]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
.
2011-04-03 c:\windows\Tasks\Driver Robot.job
- c:\program files\Driver Robot\1.1.0.14\DriverRobot.exe [2009-10-30 00:51]
.
2011-12-30 c:\windows\Tasks\DriverCure.job
- c:\program files\ParetoLogic\DriverCure\DriverCure.exe [2010-06-17 21:28]
.
2012-01-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-10 16:42]
.
2012-01-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-10 16:42]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: EarthLink Google Search - c:\program files\EarthLink\Toolbar\SearchUI.dll/search.html
Trusted Zone: motive.com\patttbc.att
TCP: DhcpNameServer = 10.0.0.1
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-01-03 22:56
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Services\NSL]
"ImagePath"="\"c:\program files\Norton Safe Web Lite\Engine\1.0.1.8\ccSvcHst.exe\" /s \"NSL\" /m \"c:\program files\Norton Safe Web Lite\Engine\1.0.1.8\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:26,b4,25,a3,22,13,cc,01
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Completion time: 2012-01-03 23:01:48
ComboFix-quarantined-files.txt 2012-01-04 07:01
ComboFix2.txt 2012-01-02 00:56
ComboFix3.txt 2011-12-30 12:25
ComboFix4.txt 2011-12-21 20:11
.
Pre-Run: 52,527,960,064 bytes free
Post-Run: 52,493,381,632 bytes free
.
- - End Of File - - 4AAB51F2D09AEB55D1C38F56024DD918

Satchfan

Post #43January 4, 2012, 8:04 AM UTC

Did you save the script I provided to the desktop and drag it onto ComboFix as I instructed?

Let’s check to see if there are any signs of it antwhere else.

Re-run SystemLook

Please delete SystemLook.txt from your desktop.

Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:

:regfind I Yogi Test
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

Satchfan

AD4GP - Sean O

Post #44January 4, 2012, 6:28 PM UTC

Hi Satchfan: I found the "SystemLook.exe" program under: "C:\Users\Home\Downloads\SystemLook.exe". The "SystemLook.txt" report is noted below. I noticed that the report says "No data found." I looked into the folders and found that the "I Yogi Test" folder really is there. It also contains several subfolders and under those even more subfolders. The directory to "I Yogi Test" is: C:\Users\I Yogi Test The subfolders under "I Yogi Test" are: "AppData, Contacts, Favorties, and Searches." And there are even some subfolders under those also. Here is the report from "SystemLook.txt". Take care Satchfan. Sean. ================================================================== SystemLook 30.07.11 by jpshortstuff Log created at 13:06 on 04/01/2012 by Home Administrator - Elevation successful ========== regfind ========== Searching for "I Yogi Test" No data found. -= EOF =-

Satchfan

Post #45January 5, 2012, 8:50 AM UTC

Please bear with me while I confer with my colleagues to see if they have any ideas about this. Thanks Satchfan

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

iYogiSupportDock Module [Closed]

✨ Ask AI

Ask AI