What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Windows 7 - Had fest0r_ot.exe trojan, removed, but computer still extr

16 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #17
OK thanks. It's just that some programs are being stored in the VirtualStore folder. I will not be able to answer for a while but will get back later. Satchfan
Post #18
Open ComboFix

Please do the following:
  • close any open browsers.
  • close/disable all anti virus and anti malware programs so that they do not interfere with the running of ComboFix.
  • open notepad and copy/paste the text in the codebox below into it:
DirLook::
C:\da13dac87d2d582d8f8a52
C:\f789519418b15c56833cbd00ec41bff4
C:\be5d019b8eb4f4d3ef4690b50adc96
c:\users\Sean\AppData\Local\VirtualStore

Save this as "CFScript.txt", and as Type: All Files (*.*) in the same location as ComboFix.exe

[external image: Posted Image]

Referring to the picture above, drag CFScript into ComboFix.exe

When finished, it produces a log at C:\ComboFix.txt. Post the contents of Combofix.txt in your next reply.

Satchfan
Post #19
Hi Satchfan, Here are my logs. Please advise. Thanks! ComboFix 12-07-27.03 - Sean 29.07.2012 10:45:19.2.4 - x64 NETWORK Microsoft Windows 7 Home Premium 6.1.7601.1.1252.358.1033.18.3894.3000 [GMT 3:00] Sijainti: c:\users\Sean\Desktop\ComboFix.exe Käytetyt komentorivivalitsimet :: c:\users\Sean\Desktop\CFScript.txt AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6} SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Uusi palautuspiste luotu . . ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2012-06-28 to 2012-07-29 ))))))))))))))))) . . 2012-07-29 07:54 . 2012-07-29 07:54 ——– d—–w- c:\windows\system32\config\systemprofile\AppData\Local\temp 2012-07-29 07:54 . 2012-07-29 07:54 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-07-28 12:37 . 2012-06-29 00:04 9133488 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F4B126C8-3C14-4362-B64A-3B67887C5117}\mpengine.dll 2012-07-28 12:20 . 2012-07-28 12:20 ——– d—–w- C:\adbf54e3f93c80dcce5187e4bada 2012-07-27 10:23 . 2012-06-29 00:04 9133488 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2012-07-25 08:10 . 2012-07-25 08:10 ——– d—–w- C:\da13dac87d2d582d8f8a52 2012-07-25 07:47 . 2012-07-25 07:47 ——– d—–w- C:\f789519418b15c56833cbd00ec41bff4 2012-07-25 07:32 . 2012-07-25 07:32 ——– d—–w- C:\be5d019b8eb4f4d3ef4690b50adc96 2012-07-23 09:51 . 2012-07-23 09:51 ——– d—–w- c:\users\Sean\AppData\Roaming\Malwarebytes 2012-07-23 09:50 . 2012-07-23 09:50 ——– d—–w- c:\programdata\Malwarebytes 2012-07-23 09:50 . 2012-07-23 09:50 ——– d—–w- c:\program files (x86)\Malwarebytes' Anti-Malware 2012-07-23 09:50 . 2012-07-03 10:46 24904 —-a-w- c:\windows\system32\drivers\mbam.sys 2012-07-23 06:42 . 2012-07-23 06:41 927800 ——w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{47024564-FB76-449D-ADBD-E793D6C02D50}\gapaengine.dll 2012-07-23 06:40 . 2012-07-23 06:40 ——– d—–w- c:\program files (x86)\Microsoft Security Client 2012-07-23 06:40 . 2012-07-23 06:40 ——– d—–w- c:\program files\Microsoft Security Client 2012-07-23 04:13 . 2012-07-22 09:59 460888 —-a-w- c:\windows\system32\drivers\59957290.sys 2012-07-22 20:11 . 2012-07-22 09:59 460888 —-a-w- c:\windows\system32\drivers\50400911.sys 2012-07-22 18:03 . 2012-07-22 09:59 460888 —-a-w- c:\windows\system32\drivers\24789420.sys 2012-07-22 17:36 . 2012-07-25 08:08 ——– d—–w- c:\users\Sean\AppData\Local\VirtualStore 2012-07-22 10:17 . 2012-07-22 09:59 460888 —-a-w- c:\windows\system32\drivers\08041664.sys 2012-07-22 10:06 . 2012-07-22 10:06 ——– d—–w- c:\programdata\Kaspersky Lab 2012-07-22 07:34 . 2012-07-22 07:34 ——– d—–w- c:\users\Sean\AppData\Roaming\SUPERAntiSpyware.com 2012-07-22 07:33 . 2012-07-24 02:26 ——– d—–w- c:\program files\SUPERAntiSpyware 2012-07-22 07:33 . 2012-07-22 07:33 ——– d—–w- c:\programdata\SUPERAntiSpyware.com 2012-07-21 22:11 . 2012-07-21 22:11 ——– d—–w- c:\programdata\Lavasoft 2012-07-21 22:11 . 2012-07-21 22:11 ——– d—–w- c:\program files (x86)\Ad-Aware Antivirus 2012-07-21 22:10 . 2012-07-21 22:10 ——– d—–w- c:\users\Sean\AppData\Roaming\Ad-Aware Antivirus 2012-07-21 11:58 . 2012-07-29 07:56 ——– d—–w- c:\windows\system32\wbem\repository 2012-07-12 07:04 . 2012-06-12 03:08 3148800 —-a-w- c:\windows\system32\win32k.sys 2012-07-11 07:45 . 2012-06-06 06:06 2004480 —-a-w- c:\windows\system32\msxml6.dll 2012-07-11 07:45 . 2012-06-06 06:06 1881600 —-a-w- c:\windows\system32\msxml3.dll 2012-07-11 07:45 . 2012-06-06 05:05 1390080 —-a-w- c:\windows\SysWow64\msxml6.dll 2012-07-11 07:45 . 2012-06-06 05:05 1236992 —-a-w- c:\windows\SysWow64\msxml3.dll 2012-07-11 07:45 . 2010-06-26 03:55 2048 —-a-w- c:\windows\system32\msxml3r.dll 2012-07-11 07:45 . 2010-06-26 03:24 2048 —-a-w- c:\windows\SysWow64\msxml3r.dll 2012-07-10 21:03 . 2012-07-10 21:03 ——– d—–w- c:\users\Sean\AppData\Roaming\PDAppFlex 2012-07-09 22:52 . 2012-07-09 22:52 ——– d—–w- c:\programdata\regid.1986-12.com.adobe 2012-07-09 22:23 . 2012-07-09 22:23 ——– d—–w- c:\users\Sean\New folder (3) 2012-07-09 22:22 . 2012-07-09 22:22 ——– d—–w- c:\users\Sean\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant 2012-07-09 22:22 . 2012-07-09 22:22 ——– d—–w- c:\program files (x86)\Adobe Download Assistant 2012-07-07 15:45 . 2012-07-07 15:46 ——– d—–w- c:\program files\iTunes 2012-07-07 15:45 . 2012-07-07 15:46 ——– d—–w- c:\program files (x86)\iTunes 2012-07-07 15:45 . 2012-07-07 15:45 ——– d—–w- c:\program files\iPod 2012-07-06 19:06 . 2012-07-06 19:06 ——– d—–w- c:\program files (x86)\Common Files\Canon . . . (((((((((((((((((((((((((((((((((((( Find3M-raportti )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-07-12 09:06 . 2012-04-03 16:19 426184 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-07-12 09:06 . 2011-05-16 07:56 70344 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-07-12 06:53 . 2011-05-01 07:24 59701280 —-a-w- c:\windows\system32\MRT.exe 2012-06-02 22:19 . 2012-06-24 13:45 38424 —-a-w- c:\windows\system32\wups.dll 2012-06-02 22:19 . 2012-06-24 13:45 2428952 —-a-w- c:\windows\system32\wuaueng.dll 2012-06-02 22:19 . 2012-06-24 13:45 57880 —-a-w- c:\windows\system32\wuauclt.exe 2012-06-02 22:19 . 2012-06-24 13:45 44056 —-a-w- c:\windows\system32\wups2.dll 2012-06-02 22:19 . 2012-06-24 13:45 701976 —-a-w- c:\windows\system32\wuapi.dll 2012-06-02 22:15 . 2012-06-24 13:45 2622464 —-a-w- c:\windows\system32\wucltux.dll 2012-06-02 22:15 . 2012-06-24 13:45 99840 —-a-w- c:\windows\system32\wudriver.dll 2012-06-02 12:19 . 2012-06-24 13:44 186752 —-a-w- c:\windows\system32\wuwebv.dll 2012-06-02 12:15 . 2012-06-24 13:44 36864 —-a-w- c:\windows\system32\wuapp.exe 2012-05-31 16:11 . 2012-05-31 16:11 163048 —-a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10141.bin 2012-05-29 19:19 . 2011-03-28 15:36 19736 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll 2012-05-04 11:06 . 2012-06-12 22:20 5559664 —-a-w- c:\windows\system32\ntoskrnl.exe 2012-05-04 10:03 . 2012-06-12 22:20 3968368 —-a-w- c:\windows\SysWow64\ntkrnlpa.exe 2012-05-04 10:03 . 2012-06-12 22:20 3913072 —-a-w- c:\windows\SysWow64\ntoskrnl.exe 2012-05-01 05:40 . 2012-06-12 22:20 209920 —-a-w- c:\windows\system32\profsvc.dll . . (((((((((((((((((((((((((((((((((((((((((((( Look ))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . —- Directory of C:\be5d019b8eb4f4d3ef4690b50adc96 —- . 2012-07-25 07:32 . 2012-07-25 07:32 788 —ha-w- c:\be5d019b8eb4f4d3ef4690b50adc96\$shtdwn$.req 2011-11-21 21:49 . 2011-11-21 21:49 36530 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1046\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 37394 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1049\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 36014 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1053\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 36274 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1055\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 28414 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\2052\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 37332 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\2070\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 37096 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\3082\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 33028 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1037\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 37692 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1038\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 37048 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1040\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 31424 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1041\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 30504 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1042\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 36850 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1043\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 36546 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1044\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 37132 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1045\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 28422 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1028\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 36716 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1029\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 36020 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1030\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 37858 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1031\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 38668 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1032\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 36066 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1035\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 37676 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1036\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 28422 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\3076\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 34118 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1025\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 29210 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\ParameterInfo.xml 2011-11-21 21:49 . 2011-11-21 21:49 35802 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1033\LocalizedData.xml 2011-11-21 21:42 . 2011-11-21 21:42 33189888 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\NDP40-KB2600217.msp 2011-11-21 20:13 . 2011-11-21 20:13 3628 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\header.bmp 2011-11-21 20:13 . 2011-11-21 20:13 196662 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\SplashScreen.bmp 2011-11-21 20:13 . 2011-11-21 20:13 13606 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\Strings.xml 2011-11-21 20:13 . 2011-11-21 20:13 36180 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\UiInfo.xml 2011-11-21 20:13 . 2011-11-21 20:13 104072 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\watermark.bmp 2011-11-21 20:13 . 2011-11-21 20:13 123035 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1025\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 128333 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1028\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 101146 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1029\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 109464 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1030\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 91719 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1031\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 102048 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1032\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 138595 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1033\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 111176 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1035\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 133172 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1036\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 125351 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1037\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 110879 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1038\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 124974 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1040\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 111958 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1041\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 149503 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1042\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 35285 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1043\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 36083 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1044\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 126541 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1045\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 109574 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1046\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 49319 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1049\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 125073 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1053\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 112947 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1055\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 110754 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\2052\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 125196 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\2070\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 2060 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\3076\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 108174 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\3082\eula.rtf 2011-11-21 18:20 . 2011-11-21 18:20 19224 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\3082\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 14616 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\2052\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 19224 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\2070\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 18200 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1053\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 18200 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1055\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 19224 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1049\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 18712 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1045\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 18712 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1046\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 19736 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1043\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 18200 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1044\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 15640 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1042\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 18712 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1040\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 16152 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1041\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 17176 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1037\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 19224 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1038\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 19224 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1036\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 17688 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1033\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 18712 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1035\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 19736 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1032\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 19224 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1031\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 18712 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1030\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 18712 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1029\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 14616 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1028\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 14616 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\3076\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 296712 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\SetupUi.dll 2011-11-21 18:20 . 2011-11-21 18:20 17688 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\1025\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 810256 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\SetupEngine.dll 2011-11-21 18:19 . 2011-11-21 18:19 79112 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\Setup.exe 2011-11-21 18:02 . 2011-11-21 18:02 16118 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\DHtmlHeader.html 2011-11-21 18:02 . 2011-11-21 18:02 30120 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\SetupUi.xsd 2011-11-21 18:02 . 2011-11-21 18:02 196416 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\sqmapi.dll 2011-11-21 11:41 . 2011-11-21 11:41 97048 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\SetupUtility.exe 2011-11-21 10:19 . 2011-11-21 10:19 1150 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\Graphics\Print.ico 2011-11-21 10:19 . 2011-11-21 10:19 894 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\Graphics\Rotate1.ico 2011-11-21 10:19 . 2011-11-21 10:19 894 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\Graphics\Rotate2.ico 2011-11-21 10:19 . 2011-11-21 10:19 894 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\Graphics\Rotate3.ico 2011-11-21 10:19 . 2011-11-21 10:19 894 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\Graphics\Rotate4.ico 2011-11-21 10:19 . 2011-11-21 10:19 894 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\Graphics\Rotate5.ico 2011-11-21 10:19 . 2011-11-21 10:19 894 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\Graphics\Rotate6.ico 2011-11-21 10:19 . 2011-11-21 10:19 894 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\Graphics\Rotate7.ico 2011-11-21 10:19 . 2011-11-21 10:19 894 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\Graphics\Rotate8.ico 2011-11-21 10:19 . 2011-11-21 10:19 1150 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\Graphics\Save.ico 2011-11-21 10:19 . 2011-11-21 10:19 36710 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\Graphics\Setup.ico 2011-11-21 10:19 . 2011-11-21 10:19 10134 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\Graphics\stop.ico 2011-11-21 10:19 . 2011-11-21 10:19 1150 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\Graphics\SysReqMet.ico 2011-11-21 10:19 . 2011-11-21 10:19 1150 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\Graphics\SysReqNotMet.ico 2011-11-21 10:19 . 2011-11-21 10:19 10134 —-a-w- c:\be5d019b8eb4f4d3ef4690b50adc96\Graphics\warn.ico . —- Directory of C:\da13dac87d2d582d8f8a52 —- . 2012-07-25 08:10 . 2012-07-25 08:10 788 —ha-w- c:\da13dac87d2d582d8f8a52\$shtdwn$.req 2011-11-21 21:49 . 2011-11-21 21:49 36530 —-a-w- c:\da13dac87d2d582d8f8a52\1046\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 37394 —-a-w- c:\da13dac87d2d582d8f8a52\1049\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 36014 —-a-w- c:\da13dac87d2d582d8f8a52\1053\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 36274 —-a-w- c:\da13dac87d2d582d8f8a52\1055\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 28414 —-a-w- c:\da13dac87d2d582d8f8a52\2052\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 37332 —-a-w- c:\da13dac87d2d582d8f8a52\2070\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 37096 —-a-w- c:\da13dac87d2d582d8f8a52\3082\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 33028 —-a-w- c:\da13dac87d2d582d8f8a52\1037\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 37692 —-a-w- c:\da13dac87d2d582d8f8a52\1038\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 37048 —-a-w- c:\da13dac87d2d582d8f8a52\1040\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 31424 —-a-w- c:\da13dac87d2d582d8f8a52\1041\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 30504 —-a-w- c:\da13dac87d2d582d8f8a52\1042\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 36850 —-a-w- c:\da13dac87d2d582d8f8a52\1043\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 36546 —-a-w- c:\da13dac87d2d582d8f8a52\1044\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 37132 —-a-w- c:\da13dac87d2d582d8f8a52\1045\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 28422 —-a-w- c:\da13dac87d2d582d8f8a52\1028\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 36716 —-a-w- c:\da13dac87d2d582d8f8a52\1029\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 36020 —-a-w- c:\da13dac87d2d582d8f8a52\1030\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 37858 —-a-w- c:\da13dac87d2d582d8f8a52\1031\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 38668 —-a-w- c:\da13dac87d2d582d8f8a52\1032\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 36066 —-a-w- c:\da13dac87d2d582d8f8a52\1035\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 37676 —-a-w- c:\da13dac87d2d582d8f8a52\1036\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 28422 —-a-w- c:\da13dac87d2d582d8f8a52\3076\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 34118 —-a-w- c:\da13dac87d2d582d8f8a52\1025\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 29210 —-a-w- c:\da13dac87d2d582d8f8a52\ParameterInfo.xml 2011-11-21 21:49 . 2011-11-21 21:49 35802 —-a-w- c:\da13dac87d2d582d8f8a52\1033\LocalizedData.xml 2011-11-21 21:42 . 2011-11-21 21:42 33189888 —-a-w- c:\da13dac87d2d582d8f8a52\NDP40-KB2600217.msp 2011-11-21 20:13 . 2011-11-21 20:13 3628 —-a-w- c:\da13dac87d2d582d8f8a52\header.bmp 2011-11-21 20:13 . 2011-11-21 20:13 196662 —-a-w- c:\da13dac87d2d582d8f8a52\SplashScreen.bmp 2011-11-21 20:13 . 2011-11-21 20:13 13606 —-a-w- c:\da13dac87d2d582d8f8a52\Strings.xml 2011-11-21 20:13 . 2011-11-21 20:13 36180 —-a-w- c:\da13dac87d2d582d8f8a52\UiInfo.xml 2011-11-21 20:13 . 2011-11-21 20:13 104072 —-a-w- c:\da13dac87d2d582d8f8a52\watermark.bmp 2011-11-21 20:13 . 2011-11-21 20:13 123035 —-a-w- c:\da13dac87d2d582d8f8a52\1025\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 128333 —-a-w- c:\da13dac87d2d582d8f8a52\1028\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 101146 —-a-w- c:\da13dac87d2d582d8f8a52\1029\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 109464 —-a-w- c:\da13dac87d2d582d8f8a52\1030\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 91719 —-a-w- c:\da13dac87d2d582d8f8a52\1031\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 102048 —-a-w- c:\da13dac87d2d582d8f8a52\1032\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 138595 —-a-w- c:\da13dac87d2d582d8f8a52\1033\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 111176 —-a-w- c:\da13dac87d2d582d8f8a52\1035\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 133172 —-a-w- c:\da13dac87d2d582d8f8a52\1036\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 125351 —-a-w- c:\da13dac87d2d582d8f8a52\1037\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 110879 —-a-w- c:\da13dac87d2d582d8f8a52\1038\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 124974 —-a-w- c:\da13dac87d2d582d8f8a52\1040\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 111958 —-a-w- c:\da13dac87d2d582d8f8a52\1041\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 149503 —-a-w- c:\da13dac87d2d582d8f8a52\1042\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 35285 —-a-w- c:\da13dac87d2d582d8f8a52\1043\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 36083 —-a-w- c:\da13dac87d2d582d8f8a52\1044\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 126541 —-a-w- c:\da13dac87d2d582d8f8a52\1045\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 109574 —-a-w- c:\da13dac87d2d582d8f8a52\1046\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 49319 —-a-w- c:\da13dac87d2d582d8f8a52\1049\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 125073 —-a-w- c:\da13dac87d2d582d8f8a52\1053\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 112947 —-a-w- c:\da13dac87d2d582d8f8a52\1055\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 110754 —-a-w- c:\da13dac87d2d582d8f8a52\2052\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 125196 —-a-w- c:\da13dac87d2d582d8f8a52\2070\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 2060 —-a-w- c:\da13dac87d2d582d8f8a52\3076\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 108174 —-a-w- c:\da13dac87d2d582d8f8a52\3082\eula.rtf 2011-11-21 18:20 . 2011-11-21 18:20 19224 —-a-w- c:\da13dac87d2d582d8f8a52\3082\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 14616 —-a-w- c:\da13dac87d2d582d8f8a52\2052\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 19224 —-a-w- c:\da13dac87d2d582d8f8a52\2070\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 18200 —-a-w- c:\da13dac87d2d582d8f8a52\1053\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 18200 —-a-w- c:\da13dac87d2d582d8f8a52\1055\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 19224 —-a-w- c:\da13dac87d2d582d8f8a52\1049\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 18712 —-a-w- c:\da13dac87d2d582d8f8a52\1045\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 18712 —-a-w- c:\da13dac87d2d582d8f8a52\1046\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 19736 —-a-w- c:\da13dac87d2d582d8f8a52\1043\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 18200 —-a-w- c:\da13dac87d2d582d8f8a52\1044\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 15640 —-a-w- c:\da13dac87d2d582d8f8a52\1042\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 18712 —-a-w- c:\da13dac87d2d582d8f8a52\1040\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 16152 —-a-w- c:\da13dac87d2d582d8f8a52\1041\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 17176 —-a-w- c:\da13dac87d2d582d8f8a52\1037\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 19224 —-a-w- c:\da13dac87d2d582d8f8a52\1038\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 19224 —-a-w- c:\da13dac87d2d582d8f8a52\1036\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 17688 —-a-w- c:\da13dac87d2d582d8f8a52\1033\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 18712 —-a-w- c:\da13dac87d2d582d8f8a52\1035\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 19736 —-a-w- c:\da13dac87d2d582d8f8a52\1032\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 19224 —-a-w- c:\da13dac87d2d582d8f8a52\1031\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 18712 —-a-w- c:\da13dac87d2d582d8f8a52\1030\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 18712 —-a-w- c:\da13dac87d2d582d8f8a52\1029\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 14616 —-a-w- c:\da13dac87d2d582d8f8a52\1028\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 14616 —-a-w- c:\da13dac87d2d582d8f8a52\3076\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 296712 —-a-w- c:\da13dac87d2d582d8f8a52\SetupUi.dll 2011-11-21 18:20 . 2011-11-21 18:20 17688 —-a-w- c:\da13dac87d2d582d8f8a52\1025\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 810256 —-a-w- c:\da13dac87d2d582d8f8a52\SetupEngine.dll 2011-11-21 18:19 . 2011-11-21 18:19 79112 —-a-w- c:\da13dac87d2d582d8f8a52\Setup.exe 2011-11-21 18:02 . 2011-11-21 18:02 16118 —-a-w- c:\da13dac87d2d582d8f8a52\DHtmlHeader.html 2011-11-21 18:02 . 2011-11-21 18:02 30120 —-a-w- c:\da13dac87d2d582d8f8a52\SetupUi.xsd 2011-11-21 18:02 . 2011-11-21 18:02 196416 —-a-w- c:\da13dac87d2d582d8f8a52\sqmapi.dll 2011-11-21 11:41 . 2011-11-21 11:41 97048 —-a-w- c:\da13dac87d2d582d8f8a52\SetupUtility.exe 2011-11-21 10:19 . 2011-11-21 10:19 1150 —-a-w- c:\da13dac87d2d582d8f8a52\Graphics\Print.ico 2011-11-21 10:19 . 2011-11-21 10:19 894 —-a-w- c:\da13dac87d2d582d8f8a52\Graphics\Rotate1.ico 2011-11-21 10:19 . 2011-11-21 10:19 894 —-a-w- c:\da13dac87d2d582d8f8a52\Graphics\Rotate2.ico 2011-11-21 10:19 . 2011-11-21 10:19 894 —-a-w- c:\da13dac87d2d582d8f8a52\Graphics\Rotate3.ico 2011-11-21 10:19 . 2011-11-21 10:19 894 —-a-w- c:\da13dac87d2d582d8f8a52\Graphics\Rotate4.ico 2011-11-21 10:19 . 2011-11-21 10:19 894 —-a-w- c:\da13dac87d2d582d8f8a52\Graphics\Rotate5.ico 2011-11-21 10:19 . 2011-11-21 10:19 894 —-a-w- c:\da13dac87d2d582d8f8a52\Graphics\Rotate6.ico 2011-11-21 10:19 . 2011-11-21 10:19 894 —-a-w- c:\da13dac87d2d582d8f8a52\Graphics\Rotate7.ico 2011-11-21 10:19 . 2011-11-21 10:19 894 —-a-w- c:\da13dac87d2d582d8f8a52\Graphics\Rotate8.ico 2011-11-21 10:19 . 2011-11-21 10:19 1150 —-a-w- c:\da13dac87d2d582d8f8a52\Graphics\Save.ico 2011-11-21 10:19 . 2011-11-21 10:19 36710 —-a-w- c:\da13dac87d2d582d8f8a52\Graphics\Setup.ico 2011-11-21 10:19 . 2011-11-21 10:19 10134 —-a-w- c:\da13dac87d2d582d8f8a52\Graphics\stop.ico 2011-11-21 10:19 . 2011-11-21 10:19 1150 —-a-w- c:\da13dac87d2d582d8f8a52\Graphics\SysReqMet.ico 2011-11-21 10:19 . 2011-11-21 10:19 1150 —-a-w- c:\da13dac87d2d582d8f8a52\Graphics\SysReqNotMet.ico 2011-11-21 10:19 . 2011-11-21 10:19 10134 —-a-w- c:\da13dac87d2d582d8f8a52\Graphics\warn.ico . —- Directory of C:\f789519418b15c56833cbd00ec41bff4 —- . 2012-07-25 07:47 . 2012-07-25 07:47 788 —ha-w- c:\f789519418b15c56833cbd00ec41bff4\$shtdwn$.req 2011-11-21 21:49 . 2011-11-21 21:49 36530 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1046\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 37394 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1049\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 36014 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1053\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 36274 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1055\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 28414 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\2052\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 37332 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\2070\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 37096 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\3082\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 33028 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1037\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 37692 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1038\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 37048 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1040\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 31424 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1041\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 30504 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1042\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 36850 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1043\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 36546 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1044\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 37132 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1045\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 28422 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1028\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 36716 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1029\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 36020 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1030\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 37858 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1031\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 38668 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1032\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 36066 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1035\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 37676 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1036\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 28422 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\3076\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 34118 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1025\LocalizedData.xml 2011-11-21 21:49 . 2011-11-21 21:49 29210 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\ParameterInfo.xml 2011-11-21 21:49 . 2011-11-21 21:49 35802 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1033\LocalizedData.xml 2011-11-21 21:42 . 2011-11-21 21:42 33189888 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\NDP40-KB2600217.msp 2011-11-21 20:13 . 2011-11-21 20:13 3628 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\header.bmp 2011-11-21 20:13 . 2011-11-21 20:13 196662 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\SplashScreen.bmp 2011-11-21 20:13 . 2011-11-21 20:13 13606 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\Strings.xml 2011-11-21 20:13 . 2011-11-21 20:13 36180 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\UiInfo.xml 2011-11-21 20:13 . 2011-11-21 20:13 104072 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\watermark.bmp 2011-11-21 20:13 . 2011-11-21 20:13 123035 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1025\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 128333 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1028\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 101146 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1029\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 109464 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1030\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 91719 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1031\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 102048 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1032\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 138595 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1033\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 111176 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1035\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 133172 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1036\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 125351 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1037\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 110879 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1038\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 124974 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1040\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 111958 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1041\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 149503 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1042\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 35285 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1043\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 36083 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1044\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 126541 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1045\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 109574 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1046\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 49319 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1049\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 125073 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1053\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 112947 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1055\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 110754 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\2052\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 125196 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\2070\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 2060 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\3076\eula.rtf 2011-11-21 20:13 . 2011-11-21 20:13 108174 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\3082\eula.rtf 2011-11-21 18:20 . 2011-11-21 18:20 19224 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\3082\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 14616 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\2052\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 19224 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\2070\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 18200 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1053\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 18200 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1055\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 19224 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1049\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 18712 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1045\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 18712 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1046\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 19736 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1043\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 18200 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1044\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 15640 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1042\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 18712 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1040\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 16152 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1041\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 17176 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1037\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 19224 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1038\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 19224 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1036\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 17688 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1033\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 18712 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1035\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 19736 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1032\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 19224 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1031\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 18712 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1030\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 18712 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1029\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 14616 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1028\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 14616 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\3076\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 296712 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\SetupUi.dll 2011-11-21 18:20 . 2011-11-21 18:20 17688 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\1025\SetupResources.dll 2011-11-21 18:20 . 2011-11-21 18:20 810256 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\SetupEngine.dll 2011-11-21 18:19 . 2011-11-21 18:19 79112 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\Setup.exe 2011-11-21 18:02 . 2011-11-21 18:02 16118 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\DHtmlHeader.html 2011-11-21 18:02 . 2011-11-21 18:02 30120 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\SetupUi.xsd 2011-11-21 18:02 . 2011-11-21 18:02 196416 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\sqmapi.dll 2011-11-21 11:41 . 2011-11-21 11:41 97048 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\SetupUtility.exe 2011-11-21 10:19 . 2011-11-21 10:19 1150 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\Graphics\Print.ico 2011-11-21 10:19 . 2011-11-21 10:19 894 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\Graphics\Rotate1.ico 2011-11-21 10:19 . 2011-11-21 10:19 894 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\Graphics\Rotate2.ico 2011-11-21 10:19 . 2011-11-21 10:19 894 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\Graphics\Rotate3.ico 2011-11-21 10:19 . 2011-11-21 10:19 894 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\Graphics\Rotate4.ico 2011-11-21 10:19 . 2011-11-21 10:19 894 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\Graphics\Rotate5.ico 2011-11-21 10:19 . 2011-11-21 10:19 894 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\Graphics\Rotate6.ico 2011-11-21 10:19 . 2011-11-21 10:19 894 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\Graphics\Rotate7.ico 2011-11-21 10:19 . 2011-11-21 10:19 894 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\Graphics\Rotate8.ico 2011-11-21 10:19 . 2011-11-21 10:19 1150 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\Graphics\Save.ico 2011-11-21 10:19 . 2011-11-21 10:19 36710 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\Graphics\Setup.ico 2011-11-21 10:19 . 2011-11-21 10:19 10134 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\Graphics\stop.ico 2011-11-21 10:19 . 2011-11-21 10:19 1150 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\Graphics\SysReqMet.ico 2011-11-21 10:19 . 2011-11-21 10:19 1150 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\Graphics\SysReqNotMet.ico 2011-11-21 10:19 . 2011-11-21 10:19 10134 —-a-w- c:\f789519418b15c56833cbd00ec41bff4\Graphics\warn.ico . —- Directory of c:\users\Sean\AppData\Local\VirtualStore —- . 2009-07-14 02:34 . 2009-06-10 21:08 219 ——w- c:\users\Sean\AppData\Local\VirtualStore\Windows\system.ini 2009-07-14 02:34 . 2012-04-11 03:47 478 ——w- c:\users\Sean\AppData\Local\VirtualStore\Windows\win.ini . . ((((((((((((((((((((((((((((( SnapShot@2012-07-28_12.10.04 ))))))))))))))))))))))))))))))))))))))))) . + 2010-07-20 21:53 . 2012-07-29 07:58 60030 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin + 2009-07-14 05:10 . 2012-07-29 07:58 42830 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin + 2011-04-29 15:39 . 2012-07-29 07:58 19546 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-4142059444-1688088560-805727375-1000_UserData.bin + 2011-05-03 06:46 . 2010-08-25 02:00 28672 c:\windows\system32\spool\prtprocs\x64\8_CNMPDAA.DLL + 2012-07-29 07:55 . 2012-07-29 07:55 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2012-07-28 12:08 . 2012-07-28 12:08 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2012-07-29 07:55 . 2012-07-29 07:55 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2012-07-28 12:08 . 2012-07-28 12:08 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2011-11-21 21:42 . 2011-11-21 21:42 33189888 c:\windows\Installer\ae502.msp . (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet ))))))))))))))))))))))))))))))))))))))))))))) . . *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä REGEDIT4 . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 —-a-w- c:\users\Sean\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 —-a-w- c:\users\Sean\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 —-a-w- c:\users\Sean\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 —-a-w- c:\users\Sean\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="c:\program files (x86)\Google\Gmail Notifier\gnotify.exe" [2005-07-15 479232] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696] "Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2010-05-19 2736128] . c:\users\Sean\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Dropbox.lnk - c:\users\Sean\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-5-24 27112840] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) "HideFastUserSwitching"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "EnableShellExecuteHooks"= 1 (0x1) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [2011-09-09 86072] R2 HP Wireless Assistant Service;HP Wireless Assistant Service;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-06-18 103992] R2 RtVOsdService;RtVOsdService Installer;c:\program files\Realtek\RtVOsd\RtVOsdService.exe [2010-06-24 315392] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-06-07 160944] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-12 250056] R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 51740536] R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-07-18 113120] R3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [2009-06-10 5434368] R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-03-20 98688] R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-03-26 291696] R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440] R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184] R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2009-09-23 225280] R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-05-09 349800] R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864] R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312] R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-02-15 52736] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-05-01 1255736] R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [2009-06-10 389120] S0 08041664;08041664;c:\windows\system32\DRIVERS\08041664.sys [2012-07-22 460888] S0 24789420;24789420;c:\windows\system32\DRIVERS\24789420.sys [2012-07-22 460888] S0 59957290;59957290;c:\windows\system32\DRIVERS\59957290.sys [2012-07-22 460888] S1 50400911;50400911;c:\windows\system32\DRIVERS\50400911.sys [2012-07-22 460888] S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928] S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368] S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2011-08-11 140672] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928] S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [2009-11-18 98208] S2 ezSharedSvc;Easybits Services for Windows;c:\windows\System32\ezSharedSvcHost.exe [x] S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-09-01 227896] S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2012-02-15 34872] S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-04-13 13336] S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-07-03 655944] S2 UNS;Intel® Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-03-18 2320920] S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344] S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-02-03 271872] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-07-03 24904] S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [2011-06-02 157672] S3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [2011-06-02 16872] S3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [2011-06-02 177640] . . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] 2010-05-19 18:36 451872 —-a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe . 'Ajoitetut tehtävät'-kansion sisältö . 2012-07-25 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-03 09:06] . 2012-07-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4142059444-1688088560-805727375-1000Core.job - c:\users\Sean\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-10 07:38] . 2012-07-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4142059444-1688088560-805727375-1000UA.job - c:\users\Sean\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-10 07:38] . 2012-07-17 c:\windows\Tasks\HPCeeScheduleForSean.job - c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13 20:15] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 97792 —-a-w- c:\users\Sean\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 97792 —-a-w- c:\users\Sean\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 97792 —-a-w- c:\users\Sean\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 97792 —-a-w- c:\users\Sean\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU] "RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2011-05-09 6486120] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-07-19 161304] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-07-19 386584] "Persistence"="c:\windows\system32\igfxpers.exe" [2010-07-19 415256] "BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 112512] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 1271168] . ——- Täydentävä tarkistus ——- . uStart Page = about:blank uLocal Page = c:\windows\system32\blank.htm mStart Page = hxxp://www.bing.com mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000 IE: Se&nd to OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105 TCP: DhcpNameServer = 192.168.100.1 FF - ProfilePath - c:\users\Sean\AppData\Roaming\Mozilla\Firefox\Profiles\1f9lc7zi.default\ . . ——————— LUKITUT REKISTERIAVAIMET ——————— . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}] @Denied: (A) (Everyone) "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3] @Denied: (A) (Everyone) . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0] "Key"="ActionsPane3" "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ———————— Muut prosessit ———————— . c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\windows\SysWOW64\ezSharedSvcHost.exe c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe c:\program files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe . ************************************************************************** . Valmistumisajankohta: 2012-07-29 11:04:53 - kone käynnistettiin uudelleen ComboFix-quarantined-files.txt 2012-07-29 08:04 ComboFix2.txt 2012-07-28 12:18 . Ennen ajoa: 91 390 980 096 bytes free Ajon jälkeen: 91 281 801 216 bytes free . - - End Of File - - D7383C40AD87C2E35B8297B583AEA196
Post #20
Hi skall

Open ComboFix

Please do the following:
  • close any open browsers.
  • close/disable all anti virus and anti malware programs so that they do not interfere with the running of ComboFix.
  • open notepad and copy/paste the text in the codebox below into it:
File::
c:\windows\system32\drivers\59957290.sys
c:\windows\system32\drivers\50400911.sys
c:\windows\system32\drivers\24789420.sys
c:\windows\system32\drivers\08041664.sys

Driver::
59957290
50400911
24789420
08041664

Save this as "CFScript.txt", and as Type: All Files (*.*) in the same location as ComboFix.exe

[external image: Posted Image]

Referring to the picture above, drag CFScript into ComboFix.exe

When finished, it produces a log at C:\ComboFix.txt. Post the contents of Combofix.txt in your next reply.

Please tell me how your computer is behaving after carrying out these instructions.

Thanks

Satchfan
Post #21
Hi Satchfan, I am writing to you in normal boot mode now, but after running the Combofix, it is still running extremely slow and even after I reset and tried to get into normal boot mode again, the startup time was extremely long, and twice I got the blue screen of death during startup which then I had to run Repair Mode for startup, so unfortunately not much has changed it seems. Here are my logs. Please advise. Thanks! ComboFix 12-07-29.02 - Sean 29.07.2012 19:15:34.3.4 - x64 NETWORK Microsoft Windows 7 Home Premium 6.1.7601.1.1252.358.1033.18.3894.3042 [GMT 3:00] Sijainti: c:\users\Sean\Desktop\ComboFix.exe Käytetyt komentorivivalitsimet :: c:\users\Sean\Desktop\CFScript.txt AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6} SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Uusi palautuspiste luotu . FILE :: "c:\windows\system32\drivers\08041664.sys" "c:\windows\system32\drivers\24789420.sys" "c:\windows\system32\drivers\50400911.sys" "c:\windows\system32\drivers\59957290.sys" . . (((((((((((((((((((((((((((((((((((((( Muut poistot )))))))))))))))))))))))))))))))))))))))))))))))))))))))) . . . ((((((((((((((((((((((((((((((((((((((( Ajurit/Palvelut ))))))))))))))))))))))))))))))))))))))))))))))))) . . ——-\Legacy_08041664 ——-\Legacy_24789420 ——-\Legacy_50400911 ——-\Legacy_59957290 ——-\Service_08041664 ——-\Service_24789420 ——-\Service_50400911 ——-\Service_59957290 . . ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2012-06-28 to 2012-07-29 ))))))))))))))))) . . 2012-07-29 17:12 . 2012-07-29 17:12 ——– d—–w- c:\windows\system32\config\systemprofile\AppData\Local\temp 2012-07-29 17:12 . 2012-07-29 17:12 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-07-29 08:06 . 2012-07-29 08:06 9230024 —-a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe 2012-07-28 12:37 . 2012-06-29 00:04 9133488 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F4B126C8-3C14-4362-B64A-3B67887C5117}\mpengine.dll 2012-07-28 12:20 . 2012-07-28 12:20 ——– d—–w- C:\adbf54e3f93c80dcce5187e4bada 2012-07-27 10:23 . 2012-06-29 00:04 9133488 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2012-07-25 08:10 . 2012-07-25 08:10 ——– d—–w- C:\da13dac87d2d582d8f8a52 2012-07-25 07:47 . 2012-07-25 07:47 ——– d—–w- C:\f789519418b15c56833cbd00ec41bff4 2012-07-25 07:32 . 2012-07-25 07:32 ——– d—–w- C:\be5d019b8eb4f4d3ef4690b50adc96 2012-07-23 09:51 . 2012-07-23 09:51 ——– d—–w- c:\users\Sean\AppData\Roaming\Malwarebytes 2012-07-23 09:50 . 2012-07-23 09:50 ——– d—–w- c:\programdata\Malwarebytes 2012-07-23 09:50 . 2012-07-23 09:50 ——– d—–w- c:\program files (x86)\Malwarebytes' Anti-Malware 2012-07-23 09:50 . 2012-07-03 10:46 24904 —-a-w- c:\windows\system32\drivers\mbam.sys 2012-07-23 06:42 . 2012-07-23 06:41 927800 ——w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{47024564-FB76-449D-ADBD-E793D6C02D50}\gapaengine.dll 2012-07-23 06:40 . 2012-07-23 06:40 ——– d—–w- c:\program files (x86)\Microsoft Security Client 2012-07-23 06:40 . 2012-07-23 06:40 ——– d—–w- c:\program files\Microsoft Security Client 2012-07-23 04:13 . 2012-07-22 09:59 460888 —-a-w- c:\windows\system32\drivers\59957290.sys 2012-07-22 20:11 . 2012-07-22 09:59 460888 —-a-w- c:\windows\system32\drivers\50400911.sys 2012-07-22 18:03 . 2012-07-22 09:59 460888 —-a-w- c:\windows\system32\drivers\24789420.sys 2012-07-22 17:36 . 2012-07-25 08:08 ——– d—–w- c:\users\Sean\AppData\Local\VirtualStore 2012-07-22 10:17 . 2012-07-22 09:59 460888 —-a-w- c:\windows\system32\drivers\08041664.sys 2012-07-22 10:06 . 2012-07-22 10:06 ——– d—–w- c:\programdata\Kaspersky Lab 2012-07-22 07:34 . 2012-07-22 07:34 ——– d—–w- c:\users\Sean\AppData\Roaming\SUPERAntiSpyware.com 2012-07-22 07:33 . 2012-07-24 02:26 ——– d—–w- c:\program files\SUPERAntiSpyware 2012-07-22 07:33 . 2012-07-22 07:33 ——– d—–w- c:\programdata\SUPERAntiSpyware.com 2012-07-21 22:11 . 2012-07-21 22:11 ——– d—–w- c:\programdata\Lavasoft 2012-07-21 22:11 . 2012-07-21 22:11 ——– d—–w- c:\program files (x86)\Ad-Aware Antivirus 2012-07-21 22:10 . 2012-07-21 22:10 ——– d—–w- c:\users\Sean\AppData\Roaming\Ad-Aware Antivirus 2012-07-21 11:58 . 2012-07-29 17:13 ——– d—–w- c:\windows\system32\wbem\repository 2012-07-12 07:04 . 2012-06-12 03:08 3148800 —-a-w- c:\windows\system32\win32k.sys 2012-07-11 07:45 . 2012-06-06 06:06 2004480 —-a-w- c:\windows\system32\msxml6.dll 2012-07-11 07:45 . 2012-06-06 06:06 1881600 —-a-w- c:\windows\system32\msxml3.dll 2012-07-11 07:45 . 2012-06-06 05:05 1390080 —-a-w- c:\windows\SysWow64\msxml6.dll 2012-07-11 07:45 . 2012-06-06 05:05 1236992 —-a-w- c:\windows\SysWow64\msxml3.dll 2012-07-11 07:45 . 2010-06-26 03:55 2048 —-a-w- c:\windows\system32\msxml3r.dll 2012-07-11 07:45 . 2010-06-26 03:24 2048 —-a-w- c:\windows\SysWow64\msxml3r.dll 2012-07-10 21:03 . 2012-07-10 21:03 ——– d—–w- c:\users\Sean\AppData\Roaming\PDAppFlex 2012-07-09 22:52 . 2012-07-09 22:52 ——– d—–w- c:\programdata\regid.1986-12.com.adobe 2012-07-09 22:23 . 2012-07-09 22:23 ——– d—–w- c:\users\Sean\New folder (3) 2012-07-09 22:22 . 2012-07-09 22:22 ——– d—–w- c:\users\Sean\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant 2012-07-09 22:22 . 2012-07-09 22:22 ——– d—–w- c:\program files (x86)\Adobe Download Assistant 2012-07-07 15:45 . 2012-07-07 15:46 ——– d—–w- c:\program files\iTunes 2012-07-07 15:45 . 2012-07-07 15:46 ——– d—–w- c:\program files (x86)\iTunes 2012-07-07 15:45 . 2012-07-07 15:45 ——– d—–w- c:\program files\iPod 2012-07-06 19:06 . 2012-07-06 19:06 ——– d—–w- c:\program files (x86)\Common Files\Canon . . . (((((((((((((((((((((((((((((((((((( Find3M-raportti )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-07-29 08:06 . 2012-04-03 16:19 426184 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-07-29 08:06 . 2011-05-16 07:56 70344 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-07-12 06:53 . 2011-05-01 07:24 59701280 —-a-w- c:\windows\system32\MRT.exe 2012-06-02 22:19 . 2012-06-24 13:45 38424 —-a-w- c:\windows\system32\wups.dll 2012-06-02 22:19 . 2012-06-24 13:45 2428952 —-a-w- c:\windows\system32\wuaueng.dll 2012-06-02 22:19 . 2012-06-24 13:45 57880 —-a-w- c:\windows\system32\wuauclt.exe 2012-06-02 22:19 . 2012-06-24 13:45 44056 —-a-w- c:\windows\system32\wups2.dll 2012-06-02 22:19 . 2012-06-24 13:45 701976 —-a-w- c:\windows\system32\wuapi.dll 2012-06-02 22:15 . 2012-06-24 13:45 2622464 —-a-w- c:\windows\system32\wucltux.dll 2012-06-02 22:15 . 2012-06-24 13:45 99840 —-a-w- c:\windows\system32\wudriver.dll 2012-06-02 12:19 . 2012-06-24 13:44 186752 —-a-w- c:\windows\system32\wuwebv.dll 2012-06-02 12:15 . 2012-06-24 13:44 36864 —-a-w- c:\windows\system32\wuapp.exe 2012-05-31 16:11 . 2012-05-31 16:11 163048 —-a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10141.bin 2012-05-29 19:19 . 2011-03-28 15:36 19736 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll 2012-05-04 11:06 . 2012-06-12 22:20 5559664 —-a-w- c:\windows\system32\ntoskrnl.exe 2012-05-04 10:03 . 2012-06-12 22:20 3968368 —-a-w- c:\windows\SysWow64\ntkrnlpa.exe 2012-05-04 10:03 . 2012-06-12 22:20 3913072 —-a-w- c:\windows\SysWow64\ntoskrnl.exe 2012-05-01 05:40 . 2012-06-12 22:20 209920 —-a-w- c:\windows\system32\profsvc.dll . . ((((((((((((((((((((((((((((( SnapShot@2012-07-28_12.10.04 ))))))))))))))))))))))))))))))))))))))))) . - 2009-07-14 04:54 . 2012-07-22 09:25 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2009-07-14 04:54 . 2012-07-29 08:06 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2009-07-14 04:54 . 2012-07-29 08:06 49152 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2009-07-14 04:54 . 2012-07-22 09:25 49152 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2009-07-14 04:54 . 2012-07-29 08:06 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2009-07-14 04:54 . 2012-07-22 09:25 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2010-07-20 21:53 . 2012-07-29 08:10 60110 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin + 2009-07-14 05:10 . 2012-07-29 17:15 43038 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin + 2011-04-29 15:39 . 2012-07-29 07:58 19546 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-4142059444-1688088560-805727375-1000_UserData.bin + 2011-05-03 06:46 . 2010-08-25 02:00 28672 c:\windows\system32\spool\prtprocs\x64\8_CNMPDAA.DLL - 2011-04-29 23:38 . 2012-07-15 07:41 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2011-04-29 23:38 . 2012-07-29 08:06 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2009-07-14 04:54 . 2012-07-29 08:06 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2009-07-14 04:54 . 2012-07-15 07:41 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2012-07-29 17:13 . 2012-07-29 17:13 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2012-07-28 12:08 . 2012-07-28 12:08 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2012-07-29 17:13 . 2012-07-29 17:13 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2012-07-28 12:08 . 2012-07-28 12:08 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2012-07-29 08:06 . 2012-07-29 08:06 686792 c:\windows\SysWOW64\Macromed\Flash\FlashUtil32_11_3_300_268_ActiveX.exe + 2012-07-29 08:06 . 2012-07-29 08:06 466632 c:\windows\SysWOW64\Macromed\Flash\FlashUtil32_11_3_300_268_ActiveX.dll - 2012-04-03 16:19 . 2012-07-12 09:06 250056 c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe + 2012-04-03 16:19 . 2012-07-29 08:06 250056 c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe + 2012-07-29 08:06 . 2012-07-29 08:06 417992 c:\windows\system32\Macromed\Flash\FlashUtil64_11_3_300_268_ActiveX.exe + 2012-07-29 08:06 . 2012-07-29 08:06 513224 c:\windows\system32\Macromed\Flash\FlashUtil64_11_3_300_268_ActiveX.dll - 2009-07-14 05:01 . 2012-07-25 10:22 485472 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2009-07-14 05:01 . 2012-07-29 08:07 485472 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2011-04-29 22:38 . 2012-07-29 08:07 1070756 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-4142059444-1688088560-805727375-1000-8192.dat - 2011-04-29 22:38 . 2012-07-25 10:22 1070756 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-4142059444-1688088560-805727375-1000-8192.dat + 2011-11-21 21:42 . 2011-11-21 21:42 33189888 c:\windows\Installer\ae502.msp . (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet ))))))))))))))))))))))))))))))))))))))))))))) . . *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä REGEDIT4 . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 —-a-w- c:\users\Sean\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 —-a-w- c:\users\Sean\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 —-a-w- c:\users\Sean\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 —-a-w- c:\users\Sean\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="c:\program files (x86)\Google\Gmail Notifier\gnotify.exe" [2005-07-15 479232] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696] "Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2010-05-19 2736128] . c:\users\Sean\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Dropbox.lnk - c:\users\Sean\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-5-24 27112840] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) "HideFastUserSwitching"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "EnableShellExecuteHooks"= 1 (0x1) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [2011-09-09 86072] R2 HP Wireless Assistant Service;HP Wireless Assistant Service;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-06-18 103992] R2 RtVOsdService;RtVOsdService Installer;c:\program files\Realtek\RtVOsd\RtVOsdService.exe [2010-06-24 315392] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-06-07 160944] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-29 250056] R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 51740536] R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-07-18 113120] R3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [2009-06-10 5434368] R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-03-20 98688] R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-03-26 291696] R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440] R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184] R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2009-09-23 225280] R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-05-09 349800] R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864] R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312] R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864] R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [2011-06-02 157672] R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [2011-06-02 16872] R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [2011-06-02 177640] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-02-15 52736] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-05-01 1255736] R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [2009-06-10 389120] S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928] S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368] S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2011-08-11 140672] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928] S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [2009-11-18 98208] S2 ezSharedSvc;Easybits Services for Windows;c:\windows\System32\ezSharedSvcHost.exe [x] S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-09-01 227896] S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2012-02-15 34872] S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-04-13 13336] S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-07-03 655944] S2 UNS;Intel® Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-03-18 2320920] S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344] S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-02-03 271872] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-07-03 24904] . . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] 2010-05-19 18:36 451872 —-a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe . 'Ajoitetut tehtävät'-kansion sisältö . 2012-07-29 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-03 08:06] . 2012-07-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4142059444-1688088560-805727375-1000Core.job - c:\users\Sean\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-10 07:38] . 2012-07-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4142059444-1688088560-805727375-1000UA.job - c:\users\Sean\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-10 07:38] . 2012-07-17 c:\windows\Tasks\HPCeeScheduleForSean.job - c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13 20:15] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 97792 —-a-w- c:\users\Sean\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 97792 —-a-w- c:\users\Sean\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 97792 —-a-w- c:\users\Sean\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 97792 —-a-w- c:\users\Sean\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU] "RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2011-05-09 6486120] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-07-19 161304] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-07-19 386584] "Persistence"="c:\windows\system32\igfxpers.exe" [2010-07-19 415256] "BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 112512] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 1271168] "combofix"="c:\combofix\CF24743.3XE" [2010-11-20 345088] . ——- Täydentävä tarkistus ——- . uStart Page = about:blank uLocal Page = c:\windows\system32\blank.htm mStart Page = hxxp://www.bing.com mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000 IE: Se&nd to OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105 TCP: DhcpNameServer = 192.168.100.1 FF - ProfilePath - c:\users\Sean\AppData\Roaming\Mozilla\Firefox\Profiles\1f9lc7zi.default\ . . ——————— LUKITUT REKISTERIAVAIMET ——————— . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_268_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_268_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_268.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_268.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_268.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_268.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}] @Denied: (A) (Everyone) "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3] @Denied: (A) (Everyone) . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0] "Key"="ActionsPane3" "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ———————— Muut prosessit ———————— . c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\windows\SysWOW64\ezSharedSvcHost.exe c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe c:\program files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe . ************************************************************************** . Valmistumisajankohta: 2012-07-29 20:21:49 - kone käynnistettiin uudelleen ComboFix-quarantined-files.txt 2012-07-29 17:21 ComboFix2.txt 2012-07-29 08:04 ComboFix3.txt 2012-07-28 12:18 . Ennen ajoa: 91 160 154 112 bytes free Ajon jälkeen: 90 891 415 552 bytes free . - - End Of File - - CAC4167589BF89ED72155176FC609065
Post #22
I don't see any malware there.

I'd like you to run another scan to see what security you have on your computer.

Run Security Check

Download Security Check by screen317 from here or here.
  • save it to your Desktop.
  • double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • a Notepad document should open automatically called checkup.txt; please post the contents of that document.
Can you also tell me when you installed SUPERAntiSpyware and if you had problems prior to that.

Satchfan
Post #23
Hi Satchfan,

I installed SuperAntiSpyware around a week and a half ago or so when this problem started, so I did have the problem beforehand.

Here are the contents of my log. Thanks!

Results of screen317's Security Check version 0.99.43
Windows 7 Service Pack 1 x64 (UAC is disabled!)
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
Windows Security Center service is not running! This report may not be accurate!
Windows Firewall Enabled!
Microsoft Security Essentials
(On Access scanning disabled!)
Error obtaining update status for antivirus!
`````````Anti-malware/Other Utilities Check:`````````
Java™ 6 Update 31
Java version out of Date!
Adobe Reader X (10.1.3)
Mozilla Firefox 13.0.1 Firefox out of Date!
Google Chrome 20.0.1132.47
Google Chrome 20.0.1132.57
````````Process Check: objlist.exe by Laurent````````
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
Post #24 last edited
I’d like you to check your system files

This scans the integrity of all protected Windows 7 system files and replaces incorrect corrupted, changed/modified, or damaged versions with the correct versions if possible.

Be aware that if you have modified your system files as in theming explorer/system files, running sfc /scannow will revert the system files such as explorer.exe back to it's default state. Make the appropriate backups of your system files that you have modified for theming if you wish to save them before running sfc /scannow.
  • click on Start, Run
  • type in sfc /scannow in the command window and press Enter
  • note the space between the c and the /
  • if any files require replacing SFC will replace them. You may be asked to insert your Windows 7 Disk for this process to continue. This can be done with a borrowed Windows 7 disk if you don't have one
  • be patient because the scan may take some time
  • allow the scan to run and when completed, reboot the system.
Satchfan
Post #25
Hi satchfan, I am writing from my phone now as the problem got even worse! The computer will now not boot correctly, even into safe mode. I tried startup repair and it doesnt work now either. It tries to boor, goes through the windows startup logo process, takes a long time, and then reboots again. Please help. I do not have a backup, and even while the HP recovery manager allows,me to do so, i do not have enough space on the partition it says. Please advise. Thanks
Post #26
You said that you could boot in normal mode even though the computer was slow, so what happened between that and now? When you re-booted, what had you done immediately prior to that? Please explain in detail what happens when you start your computer and at which stage it fails to respond or any error messages.
Post #27
Hi, Well, there were plenty of times that I had to reboot, so that I had to turn it off and back on just to get in to safe mode for example. But one thing that I can think of, is that I tried to install Microsoft Security Essentials again because it was not booting properly. But then for some reason it actually DID seem to be installed and working, so I stopped the one instance of it installing, and then that process froze as well. Then I rebooted again. I dont know if that did it? Also, I had some usb cables plugged in (to charge my phone and ipod), and I noticed sometimes that if I take them out (even while booting. I have done this when the computer was healthy many times), that it helps it to boot quicker. Other than that, I really cannot think of anything else that might have caused this. Any ideas? Please let me know. I went to the office to get my work laptop to use in the meanwhile, but I would still really like to get my personal one fixed. Thanks!
Post #28

I tried to install Microsoft Security Essentials again

In my introduction I stated that it was important that you do not install/uninstall anything unless asked.

Do you have a Windows 7 disk?
Post #29
Yes, I didn't think of it at the time. Sorry for that. I dont have one, but I am going to get access to one from a friend of mine, although it may take a few days as he has to send it by post.
Post #30
You may have to wait for the disk but meanwhile, this might be worth a try.

Completely powering down your computer will help the computer boot from the very beginning, simply shutting down a computer and then powering it on again will start the boot process somewhere in the middle.

Although we only deal with malware-related issues here and I am no expert in hardware issues, there are a couple of things that might be worth trying.

First, check that you haven't accidently left a blank CD/DVD in the DVD drive as the computer will try to boot from it.

Next, completely turn off the computer.
  • remove the battery and disconnect the mains adapter
  • press and hold in the Power button for 60 seconds
  • replace the battery, plug in the adapter and re-start your computer.
Try starting your computer and let me know what happens.

Satchfan

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI