What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Sirefef [Closed]

2 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi. I have sirefef detected by Microsoft Security Essentials and I have been unable to remove it.

I read a post on these forums and ran aswmbr and combofix.

http://forums.whatthetech.com/index.php?showtopic=123174

I also understand that I should not have done this without your go ahead. I had backed up the system and was preparing to reinstall it anyway but I thought I'd try this first.

I appreciate your help. Please let me know if there is anything I should do.

Here are the logs:

aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software
Run date: 2012-06-03 18:30:57
—————————–
18:30:57.687 OS Version: Windows 5.1.2600 Service Pack 3
18:30:57.687 Number of processors: 4 586 0xF0B
18:30:57.687 ComputerName: HOME UserName:
18:30:58.265 Initialize success
18:31:27.890 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-7
18:31:27.890 Disk 0 Vendor: WDC_WD3200AAKS-00B3A0 01.03A01 Size: 305245MB BusType: 3
18:31:27.890 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP4T0L0-14
18:31:27.890 Disk 1 Vendor: ST3500418AS CC34 Size: 476940MB BusType: 3
18:31:27.921 Disk 0 MBR read successfully
18:31:27.921 Disk 0 MBR scan
18:31:27.921 Disk 0 Windows XP default MBR code
18:31:27.921 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 305234 MB offset 63
18:31:27.921 Disk 0 scanning sectors +625121280
18:31:28.015 Disk 0 scanning C:\WINDOWS\system32\drivers
18:31:33.828 Service scanning
18:31:37.218 Service MpKsld715da56 C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C41497BB-9A5B-458D-9315-FEC1F4490D2B}\MpKsld715da56.sys **LOCKED** 32
18:31:41.671 Modules scanning
18:31:45.812 Disk 0 trace - called modules:
18:31:45.843 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
18:31:45.843 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8ac45ab8]
18:31:45.843 3 CLASSPNP.SYS[ba108fd7] -> nt!IofCallDriver -> \Device\0000006c[0x8ac1b9e8]
18:31:45.843 5 ACPI.sys[b9f7f620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-7[0x8ac1bd98]
18:31:45.843 Scan finished successfully
18:31:53.000 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Administrator\Desktop\MBR.dat"
18:31:53.000 The log file has been saved successfully to "C:\Documents and Settings\Administrator\Desktop\aswMBR.txt"


ComboFix 12-06-02.03 - Administrator 03/06/2012 18:38:23.1.4 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3327.2464 [GMT 10:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Administrator\Local Settings\Application Data\{0ea2b7aa-da34-e9d1-d7d1-74916529bbed}
c:\documents and settings\Administrator\Local Settings\Application Data\{0ea2b7aa-da34-e9d1-d7d1-74916529bbed}\@
c:\documents and settings\Administrator\Local Settings\Application Data\{0ea2b7aa-da34-e9d1-d7d1-74916529bbed}\L\00000004.@
c:\documents and settings\Administrator\Local Settings\Application Data\{0ea2b7aa-da34-e9d1-d7d1-74916529bbed}\n
c:\documents and settings\Administrator\Local Settings\Application Data\{0ea2b7aa-da34-e9d1-d7d1-74916529bbed}\U\00000004.@
c:\program files\FunWebProducts
c:\program files\FunWebProducts\Installr\1.bin\F3EZSETP.DLL
c:\program files\FunWebProducts\Installr\1.bin\F3PLUGIN.DLL
c:\program files\FunWebProducts\Installr\1.bin\NPFUNWEB.DLL
c:\program files\Internet Explorer\SET55C.tmp
c:\program files\Internet Explorer\SET561.tmp
c:\windows\assembly\GAC\Desktop.ini
c:\windows\Installer\{0ea2b7aa-da34-e9d1-d7d1-74916529bbed}
c:\windows\Installer\{0ea2b7aa-da34-e9d1-d7d1-74916529bbed}\@
c:\windows\Installer\{0ea2b7aa-da34-e9d1-d7d1-74916529bbed}\L\00000004.@
c:\windows\Installer\{0ea2b7aa-da34-e9d1-d7d1-74916529bbed}\L\1afb2d56
c:\windows\Installer\{0ea2b7aa-da34-e9d1-d7d1-74916529bbed}\n
c:\windows\Installer\{0ea2b7aa-da34-e9d1-d7d1-74916529bbed}\U\00000004.@
c:\windows\system32\_000005_.tmp.dll
c:\windows\system32\_000006_.tmp.dll
c:\windows\system32\_000007_.tmp.dll
c:\windows\system32\_000008_.tmp.dll
c:\windows\system32\_000009_.tmp.dll
c:\windows\system32\_000013_.tmp.dll
c:\windows\system32\_000017_.tmp.dll
c:\windows\system32\_000018_.tmp.dll
c:\windows\system32\_000019_.tmp.dll
c:\windows\system32\AutoRun.inf
c:\windows\system32\SET1E2.tmp
c:\windows\system32\SET1E3.tmp
c:\windows\system32\SET1E4.tmp
c:\windows\system32\SET1E6.tmp
c:\windows\system32\SET1F6.tmp
c:\windows\system32\SET23C.tmp
c:\windows\system32\SET244.tmp
c:\windows\system32\SET24C.tmp
c:\windows\system32\SET258.tmp
c:\windows\system32\SET25C.tmp
c:\windows\system32\SET266.tmp
c:\windows\system32\SET267.tmp
c:\windows\system32\SET277.tmp
c:\windows\system32\SET28F.tmp
c:\windows\system32\SET299.tmp
c:\windows\system32\SET427.tmp
c:\windows\system32\SET42F.tmp
c:\windows\system32\SET432.tmp
c:\windows\system32\SET44E.tmp
c:\windows\system32\SET450.tmp
c:\windows\system32\SET48D.tmp
c:\windows\system32\SET491.tmp
c:\windows\system32\SET49D.tmp
c:\windows\system32\SET4A2.tmp
c:\windows\system32\SET4CD.tmp
c:\windows\system32\SET4FB.tmp
c:\windows\system32\SET511.tmp
c:\windows\system32\SET519.tmp
c:\windows\system32\SET52A.tmp
c:\windows\system32\SET577.tmp
c:\windows\system32\SET578.tmp
c:\windows\system32\SET57A.tmp
c:\windows\system32\SET57B.tmp
c:\windows\system32\SET57C.tmp
c:\windows\system32\SET57D.tmp
c:\windows\system32\SET582.tmp
c:\windows\system32\SET583.tmp
c:\windows\system32\SET584.tmp
c:\windows\system32\SET58C.tmp
c:\windows\system32\SET58E.tmp
c:\windows\system32\SET591.tmp
c:\windows\system32\SET593.tmp
c:\windows\system32\SET594.tmp
c:\windows\system32\SET596.tmp
c:\windows\system32\SET59A.tmp
c:\windows\system32\SET59D.tmp
c:\windows\system32\SET59E.tmp
c:\windows\system32\SET59F.tmp
c:\windows\system32\SET5A0.tmp
c:\windows\system32\SET5A1.tmp
c:\windows\system32\SET5A5.tmp
c:\windows\system32\SET5A6.tmp
c:\windows\system32\SET5A8.tmp
c:\windows\system32\SET5AA.tmp
c:\windows\system32\SET5AB.tmp
c:\windows\system32\SET5D1.tmp
c:\windows\system32\SET5D2.tmp
c:\windows\system32\SET5D5.tmp
c:\windows\system32\SET5D6.tmp
c:\windows\system32\SET5D7.tmp
c:\windows\system32\SET5DA.tmp
c:\windows\system32\SET5DC.tmp
c:\windows\system32\SET60D.tmp
c:\windows\system32\SET626.tmp
c:\windows\system32\SET627.tmp
c:\windows\system32\SET664.tmp
c:\windows\system32\SET69E.tmp
c:\windows\system32\SET69F.tmp
c:\windows\system32\SET6A1.tmp
c:\windows\system32\SET6A5.tmp
c:\windows\system32\SET6AD.tmp
c:\windows\system32\SET6AF.tmp
c:\windows\TEMP\logishrd\LVPrcInj01.dll
d:\documents and settings\barry silk\My Documents\~WRD0000.tmp
d:\documents and settings\barry silk\My Documents\~WRD2614.tmp
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
——-\Legacy_ABP470N5
——-\Service_abp470n5
.
.
((((((((((((((((((((((((( Files Created from 2012-05-03 to 2012-06-03 )))))))))))))))))))))))))))))))
.
.
2012-06-03 07:51 . 2012-06-03 07:51 ——– d—–w- c:\windows\LastGood.Tmp
2012-06-03 00:51 . 2008-04-13 19:42 116224 -c–a-w- c:\windows\system32\dllcache\xrxwiadr.dll
2012-06-03 00:51 . 2001-08-17 12:36 23040 -c–a-w- c:\windows\system32\dllcache\xrxwbtmp.dll
2012-06-03 00:51 . 2008-04-13 19:42 18944 -c–a-w- c:\windows\system32\dllcache\xrxscnui.dll
2012-06-03 00:51 . 2001-08-17 12:37 27648 -c–a-w- c:\windows\system32\dllcache\xrxftplt.exe
2012-06-03 00:51 . 2001-08-17 12:37 4608 -c–a-w- c:\windows\system32\dllcache\xrxflnch.exe
2012-06-03 00:51 . 2001-08-17 12:37 99865 -c–a-w- c:\windows\system32\dllcache\xlog.exe
2012-06-03 00:51 . 2001-08-17 02:11 16970 -c–a-w- c:\windows\system32\dllcache\xem336n5.sys
2012-06-03 00:51 . 2008-04-13 12:04 19455 -c–a-w- c:\windows\system32\dllcache\wvchntxx.sys
2012-06-03 00:51 . 2008-04-13 12:04 12063 -c–a-w- c:\windows\system32\dllcache\wsiintxx.sys
2012-06-03 00:51 . 2008-04-13 19:42 8192 -c–a-w- c:\windows\system32\dllcache\wshirda.dll
2012-06-03 00:51 . 2008-04-13 14:06 8832 -c–a-w- c:\windows\system32\dllcache\wmiacpi.sys
2012-06-03 00:51 . 2008-04-13 12:05 154624 -c–a-w- c:\windows\system32\dllcache\wlluc48.sys
2012-06-03 00:49 . 2008-04-13 19:42 11325 -c–a-w- c:\windows\system32\dllcache\vchnt5.dll
2012-06-03 00:48 . 2001-08-17 03:48 11520 -c–a-w- c:\windows\system32\dllcache\twotrack.sys
2012-06-03 00:47 . 2001-08-17 03:49 30464 -c–a-w- c:\windows\system32\dllcache\tbatm155.sys
2012-06-03 00:46 . 2001-08-17 12:36 24660 -c–a-w- c:\windows\system32\dllcache\spxupchk.dll
2012-06-03 00:45 . 2008-04-13 12:05 63547 -c–a-w- c:\windows\system32\dllcache\sla30nd5.sys
2012-06-03 00:44 . 2001-08-17 03:51 23936 -c–a-w- c:\windows\system32\dllcache\sccmusbm.sys
2012-06-03 00:43 . 2001-08-17 12:36 86097 -c–a-w- c:\windows\system32\dllcache\reslog32.dll
2012-06-03 00:42 . 2001-08-17 12:36 121344 -c–a-w- c:\windows\system32\dllcache\phvfwext.dll
2012-06-03 00:41 . 2001-08-17 04:05 48000 -c–a-w- c:\windows\system32\dllcache\ovcam2.sys
2012-06-03 00:40 . 2001-08-17 04:56 91488 -c–a-w- c:\windows\system32\dllcache\n9i3disp.dll
2012-06-03 00:39 . 2001-08-17 03:52 17280 -c–a-w- c:\windows\system32\dllcache\mraid35x.sys
2012-06-03 00:38 . 2001-08-17 02:12 70730 -c–a-w- c:\windows\system32\dllcache\lne100tx.sys
2012-06-03 00:37 . 2001-08-17 03:52 16000 -c–a-w- c:\windows\system32\dllcache\ini910u.sys
2012-06-03 00:36 . 2001-08-17 03:28 488383 -c–a-w- c:\windows\system32\dllcache\hsf_v124.sys
2012-06-03 00:35 . 2001-08-17 03:28 907456 -c–a-w- c:\windows\system32\dllcache\hcf_msft.sys
2012-06-03 00:34 . 2001-08-17 02:19 63360 -c–a-w- c:\windows\system32\dllcache\ess.sys
2012-06-03 00:33 . 2001-08-17 02:14 952007 -c–a-w- c:\windows\system32\dllcache\diwan.sys
2012-06-03 00:32 . 2008-04-13 14:06 10240 -c–a-w- c:\windows\system32\dllcache\compbatt.sys
2012-06-03 00:31 . 2001-08-17 12:36 87552 -c–a-w- c:\windows\system32\dllcache\avmcoxp.dll
2012-06-03 00:30 . 2001-08-17 04:56 66048 -c–a-w- c:\windows\system32\dllcache\s3legacy.dll
2012-06-03 00:30 . 2012-04-11 13:10 2192640 -c–a-w- c:\windows\system32\dllcache\ntoskrnl.exe
2012-06-02 21:29 . 2012-03-01 11:01 55296 -c—-w- c:\windows\system32\dllcache\msfeedsbs.dll
2012-06-02 21:29 . 2012-03-01 11:01 743424 -c—-w- c:\windows\system32\dllcache\iedvtool.dll
2012-06-02 21:29 . 2012-03-01 11:01 12800 -c—-w- c:\windows\system32\dllcache\xpshims.dll
2012-06-02 21:29 . 2012-03-01 11:01 247808 -c—-w- c:\windows\system32\dllcache\ieproxy.dll
2012-06-02 21:29 . 2012-03-01 11:01 602112 -c—-w- c:\windows\system32\dllcache\msfeeds.dll
2012-06-02 21:29 . 2012-03-01 11:01 2000384 -c—-w- c:\windows\system32\dllcache\iertutil.dll
2012-06-02 06:03 . 2012-06-02 06:03 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2012-06-02 06:03 . 2012-06-02 06:03 ——– d—–w- c:\program files\Mozilla Maintenance Service
2012-06-02 05:44 . 2011-06-21 04:09 200976 —-a-w- c:\windows\system32\drivers\tmcomm.sys
2012-06-02 05:20 . 2008-04-14 12:00 70656 -c–a-w- c:\windows\system32\dllcache\korwbrkr.dll
2012-06-02 05:19 . 2008-04-14 12:00 68608 -c–a-w- c:\windows\system32\dllcache\isatq.dll
2012-06-02 05:02 . 2008-04-13 12:05 20992 -c–a-w- c:\windows\system32\dllcache\rtl8139.sys
2012-06-02 05:02 . 2008-04-13 12:05 20992 —-a-w- c:\windows\system32\drivers\RTL8139.sys
2012-06-02 04:59 . 2008-04-14 12:00 24661 -c–a-w- c:\windows\system32\dllcache\spxcoins.dll
2012-06-02 04:59 . 2008-04-14 12:00 24661 —-a-w- c:\windows\system32\spxcoins.dll
2012-06-02 04:59 . 2008-04-14 12:00 13312 -c–a-w- c:\windows\system32\dllcache\irclass.dll
2012-06-02 04:59 . 2008-04-14 12:00 13312 —-a-w- c:\windows\system32\irclass.dll
2012-06-02 04:59 . 2008-04-14 12:00 16535 —-a-r- c:\windows\SET13A.tmp
2012-06-02 04:59 . 2008-04-14 12:00 1088840 —-a-r- c:\windows\SET12E.tmp
2012-06-02 04:59 . 2008-04-14 12:00 1296669 —-a-r- c:\windows\SET12B.tmp
2012-06-02 02:41 . 2012-06-02 02:41 ——– d—–w- c:\documents and settings\Administrator\Application Data\TeamViewer
2012-06-02 02:41 . 2012-06-02 02:41 ——– d—–w- c:\program files\TeamViewer
2012-06-01 09:02 . 2012-05-14 15:43 6737808 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C41497BB-9A5B-458D-9315-FEC1F4490D2B}\mpengine.dll
2012-06-01 01:32 . 2012-05-14 15:43 6737808 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-06-01 01:29 . 2012-06-01 01:30 ——– d—–w- c:\program files\Microsoft Security Client
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-07 23:04 . 2012-03-28 23:20 419488 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-05-07 23:04 . 2011-07-21 00:49 70304 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-04-11 13:14 . 2008-04-14 12:00 2148352 —-a-w- c:\windows\system32\ntoskrnl.exe
2012-04-11 13:12 . 2008-04-14 12:00 1862272 —-a-w- c:\windows\system32\win32k.sys
2012-04-11 12:35 . 2008-04-14 00:01 2026496 —-a-w- c:\windows\system32\ntkrnlpa.exe
2012-03-20 10:44 . 2012-03-20 10:44 171064 —-a-w- c:\windows\system32\drivers\MpFilter.sys
2004-10-01 05:00 . 2011-04-18 02:09 40960 —-a-w- c:\program files\Uninstall_CDS.exe
2012-04-21 01:19 . 2012-06-02 06:03 97208 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-01-26 15026056]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-09-04 39408]
"ChromeFrameHelper"="c:\documents and settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\19.0.1084.52\chrome_frame_helper.exe" [2012-05-23 96792]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2008-02-13 564496]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2008-02-13 2196240]
"RemoteControl"="c:\program files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2004-11-02 32768]
"InCD"="c:\program files\Ahead\InCD\InCD.exe" [2006-07-12 1397760]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"LGODDFU"="c:\program files\lg_fwupdate\fwupdate.exe" [2011-04-18 557056]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2011-10-24 421888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-03-26 421736]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 931200]
"nwiz"="nwiz.exe" [2008-05-16 1630208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 86016]
"RTHDCPL"="RTHDCPL.EXE" [2007-03-21 16126464]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\Administrator\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
EZ-DUB Finder.lnk - c:\program files\EZ-DUB\EZ-DUB.exe [2005-9-13 266240]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2010-6-13 66864]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-01-02 00:07 843712 —-a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2012-03-27 12:41 37296 —-a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-03 18:43 69632 —-a-w- c:\windows\ALCMTR.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2008-05-16 18:31 13529088 —-a-w- c:\windows\system32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2008-05-16 18:31 86016 —-a-w- c:\windows\system32\nvmctray.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2008-05-16 18:31 1630208 —-a-w- c:\windows\system32\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2007-03-21 14:49 16126464 ——r- c:\windows\RTHDCPL.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
.
R2 TeamViewer7;TeamViewer 7;c:\program files\TeamViewer\Version7\TeamViewer_Service.exe [2/06/2012 12:41 PM 2666880]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;c:\windows\system32\drivers\atl01_xp.sys [29/05/2010 5:46 PM 38656]
S1 fwgymfoh;fwgymfoh;\??\c:\windows\system32\drivers\fwgymfoh.sys –> c:\windows\system32\drivers\fwgymfoh.sys [?]
S1 ichegdqy;ichegdqy;\??\c:\windows\system32\drivers\ichegdqy.sys –> c:\windows\system32\drivers\ichegdqy.sys [?]
S1 MpKsld715da56;MpKsld715da56;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C41497BB-9A5B-458D-9315-FEC1F4490D2B}\MpKsld715da56.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C41497BB-9A5B-458D-9315-FEC1F4490D2B}\MpKsld715da56.sys [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [5/09/2011 9:03 AM 136176]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [29/03/2012 9:20 AM 257696]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [5/09/2011 9:03 AM 136176]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [2/06/2012 4:03 PM 129976]
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2012-06-03 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-28 23:04]
.
2012-02-09 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 07:57]
.
2012-06-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-09-04 23:03]
.
2012-06-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-09-04 23:03]
.
2012-06-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2052111302-630328440-1801674531-500Core.job
- c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-04-09 21:28]
.
2012-06-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2052111302-630328440-1801674531-500UA.job
- c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-04-09 21:28]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com.au/
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\aau36ssg.default\
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-06-03 18:46
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-2052111302-630328440-1801674531-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,8f,28,6b,98,e7,1f,63,4e,8c,28,f9,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,8f,28,6b,98,e7,1f,63,4e,8c,28,f9,\
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,89,eb,8a,45,49,eb,72,4e,8f,6a,ae,\
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'explorer.exe'(6484)
c:\windows\system32\WININET.dll
c:\documents and settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\19.0.1084.52\chrome_frame_helper.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\MSVCR80.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\program files\Ahead\InCD\InCDsrv.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\windows\system32\SearchIndexer.exe
c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
c:\program files\TeamViewer\Version7\TeamViewer.exe
c:\program files\TeamViewer\Version7\tv_w32.exe
c:\windows\system32\RUNDLL32.EXE
c:\program files\Common Files\Logishrd\LQCVFX\COCIManager.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2012-06-03 18:48:55 - machine was rebooted
ComboFix-quarantined-files.txt 2012-06-03 08:48
.
Pre-Run: 300,676,411,392 bytes free
Post-Run: 301,947,428,864 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - 1D1B9AB968B8BF00FCDD780707138A1D
Post #2
Hi,

Please run the following:

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
  • They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

File::
c:\windows\SET13A.tmp
c:\windows\SET12E.tmp
c:\windows\SET12B.tmp
c:\windows\system32\drivers\fwgymfoh.sys 
c:\windows\system32\drivers\ichegdqy.sys 

Driver::
fwgymfoh
ichegdqy

ClearJavaCache::

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix may request an update; please allow it.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you.
  • Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

**Note**

When CF finishes running, the ComboFix log will open along with a message box–do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.
  • Ensure you are connected to the internet and click OK on the message box.


NEXT


Please download TDSSKiller.zip
  • Extract it to your desktop
  • Double click TDSSKiller.exe
  • when the window opens, click on Change Parameters
  • under ”Additional options”, put a check mark in the box next to “Detect TDLFS File System”
  • click OK
  • Press Start Scan
    • If Malicious objects are found then ensure Cure is selected
    • If TDLFS File System is found then ensure Delete is selected
    • Then click Continue > Reboot now
  • Copy and paste the log in your next reply
    • A copy of the log will be saved automatically to the root of the drive (typically C:\)
Post #3
Thank you for your reply CatByte.

The virus did come back again after combo fix was run last time and rebooted. This was a couple of days ago. I have now followed your instructions with combofix and tdsskiller.

tdsskiller found

(Suspicious)

\Device\Harddisk1\DR1 ( TDSS File System )

And I deleted it.

Here is the combofix log which was run with your cfscript:

ComboFix 12-06-04.02 - Administrator 05/06/2012 10:50:29.2.4 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3327.2528 [GMT 10:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
FILE ::
"c:\windows\SET12B.tmp"
"c:\windows\SET12E.tmp"
"c:\windows\SET13A.tmp"
"c:\windows\system32\drivers\fwgymfoh.sys"
"c:\windows\system32\drivers\ichegdqy.sys"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\SET12B.tmp
c:\windows\SET12E.tmp
c:\windows\SET13A.tmp
c:\windows\TEMP\logishrd\LVPrcInj01.dll
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
——-\Service_fwgymfoh
——-\Service_ichegdqy
.
.
((((((((((((((((((((((((( Files Created from 2012-05-05 to 2012-06-05 )))))))))))))))))))))))))))))))
.
.
2012-06-04 03:14 . 2012-06-04 03:14 ——– d—–w- c:\program files\Microsoft Junk E-mail Reporting
2012-06-04 01:54 . 2012-06-04 01:54 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\ApplicationHistory
2012-06-04 00:54 . 2012-06-04 00:54 ——– d—–w- c:\windows\system32\URTTEMP
2012-06-04 00:49 . 2012-06-04 01:46 ——– d—–w- c:\program files\Microsoft.NET
2012-06-04 00:24 . 2012-05-14 15:43 6737808 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6ACEDAA2-8A27-4631-B140-5CD9D470CB61}\mpengine.dll
2012-06-03 00:51 . 2008-04-13 19:42 116224 -c–a-w- c:\windows\system32\dllcache\xrxwiadr.dll
2012-06-03 00:51 . 2001-08-17 12:36 23040 -c–a-w- c:\windows\system32\dllcache\xrxwbtmp.dll
2012-06-03 00:51 . 2008-04-13 19:42 18944 -c–a-w- c:\windows\system32\dllcache\xrxscnui.dll
2012-06-03 00:51 . 2001-08-17 12:37 27648 -c–a-w- c:\windows\system32\dllcache\xrxftplt.exe
2012-06-03 00:51 . 2001-08-17 12:37 4608 -c–a-w- c:\windows\system32\dllcache\xrxflnch.exe
2012-06-03 00:51 . 2001-08-17 12:37 99865 -c–a-w- c:\windows\system32\dllcache\xlog.exe
2012-06-03 00:51 . 2001-08-17 02:11 16970 -c–a-w- c:\windows\system32\dllcache\xem336n5.sys
2012-06-03 00:51 . 2008-04-13 12:04 19455 -c–a-w- c:\windows\system32\dllcache\wvchntxx.sys
2012-06-03 00:51 . 2008-04-13 12:04 12063 -c–a-w- c:\windows\system32\dllcache\wsiintxx.sys
2012-06-03 00:51 . 2008-04-13 19:42 8192 -c–a-w- c:\windows\system32\dllcache\wshirda.dll
2012-06-03 00:51 . 2008-04-13 14:06 8832 -c–a-w- c:\windows\system32\dllcache\wmiacpi.sys
2012-06-03 00:51 . 2008-04-13 12:05 154624 -c–a-w- c:\windows\system32\dllcache\wlluc48.sys
2012-06-03 00:49 . 2008-04-13 19:42 11325 -c–a-w- c:\windows\system32\dllcache\vchnt5.dll
2012-06-03 00:48 . 2001-08-17 03:48 11520 -c–a-w- c:\windows\system32\dllcache\twotrack.sys
2012-06-03 00:47 . 2001-08-17 03:49 30464 -c–a-w- c:\windows\system32\dllcache\tbatm155.sys
2012-06-03 00:46 . 2001-08-17 12:36 24660 -c–a-w- c:\windows\system32\dllcache\spxupchk.dll
2012-06-03 00:45 . 2008-04-13 12:05 63547 -c–a-w- c:\windows\system32\dllcache\sla30nd5.sys
2012-06-03 00:44 . 2001-08-17 03:51 23936 -c–a-w- c:\windows\system32\dllcache\sccmusbm.sys
2012-06-03 00:43 . 2001-08-17 12:36 86097 -c–a-w- c:\windows\system32\dllcache\reslog32.dll
2012-06-03 00:42 . 2001-08-17 12:36 121344 -c–a-w- c:\windows\system32\dllcache\phvfwext.dll
2012-06-03 00:41 . 2001-08-17 04:05 48000 -c–a-w- c:\windows\system32\dllcache\ovcam2.sys
2012-06-03 00:40 . 2001-08-17 04:56 91488 -c–a-w- c:\windows\system32\dllcache\n9i3disp.dll
2012-06-03 00:39 . 2001-08-17 03:52 17280 -c–a-w- c:\windows\system32\dllcache\mraid35x.sys
2012-06-03 00:38 . 2001-08-17 02:12 70730 -c–a-w- c:\windows\system32\dllcache\lne100tx.sys
2012-06-03 00:37 . 2001-08-17 03:52 16000 -c–a-w- c:\windows\system32\dllcache\ini910u.sys
2012-06-03 00:36 . 2001-08-17 03:28 488383 -c–a-w- c:\windows\system32\dllcache\hsf_v124.sys
2012-06-03 00:35 . 2001-08-17 03:28 907456 -c–a-w- c:\windows\system32\dllcache\hcf_msft.sys
2012-06-03 00:34 . 2001-08-17 02:19 63360 -c–a-w- c:\windows\system32\dllcache\ess.sys
2012-06-03 00:33 . 2001-08-17 02:14 952007 -c–a-w- c:\windows\system32\dllcache\diwan.sys
2012-06-03 00:32 . 2008-04-13 14:06 10240 -c–a-w- c:\windows\system32\dllcache\compbatt.sys
2012-06-03 00:31 . 2001-08-17 12:36 87552 -c–a-w- c:\windows\system32\dllcache\avmcoxp.dll
2012-06-03 00:30 . 2001-08-17 04:56 66048 -c–a-w- c:\windows\system32\dllcache\s3legacy.dll
2012-06-03 00:30 . 2012-04-11 13:10 2192640 -c–a-w- c:\windows\system32\dllcache\ntoskrnl.exe
2012-06-02 21:29 . 2012-03-01 11:01 55296 -c—-w- c:\windows\system32\dllcache\msfeedsbs.dll
2012-06-02 21:29 . 2012-03-01 11:01 743424 -c—-w- c:\windows\system32\dllcache\iedvtool.dll
2012-06-02 21:29 . 2012-03-01 11:01 12800 -c—-w- c:\windows\system32\dllcache\xpshims.dll
2012-06-02 21:29 . 2012-03-01 11:01 247808 -c—-w- c:\windows\system32\dllcache\ieproxy.dll
2012-06-02 21:29 . 2012-03-01 11:01 602112 -c—-w- c:\windows\system32\dllcache\msfeeds.dll
2012-06-02 21:29 . 2012-03-01 11:01 2000384 -c—-w- c:\windows\system32\dllcache\iertutil.dll
2012-06-02 06:03 . 2012-06-02 06:03 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2012-06-02 06:03 . 2012-06-02 06:03 ——– d—–w- c:\program files\Mozilla Maintenance Service
2012-06-02 05:44 . 2011-06-21 04:09 200976 —-a-w- c:\windows\system32\drivers\tmcomm.sys
2012-06-02 05:20 . 2008-04-14 12:00 70656 -c–a-w- c:\windows\system32\dllcache\korwbrkr.dll
2012-06-02 05:19 . 2008-04-14 12:00 68608 -c–a-w- c:\windows\system32\dllcache\isatq.dll
2012-06-02 05:02 . 2008-04-13 12:05 20992 -c–a-w- c:\windows\system32\dllcache\rtl8139.sys
2012-06-02 05:02 . 2008-04-13 12:05 20992 —-a-w- c:\windows\system32\drivers\RTL8139.sys
2012-06-02 04:59 . 2008-04-14 12:00 24661 -c–a-w- c:\windows\system32\dllcache\spxcoins.dll
2012-06-02 04:59 . 2008-04-14 12:00 24661 —-a-w- c:\windows\system32\spxcoins.dll
2012-06-02 04:59 . 2008-04-14 12:00 13312 -c–a-w- c:\windows\system32\dllcache\irclass.dll
2012-06-02 04:59 . 2008-04-14 12:00 13312 —-a-w- c:\windows\system32\irclass.dll
2012-06-02 02:41 . 2012-06-02 02:41 ——– d—–w- c:\documents and settings\Administrator\Application Data\TeamViewer
2012-06-02 02:41 . 2012-06-02 02:41 ——– d—–w- c:\program files\TeamViewer
2012-06-01 01:32 . 2012-05-14 15:43 6737808 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-06-01 01:29 . 2012-06-01 01:30 ——– d—–w- c:\program files\Microsoft Security Client
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-31 13:22 . 2008-04-14 12:00 599040 —-a-w- c:\windows\system32\crypt32.dll
2012-05-07 23:04 . 2012-03-28 23:20 419488 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-05-07 23:04 . 2011-07-21 00:49 70304 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-04-11 13:14 . 2008-04-14 12:00 2148352 —-a-w- c:\windows\system32\ntoskrnl.exe
2012-04-11 13:12 . 2008-04-14 12:00 1862272 —-a-w- c:\windows\system32\win32k.sys
2012-04-11 12:35 . 2008-04-14 00:01 2026496 —-a-w- c:\windows\system32\ntkrnlpa.exe
2012-03-20 10:44 . 2012-03-20 10:44 171064 —-a-w- c:\windows\system32\drivers\MpFilter.sys
2004-10-01 05:00 . 2011-04-18 02:09 40960 —-a-w- c:\program files\Uninstall_CDS.exe
2012-04-21 01:19 . 2012-06-02 06:03 97208 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2012-06-03_08.44.48 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-06-05 00:56 . 2012-06-05 00:56 16384 c:\windows\Temp\Perflib_Perfdata_2c4.dat
+ 2008-04-14 12:00 . 2006-10-18 11:47 99840 c:\windows\system32\wmpshell.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 37376 c:\windows\system32\wmdmps.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 33792 c:\windows\system32\wmdmlog.dll
+ 2003-02-20 19:16 . 2003-02-20 19:16 49152 c:\windows\system32\URTTEMP\regtlib.exe
+ 2008-04-14 12:00 . 2009-10-21 05:38 75776 c:\windows\system32\strmfilt.dll
- 2008-04-14 12:00 . 2008-04-14 12:00 75776 c:\windows\system32\strmfilt.dll
+ 2008-04-14 12:00 . 2010-08-27 05:57 99840 c:\windows\system32\srvsvc.dll
+ 2012-06-04 00:56 . 2010-07-05 13:15 17272 c:\windows\system32\spmsg.dll
+ 2008-04-14 12:00 . 2012-06-04 02:00 88136 c:\windows\system32\perfc009.dat
+ 2008-04-14 12:00 . 2006-10-18 11:47 27136 c:\windows\system32\mspmsnsv.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 11264 c:\windows\system32\LAPRXY.dll
+ 2008-04-14 12:00 . 2009-10-21 05:38 25088 c:\windows\system32\httpapi.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 70472 c:\windows\system32\dxva2.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 99840 c:\windows\system32\dllcache\wmpshell.dll
+ 2010-05-29 07:12 . 2006-10-18 11:46 64000 c:\windows\system32\dllcache\wmplayer.exe
+ 2010-05-29 07:12 . 2006-10-18 11:47 96256 c:\windows\system32\dllcache\wmpband.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 37376 c:\windows\system32\dllcache\wmdmps.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 33792 c:\windows\system32\dllcache\wmdmlog.dll
- 2008-04-14 12:00 . 2008-04-14 12:00 75776 c:\windows\system32\dllcache\strmfilt.dll
+ 2008-04-14 12:00 . 2009-10-21 05:38 75776 c:\windows\system32\dllcache\strmfilt.dll
+ 2008-04-14 12:00 . 2010-08-27 05:57 99840 c:\windows\system32\dllcache\srvsvc.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 27136 c:\windows\system32\dllcache\mspmsnsv.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 11264 c:\windows\system32\dllcache\LAPRXY.dll
+ 2008-04-14 12:00 . 2009-10-21 05:38 25088 c:\windows\system32\dllcache\httpapi.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 87408 c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WindowsFormsIntegration.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 93024 c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\UIAutomationTypes.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 35688 c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\UIAutomationProvider.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 17784 c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\System.Windows.Presentation.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 58240 c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\System.Windows.Input.Manipulations.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 67912 c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\PenIMC.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 31576 c:\windows\Microsoft.NET\Framework\v4.0.30319\WMINet_Utils.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 44920 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Web.ApplicationServices.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 37240 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.ServiceModel.Channels.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 64352 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Numerics.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 45952 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.EnterpriseServices.Thunk.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 51032 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Device.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 50552 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Data.DataSetExtensions.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 81784 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Configuration.Install.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 81800 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.ComponentModel.DataAnnotations.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 39784 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.AddIn.Contract.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 68952 c:\windows\Microsoft.NET\Framework\v4.0.30319\SMDiagnostics.dll
+ 2010-03-18 19:58 . 2010-03-18 19:58 96088 c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\SetupUtility.exe
+ 2010-03-18 20:16 . 2010-03-18 20:16 78152 c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\Setup.exe
+ 2010-03-18 20:16 . 2010-03-18 20:16 18776 c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3082\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16 14168 c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3076\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16 18776 c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2070\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16 14168 c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2052\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16 17752 c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1055\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16 17752 c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1053\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16 18264 c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1049\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16 18264 c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1046\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16 18264 c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1045\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16 17752 c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1044\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16 19288 c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1043\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16 15192 c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1042\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16 15704 c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1041\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16 18264 c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1040\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16 18776 c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1038\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16 16728 c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1037\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16 18776 c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1036\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16 18264 c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1035\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16 17240 c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1033\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16 19288 c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1032\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16 18776 c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1031\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16 18264 c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1030\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16 18264 c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1029\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16 14168 c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1028\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16 17240 c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1025\SetupResources.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 13648 c:\windows\Microsoft.NET\Framework\v4.0.30319\SbsNclPerf.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 58192 c:\windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe
+ 2010-03-18 03:16 . 2010-03-18 03:16 32592 c:\windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
+ 2010-03-18 03:16 . 2010-03-18 03:16 52040 c:\windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
+ 2010-03-18 03:16 . 2010-03-18 03:16 21336 c:\windows\Microsoft.NET\Framework\v4.0.30319\normalization.dll
+ 2011-12-15 03:08 . 2011-12-15 03:08 57616 c:\windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 27984 c:\windows\Microsoft.NET\Framework\v4.0.30319\MUI\0409\mscorsecr.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 40784 c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorpe.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 20816 c:\windows\Microsoft.NET\Framework\v4.0.30319\mscoreeis.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 12128 c:\windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.VisualC.Dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 97680 c:\windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.VisualBasic.Compatibility.Data.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 36168 c:\windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
+ 2010-03-18 03:16 . 2010-03-18 03:16 78168 c:\windows\Microsoft.NET\Framework\v4.0.30319\ISymWrapper.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 58200 c:\windows\Microsoft.NET\Framework\v4.0.30319\InstallUtilLib.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 27992 c:\windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
+ 2010-03-18 03:16 . 2010-03-18 03:16 42312 c:\windows\Microsoft.NET\Framework\v4.0.30319\fusion.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 11592 c:\windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe
+ 2010-03-18 03:16 . 2010-03-18 03:16 88904 c:\windows\Microsoft.NET\Framework\v4.0.30319\dfdll.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 31048 c:\windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
+ 2010-03-18 03:16 . 2010-03-18 03:16 81248 c:\windows\Microsoft.NET\Framework\v4.0.30319\CustomMarshalers.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 44368 c:\windows\Microsoft.NET\Framework\v4.0.30319\Culture.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 95048 c:\windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
+ 2010-03-18 03:16 . 2010-03-18 03:16 29008 c:\windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe
+ 2010-03-18 03:16 . 2010-03-18 03:16 29528 c:\windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
+ 2010-03-18 03:16 . 2010-03-18 03:16 29016 c:\windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe
+ 2010-03-18 03:16 . 2010-03-18 03:16 17240 c:\windows\Microsoft.NET\Framework\v4.0.30319\Accessibility.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 10064 c:\windows\Microsoft.NET\Framework\v4.0.30319\1033\CvtResUI.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 24400 c:\windows\Microsoft.NET\Framework\v4.0.30319\1033\alinkui.dll
+ 2004-07-14 16:11 . 2004-07-14 16:11 31744 c:\windows\Microsoft.NET\Framework\v1.1.4322\WMINet_Utils.dll
+ 2009-06-24 09:56 . 2009-06-24 09:56 73728 c:\windows\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe
+ 2004-07-15 04:28 . 2004-07-15 04:28 57344 c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Web.RegularExpressions.dll
+ 2011-12-25 01:07 . 2011-12-25 01:07 81920 c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Security.dll
+ 2004-07-14 14:35 . 2004-07-14 14:35 66560 c:\windows\Microsoft.NET\Framework\v1.1.4322\System.EnterpriseServices.Thunk.dll
+ 2003-02-20 21:26 . 2003-02-20 21:26 65536 c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Drawing.Design.dll
+ 2004-07-15 04:28 . 2004-07-15 04:28 90112 c:\windows\Microsoft.NET\Framework\v1.1.4322\System.DirectoryServices.dll
+ 2003-02-20 21:26 . 2003-02-20 21:26 77824 c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Configuration.Install.dll
+ 2003-02-20 21:25 . 2003-02-20 21:25 12288 c:\windows\Microsoft.NET\Framework\v1.1.4322\RegSvcs.exe
+ 2004-07-15 04:28 . 2004-07-15 04:28 32768 c:\windows\Microsoft.NET\Framework\v1.1.4322\RegCode.dll
+ 2003-02-20 21:25 . 2003-02-20 21:25 28672 c:\windows\Microsoft.NET\Framework\v1.1.4322\RegAsm.exe
+ 2004-07-14 14:34 . 2004-07-14 14:34 94208 c:\windows\Microsoft.NET\Framework\v1.1.4322\PerfCounter.dll
+ 2003-02-20 09:09 . 2003-02-20 09:09 73728 c:\windows\Microsoft.NET\Framework\v1.1.4322\ngen.exe
+ 2003-02-20 08:43 . 2003-02-20 08:43 22528 c:\windows\Microsoft.NET\Framework\v1.1.4322\MUI\0409\mscorsecr.dll
+ 2003-02-20 09:18 . 2003-02-20 09:18 20480 c:\windows\Microsoft.NET\Framework\v1.1.4322\mtxoci8.dll
+ 2011-12-24 12:55 . 2011-12-24 12:55 77824 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorsn.dll
+ 2004-07-14 14:33 . 2004-07-14 14:33 81920 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorsec.dll
+ 2003-02-20 09:06 . 2003-02-20 09:06 65536 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorpe.dll
+ 2011-12-24 12:55 . 2011-12-24 12:55 86016 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorie.dll
+ 2004-07-14 14:32 . 2004-07-14 14:32 86016 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscordbc.dll
+ 2004-07-15 04:28 . 2004-07-15 04:28 49152 c:\windows\Microsoft.NET\Framework\v1.1.4322\MigPolWin.exe
+ 2004-07-15 04:28 . 2004-07-15 04:28 49152 c:\windows\Microsoft.NET\Framework\v1.1.4322\MigPol.exe
+ 2003-02-20 21:25 . 2003-02-20 21:25 11264 c:\windows\Microsoft.NET\Framework\v1.1.4322\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
+ 2003-02-20 21:24 . 2003-02-20 21:24 32768 c:\windows\Microsoft.NET\Framework\v1.1.4322\Microsoft.Vsa.dll
+ 2003-02-20 21:24 . 2003-02-20 21:24 28672 c:\windows\Microsoft.NET\Framework\v1.1.4322\Microsoft.VisualBasic.Vsa.dll
+ 2003-02-20 21:24 . 2003-02-20 21:24 40960 c:\windows\Microsoft.NET\Framework\v1.1.4322\jsc.exe
+ 2003-02-20 21:24 . 2003-02-20 21:24 26112 c:\windows\Microsoft.NET\Framework\v1.1.4322\ISymWrapper.dll
+ 2003-02-20 09:22 . 2003-02-20 09:22 40960 c:\windows\Microsoft.NET\Framework\v1.1.4322\InstallUtilLib.dll
+ 2003-02-20 21:24 . 2003-02-20 21:24 15872 c:\windows\Microsoft.NET\Framework\v1.1.4322\InstallUtil.exe
+ 2004-07-15 04:31 . 2004-07-15 04:31 32768 c:\windows\Microsoft.NET\Framework\v1.1.4322\IEHost.dll
+ 2003-10-08 04:30 . 2003-10-08 04:30 81920 c:\windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe
+ 2003-02-20 18:12 . 2003-02-20 18:12 28672 c:\windows\Microsoft.NET\Framework\v1.1.4322\cvtres.exe
+ 2003-02-20 21:24 . 2003-02-20 21:24 33792 c:\windows\Microsoft.NET\Framework\v1.1.4322\CustomMarshalers.dll
+ 2003-02-20 21:24 . 2003-02-20 21:24 12288 c:\windows\Microsoft.NET\Framework\v1.1.4322\cscompmgd.dll
+ 2004-07-15 01:23 . 2004-07-15 01:23 49152 c:\windows\Microsoft.NET\Framework\v1.1.4322\csc.exe
+ 2011-12-24 12:55 . 2011-12-24 12:55 81920 c:\windows\Microsoft.NET\Framework\v1.1.4322\CORPerfMonExt.dll
+ 2003-02-20 21:24 . 2003-02-20 21:24 49152 c:\windows\Microsoft.NET\Framework\v1.1.4322\ConfigWizards.exe
+ 2003-02-20 21:24 . 2003-02-20 21:24 94208 c:\windows\Microsoft.NET\Framework\v1.1.4322\CasPol.exe
+ 2011-12-24 13:49 . 2011-12-24 13:49 32768 c:\windows\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe
+ 2004-07-14 15:49 . 2004-07-14 15:49 32768 c:\windows\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
+ 2004-07-14 15:49 . 2004-07-14 15:49 20480 c:\windows\Microsoft.NET\Framework\v1.1.4322\aspnet_regiis.exe
+ 2003-02-20 09:19 . 2003-02-20 09:19 40960 c:\windows\Microsoft.NET\Framework\v1.1.4322\aspnet_rc.dll
+ 2011-12-24 13:49 . 2011-12-24 13:49 24576 c:\windows\Microsoft.NET\Framework\v1.1.4322\aspnet_filter.dll
+ 2003-02-20 19:00 . 2003-02-20 19:00 98304 c:\windows\Microsoft.NET\Framework\v1.1.4322\alink.dll
+ 2003-02-20 17:55 . 2003-02-20 17:55 94208 c:\windows\Microsoft.NET\Framework\v1.1.4322\1033\cscompui.dll
+ 2003-02-20 16:59 . 2003-02-20 16:59 16896 c:\windows\Microsoft.NET\Framework\v1.1.4322\1033\alinkui.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 13648 c:\windows\Microsoft.NET\Framework\sbscmp20_mscorlib.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 13648 c:\windows\Microsoft.NET\Framework\sbs_wminet_utils.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 13648 c:\windows\Microsoft.NET\Framework\sbs_system.enterpriseservices.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 13648 c:\windows\Microsoft.NET\Framework\sbs_system.data.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 13648 c:\windows\Microsoft.NET\Framework\sbs_system.configuration.install.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 13648 c:\windows\Microsoft.NET\Framework\sbs_mscorsec.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 13648 c:\windows\Microsoft.NET\Framework\sbs_mscorrc.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 13648 c:\windows\Microsoft.NET\Framework\sbs_mscordbi.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 13648 c:\windows\Microsoft.NET\Framework\sbs_microsoft.jscript.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 13648 c:\windows\Microsoft.NET\Framework\sbs_diasymreader.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 87408 c:\windows\Microsoft.NET\assembly\GAC_MSIL\WindowsFormsIntegration\v4.0_4.0.0.0__31bf3856ad364e35\WindowsFormsIntegration.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 93024 c:\windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 35688 c:\windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 17784 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Presentation\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Presentation.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 58240 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Input.Manipulations\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Input.Manipulations.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 44920 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.ApplicationServices\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.ApplicationServices.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 37240 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Channels\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Channels.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 64352 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 51032 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Device\v4.0_4.0.0.0__b77a5c561934e089\System.Device.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 50552 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.DataSetExtensions\v4.0_4.0.0.0__b77a5c561934e089\System.Data.DataSetExtensions.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 81784 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 81800 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\v4.0_4.0.0.0__31bf3856ad364e35\System.ComponentModel.DataAnnotations.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 39784 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.AddIn.Contract\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.AddIn.Contract.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 68952 c:\windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 12128 c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 97680 c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 17240 c:\windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 78168 c:\windows\Microsoft.NET\assembly\GAC_32\ISymWrapper\v4.0_4.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 81248 c:\windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
+ 2012-06-04 17:01 . 2012-06-04 17:01 90112 c:\windows\assembly\NativeImages1_v1.1.4322\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a_abf00fb7\System.Drawing.Design.dll
+ 2012-06-04 17:00 . 2012-06-04 17:00 61440 c:\windows\assembly\NativeImages1_v1.1.4322\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a_0762ae15\CustomMarshalers.dll
+ 2012-06-04 02:36 . 2012-06-04 02:36 96768 c:\windows\assembly\NativeImages_v4.0.30319_32\UIAutomationProvider\4add87007e0864467659e6a248a7fe06\UIAutomationProvider.ni.dll
+ 2012-06-04 02:38 . 2012-06-04 02:38 35328 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Pres#\5172f64c070a65b834e61f5cd6d0e632\System.Windows.Presentation.ni.dll
+ 2012-06-04 02:38 . 2012-06-04 02:38 71680 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Web.Applicat#\64032bf6e0ddb07ec8e374dae9afcd17\System.Web.ApplicationServices.ni.dll
+ 2012-06-04 02:38 . 2012-06-04 02:38 82432 c:\windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\76ba7b2f5232c390b8db9dfcd935af93\System.ServiceModel.Channels.ni.dll
+ 2012-06-04 02:36 . 2012-06-04 02:36 78848 c:\windows\assembly\NativeImages_v4.0.30319_32\System.AddIn.Contra#\a5c37bc9caf315df294f8b680a1ccd6f\System.AddIn.Contract.ni.dll
+ 2012-06-04 02:36 . 2012-06-04 02:36 11776 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualC\5ccc57bb582bf753166610089f204601\Microsoft.VisualC.ni.dll
+ 2012-06-04 02:35 . 2012-06-04 02:35 44544 c:\windows\assembly\NativeImages_v4.0.30319_32\Accessibility\414da765b5d5bb7fde97c0ea22de7d74\Accessibility.ni.dll
+ 2012-06-04 01:53 . 2012-06-04 01:53 57344 c:\windows\assembly\GAC\System.Web.RegularExpressions\1.0.5000.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
+ 2012-06-04 17:00 . 2012-06-04 17:00 81920 c:\windows\assembly\GAC\System.Security\1.0.5000.0__b03f5f7f11d50a3a\System.Security.dll
+ 2012-06-04 01:53 . 2012-06-04 01:53 66560 c:\windows\assembly\GAC\System.EnterpriseServices\1.0.5000.0__b03f5f7f11d50a3a\System.EnterpriseServices.Thunk.dll
+ 2012-06-04 00:54 . 2012-06-04 00:54 65536 c:\windows\assembly\GAC\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
+ 2012-06-04 01:54 . 2012-06-04 01:54 90112 c:\windows\assembly\GAC\System.DirectoryServices\1.0.5000.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
+ 2012-06-04 00:54 . 2012-06-04 00:54 77824 c:\windows\assembly\GAC\System.Configuration.Install\1.0.5000.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
+ 2012-06-04 00:49 . 2012-06-04 00:49 16384 c:\windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\stdole.dll
+ 2012-06-04 01:53 . 2012-06-04 01:53 32768 c:\windows\assembly\GAC\Regcode\1.0.5000.0__b03f5f7f11d50a3a\RegCode.dll
+ 2012-06-04 00:49 . 2012-06-04 00:49 11544 c:\windows\assembly\GAC\Policy.11.0.office\12.0.0.0__71e9bce111e9429c\Policy.11.0.Office.dll
+ 2012-06-04 00:49 . 2012-06-04 00:49 12080 c:\windows\assembly\GAC\Policy.11.0.Microsoft.Vbe.Interop\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Vbe.Interop.dll
+ 2012-06-04 00:49 . 2012-06-04 00:49 12096 c:\windows\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.Word\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.Word.dll
+ 2012-06-04 00:49 . 2012-06-04 00:49 12104 c:\windows\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.SmartTag\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.SmartTag.dll
+ 2012-06-04 00:49 . 2012-06-04 00:49 12104 c:\windows\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.Publisher\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.Publisher.dll
+ 2012-06-04 00:49 . 2012-06-04 00:49 12112 c:\windows\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.PowerPoint\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.PowerPoint.dll
+ 2012-06-04 00:49 . 2012-06-04 00:49 12632 c:\windows\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl.dll
+ 2012-06-04 00:49 . 2012-06-04 00:49 12104 c:\windows\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.Outlook\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.Outlook.dll
+ 2012-06-04 00:49 . 2012-06-04 00:49 12616 c:\windows\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.InfoPath\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.InfoPath.dll
+ 2012-06-04 00:49 . 2012-06-04 00:49 12616 c:\windows\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml.dll
+ 2012-06-04 00:49 . 2012-06-04 00:49 12096 c:\windows\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.Graph\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.Graph.dll
+ 2012-06-04 00:49 . 2012-06-04 00:49 12096 c:\windows\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.Excel\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.Excel.dll
+ 2012-06-04 00:49 . 2012-06-04 00:49 12104 c:\windows\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.Access\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.Access.dll
+ 2012-06-04 00:54 . 2012-06-04 00:54 32768 c:\windows\assembly\GAC\Microsoft.Vsa\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
+ 2012-06-04 00:54 . 2012-06-04 00:54 11264 c:\windows\assembly\GAC\Microsoft.Vsa.Vb.CodeDOMProcessor\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
+ 2012-06-04 00:54 . 2012-06-04 00:54 28672 c:\windows\assembly\GAC\Microsoft.VisualBasic.Vsa\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
+ 2012-06-04 00:49 . 2012-06-04 00:49 64288 c:\windows\assembly\GAC\Microsoft.Vbe.Interop\12.0.0.0__71e9bce111e9429c\Microsoft.Vbe.Interop.dll
+ 2012-06-04 00:49 . 2012-06-04 00:49 13312 c:\windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.stdformat.dll
+ 2012-06-04 00:49 . 2012-06-04 00:49 20280 c:\windows\assembly\GAC\Microsoft.Office.Interop.SmartTag\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.SmartTag.dll
+ 2012-06-04 00:49 . 2012-06-04 00:49 35648 c:\windows\assembly\GAC\Microsoft.Office.Interop.OutlookViewCtl\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.OutlookViewCtl.dll
+ 2012-06-04 00:49 . 2012-06-04 00:49 17208 c:\windows\assembly\GAC\Microsoft.Office.Interop.OneNote\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.OneNote.dll
+ 2012-06-04 00:49 . 2012-06-04 00:49 88896 c:\windows\assembly\GAC\Microsoft.Office.Interop.InfoPath.Xml\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.InfoPath.Xml.dll
+ 2012-06-04 00:49 . 2012-06-04 00:49 80696 c:\windows\assembly\GAC\Microsoft.Office.Interop.Access.Dao\12.0.0.0__71e9bce111e9429c\Microsoft.Office.interop.access.dao.dll
+ 2012-06-04 00:49 . 2012-06-04 00:49 16712 c:\windows\assembly\GAC\Microsoft.Office.InfoPath.Permission\12.0.0.0__71e9bce111e9429c\Microsoft.Office.InfoPath.Permission.dll
+ 2012-06-04 00:54 . 2012-06-04 00:54 26112 c:\windows\assembly\GAC\ISymWrapper\1.0.5000.0__b03f5f7f11d50a3a\ISymWrapper.dll
+ 2012-06-04 00:49 . 2012-06-04 00:49 31560 c:\windows\assembly\GAC\ipdmctrl\11.0.0.0__71e9bce111e9429c\IPDMCTRL.DLL
+ 2012-06-04 01:53 . 2012-06-04 01:53 32768 c:\windows\assembly\GAC\IEHost\1.0.5000.0__b03f5f7f11d50a3a\IEHost.dll
+ 2012-06-04 00:49 . 2012-06-04 00:49 65536 c:\windows\assembly\GAC\dao\10.0.4504.0__31bf3856ad364e35\DAO.DLL
+ 2012-06-04 00:54 . 2012-06-04 00:54 33792 c:\windows\assembly\GAC\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a\CustomMarshalers.dll
+ 2012-06-04 00:54 . 2012-06-04 00:54 12288 c:\windows\assembly\GAC\cscompmgd\7.0.5000.0__b03f5f7f11d50a3a\cscompmgd.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 4096 c:\windows\system32\wmvdmoe2.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 4096 c:\windows\system32\wmvdmod.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 4096 c:\windows\system32\wmsdmoe2.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 4096 c:\windows\system32\wmsdmod.dll
+ 2003-02-20 08:43 . 2003-02-20 08:43 4096 c:\windows\system32\mui\0409\mscoreer.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 4096 c:\windows\system32\MPG4DMOD.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 4096 c:\windows\system32\MP4SDMOD.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 4096 c:\windows\system32\MP43DMOD.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 4096 c:\windows\system32\dllcache\wmvdmoe2.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 4096 c:\windows\system32\dllcache\wmvdmod.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 4096 c:\windows\system32\dllcache\wmsdmoe2.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 4096 c:\windows\system32\dllcache\wmsdmod.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 4096 c:\windows\system32\dllcache\MPG4DMOD.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 4096 c:\windows\system32\dllcache\MP4SDMOD.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 4096 c:\windows\system32\dllcache\MP43DMOD.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 7168 c:\windows\system32\dllcache\asferror.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 7168 c:\windows\system32\asferror.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 8536 c:\windows\Microsoft.NET\NETFXRepair.3082.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 8536 c:\windows\Microsoft.NET\NETFXRepair.3076.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 8536 c:\windows\Microsoft.NET\NETFXRepair.2070.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 8024 c:\windows\Microsoft.NET\NETFXRepair.2052.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 8536 c:\windows\Microsoft.NET\NETFXRepair.1055.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 8536 c:\windows\Microsoft.NET\NETFXRepair.1053.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 9048 c:\windows\Microsoft.NET\NETFXRepair.1049.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 8536 c:\windows\Microsoft.NET\NETFXRepair.1046.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 8536 c:\windows\Microsoft.NET\NETFXRepair.1045.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 8536 c:\windows\Microsoft.NET\NETFXRepair.1044.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 8536 c:\windows\Microsoft.NET\NETFXRepair.1043.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 8536 c:\windows\Microsoft.NET\NETFXRepair.1042.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 8536 c:\windows\Microsoft.NET\NETFXRepair.1041.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 8536 c:\windows\Microsoft.NET\NETFXRepair.1040.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 8536 c:\windows\Microsoft.NET\NETFXRepair.1038.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 8536 c:\windows\Microsoft.NET\NETFXRepair.1037.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 9048 c:\windows\Microsoft.NET\NETFXRepair.1036.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 9048 c:\windows\Microsoft.NET\NETFXRepair.1035.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 8536 c:\windows\Microsoft.NET\NETFXRepair.1033.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 9048 c:\windows\Microsoft.NET\NETFXRepair.1032.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 8536 c:\windows\Microsoft.NET\NETFXRepair.1031.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 8536 c:\windows\Microsoft.NET\NETFXRepair.1030.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 8536 c:\windows\Microsoft.NET\NETFXRepair.1029.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 8024 c:\windows\Microsoft.NET\NETFXRepair.1028.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 8536 c:\windows\Microsoft.NET\NETFXRepair.1025.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 8032 c:\windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelRegUI.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 8040 c:\windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelInstallRC.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 8032 c:\windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelEvents.dll
+ 2003-02-20 09:09 . 2003-02-20 09:09 9216 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscortim.dll
+ 2003-02-20 21:25 . 2003-02-20 21:25 6656 c:\windows\Microsoft.NET\Framework\v1.1.4322\Microsoft_VsaVb.dll
+ 2003-02-20 21:25 . 2003-02-20 21:25 6144 c:\windows\Microsoft.NET\Framework\v1.1.4322\Microsoft.VisualC.Dll
+ 2003-02-20 21:24 . 2003-02-20 21:24 4608 c:\windows\Microsoft.NET\Framework\v1.1.4322\IIEHost.dll
+ 2004-07-15 04:31 . 2004-07-15 04:31 8192 c:\windows\Microsoft.NET\Framework\v1.1.4322\IEExecRemote.dll
+ 2003-02-20 21:24 . 2003-02-20 21:24 7680 c:\windows\Microsoft.NET\Framework\v1.1.4322\IEExec.exe
+ 2003-02-20 21:24 . 2003-02-20 21:24 7680 c:\windows\Microsoft.NET\Framework\v1.1.4322\Accessibility.dll
+ 2012-06-04 02:35 . 2012-06-04 02:35 9728 c:\windows\assembly\NativeImages_v4.0.30319_32\dfsvc\1361a05238cfe45d7da6cb4b367a986c\dfsvc.ni.exe
+ 2012-06-04 00:49 . 2012-06-04 00:49 4096 c:\windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\msdatasrc.dll
+ 2012-06-04 00:54 . 2012-06-04 00:54 6656 c:\windows\assembly\GAC\Microsoft_VsaVb\7.0.5000.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
+ 2012-06-04 00:54 . 2012-06-04 00:54 6144 c:\windows\assembly\GAC\Microsoft.VisualC\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.VisualC.dll
+ 2012-06-04 00:54 . 2012-06-04 00:54 4608 c:\windows\assembly\GAC\IIEHost\1.0.5000.0__b03f5f7f11d50a3a\IIEHost.dll
+ 2012-06-04 01:53 . 2012-06-04 01:53 8192 c:\windows\assembly\GAC\IEExecRemote\1.0.5000.0__b03f5f7f11d50a3a\IEExecRemote.dll
+ 2012-06-04 00:49 . 2012-06-04 00:49 4608 c:\windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\extensibility.dll
+ 2012-06-04 00:54 . 2012-06-04 00:54 7680 c:\windows\assembly\GAC\Accessibility\1.0.5000.0__b03f5f7f11d50a3a\Accessibility.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 109568 c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\System.EnterpriseServices.Wrapper.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 246128 c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\System.EnterpriseServices.dll
+ 2010-04-20 12:36 . 2010-04-20 12:36 653136 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.5025_x-ww_029c6d0b\msvcr90.dll
+ 2010-04-20 12:36 . 2010-04-20 12:36 569680 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.5025_x-ww_029c6d0b\msvcp90.dll
+ 2010-04-20 12:39 . 2010-04-20 12:39 225280 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.5025_x-ww_029c6d0b\msvcm90.dll
+ 2010-04-20 12:36 . 2010-04-20 12:36 159048 c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.5025_x-ww_633c5a7f\atl90.dll
+ 2008-04-14 12:00 . 2009-04-01 13:02 604160 c:\windows\system32\wmspdmod.dll
+ 2008-04-14 12:00 . 2009-07-13 13:43 286208 c:\windows\system32\wmpdxm.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 242688 c:\windows\system32\wmpasf.dll
+ 2008-04-14 12:00 . 2008-06-17 19:03 938496 c:\windows\system32\WMNetmgr.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 157184 c:\windows\system32\wmidx.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 227328 c:\windows\system32\wmerror.dll
+ 2008-04-14 12:00 . 2007-10-27 07:40 222720 c:\windows\system32\wmasf.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 757248 c:\windows\system32\WMADMOD.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 211456 c:\windows\system32\qasf.dll
+ 2008-04-14 12:00 . 2012-06-04 02:00 505856 c:\windows\system32\perfh009.dat
+ 2008-04-14 12:00 . 2006-10-18 11:47 321536 c:\windows\system32\mswmdm.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 771424 c:\windows\system32\msvcr100_clr0400.dll
+ 2008-04-14 12:00 . 2006-12-04 06:21 414720 c:\windows\system32\msscp.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 175616 c:\windows\system32\mspmsp.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 179712 c:\windows\system32\msnetobj.dll
+ 2009-09-23 14:30 . 2009-09-23 14:30 156488 c:\windows\system32\mscorier.dll
+ 2008-04-14 12:00 . 2008-06-17 15:09 100864 c:\windows\system32\logagent.exe
+ 2010-03-18 03:16 . 2010-03-18 03:16 486216 c:\windows\system32\evr.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 991744 c:\windows\system32\drmv2clt.dll
+ 2008-04-14 12:00 . 2009-10-20 16:20 265728 c:\windows\system32\drivers\http.sys
+ 2008-04-14 12:00 . 2009-04-01 13:02 604160 c:\windows\system32\dllcache\wmspdmod.dll
+ 2008-04-14 12:00 . 2009-07-13 13:43 286208 c:\windows\system32\dllcache\wmpdxm.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 242688 c:\windows\system32\dllcache\wmpasf.dll
+ 2008-04-14 12:00 . 2008-06-17 19:03 938496 c:\windows\system32\dllcache\WMNetmgr.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 157184 c:\windows\system32\dllcache\wmidx.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 227328 c:\windows\system32\dllcache\wmerror.dll
+ 2008-04-14 12:00 . 2007-10-27 07:40 222720 c:\windows\system32\dllcache\wmasf.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 757248 c:\windows\system32\dllcache\WMADMOD.dll
+ 2008-04-14 12:00 . 2007-06-26 12:10 317440 c:\windows\system32\dllcache\unregmp2.exe
+ 2008-04-14 12:00 . 2006-10-18 11:47 211456 c:\windows\system32\dllcache\qasf.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 321536 c:\windows\system32\dllcache\mswmdm.dll
+ 2008-04-14 12:00 . 2006-12-04 06:21 414720 c:\windows\system32\dllcache\msscp.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 175616 c:\windows\system32\dllcache\mspmsp.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 179712 c:\windows\system32\dllcache\msnetobj.dll
+ 2010-05-29 07:12 . 2006-10-18 11:47 243712 c:\windows\system32\dllcache\mpvis.dll
+ 2008-04-14 12:00 . 2008-06-17 15:09 100864 c:\windows\system32\dllcache\logagent.exe
+ 2008-04-14 12:00 . 2009-10-20 16:20 265728 c:\windows\system32\dllcache\http.sys
+ 2008-04-14 12:00 . 2006-10-18 11:47 991744 c:\windows\system32\dllcache\drmv2clt.dll
- 2008-04-14 12:00 . 2011-09-28 07:06 599040 c:\windows\system32\dllcache\crypt32.dll
+ 2008-04-14 12:00 . 2012-05-31 13:22 599040 c:\windows\system32\dllcache\crypt32.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 229376 c:\windows\system32\dllcache\cewmdm.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 542720 c:\windows\system32\dllcache\blackbox.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 229376 c:\windows\system32\cewmdm.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 542720 c:\windows\system32\blackbox.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 114520 c:\windows\Microsoft.NET\NETFXRepair.exe
+ 2012-01-19 03:08 . 2012-01-19 03:08 917272 c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\wpftxt_v0400.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 753504 c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
+ 2010-03-18 03:16 . 2010-03-18 03:16 350592 c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\UIAutomationClientsideProviders.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 163168 c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\UIAutomationClient.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 675672 c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\System.Speech.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 334688 c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\System.Printing.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 581464 c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\ReachFramework.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 832856 c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationUI.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 801136 c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationNative_v0400.dll
+ 2011-12-15 03:08 . 2011-12-15 03:08 182056 c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationHost_v0400.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 194424 c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationFramework.Royale.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 478576 c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationFramework.Luna.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 167288 c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationFramework.Classic.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 232304 c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationFramework.Aero.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 807264 c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\NaturalLanguage6.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 138592 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Xml.Linq.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 699224 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Xaml.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 857960 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Web.Services.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 269672 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Transactions.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 113512 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.ServiceProcess.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 129912 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.ServiceModel.Routing.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 390008 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.ServiceModel.Discovery.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 505208 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.ServiceModel.Activities.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 261472 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Security.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 122264 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Runtime.Serialization.Formatters.Soap.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 291184 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Runtime.Remoting.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 349568 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Runtime.DurableInstancing.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 231760 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Net.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 253280 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Messaging.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 134528 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Management.Instrumentation.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 378720 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Management.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 123736 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.IO.Log.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 125816 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.IdentityModel.Selectors.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 392552 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.IdentityModel.dll
+ 2010-03-17 14:51 . 2010-03-17 14:51 109568 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.EnterpriseServices.Wrapper.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 246128 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.EnterpriseServices.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 120152 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Dynamic.dll
+ 2012-01-21 07:40 . 2012-01-21 07:40 616216 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Drawing.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 182144 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.DirectoryServices.Protocols.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 395120 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.DirectoryServices.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 285072 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.DirectoryServices.AccountManagement.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 829280 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Deployment.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 747360 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Data.SqlXml.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 436600 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Data.Services.Client.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 683872 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Data.Linq.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 409448 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.configuration.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 210816 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.ComponentModel.Composition.dll
+ 2011-12-15 03:08 . 2011-12-15 03:08 156440 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.AddIn.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 122248 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Activities.DurableInstancing.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 525704 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Activities.Core.Presentation.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 112976 c:\windows\Microsoft.NET\Framework\v4.0.30319\sysglobl.dll
+ 2011-12-15 03:08 . 2011-12-15 03:08 518400 c:\windows\Microsoft.NET\Framework\v4.0.30319\SOS.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 124240 c:\windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
+ 2009-08-31 10:44 . 2009-08-31 10:44 144416 c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\sqmapi.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16 295248 c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\SetupUi.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16 807256 c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\SetupEngine.dll
+ 2011-12-25 18:39 . 2011-12-25 18:39 192792 c:\windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe
+ 2010-03-18 03:16 . 2010-03-18 03:16 121688 c:\windows\Microsoft.NET\Framework\v4.0.30319\PerfCounter.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 150856 c:\windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
+ 2010-03-18 03:16 . 2010-03-18 03:16 130384 c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
+ 2010-03-18 03:16 . 2010-03-18 03:16 335184 c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 110936 c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsecimpl.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 372048 c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 145752 c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorpehost.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 413008 c:\windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
+ 2011-12-15 03:08 . 2011-12-15 03:08 957200 c:\windows\Microsoft.NET\Framework\v4.0.30319\mscordbi.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 661352 c:\windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.VisualBasic.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 349576 c:\windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.VisualBasic.Compatibility.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 170368 c:\windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Transactions.Bridge.Dtc.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 387960 c:\windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Transactions.Bridge.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 746336 c:\windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.JScript.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 505184 c:\windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.CSharp.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 794464 c:\windows\Microsoft.NET\Framework\v4.0.30319\EventLogMessages.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 688472 c:\windows\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 129880 c:\windows\Microsoft.NET\Framework\v4.0.30319\CORPerfMonExt.dll
+ 2011-12-15 03:08 . 2011-12-15 03:08 386824 c:\windows\Microsoft.NET\Framework\v4.0.30319\clrjit.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 105808 c:\windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
+ 2010-03-18 03:16 . 2010-03-18 03:16 105288 c:\windows\Microsoft.NET\Framework\v4.0.30319\alink.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 139088 c:\windows\Microsoft.NET\Framework\v4.0.30319\AdoNetDiag.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 255304 c:\windows\Microsoft.NET\Framework\v4.0.30319\1033\vbc7ui.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 255896 c:\windows\Microsoft.NET\Framework\v4.0.30319\1033\Microsoft.VisualBasic.Activities.CompilerUI.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 182088 c:\windows\Microsoft.NET\Framework\v4.0.30319\1033\cscui.dll
+ 2004-07-15 01:23 . 2004-07-15 01:23 737280 c:\windows\Microsoft.NET\Framework\v1.1.4322\vbc.exe
+ 2004-07-15 04:31 . 2004-07-15 04:31 573440 c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Web.Services.dll
+ 2004-07-15 04:28 . 2004-07-15 04:28 819200 c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Web.Mobile.dll
+ 2004-07-15 04:28 . 2004-07-15 04:28 126976 c:\windows\Microsoft.NET\Framework\v1.1.4322\System.ServiceProcess.dll
+ 2004-07-15 04:31 . 2004-07-15 04:31 131072 c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Runtime.Serialization.Formatters.Soap.dll
+ 2004-07-15 04:28 . 2004-07-15 04:28 323584 c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Runtime.Remoting.dll
+ 2004-07-15 04:31 . 2004-07-15 04:31 241664 c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Messaging.dll
+ 2004-07-15 04:31 . 2004-07-15 04:31 372736 c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Management.dll
+ 2004-07-15 04:28 . 2004-07-15 04:28 241664 c:\windows\Microsoft.NET\Framework\v1.1.4322\System.EnterpriseServices.dll
+ 2004-07-15 04:28 . 2004-07-15 04:28 466944 c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Drawing.dll
+ 2004-07-15 04:31 . 2004-07-15 04:31 303104 c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Data.OracleClient.dll
+ 2004-07-14 14:35 . 2004-07-14 14:35 319488 c:\windows\Microsoft.NET\Framework\v1.1.4322\SOS.dll
+ 2003-02-20 09:09 . 2003-02-20 09:09 122880 c:\windows\Microsoft.NET\Framework\v1.1.4322\shfusres.dll
+ 2003-02-20 09:09 . 2003-02-20 09:09 253952 c:\windows\Microsoft.NET\Framework\v1.1.4322\shfusion.dll
+ 2004-08-10 06:20 . 2004-08-10 06:20 106496 c:\windows\Microsoft.NET\Framework\v1.1.4322\netfxupdate.exe
+ 2003-02-20 18:42 . 2003-02-20 18:42 348160 c:\windows\Microsoft.NET\Framework\v1.1.4322\msvcr71.dll
+ 2004-07-14 14:33 . 2004-07-14 14:33 143360 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorrc.dll
+ 2003-02-20 08:43 . 2003-02-20 08:43 131072 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscormmc.dll
+ 2011-12-24 12:55 . 2011-12-24 12:55 102400 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorld.dll
+ 2011-12-24 12:53 . 2011-12-24 12:53 315392 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorjit.dll
+ 2004-07-14 14:32 . 2004-07-14 14:32 233472 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscordbi.dll
+ 2004-07-15 04:28 . 2004-07-15 04:28 299008 c:\windows\Microsoft.NET\Framework\v1.1.4322\Microsoft.VisualBasic.dll
+ 2004-07-15 04:28 . 2004-07-15 04:28 720896 c:\windows\Microsoft.NET\Framework\v1.1.4322\Microsoft.JScript.dll
+ 2004-07-14 14:35 . 2004-07-14 14:35 196608 c:\windows\Microsoft.NET\Framework\v1.1.4322\ilasm.exe
+ 2004-07-14 14:24 . 2004-07-14 14:24 282624 c:\windows\Microsoft.NET\Framework\v1.1.4322\fusion.dll
+ 2003-02-20 09:16 . 2003-02-20 09:16 798720 c:\windows\Microsoft.NET\Framework\v1.1.4322\EventLogMessages.dll
+ 2003-02-21 00:21 . 2003-02-21 00:21 524288 c:\windows\Microsoft.NET\Framework\v1.1.4322\diasymreader.dll
+ 2004-07-15 01:23 . 2004-07-15 01:23 626688 c:\windows\Microsoft.NET\Framework\v1.1.4322\cscomp.dll
+ 2002-07-29 01:11 . 2002-07-29 01:11 219136 c:\windows\Microsoft.NET\Framework\v1.1.4322\c_g18030.dll
+ 2011-12-24 13:49 . 2011-12-24 13:49 258048 c:\windows\Microsoft.NET\Framework\v1.1.4322\aspnet_isapi.dll
+ 2003-02-20 19:04 . 2003-02-20 19:04 155648 c:\windows\Microsoft.NET\Framework\v1.1.4322\1033\Vsavb7rtUI.dll
+ 2003-02-20 17:02 . 2003-02-20 17:02 131072 c:\windows\Microsoft.NET\Framework\v1.1.4322\1033\vbc7ui.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 350592 c:\windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationClientsideProviders\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationClientsideProviders.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 163168 c:\windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationClient\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationClient.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 138592 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml.Linq\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.Linq.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 699224 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Xaml\v4.0_4.0.0.0__b77a5c561934e089\System.Xaml.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 857960 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Services\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 675672 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Speech\v4.0_4.0.0.0__31bf3856ad364e35\System.Speech.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 113512 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 129912 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Routing\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Routing.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 390008 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Discovery\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Discovery.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 505208 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Activities\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Activities.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 261472 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 122264 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 291184 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 349568 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.DurableInstancing\v4.0_4.0.0.0__31bf3856ad364e35\System.Runtime.DurableInstancing.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 231760 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Net\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 253280 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Messaging\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 378720 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 134528 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Instrumentation\v4.0_4.0.0.0__b77a5c561934e089\System.Management.Instrumentation.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 123736 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Log\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.IO.Log.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 392552 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 125816 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel.Selectors\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.Selectors.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 120152 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 616216 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 395120 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 182144 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices.Protocols\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 285072 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices.AccountManagement\v4.0_4.0.0.0__b77a5c561934e089\System.DirectoryServices.AccountManagement.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 829280 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 747360 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 436600 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services.Client\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Services.Client.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 683872 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Linq\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Linq.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 409448 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 210816 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.Composition\v4.0_4.0.0.0__b77a5c561934e089\System.ComponentModel.Composition.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 156440 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.AddIn\v4.0_4.0.0.0__b77a5c561934e089\System.AddIn.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 122248 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.DurableInstancing\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.DurableInstancing.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 525704 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.Core.Presentation\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.Core.Presentation.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 112976 c:\windows\Microsoft.NET\assembly\GAC_MSIL\sysglobl\v4.0_4.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 581464 c:\windows\Microsoft.NET\assembly\GAC_MSIL\ReachFramework\v4.0_4.0.0.0__31bf3856ad364e35\ReachFramework.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 832856 c:\windows\Microsoft.NET\assembly\GAC_MSIL\PresentationUI\v4.0_4.0.0.0__31bf3856ad364e35\PresentationUI.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 194424 c:\windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Royale\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.Royale.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 478576 c:\windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Luna\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.Luna.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 167288 c:\windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Classic\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.Classic.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 232304 c:\windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Aero\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.Aero.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 661352 c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 349576 c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 387960 c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 746336 c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 505184 c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 269672 c:\windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 334688 c:\windows\Microsoft.NET\assembly\GAC_32\System.Printing\v4.0_4.0.0.0__31bf3856ad364e35\System.Printing.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 109568 c:\windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 246128 c:\windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 170368 c:\windows\Microsoft.NET\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Dtc.dll
+ 2012-06-04 03:14 . 2012-06-04 03:14 385024 c:\windows\Installer\2a55c7.msi
+ 2012-06-04 00:49 . 2012-06-04 00:49 591872 c:\windows\Installer\19e57db.msi
+ 2012-06-04 00:49 . 2012-06-04 00:49 217864 c:\windows\Installer\{50120000-1105-0000-0000-0000000FF1CE}\misc.exe
+ 2010-03-18 03:16 . 2010-03-18 03:16 915800 c:\windows\Installer\$PatchCache$\Managed\5C1093C35543A0E32A41B090A305076A\4.0.30319\wpftxt_x86.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 181096 c:\windows\Installer\$PatchCache$\Managed\5C1093C35543A0E32A41B090A305076A\4.0.30319\PresentationHostDLL_X86.dll
+ 2008-04-14 12:00 . 2007-06-26 12:10 317440 c:\windows\inf\unregmp2.exe
+ 2009-10-20 16:20 . 2009-10-20 16:20 265728 c:\windows\Driver Cache\i386\http.sys
+ 2012-06-04 17:01 . 2012-06-04 17:01 835584 c:\windows\assembly\NativeImages1_v1.1.4322\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a_b5ffbdeb\System.Drawing.dll
+ 2012-06-04 17:01 . 2012-06-04 17:01 192512 c:\windows\assembly\NativeImages1_v1.1.4322\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a_bc9f7ba0\System.Drawing.Design.dll
+ 2012-06-04 17:01 . 2012-06-04 17:01 118784 c:\windows\assembly\NativeImages1_v1.1.4322\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a_f195705c\CustomMarshalers.dll
+ 2012-06-04 02:38 . 2012-06-04 02:38 253952 c:\windows\assembly\NativeImages_v4.0.30319_32\WindowsFormsIntegra#\08865eb19bdd47a2cb9fb382e3ab4ca9\WindowsFormsIntegration.ni.dll
+ 2012-06-04 02:36 . 2012-06-04 02:36 196096 c:\windows\assembly\NativeImages_v4.0.30319_32\UIAutomationTypes\6823effdbb0434f96511748697349862\UIAutomationTypes.ni.dll
+ 2012-06-04 02:38 . 2012-06-04 02:38 484352 c:\windows\assembly\NativeImages_v4.0.30319_32\UIAutomationClient\067c005d73ef58a2c3b85c1eb1f82468\UIAutomationClient.ni.dll
+ 2012-06-04 02:36 . 2012-06-04 02:36 391680 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Xml.Linq\738d3077763a0ce3ddf9228b5854e26d\System.Xml.Linq.ni.dll
+ 2012-06-04 02:36 . 2012-06-04 02:36 188928 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Inpu#\eaa4a186f9f15fe9e94ce946b603e42e\System.Windows.Input.Manipulations.ni.dll
+ 2012-06-04 02:36 . 2012-06-04 02:36 646656 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Transactions\530e202cb070fa04243f083c48c7723c\System.Transactions.ni.dll
+ 2012-06-04 02:38 . 2012-06-04 02:38 221696 c:\windows\assembly\NativeImages_v4.0.30319_32\System.ServiceProce#\a0c81f698208f3a0e93b054d7ebe7ee6\System.ServiceProcess.ni.dll
+ 2012-06-04 02:38 . 2012-06-04 02:38 365056 c:\windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\c59256d906eb8bf251fdcade8d3e8db8\System.ServiceModel.Routing.ni.dll
+ 2012-06-04 02:01 . 2012-06-04 02:01 729088 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Security\3a852d2bd1860c7e917dd7ae2676c97c\System.Security.ni.dll
+ 2012-06-04 02:36 . 2012-06-04 02:36 311296 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Seri#\1ea68db6df26604de2e14af08dde4adb\System.Runtime.Serialization.Formatters.Soap.ni.dll
+ 2012-06-04 02:36 . 2012-06-04 02:36 762368 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\dbb4966fd679de3336ad5a15e44e1cb2\System.Runtime.Remoting.ni.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 145408 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Numerics\360e9c00572679f437fff0ae719a5886\System.Numerics.ni.dll
+ 2012-06-04 02:37 . 2012-06-04 02:37 652800 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Net\24d2d4150f7c122d6c66cf7574db5b2f\System.Net.ni.dll
+ 2012-06-04 02:37 . 2012-06-04 02:37 626176 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Messaging\e9075140a13aa2ea0756540bdee37137\System.Messaging.ni.dll
+ 2012-06-04 02:37 . 2012-06-04 02:37 395264 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Management.I#\5cb0d92749a57afb6f7fb8220fd5a23d\System.Management.Instrumentation.ni.dll
+ 2012-06-04 02:37 . 2012-06-04 02:37 413696 c:\windows\assembly\NativeImages_v4.0.30319_32\System.IO.Log\ee6b0560b2f6fe2c590144b716767ac9\System.IO.Log.ni.dll
+ 2012-06-04 02:37 . 2012-06-04 02:37 229376 c:\windows\assembly\NativeImages_v4.0.30319_32\System.IdentityMode#\fc5861a7b6a55a0179ec33611a25725c\System.IdentityModel.Selectors.ni.dll
+ 2012-06-04 02:36 . 2012-06-04 02:36 236032 c:\windows\assembly\NativeImages_v4.0.30319_32\System.EnterpriseSe#\56d1e62510421b3721142688b44a581b\System.EnterpriseServices.Wrapper.dll
+ 2012-06-04 02:36 . 2012-06-04 02:36 786944 c:\windows\assembly\NativeImages_v4.0.30319_32\System.EnterpriseSe#\56d1e62510421b3721142688b44a581b\System.EnterpriseServices.ni.dll
+ 2012-06-04 02:01 . 2012-06-04 02:01 377344 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Dynamic\f32323be4d8b7b9b47e3605ee2cfff18\System.Dynamic.ni.dll
+ 2012-06-04 02:37 . 2012-06-04 02:37 468992 c:\windows\assembly\NativeImages_v4.0.30319_32\System.DirectorySer#\c953921036f6785c65d591bf7308cb46\System.DirectoryServices.Protocols.ni.dll
+ 2012-06-04 02:37 . 2012-06-04 02:37 913920 c:\windows\assembly\NativeImages_v4.0.30319_32\System.DirectorySer#\37878191c4d2cea35b7d78b3530f862b\System.DirectoryServices.AccountManagement.ni.dll
+ 2012-06-04 02:37 . 2012-06-04 02:37 112640 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Device\6aaf2213386341b4c3d3b3ad0c6438dd\System.Device.ni.dll
+ 2012-06-04 02:36 . 2012-06-04 02:36 134656 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Data.DataSet#\623f6a322d104b4424aae3a9fb34e13f\System.Data.DataSetExtensions.ni.dll
+ 2012-06-04 02:01 . 2012-06-04 02:01 980480 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\4b1f1878bf47391d09f9e256fde70e4b\System.Configuration.ni.dll
+ 2012-06-04 02:36 . 2012-06-04 02:36 148480 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Configuratio#\93850f026d034279e163228fe629b674\System.Configuration.Install.ni.dll
+ 2012-06-04 02:36 . 2012-06-04 02:36 194048 c:\windows\assembly\NativeImages_v4.0.30319_32\System.ComponentMod#\86c524ba4d7c611933fd831482fc37b2\System.ComponentModel.DataAnnotations.ni.dll
+ 2012-06-04 02:01 . 2012-06-04 02:01 690176 c:\windows\assembly\NativeImages_v4.0.30319_32\System.ComponentMod#\1f22e510d8f22aebc2ad37944ae9e5b4\System.ComponentModel.Composition.ni.dll
+ 2012-06-04 02:36 . 2012-06-04 02:36 624128 c:\windows\assembly\NativeImages_v4.0.30319_32\System.AddIn\847a89aa3ca79dd380995cb43694d6e9\System.AddIn.ni.dll
+ 2012-06-04 02:36 . 2012-06-04 02:36 404992 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Activities.D#\48a515b17e8631c620aa0b293a0eb594\System.Activities.DurableInstancing.ni.dll
+ 2012-06-04 02:35 . 2012-06-04 02:35 317952 c:\windows\assembly\NativeImages_v4.0.30319_32\SMSvcHost\492f2a986cfa8ec67862fc9aef1d0a88\SMSvcHost.ni.exe
+ 2012-06-04 02:36 . 2012-06-04 02:36 142848 c:\windows\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\13a7f21e234d2c7587f7a0b58a17d591\SMDiagnostics.ni.dll
+ 2012-06-04 02:01 . 2012-06-04 02:01 755712 c:\windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\e28fd0201f1e3003f2f6043b491c69b3\PresentationFramework.Luna.ni.dll
+ 2012-06-04 02:01 . 2012-06-04 02:01 387072 c:\windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\ae8a309e2b2ff2df84ad53a60c69d157\PresentationFramework.Royale.ni.dll
+ 2012-06-04 02:01 . 2012-06-04 02:01 309760 c:\windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\53259db9c53023068d56fbfdb75e7f70\PresentationFramework.Classic.ni.dll
+ 2012-06-04 02:01 . 2012-06-04 02:01 595968 c:\windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\124775115f8585454f2f7470b74a7d8d\PresentationFramework.Aero.ni.dll
+ 2012-06-04 02:36 . 2012-06-04 02:36 303104 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\becdc726fc4f3d576f5d466488d784d4\Microsoft.VisualBasic.Compatibility.Data.ni.dll
+ 2012-06-04 02:35 . 2012-06-04 02:35 418816 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Transacti#\7b9889431566039e4eda08930c626d67\Microsoft.Transactions.Bridge.Dtc.ni.dll
+ 2012-06-04 02:35 . 2012-06-04 02:35 194048 c:\windows\assembly\NativeImages_v4.0.30319_32\CustomMarshalers\8f0e78c2aa12e929ecf3b0c912ac8406\CustomMarshalers.ni.dll
+ 2012-06-04 01:53 . 2012-06-04 01:53 573440 c:\windows\assembly\GAC\System.Web.Services\1.0.5000.0__b03f5f7f11d50a3a\System.Web.Services.dll
+ 2012-06-04 01:53 . 2012-06-04 01:53 819200 c:\windows\assembly\GAC\System.Web.Mobile\1.0.5000.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
+ 2012-06-04 01:53 . 2012-06-04 01:53 126976 c:\windows\assembly\GAC\System.ServiceProcess\1.0.5000.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
+ 2012-06-04 01:53 . 2012-06-04 01:53 131072 c:\windows\assembly\GAC\System.Runtime.Serialization.Formatters.Soap\1.0.5000.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
+ 2012-06-04 01:53 . 2012-06-04 01:53 323584 c:\windows\assembly\GAC\System.Runtime.Remoting\1.0.5000.0__b77a5c561934e089\System.Runtime.Remoting.dll
+ 2012-06-04 01:54 . 2012-06-04 01:54 241664 c:\windows\assembly\GAC\System.Messaging\1.0.5000.0__b03f5f7f11d50a3a\System.Messaging.dll
+ 2012-06-04 01:53 . 2012-06-04 01:53 372736 c:\windows\assembly\GAC\System.Management\1.0.5000.0__b03f5f7f11d50a3a\System.Management.dll
+ 2012-06-04 01:53 . 2012-06-04 01:53 241664 c:\windows\assembly\GAC\System.EnterpriseServices\1.0.5000.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
+ 2012-06-04 01:53 . 2012-06-04 01:53 466944 c:\windows\assembly\GAC\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a\System.Drawing.dll
+ 2012-06-04 01:53 . 2012-06-04 01:53 303104 c:\windows\assembly\GAC\System.Data.OracleClient\1.0.5000.0__b77a5c561934e089\System.Data.OracleClient.dll
+ 2012-06-04 00:49 . 2012-06-04 00:49 416544 c:\windows\assembly\GAC\office\12.0.0.0__71e9bce111e9429c\OFFICE.DLL
+ 2012-06-04 00:49 . 2012-06-04 00:49 229376 c:\windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\MSCOMCTL.DLL
+ 2012-06-04 01:53 . 2012-06-04 01:53 299008 c:\windows\assembly\GAC\Microsoft.VisualBasic\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
+ 2012-06-04 00:49 . 2012-06-04 00:49 371496 c:\windows\assembly\GAC\Microsoft.Vbe.Interop.Forms\11.0.0.0__71e9bce111e9429c\Microsoft.Vbe.Interop.Forms.dll
+ 2012-06-04 00:49 . 2012-06-04 00:49 781104 c:\windows\assembly\GAC\Microsoft.Office.Interop.Word\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.Word.dll
+ 2012-06-04 00:49 . 2012-06-04 00:49 232248 c:\windows\assembly\GAC\Microsoft.Office.Interop.Publisher\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.Publisher.dll
+ 2012-06-04 00:49 . 2012-06-04 00:49 248632 c:\windows\assembly\GAC\Microsoft.Office.Interop.PowerPoint\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.PowerPoint.dll
+ 2012-06-04 00:49 . 2012-06-04 00:49 920376 c:\windows\assembly\GAC\Microsoft.Office.Interop.Outlook\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.Outlook.dll
+ 2012-06-04 00:49 . 2012-06-04 00:49 146232 c:\windows\assembly\GAC\Microsoft.Office.Interop.InfoPath\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.InfoPath.dll
+ 2012-06-04 00:49 . 2012-06-04 00:49 404296 c:\windows\assembly\GAC\Microsoft.Office.Interop.InfoPath.SemiTrust\11.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.InfoPath.SemiTrust.dll
+ 2012-06-04 00:49 . 2012-06-04 00:49 150320 c:\windows\assembly\GAC\Microsoft.Office.Interop.Graph\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.Graph.dll
+ 2012-06-04 01:54 . 2012-06-04 01:54 720896 c:\windows\assembly\GAC\Microsoft.JScript\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
+ 2012-06-04 00:49 . 2012-06-04 00:49 110592 c:\windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\adodb.dll
+ 2008-04-14 12:00 . 2010-04-05 18:52 2462720 c:\windows\system32\WMVCore.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 1329152 c:\windows\system32\WMSPDMOE.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 8231936 c:\windows\system32\wmploc.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 1117696 c:\windows\system32\WMADMOE.dll
+ 2008-04-14 12:00 . 2010-04-05 18:52 2462720 c:\windows\system32\dllcache\WMVCore.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 1329152 c:\windows\system32\dllcache\WMSPDMOE.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 8231936 c:\windows\system32\dllcache\wmploc.dll
+ 2008-04-14 12:00 . 2006-10-18 11:47 1117696 c:\windows\system32\dllcache\WMADMOE.dll
+ 2010-05-29 07:12 . 2006-11-01 08:31 1669120 c:\windows\system32\dllcache\setup_wm.exe
+ 2010-03-18 03:16 . 2010-03-18 03:16 1663320 c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll
+ 2012-01-19 03:08 . 2012-01-19 03:08 1369872 c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WindowsBase.dll
+ 2012-01-19 03:08 . 2012-01-19 03:08 6429992 c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationFramework.dll
+ 2012-01-19 03:08 . 2012-01-19 03:08 3790112 c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationCore.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 2650464 c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\NlsLexicons0009.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 4881752 c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\NlsData0009.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 2199880 c:\windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
+ 2010-03-18 03:16 . 2010-03-18 03:16 2207568 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.XML.dll
+ 2011-12-15 03:08 . 2011-12-15 03:08 5029160 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Windows.Forms.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 1711496 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Windows.Forms.DataVisualization.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 6067048 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.ServiceModel.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 1026936 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Runtime.Serialization.dll
+ 2011-12-15 03:08 . 2011-12-15 03:08 3512072 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 4464480 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Data.Entity.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 2970968 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Data.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 1339736 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Core.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 1462648 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Activities.Presentation.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 1199968 c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Activities.dll
+ 2010-03-18 20:26 . 2010-03-18 20:26 1163264 c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\netfx_core_x86.msi
+ 2011-12-15 03:08 . 2011-12-15 03:08 5201168 c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll
+ 2011-12-15 03:08 . 2011-12-15 03:08 1143568 c:\windows\Microsoft.NET\Framework\v4.0.30319\mscordacwks.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 2989456 c:\windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.VisualBasic.Activities.Compiler.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 1972552 c:\windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
+ 2011-12-15 03:08 . 2011-12-15 03:08 6727424 c:\windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
+ 2004-07-14 22:15 . 2004-07-14 22:15 1032192 c:\windows\Microsoft.NET\Framework\v1.1.4322\VsaVb7rt.dll
+ 2004-07-15 04:29 . 2004-07-15 04:29 1339392 c:\windows\Microsoft.NET\Framework\v1.1.4322\System.XML.dll
+ 2011-12-25 01:07 . 2011-12-25 01:07 2064384 c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Windows.Forms.dll
+ 2011-12-25 01:06 . 2011-12-25 01:06 1269760 c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Web.dll
+ 2011-12-25 01:06 . 2011-12-25 01:06 1232896 c:\windows\Microsoft.NET\Framework\v1.1.4322\System.dll
+ 2004-07-15 04:29 . 2004-07-15 04:29 1703936 c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Design.dll
+ 2004-07-15 04:32 . 2004-07-15 04:32 1294336 c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Data.dll
+ 2011-12-24 12:54 . 2011-12-24 12:54 2514944 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
+ 2011-12-24 12:53 . 2011-12-24 12:53 2527232 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll
+ 2011-12-25 01:06 . 2011-12-25 01:06 2142208 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorlib.dll
+ 2003-02-20 21:25 . 2003-02-20 21:25 1564672 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorcfg.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 1369872 c:\windows\Microsoft.NET\assembly\GAC_MSIL\WindowsBase\v4.0_4.0.0.0__31bf3856ad364e35\WindowsBase.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 3512072 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 2207568 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 5029160 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 1711496 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms.DataVisualization\v4.0_4.0.0.0__31bf3856ad364e35\System.Windows.Forms.DataVisualization.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 6067048 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 1026936 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 4464480 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Entity\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Entity.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 1339736 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 1199968 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 1462648 c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.Presentation\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.Presentation.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 6429992 c:\windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 2970968 c:\windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 3790112 c:\windows\Microsoft.NET\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\PresentationCore.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 5201168 c:\windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 2989456 c:\windows\Microsoft.NET\assembly\GAC_32\Microsoft.VisualBasic.Activities.Compiler\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Activities.Compiler.dll
+ 2012-01-19 03:37 . 2012-01-19 03:37 8999936 c:\windows\Installer\3210f7.msp
+ 2012-01-22 00:09 . 2012-01-22 00:09 1700352 c:\windows\Installer\3210ec.msp
+ 2011-12-25 19:06 . 2011-12-25 19:06 5115392 c:\windows\Installer\3210e4.msp
+ 2012-06-04 01:46 . 2012-06-04 01:46 1160192 c:\windows\Installer\2b5bcd.msi
+ 2012-06-04 00:54 . 2012-06-04 00:54 3443712 c:\windows\Installer\1a3371f.msi
+ 2010-03-18 03:16 . 2010-03-18 03:16 1303896 c:\windows\Installer\$PatchCache$\Managed\5C1093C35543A0E32A41B090A305076A\4.0.30319\WindowsBase_x86.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 6346600 c:\windows\Installer\$PatchCache$\Managed\5C1093C35543A0E32A41B090A305076A\4.0.30319\PresentationFramework_x86.dll
+ 2010-03-18 03:16 . 2010-03-18 03:16 3545952 c:\windows\Installer\$PatchCache$\Managed\5C1093C35543A0E32A41B090A305076A\4.0.30319\PresentationCore_x86.dll
+ 2012-06-04 17:01 . 2012-06-04 17:01 4792320 c:\windows\assembly\NativeImages1_v1.1.4322\System\1.0.5000.0__b77a5c561934e089_73847121\System.dll
+ 2012-06-04 17:00 . 2012-06-04 17:00 1966080 c:\windows\assembly\NativeImages1_v1.1.4322\System\1.0.5000.0__b77a5c561934e089_2719db2c\System.dll
+ 2012-06-04 17:01 . 2012-06-04 17:01 5513216 c:\windows\assembly\NativeImages1_v1.1.4322\System.Xml\1.0.5000.0__b77a5c561934e089_dd78d219\System.Xml.dll
+ 2012-06-04 17:01 . 2012-06-04 17:01 2088960 c:\windows\assembly\NativeImages1_v1.1.4322\System.Xml\1.0.5000.0__b77a5c561934e089_d07e1684\System.Xml.dll
+ 2012-06-04 17:01 . 2012-06-04 17:01 7917568 c:\windows\assembly\NativeImages1_v1.1.4322\System.Windows.Forms\1.0.5000.0__b77a5c561934e089_ac33c14d\System.Windows.Forms.dll
+ 2012-06-04 17:01 . 2012-06-04 17:01 3035136 c:\windows\assembly\NativeImages1_v1.1.4322\System.Windows.Forms\1.0.5000.0__b77a5c561934e089_27bc9b66\System.Windows.Forms.dll
+ 2012-06-04 17:01 . 2012-06-04 17:01 2244608 c:\windows\assembly\NativeImages1_v1.1.4322\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a_672cb7cd\System.Drawing.dll
+ 2012-06-04 17:01 . 2012-06-04 17:01 1470464 c:\windows\assembly\NativeImages1_v1.1.4322\System.Design\1.0.5000.0__b03f5f7f11d50a3a_3332e819\System.Design.dll
+ 2012-06-04 17:01 . 2012-06-04 17:01 3395584 c:\windows\assembly\NativeImages1_v1.1.4322\System.Design\1.0.5000.0__b03f5f7f11d50a3a_2ef3dd8b\System.Design.dll
+ 2012-06-04 17:01 . 2012-06-04 17:01 3391488 c:\windows\assembly\NativeImages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_7b4dc3a2\mscorlib.dll
+ 2012-06-04 17:01 . 2012-06-04 17:01 8908800 c:\windows\assembly\NativeImages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_213d0cb2\mscorlib.dll
+ 2012-06-04 02:01 . 2012-06-04 02:01 3856896 c:\windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\1d7cbd715842710ef8a405ad1e1d2aac\WindowsBase.ni.dll
+ 2012-06-04 02:38 . 2012-06-04 02:38 1063424 c:\windows\assembly\NativeImages_v4.0.30319_32\UIAutomationClients#\699b33373dccad550e1c3816dd75c321\UIAutomationClientsideProviders.ni.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 9090560 c:\windows\assembly\NativeImages_v4.0.30319_32\System\5339ecdda252537e37def11dc77c77aa\System.ni.dll
+ 2012-06-04 02:01 . 2012-06-04 02:01 5618176 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Xml\6e70ff4b74bed30aa8751253ed8aee56\System.Xml.ni.dll
+ 2012-06-04 02:36 . 2012-06-04 02:36 1781760 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\adf79290d55b53d72aaedf49dc0ab05c\System.Xaml.ni.dll
+ 2012-06-04 02:38 . 2012-06-04 02:38 4586496 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Form#\287af325d071e82b0a7732b800085855\System.Windows.Forms.DataVisualization.ni.dll
+ 2012-06-04 02:38 . 2012-06-04 02:38 1859584 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Web.Services\393e2a02b90b4e6f17df2f1307190f14\System.Web.Services.ni.dll
+ 2012-06-04 02:38 . 2012-06-04 02:38 2010624 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Speech\55ff552cd61d1c825e65660fa705df81\System.Speech.ni.dll
+ 2012-06-04 02:38 . 2012-06-04 02:38 1128960 c:\windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\cac970090ee40f6eb194fcc66391d99f\System.ServiceModel.Discovery.ni.dll
+ 2012-06-04 02:38 . 2012-06-04 02:38 1387520 c:\windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\49d13cef799a2cbb948f3292a87995fe\System.ServiceModel.Activities.ni.dll
+ 2012-06-04 02:36 . 2012-06-04 02:36 2637312 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Seri#\d0b065445b421ccf5e2beb5eecc45a48\System.Runtime.Serialization.ni.dll
+ 2012-06-04 02:36 . 2012-06-04 02:36 1020928 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Dura#\3434c23fcc8dfcf056d06f0328d2225d\System.Runtime.DurableInstancing.ni.dll
+ 2012-06-04 02:36 . 2012-06-04 02:36 1060864 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Printing\09c9359d9661e4934c20733cc7bcfb2a\System.Printing.ni.dll
+ 2012-06-04 02:37 . 2012-06-04 02:37 1218560 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Management\6a277b0dd5279e1f76d31604b4eeb31f\System.Management.ni.dll
+ 2012-06-04 02:37 . 2012-06-04 02:37 1072128 c:\windows\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\9c5381e06b81e9859210d9164288cd8b\System.IdentityModel.ni.dll
+ 2012-06-04 02:01 . 2012-06-04 02:01 1665536 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\ca3e5d50a488146065d1b15e552e99be\System.Drawing.ni.dll
+ 2012-06-04 02:36 . 2012-06-04 02:36 1172992 c:\windows\assembly\NativeImages_v4.0.30319_32\System.DirectorySer#\2c7bd166899c82a07c0ae33f800166de\System.DirectoryServices.ni.dll
+ 2012-06-04 02:36 . 2012-06-04 02:36 1879040 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Deployment\d52dcaccce74fd1bd0b63ed719b8265f\System.Deployment.ni.dll
+ 2012-06-04 02:01 . 2012-06-04 02:01 6798336 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Data\6100a4d8635f4e12d3ab23545dbc7dcc\System.Data.ni.dll
+ 2012-06-04 02:01 . 2012-06-04 02:01 2545152 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Data.SqlXml\81916491a37ab590ae68cf4e2738d13b\System.Data.SqlXml.ni.dll
+ 2012-06-04 02:37 . 2012-06-04 02:37 1338880 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Data.Service#\cda5338af4bedb3a42d01451e0cc0784\System.Data.Services.Client.ni.dll
+ 2012-06-04 02:01 . 2012-06-04 02:01 2512384 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Data.Linq\a13bba7255b2e85af402b348801761ca\System.Data.Linq.ni.dll
+ 2012-06-04 02:01 . 2012-06-04 02:01 7052800 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Core\0ad566912479454ed9ce37fb09de2715\System.Core.ni.dll
+ 2012-06-04 02:36 . 2012-06-04 02:36 4121088 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Activities\69ed7b4d15e9637e3756f38833a8ae3a\System.Activities.ni.dll
+ 2012-06-04 02:36 . 2012-06-04 02:36 3755008 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Activities.P#\53810b1c60d29affab72da39c99130b4\System.Activities.Presentation.ni.dll
+ 2012-06-04 02:36 . 2012-06-04 02:36 1544192 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Activities.C#\7c94adcec5f00ebe4357fc854e9568d3\System.Activities.Core.Presentation.ni.dll
+ 2012-06-04 02:36 . 2012-06-04 02:36 2904576 c:\windows\assembly\NativeImages_v4.0.30319_32\ReachFramework\13407232969daca5ccd3a77e4f4fcc17\ReachFramework.ni.dll
+ 2012-06-04 02:36 . 2012-06-04 02:36 1641984 c:\windows\assembly\NativeImages_v4.0.30319_32\PresentationUI\5dad9fdce69ecf060156fe9913c4c6b7\PresentationUI.ni.dll
+ 2012-06-04 02:36 . 2012-06-04 02:36 1139712 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\c75c39a45666489f342f035b1603cbfc\Microsoft.VisualBasic.Compatibility.ni.dll
+ 2012-06-04 02:36 . 2012-06-04 02:36 1836544 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\181690540d71290b2c25802750039206\Microsoft.VisualBasic.ni.dll
+ 2012-06-04 02:36 . 2012-06-04 02:36 1172480 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\16becd1736af2b825937882589b46762\Microsoft.VisualBasic.Activities.Compiler.ni.dll
+ 2012-06-04 02:35 . 2012-06-04 02:35 1082368 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Transacti#\5530d1f5441182d07978e24d3c0125de\Microsoft.Transactions.Bridge.ni.dll
+ 2012-06-04 02:37 . 2012-06-04 02:37 2452480 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.JScript\9f600932530e718cc45e80939bcc1966\Microsoft.JScript.ni.dll
+ 2012-06-04 02:01 . 2012-06-04 02:01 1616384 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\c4ed07b3ab497d4b2f60f9935cbf3b08\Microsoft.CSharp.ni.dll
+ 2012-06-04 17:00 . 2012-06-04 17:00 1232896 c:\windows\assembly\GAC\System\1.0.5000.0__b77a5c561934e089\System.dll
+ 2012-06-04 01:53 . 2012-06-04 01:53 1339392 c:\windows\assembly\GAC\System.Xml\1.0.5000.0__b77a5c561934e089\System.XML.dll
+ 2012-06-04 17:00 . 2012-06-04 17:00 2064384 c:\windows\assembly\GAC\System.Windows.Forms\1.0.5000.0__b77a5c561934e089\System.Windows.Forms.dll
+ 2012-06-04 17:00 . 2012-06-04 17:00 1269760 c:\windows\assembly\GAC\System.Web\1.0.5000.0__b03f5f7f11d50a3a\System.Web.dll
+ 2012-06-04 01:53 . 2012-06-04 01:53 1703936 c:\windows\assembly\GAC\System.Design\1.0.5000.0__b03f5f7f11d50a3a\System.Design.dll
+ 2012-06-04 01:53 . 2012-06-04 01:53 1294336 c:\windows\assembly\GAC\System.Data\1.0.5000.0__b77a5c561934e089\System.Data.dll
+ 2012-06-04 00:54 . 2012-06-04 00:54 1564672 c:\windows\assembly\GAC\mscorcfg\1.0.5000.0__b03f5f7f11d50a3a\mscorcfg.dll
+ 2012-06-04 00:49 . 2012-06-04 00:49 1276720 c:\windows\assembly\GAC\Microsoft.Office.Interop.Excel\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.Excel.dll
+ 2012-06-04 00:49 . 2012-06-04 00:49 1612592 c:\windows\assembly\GAC\Microsoft.Office.Interop.Access\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.Access.dll
+ 2012-06-04 00:49 . 2012-06-04 00:49 8007680 c:\windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll
+ 2008-04-14 12:00 . 2010-08-25 13:36 10841088 c:\windows\system32\wmp.dll
+ 2008-04-14 12:00 . 2010-08-25 13:36 10841088 c:\windows\system32\dllcache\wmp.dll
+ 2011-12-26 07:02 . 2011-12-26 07:02 12482048 c:\windows\Microsoft.NET\Framework\v1.1.4322\Updates\M2656353\M2656353Uninstall.msp
+ 2011-12-15 03:40 . 2011-12-15 03:40 23374336 c:\windows\Installer\321109.msp
+ 2012-06-04 01:53 . 2012-06-04 01:53 19210240 c:\windows\Installer\3210dc.msp
+ 2011-12-25 23:02 . 2011-12-25 23:02 19677184 c:\windows\Installer\31e66e6.msp
+ 2012-06-04 02:01 . 2012-06-04 02:01 13196800 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\a8d2bf149a0901997a5b6a46c63ac2d6\System.Windows.Forms.ni.dll
+ 2012-06-04 02:38 . 2012-06-04 02:38 17996800 c:\windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel\8be0d48c6312a96e2ff0fd5bafb70469\System.ServiceModel.ni.dll
+ 2012-06-04 02:37 . 2012-06-04 02:37 13324288 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Data.Entity\4c3b8750cd9b5b61f300275a6dd9ed07\System.Data.Entity.ni.dll
+ 2012-06-04 02:01 . 2012-06-04 02:01 17998848 c:\windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\bc27eeb2155247bd3eb500428aba7db8\PresentationFramework.ni.dll
+ 2012-06-04 02:01 . 2012-06-04 02:01 11451904 c:\windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\aec0265c1f17056fb8e2e4db2c3a2c0f\PresentationCore.ni.dll
+ 2012-06-04 02:00 . 2012-06-04 02:00 14413824 c:\windows\assembly\NativeImages_v4.0.30319_32\mscorlib\1bdf7de454340e0ea9fc455aeaec49d9\mscorlib.ni.dll
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-01-26 15026056]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-09-04 39408]
"ChromeFrameHelper"="c:\documents and settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\19.0.1084.52\chrome_frame_helper.exe" [2012-05-23 96792]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2008-02-13 564496]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2008-02-13 2196240]
"RemoteControl"="c:\program files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2004-11-02 32768]
"InCD"="c:\program files\Ahead\InCD\InCD.exe" [2006-07-12 1397760]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"LGODDFU"="c:\program files\lg_fwupdate\fwupdate.exe" [2011-04-18 557056]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2011-10-24 421888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-03-26 421736]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 931200]
"nwiz"="nwiz.exe" [2008-05-16 1630208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 86016]
"RTHDCPL"="RTHDCPL.EXE" [2007-03-21 16126464]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\Administrator\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
EZ-DUB Finder.lnk - c:\program files\EZ-DUB\EZ-DUB.exe [2005-9-13 266240]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2010-6-13 66864]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-01-02 00:07 843712 —-a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2012-03-27 12:41 37296 —-a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-03 18:43 69632 —-a-w- c:\windows\ALCMTR.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2009-02-26 08:36 30040 —-a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2008-05-16 18:31 13529088 —-a-w- c:\windows\system32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2008-05-16 18:31 86016 —-a-w- c:\windows\system32\nvmctray.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2008-05-16 18:31 1630208 —-a-w- c:\windows\system32\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2007-03-21 14:49 16126464 ——r- c:\windows\RTHDCPL.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
.
R2 TeamViewer7;TeamViewer 7;c:\program files\TeamViewer\Version7\TeamViewer_Service.exe [2/06/2012 12:41 PM 2666880]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;c:\windows\system32\drivers\atl01_xp.sys [29/05/2010 5:46 PM 38656]
S1 MpKsla6bd7df6;MpKsla6bd7df6;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6ACEDAA2-8A27-4631-B140-5CD9D470CB61}\MpKsla6bd7df6.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6ACEDAA2-8A27-4631-B140-5CD9D470CB61}\MpKsla6bd7df6.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18/03/2010 1:16 PM 130384]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [5/09/2011 9:03 AM 136176]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [29/03/2012 9:20 AM 257696]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [5/09/2011 9:03 AM 136176]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [2/06/2012 4:03 PM 129976]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18/03/2010 1:16 PM 753504]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2012-06-05 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-28 23:04]
.
2012-02-09 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 07:57]
.
2012-06-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-09-04 23:03]
.
2012-06-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-09-04 23:03]
.
2012-06-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2052111302-630328440-1801674531-500Core.job
- c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-04-09 21:28]
.
2012-06-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2052111302-630328440-1801674531-500UA.job
- c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-04-09 21:28]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com.au/
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\aau36ssg.default\
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-06-05 10:59
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-2052111302-630328440-1801674531-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,8f,28,6b,98,e7,1f,63,4e,8c,28,f9,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,8f,28,6b,98,e7,1f,63,4e,8c,28,f9,\
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,89,eb,8a,45,49,eb,72,4e,8f,6a,ae,\
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'explorer.exe'(7336)
c:\windows\system32\WININET.dll
c:\documents and settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\19.0.1084.52\chrome_frame_helper.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\MSVCR80.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\program files\Ahead\InCD\InCDsrv.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\windows\system32\RUNDLL32.EXE
c:\windows\system32\nvsvc32.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\windows\system32\SearchIndexer.exe
c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
c:\program files\TeamViewer\Version7\TeamViewer.exe
c:\program files\TeamViewer\Version7\tv_w32.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Common Files\Logishrd\LQCVFX\COCIManager.exe
.
**************************************************************************
.
Completion time: 2012-06-05 11:00:52 - machine was rebooted
ComboFix-quarantined-files.txt 2012-06-05 01:00
ComboFix2.txt 2012-06-03 08:48
.
Pre-Run: 300,575,150,080 bytes free
Post-Run: 300,664,172,544 bytes free
.
- - End Of File - - 075B5E50018CA2A388CB3D1E64E64406
Post #4
Hi,

Please do the following:

Please download Malwarebytes' Anti-Malware
  • Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <– very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



NEXT


Go here to run an online scanner from ESET.
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activeX control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
  • Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
  • Click Scan
  • Wait for the scan to finish
  • When the scan completes, press the LIST OF THREATS FOUND button
  • Press EXPORT TO TEXT FILE , name the file ESETSCAN and save it to your desktop
  • Include the contents of this report in your next reply.
  • Press the BACK button.
  • Press Finish
Post #5
Hi, MalwareBytes scan found no threats. ESET online scanner found 9 threats! Removed 0! C:\Qoobox\Quarantine\C\Documents and Settings\Administrator\Local Settings\Application Data\{0ea2b7aa-da34-e9d1-d7d1-74916529bbed}\n.vir Win32/Sirefef.EV trojan C:\Qoobox\Quarantine\C\Program Files\FunWebProducts\Installr\1.bin\F3EZSETP.DLL.vir Win32/Toolbar.MyWebSearch.M application C:\Qoobox\Quarantine\C\Program Files\FunWebProducts\Installr\1.bin\F3PLUGIN.DLL.vir Win32/Toolbar.MyWebSearch application C:\Qoobox\Quarantine\C\Program Files\FunWebProducts\Installr\1.bin\NPFUNWEB.DLL.vir Win32/Toolbar.MyWebSearch application C:\Qoobox\Quarantine\C\WINDOWS\Installer\{0ea2b7aa-da34-e9d1-d7d1-74916529bbed}\n.vir Win32/Sirefef.EV trojan C:\System Volume Information\_restore{7FBA067D-81E6-43C9-A75D-1E68B3BD4949}\RP3\A0004881.DLL Win32/Toolbar.MyWebSearch.M application C:\System Volume Information\_restore{7FBA067D-81E6-43C9-A75D-1E68B3BD4949}\RP3\A0004882.DLL Win32/Toolbar.MyWebSearch application C:\System Volume Information\_restore{7FBA067D-81E6-43C9-A75D-1E68B3BD4949}\RP3\A0004883.DLL Win32/Toolbar.MyWebSearch application C:\TDSSKiller_Quarantine\05.06.2012_11.24.23\tdlfs0000\tsk0004.dta a variant of Win32/Olmarik.ADZ trojan Here is the Malwarebytes log: Malwarebytes Anti-Malware (Trial) 1.61.0.1400 www.malwarebytes.org Database version: v2012.06.05.02 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 Administrator :: HOME [administrator] Protection: Enabled 5/06/2012 2:45:04 PM mbam-log-2012-06-05 (14-45-04).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 197240 Time elapsed: 3 minute(s), 28 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end)
Post #6
Hi,

Those items found by ESET are already in quarantine or old system restore points which will be removed when we uninstall ComboFix,

please do the following:

Visit ADOBE and download the latest version of Acrobat Reader (version X)
Having the latest updates ensures there are no security vulnerabilities in your system.


NEXT

Go to Start > Control Panel > Add/Remove Programs, scroll down to the Java entries and remove them, now download the latest Java version 7 update 4 from the below link and install it:


http://java.com/en/download/index.jsp


NEXT

Please advise how your computer is running now and if there are any outstanding issues

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI