What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Hacktool.win32/Keygen and Adware.mywebsearchtoolbar [Solved]

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Evening gents,

Please help me, I'm not that computer savy. Just this morning when I turned on my computer, MSE detected that i have Hacktool.win32/Keygen. Looking for solutions, I also found out that I have Adware.mywebsearchtoolbar.

Thank you for reading.


PS. Sorry for my grammar. English is my second language.

Heres is my scan result:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:38:21 PM, on 18/03/2012
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\vVX3000.exe
C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
C:\Program Files (x86)\uTorrent\uTorrent.exe
C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe
C:\Program Files (x86)\Winamp\winampa.exe
C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe
C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
C:\Program Files (x86)\Sony\SmartWi Connection Utility\CCP.exe
C:\Program Files (x86)\Sony\SmartWi Connection Utility\SmartWi.exe
C:\Program Files (x86)\Sony\SmartWi Connection Utility\ThirdPartyAppMgr.exe
C:\Program Files (x86)\Sony\SmartWi Connection Utility\PowerManager.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Users\Avi\Downloads\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.facebook.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Increase performance and video formats for your HTML5 - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\IPSBHO.DLL
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\coIEPlg.dll
O3 - Toolbar: (no name) - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - (no file)
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SmartWiHelper] "C:\Program Files (x86)\Sony\SmartWi Connection Utility\SmartWiHelper.exe" /WindowsStartup
O4 - HKLM\..\Run: [ISBMgr.exe] "C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files (x86)\Winamp\winampa.exe"
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [SSDMonitor] C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe
O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~2\MYWEBS~1\bar\1.bin\m3SrchMn.exe" /m=2 /w /h
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKCU\..\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [cdloader] "C:\Users\Avi\AppData\Roaming\mjusbsp\cdloader2.exe" MAGICJACK
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files (x86)\uTorrent\uTorrent.exe" /MINIMIZED
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Send image to &Bluetooth Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send page to &Bluetooth Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Send To Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: Send to &Bluetooth Device… - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} (JuniperSetupClientControl Class) - https://remote.fransenengineering.com/dana-…SetupClient.cab
O18 - Protocol: intu-tt2010 - {97A0575E-2309-4E75-8509-B1F9390C4DE7} - C:\Program Files (x86)\TurboTax 2010\ic2010pp.dll
O18 - Protocol: intu-tt2011 - {B3B5DAD9-E96D-45B4-B636-B6CF2F773DE1} - C:\Program Files (x86)\TurboTax 2011\ic2011pp.dll
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\coIEPlg.dll
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\ccSvcHst.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: PC Tools Startup and Shutdown Monitor service (PCToolsSSDMonitorSvc) - Unknown owner - C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Roxio UPnP Renderer 10 - Sonic Solutions - C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe
O23 - Service: Roxio Upnp Server 10 - Sonic Solutions - C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: Intel® Sample Collector (SampleCollector) - Intel Corporation - C:\Program Files\Sony\VAIO Care\collsvc.exe
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: VAIO Media plus Content Importer (SOHCImp) - Sony Corporation - C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe
O23 - Service: VAIO Media plus Database Manager (SOHDBSvr) - Sony Corporation - C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe
O23 - Service: VAIO Media plus Digital Media Server (SOHDms) - Sony Corporation - C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe
O23 - Service: VAIO Media plus Device Searcher (SOHDs) - Sony Corporation - C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe
O23 - Service: VAIO Media plus Playlist Manager (SOHPlMgr) - Sony Corporation - C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe
O23 - Service: VAIO Power Management - Sony Corporation - C:\Program Files\Sony\VAIO Power Management\SPMService.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: VAIO Content Folder Watcher (VCFw) - Sony Corporation - C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe
O23 - Service: VAIO Content Metadata Intelligent Analyzing Manager (VcmIAlzMgr) - Sony Corporation - C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
O23 - Service: VAIO Content Metadata Intelligent Network Service Manager (VcmINSMgr) - Sony Corporation - C:\Program Files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe
O23 - Service: VAIO Content Metadata XML Interface (VcmXmlIfHelper) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

–
End of file - 13394 bytes
Post #2
Hi klown604,

:welcome:

My name is NoodleTech. I would be glad to assist you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • Please be aware that removing malware is not without risk and while unrecoverable damage to systems is rare, it can happen and may require a re-format and re-install of your operating system. Because of this it is a good idea to back-up anything important saved on your computer.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Do not delete anything unless instructed to.
  • DO NOT use tools such as ComboFix without supervision.
  • Please continue to review my answers until I tell you your machine appears to be clean. Absence of symptoms does not mean that everything is clean.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.
  • Failure to respond within 3 days will result in this topic being closed - If you need more time to complete the steps required, please let me know.
===================================================

Please download DDS by sUBs from one of the following links and save it to your desktop.
    • DDS.scr
    • DDS.pif
  • Disable any script blocking protection (How to Disable your Security Programs)
  • Double click DDS icon to run the tool (may take up to 3 minutes to run)
  • When done, DDS.txt will open.
  • After a few moments,  attach.txt will open in a second window.
  • Save both reports to your desktop.
—————————————————
  • Post the contents of the DDS.txt report in your next reply
  • Attach the Attach.txt report to your post by scrolling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.
===================================================

Please download aswMBR.exe and save it to your desktop. 

Double click aswMBR.exe to start the tool. (Vista/Windows 7 users - right click to run as administrator)

Click Scan
  • Upon completion of the scan, click Save log and save it to your desktop, and post that log in your next reply for review.
  • Note - do NOT attempt any Fix yet.
  • You will also notice another file created on the desktop named MBR.dat.
  • Right click that file and select Send To>Compressed (zipped) file.
  • Attach that zipped file in your next reply as well.
Post #3
Thanks for the help, NoodleTech. Just got home from work. Just to let you know, I downloaded MBAM and i think I got rid of the adware. Will now run DDS and aswMBR.exe
Post #5
here are the logs: aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software Run date: 2012-03-19 20:16:39 —————————– 20:16:39.257 OS Version: Windows x64 6.1.7600 20:16:39.258 Number of processors: 2 586 0x170A 20:16:39.260 ComputerName: AVI-VAIO UserName: Avi 20:16:41.516 Initialize success 20:20:42.822 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 20:20:42.828 Disk 0 Vendor: WDC_WD32 11.0 Size: 305245MB BusType: 3 20:20:42.832 Disk 1 \Device\Harddisk1\DR1 -> \Device\00000071 20:20:42.837 Disk 1 Vendor: RICOH 02 Size: 305245MB BusType: 0 20:20:42.842 Disk 2 \Device\Harddisk2\DR2 -> \Device\00000072 20:20:42.847 Disk 2 Vendor: RICOH 02 Size: 305245MB BusType: 0 20:20:42.868 Disk 0 MBR read successfully 20:20:42.874 Disk 0 MBR scan 20:20:42.879 Disk 0 Windows 7 default MBR code 20:20:42.893 Disk 0 Partition 1 00 27 Hidden NTFS WinRE NTFS 10497 MB offset 2048 20:20:42.908 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 21499904 20:20:42.918 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 294646 MB offset 21704704 20:20:42.939 Disk 0 scanning C:\Windows\system32\drivers 20:20:49.886 Service scanning 20:20:56.476 Service MpNWMon C:\Windows\system32\DRIVERS\MpNWMon.sys **LOCKED** 32 20:21:06.780 Modules scanning 20:21:06.795 Disk 0 trace - called modules: 20:21:06.860 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys iaStor.sys hal.dll 20:21:06.877 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004b1f060] 20:21:06.888 3 CLASSPNP.SYS[fffff88000dc043f] -> nt!IofCallDriver -> [0xfffffa8003cedbe0] 20:21:06.898 5 ACPI.sys[fffff88000f52781] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa800470e050] 20:21:06.909 Scan finished successfully 20:21:24.131 Disk 0 MBR has been saved successfully to "C:\Users\Avi\Desktop\MBR.dat" 20:21:24.137 The log file has been saved successfully to "C:\Users\Avi\Desktop\aswMBR.txt" . DDS (Ver_2011-08-26.01) - NTFSAMD64 Internet Explorer: 9.0.8112.16421 Run by [removed] at 20:13:14 on 2012-03-19 Microsoft Windows 7 Home Premium 6.1.7600.0.1252.2.1033.18.4063.2428 [GMT -7:00] . AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160} AV: Norton Internet Security *Disabled/Outdated* {63DF5164-9100-186D-2187-8DC619EFD8BF} SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: Norton Internet Security *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202} FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\nvvsvc.exe C:\Windows\system32\svchost.exe -k RPCSS c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\System32\svchost.exe -k yksvcs C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\nvvsvc.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe C:\Program Files\Microsoft LifeCam\MSCamS64.exe C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\ccSvcHst.exe C:\Windows\system32\taskhost.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe C:\Windows\system32\taskeng.exe C:\Program Files\Sony\VAIO Update 4\VAIOUpdt.exe C:\Windows\SysWOW64\PnkBstrA.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe C:\Windows\vVX3000.exe C:\Program Files\Microsoft Security Client\msseces.exe C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe C:\Program Files (x86)\uTorrent\uTorrent.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe C:\Windows\SysWOW64\DllHost.exe C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe C:\Program Files (x86)\Winamp\winampa.exe C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe C:\Program Files (x86)\Sony\SmartWi Connection Utility\CCP.exe C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe C:\Windows\system32\SearchIndexer.exe C:\Program Files (x86)\Sony\SmartWi Connection Utility\SmartWi.exe C:\Windows\system32\svchost.exe -k bthsvcs C:\Windows\system32\taskeng.exe C:\Program Files (x86)\Sony\VAIO Survey\VAIO Sat Survey.exe C:\Program Files\Sony\VAIO Care\VCsystray.exe C:\Windows\system32\WUDFHost.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\ccSvcHst.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Program Files (x86)\Sony\SmartWi Connection Utility\ThirdPartyAppMgr.exe C:\Program Files (x86)\Sony\SmartWi Connection Utility\PowerManager.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe C:\Program Files (x86)\Mozilla Firefox\firefox.exe C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\sppsvc.exe C:\Program Files\Sony\VAIO Power Management\SPMService.exe C:\Program Files\Sony\VAIO Power Management\SPMgr.exe C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\system32\wuauclt.exe C:\Windows\servicing\TrustedInstaller.exe C:\Program Files\Java\jre6\bin\jucheck.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\DllHost.exe C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\conhost.exe C:\Windows\SysWOW64\cscript.exe C:\Windows\system32\wbem\wmiprvse.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.facebook.com/ uDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=SNNT&bmod=SNNT mDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=SNNT&bmod=SNNT mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=SNNT&bmod=SNNT mWinlogon: Userinit=userinit.exe, BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: DivX Plus Web Player HTML5 : {326e768d-4182-46fd-9c16-1449a49795f4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\coIEPlg.dll BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\IPSBHO.DLL BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\coIEPlg.dll TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background uRun: [cdloader] "C:\Users\Avi\AppData\Roaming\mjusbsp\cdloader2.exe" MAGICJACK uRun: [uTorrent] "C:\Program Files (x86)\uTorrent\uTorrent.exe" /MINIMIZED mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" mRun: [SmartWiHelper] "C:\Program Files (x86)\Sony\SmartWi Connection Utility\SmartWiHelper.exe" /WindowsStartup mRun: [ISBMgr.exe] "C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe" mRun: [WinampAgent] "C:\Program Files (x86)\Winamp\winampa.exe" mRun: [LifeCam] "C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe" mRun: [SSDMonitor] C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe mRun: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\BLUETO~1.LNK - C:\Program Files (x86)\WIDCOMM\Bluetooth Software\BTTray.exe mPolicies-explorer: NoActiveDesktop = 1 (0x1) mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1) mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000 IE: Send image to &Bluetooth Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm IE: Send page to &Bluetooth Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} - hxxps://remote.fransenengineering.com/dana-cached/sc/JuniperSetupClient.cab TCP: DhcpNameServer = 192.168.0.1 TCP: Interfaces\{94723A2F-ABC6-4E7C-A564-9200D944F430} : DhcpNameServer = 192.168.0.1 TCP: Interfaces\{E2533797-0386-4787-99B2-9450816C96D1} : DhcpNameServer = 192.168.0.1 TCP: Interfaces\{E2533797-0386-4787-99B2-9450816C96D1}\A457C6965647 : DhcpNameServer = [removed] [removed] TCP: Interfaces\{E2533797-0386-4787-99B2-9450816C96D1}\C696E6B6379737 : DhcpNameServer = [removed] [removed] Handler: intu-tt2010 - {97A0575E-2309-4e75-8509-B1F9390C4DE7} - C:\Program Files (x86)\TurboTax 2010\ic2010pp.dll Handler: intu-tt2011 - {B3B5DAD9-E96D-45b4-B636-B6CF2F773DE1} - C:\Program Files (x86)\TurboTax 2011\ic2011pp.dll Handler: symres - {AA1061FE-6C41-421f-9344-69640C9732AB} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\CoIEPlg.dll Notify: VESWinlogon - VESWinlogon.dll BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO-X64: AcroIEHelperStub - No File BHO-X64: DivX Plus Web Player HTML5 : {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll BHO-X64: Increase performance and video formats for your HTML5 - No File BHO-X64: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO-X64: Symantec NCO BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\coIEPlg.dll BHO-X64: Symantec NCO BHO - No File BHO-X64: Symantec Intrusion Prevention: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\IPSBHO.DLL BHO-X64: Symantec Intrusion Prevention - No File BHO-X64: Windows Live Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO-X64: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll TB-X64: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\coIEPlg.dll TB-X64: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll TB-X64: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" mRun-x64: [SmartWiHelper] "C:\Program Files (x86)\Sony\SmartWi Connection Utility\SmartWiHelper.exe" /WindowsStartup mRun-x64: [ISBMgr.exe] "C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe" mRun-x64: [WinampAgent] "C:\Program Files (x86)\Winamp\winampa.exe" mRun-x64: [LifeCam] "C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe" mRun-x64: [SSDMonitor] C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe mRun-x64: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW IE-X64: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\Avi\AppData\Roaming\Mozilla\Firefox\Profiles\pbbcnf07.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://forums.whatthetech.com/index.php?showforum=27 FF - prefs.js: keyword.URL - hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=ZVxdm148YYCA&ptnrS=ZVxdm148YYCA&ptb=JrWlDCxDbDlcTUqxsjFfVA&ind=2011071318&n=77de8356&psa=&st=kwd&searchfor= FF - component: C:\Users\Avi\AppData\Roaming\Mozilla\Firefox\Profiles\pbbcnf07.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc.dll FF - plugin: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll FF - plugin: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll FF - plugin: C:\Program Files (x86)\Veetle\Player\npvlc.dll FF - plugin: C:\Program Files (x86)\Veetle\plugins\npVeetle.dll FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll FF - plugin: C:\Users\Avi\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll FF - plugin: C:\Users\Avi\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll . ============= SERVICES / DRIVERS =============== . R0 PxHlpa64;PxHlpa64;C:\Windows\system32\Drivers\PxHlpa64.sys –> C:\Windows\system32\Drivers\PxHlpa64.sys [?] R0 SymEFA;Symantec Extended File Attributes;C:\Windows\system32\drivers\NISx64\1008030.006\SYMEFA64.SYS –> C:\Windows\system32\drivers\NISx64\1008030.006\SYMEFA64.SYS [?] R1 BHDrvx64;Symantec Heuristics Driver;C:\Windows\system32\Drivers\NISx64\1008030.006\BHDrvx64.sys –> C:\Windows\system32\Drivers\NISx64\1008030.006\BHDrvx64.sys [?] R1 ccHP;Symantec Hash Provider;C:\Windows\system32\Drivers\NISx64\1008030.006\ccHPx64.sys –> C:\Windows\system32\Drivers\NISx64\1008030.006\ccHPx64.sys [?] R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20120224.002\IDSviA64.sys [2012-2-24 488568] R1 MpFilter;Microsoft Malware Protection Driver;C:\Windows\system32\DRIVERS\MpFilter.sys –> C:\Windows\system32\DRIVERS\MpFilter.sys [?] R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys –> C:\Windows\system32\DRIVERS\vwififlt.sys [?] R2 Norton Internet Security;Norton Internet Security;C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\ccSvcHst.exe [2012-1-27 117648] R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [2010-11-28 583640] R2 rimspci;rimspci;C:\Windows\system32\DRIVERS\rimssne64.sys –> C:\Windows\system32\DRIVERS\rimssne64.sys [?] R2 risdsnpe;risdsnpe;C:\Windows\system32\DRIVERS\risdsne64.sys –> C:\Windows\system32\DRIVERS\risdsne64.sys [?] R2 VAIO Power Management;VAIO Power Management;C:\Program Files\Sony\VAIO Power Management\SPMService.exe [2009-11-27 411496] R2 VCFw;VAIO Content Folder Watcher;C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [2009-7-22 642920] R2 yksvc;Marvell Yukon Service;C:\Windows\System32\svchost.exe -k yksvcs [2009-7-13 20992] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-2-10 138360] R3 MpNWMon;Microsoft Malware Protection Network Driver;C:\Windows\system32\DRIVERS\MpNWMon.sys –> C:\Windows\system32\DRIVERS\MpNWMon.sys [?] R3 NVHDA;Service for NVIDIA High Definition Audio Driver;C:\Windows\system32\drivers\nvhda64v.sys –> C:\Windows\system32\drivers\nvhda64v.sys [?] R3 SFEP;Sony Firmware Extension Parser;C:\Windows\system32\DRIVERS\SFEP.sys –> C:\Windows\system32\DRIVERS\SFEP.sys [?] R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk62x64.sys –> C:\Windows\system32\DRIVERS\yk62x64.sys [?] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2009-11-27 133104] S2 Roxio Upnp Server 10;Roxio Upnp Server 10;C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe [2009-6-26 362992] S3 btwl2cap;Bluetooth L2CAP Service;C:\Windows\system32\DRIVERS\btwl2cap.sys –> C:\Windows\system32\DRIVERS\btwl2cap.sys [?] S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2009-11-27 133104] S3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\system32\DRIVERS\netw5v64.sys –> C:\Windows\system32\DRIVERS\netw5v64.sys [?] S3 NisDrv;Microsoft Network Inspection System;C:\Windows\system32\DRIVERS\NisDrvWFP.sys –> C:\Windows\system32\DRIVERS\NisDrvWFP.sys [?] S3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-4-27 288272] S3 npggsvc;nProtect GameGuard Service;C:\Windows\system32\GameMon.des -service –> C:\Windows\system32\GameMon.des -service [?] S3 Roxio UPnP Renderer 10;Roxio UPnP Renderer 10;C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [2009-6-26 313840] S3 SampleCollector;Intel® Sample Collector;C:\Program Files\Sony\VAIO Care\collsvc.exe [2009-11-27 167424] S3 SOHCImp;VAIO Media plus Content Importer;C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe [2009-11-27 120104] S3 SOHDBSvr;VAIO Media plus Database Manager;C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe [2009-11-27 70952] S3 SOHDms;VAIO Media plus Digital Media Server;C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe [2009-11-27 427304] S3 SOHDs;VAIO Media plus Device Searcher;C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe [2009-11-27 75048] S3 SOHPlMgr;VAIO Media plus Playlist Manager;C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe [2009-11-27 91432] S3 SYMNDISV;Symantec Network Filter Driver;C:\Windows\system32\Drivers\NISx64\1008030.006\SYMNDISV.SYS –> C:\Windows\system32\Drivers\NISx64\1008030.006\SYMNDISV.SYS [?] S3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2009-11-27 468264] S3 VcmINSMgr;VAIO Content Metadata Intelligent Network Service Manager;C:\Program Files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [2009-11-27 357672] S3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [2009-11-27 110888] S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe –> C:\Windows\system32\Wat\WatAdminSvc.exe [?] S3 WSDPrintDevice;WSD Print Support via UMB;C:\Windows\system32\DRIVERS\WSDPrint.sys –> C:\Windows\system32\DRIVERS\WSDPrint.sys [?] . =============== Created Last 30 ================ . 2012-03-20 03:05:23 69000 —-a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{5FD6E8F8-F6F6-4396-A6C2-4F28B531F1B5}\offreg.dll 2012-03-19 05:39:40 ——– d—–w- C:\Users\Avi\AppData\Roaming\Malwarebytes 2012-03-19 05:39:13 ——– d—–w- C:\ProgramData\Malwarebytes 2012-03-19 05:39:11 23152 —-a-w- C:\Windows\System32\drivers\mbam.sys 2012-03-19 05:39:11 ——– d—–w- C:\Program Files (x86)\Malwarebytes' Anti-Malware 2012-03-19 00:46:35 8643640 —-a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{5FD6E8F8-F6F6-4396-A6C2-4F28B531F1B5}\mpengine.dll 2012-03-14 20:13:42 ——– d—–w- C:\Users\Avi\AppData\Roaming\TeamViewer 2012-03-14 16:49:51 5504880 —-a-w- C:\Windows\System32\ntoskrnl.exe 2012-03-14 16:49:50 3957616 —-a-w- C:\Windows\SysWow64\ntkrnlpa.exe 2012-03-14 16:49:49 3902320 —-a-w- C:\Windows\SysWow64\ntoskrnl.exe 2012-03-14 03:47:23 3143168 —-a-w- C:\Windows\System32\win32k.sys 2012-03-14 03:47:23 1541120 —-a-w- C:\Windows\System32\DWrite.dll 2012-03-14 03:47:22 320512 —-a-w- C:\Windows\System32\d3d10_1core.dll 2012-03-14 03:47:22 218624 —-a-w- C:\Windows\SysWow64\d3d10_1core.dll 2012-03-14 03:47:22 1837568 —-a-w- C:\Windows\System32\d3d10warp.dll 2012-03-14 03:47:22 1170944 —-a-w- C:\Windows\SysWow64\d3d10warp.dll 2012-03-14 03:47:22 1074176 —-a-w- C:\Windows\SysWow64\DWrite.dll 2012-03-14 03:47:21 902656 —-a-w- C:\Windows\System32\d2d1.dll 2012-03-14 03:47:21 739840 —-a-w- C:\Windows\SysWow64\d2d1.dll 2012-03-14 03:47:21 197120 —-a-w- C:\Windows\System32\d3d10_1.dll 2012-03-14 03:47:21 161792 —-a-w- C:\Windows\SysWow64\d3d10_1.dll 2012-03-14 03:46:50 826368 —-a-w- C:\Windows\SysWow64\rdpcore.dll 2012-03-14 03:46:50 23552 —-a-w- C:\Windows\System32\drivers\tdtcp.sys 2012-03-14 03:46:50 204800 —-a-w- C:\Windows\System32\drivers\rdpwd.sys 2012-03-14 03:46:50 1031680 —-a-w- C:\Windows\System32\rdpcore.dll 2012-03-14 03:46:49 9216 —-a-w- C:\Windows\System32\rdrmemptylst.exe 2012-03-14 03:46:49 76288 —-a-w- C:\Windows\System32\rdpwsx.dll 2012-03-14 03:46:49 149504 —-a-w- C:\Windows\System32\rdpcorekmts.dll . ==================== Find3M ==================== . 2012-01-31 12:44:20 279656 ——w- C:\Windows\System32\MpSigStub.exe 2012-01-28 06:04:46 561800 —-a-w- C:\Windows\System32\drivers\NISx64\1008030.006\cchpx64.sys 2012-01-26 04:23:22 172592 —-a-w- C:\Windows\System32\drivers\SYMEVENT64x86.SYS 2012-01-04 09:58:13 509952 —-a-w- C:\Windows\System32\ntshrui.dll 2012-01-04 09:03:07 442880 —-a-w- C:\Windows\SysWow64\ntshrui.dll 2012-01-03 06:24:52 515584 —-a-w- C:\Windows\System32\timedate.cpl 2012-01-03 05:44:24 478208 —-a-w- C:\Windows\SysWow64\timedate.cpl 2011-12-28 03:59:11 499200 —-a-w- C:\Windows\System32\drivers\afd.sys . ============= FINISH: 20:13:54.93 =============== Malwarebytes Anti-Malware 1.60.1.1000 www.malwarebytes.org Database version: v2012.03.19.01 Windows 7 x64 NTFS Internet Explorer 9.0.8112.16421 Avi :: AVI-VAIO [administrator] 18/03/2012 11:06:20 PM mbam-log-2012-03-18 (23-06-20).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 195157 Time elapsed: 7 minute(s), 3 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end)

Attachments:

Post #6
Hi klown604,

Looks like Malwarebytes did not remove anything.

Please do the following:

Refer to the ComboFix User's Guide

  • Download ComboFix from one of these locations:

    Link 1
    Link 2

    * IMPORTANT !!! Place ComboFix.exe on your Desktop
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.
    You can get help on disabling your protection programs here
  • Double click on ComboFix.exe & follow the prompts.
  • Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
  • When finished, it shall produce a log for you. Post that log in your next reply

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

    ———————————————————————————————
  • Ensure your AntiVirus and AntiSpyware applications are re-enabled.

    ———————————————————————————————

NOTE: If you encounter a message "illegal operation attempted on registry key that has been marked for deletion" and no programs will run - please just reboot and that will resolve that error.
Post #8
First run of Combofix froze. Second run took almost an hour. Here's the log: ComboFix 12-03-18.04 - Avi 19/03/2012 21:19:05.2.2 - x64 Microsoft Windows 7 Home Premium 6.1.7600.0.1252.2.1033.18.4063.2809 [GMT -7:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160} AV: Norton Internet Security *Disabled/Outdated* {63DF5164-9100-186D-2187-8DC619EFD8BF} FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4} SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD} SP: Norton Internet Security *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . —- Previous Run ——- . c:\users\Avi\AppData\Roaming\Adobe\plugs c:\users\Avi\AppData\Roaming\Adobe\shed c:\users\Avi\AppData\Roaming\Help\coredb\storage . . ((((((((((((((((((((((((( Files Created from 2012-02-20 to 2012-03-20 ))))))))))))))))))))))))))))))) . . 2012-03-20 04:30 . 2012-03-20 04:30 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-03-20 04:15 . 2012-03-20 04:15 69000 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{633BDBA3-660F-441E-A5AA-B6A1F4766012}\offreg.dll 2012-03-20 03:17 . 2012-02-08 07:13 8643640 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{633BDBA3-660F-441E-A5AA-B6A1F4766012}\mpengine.dll 2012-03-19 05:39 . 2012-03-19 05:39 ——– d—–w- c:\users\Avi\AppData\Roaming\Malwarebytes 2012-03-19 05:39 . 2012-03-19 05:39 ——– d—–w- c:\programdata\Malwarebytes 2012-03-19 05:39 . 2012-03-19 05:39 ——– d—–w- c:\program files (x86)\Malwarebytes' Anti-Malware 2012-03-19 05:39 . 2011-12-10 22:24 23152 —-a-w- c:\windows\system32\drivers\mbam.sys 2012-03-14 20:13 . 2012-03-14 20:13 ——– d—–w- c:\users\Avi\AppData\Roaming\TeamViewer 2012-03-14 16:49 . 2011-11-19 18:30 5504880 —-a-w- c:\windows\system32\ntoskrnl.exe 2012-03-14 16:49 . 2011-11-19 14:25 3957616 —-a-w- c:\windows\SysWow64\ntkrnlpa.exe 2012-03-14 16:49 . 2011-11-19 14:25 3902320 —-a-w- c:\windows\SysWow64\ntoskrnl.exe 2012-03-14 03:47 . 2012-02-10 06:18 1541120 —-a-w- c:\windows\system32\DWrite.dll 2012-03-14 03:47 . 2012-02-03 04:16 3143168 —-a-w- c:\windows\system32\win32k.sys 2012-03-14 03:47 . 2012-02-10 06:17 1837568 —-a-w- c:\windows\system32\d3d10warp.dll 2012-03-14 03:47 . 2012-02-10 06:17 320512 —-a-w- c:\windows\system32\d3d10_1core.dll 2012-03-14 03:47 . 2012-02-10 05:41 1074176 —-a-w- c:\windows\SysWow64\DWrite.dll 2012-03-14 03:47 . 2012-02-10 05:41 218624 —-a-w- c:\windows\SysWow64\d3d10_1core.dll 2012-03-14 03:47 . 2012-02-10 05:41 1170944 —-a-w- c:\windows\SysWow64\d3d10warp.dll 2012-03-14 03:47 . 2012-02-10 06:17 902656 —-a-w- c:\windows\system32\d2d1.dll 2012-03-14 03:47 . 2012-02-10 06:17 197120 —-a-w- c:\windows\system32\d3d10_1.dll 2012-03-14 03:47 . 2012-02-10 05:41 161792 —-a-w- c:\windows\SysWow64\d3d10_1.dll 2012-03-14 03:47 . 2012-02-10 05:41 739840 —-a-w- c:\windows\SysWow64\d2d1.dll 2012-03-14 03:46 . 2012-02-15 06:27 1031680 —-a-w- c:\windows\system32\rdpcore.dll 2012-03-14 03:46 . 2012-02-15 05:44 826368 —-a-w- c:\windows\SysWow64\rdpcore.dll 2012-03-14 03:46 . 2012-02-15 04:47 204800 —-a-w- c:\windows\system32\drivers\rdpwd.sys 2012-03-14 03:46 . 2012-02-15 04:46 23552 —-a-w- c:\windows\system32\drivers\tdtcp.sys 2012-03-14 03:46 . 2012-01-25 06:27 76288 —-a-w- c:\windows\system32\rdpwsx.dll 2012-03-14 03:46 . 2012-01-25 06:27 149504 —-a-w- c:\windows\system32\rdpcorekmts.dll 2012-03-14 03:46 . 2012-01-25 06:20 9216 —-a-w- c:\windows\system32\rdrmemptylst.exe . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-02-11 04:52 . 2012-02-11 04:53 927800 ——w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{DE1C7EEA-F32F-4B06-96A0-A086F754207D}\gapaengine.dll 2012-02-08 07:13 . 2011-04-24 22:26 8643640 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2012-01-31 12:44 . 2009-12-24 02:18 279656 ——w- c:\windows\system32\MpSigStub.exe 2012-01-28 06:04 . 2012-01-28 06:04 561800 —-a-w- c:\windows\system32\drivers\NISx64\1008030.006\cchpx64.sys 2012-01-26 04:23 . 2012-01-26 04:23 172592 —-a-w- c:\windows\system32\drivers\SYMEVENT64x86.SYS 2012-01-04 09:58 . 2012-02-16 15:34 509952 —-a-w- c:\windows\system32\ntshrui.dll 2012-01-04 09:03 . 2012-02-16 15:34 442880 —-a-w- c:\windows\SysWow64\ntshrui.dll 2012-01-03 06:24 . 2012-02-16 15:34 515584 —-a-w- c:\windows\system32\timedate.cpl 2012-01-03 05:44 . 2012-02-16 15:33 478208 —-a-w- c:\windows\SysWow64\timedate.cpl 2011-12-28 03:59 . 2012-02-16 15:33 499200 —-a-w- c:\windows\system32\drivers\afd.sys . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-11-28 39408] "cdloader"="c:\users\Avi\AppData\Roaming\mjusbsp\cdloader2.exe" [2011-08-23 50592] "uTorrent"="c:\program files (x86)\uTorrent\uTorrent.exe" [2012-03-03 740216] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696] "SmartWiHelper"="c:\program files (x86)\Sony\SmartWi Connection Utility\SmartWiHelper.exe" [2009-08-26 79872] "ISBMgr.exe"="c:\program files (x86)\Sony\ISB Utility\ISBMgr.exe" [2009-05-26 317288] "WinampAgent"="c:\program files (x86)\Winamp\winampa.exe" [2010-01-13 37888] "LifeCam"="c:\program files (x86)\Microsoft LifeCam\LifeExp.exe" [2010-05-20 119152] "SSDMonitor"="c:\program files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe" [2010-08-05 104408] "DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-03-21 1230704] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-7-1 1079584] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon] 2009-07-01 16:49 98304 —-a-w- c:\windows\System32\VESWinlogon.dll . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys] @="FSFilter Activity Monitor" . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-11-28 133104] R2 Roxio Upnp Server 10;Roxio Upnp Server 10;c:\program files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe [2009-06-26 362992] R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x] R3 dump_wmimmc;dump_wmimmc;c:\gpotato.eu\Dragonica\Release\GameGuard\dump_wmimmc.sys [x] R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-11-28 133104] R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [x] R3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [x] R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x] R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-28 288272] R3 Roxio UPnP Renderer 10;Roxio UPnP Renderer 10;c:\program files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [2009-06-26 313840] R3 SampleCollector;Intel® Sample Collector;c:\program files\Sony\VAIO Care\collsvc.exe [2008-09-29 167424] R3 SOHCImp;VAIO Media plus Content Importer;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe [2009-07-27 120104] R3 SOHDBSvr;VAIO Media plus Database Manager;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe [2009-07-27 70952] R3 SOHDms;VAIO Media plus Digital Media Server;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe [2009-07-27 427304] R3 SOHDs;VAIO Media plus Device Searcher;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe [2009-07-27 75048] R3 SOHPlMgr;VAIO Media plus Playlist Manager;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe [2009-07-27 91432] R3 SYMNDISV;Symantec Network Filter Driver;c:\windows\System32\Drivers\NISx64\1008030.006\SYMNDISV.SYS [x] R3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2009-06-26 468264] R3 VcmINSMgr;VAIO Content Metadata Intelligent Network Service Manager;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [2009-06-26 357672] R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [2009-06-17 110888] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [x] S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x] S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1008030.006\SYMEFA64.SYS [x] S1 BHDrvx64;Symantec Heuristics Driver;c:\windows\System32\Drivers\NISx64\1008030.006\BHDrvx64.sys [x] S1 ccHP;Symantec Hash Provider;c:\windows\System32\Drivers\NISx64\1008030.006\ccHPx64.sys [x] S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20120224.002\IDSvia64.sys [2012-01-26 488568] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] S2 Norton Internet Security;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\16.8.3.6\ccSvcHst.exe [2011-09-22 117648] S2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [2010-08-05 583640] S2 rimspci;rimspci;c:\windows\system32\DRIVERS\rimssne64.sys [x] S2 risdsnpe;risdsnpe;c:\windows\system32\DRIVERS\risdsne64.sys [x] S2 VAIO Power Management;VAIO Power Management;c:\program files\Sony\VAIO Power Management\SPMService.exe [2009-08-22 411496] S2 VCFw;VAIO Content Folder Watcher;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [2009-07-22 642920] S2 yksvc;Marvell Yukon Service;c:\windows\System32\svchost.exe [2009-07-14 27136] S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-02-03 138360] S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x] S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\DRIVERS\SFEP.sys [x] S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x] . . — Other Services/Drivers In Memory — . *NewlyCreated* - WS2IFSL . Contents of the 'Scheduled Tasks' folder . 2012-03-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-11-28 00:16] . 2012-03-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-11-28 00:16] . 2012-03-18 c:\windows\Tasks\Norton Security Scan for Avi.job - c:\program files (x86)\Norton Security Scan\Engine\2.7.3.34\Nss.exe [2010-07-14 18:06] . 2012-03-19 c:\windows\Tasks\RMSchedule.job - c:\program files (x86)\Registry Mechanic\RegMech.exe [2010-11-29 16:46] . . ——— x86-64 ———– . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-07-24 7938080] "Skytel"="c:\program files\Realtek\Audio\HDA\Skytel.exe" [2009-07-24 1833504] "IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-05 186904] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-10-03 16395880] "VX3000"="c:\windows\vVX3000.exe" [2010-05-20 762736] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 1436736] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x0 . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://www.facebook.com/ mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=SNNT&bmod=SNNT mLocal Page = c:\windows\SysWOW64\blank.htm IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000 IE: Send image to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm IE: Send page to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm TCP: DhcpNameServer = 192.168.0.1 Handler: intu-tt2011 - {B3B5DAD9-E96D-45b4-B636-B6CF2F773DE1} - c:\program files (x86)\TurboTax 2011\ic2011pp.dll FF - ProfilePath - c:\users\Avi\AppData\Roaming\Mozilla\Firefox\Profiles\pbbcnf07.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://forums.whatthetech.com/index.php?showforum=27 FF - prefs.js: keyword.URL - hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=ZVxdm148YYCA&ptnrS=ZVxdm148YYCA&ptb=JrWlDCxDbDlcTUqxsjFfVA&ind=2011071318&n=77de8356&psa=&st=kwd&searchfor= . - - - - ORPHANS REMOVED - - - - . WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc.exe . . . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Norton Internet Security] "ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\16.8.3.6\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files (x86)\Norton Internet Security\Engine\16.8.3.6\diMaster.dll\" /prefetch:1" – . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SampleCollector] "ImagePath"="\"c:\program files\Sony\VAIO Care\collsvc.exe\" \"/service\" \"/counter=\Processor(_Total)\% Processor Time:5\" \"/counter=\PhysicalDisk(_Total)\Disk Bytes/sec:5\" \"/counter=\Network Interface(*)\Bytes Total/sec:5\" \"/directory=inteldata\"" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc] "ImagePath"="c:\windows\system32\GameMon.des -service" . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11c_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11c_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2012-03-19 21:49:17 ComboFix-quarantined-files.txt 2012-03-20 04:49 . Pre-Run: 43,321,393,152 bytes free Post-Run: 42,955,718,656 bytes free . - - End Of File - - 5A2B83AC780F85452D8475CAA0759B2B
Post #9
Hi klown604,

Thanks for the log. You have some outdated software.

Update Adobe Reader
Earlier versions of Adobe Reader have known security flaws so it is recommended that you update your copy
  • Go to Start > Control Panel > Add/Remove Programs
  • Remove ALL instances of Adobe Reader
  • Re-boot your computer if required.
  • Once ALL versions of Adobe Reader have been uninstalled, visit: <> and download the latest version of Adobe Reader.
  • Make sure you uncheck Yes, install McAfee Security Scan Plus - optional if prompted.
Alternative Option: after uninstalling Adobe Reader, you could try downloading and installing SlimPDF Reader from >here< SlimPDF Reader comes with no bloatware and loads extremely quickly.

===================================================

Flash Player is out of date
  • Outdated versions of Flash are vulnerable to malware infections.
  • Please uninstall old versions of Flash Player by following the instructions here.
  • Next, click here to download the latest version of Flash Player.
  • Uncheck "Yes, install Google Toolbar - optional" if you do not want to install Google Toolbar.
  • Click Download Now then double click on the setup file to start the installation.
===================================================

ESET Online Scanner
I'd like us to scan your machine with ESET OnlineScan

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.


  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the [external image: Posted Image] button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the [external image: Posted Image] icon on your desktop.
  • Check [external image: Posted Image]
  • Click the [external image: Posted Image] button.
  • Accept any security warnings from your browser.
  • Check [external image: Posted Image]
  • Make sure that the option "Remove found threats" is Unchecked
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin
    scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push [external image: Posted Image]
  • Push [external image: Posted Image], and save the file to your desktop using a unique name, such as
    ESETScan. Include the contents of this report in your next reply.
  • Push the [external image: Posted Image] button.
  • Push [external image: Posted Image]
Post #11
Hi klown604,

I noticed that you have two antivirus suites installed on your computer (Microsoft Security Essentials and Norton Internet Security). This can lead to conflict and sluggish performance. I suggest you remove one of the antivirus suites. I prefer to use Microsoft Security Essentials, but I understand you may have paid for a subscription from Norton.

===================================================

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text. 

File::
C:\Users\Avi\AppData\LocalLow\FunWebProducts\Installr\Cache\002FBF49.exe
C:\Users\Avi\AppData\LocalLow\MyWebSearch\bar\Cache\00136769.exe
C:\Users\Avi\AppData\Roaming\2878DB1234C21D5A5B6744E1024A6DDC\enemies-names.txt

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …


[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe


Then post the results log using Copy / Paste
Post #12 last edited
Hi NoodleTech, Actually the subscription of my Norton AV already expired. Is there a way to totally remove all traces of all norton products? Thanks.
Post #14
Thanks for the link. Heres the log: ComboFix 12-03-18.04 - Avi 20/03/2012 22:13:15.3.2 - x64 Microsoft Windows 7 Home Premium 6.1.7600.0.1252.2.1033.18.4063.2535 [GMT -7:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe Command switches used :: c:\users\Avi\Desktop\CFScript.txt AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160} SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . FILE :: "c:\users\Avi\AppData\LocalLow\FunWebProducts\Installr\Cache\002FBF49.exe" "c:\users\Avi\AppData\LocalLow\MyWebSearch\bar\Cache\00136769.exe" "c:\users\Avi\AppData\Roaming\2878DB1234C21D5A5B6744E1024A6DDC\enemies-names.txt" . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\users\Avi\AppData\LocalLow\FunWebProducts\Installr\Cache\002FBF49.exe c:\users\Avi\AppData\LocalLow\MyWebSearch\bar\Cache\00136769.exe c:\users\Avi\AppData\Roaming\2878DB1234C21D5A5B6744E1024A6DDC\enemies-names.txt . . ((((((((((((((((((((((((( Files Created from 2012-02-21 to 2012-03-21 ))))))))))))))))))))))))))))))) . . 2012-03-21 05:19 . 2012-03-21 05:19 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-03-21 05:07 . 2012-03-21 05:07 69000 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{09DE37A5-830C-4244-969B-8D70CF9EEBDD}\offreg.dll 2012-03-21 02:05 . 2012-02-08 07:13 8643640 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{09DE37A5-830C-4244-969B-8D70CF9EEBDD}\mpengine.dll 2012-03-20 06:40 . 2012-03-20 06:40 ——– d—–w- c:\program files (x86)\ESET 2012-03-20 06:37 . 2012-03-20 06:37 414368 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-03-20 06:35 . 2012-03-20 06:35 ——– d—–w- c:\program files (x86)\Common Files\SlimPDFReader 2012-03-20 06:35 . 2012-03-20 06:35 ——– d—–w- c:\program files (x86)\Investintech.com Inc 2012-03-19 05:39 . 2012-03-19 05:39 ——– d—–w- c:\users\Avi\AppData\Roaming\Malwarebytes 2012-03-19 05:39 . 2012-03-19 05:39 ——– d—–w- c:\programdata\Malwarebytes 2012-03-19 05:39 . 2012-03-19 05:39 ——– d—–w- c:\program files (x86)\Malwarebytes' Anti-Malware 2012-03-19 05:39 . 2011-12-10 22:24 23152 —-a-w- c:\windows\system32\drivers\mbam.sys 2012-03-14 20:13 . 2012-03-14 20:13 ——– d—–w- c:\users\Avi\AppData\Roaming\TeamViewer 2012-03-14 16:49 . 2011-11-19 18:30 5504880 —-a-w- c:\windows\system32\ntoskrnl.exe 2012-03-14 16:49 . 2011-11-19 14:25 3957616 —-a-w- c:\windows\SysWow64\ntkrnlpa.exe 2012-03-14 16:49 . 2011-11-19 14:25 3902320 —-a-w- c:\windows\SysWow64\ntoskrnl.exe 2012-03-14 03:47 . 2012-02-10 06:18 1541120 —-a-w- c:\windows\system32\DWrite.dll 2012-03-14 03:47 . 2012-02-03 04:16 3143168 —-a-w- c:\windows\system32\win32k.sys 2012-03-14 03:47 . 2012-02-10 06:17 1837568 —-a-w- c:\windows\system32\d3d10warp.dll 2012-03-14 03:47 . 2012-02-10 06:17 320512 —-a-w- c:\windows\system32\d3d10_1core.dll 2012-03-14 03:47 . 2012-02-10 05:41 1074176 —-a-w- c:\windows\SysWow64\DWrite.dll 2012-03-14 03:47 . 2012-02-10 05:41 218624 —-a-w- c:\windows\SysWow64\d3d10_1core.dll 2012-03-14 03:47 . 2012-02-10 05:41 1170944 —-a-w- c:\windows\SysWow64\d3d10warp.dll 2012-03-14 03:47 . 2012-02-10 06:17 902656 —-a-w- c:\windows\system32\d2d1.dll 2012-03-14 03:47 . 2012-02-10 06:17 197120 —-a-w- c:\windows\system32\d3d10_1.dll 2012-03-14 03:47 . 2012-02-10 05:41 161792 —-a-w- c:\windows\SysWow64\d3d10_1.dll 2012-03-14 03:47 . 2012-02-10 05:41 739840 —-a-w- c:\windows\SysWow64\d2d1.dll 2012-03-14 03:46 . 2012-02-15 06:27 1031680 —-a-w- c:\windows\system32\rdpcore.dll 2012-03-14 03:46 . 2012-02-15 05:44 826368 —-a-w- c:\windows\SysWow64\rdpcore.dll 2012-03-14 03:46 . 2012-02-15 04:47 204800 —-a-w- c:\windows\system32\drivers\rdpwd.sys 2012-03-14 03:46 . 2012-02-15 04:46 23552 —-a-w- c:\windows\system32\drivers\tdtcp.sys 2012-03-14 03:46 . 2012-01-25 06:27 76288 —-a-w- c:\windows\system32\rdpwsx.dll 2012-03-14 03:46 . 2012-01-25 06:27 149504 —-a-w- c:\windows\system32\rdpcorekmts.dll 2012-03-14 03:46 . 2012-01-25 06:20 9216 —-a-w- c:\windows\system32\rdrmemptylst.exe . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-02-11 04:52 . 2012-02-11 04:53 927800 ——w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{DE1C7EEA-F32F-4B06-96A0-A086F754207D}\gapaengine.dll 2012-02-08 07:13 . 2011-04-24 22:26 8643640 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2012-01-31 12:44 . 2009-12-24 02:18 279656 ——w- c:\windows\system32\MpSigStub.exe 2012-01-04 09:58 . 2012-02-16 15:34 509952 —-a-w- c:\windows\system32\ntshrui.dll 2012-01-04 09:03 . 2012-02-16 15:34 442880 —-a-w- c:\windows\SysWow64\ntshrui.dll 2012-01-03 06:24 . 2012-02-16 15:34 515584 —-a-w- c:\windows\system32\timedate.cpl 2012-01-03 05:44 . 2012-02-16 15:33 478208 —-a-w- c:\windows\SysWow64\timedate.cpl 2011-12-28 03:59 . 2012-02-16 15:33 499200 —-a-w- c:\windows\system32\drivers\afd.sys . . ((((((((((((((((((((((((((((( SnapShot@2012-03-20_04.31.14 ))))))))))))))))))))))))))))))))))))))))) . + 2009-11-16 19:44 . 2012-03-21 05:09 56778 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin + 2009-07-14 05:10 . 2012-03-21 05:09 49284 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin + 2009-12-24 02:06 . 2012-03-21 05:09 19494 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2636114741-474596119-2817400375-1000_UserData.bin - 2009-12-24 02:06 . 2012-03-20 03:07 19494 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2636114741-474596119-2817400375-1000_UserData.bin - 2009-07-14 05:30 . 2012-01-28 09:15 86016 c:\windows\system32\DriverStore\infpub.dat + 2009-07-14 05:30 . 2012-03-21 05:04 86016 c:\windows\system32\DriverStore\infpub.dat + 2009-12-24 02:00 . 2012-03-20 08:25 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2009-12-24 02:00 . 2012-03-17 16:30 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2009-12-24 02:00 . 2012-03-20 08:25 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2009-12-24 02:00 . 2012-03-17 16:30 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2009-07-14 04:54 . 2012-03-20 08:25 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2009-07-14 04:54 . 2012-03-17 16:30 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2011-11-22 06:57 . 2011-11-22 06:57 68880 c:\windows\Microsoft.NET\Framework64\v4.0.30319\nlssorting.dll + 2011-11-22 05:31 . 2011-11-22 05:31 57616 c:\windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll - 2012-02-17 04:46 . 2012-02-17 04:46 87408 c:\windows\Microsoft.NET\assembly\GAC_MSIL\WindowsFormsIntegration\v4.0_4.0.0.0__31bf3856ad364e35\WindowsFormsIntegration.dll + 2012-03-20 10:03 . 2012-03-20 10:03 87408 c:\windows\Microsoft.NET\assembly\GAC_MSIL\WindowsFormsIntegration\v4.0_4.0.0.0__31bf3856ad364e35\WindowsFormsIntegration.dll + 2012-03-20 10:03 . 2012-03-20 10:03 93024 c:\windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll - 2012-02-17 04:46 . 2012-02-17 04:46 93024 c:\windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll + 2012-03-20 10:03 . 2012-03-20 10:03 35688 c:\windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll - 2012-02-17 04:46 . 2012-02-17 04:46 35688 c:\windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll - 2012-02-17 04:46 . 2012-02-17 04:46 11120 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml.Serialization\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.Serialization.dll + 2012-03-20 10:03 . 2012-03-20 10:03 11120 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml.Serialization\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.Serialization.dll - 2012-02-17 04:46 . 2012-02-17 04:46 17784 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Presentation\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Presentation.dll + 2012-03-20 10:03 . 2012-03-20 10:03 17784 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Presentation\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Presentation.dll - 2012-02-17 04:46 . 2012-02-17 04:46 58240 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Input.Manipulations\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Input.Manipulations.dll + 2012-03-20 10:03 . 2012-03-20 10:03 58240 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Input.Manipulations\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Input.Manipulations.dll - 2012-02-17 04:46 . 2012-02-17 04:46 44920 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.ApplicationServices\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.ApplicationServices.dll + 2012-03-20 10:03 . 2012-03-20 10:03 44920 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.ApplicationServices\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.ApplicationServices.dll - 2012-02-17 04:46 . 2012-02-17 04:46 37240 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Channels\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Channels.dll + 2012-03-20 10:03 . 2012-03-20 10:03 37240 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Channels\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Channels.dll - 2012-02-17 04:46 . 2012-02-17 04:46 64352 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll + 2012-03-20 10:03 . 2012-03-20 10:03 64352 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll - 2012-02-17 04:46 . 2012-02-17 04:46 51032 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Device\v4.0_4.0.0.0__b77a5c561934e089\System.Device.dll + 2012-03-20 10:03 . 2012-03-20 10:03 51032 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Device\v4.0_4.0.0.0__b77a5c561934e089\System.Device.dll - 2012-02-17 04:46 . 2012-02-17 04:46 50552 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.DataSetExtensions\v4.0_4.0.0.0__b77a5c561934e089\System.Data.DataSetExtensions.dll + 2012-03-20 10:03 . 2012-03-20 10:03 50552 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.DataSetExtensions\v4.0_4.0.0.0__b77a5c561934e089\System.Data.DataSetExtensions.dll + 2012-03-20 10:03 . 2012-03-20 10:03 81784 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll - 2012-02-17 04:46 . 2012-02-17 04:46 81784 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll - 2012-02-17 04:46 . 2012-02-17 04:46 81800 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\v4.0_4.0.0.0__31bf3856ad364e35\System.ComponentModel.DataAnnotations.dll + 2012-03-20 10:03 . 2012-03-20 10:03 81800 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\v4.0_4.0.0.0__31bf3856ad364e35\System.ComponentModel.DataAnnotations.dll + 2012-03-20 10:03 . 2012-03-20 10:03 39784 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.AddIn.Contract\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.AddIn.Contract.dll - 2012-02-17 04:46 . 2012-02-17 04:46 39784 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.AddIn.Contract\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.AddIn.Contract.dll - 2012-02-17 04:46 . 2012-02-17 04:46 68952 c:\windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll + 2012-03-20 10:03 . 2012-03-20 10:03 68952 c:\windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll + 2012-03-20 10:03 . 2012-03-20 10:03 62880 c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.ApplicationServer.Applications\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Windows.ApplicationServer.Applications.dll - 2012-02-17 04:46 . 2012-02-17 04:46 62880 c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.ApplicationServer.Applications\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Windows.ApplicationServer.Applications.dll - 2012-02-17 04:46 . 2012-02-17 04:46 12128 c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll + 2012-03-20 10:03 . 2012-03-20 10:03 12128 c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll - 2012-02-17 04:46 . 2012-02-17 04:46 97680 c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll + 2012-03-20 10:03 . 2012-03-20 10:03 97680 c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll + 2012-03-20 10:03 . 2012-03-20 10:03 17240 c:\windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll - 2012-02-17 04:46 . 2012-02-17 04:46 17240 c:\windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll + 2012-03-20 10:03 . 2012-03-20 10:03 94552 c:\windows\Microsoft.NET\assembly\GAC_64\ISymWrapper\v4.0_4.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll - 2012-02-17 04:46 . 2012-02-17 04:46 94552 c:\windows\Microsoft.NET\assembly\GAC_64\ISymWrapper\v4.0_4.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll - 2012-02-17 04:46 . 2012-02-17 04:46 91488 c:\windows\Microsoft.NET\assembly\GAC_64\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll + 2012-03-20 10:03 . 2012-03-20 10:03 91488 c:\windows\Microsoft.NET\assembly\GAC_64\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll - 2012-02-17 04:45 . 2012-02-17 04:45 78168 c:\windows\Microsoft.NET\assembly\GAC_32\ISymWrapper\v4.0_4.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll + 2012-03-20 10:02 . 2012-03-20 10:02 78168 c:\windows\Microsoft.NET\assembly\GAC_32\ISymWrapper\v4.0_4.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll + 2012-03-20 10:02 . 2012-03-20 10:02 81248 c:\windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll - 2012-02-17 04:45 . 2012-02-17 04:45 81248 c:\windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll + 2012-03-20 10:13 . 2012-03-20 10:13 10240 c:\windows\assembly\NativeImages_v4.0.30319_64\System.Xml.Serializ#\f137c53afae3903f20eba1fa0f8f8dad\System.Xml.Serialization.ni.dll + 2012-03-20 10:13 . 2012-03-20 10:13 43520 c:\windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Pres#\ef151d5b49d8b0d0052d05fc56d25107\System.Windows.Presentation.ni.dll + 2012-03-20 10:12 . 2012-03-20 10:12 86016 c:\windows\assembly\NativeImages_v4.0.30319_64\System.Web.Applicat#\c5b08a1a9a7a97922af50f30b5e32268\System.Web.ApplicationServices.ni.dll + 2012-03-20 10:10 . 2012-03-20 10:10 97792 c:\windows\assembly\NativeImages_v4.0.30319_64\System.AddIn.Contra#\5b53a87f7799ee5454e4fb8faece3a82\System.AddIn.Contract.ni.dll + 2012-03-20 10:07 . 2012-03-20 10:07 14336 c:\windows\assembly\NativeImages_v4.0.30319_64\Microsoft.VisualC\a4e98103e5d36bf22ef19c64442543f2\Microsoft.VisualC.ni.dll + 2012-03-20 10:07 . 2012-03-20 10:07 10752 c:\windows\assembly\NativeImages_v4.0.30319_64\dfsvc\cbd21f19057f07ec2cb55b2bef91f344\dfsvc.ni.exe + 2012-03-20 10:07 . 2012-03-20 10:07 58368 c:\windows\assembly\NativeImages_v4.0.30319_64\Accessibility\52890eb2a4f8d822bff7e9cddc713fb5\Accessibility.ni.dll + 2012-03-20 10:14 . 2012-03-20 10:14 96768 c:\windows\assembly\NativeImages_v4.0.30319_32\UIAutomationProvider\9a3f2f7233160bfcb2fd278d05da630c\UIAutomationProvider.ni.dll + 2012-03-20 10:16 . 2012-03-20 10:16 35328 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Pres#\931e299528cf8cb4c1b7321e5be5fb1e\System.Windows.Presentation.ni.dll + 2012-03-20 10:16 . 2012-03-20 10:16 71680 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Web.Applicat#\89383b658e1538a95c9004e5b30fff39\System.Web.ApplicationServices.ni.dll + 2012-03-20 10:16 . 2012-03-20 10:16 82432 c:\windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\5173df5175ccade890b8e0117297fdae\System.ServiceModel.Channels.ni.dll + 2012-03-20 10:14 . 2012-03-20 10:14 78848 c:\windows\assembly\NativeImages_v4.0.30319_32\System.AddIn.Contra#\541d664486e505282e6805462b288507\System.AddIn.Contract.ni.dll + 2012-03-20 10:14 . 2012-03-20 10:14 11776 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualC\bf2bfecb57a7987d05968d7494512ce8\Microsoft.VisualC.ni.dll + 2012-03-20 10:13 . 2012-03-20 10:13 44544 c:\windows\assembly\NativeImages_v4.0.30319_32\Accessibility\cbc5e9834f47c0aaa4808764ac2afd11\Accessibility.ni.dll + 2010-03-23 04:46 . 2012-03-20 14:26 4642 c:\windows\system32\wdi\ERCQueuedResolutions.dat - 2012-03-20 04:14 . 2012-03-20 04:14 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2012-03-21 05:07 . 2012-03-21 05:07 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2012-03-20 04:14 . 2012-03-20 04:14 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2012-03-21 05:07 . 2012-03-21 05:07 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2012-03-20 10:16 . 2012-03-20 10:16 9216 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Xml.Serializ#\1d9f36e98e17e1f594b25f42269801ac\System.Xml.Serialization.ni.dll + 2012-03-20 10:13 . 2012-03-20 10:13 9728 c:\windows\assembly\NativeImages_v4.0.30319_32\dfsvc\ae8a2abe6e9b5931480460c20967b216\dfsvc.ni.exe + 2012-03-20 06:37 . 2012-03-20 06:37 250528 c:\windows\SysWOW64\Macromed\Flash\FlashUtil11g_Plugin.exe + 2009-07-14 02:36 . 2012-03-20 10:02 618342 c:\windows\system32\perfh009.dat + 2009-07-14 02:36 . 2012-03-20 10:02 107622 c:\windows\system32\perfc009.dat + 2012-03-20 06:37 . 2012-03-20 06:37 465568 c:\windows\system32\Macromed\Flash\FlashUtil64_11_1_102_Plugin.exe - 2009-07-14 05:30 . 2012-01-28 09:15 143360 c:\windows\system32\DriverStore\infstrng.dat + 2009-07-14 05:30 . 2012-03-21 05:04 143360 c:\windows\system32\DriverStore\infstrng.dat - 2009-07-14 05:30 . 2012-01-28 09:15 143360 c:\windows\system32\DriverStore\infstor.dat + 2009-07-14 05:30 . 2012-03-21 05:04 143360 c:\windows\system32\DriverStore\infstor.dat + 2009-07-14 05:01 . 2012-03-21 05:06 341768 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat - 2009-07-14 05:01 . 2012-03-20 04:14 341768 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2011-11-22 06:57 . 2011-11-22 06:57 598784 c:\windows\Microsoft.NET\Framework64\v4.0.30319\SOS.dll + 2011-11-22 05:31 . 2011-11-22 05:31 518400 c:\windows\Microsoft.NET\Framework\v4.0.30319\SOS.dll + 2011-11-22 05:31 . 2011-11-22 05:31 957200 c:\windows\Microsoft.NET\Framework\v4.0.30319\mscordbi.dll + 2012-03-20 10:03 . 2012-03-20 10:03 350592 c:\windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationClientsideProviders\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationClientsideProviders.dll - 2012-02-17 04:46 . 2012-02-17 04:46 350592 c:\windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationClientsideProviders\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationClientsideProviders.dll + 2012-03-20 10:03 . 2012-03-20 10:03 163168 c:\windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationClient\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationClient.dll - 2012-02-17 04:46 . 2012-02-17 04:46 163168 c:\windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationClient\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationClient.dll + 2012-03-20 10:03 . 2012-03-20 10:03 138592 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml.Linq\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.Linq.dll - 2012-02-17 04:46 . 2012-02-17 04:46 138592 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml.Linq\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.Linq.dll + 2012-03-20 10:03 . 2012-03-20 10:03 699224 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Xaml\v4.0_4.0.0.0__b77a5c561934e089\System.Xaml.dll - 2012-02-17 04:46 . 2012-02-17 04:46 699224 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Xaml\v4.0_4.0.0.0__b77a5c561934e089\System.Xaml.dll - 2012-02-17 04:46 . 2012-02-17 04:46 857960 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Services\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll + 2012-03-20 10:03 . 2012-03-20 10:03 857960 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Services\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll - 2012-02-17 04:46 . 2012-02-17 04:46 675672 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Speech\v4.0_4.0.0.0__31bf3856ad364e35\System.Speech.dll + 2012-03-20 10:03 . 2012-03-20 10:03 675672 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Speech\v4.0_4.0.0.0__31bf3856ad364e35\System.Speech.dll - 2012-02-17 04:46 . 2012-02-17 04:46 113512 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll + 2012-03-20 10:03 . 2012-03-20 10:03 113512 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll - 2012-02-17 04:46 . 2012-02-17 04:46 129912 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Routing\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Routing.dll + 2012-03-20 10:03 . 2012-03-20 10:03 129912 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Routing\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Routing.dll - 2012-02-17 04:46 . 2012-02-17 04:46 390008 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Discovery\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Discovery.dll + 2012-03-20 10:03 . 2012-03-20 10:03 390008 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Discovery\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Discovery.dll - 2012-02-17 04:46 . 2012-02-17 04:46 505208 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Activities\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Activities.dll + 2012-03-20 10:03 . 2012-03-20 10:03 505208 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Activities\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Activities.dll - 2012-02-17 04:46 . 2012-02-17 04:46 261472 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll + 2012-03-20 10:03 . 2012-03-20 10:03 261472 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll + 2012-03-20 10:03 . 2012-03-20 10:03 122264 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll - 2012-02-17 04:46 . 2012-02-17 04:46 122264 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll + 2012-03-20 10:03 . 2012-03-20 10:03 291184 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll - 2012-02-17 04:46 . 2012-02-17 04:46 291184 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll + 2012-03-20 10:03 . 2012-03-20 10:03 349568 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.DurableInstancing\v4.0_4.0.0.0__31bf3856ad364e35\System.Runtime.DurableInstancing.dll - 2012-02-17 04:46 . 2012-02-17 04:46 349568 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.DurableInstancing\v4.0_4.0.0.0__31bf3856ad364e35\System.Runtime.DurableInstancing.dll + 2012-03-20 10:03 . 2012-03-20 10:03 236880 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Net\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.dll - 2012-02-17 04:46 . 2012-02-17 04:46 236880 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Net\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.dll + 2012-03-20 10:03 . 2012-03-20 10:03 253280 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Messaging\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll - 2012-02-17 04:46 . 2012-02-17 04:46 253280 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Messaging\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll - 2012-02-17 04:46 . 2012-02-17 04:46 378720 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll + 2012-03-20 10:03 . 2012-03-20 10:03 378720 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll + 2012-03-20 10:03 . 2012-03-20 10:03 134528 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Instrumentation\v4.0_4.0.0.0__b77a5c561934e089\System.Management.Instrumentation.dll - 2012-02-17 04:46 . 2012-02-17 04:46 134528 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Instrumentation\v4.0_4.0.0.0__b77a5c561934e089\System.Management.Instrumentation.dll + 2012-03-20 10:03 . 2012-03-20 10:03 123736 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Log\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.IO.Log.dll - 2012-02-17 04:46 . 2012-02-17 04:46 123736 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Log\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.IO.Log.dll - 2012-02-17 04:46 . 2012-02-17 04:46 392552 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll + 2012-03-20 10:03 . 2012-03-20 10:03 392552 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll + 2012-03-20 10:03 . 2012-03-20 10:03 125816 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel.Selectors\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.Selectors.dll - 2012-02-17 04:46 . 2012-02-17 04:46 125816 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel.Selectors\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.Selectors.dll + 2012-03-20 10:03 . 2012-03-20 10:03 120152 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll - 2012-02-17 04:46 . 2012-02-17 04:46 120152 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll - 2012-02-17 04:46 . 2012-02-17 04:46 607064 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll + 2012-03-20 10:03 . 2012-03-20 10:03 607064 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll - 2012-02-17 04:46 . 2012-02-17 04:46 395120 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll + 2012-03-20 10:03 . 2012-03-20 10:03 395120 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll + 2012-03-20 10:03 . 2012-03-20 10:03 182144 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices.Protocols\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll - 2012-02-17 04:46 . 2012-02-17 04:46 182144 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices.Protocols\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll - 2012-02-17 04:46 . 2012-02-17 04:46 285072 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices.AccountManagement\v4.0_4.0.0.0__b77a5c561934e089\System.DirectoryServices.AccountManagement.dll + 2012-03-20 10:03 . 2012-03-20 10:03 285072 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices.AccountManagement\v4.0_4.0.0.0__b77a5c561934e089\System.DirectoryServices.AccountManagement.dll + 2012-03-20 10:03 . 2012-03-20 10:03 829280 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll - 2012-02-17 04:46 . 2012-02-17 04:46 829280 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll - 2012-02-17 04:46 . 2012-02-17 04:46 747360 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll + 2012-03-20 10:03 . 2012-03-20 10:03 747360 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll + 2012-03-20 10:03 . 2012-03-20 10:03 436600 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services.Client\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Services.Client.dll - 2012-02-17 04:46 . 2012-02-17 04:46 436600 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services.Client\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Services.Client.dll + 2012-03-20 10:03 . 2012-03-20 10:03 683872 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Linq\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Linq.dll - 2012-02-17 04:46 . 2012-02-17 04:46 683872 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Linq\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Linq.dll + 2012-03-20 10:03 . 2012-03-20 10:03 409448 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.configuration.dll - 2012-02-17 04:46 . 2012-02-17 04:46 409448 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.configuration.dll + 2012-03-20 10:03 . 2012-03-20 10:03 210816 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.Composition\v4.0_4.0.0.0__b77a5c561934e089\System.ComponentModel.Composition.dll - 2012-02-17 04:46 . 2012-02-17 04:46 210816 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.Composition\v4.0_4.0.0.0__b77a5c561934e089\System.ComponentModel.Composition.dll - 2012-02-17 04:46 . 2012-02-17 04:46 149848 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.AddIn\v4.0_4.0.0.0__b77a5c561934e089\System.AddIn.dll + 2012-03-20 10:03 . 2012-03-20 10:03 149848 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.AddIn\v4.0_4.0.0.0__b77a5c561934e089\System.AddIn.dll + 2012-03-20 10:03 . 2012-03-20 10:03 122248 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.DurableInstancing\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.DurableInstancing.dll - 2012-02-17 04:46 . 2012-02-17 04:46 122248 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.DurableInstancing\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.DurableInstancing.dll - 2012-02-17 04:46 . 2012-02-17 04:46 525704 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.Core.Presentation\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.Core.Presentation.dll + 2012-03-20 10:03 . 2012-03-20 10:03 525704 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.Core.Presentation\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.Core.Presentation.dll + 2012-03-20 10:03 . 2012-03-20 10:03 112976 c:\windows\Microsoft.NET\assembly\GAC_MSIL\sysglobl\v4.0_4.0.0.0__b03f5f7f11d50a3a\sysglobl.dll - 2012-02-17 04:46 . 2012-02-17 04:46 112976 c:\windows\Microsoft.NET\assembly\GAC_MSIL\sysglobl\v4.0_4.0.0.0__b03f5f7f11d50a3a\sysglobl.dll - 2012-02-17 04:46 . 2012-02-17 04:46 581464 c:\windows\Microsoft.NET\assembly\GAC_MSIL\ReachFramework\v4.0_4.0.0.0__31bf3856ad364e35\ReachFramework.dll + 2012-03-20 10:03 . 2012-03-20 10:03 581464 c:\windows\Microsoft.NET\assembly\GAC_MSIL\ReachFramework\v4.0_4.0.0.0__31bf3856ad364e35\ReachFramework.dll - 2012-02-17 04:46 . 2012-02-17 04:46 832856 c:\windows\Microsoft.NET\assembly\GAC_MSIL\PresentationUI\v4.0_4.0.0.0__31bf3856ad364e35\PresentationUI.dll + 2012-03-20 10:03 . 2012-03-20 10:03 832856 c:\windows\Microsoft.NET\assembly\GAC_MSIL\PresentationUI\v4.0_4.0.0.0__31bf3856ad364e35\PresentationUI.dll + 2012-03-20 10:03 . 2012-03-20 10:03 194424 c:\windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Royale\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.Royale.dll - 2012-02-17 04:46 . 2012-02-17 04:46 194424 c:\windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Royale\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.Royale.dll + 2012-03-20 10:03 . 2012-03-20 10:03 478576 c:\windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Luna\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.Luna.dll - 2012-02-17 04:46 . 2012-02-17 04:46 478576 c:\windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Luna\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.Luna.dll - 2012-02-17 04:46 . 2012-02-17 04:46 167288 c:\windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Classic\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.Classic.dll + 2012-03-20 10:03 . 2012-03-20 10:03 167288 c:\windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Classic\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.Classic.dll - 2012-02-17 04:46 . 2012-02-17 04:46 232304 c:\windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Aero\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.Aero.dll + 2012-03-20 10:03 . 2012-03-20 10:03 232304 c:\windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Aero\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.Aero.dll + 2012-03-20 10:03 . 2012-03-20 10:03 661352 c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll - 2012-02-17 04:46 . 2012-02-17 04:46 661352 c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll + 2012-03-20 10:03 . 2012-03-20 10:03 349576 c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll - 2012-02-17 04:46 . 2012-02-17 04:46 349576 c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll - 2012-02-17 04:46 . 2012-02-17 04:46 387960 c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.dll + 2012-03-20 10:03 . 2012-03-20 10:03 387960 c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.dll - 2012-02-17 04:46 . 2012-02-17 04:46 746336 c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll + 2012-03-20 10:03 . 2012-03-20 10:03 746336 c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll - 2012-02-17 04:46 . 2012-02-17 04:46 505184 c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll + 2012-03-20 10:03 . 2012-03-20 10:03 505184 c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll - 2012-02-17 04:46 . 2012-02-17 04:46 288616 c:\windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll + 2012-03-20 10:03 . 2012-03-20 10:03 288616 c:\windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll - 2012-02-17 04:46 . 2012-02-17 04:46 335712 c:\windows\Microsoft.NET\assembly\GAC_64\System.Printing\v4.0_4.0.0.0__31bf3856ad364e35\System.Printing.dll + 2012-03-20 10:03 . 2012-03-20 10:03 335712 c:\windows\Microsoft.NET\assembly\GAC_64\System.Printing\v4.0_4.0.0.0__31bf3856ad364e35\System.Printing.dll - 2012-02-17 04:46 . 2012-02-17 04:46 125440 c:\windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll + 2012-03-20 10:03 . 2012-03-20 10:03 125440 c:\windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll + 2012-03-20 10:03 . 2012-03-20 10:03 237424 c:\windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll - 2012-02-17 04:46 . 2012-02-17 04:46 237424 c:\windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll + 2012-03-20 10:03 . 2012-03-20 10:03 187776 c:\windows\Microsoft.NET\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Dtc.dll - 2012-02-17 04:46 . 2012-02-17 04:46 187776 c:\windows\Microsoft.NET\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Dtc.dll - 2012-02-17 04:45 . 2012-02-17 04:45 269672 c:\windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll + 2012-03-20 10:03 . 2012-03-20 10:03 269672 c:\windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll - 2012-02-17 04:45 . 2012-02-17 04:45 334688 c:\windows\Microsoft.NET\assembly\GAC_32\System.Printing\v4.0_4.0.0.0__31bf3856ad364e35\System.Printing.dll + 2012-03-20 10:03 . 2012-03-20 10:03 334688 c:\windows\Microsoft.NET\assembly\GAC_32\System.Printing\v4.0_4.0.0.0__31bf3856ad364e35\System.Printing.dll - 2012-02-17 04:45 . 2012-02-17 04:45 109568 c:\windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll + 2012-03-20 10:02 . 2012-03-20 10:02 109568 c:\windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll + 2012-03-20 10:02 . 2012-03-20 10:02 246128 c:\windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll - 2012-02-17 04:45 . 2012-02-17 04:45 246128 c:\windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll + 2012-03-20 10:03 . 2012-03-20 10:03 170368 c:\windows\Microsoft.NET\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Dtc.dll - 2012-02-17 04:45 . 2012-02-17 04:45 170368 c:\windows\Microsoft.NET\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Dtc.dll + 2012-03-20 10:13 . 2012-03-20 10:13 336896 c:\windows\assembly\NativeImages_v4.0.30319_64\WindowsFormsIntegra#\d05858dd730eef93a5e4a3cc88dd4ec3\WindowsFormsIntegration.ni.dll + 2012-03-20 10:09 . 2012-03-20 10:09 231424 c:\windows\assembly\NativeImages_v4.0.30319_64\UIAutomationTypes\b2a2a1fb4e1313088250b334b3af2a15\UIAutomationTypes.ni.dll + 2012-03-20 10:09 . 2012-03-20 10:09 122368 c:\windows\assembly\NativeImages_v4.0.30319_64\UIAutomationProvider\89414bab411eb27c7c181df81b4d36a5\UIAutomationProvider.ni.dll + 2012-03-20 10:13 . 2012-03-20 10:13 645120 c:\windows\assembly\NativeImages_v4.0.30319_64\UIAutomationClient\cd55f47d44c3695862bc047b8e86fcd3\UIAutomationClient.ni.dll + 2012-03-20 10:09 . 2012-03-20 10:09 528896 c:\windows\assembly\NativeImages_v4.0.30319_64\System.Xml.Linq\910d557d55f4fc7bb51ace0546bd3c50\System.Xml.Linq.ni.dll + 2012-03-20 10:09 . 2012-03-20 10:09 256000 c:\windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Inpu#\dcb9e1eaa1491094f79c3288b8c78830\System.Windows.Input.Manipulations.ni.dll + 2012-03-20 10:09 . 2012-03-20 10:09 903168 c:\windows\assembly\NativeImages_v4.0.30319_64\System.Transactions\922f3f17f5112441e77f9d3d56d5b753\System.Transactions.ni.dll + 2012-03-20 10:12 . 2012-03-20 10:12 281088 c:\windows\assembly\NativeImages_v4.0.30319_64\System.ServiceProce#\73874670b92afbde73b23e8a1200eede\System.ServiceProcess.ni.dll + 2012-03-20 10:12 . 2012-03-20 10:12 517120 c:\windows\assembly\NativeImages_v4.0.30319_64\System.ServiceModel#\909c8d76773648809478644ac50a21eb\System.ServiceModel.Routing.ni.dll + 2012-03-20 10:12 . 2012-03-20 10:12 108032 c:\windows\assembly\NativeImages_v4.0.30319_64\System.ServiceModel#\26db69101f5bcf148fd962f00c0e78dd\System.ServiceModel.Channels.ni.dll + 2012-03-20 10:07 . 2012-03-20 10:07 946688 c:\windows\assembly\NativeImages_v4.0.30319_64\System.Security\878946615037b9d5f09916c598420dc1\System.Security.ni.dll + 2012-03-20 10:09 . 2012-03-20 10:09 376832 c:\windows\assembly\NativeImages_v4.0.30319_64\System.Runtime.Seri#\73cc698ccc98e37f53cdbff3687a921c\System.Runtime.Serialization.Formatters.Soap.ni.dll + 2012-03-20 10:09 . 2012-03-20 10:09 987648 c:\windows\assembly\NativeImages_v4.0.30319_64\System.Runtime.Remo#\b73b4f0282ef46505b3e59702ded433b\System.Runtime.Remoting.ni.dll + 2012-03-20 10:07 . 2012-03-20 10:07 176640 c:\windows\assembly\NativeImages_v4.0.30319_64\System.Numerics\8064e773b9addf027658899e27e94c7b\System.Numerics.ni.dll + 2012-03-20 10:12 . 2012-03-20 10:12 933376 c:\windows\assembly\NativeImages_v4.0.30319_64\System.Net\a46d5472536da900435885b28a19eda8\System.Net.ni.dll + 2012-03-20 10:12 . 2012-03-20 10:12 781824 c:\windows\assembly\NativeImages_v4.0.30319_64\System.Messaging\ae0089b9135614de304ebe288fa6fca8\System.Messaging.ni.dll + 2012-03-20 10:11 . 2012-03-20 10:11 521728 c:\windows\assembly\NativeImages_v4.0.30319_64\System.Management.I#\3ad050d3f47352421e05b7707ddd3524\System.Management.Instrumentation.ni.dll + 2012-03-20 10:11 . 2012-03-20 10:11 531456 c:\windows\assembly\NativeImages_v4.0.30319_64\System.IO.Log\87efa405cd384d2c47380467fcd7ea86\System.IO.Log.ni.dll + 2012-03-20 10:11 . 2012-03-20 10:11 290816 c:\windows\assembly\NativeImages_v4.0.30319_64\System.IdentityMode#\50ccc897ad714e66f750ca1e51e0ffde\System.IdentityModel.Selectors.ni.dll + 2012-03-20 10:09 . 2012-03-20 10:09 348672 c:\windows\assembly\NativeImages_v4.0.30319_64\System.EnterpriseSe#\7b06b84cb3b99a3ab22adb2a3f6376e6\System.EnterpriseServices.Wrapper.dll + 2012-03-20 10:07 . 2012-03-20 10:07 512000 c:\windows\assembly\NativeImages_v4.0.30319_64\System.Dynamic\cbc3e5d028dd347a294096f068a053d4\System.Dynamic.ni.dll + 2012-03-20 10:11 . 2012-03-20 10:11 632832 c:\windows\assembly\NativeImages_v4.0.30319_64\System.DirectorySer#\1ae0a8a9eb92ccaf900f5911740b2c3c\System.DirectoryServices.Protocols.ni.dll + 2012-03-20 10:11 . 2012-03-20 10:11 141824 c:\windows\assembly\NativeImages_v4.0.30319_64\System.Device\9edded64312f5cbae54a093eca246aaa\System.Device.ni.dll + 2012-03-20 10:10 . 2012-03-20 10:10 176128 c:\windows\assembly\NativeImages_v4.0.30319_64\System.Data.DataSet#\db296a100034c7dee5f80219f0542df7\System.Data.DataSetExtensions.ni.dll + 2012-03-20 10:10 . 2012-03-20 10:10 181760 c:\windows\assembly\NativeImages_v4.0.30319_64\System.Configuratio#\0f771cbf8b32ae1618f4cd4266337b3c\System.Configuration.Install.ni.dll + 2012-03-20 10:10 . 2012-03-20 10:10 255488 c:\windows\assembly\NativeImages_v4.0.30319_64\System.ComponentMod#\501ad39b1ef6f43e8dc92a4efa7c35ea\System.ComponentModel.DataAnnotations.ni.dll + 2012-03-20 10:10 . 2012-03-20 10:10 865792 c:\windows\assembly\NativeImages_v4.0.30319_64\System.AddIn\f8c6e4854178bb4d928c8aec1c04648d\System.AddIn.ni.dll + 2012-03-20 10:10 . 2012-03-20 10:10 560640 c:\windows\assembly\NativeImages_v4.0.30319_64\System.Activities.D#\3503e3c2a87db97b720c0ed8a5d59f61\System.Activities.DurableInstancing.ni.dll + 2012-03-20 10:07 . 2012-03-20 10:07 432128 c:\windows\assembly\NativeImages_v4.0.30319_64\SMSvcHost\30cf4fc2c247cf490879f5436c63017c\SMSvcHost.ni.exe + 2012-03-20 10:09 . 2012-03-20 10:09 185344 c:\windows\assembly\NativeImages_v4.0.30319_64\SMDiagnostics\b4f75962376771b6b6d39279d780abba\SMDiagnostics.ni.dll + 2012-03-20 10:09 . 2012-03-20 10:09 428032 c:\windows\assembly\NativeImages_v4.0.30319_64\PresentationFramewo#\eaca48940ac6976d39d5de4d5b42fed6\PresentationFramework.Royale.ni.dll + 2012-03-20 10:09 . 2012-03-20 10:09 802304 c:\windows\assembly\NativeImages_v4.0.30319_64\PresentationFramewo#\bdb41ce9ab6d561ddb8107255daaee30\PresentationFramework.Luna.ni.dll + 2012-03-20 10:09 . 2012-03-20 10:09 622592 c:\windows\assembly\NativeImages_v4.0.30319_64\PresentationFramewo#\78310f7eef84b5f9ca4bf32798bd77f9\PresentationFramework.Aero.ni.dll + 2012-03-20 10:09 . 2012-03-20 10:09 349184 c:\windows\assembly\NativeImages_v4.0.30319_64\PresentationFramewo#\64b86aebea22fd357f22384757caed3f\PresentationFramework.Classic.ni.dll + 2012-03-20 10:07 . 2012-03-20 10:07 422400 c:\windows\assembly\NativeImages_v4.0.30319_64\Microsoft.VisualBas#\480ae0610a44148c6532d3d134f9956f\Microsoft.VisualBasic.Compatibility.Data.ni.dll + 2012-03-20 10:07 . 2012-03-20 10:07 600064 c:\windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Transacti#\16bf3be602620d349b25e6c2d08199a3\Microsoft.Transactions.Bridge.Dtc.ni.dll + 2012-03-20 10:07 . 2012-03-20 10:07 279552 c:\windows\assembly\NativeImages_v4.0.30319_64\CustomMarshalers\f6b9abf9cd43524102ad9be82b7136d0\CustomMarshalers.ni.dll + 2012-03-20 10:16 . 2012-03-20 10:16 253952 c:\windows\assembly\NativeImages_v4.0.30319_32\WindowsFormsIntegra#\2e1468ce2858baafbab0482a638eb251\WindowsFormsIntegration.ni.dll + 2012-03-20 10:14 . 2012-03-20 10:14 196096 c:\windows\assembly\NativeImages_v4.0.30319_32\UIAutomationTypes\3229ca959686fc6c4e3ef5a9dd285cd4\UIAutomationTypes.ni.dll + 2012-03-20 10:16 . 2012-03-20 10:16 484352 c:\windows\assembly\NativeImages_v4.0.30319_32\UIAutomationClient\fa5ac28e670cb4917e8f3f22c059724b\UIAutomationClient.ni.dll + 2012-03-20 10:14 . 2012-03-20 10:14 393216 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Xml.Linq\706f0cbe7c279c059b52ad8b4bd248d8\System.Xml.Linq.ni.dll + 2012-03-20 10:14 . 2012-03-20 10:14 189440 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Inpu#\77cd8b170b07f428c98896e35eb556f3\System.Windows.Input.Manipulations.ni.dll + 2012-03-20 10:14 . 2012-03-20 10:14 649728 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Transactions\678637ab7a50a87b13c287992ef7fbd8\System.Transactions.ni.dll + 2012-03-20 10:16 . 2012-03-20 10:16 221696 c:\windows\assembly\NativeImages_v4.0.30319_32\System.ServiceProce#\9a1e3b04442d5c7ec79946335b412b8b\System.ServiceProcess.ni.dll + 2012-03-20 10:16 . 2012-03-20 10:16 369664 c:\windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\4808a59d1eb0e6484162f9a4a2eda748\System.ServiceModel.Routing.ni.dll + 2012-03-20 10:05 . 2012-03-20 10:05 736768 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Security\68e9fba708d531093efed0d06fc255ae\System.Security.ni.dll + 2012-03-20 10:14 . 2012-03-20 10:14 311296 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Seri#\8242a11970b6c106bc860a168fbf0d3c\System.Runtime.Serialization.Formatters.Soap.ni.dll + 2012-03-20 10:14 . 2012-03-20 10:14 762880 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\4017661cfa4a173b878d7e2a949c3a9e\System.Runtime.Remoting.ni.dll + 2012-03-20 10:05 . 2012-03-20 10:05 145408 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Numerics\db65b5a04bb376ef4df08803ec27c12e\System.Numerics.ni.dll + 2012-03-20 10:15 . 2012-03-20 10:15 657408 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Net\89e476c433069af1957535a158feac9a\System.Net.ni.dll + 2012-03-20 10:15 . 2012-03-20 10:15 626176 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Messaging\0a7f81c69a451afc1c29f406af951b4e\System.Messaging.ni.dll + 2012-03-20 10:15 . 2012-03-20 10:15 395264 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Management.I#\04fec0e57becb283fbeddf031f2e201a\System.Management.Instrumentation.ni.dll + 2012-03-20 10:15 . 2012-03-20 10:15 413696 c:\windows\assembly\NativeImages_v4.0.30319_32\System.IO.Log\5495c14e5629c89453853fa2a6e6fd3a\System.IO.Log.ni.dll + 2012-03-20 10:15 . 2012-03-20 10:15 229888 c:\windows\assembly\NativeImages_v4.0.30319_32\System.IdentityMode#\6886e37c6d37f6d2523fe10dd02ce983\System.IdentityModel.Selectors.ni.dll + 2012-03-20 10:14 . 2012-03-20 10:14 236032 c:\windows\assembly\NativeImages_v4.0.30319_32\System.EnterpriseSe#\dfa641de28b73dda041bf7f47972b5eb\System.EnterpriseServices.Wrapper.dll + 2012-03-20 10:14 . 2012-03-20 10:14 787456 c:\windows\assembly\NativeImages_v4.0.30319_32\System.EnterpriseSe#\dfa641de28b73dda041bf7f47972b5eb\System.EnterpriseServices.ni.dll + 2012-03-20 10:05 . 2012-03-20 10:05 377856 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Dynamic\7612a70db260ea55fe72f57cee028092\System.Dynamic.ni.dll + 2012-03-20 10:15 . 2012-03-20 10:15 470528 c:\windows\assembly\NativeImages_v4.0.30319_32\System.DirectorySer#\d754996afc55c4ad30377765fb1af5f7\System.DirectoryServices.Protocols.ni.dll + 2012-03-20 10:15 . 2012-03-20 10:15 913920 c:\windows\assembly\NativeImages_v4.0.30319_32\System.DirectorySer#\cf4a74f7bb940cfede8c0758026211a9\System.DirectoryServices.AccountManagement.ni.dll + 2012-03-20 10:15 . 2012-03-20 10:15 112640 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Device\77372a2fb9e95c02b2d76efcbed718bd\System.Device.ni.dll + 2012-03-20 10:14 . 2012-03-20 10:14 134656 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Data.DataSet#\623ae2e1d7735e14f9adb9d830f29d29\System.Data.DataSetExtensions.ni.dll + 2012-03-20 10:05 . 2012-03-20 10:05 982528 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\6757251401cd9c17d5e608db6e5f964a\System.Configuration.ni.dll + 2012-03-20 10:14 . 2012-03-20 10:14 148480 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Configuratio#\522ff751bd7c2d6560abd743c967eeef\System.Configuration.Install.ni.dll + 2012-03-20 10:14 . 2012-03-20 10:14 194048 c:\windows\assembly\NativeImages_v4.0.30319_32\System.ComponentMod#\90cc58de90e1d3cbb4a4c06600096331\System.ComponentModel.DataAnnotations.ni.dll + 2012-03-20 10:05 . 2012-03-20 10:05 693760 c:\windows\assembly\NativeImages_v4.0.30319_32\System.ComponentMod#\521d371ccd63aba119d74e1352fda6dc\System.ComponentModel.Composition.ni.dll + 2012-03-20 10:14 . 2012-03-20 10:14 617984 c:\windows\assembly\NativeImages_v4.0.30319_32\System.AddIn\4281a2e60037fa6e043569d2b70ed864\System.AddIn.ni.dll + 2012-03-20 10:14 . 2012-03-20 10:14 411136 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Activities.D#\8e122e72de21cfbf2e41e6a338844415\System.Activities.DurableInstancing.ni.dll + 2012-03-20 10:13 . 2012-03-20 10:13 317952 c:\windows\assembly\NativeImages_v4.0.30319_32\SMSvcHost\abec8eb49acd9d3dad8066795b9d095d\SMSvcHost.ni.exe + 2012-03-20 10:14 . 2012-03-20 10:14 143360 c:\windows\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\4e6da16e44ef441e463e006185b1b5d8\SMDiagnostics.ni.dll + 2012-03-20 10:05 . 2012-03-20 10:05 309760 c:\windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\ec80c61fa0d532d78f0b50eec27a4a1f\PresentationFramework.Classic.ni.dll + 2012-03-20 10:05 . 2012-03-20 10:05 755712 c:\windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\ec69ab111679b2775127815726f87a7d\PresentationFramework.Luna.ni.dll + 2012-03-20 10:05 . 2012-03-20 10:05 387072 c:\windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\e5cd234a62bbdaafdd21857a7cc3a28a\PresentationFramework.Royale.ni.dll + 2012-03-20 10:05 . 2012-03-20 10:05 595968 c:\windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\1c5b741f270fccb3b527b4fc3a8431f3\PresentationFramework.Aero.ni.dll + 2012-03-20 10:14 . 2012-03-20 10:14 303104 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\f730eb20c2189e35b0f0d0739c893057\Microsoft.VisualBasic.Compatibility.Data.ni.dll + 2012-03-20 10:14 . 2012-03-20 10:14 418816 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Transacti#\b25cf7ec03eb047aecbe2fcc842b3471\Microsoft.Transactions.Bridge.Dtc.ni.dll + 2012-03-20 10:13 . 2012-03-20 10:13 194048 c:\windows\assembly\NativeImages_v4.0.30319_32\CustomMarshalers\ed336359eb1b1312b935f4692e71474b\CustomMarshalers.ni.dll + 2012-03-20 06:37 . 2012-03-20 06:37 8527520 c:\windows\SysWOW64\Macromed\Flash\NPSWF32.dll - 2009-12-09 09:12 . 2012-03-20 04:14 1554152 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat + 2009-12-09 09:12 . 2012-03-21 05:06 1554152 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat + 2011-04-24 06:21 . 2012-03-21 05:06 2380848 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2636114741-474596119-2817400375-1000-8192.dat - 2011-04-24 06:21 . 2012-03-20 04:14 2380848 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2636114741-474596119-2817400375-1000-8192.dat - 2011-10-06 08:49 . 2012-03-20 04:14 1077496 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2636114741-474596119-2817400375-1000-12288.dat + 2011-10-06 08:49 . 2012-03-20 14:26 1077496 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2636114741-474596119-2817400375-1000-12288.dat + 2011-11-22 05:31 . 2011-11-22 05:31 3512072 c:\windows\Microsoft.NET\Framework64\v4.0.30319\System.dll + 2011-11-22 06:57 . 2011-11-22 06:57 4970768 c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll + 2011-11-22 06:57 . 2011-11-22 06:57 1455376 c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscordbi.dll + 2011-11-22 06:57 . 2011-11-22 06:57 1515792 c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscordacwks.dll + 2011-11-22 06:57 . 2011-11-22 06:57 9793280 c:\windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll + 2011-11-22 05:31 . 2011-11-22 05:31 3512072 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.dll + 2011-11-22 05:31 . 2011-11-22 05:31 5201168 c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll + 2011-11-22 05:31 . 2011-11-22 05:31 1143568 c:\windows\Microsoft.NET\Framework\v4.0.30319\mscordacwks.dll + 2011-11-22 05:31 . 2011-11-22 05:31 6727424 c:\windows\Microsoft.NET\Framework\v4.0.30319\clr.dll - 2012-02-17 04:46 . 2012-02-17 04:46 1368920 c:\windows\Microsoft.NET\assembly\GAC_MSIL\WindowsBase\v4.0_4.0.0.0__31bf3856ad364e35\WindowsBase.dll + 2012-03-20 10:03 . 2012-03-20 10:03 1368920 c:\windows\Microsoft.NET\assembly\GAC_MSIL\WindowsBase\v4.0_4.0.0.0__31bf3856ad364e35\WindowsBase.dll + 2012-03-20 10:03 . 2012-03-20 10:03 3512072 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll + 2012-03-20 10:03 . 2012-03-20 10:03 2207568 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll - 2012-02-17 04:46 . 2012-02-17 04:46 2207568 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll + 2012-03-20 10:03 . 2012-03-20 10:03 5028200 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll - 2012-02-17 04:46 . 2012-02-17 04:46 5028200 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll - 2012-02-17 04:46 . 2012-02-17 04:46 1711496 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms.DataVisualization\v4.0_4.0.0.0__31bf3856ad364e35\System.Windows.Forms.DataVisualization.dll + 2012-03-20 10:03 . 2012-03-20 10:03 1711496 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms.DataVisualization\v4.0_4.0.0.0__31bf3856ad364e35\System.Windows.Forms.DataVisualization.dll + 2012-03-20 10:03 . 2012-03-20 10:03 6097256 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll - 2012-02-17 04:46 . 2012-02-17 04:46 6097256 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll + 2012-03-20 10:03 . 2012-03-20 10:03 1026936 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll - 2012-02-17 04:46 . 2012-02-17 04:46 1026936 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll - 2012-02-17 04:46 . 2012-02-17 04:46 4464480 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Entity\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Entity.dll + 2012-03-20 10:03 . 2012-03-20 10:03 4464480 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Entity\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Entity.dll - 2012-02-17 04:46 . 2012-02-17 04:46 1354584 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll + 2012-03-20 10:03 . 2012-03-20 10:03 1354584 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll + 2012-03-20 10:03 . 2012-03-20 10:03 1199968 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.dll - 2012-02-17 04:46 . 2012-02-17 04:46 1199968 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.dll - 2012-02-17 04:46 . 2012-02-17 04:46 1462648 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.Presentation\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.Presentation.dll + 2012-03-20 10:03 . 2012-03-20 10:03 1462648 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.Presentation\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.Presentation.dll - 2012-02-17 04:46 . 2012-02-17 04:46 6428520 c:\windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.dll + 2012-03-20 10:03 . 2012-03-20 10:03 6428520 c:\windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.dll + 2012-03-20 10:03 . 2012-03-20 10:03 3116376 c:\windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll - 2012-02-17 04:46 . 2012-02-17 04:46 3116376 c:\windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll - 2012-02-17 04:46 . 2012-02-17 04:46 3824480 c:\windows\Microsoft.NET\assembly\GAC_64\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\PresentationCore.dll + 2012-03-20 10:03 . 2012-03-20 10:03 3824480 c:\windows\Microsoft.NET\assembly\GAC_64\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\PresentationCore.dll + 2012-03-20 10:03 . 2012-03-20 10:03 4970768 c:\windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll - 2012-02-17 04:46 . 2012-02-17 04:46 3563408 c:\windows\Microsoft.NET\assembly\GAC_64\Microsoft.VisualBasic.Activities.Compiler\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Activities.Compiler.dll + 2012-03-20 10:03 . 2012-03-20 10:03 3563408 c:\windows\Microsoft.NET\assembly\GAC_64\Microsoft.VisualBasic.Activities.Compiler\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Activities.Compiler.dll + 2012-03-20 10:03 . 2012-03-20 10:03 2975064 c:\windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll - 2012-02-17 04:45 . 2012-02-17 04:45 2975064 c:\windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll + 2012-03-20 10:03 . 2012-03-20 10:03 3788128 c:\windows\Microsoft.NET\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\PresentationCore.dll - 2012-02-17 04:45 . 2012-02-17 04:45 3788128 c:\windows\Microsoft.NET\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\PresentationCore.dll + 2012-03-20 10:02 . 2012-03-20 10:02 5201168 c:\windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll + 2012-03-20 10:03 . 2012-03-20 10:03 2989456 c:\windows\Microsoft.NET\assembly\GAC_32\Microsoft.VisualBasic.Activities.Compiler\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Activities.Compiler.dll - 2012-02-17 04:45 . 2012-02-17 04:45 2989456 c:\windows\Microsoft.NET\assembly\GAC_32\Microsoft.VisualBasic.Activities.Compiler\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Activities.Compiler.dll + 2012-03-20 10:08 . 2012-03-20 10:08 5237248 c:\windows\assembly\NativeImages_v4.0.30319_64\WindowsBase\02198c29552545c7d7e7a95ab39488e5\WindowsBase.ni.dll + 2012-03-20 10:13 . 2012-03-20 10:13 1430016 c:\windows\assembly\NativeImages_v4.0.30319_64\UIAutomationClients#\d1d48cd30cd275b06fad70778798cae7\UIAutomationClientsideProviders.ni.dll + 2012-03-20 10:07 . 2012-03-20 10:07 7037952 c:\windows\assembly\NativeImages_v4.0.30319_64\System.Xml\ecdcf3d1d7bc90546464d70a4bee843d\System.Xml.ni.dll + 2012-03-20 10:09 . 2012-03-20 10:09 2449408 c:\windows\assembly\NativeImages_v4.0.30319_64\System.Xaml\3a9670f473f8f9291ca256d9a15fc281\System.Xaml.ni.dll + 2012-03-20 10:13 . 2012-03-20 10:13 5627904 c:\windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Form#\455d5edfdc989057a8fea7bc88a02ef6\System.Windows.Forms.DataVisualization.ni.dll + 2012-03-20 10:12 . 2012-03-20 10:13 2236416 c:\windows\assembly\NativeImages_v4.0.30319_64\System.Web.Services\bd044dc068adc34e430faa820e5c5e44\System.Web.Services.ni.dll + 2012-03-20 10:12 . 2012-03-20 10:12 2735616 c:\windows\assembly\NativeImages_v4.0.30319_64\System.Speech\561e5a115d6d7ade93236df74d61af84\System.Speech.ni.dll + 2012-03-20 10:12 . 2012-03-20 10:12 1918976 c:\windows\assembly\NativeImages_v4.0.30319_64\System.ServiceModel#\4606cac0ba2d406b4ddefca21a3db1eb\System.ServiceModel.Activities.ni.dll + 2012-03-20 10:12 . 2012-03-20 10:12 1579008 c:\windows\assembly\NativeImages_v4.0.30319_64\System.ServiceModel#\28b5d075cf252a24a6b007ff5941dce1\System.ServiceModel.Discovery.ni.dll + 2012-03-20 10:09 . 2012-03-20 10:09 3412992 c:\windows\assembly\NativeImages_v4.0.30319_64\System.Runtime.Seri#\1a361129f93a8190d8797b7c680baecc\System.Runtime.Serialization.ni.dll + 2012-03-20 10:09 . 2012-03-20 10:09 1348096 c:\windows\assembly\NativeImages_v4.0.30319_64\System.Runtime.Dura#\2c57eff357f1bc56d0367f04adcf6d76\System.Runtime.DurableInstancing.ni.dll + 2012-03-20 10:10 . 2012-03-20 10:10 1467392 c:\windows\assembly\NativeImages_v4.0.30319_64\System.Printing\7668fa73a73410f2e00d341a8684e28a\System.Printing.ni.dll + 2012-03-20 10:12 . 2012-03-20 10:12 1470464 c:\windows\assembly\NativeImages_v4.0.30319_64\System.Management\2280764a011295483642b17fe5d2b1f7\System.Management.ni.dll + 2012-03-20 10:11 . 2012-03-20 10:11 1416192 c:\windows\assembly\NativeImages_v4.0.30319_64\System.IdentityModel\a77730a57cc54142f1ecbb1e85060e5f\System.IdentityModel.ni.dll + 2012-03-20 10:09 . 2012-03-20 10:09 1098752 c:\windows\assembly\NativeImages_v4.0.30319_64\System.EnterpriseSe#\7b06b84cb3b99a3ab22adb2a3f6376e6\System.EnterpriseServices.ni.dll + 2012-03-20 10:09 . 2012-03-20 10:09 2290176 c:\windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\5b5fe518d1a632afaae9f24dd18cee2f\System.Drawing.ni.dll + 2012-03-20 10:11 . 2012-03-20 10:11 1217024 c:\windows\assembly\NativeImages_v4.0.30319_64\System.DirectorySer#\60390cb3abc6f1d85a572c156d39fc02\System.DirectoryServices.AccountManagement.ni.dll + 2012-03-20 10:09 . 2012-03-20 10:09 1622528 c:\windows\assembly\NativeImages_v4.0.30319_64\System.DirectorySer#\5eaf17b571cf9fb6f159a0c92d6244ab\System.DirectoryServices.ni.dll + 2012-03-20 10:09 . 2012-03-20 10:09 2402816 c:\windows\assembly\NativeImages_v4.0.30319_64\System.Deployment\0ce1b3a9a0192c2cdb16d848e78e6688\System.Deployment.ni.dll + 2012-03-20 10:09 . 2012-03-20 10:09 8601600 c:\windows\assembly\NativeImages_v4.0.30319_64\System.Data\ca4a0bde02b2eb73d2e9f22925719ecf\System.Data.ni.dll + 2012-03-20 10:07 . 2012-03-20 10:07 3390976 c:\windows\assembly\NativeImages_v4.0.30319_64\System.Data.SqlXml\657b967b5fd7819f273f5704197ce97e\System.Data.SqlXml.ni.dll + 2012-03-20 10:11 . 2012-03-20 10:11 1799168 c:\windows\assembly\NativeImages_v4.0.30319_64\System.Data.Service#\930a4b48234d358f2758f075be0684c5\System.Data.Services.Client.ni.dll + 2012-03-20 10:11 . 2012-03-20 10:11 3386880 c:\windows\assembly\NativeImages_v4.0.30319_64\System.Data.Linq\0ba3ab7e136a52fcba260ad7893ede32\System.Data.Linq.ni.dll + 2012-03-20 10:07 . 2012-03-20 10:07 1257472 c:\windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\c24ce44b45c0e0c0961a9755f192eb3a\System.Configuration.ni.dll + 2012-03-20 10:10 . 2012-03-20 10:10 1007616 c:\windows\assembly\NativeImages_v4.0.30319_64\System.ComponentMod#\5a66bc1859e864d87b81e31438a5f07d\System.ComponentModel.Composition.ni.dll + 2012-03-20 10:10 . 2012-03-20 10:10 5695488 c:\windows\assembly\NativeImages_v4.0.30319_64\System.Activities\f25d1dde40ef0128d9e5163d142bd2e2\System.Activities.ni.dll + 2012-03-20 10:10 . 2012-03-20 10:10 5048832 c:\windows\assembly\NativeImages_v4.0.30319_64\System.Activities.P#\26671ab09e54e0ecfd23012e32cb6383\System.Activities.Presentation.ni.dll + 2012-03-20 10:10 . 2012-03-20 10:10 2064896 c:\windows\assembly\NativeImages_v4.0.30319_64\System.Activities.C#\e9f6686e336507594e33cad6ed7814cd\System.Activities.Core.Presentation.ni.dll + 2012-03-20 10:10 . 2012-03-20 10:10 4233216 c:\windows\assembly\NativeImages_v4.0.30319_64\ReachFramework\9c49a7b6fb133a307e3804ca7ba35d16\ReachFramework.ni.dll + 2012-03-20 10:09 . 2012-03-20 10:09 2056192 c:\windows\assembly\NativeImages_v4.0.30319_64\PresentationUI\68d02e44d8b1f23c21a116119fbb65d0\PresentationUI.ni.dll + 2012-03-20 10:07 . 2012-03-20 10:07 2317312 c:\windows\assembly\NativeImages_v4.0.30319_64\Microsoft.VisualBas#\1903f5de0c7c33993c55319d4fc3062e\Microsoft.VisualBasic.ni.dll + 2012-03-20 10:07 . 2012-03-20 10:07 1623040 c:\windows\assembly\NativeImages_v4.0.30319_64\Microsoft.VisualBas#\15b88fefd6d638f01856a68c14e2ab9b\Microsoft.VisualBasic.Activities.Compiler.ni.dll + 2012-03-20 10:07 . 2012-03-20 10:07 1843200 c:\windows\assembly\NativeImages_v4.0.30319_64\Microsoft.VisualBas#\10bfd23b78a3492727e8b11e2fcbb990\Microsoft.VisualBasic.Compatibility.ni.dll + 2012-03-20 10:07 . 2012-03-20 10:07 1526784 c:\windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Transacti#\2d92f0cffe052f601c1bca1f52425fef\Microsoft.Transactions.Bridge.ni.dll + 2012-03-20 10:12 . 2012-03-20 10:12 3313664 c:\windows\assembly\NativeImages_v4.0.30319_64\Microsoft.JScript\0fbfc1087f7622c5b6b06f88fce1a45e\Microsoft.JScript.ni.dll + 2012-03-20 10:07 . 2012-03-20 10:07 2009600 c:\windows\assembly\NativeImages_v4.0.30319_64\Microsoft.CSharp\83f53b455553f5ad67e756f6762dc3b4\Microsoft.CSharp.ni.dll + 2012-03-20 10:05 . 2012-03-20 10:05 3858432 c:\windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\c0c7b3ff43f1b29cad7dde24bdbd5b79\WindowsBase.ni.dll + 2012-03-20 10:16 . 2012-03-20 10:16 1063424 c:\windows\assembly\NativeImages_v4.0.30319_32\UIAutomationClients#\75c3f67e1911f5b2b7f0e2d7349d7d3f\UIAutomationClientsideProviders.ni.dll + 2012-03-20 10:05 . 2012-03-20 10:05 9091584 c:\windows\assembly\NativeImages_v4.0.30319_32\System\57e066d0b97757dbd26d59302c3d701a\System.ni.dll + 2012-03-20 10:05 . 2012-03-20 10:05 5617664 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Xml\68345d6b57fe33c9a94fe6a72ab5e85e\System.Xml.ni.dll + 2012-03-20 10:14 . 2012-03-20 10:14 1782272 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\b9942cb07813f553f6d6374dd4541362\System.Xaml.ni.dll + 2012-03-20 10:16 . 2012-03-20 10:16 4545024 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Form#\c2ed38a4852d1795a28630b943132a8f\System.Windows.Forms.DataVisualization.ni.dll + 2012-03-20 10:16 . 2012-03-20 10:16 1885696 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Web.Services\ed3c3da0975b58d65c97de64ad12b67f\System.Web.Services.ni.dll + 2012-03-20 10:16 . 2012-03-20 10:16 2012160 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Speech\ebf81a3c4b84173e4c261b53c36dc2c7\System.Speech.ni.dll + 2012-03-20 10:16 . 2012-03-20 10:16 1140736 c:\windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\bd56724925a1ac99f75696295cbb078a\System.ServiceModel.Discovery.ni.dll + 2012-03-20 10:16 . 2012-03-20 10:16 1393152 c:\windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\1a9500e548a617a7ff96d4260554e4d5\System.ServiceModel.Activities.ni.dll + 2012-03-20 10:14 . 2012-03-20 10:14 2647040 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Seri#\ca261c617636f2ff269d6233b19f97b8\System.Runtime.Serialization.ni.dll + 2012-03-20 10:14 . 2012-03-20 10:14 1021952 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Dura#\e4f2a7b1e685e937ccefac6ff0a36b27\System.Runtime.DurableInstancing.ni.dll + 2012-03-20 10:14 . 2012-03-20 10:14 1060864 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Printing\03109a409036c6e939bc9881f9e60b37\System.Printing.ni.dll + 2012-03-20 10:15 . 2012-03-20 10:15 1218560 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Management\eef171dee81858018c3956485fff7ba7\System.Management.ni.dll + 2012-03-20 10:15 . 2012-03-20 10:15 1072640 c:\windows\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\38f1dee7d3bebfb9bf83898f598ea4c2\System.IdentityModel.ni.dll + 2012-03-20 10:05 . 2012-03-20 10:05 1653248 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\2c958d61dd28474ec780db9d18d266ae\System.Drawing.ni.dll + 2012-03-20 10:14 . 2012-03-20 10:14 1172992 c:\windows\assembly\NativeImages_v4.0.30319_32\System.DirectorySer#\45e9729f55f25e4c70f7ea3cfc0a8087\System.DirectoryServices.ni.dll + 2012-03-20 10:14 . 2012-03-20 10:14 1879040 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Deployment\d6ca9981841735085e10843bb7187573\System.Deployment.ni.dll + 2012-03-20 10:05 . 2012-03-20 10:05 6815232 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Data\b0df867e9242cf4d254ec8eb8da97332\System.Data.ni.dll + 2012-03-20 10:05 . 2012-03-20 10:05 2549760 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Data.SqlXml\32fffd4b8760322bc2e35c2417676b7f\System.Data.SqlXml.ni.dll + 2012-03-20 10:15 . 2012-03-20 10:15 1344000 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Data.Service#\f4087e23c683a35e4628d9f829aaa41d\System.Data.Services.Client.ni.dll + 2012-03-20 10:05 . 2012-03-20 10:05 2517504 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Data.Linq\a791cec82d0c142b843025f25c8277f9\System.Data.Linq.ni.dll + 2012-03-20 10:05 . 2012-03-20 10:05 7069696 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Core\b7409080f31b0a702281b68c37bac326\System.Core.ni.dll + 2012-03-20 10:14 . 2012-03-20 10:14 4129792 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Activities\004bf96bf646e4f1126b919316be5c2f\System.Activities.ni.dll + 2012-03-20 10:14 . 2012-03-20 10:14 3757568 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Activities.P#\2456337e1ae6411ec64b9d18042d5c13\System.Activities.Presentation.ni.dll + 2012-03-20 10:14 . 2012-03-20 10:14 1547264 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Activities.C#\3206d2885d46ae9513c1489d7bc97b9c\System.Activities.Core.Presentation.ni.dll + 2012-03-20 10:14 . 2012-03-20 10:14 2906624 c:\windows\assembly\NativeImages_v4.0.30319_32\ReachFramework\ccc1a34a0a532480e00219ca5645ffeb\ReachFramework.ni.dll + 2012-03-20 10:14 . 2012-03-20 10:14 1640448 c:\windows\assembly\NativeImages_v4.0.30319_32\PresentationUI\dee17bfe2a1b329bd8bb2199446dda83\PresentationUI.ni.dll + 2012-03-20 10:14 . 2012-03-20 10:14 1172480 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\f1451a88d3bc4ab55d1cde85ceb4cd35\Microsoft.VisualBasic.Activities.Compiler.ni.dll + 2012-03-20 10:14 . 2012-03-20 10:14 1838080 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\7a3431124b8ded91068710226c0a00d4\Microsoft.VisualBasic.ni.dll + 2012-03-20 10:14 . 2012-03-20 10:14 1139200 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\363a87c6f2b70055eb822596173ba1ac\Microsoft.VisualBasic.Compatibility.ni.dll + 2012-03-20 10:14 . 2012-03-20 10:14 1085952 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Transacti#\ba7e3823b1a01f31e53be9b57b392035\Microsoft.Transactions.Bridge.ni.dll + 2012-03-20 10:15 . 2012-03-20 10:15 2452480 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.JScript\ddba6895bf4a65312155228d9744c912\Microsoft.JScript.ni.dll + 2012-03-20 10:05 . 2012-03-20 10:05 1616384 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\409a7c3f32302875f33d0910cc484bac\Microsoft.CSharp.ni.dll + 2009-07-14 02:34 . 2012-03-21 02:14 10485760 c:\windows\system32\SMI\Store\Machine\schema.dat - 2009-07-14 02:34 . 2012-03-20 04:29 10485760 c:\windows\system32\SMI\Store\Machine\schema.dat + 2012-03-20 06:37 . 2012-03-20 06:37 11350176 c:\windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll - 2011-10-04 04:38 . 2012-03-20 04:14 33613964 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2636114741-474596119-2817400375-1000-4096.dat + 2011-10-04 04:38 . 2012-03-21 05:06 33613964 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2636114741-474596119-2817400375-1000-4096.dat + 2011-11-22 07:42 . 2011-11-22 07:42 33189888 c:\windows\Installer\bf56cd.msp + 2012-03-20 10:04 . 2012-03-20 10:04 11880448 c:\windows\assembly\NativeImages_v4.0.30319_64\System\a9e29e892ad68ac0b88f0480746a0d0b\System.ni.dll + 2012-03-20 10:10 . 2012-03-20 10:10 17291264 c:\windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\f850dba642b0cc845d9a7d8ac300e243\System.Windows.Forms.ni.dll + 2012-03-20 10:12 . 2012-03-20 10:12 24551424 c:\windows\assembly\NativeImages_v4.0.30319_64\System.ServiceModel\bd433ada9b2565b666331b5b1276538a\System.ServiceModel.ni.dll + 2012-03-20 10:11 . 2012-03-20 10:11 18480128 c:\windows\assembly\NativeImages_v4.0.30319_64\System.Data.Entity\9aca7097fc620da8481516b2d4e3fede\System.Data.Entity.ni.dll + 2012-03-20 10:07 . 2012-03-20 10:07 10440704 c:\windows\assembly\NativeImages_v4.0.30319_64\System.Core\e91a0d844afdda429e0fbd9814f41134\System.Core.ni.dll + 2012-03-20 10:09 . 2012-03-20 10:09 24406528 c:\windows\assembly\NativeImages_v4.0.30319_64\PresentationFramewo#\8a4ac50c706da226242a99b871c9f981\PresentationFramework.ni.dll + 2012-03-20 10:08 . 2012-03-20 10:08 15907328 c:\windows\assembly\NativeImages_v4.0.30319_64\PresentationCore\b0adff19c63ba3b4be1cae43567af15d\PresentationCore.ni.dll + 2012-03-20 10:04 . 2012-03-20 10:04 19355648 c:\windows\assembly\NativeImages_v4.0.30319_64\mscorlib\d9d8d4f8fc868d07be41d4ffb46d7364\mscorlib.ni.dll + 2012-03-20 10:05 . 2012-03-20 10:05 13138944 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\33eae86e0a5d9bcc4d0e4e469e2ac36a\System.Windows.Forms.ni.dll + 2012-03-20 10:16 . 2012-03-20 10:16 18058752 c:\windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel\a526845de91a382b6ea05b02eddc6f3e\System.ServiceModel.ni.dll + 2012-03-20 10:15 . 2012-03-20 10:15 13345792 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Data.Entity\32e0d99cfda10e64d7583bb65444cab3\System.Data.Entity.ni.dll + 2012-03-20 10:05 . 2012-03-20 10:05 18000384 c:\windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\bd3685e578c22d17625390d847973de0\PresentationFramework.ni.dll + 2012-03-20 10:05 . 2012-03-20 10:05 11450880 c:\windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\008fbb2e42b3c2569ff58d651575ff29\PresentationCore.ni.dll + 2012-03-20 10:05 . 2012-03-20 10:05 14414336 c:\windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e5b31f3bb6508df0dc7c20ddc72f3191\mscorlib.ni.dll . – Snapshot reset to current date – . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-11-28 39408] "cdloader"="c:\users\Avi\AppData\Roaming\mjusbsp\cdloader2.exe" [2011-08-23 50592] "uTorrent"="c:\program files (x86)\uTorrent\uTorrent.exe" [2012-03-03 740216] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "SmartWiHelper"="c:\program files (x86)\Sony\SmartWi Connection Utility\SmartWiHelper.exe" [2009-08-26 79872] "ISBMgr.exe"="c:\program files (x86)\Sony\ISB Utility\ISBMgr.exe" [2009-05-26 317288] "WinampAgent"="c:\program files (x86)\Winamp\winampa.exe" [2010-01-13 37888] "LifeCam"="c:\program files (x86)\Microsoft LifeCam\LifeExp.exe" [2010-05-20 119152] "SSDMonitor"="c:\program files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe" [2010-08-05 104408] "DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-03-21 1230704] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-7-1 1079584] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon] 2009-07-01 16:49 98304 —-a-w- c:\windows\System32\VESWinlogon.dll . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-11-28 133104] R2 Roxio Upnp Server 10;Roxio Upnp Server 10;c:\program files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe [2009-06-26 362992] R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x] R3 dump_wmimmc;dump_wmimmc;c:\gpotato.eu\Dragonica\Release\GameGuard\dump_wmimmc.sys [x] R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-11-28 133104] R3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [x] R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x] R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-28 288272] R3 Roxio UPnP Renderer 10;Roxio UPnP Renderer 10;c:\program files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [2009-06-26 313840] R3 SampleCollector;Intel® Sample Collector;c:\program files\Sony\VAIO Care\collsvc.exe [2008-09-29 167424] R3 SOHCImp;VAIO Media plus Content Importer;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe [2009-07-27 120104] R3 SOHDBSvr;VAIO Media plus Database Manager;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe [2009-07-27 70952] R3 SOHDms;VAIO Media plus Digital Media Server;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe [2009-07-27 427304] R3 SOHDs;VAIO Media plus Device Searcher;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe [2009-07-27 75048] R3 SOHPlMgr;VAIO Media plus Playlist Manager;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe [2009-07-27 91432] R3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2009-06-26 468264] R3 VcmINSMgr;VAIO Content Metadata Intelligent Network Service Manager;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [2009-06-26 357672] R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [2009-06-17 110888] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [x] S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] S2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [2010-08-05 583640] S2 rimspci;rimspci;c:\windows\system32\DRIVERS\rimssne64.sys [x] S2 risdsnpe;risdsnpe;c:\windows\system32\DRIVERS\risdsne64.sys [x] S2 VAIO Power Management;VAIO Power Management;c:\program files\Sony\VAIO Power Management\SPMService.exe [2009-08-22 411496] S2 VCFw;VAIO Content Folder Watcher;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [2009-07-22 642920] S2 yksvc;Marvell Yukon Service;c:\windows\System32\svchost.exe [2009-07-14 27136] S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [x] S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x] S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\DRIVERS\SFEP.sys [x] S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x] . . Contents of the 'Scheduled Tasks' folder . 2012-03-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-11-28 00:16] . 2012-03-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-11-28 00:16] . 2012-03-18 c:\windows\Tasks\Norton Security Scan for Avi.job - c:\program files (x86)\Norton Security Scan\Engine\2.7.3.34\Nss.exe [2010-07-14 18:06] . . ——— x86-64 ———– . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-07-24 7938080] "Skytel"="c:\program files\Realtek\Audio\HDA\Skytel.exe" [2009-07-24 1833504] "SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU] "IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-05 186904] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-10-03 16395880] "VX3000"="c:\windows\vVX3000.exe" [2010-05-20 762736] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 1436736] . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://www.facebook.com/ mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=SNNT&bmod=SNNT mLocal Page = c:\windows\SysWOW64\blank.htm IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000 IE: Send image to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm IE: Send page to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm TCP: DhcpNameServer = 192.168.0.1 Handler: intu-tt2011 - {B3B5DAD9-E96D-45b4-B636-B6CF2F773DE1} - c:\program files (x86)\TurboTax 2011\ic2011pp.dll FF - ProfilePath - c:\users\Avi\AppData\Roaming\Mozilla\Firefox\Profiles\pbbcnf07.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://forums.whatthetech.com/index.php?showforum=27 FF - prefs.js: keyword.URL - hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=ZVxdm148YYCA&ptnrS=ZVxdm148YYCA&ptb=JrWlDCxDbDlcTUqxsjFfVA&ind=2011071318&n=77de8356&psa=&st=kwd&searchfor= . - - - - ORPHANS REMOVED - - - - . WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) . . . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SampleCollector] "ImagePath"="\"c:\program files\Sony\VAIO Care\collsvc.exe\" \"/service\" \"/counter=\Processor(_Total)\% Processor Time:5\" \"/counter=\PhysicalDisk(_Total)\Disk Bytes/sec:5\" \"/counter=\Network Interface(*)\Bytes Total/sec:5\" \"/directory=inteldata\"" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc] "ImagePath"="c:\windows\system32\GameMon.des -service" . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2012-03-20 22:21:42 ComboFix-quarantined-files.txt 2012-03-21 05:21 ComboFix2.txt 2012-03-20 04:49 . Pre-Run: 43,175,735,296 bytes free Post-Run: 42,926,727,168 bytes free . - - End Of File - - 841F94E7AEFC4061579BDAEAF812F494
Post #15
Hi klown604,

Sorry, I missed one entry. We'll be ready to clean up the tools we used and send you on your way after this last fix. How is the computer running now?

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text. 

Firefox::
FF - ProfilePath - c:\users\Avi\AppData\Roaming\Mozilla\Firefox\Profiles\pbbcnf07.default\
FF - prefs.js: keyword.URL - hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …


[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe


Then post the results log using Copy / Paste

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI