[Resolved] www.savetheinformation.com

Hi, i got a virus or somethin, then removed with vundo fix virus stopped, and when i used combo fix the virus restarted,,, any soloutions? Right now used vundo fix and is normal.

HJT LOG:

Logfile of HijackThis v1.99.1
Scan saved at 8:46:59 PM, on 25/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Alwil Software\Avast 4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast 4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\PROGRA~1\ALWILS~1\AVAST4~1\ashDisp.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Alwil Software\Avast 4\ashMaiSv.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Alwil Software\Avast 4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Safari\Safari.exe
C:\Documents and Settings\Mehreen\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - (no file)
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\AVAST4~1\ashDisp.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: &Clean; Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download; with &DAP; - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all; with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: PD - {1173A4DB-B5A8-4CB2-A646-09245DC2C589} - C:\Program Files\Pop up Blocker\pd.exe
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: PopupPopper Control Panel - {3E94F358-9537-4BBA-8D12-D7F8A0136973} - C:\Program Files\PopupPopper\SiteList.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O11 - Options group: Tabbed Browsing
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {37A273C2-5129-11D5-BF37-00A0CCE8754B} (TTestGenXInstallObject) - http://asp.mathxl.com/wizmodules/testgen/i…GenXInstall.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase4009.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1188839955832
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…/sysreqlab2.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1188841528977
O16 - DPF: {95D88B35-A521-472B-A182-BB1A98356421} (Pearson Installation Assistant 2) - http://asp.mathxl.com/books/_Players/PearsonInstallAsst2.cab
O16 - DPF: {E473A65C-8087-49A3-AFFD-C5BC4A10669B} (Quantum Streaming IE Player Class) - http://mvnet.xlontech.net/qm/fox/06101102/qsp2ie06101001.cab
O16 - DPF: {EEC9DBCC-04AD-4A1B-BEA7-C6DAD9515D5A} (Pearson MyEconLab Player Control) - http://asp.mathxl.com/books/_Players/EconPlayer.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast 4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast 4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast 4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast 4\ashWebSv.exe" /service (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe


My combofix log:

ComboFix 07-11-19.3 - Mehreen 2007-11-25 17:32:32.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.148 [GMT 3:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.

Unable to gain System Privileges

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Administrator\Desktop\Live Safety Center.lnk
C:\Documents and Settings\Administrator\Desktop\Online Security Guide.lnk
C:\Documents and Settings\Administrator\Favorites\Online Security Guide.lnk
C:\Documents and Settings\All Users\Start Menu\Live Safety Center.lnk
C:\Documents and Settings\All Users\Start Menu\Online Security Guide.lnk
C:\Documents and Settings\Mehreen\Application Data\Dxcknwrd.dll
C:\Documents and Settings\Mehreen\Desktop\Live Safety Center.lnk
C:\Documents and Settings\Mehreen\Desktop\Online Security Guide.lnk
C:\Documents and Settings\Mehreen\Favorites\Online Security Guide.lnk
C:\Program Files\Common Files\{3CB86~1
C:\Program Files\Common Files\{ECB86~1
C:\Program Files\Insider
C:\Program Files\Insider\Insider.exe
C:\Program Files\Temporary
C:\Program Files\vsadd-in
C:\WINDOWS\b122.exe
C:\WINDOWS\b147.exe
C:\WINDOWS\system32\components
C:\WINDOWS\system32\egfii.ini
C:\WINDOWS\system32\egfii.ini2
C:\WINDOWS\system32\iifge.dll
C:\WINDOWS\system32\rwamkvhc.dllbox

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\LEGACY_DOMAINSERVICE
——-\DomainService


((((((((((((((((((((((((( Files Created from 2007-10-25 to 2007-11-25 )))))))))))))))))))))))))))))))
.

2007-11-25 17:47 20,810 —hs—- C:\WINDOWS\system32\rwamkvhc.dllbox
2007-11-25 17:31 145,984 –a—— C:\WINDOWS\system32\ymmhxdat.dll
2007-11-25 17:31 145,984 –a—— C:\WINDOWS\system32\rwamkvhc.dll
2007-11-25 16:28 85,056 –a—— C:\WINDOWS\system32\pmvsdsjb.dll
2007-11-25 16:28 294 —hs—- C:\WINDOWS\system32\bjsdsvmp.ini
2007-11-25 16:22 79,936 –a—— C:\WINDOWS\system32\yxslifqj.dll
2007-11-25 16:21 71,232 –a—— C:\WINDOWS\system32\rbhmupdj.exe
2007-11-24 19:15 d——– C:\Program Files\Western Digital Technologies
2007-11-24 18:30 d——– C:\Program Files\SpywareBlaster
2007-11-24 16:35 d——– C:\VundoFix Backups
2007-11-24 15:20 81,472 –a—— C:\WINDOWS\system32\mpoaglyy.dll
2007-11-24 15:08 71,232 –a—— C:\WINDOWS\system32\wtpkxnny.exe
2007-11-23 21:10 d——– C:\Documents and Settings\Administrator\WINDOWS
2007-11-23 18:29 288,417 –a—— C:\WINDOWS\system32\SrchSTS.exe
2007-11-23 18:29 53,248 –a—— C:\WINDOWS\system32\Process.exe
2007-11-23 18:29 51,200 –a—— C:\WINDOWS\system32\dumphive.exe
2007-11-23 09:48 85,056 –a—— C:\WINDOWS\system32\kdivllyl.dll
2007-11-23 09:48 774 –ahs—- C:\WINDOWS\system32\lyllvidk.ini
2007-11-23 09:45 83,520 –a—— C:\WINDOWS\system32\jrekrlfq.dll
2007-11-22 18:10 d——– C:\Documents and Settings\Mehreen\Phone Browser
2007-11-22 18:00 d——– C:\Program Files\Common Files\PCSuite
2007-11-22 18:00 d——– C:\Program Files\Common Files\Nokia
2007-11-22 17:57 d——– C:\Program Files\PC Connectivity Solution
2007-11-22 17:57 d——– C:\Program Files\Nokia
2007-11-22 17:57 137,216 –a—— C:\WINDOWS\system32\drivers\nmwcd.sys
2007-11-22 17:57 65,536 –a—— C:\WINDOWS\system32\nmwcdcocls.dll
2007-11-22 17:57 12,288 –a—— C:\WINDOWS\system32\drivers\nmwcdcm.sys
2007-11-22 17:57 8,320 –a—— C:\WINDOWS\system32\drivers\nmwcdc.sys
2007-11-22 01:16 d——– C:\Temp
2007-11-22 01:16 d——– C:\Program Files\AviSynth 2.5
2007-11-22 01:15 d——– C:\Program Files\Winnydows
2007-11-21 21:48 36,352 –a—— C:\WINDOWS\system32\awttqpn.dll
2007-11-21 21:29 36,352 –a—— C:\WINDOWS\system32\efcayvu.dll
2007-11-21 21:27 36,352 –a—— C:\WINDOWS\system32\efcywtq.dll
2007-11-21 16:35 63,608 –ah—– C:\WINDOWS\system32\mlfcache.dat
2007-11-19 15:13 d——– C:\Program Files\iTunes
2007-11-19 15:13 d——– C:\Program Files\iPod
2007-11-19 15:11 d——– C:\Program Files\QuickTime
2007-11-19 15:10 d——– C:\Program Files\Common Files\Apple
2007-11-15 22:22 d——– C:\Program Files\Safari
2007-11-08 12:10 d——– C:\Program Files\PSP ISO Compressor
2007-11-03 18:38 676,352 –a—— C:\WINDOWS\system32\rtl60.bpl
2007-11-03 18:37 d——– C:\Program Files\PopupPopper
2007-11-03 13:35 d——– C:\Documents and Settings\All Users\Application Data\nView_Profiles
2007-11-03 11:34 d——– C:\Program Files\Cricket 2004
2007-11-03 10:42 d——– C:\Program Files\Common Files\LightScribe
2007-11-03 10:40 d——– C:\Program Files\Common Files\Ahead
2007-11-02 16:26 d——– C:\Documents and Settings\Mehreen\Application Data\CyberLink
2007-11-02 16:26 d——– C:\Documents and Settings\All Users\Application Data\CyberLink
2007-11-02 16:17 d——– C:\MyWorks
2007-11-02 16:15 d——– C:\Program Files\CyberLink
2007-11-02 02:16 152,848 –a—— C:\WINDOWS\system32\comdlg32.OCX
2007-11-02 02:15 d——– C:\Program Files\Bit Che
2007-11-02 02:15 124,688 –a—— C:\WINDOWS\system32\mswinsck.ocx
2007-11-01 20:48 138,893 –a—— C:\WINDOWS\system32\nvapps.xml
2007-11-01 20:47 356,352 –a—— C:\WINDOWS\system32\NVUNINST.EXE
2007-11-01 20:46 d——– C:\NVIDIA
2007-11-01 12:44 d——– C:\Program Files\SystemRequirementsLab
2007-10-30 21:52 7,552 –a—— C:\WINDOWS\system32\drivers\SONYPVU1.SYS
2007-10-30 21:52 7,552 –a–c— C:\WINDOWS\system32\dllcache\sonypvu1.sys
2007-10-30 20:43 d——– C:\Program Files\iDump
2007-10-29 17:22 26,624 –a—— C:\WINDOWS\system32\drivers\aavmker4.sys
2007-10-29 17:22 23,152 –a—— C:\WINDOWS\system32\drivers\aswRdr.sys
2007-10-29 17:21 815,480 –a—— C:\WINDOWS\system32\aswBoot.exe
2007-10-29 17:21 380,928 –a—— C:\WINDOWS\system32\actskin4.ocx
2007-10-29 17:21 95,608 –a—— C:\WINDOWS\system32\AvastSS.scr
2007-10-29 17:21 94,416 –a—— C:\WINDOWS\system32\drivers\aswmon2.sys
2007-10-29 17:21 93,264 –a—— C:\WINDOWS\system32\drivers\aswmon.sys
2007-10-27 18:22 d——– C:\Program Files\Alwil Software
2007-10-27 18:22 42,912 –a—— C:\WINDOWS\system32\drivers\aswTdi.sys
2007-10-27 15:36 77,703 –a—— C:\WINDOWS\system32\drivers\klif.cab
2007-10-26 12:33 d——– C:\WINDOWS\system32\Kaspersky Lab
2007-10-26 12:33 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-10-26 12:24 d——– C:\Program Files\Windows Live Safety Center
2007-10-26 10:32 69,632 –a—— C:\WINDOWS\system32\javacpl.cpl
2007-10-26 10:32 5,329 –a—— C:\WINDOWS\system32\jupdate-1.6.0_03-b05.log
2007-10-25 10:09 129,784 –a—— C:\WINDOWS\system32\pxafs.dll
2007-10-25 10:09 2,560 –a—— C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-10-25 10:09 2,432 –a—— C:\WINDOWS\system32\drivers\cdr4_xp.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-24 15:29 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-24 12:14 3,404 —-a-w C:\WINDOWS\system32\tmp.reg
2007-11-23 18:40 ——— d—–w C:\Documents and Settings\Mehreen\Application Data\uTorrent
2007-11-23 06:39 71,232 —-a-w C:\WINDOWS\system32\tlraeddc.exe
2007-11-22 15:10 ——— d—–w C:\Documents and Settings\Mehreen\Application Data\PC Suite
2007-11-22 15:10 ——— d—–w C:\Documents and Settings\Mehreen\Application Data\Nokia
2007-11-22 15:10 ——— d—–w C:\Documents and Settings\All Users\Application Data\PC Suite
2007-11-21 15:58 ——— d—–w C:\Documents and Settings\Mehreen\Application Data\LimeWire
2007-11-19 12:11 ——— d—–w C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-11-18 13:36 ——— d—–w C:\Program Files\LimeWire
2007-11-09 06:58 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-11-03 12:01 82,380 —-a-w C:\WINDOWS\system32\drivers\AFS2K.SYS
2007-11-01 22:43 ——— d—–w C:\Program Files\DivX
2007-11-01 17:46 ——— d—–w C:\Program Files\Common Files\InstallShield
2007-10-26 09:05 ——— d—–w C:\Program Files\Net2Phone CommCenter
2007-10-26 07:32 ——— d—–w C:\Program Files\Java
2007-10-26 07:06 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2007-10-25 07:09 ——— d—–w C:\Documents and Settings\Mehreen\Application Data\DivX
2007-10-24 19:53 ——— d—–w C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-10-24 13:46 ——— d—–w C:\Program Files\Warcraft III
2007-10-24 13:18 ——— d—–w C:\Program Files\Windows Defender
2007-10-23 17:20 81,984 —-a-w C:\WINDOWS\system32\bdod.bin
2007-10-23 15:50 ——— d—–w C:\Documents and Settings\All Users\Application Data\Trend Micro
2007-10-22 15:38 ——— d—–w C:\Program Files\Trend Micro
2007-10-22 15:33 805 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2007-10-22 15:33 8,014 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2007-10-22 15:33 61,064 —-a-w C:\WINDOWS\system32\S32EVNT1.DLL
2007-10-22 15:33 136,248 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-10-22 15:33 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2007-10-22 15:20 ——— d—–w C:\Documents and Settings\All Users\Application Data\McAfee
2007-10-22 14:46 ——— d—–w C:\Documents and Settings\Mehreen\Application Data\SiteAdvisor
2007-10-22 14:24 ——— d—–w C:\Program Files\Windows Media Connect 2
2007-10-22 12:50 ——— d—–w C:\Documents and Settings\Mehreen\Application Data\Command & Conquer 3 Tiberium Wars
2007-10-21 17:38 ——— d—–w C:\Program Files\Creative
2007-10-21 15:34 ——— d—–w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-10-21 15:30 ——— d—–w C:\Program Files\MSBuild
2007-10-21 15:30 ——— d—–w C:\Program Files\Microsoft Works
2007-10-21 15:26 ——— d—–w C:\Program Files\Microsoft.NET
2007-10-21 15:22 ——— d—–w C:\Program Files\Microsoft Visual Studio 8
2007-10-21 15:08 ——— d—–w C:\Program Files\Reference Assemblies
2007-10-21 13:26 ——— d—–w C:\Program Files\Windows Live
2007-10-21 13:25 ——— d—–w C:\Documents and Settings\All Users\Application Data\WindowsLiveInstaller
2007-10-20 17:19 ——— d—–w C:\Documents and Settings\Mehreen\Application Data\Apple Computer
2007-10-19 23:14 ——— d—–w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-10-19 18:09 ——— d—–w C:\Program Files\uTorrent
2007-10-19 18:07 ——— d—–w C:\Program Files\Common Files\Adobe
2007-10-19 15:47 ——— d—–w C:\Program Files\Xplosiv
2007-10-19 13:46 ——— d—–w C:\Program Files\CCleaner
2007-10-03 20:36 25,600 —-a-w C:\WINDOWS\system32\WS2Fix.exe
2007-10-03 15:45 ——— d—–w C:\Program Files\Apple Software Update
2007-10-03 15:45 ——— d—–w C:\Documents and Settings\All Users\Application Data\Apple
2007-09-16 23:10 356,352 —-a-w C:\WINDOWS\system32\nvudisp.exe
2007-09-16 22:07 81,920 —-a-w C:\WINDOWS\system32\nvwddi.dll
2007-09-16 22:07 81,920 —-a-w C:\WINDOWS\system32\nvmctray.dll
2007-09-16 22:07 8,491,008 —-a-w C:\WINDOWS\system32\nvcpl.dll
2007-09-16 22:07 753,664 —-a-w C:\WINDOWS\system32\nvcplui.exe
2007-09-16 22:07 6,746,112 —-a-w C:\WINDOWS\system32\nvoglnt.dll
2007-09-16 22:07 6,344,704 —-a-w C:\WINDOWS\system32\nvdisps.dll
2007-09-16 22:07 5,783,040 —-a-w C:\WINDOWS\system32\nv4_disp.dll
2007-09-16 22:07 466,944 —-a-w C:\WINDOWS\system32\nvshell.dll
2007-09-16 22:07 45,056 —-a-w C:\WINDOWS\system32\nvmccsrs.dll
2007-09-16 22:07 442,368 —-a-w C:\WINDOWS\system32\nvappbar.exe
2007-09-16 22:07 425,984 —-a-w C:\WINDOWS\system32\keystone.exe
2007-09-16 22:07 364,544 —-a-w C:\WINDOWS\system32\nvapi.dll
2007-09-16 22:07 36,864 —-a-w C:\WINDOWS\system32\nvcodins.dll
2007-09-16 22:07 36,864 —-a-w C:\WINDOWS\system32\nvcod.dll
2007-09-16 22:07 307,200 —-a-w C:\WINDOWS\system32\nvexpbar.dll
2007-09-16 22:07 3,551,232 —-a-w C:\WINDOWS\system32\nvvitvs.dll
2007-09-16 22:07 3,334,144 —-a-w C:\WINDOWS\system32\nvgames.dll
2007-09-16 22:07 286,720 —-a-w C:\WINDOWS\system32\nvnt4cpl.dll
2007-09-16 22:07 229,376 —-a-w C:\WINDOWS\system32\nvmccs.dll
2007-09-16 22:07 2,371,584 —-a-w C:\WINDOWS\system32\nvwss.dll
2007-09-16 22:07 188,416 —-a-w C:\WINDOWS\system32\nvmccss.dll
2007-09-16 22:07 155,716 —-a-w C:\WINDOWS\system32\nvsvc32.exe
2007-09-16 22:07 147,456 —-a-w C:\WINDOWS\system32\nvcolor.exe
2007-09-16 22:07 1,703,936 —-a-w C:\WINDOWS\system32\nvwdmcpl.dll
2007-09-16 22:07 1,626,112 —-a-w C:\WINDOWS\system32\nwiz.exe
2007-09-16 22:07 1,478,656 —-a-w C:\WINDOWS\system32\nview.dll
2007-09-16 22:07 1,339,392 —-a-w C:\WINDOWS\system32\nvdspsch.exe
2007-09-16 22:07 1,150,976 —-a-w C:\WINDOWS\system32\nvmobls.dll
2007-09-16 22:07 1,019,904 —-a-w C:\WINDOWS\system32\nvwimg.dll
2007-09-12 03:15 98,304 —-a-w C:\WINDOWS\System32CmdLineExt.dll
2007-09-11 01:56 126,976 —-a-w C:\WINDOWS\War3Unin.exe
2007-09-05 20:22 289,144 —-a-w C:\WINDOWS\system32\VCCLSID.exe
2006-11-04 07:32 0 —-a-w C:\Program Files\Common Files\err.log
2006-11-10 00:21 548,927 –sha-w C:\WINDOWS\system32\ponpo.bak1
2006-11-11 00:05 699,463 –sha-w C:\WINDOWS\system32\ponpo.bak2
2006-11-11 02:14 699,463 –sha-w C:\WINDOWS\system32\ponpo.ini2
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0019C3E2-DD48-4A6D-ABCD-8D32436323D9}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6AA3809C-6261-456F-8FCA-43FE39ADC5E9}]
2007-11-21 21:27 36352 –a—— C:\WINDOWS\system32\efcywtq.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A282E5A0-C970-48CB-BE0D-A305961C60F1}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}]
2007-11-25 17:31 145984 –a—— C:\WINDOWS\system32\rwamkvhc.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C95C6848-DCD6-4850-BA5B-57E6E3F9589C}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FD9DD278-B93B-4E11-B628-FCD1074B8C1B}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{11A69AE4-FBED-4832-A2BF-45AF82825583}"= C:\WINDOWS\system32\rwamkvhc.dll [2007-11-25 17:31 145984]

[HKEY_CLASSES_ROOT\clsid\{11a69ae4-fbed-4832-a2bf-45af82825583}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{11A69AE4-FBED-4832-A2BF-45AF82825583}"= C:\WINDOWS\system32\rwamkvhc.dll [2007-11-25 17:31 145984]

[HKEY_CLASSES_ROOT\clsid\{11a69ae4-fbed-4832-a2bf-45af82825583}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="nwiz.exe" [2007-09-17 01:07 C:\WINDOWS\system32\nwiz.exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-06-29 12:08]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 18:20]
"avast!"="C:\PROGRA~1\ALWILS~1\AVAST4~1\ashDisp.exe" [2007-10-25 18:20]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2006-11-23 15:10]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2006-12-05 22:55]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-10-19 20:16]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-11-02 18:36]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-04 00:56 C:\WINDOWS\system32\rundll32.exe]
"ecb86ff5"="C:\WINDOWS\system32\pmvsdsjb.dll" [2007-11-25 16:28]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:56]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 10:17]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
hp psc 2000 Series.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe [2003-04-06 11:37:10]
hpoddt01.exe.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-04-06 12:06:58]

[hklm\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{6AA3809C-6261-456F-8FCA-43FE39ADC5E9}"= C:\WINDOWS\system32\efcywtq.dll [2007-11-21 21:27 36352]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efcywtq]
efcywtq.dll 2007-11-21 21:27 36352 C:\WINDOWS\system32\efcywtq.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\rwamkvhc]
rwamkvhc.dll 2007-11-25 17:31 145984 C:\WINDOWS\system32\rwamkvhc.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\iifge.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders , digest.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Saad^Start Menu^Programs^Startup^.protected]
path=C:\Documents and Settings\Saad\Start Menu\Programs\Startup\.protected
backup=C:\WINDOWS\pss\.protectedStartup
????

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearFlix]
C:\Program Files\BearFlix\BearFlix.exe /pause

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
2001-07-09 13:50 155648 –a—— C:\WINDOWS\System32\\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pop up Blocker]
C:\Program Files\Pop up Blocker\pd.exe Minimize

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinAntiVirus Pro 2007]
C:\Program Files\WinAntiVirus Pro 2007\WinAV.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ServiceLayer"=3 (0x3)
"SavRoam"=2 (0x2)
"LiveUpdate"=3 (0x3)
"gusvc"=3 (0x3)

S3 ctlsb16;Creative SB16/AWE32/AWE64 Driver (WDM);C:\WINDOWS\system32\drivers\ctlsb16.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9a3f7e26-9aa0-11dc-b64b-000d61229aa4}]
\Shell\AutoRun\command - E:\wd_windows_tools\setup.exe

*Newly Created Service* - HTTPFILTER
.
Contents of the 'Scheduled Tasks' folder
"2007-11-23 17:04:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-11-23 10:33:01 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 2200 series#1162675951.job"
- C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe4-I
"2007-11-03 12:00:57 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 2200 series#1194091219.job"
- C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe
"2007-11-25 14:49:08 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-25 17:48:03
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-25 17:53:06 - machine was rebooted
.
— E O F —


and my vundofix log:


VundoFix V6.6.2

Checking Java version…

Java version is 1.5.0.9
Old versions of java are exploitable and should be removed.

Scan started at 4:35:51 PM 24/11/2007

Listing files found while scanning….

C:\Documents and settings\Mehreen\Application Data\SearchToolbarCorp\Toolbar Vision\PageHistory.txt
C:\Documents and settings\Mehreen\Application Data\SearchToolbarCorp\Toolbar Vision\WebHistory.txt
C:\windows\system32\umspkwra.dll
C:\windows\system32\umspkwra.dllbox
C:\windows\system32\wlffvvcg.dll

Beginning removal…

Attempting to delete C:\Documents and settings\Mehreen\Application Data\SearchToolbarCorp\Toolbar Vision\PageHistory.txt
C:\Documents and settings\Mehreen\Application Data\SearchToolbarCorp\Toolbar Vision\PageHistory.txt Has been deleted!

Attempting to delete C:\Documents and settings\Mehreen\Application Data\SearchToolbarCorp\Toolbar Vision\WebHistory.txt
C:\Documents and settings\Mehreen\Application Data\SearchToolbarCorp\Toolbar Vision\WebHistory.txt Has been deleted!

Attempting to delete C:\windows\system32\umspkwra.dll
C:\windows\system32\umspkwra.dll Has been deleted!

Attempting to delete C:\windows\system32\umspkwra.dllbox
C:\windows\system32\umspkwra.dllbox Has been deleted!

Attempting to delete C:\windows\system32\wlffvvcg.dll
C:\windows\system32\wlffvvcg.dll Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.6.2

Checking Java version…

Java version is 1.5.0.9
Old versions of java are exploitable and should be removed.

Scan started at 6:27:53 PM 25/11/2007

Listing files found while scanning….

C:\windows\system32\rwamkvhc.dll
C:\windows\system32\rwamkvhc.dllbox
C:\windows\system32\ymmhxdat.dll

Beginning removal…

Attempting to delete C:\windows\system32\rwamkvhc.dll
C:\windows\system32\rwamkvhc.dll Has been deleted!

Attempting to delete C:\windows\system32\rwamkvhc.dllbox
C:\windows\system32\rwamkvhc.dllbox Has been deleted!

Attempting to delete C:\windows\system32\ymmhxdat.dll
C:\windows\system32\ymmhxdat.dll Has been deleted!

Performing Repairs to the registry.
Done!


Thanks in advance, SQ

cmon admins, i am waiting.. ………………………. anybody>?<

HJT log

Logfile of HijackThis v1.99.1
Scan saved at 3:50:51 PM, on 28/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Alwil Software\Avast 4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast 4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast 4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast 4\ashWebSv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\PROGRA~1\ALWILS~1\AVAST4~1\ashDisp.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Safari\Safari.exe
C:\Documents and Settings\Mehreen\Desktop\HijackThis.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - (no file)
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\mrduczhy.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\AVAST4~1\ashDisp.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [USB2Check] RUNDLL32.EXE "C:\WINDOWS\system32\PCLECoInst.dll",CheckUSBController
O4 - HKLM\..\Run: [USBToolTip] "C:\Program Files\Pinnacle\Shared Files\\Programs\USBTip\USBTip.exe"
O4 - HKLM\..\Run: [ecb86ff5] rundll32.exe "C:\WINDOWS\system32\yvnodqen.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: PD - {1173A4DB-B5A8-4CB2-A646-09245DC2C589} - C:\Program Files\Pop up Blocker\pd.exe
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: PopupPopper Control Panel - {3E94F358-9537-4BBA-8D12-D7F8A0136973} - C:\Program Files\PopupPopper\SiteList.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O11 - Options group: Tabbed Browsing
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {37A273C2-5129-11D5-BF37-00A0CCE8754B} (TTestGenXInstallObject) - http://asp.mathxl.com/wizmodules/testgen/i…GenXInstall.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase4009.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1188839955832
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…/sysreqlab2.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1188841528977
O16 - DPF: {95D88B35-A521-472B-A182-BB1A98356421} (Pearson Installation Assistant 2) - http://asp.mathxl.com/books/_Players/PearsonInstallAsst2.cab
O16 - DPF: {E473A65C-8087-49A3-AFFD-C5BC4A10669B} (Quantum Streaming IE Player Class) - http://mvnet.xlontech.net/qm/fox/06101102/qsp2ie06101001.cab
O16 - DPF: {EEC9DBCC-04AD-4A1B-BEA7-C6DAD9515D5A} (Pearson MyEconLab Player Control) - http://asp.mathxl.com/books/_Players/EconPlayer.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast 4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast 4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast 4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast 4\ashWebSv.exe" /service (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MSSQL$PINNACLESYS - Unknown owner - C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe" -sPINNACLESYS (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - C:\Program Files\Pinnacle\Shared Files\Programs\MediaServer\PMSHost.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SQLAgent$PINNACLESYS - Unknown owner - C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlagent.EXE" -i PINNACLESYS (file missing)
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

Part #1 of combofix log


ComboFix 07-11-19.4B - Mehreen 2007-11-28 15:19:54.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.83 [GMT 3:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Start Menu\Live Safety Center.lnk
C:\Documents and Settings\All Users\Start Menu\Online Security Guide.lnk
C:\Documents and Settings\Mehreen\Desktop\Live Safety Center.lnk
C:\Documents and Settings\Mehreen\Desktop\Online Security Guide.lnk
C:\Documents and Settings\Mehreen\Favorites\Online Security Guide.lnk
C:\WINDOWS\system32\bcccf.ini
C:\WINDOWS\system32\bcccf.ini2
C:\WINDOWS\system32\fcccb.dll
C:\WINDOWS\system32\mrduczhy.dllbox

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\LEGACY_DOMAINSERVICE


((((((((((((((((((((((((( Files Created from 2007-10-28 to 2007-11-28 )))))))))))))))))))))))))))))))
.

2007-11-28 15:16 145,984 –a—— C:\WINDOWS\system32\mrduczhy.dll
2007-11-28 15:16 145,984 –a—— C:\WINDOWS\system32\bhiobhuc.dll
2007-11-27 16:54 d——– C:\Program Files\MSXML 6.0
2007-11-27 16:30 128,896 –a–c— C:\WINDOWS\system32\dllcache\fltmgr.sys
2007-11-27 16:30 23,040 –a–c— C:\WINDOWS\system32\dllcache\fltmc.exe
2007-11-27 16:30 16,896 –a–c— C:\WINDOWS\system32\dllcache\fltlib.dll
2007-11-27 16:23 d——– C:\Program Files\MSXML 4.0
2007-11-27 16:15 783,215 –ahs—- C:\WINDOWS\system32\neqdonvy.ini
2007-11-27 16:15 85,056 –a—— C:\WINDOWS\system32\yvnodqen.dll
2007-11-27 15:06 71,232 –a—— C:\WINDOWS\system32\enhdghls.exe
2007-11-27 07:18 584,192 –a–c— C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-11-26 20:15 153,088 –a—— C:\Program Files\UNWISE.EXE
2007-11-26 20:14 196,608 –a—— C:\WINDOWS\system32\MarvinUsb.ax
2007-11-26 20:14 73,728 –a—— C:\WINDOWS\system32\PCLECoInst.dll
2007-11-26 20:14 53,760 –a—— C:\WINDOWS\system32\vfwwdm32.dll
2007-11-26 20:14 53,760 –a–c— C:\WINDOWS\system32\dllcache\vfwwdm32.dll
2007-11-26 20:00 41 –a—— C:\WINDOWS\system32\blue.SITENAME
2007-11-26 18:49 2,653,888 –a—— C:\WINDOWS\system32\LTRDG13n.OCX
2007-11-26 18:49 534,192 –a—— C:\WINDOWS\system32\LTRVW13N.OCX
2007-11-26 18:49 466,624 –a—— C:\WINDOWS\system32\LTRPR13n.DLL
2007-11-26 18:49 401,408 –a—— C:\WINDOWS\system32\pvmjpg30.dll
2007-11-26 18:49 194,248 –a—— C:\WINDOWS\system32\LTRFD13n.DLL
2007-11-26 18:48 185,856 –a—— C:\WINDOWS\system32\lfpng13s.dll
2007-11-26 18:48 82,432 –a—— C:\WINDOWS\system32\msxml4r.dll
2007-11-26 18:48 44,544 –a—— C:\WINDOWS\system32\msxml4a.dll
2007-11-26 18:46 233,472 –a—— C:\WINDOWS\system32\DiskIO.dll
2007-11-26 18:46 184,320 –a—— C:\WINDOWS\system32\RALMain.dll
2007-11-26 18:46 126,976 –a—— C:\WINDOWS\system32\AVIPrAx.dll
2007-11-26 18:46 73,728 –a—— C:\WINDOWS\system32\MMAviAx.dll
2007-11-26 18:46 32,768 –a—— C:\WINDOWS\system32\MLPagAx.dll
2007-11-26 18:45 1,013,248 –a—— C:\WINDOWS\system32\Ltwvc13n.dll
2007-11-26 18:45 306,352 –a—— C:\WINDOWS\system32\Ltrio13n.dll
2007-11-26 18:41 26,624 –a—— C:\WINDOWS\system32\PSDrvCheck.JP
2007-11-26 18:41 26,624 –a—— C:\WINDOWS\system32\PSDrvCheck.IT
2007-11-26 18:41 26,624 –a—— C:\WINDOWS\system32\PSDrvCheck.FR
2007-11-26 18:41 26,624 –a—— C:\WINDOWS\system32\PSDrvCheck.ES
2007-11-26 18:41 26,624 –a—— C:\WINDOWS\system32\PSDrvCheck.DE
2007-11-26 18:41 16,896 –a—— C:\WINDOWS\system32\PSDrvCheck.NL
2007-11-26 18:41 16,896 –a—— C:\WINDOWS\system32\PSDrvCheck.KO
2007-11-26 18:30 33,340 –a—— C:\WINDOWS\system32\dbmsqlgc.dll
2007-11-26 18:30 24,576 –a—— C:\WINDOWS\system32\dbmsgnet.dll
2007-11-26 18:27 d——– C:\Program Files\Microsoft SQL Server
2007-11-26 18:24 d——– C:\WINDOWS\Cache
2007-11-26 18:24 765,952 –a—— C:\WINDOWS\system32\msvcp71d.dll
2007-11-26 18:24 544,768 –a—— C:\WINDOWS\system32\msvcr71d.dll
2007-11-26 18:15 d——– C:\WINDOWS\system32\URTTEMP
2007-11-26 17:31 d——– C:\Program Files\SmartSound Software
2007-11-26 17:31 d——– C:\Documents and Settings\All Users\Application Data\SmartSound Software Inc
2007-11-26 17:28 196,096 –a—— C:\WINDOWS\system32\macd32.dll
2007-11-26 17:28 138,752 –a—— C:\WINDOWS\system32\mase32.dll
2007-11-26 17:28 136,192 –a—— C:\WINDOWS\system32\mamc32.dll
2007-11-26 17:28 84,992 –a—— C:\WINDOWS\system32\ATL70.DLL
2007-11-26 17:28 57,856 –a—— C:\WINDOWS\system32\masd32.dll
2007-11-26 17:28 27,648 –a—— C:\WINDOWS\system32\ma32.dll
2007-11-26 17:27 41,219 –a—— C:\WINDOWS\RSETPATH.exe
2007-11-26 17:24 d——– C:\WINDOWS\Downloaded Installations
2007-11-26 17:24 65,536 –a—— C:\WINDOWS\system32\MFC71DEU.DLL
2007-11-26 17:24 61,440 –a—— C:\WINDOWS\system32\MFC71ITA.DLL
2007-11-26 17:24 61,440 –a—— C:\WINDOWS\system32\MFC71FRA.DLL
2007-11-26 17:24 61,440 –a—— C:\WINDOWS\system32\MFC71ESP.DLL
2007-11-26 17:24 57,344 –a—— C:\WINDOWS\system32\MFC71ENU.DLL
2007-11-26 17:24 49,152 –a—— C:\WINDOWS\system32\PCLEGetGuid.dll
2007-11-26 17:24 49,152 –a—— C:\WINDOWS\system32\MFC71KOR.DLL
2007-11-26 17:24 49,152 –a—— C:\WINDOWS\system32\MFC71JPN.DLL
2007-11-26 17:24 45,056 –a—— C:\WINDOWS\system32\MFC71CHT.DLL
2007-11-26 17:24 40,960 –a—— C:\WINDOWS\system32\MFC71CHS.DLL
2007-11-26 17:21 d——– C:\Documents and Settings\All Users\Application Data\Pinnacle Studio
2007-11-26 17:07 d——– C:\Program Files\Pinnacle
2007-11-26 17:07 d——– C:\Documents and Settings\All Users\Application Data\Pinnacle
2007-11-26 16:17 d——– C:\Program Files\Ares
2007-11-25 16:28 775,892 –ahs—- C:\WINDOWS\system32\bjsdsvmp.ini
2007-11-25 16:28 85,056 –a—— C:\WINDOWS\system32\pmvsdsjb.dll
2007-11-25 16:22 79,936 –a—— C:\WINDOWS\system32\yxslifqj.dll
2007-11-25 16:21 71,232 –a—— C:\WINDOWS\system32\rbhmupdj.exe
2007-11-24 19:15 d——– C:\Program Files\Western Digital Technologies
2007-11-24 18:30 d——– C:\Program Files\SpywareBlaster
2007-11-24 16:35 d——– C:\VundoFix Backups
2007-11-24 15:20 81,472 –a—— C:\WINDOWS\system32\mpoaglyy.dll
2007-11-24 15:08 71,232 –a—— C:\WINDOWS\system32\wtpkxnny.exe
2007-11-23 21:10 d——– C:\Documents and Settings\Administrator\WINDOWS
2007-11-23 18:29 53,248 –a—— C:\WINDOWS\system32\Process.exe
2007-11-23 18:29 51,200 –a—— C:\WINDOWS\system32\dumphive.exe
2007-11-23 18:29 25,600 –a—— C:\WINDOWS\system32\WS2Fix.exe
2007-11-23 09:48 85,056 –a—— C:\WINDOWS\system32\kdivllyl.dll
2007-11-23 09:48 774 –ahs—- C:\WINDOWS\system32\lyllvidk.ini
2007-11-23 09:45 83,520 –a—— C:\WINDOWS\system32\jrekrlfq.dll
2007-11-22 18:10 d——– C:\Documents and Settings\Mehreen\Phone Browser
2007-11-22 18:00 d——– C:\Program Files\Common Files\PCSuite
2007-11-22 18:00 d——– C:\Program Files\Common Files\Nokia
2007-11-22 17:57 d——– C:\Program Files\PC Connectivity Solution
2007-11-22 17:57 d——– C:\Program Files\Nokia
2007-11-22 17:57 65,536 –a—— C:\WINDOWS\system32\nmwcdcocls.dll
2007-11-22 01:16 d——– C:\Temp
2007-11-22 01:16 d——– C:\Program Files\AviSynth 2.5
2007-11-22 01:15 d——– C:\Program Files\Winnydows
2007-11-21 21:48 36,352 –a—— C:\WINDOWS\system32\awttqpn.dll
2007-11-21 21:29 36,352 –a—— C:\WINDOWS\system32\efcayvu.dll
2007-11-21 21:27 36,352 –a—— C:\WINDOWS\system32\efcywtq.dll
2007-11-21 16:35 68,008 –ah—– C:\WINDOWS\system32\mlfcache.dat
2007-11-19 15:13 d——– C:\Program Files\iTunes

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-28 03:37 ——— d—–w C:\Documents and Settings\Mehreen\Application Data\uTorrent
2007-11-27 14:08 ——— d—–w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-11-26 15:44 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-11-26 13:30 ——— d—–w C:\Program Files\LimeWire
2007-11-24 15:29 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-22 15:10 ——— d—–w C:\Documents and Settings\Mehreen\Application Data\PC Suite
2007-11-22 15:10 ——— d—–w C:\Documents and Settings\Mehreen\Application Data\Nokia
2007-11-22 15:10 ——— d—–w C:\Documents and Settings\All Users\Application Data\PC Suite
2007-11-21 15:58 ——— d—–w C:\Documents and Settings\Mehreen\Application Data\LimeWire
2007-11-19 12:11 ——— d—–w C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-11-03 12:01 82,380 —-a-w C:\WINDOWS\system32\drivers\AFS2K.SYS
2007-11-01 22:43 ——— d—–w C:\Program Files\DivX
2007-11-01 17:46 ——— d—–w C:\Program Files\Common Files\InstallShield
2007-10-29 14:21 ——— d—–w C:\Program Files\Alwil Software
2007-10-27 14:32 ——— d—–w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-10-27 12:36 77,703 —-a-w C:\WINDOWS\system32\drivers\klif.cab
2007-10-26 09:25 ——— d—–w C:\Program Files\Windows Live Safety Center
2007-10-26 09:05 ——— d—–w C:\Program Files\Net2Phone CommCenter
2007-10-26 07:32 ——— d—–w C:\Program Files\Java
2007-10-26 07:06 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2007-10-25 16:05 94,416 —-a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-10-25 16:05 93,264 —-a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-10-25 16:03 23,152 —-a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-10-25 16:01 42,912 —-a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-10-25 07:09 ——— d—–w C:\Documents and Settings\Mehreen\Application Data\DivX
2007-10-24 19:53 ——— d—–w C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-10-24 13:46 ——— d—–w C:\Program Files\Warcraft III
2007-10-24 13:18 ——— d—–w C:\Program Files\Windows Defender
2007-10-23 15:50 ——— d—–w C:\Documents and Settings\All Users\Application Data\Trend Micro
2007-10-22 15:38 ——— d—–w C:\Program Files\Trend Micro
2007-10-22 15:33 805 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2007-10-22 15:33 8,014 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2007-10-22 15:33 136,248 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-10-22 15:33 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2007-10-22 15:20 ——— d—–w C:\Documents and Settings\All Users\Application Data\McAfee
2007-10-22 14:46 ——— d—–w C:\Documents and Settings\Mehreen\Application Data\SiteAdvisor
2007-10-22 14:24 ——— d—–w C:\Program Files\Windows Media Connect 2
2007-10-22 12:50 ——— d—–w C:\Documents and Settings\Mehreen\Application Data\Command & Conquer 3 Tiberium Wars
2007-10-21 17:38 ——— d—–w C:\Program Files\Creative
2007-10-21 15:30 ——— d—–w C:\Program Files\MSBuild
2007-10-21 15:30 ——— d—–w C:\Program Files\Microsoft Works
2007-10-21 15:26 ——— d—–w C:\Program Files\Microsoft.NET
2007-10-21 15:22 ——— d—–w C:\Program Files\Microsoft Visual Studio 8
2007-10-21 15:08 ——— d—–w C:\Program Files\Reference Assemblies
2007-10-21 13:26 ——— d—–w C:\Program Files\Windows Live
2007-10-21 13:25 ——— d—–w C:\Documents and Settings\All Users\Application Data\WindowsLiveInstaller
2007-10-20 17:19 ——— d—–w C:\Documents and Settings\Mehreen\Application Data\Apple Computer
2007-10-19 23:14 ——— d—–w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-10-19 18:09 ——— d—–w C:\Program Files\uTorrent
2007-10-19 18:07 ——— d—–w C:\Program Files\Common Files\Adobe
2007-10-19 15:47 ——— d—–w C:\Program Files\Xplosiv
2007-10-19 13:46 ——— d—–w C:\Program Files\CCleaner
2007-10-03 15:45 ——— d—–w C:\Program Files\Apple Software Update
2007-10-03 15:45 ——— d—–w C:\Documents and Settings\All Users\Application Data\Apple
2007-09-12 03:15 98,304 —-a-w C:\WINDOWS\System32CmdLineExt.dll
2007-09-11 01:56 126,976 —-a-w C:\WINDOWS\War3Unin.exe
2006-11-04 07:32 0 —-a-w C:\Program Files\Common Files\err.log
2006-11-10 00:21 548,927 –sha-w C:\WINDOWS\system32\ponpo.bak1
2006-11-11 00:05 699,463 –sha-w C:\WINDOWS\system32\ponpo.bak2
2006-11-11 02:14 699,463 –sha-w C:\WINDOWS\system32\ponpo.ini2
.

((((((((((((((((((((((((((((( snapshot@2007-11-25_17.50.55.46 )))))))))))))))))))))))))))))))))))))))))
.
+ 2004-10-13 16:21:24 1,694,208 —-a-w C:\WINDOWS\$hf_mig$\KB887472\SP2QFE\msmsgs.exe
+ 2004-10-14 08:34:52 7,168 —-a-w C:\WINDOWS\$hf_mig$\KB887472\spmsg.dll
+ 2004-10-14 08:36:18 169,984 —-a-w C:\WINDOWS\$hf_mig$\KB887472\spuninst.exe
+ 2004-10-14 08:36:16 21,504 —-a-w C:\WINDOWS\$hf_mig$\KB887472\update\spcustom.dll
+ 2004-10-14 08:34:54 654,848 —-a-w C:\WINDOWS\$hf_mig$\KB887472\update\update.exe
+ 2005-08-30 04:13:42 1,287,680 —-a-w C:\WINDOWS\$hf_mig$\KB904706\SP2QFE\quartz.dll
+ 2005-10-12 23:12:25 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB904706\spmsg.dll
+ 2005-10-12 23:12:26 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB904706\spuninst.exe
+ 2005-10-12 23:12:25 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB904706\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB904706\update\update.exe
+ 2005-10-12 23:12:34 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB904706\update\updspapi.dll
+ 2006-03-17 01:08:10 262,656 —-a-w C:\WINDOWS\$hf_mig$\KB916595\SP2QFE\http.sys
+ 2005-10-12 23:16:49 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB916595\spmsg.dll
+ 2005-10-12 23:16:49 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB916595\spuninst.exe
+ 2005-10-12 23:16:49 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB916595\update\spcustom.dll
+ 2005-10-12 23:16:51 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB916595\update\update.exe
+ 2005-10-12 23:16:56 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB916595\update\updspapi.dll
+ 2006-11-27 15:17:10 539,136 —-a-w C:\WINDOWS\$hf_mig$\KB918118\SP2QFE\msftedit.dll
+ 2006-11-27 15:17:10 433,664 —-a-w C:\WINDOWS\$hf_mig$\KB918118\SP2QFE\riched20.dll
+ 2005-10-12 23:12:25 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB918118\spmsg.dll
+ 2005-10-12 23:12:26 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB918118\spuninst.exe
+ 2005-10-12 23:12:25 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB918118\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB918118\update\update.exe
+ 2005-10-12 23:12:34 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB918118\update\updspapi.dll
+ 2006-06-14 08:50:19 172,416 —-a-w C:\WINDOWS\$hf_mig$\KB920872\SP2QFE\kmixer.sys
+ 2006-06-14 08:50:19 6,272 —-a-w C:\WINDOWS\$hf_mig$\KB920872\SP2QFE\splitter.sys
+ 2006-06-14 09:17:04 82,944 —-a-w C:\WINDOWS\$hf_mig$\KB920872\SP2QFE\wdmaud.sys
+ 2005-10-12 23:12:25 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB920872\spmsg.dll
+ 2005-10-12 23:12:26 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB920872\spuninst.exe
+ 2005-10-12 23:12:25 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB920872\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB920872\update\update.exe
+ 2005-10-12 23:12:34 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB920872\update\updspapi.dll
+ 2006-10-19 13:59:58 713,216 —-a-w C:\WINDOWS\$hf_mig$\KB926255\SP2QFE\sxs.dll
+ 2005-10-12 23:12:25 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB926255\spmsg.dll
+ 2005-10-12 23:12:26 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB926255\spuninst.exe
+ 2005-10-12 23:12:25 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB926255\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB926255\update\update.exe
+ 2005-10-12 23:12:34 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB926255\update\updspapi.dll
+ 2006-10-16 17:14:17 122,880 —-a-w C:\WINDOWS\$hf_mig$\KB926436\SP2QFE\oledlg.dll
+ 2005-10-12 23:16:49 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB926436\spmsg.dll
+ 2005-10-12 23:16:49 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB926436\spuninst.exe
+ 2005-10-12 23:16:49 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB926436\update\spcustom.dll
+ 2005-10-12 23:16:51 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB926436\update\update.exe
+ 2005-10-12 23:16:56 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB926436\update\updspapi.dll
+ 2006-12-19 18:47:14 333,824 —-a-w C:\WINDOWS\$hf_mig$\KB927802\SP2QFE\wiaservc.dll
+ 2005-10-12 23:12:25 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB927802\spmsg.dll
+ 2005-10-12 23:12:26 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB927802\spuninst.exe
+ 2005-10-12 23:12:25 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB927802\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB927802\update\update.exe
+ 2005-10-12 23:12:34 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB927802\update\updspapi.dll
+ 2006-12-19 21:50:10 8,458,752 —-a-w C:\WINDOWS\$hf_mig$\KB928255\SP2QFE\shell32.dll
+ 2006-12-19 21:50:10 135,168 —-a-w C:\WINDOWS\$hf_mig$\KB928255\SP2QFE\shsvcs.dll
+ 2006-12-19 16:10:56 248,320 —-a-w C:\WINDOWS\$hf_mig$\KB928255\SP2QFE\xpsp3res.dll
+ 2006-01-19 19:29:19 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB928255\spmsg.dll
+ 2006-01-19 19:29:19 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB928255\spuninst.exe
+ 2006-01-19 19:29:19 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB928255\update\spcustom.dll
+ 2006-01-19 19:29:19 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB928255\update\update.exe
+ 2006-01-19 19:29:19 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB928255\update\updspapi.dll
+ 2005-10-12 23:12:25 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB928843\spmsg.dll
+ 2005-10-12 23:12:26 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB928843\spuninst.exe
+ 2005-10-12 23:12:25 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB928843\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB928843\update\update.exe
+ 2005-10-12 23:12:34 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB928843\update\updspapi.dll
+ 2007-02-09 11:23:36 574,976 —-a-w C:\WINDOWS\$hf_mig$\KB930916\SP2QFE\ntfs.sys
+ 2005-10-12 23:12:25 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB930916\spmsg.dll
+ 2005-10-12 23:12:26 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB930916\spuninst.exe
+ 2005-10-12 23:12:25 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB930916\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB930916\update\update.exe
+ 2005-10-12 23:12:34 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB930916\update\updspapi.dll
+ 2007-02-05 20:19:14 185,344 —-a-w C:\WINDOWS\$hf_mig$\KB931261\SP2QFE\upnphost.dll
+ 2006-01-19 19:29:19 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB931261\spmsg.dll
+ 2006-01-19 19:29:19 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB931261\spuninst.exe
+ 2006-01-19 19:29:19 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB931261\update\spcustom.dll
+ 2006-01-19 19:29:19 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB931261\update\update.exe
+ 2006-01-19 19:29:19 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB931261\update\updspapi.dll
+ 2007-03-09 13:58:57 57,344 —-a-w C:\WINDOWS\$hf_mig$\KB932168\SP2QFE\agentdpv.dll
+ 2007-03-09 11:28:00 248,320 —-a-w C:\WINDOWS\$hf_mig$\KB932168\SP2QFE\xpsp3res.dll
+ 2006-01-19 19:29:19 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB932168\spmsg.dll
+ 2006-01-19 19:29:19 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB932168\spuninst.exe
+ 2006-01-19 19:29:19 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB932168\update\spcustom.dll
+ 2006-01-19 19:29:19 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB932168\update\update.exe
+ 2006-01-19 19:29:19 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB932168\update\updspapi.dll
+ 2007-07-18 10:33:06 60,416 —-a-w C:\WINDOWS\$hf_mig$\KB933360\SP2QFE\tzchange.exe
+ 2007-03-06 01:22:36 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB933360\spmsg.dll
+ 2007-03-06 01:22:41 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB933360\spuninst.exe
+ 2007-03-06 01:22:34 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB933360\update\spcustom.dll
+ 2007-03-06 01:22:59 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB933360\update\update.exe
+ 2007-03-06 01:23:51 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB933360\update\updspapi.dll
+ 2007-04-16 16:07:27 986,112 —-a-w C:\WINDOWS\$hf_mig$\KB935839\SP2QFE\kernel32.dll
+ 2005-10-12 23:12:25 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB935839\spmsg.dll
+ 2005-10-12 23:12:26 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB935839\spuninst.exe
+ 2005-10-12 23:12:25 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB935839\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB935839\update\update.exe
+ 2005-10-12 23:12:34 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB935839\update\updspapi.dll
+ 2007-04-25 20:32:22 144,896 —-a-w C:\WINDOWS\$hf_mig$\KB935840\SP2QFE\schannel.dll
+ 2006-01-19 19:29:19 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB935840\spmsg.dll
+ 2006-01-19 19:29:19 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB935840\spuninst.exe
+ 2006-01-19 19:29:19 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB935840\update\spcustom.dll
+ 2006-01-19 19:29:19 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB935840\update\update.exe
+ 2006-01-19 19:29:19 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB935840\update\updspapi.dll
+ 2007-06-13 11:26:03 1,033,216 —-a-w C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
+ 2005-10-12 23:12:25 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB938828\spmsg.dll
+ 2005-10-12 23:12:26 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB938828\spuninst.exe
+ 2005-10-12 23:12:25 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB938828\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB938828\update\update.exe
+ 2005-10-12 23:12:34 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB938828\update\updspapi.dll
+ 2007-06-19 13:37:21 282,112 —-a-w C:\WINDOWS\$hf_mig$\KB938829\SP2QFE\gdi32.dll
+ 2006-01-19 19:29:19 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB938829\spmsg.dll
+ 2006-01-19 19:29:19 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB938829\spuninst.exe
+ 2006-01-19 19:29:19 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB938829\update\spcustom.dll
+ 2006-01-19 19:29:19 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB938829\update\update.exe
+ 2006-01-19 19:29:19 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB938829\update\updspapi.dll
+ 2007-11-26 15:15:05 7,680 —-a-w C:\WINDOWS\assembly\GAC\Accessibility\1.0.5000.0__b03f5f7f11d50a3a\Accessibility.dll
+ 2007-11-26 15:14:50 12,288 —-a-w C:\WINDOWS\assembly\GAC\cscompmgd\7.0.5000.0__b03f5f7f11d50a3a\cscompmgd.dll
+ 2007-11-26 15:15:05 33,792 —-a-w C:\WINDOWS\assembly\GAC\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a\CustomMarshalers.dll
+ 2007-11-26 15:22:03 8,192 —-a-w C:\WINDOWS\assembly\GAC\IEExecRemote\1.0.5000.0__b03f5f7f11d50a3a\IEExecRemote.dll
+ 2007-11-26 15:22:08 32,768 —-a-w C:\WINDOWS\assembly\GAC\IEHost\1.0.5000.0__b03f5f7f11d50a3a\IEHost.dll
+ 2007-11-26 15:15:06 4,608 —-a-w C:\WINDOWS\assembly\GAC\IIEHost\1.0.5000.0__b03f5f7f11d50a3a\IIEHost.dll
+ 2007-11-26 15:15:06 26,112 —-a-w C:\WINDOWS\assembly\GAC\ISymWrapper\1.0.5000.0__b03f5f7f11d50a3a\ISymWrapper.dll
+ 2007-11-26 15:22:38 720,896 —-a-w C:\WINDOWS\assembly\GAC\Microsoft.JScript\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
+ 2007-11-26 15:14:49 28,672 —-a-w C:\WINDOWS\assembly\GAC\Microsoft.VisualBasic.Vsa\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
+ 2007-11-26 15:22:10 299,008 —-a-w C:\WINDOWS\assembly\GAC\Microsoft.VisualBasic\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
+ 2007-11-26 15:14:52 6,144 —-a-w C:\WINDOWS\assembly\GAC\Microsoft.VisualC\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.VisualC.dll
+ 2007-11-26 15:14:49 11,264 —-a-w C:\WINDOWS\assembly\GAC\Microsoft.Vsa.Vb.CodeDOMProcessor\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
+ 2007-11-26 15:14:49 32,768 —-a-w C:\WINDOWS\assembly\GAC\Microsoft.Vsa\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
+ 2007-11-26 15:14:49 6,656 —-a-w C:\WINDOWS\assembly\GAC\Microsoft_VsaVb\7.0.5000.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
+ 2007-11-26 15:15:06 1,564,672 —-a-w C:\WINDOWS\assembly\GAC\mscorcfg\1.0.5000.0__b03f5f7f11d50a3a\mscorcfg.dll
+ 2007-11-26 15:22:28 32,768 —-a-w C:\WINDOWS\assembly\GAC\Regcode\1.0.5000.0__b03f5f7f11d50a3a\RegCode.dll
+ 2007-11-26 15:15:08 77,824 —-a-w C:\WINDOWS\assembly\GAC\System.Configuration.Install\1.0.5000.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
+ 2007-11-26 15:22:23 303,104 —-a-w C:\WINDOWS\assembly\GAC\System.Data.OracleClient\1.0.5000.0__b77a5c561934e089\System.Data.OracleClient.dll
+ 2007-11-26 15:22:31 1,294,336 —-a-w C:\WINDOWS\assembly\GAC\System.Data\1.0.5000.0__b77a5c561934e089\System.Data.dll
+ 2007-11-26 15:22:05 1,703,936 —-a-w C:\WINDOWS\assembly\GAC\System.Design\1.0.5000.0__b03f5f7f11d50a3a\System.Design.dll
+ 2007-11-26 15:22:37 90,112 —-a-w C:\WINDOWS\assembly\GAC\System.DirectoryServices\1.0.5000.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
+ 2007-11-26 15:15:09 65,536 —-a-w C:\WINDOWS\assembly\GAC\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
+ 2007-11-26 15:22:22 466,944 —-a-w C:\WINDOWS\assembly\GAC\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a\System.Drawing.dll
+ 2007-11-26 15:22:12 241,664 —-a-w C:\WINDOWS\assembly\GAC\System.EnterpriseServices\1.0.5000.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
+ 2007-11-26 15:22:12 66,560 —-a-w C:\WINDOWS\assembly\GAC\System.EnterpriseServices\1.0.5000.0__b03f5f7f11d50a3a\System.EnterpriseServices.Thunk.dll
+ 2007-11-26 15:22:27 372,736 —-a-w C:\WINDOWS\assembly\GAC\System.Management\1.0.5000.0__b03f5f7f11d50a3a\System.Management.dll
+ 2007-11-26 15:22:39 241,664 —-a-w C:\WINDOWS\assembly\GAC\System.Messaging\1.0.5000.0__b03f5f7f11d50a3a\System.Messaging.dll
+ 2007-11-26 15:22:24 323,584 —-a-w C:\WINDOWS\assembly\GAC\System.Runtime.Remoting\1.0.5000.0__b77a5c561934e089\System.Runtime.Remoting.dll
+ 2007-11-26 15:22:16 131,072 —-a-w C:\WINDOWS\assembly\GAC\System.Runtime.Serialization.Formatters.Soap\1.0.5000.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
+ 2007-11-26 15:22:21 77,824 —-a-w C:\WINDOWS\assembly\GAC\System.Security\1.0.5000.0__b03f5f7f11d50a3a\System.Security.dll
+ 2007-11-26 15:22:34 126,976 —-a-w C:\WINDOWS\assembly\GAC\System.ServiceProcess\1.0.5000.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
+ 2007-11-26 15:22:01 819,200 —-a-w C:\WINDOWS\assembly\GAC\System.Web.Mobile\1.0.5000.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
+ 2007-11-26 15:22:11 57,344 —-a-w C:\WINDOWS\assembly\GAC\System.Web.RegularExpressions\1.0.5000.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
+ 2007-11-26 15:22:07 573,440 —-a-w C:\WINDOWS\assembly\GAC\System.Web.Services\1.0.5000.0__b03f5f7f11d50a3a\System.Web.Services.dll
+ 2007-11-28 03:43:53 1,265,664 —-a-w C:\WINDOWS\assembly\GAC\System.Web\1.0.5000.0__b03f5f7f11d50a3a\System.Web.dll
+ 2007-11-26 15:22:20 2,052,096 —-a-w C:\WINDOWS\assembly\GAC\System.Windows.Forms\1.0.5000.0__b77a5c561934e089\System.Windows.Forms.dll
+ 2007-11-26 15:22:25 1,339,392 —-a-w C:\WINDOWS\assembly\GAC\System.Xml\1.0.5000.0__b77a5c561934e089\System.XML.dll
+ 2007-11-28 03:43:56 1,232,896 —-a-w C:\WINDOWS\assembly\GAC\System\1.0.5000.0__b77a5c561934e089\System.dll
- 2007-10-19 23:11:07 68,608 —-a-w C:\WINDOWS\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
+ 2007-11-27 13:38:18 68,608 —-a-w C:\WINDOWS\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
- 2007-10-19 23:11:37 72,192 —-a-w C:\WINDOWS\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
+ 2007-11-27 13:39:32 72,192 —-a-w C:\WINDOWS\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
- 2007-10-19 23:11:38 4,308,992 —-a-w C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
+ 2007-11-27 13:39:33 4,308,992 —-a-w C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
- 2007-10-19 23:11:41 482,304 —-a-w C:\WINDOWS\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
+ 2007-11-27 13:39:53 482,304 —-a-w C:\WINDOWS\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
- 2007-10-19 23:11:30 2,878,976 —-a-w C:\WINDOWS\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
+ 2007-11-27 13:39:24 2,902,016 —-a-w C:\WINDOWS\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
- 2007-10-19 23:10:59 258,048 —-a-w C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
+ 2007-11-27 13:37:41 258,048 —-a-w C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
- 2007-10-19 23:10:59 114,176 —-a-w C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
+ 2007-11-27 13:37:41 114,176 —-a-w C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
- 2007-10-19 23:11:51 260,096 —-a-w C:\WINDOWS\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
+ 2007-11-27 13:40:06 260,096 —-a-w C:\WINDOWS\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
- 2007-10-19 23:11:12 5,029,888 —-a-w C:\WINDOWS\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
+ 2007-11-27 13:38:27 5,156,864 —-a-w C:\WINDOWS\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
- 2007-10-19 23:11:06 10,752 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
+ 2007-11-27 13:38:15 10,752 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
- 2007-10-19 23:10:58 503,808 —-a-w C:\WINDOWS\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
+ 2007-11-27 13:37:36 507,904 —-a-w C:\WINDOWS\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
- 2007-10-19 23:11:01 13,312 —-a-w C:\WINDOWS\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
+ 2007-11-27 13:38:04 13,312 —-a-w C:\WINDOWS\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
- 2007-10-19 23:11:35 8,192 —-a-w C:\WINDOWS\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
+ 2007-11-27 13:39:28 8,192 —-a-w C:\WINDOWS\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
- 2007-10-19 23:11:35 36,864 —-a-w C:\WINDOWS\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
+ 2007-11-27 13:39:29 36,864 —-a-w C:\WINDOWS\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
- 2007-10-19 23:11:36 5,632 —-a-w C:\WINDOWS\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
+ 2007-11-27 13:39:30 5,632 —-a-w C:\WINDOWS\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
- 2007-10-19 23:11:02 413,696 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
+ 2007-11-27 13:38:07 413,696 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
- 2007-10-19 23:11:03 36,864 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
+ 2007-11-27 13:38:09 36,864 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
- 2007-10-19 23:11:04 647,168 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
+ 2007-11-27 13:38:10 647,168 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
- 2007-10-19 23:11:05 73,728 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
+ 2007-11-27 13:38:14 73,728 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
- 2007-10-19 23:11:02 745,472 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
+ 2007-11-27 13:38:06 749,568 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
- 2007-10-19 23:11:54 110,592 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
+ 2007-11-27 13:40:13 110,592 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
- 2007-10-19 23:11:53 372,736 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
+ 2007-11-27 13:40:11 372,736 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
- 2007-10-19 23:10:55 28,672 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
+ 2007-11-27 13:37:30 28,672 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
- 2007-10-19 23:11:52 667,648 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
+ 2007-11-27 13:40:09 667,648 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
- 2007-10-19 23:11:55 5,632 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
+ 2007-11-27 13:40:14 5,632 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
- 2007-10-19 23:10:57 12,800 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
+ 2007-11-27 13:37:34 12,800 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
- 2007-10-19 23:10:56 32,768 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
+ 2007-11-27 13:37:32 32,768 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
- 2007-10-19 23:10:56 7,168 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
+ 2007-11-27 13:37:33 7,168 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
- 2007-10-19 23:11:45 110,592 —-a-w C:\WINDOWS\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
+ 2007-11-27 13:39:59 110,592 —-a-w C:\WINDOWS\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
- 2007-10-19 23:11:08 81,920 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
+ 2007-11-27 13:38:19 81,920 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
- 2007-10-19 23:11:46 389,120 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
+ 2007-11-27 13:40:00 413,696 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
- 2007-10-19 23:11:42 716,800 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
+ 2007-11-27 13:39:54 716,800 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
- 2007-10-19 23:11:00 884,736 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
+ 2007-11-27 13:37:58 888,832 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
- 2007-10-19 23:11:33 5,050,368 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
+ 2007-11-27 13:39:26 5,001,216 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
- 2007-10-19 23:11:10 188,416 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
+ 2007-11-27 13:38:22 188,416 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
- 2007-10-19 23:11:09 397,312 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
+ 2007-11-27 13:38:20 397,312 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
- 2007-10-19 23:11:10 81,920 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
+ 2007-11-27 13:38:23 81,920 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
- 2007-10-19 23:11:48 700,416 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
+ 2007-11-27 13:40:03 577,536 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
- 2007-10-19 23:11:42 368,640 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
+ 2007-11-27 13:39:55 372,736 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
- 2007-10-19 23:11:50 258,048 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
+ 2007-11-27 13:40:04 258,048 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
- 2007-10-19 23:11:43 299,008 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
+ 2007-11-27 13:39:57 299,008 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
- 2007-10-19 23:11:44 131,072 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
+ 2007-11-27 13:39:58 131,072 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
- 2007-10-19 23:11:07 258,048 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
+ 2007-11-27 13:38:17 258,048 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
- 2007-10-19 23:11:11 114,688 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
+ 2007-11-27 13:38:26 114,688 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
- 2007-10-19 23:11:51 835,584 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
+ 2007-11-27 13:40:08 835,584 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
- 2007-10-19 23:11:15 86,016 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
+ 2007-11-27 13:38:35 86,016 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
- 2007-10-19 23:11:16 823,296 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
+ 2007-11-27 13:38:37 823,296 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
- 2007-10-19 23:11:20 5,316,608 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
+ 2007-11-27 13:38:39 5,152,768 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
- 2007-10-19 23:11:26 2,035,712 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
+ 2007-11-27 13:38:46 2,027,520 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
- 2007-10-19 23:11:48 3,018,752 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
+ 2007-11-27 13:40:01 2,940,928 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
+ 2007-11-27 13:58:14 26,624 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Accessibility\b73d0a639fee2f043f6d980281edf53f\Accessibility.ni.dll
+ 2007-11-27 13:58:32 888,832 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\bfe94bd6650e811087c5d74a445385bc\AspNetMMCExt.ni.dll
+ 2007-11-27 14:00:55 499,712 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\ebaa31879fcdf3c45863c7ee11c36f37\ComSvcConfig.ni.exe
+ 2007-11-27 14:27:08 237,568 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\ce51b04c6863cd6df284cf7f02528ebd\CustomMarshalers.ni.dll
+ 2007-11-27 14:00:45 15,360 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\dfsvc\e2c0e0290e1c514da85d43270bd1cd7e\dfsvc.ni.exe
+ 2007-11-27 14:27:11 880,640 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\e81e5b3015dca0d369154ba30a919b66\Microsoft.Build.Engine.ni.dll
+ 2007-11-27 14:27:13 81,920 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\a0e2afb9386469f8ce5590a3bb851313\Microsoft.Build.Framework.ni.dll
+ 2007-11-27 14:27:20 1,687,552 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\b78178198d848788e28a18b6dc0e520f\Microsoft.Build.Tasks.ni.dll
+ 2007-11-27 14:27:23 163,840 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\55cc867e495d7ab808e09fbf2e5e1b04\Microsoft.Build.Utilities.ni.dll
+ 2007-11-27 14:01:20 405,504 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\c9d9173ca4fee5f80e34c69c99d3a598\Microsoft.Transactions.Bridge.Dtc.ni.dll
+ 2007-11-27 14:01:11 1,118,208 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\cf44c0972b67140b205bdc0a53a636d9\Microsoft.Transactions.Bridge.ni.dll
+ 2007-11-27 14:27:33 1,720,320 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\f72556b93e477de9eca566dce99367b5\Microsoft.VisualBasic.ni.dll
+ 2007-11-27 14:03:44 17,920 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualC\82af0f113246a36b7ccd68fa9e451cb8\Microsoft.VisualC.ni.dll
+ 2007-11-27 13:44:22 11,304,960 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\3fb21e7cd6d73ae9e5ec693e6f6075f6\mscorlib.ni.dll
+ 2007-11-27 14:27:38 1,568,768 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\PresentationBuildTa#\186c3534673acc7af4dc2587177c7d10\PresentationBuildTasks.ni.dll
+ 2007-11-27 14:27:06 40,448 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\PresentationCFFRast#\54232f42b53c03675d858b19d127bb8a\PresentationCFFRasterizer.ni.dll
+ 2007-11-27 14:18:21 11,984,896 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\PresentationCore\049fb7112b33b4cf10002cf4fa6e2c38\PresentationCore.ni.dll
+ 2007-11-27 14:01:59 48,640 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\eb03bdded59ca58a7b66d97f99df3eef\PresentationFontCache.ni.exe
+ 2007-11-27 14:31:01 548,864 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\336d746ed3bf8f0b9e2fd2afd08b746d\PresentationFramework.Luna.ni.dll
+ 2007-11-27 14:30:46 241,664 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\4ceb7d0a45fb92be91720988d8f5ae06\PresentationFramework.Classic.ni.dll
+ 2007-11-27 14:30:31 393,216 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\a216145a8679eaf871bca6251d28b24c\PresentationFramework.Aero.ni.dll
+ 2007-11-27 14:31:16 270,336 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\d1d644825905e450f6a06e82f62dfd34\PresentationFramework.Royale.ni.dll
+ 2007-11-27 14:29:53 14,680,064 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\e8474c8698a9c4dfc1fcc93a99727c3a\PresentationFramework.ni.dll
+ 2007-11-27 14:30:11 1,982,464 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\PresentationUI\541eac6a750cace305f0fc423450bf96\PresentationUI.ni.dll
+ 2007-11-27 14:30:24 2,396,160 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\ReachFramework\b6529205c2de59dbc598b17ffec64714\ReachFramework.ni.dll
+ 2007-11-27 14:01:27 135,168 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\ServiceModelReg\ccda449956f4cf0fe49213096ff2d098\ServiceModelReg.ni.exe
+ 2007-11-27 14:01:41 286,720 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\SMDiagnostics\2131642eddcb61013dd32fb677a6fbe2\SMDiagnostics.ni.dll
+ 2007-11-27 14:01:45 323,584 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\SMSvcHost\36bae56db51425698225eb0863177c21\SMSvcHost.ni.exe
+ 2007-11-27 14:32:32 262,144 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\sysglobl\76914b6aee95bcf826006aee2a556ab4\sysglobl.ni.dll
+ 2007-11-27 14:03:21 163,840 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\e43cfa4e1e7ce722fd283e9aa5243553\System.Configuration.Install.ni.dll
+ 2007-11-27 14:02:26 1,003,520 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\a89911fe53c86b4a6ae39cda677eee3e\System.Configuration.ni.dll
+ 2007-11-27 14:26:47 1,179,648 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Data.OracleC#\53583133639b9a53927755aeda7ae769\System.Data.OracleClient.ni.dll
+ 2007-11-27 14:02:58 2,695,168 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Data.SqlXml\bb6628ba038af0338f17dabdbab841f5\System.Data.SqlXml.ni.dll
+ 2007-11-27 13:46:01 6,676,480 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Data\6334a22c6f63f7b3546f45beaa94b26f\System.Data.ni.dll
+ 2007-11-27 14:03:40 1,724,416 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Deployment\f6737d7ce1aee6fe30cc30b6f632427f\System.Deployment.ni.dll
+ 2007-11-27 13:47:01 10,702,848 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Design\f29708ad1d27d02f3895d1373709bd95\System.Design.ni.dll
+ 2007-11-27 14:18:36 1,216,512 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\2af5c0a391feb34fb28784b04544db32\System.DirectoryServices.ni.dll
+ 2007-11-27 14:26:52 512,000 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\a9cccbfc54b486a05058b821fe4c5722\System.DirectoryServices.Protocols.ni.dll
+ 2007-11-27 13:47:46 229,376 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing.Desi#\2f9d557ed8ec9d4ab603340584a5e31a\System.Drawing.Design.ni.dll
+ 2007-11-27 13:47:29 1,601,536 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\a3c3ca7943153305cceae64be729741f\System.Drawing.ni.dll
+ 2007-11-27 14:18:31 659,456 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\85f89d281bcdbf753bdaed4f50350856\System.EnterpriseServices.ni.dll
+ 2007-11-27 14:18:31 294,912 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\85f89d281bcdbf753bdaed4f50350856\System.EnterpriseServices.Wrapper.dll
+ 2007-11-27 13:58:49 241,664 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.IdentityMode#\33558ffb656849eba295219dad2176ce\System.IdentityModel.Selectors.ni.dll
+ 2007-11-27 13:58:43 987,136 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\788d8471dae9435bb21c34c5ebb3431e\System.IdentityModel.ni.dll
+ 2007-11-27 13:58:54 421,888 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.IO.Log\7fa910297c63debf4fa79e994111159d\System.IO.Log.ni.dll
+ 2007-11-27 14:33:33 655,360 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Messaging\263acea21b038fffd38852b7bba77731\System.Messaging.ni.dll
+ 2007-11-27 14:30:28 1,118,208 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Printing\5ad29d3806578070dd1fac650b6f08af\System.Printing.ni.dll
+ 2007-11-27 14:18:41 815,104 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\f6862a239e880cfac7c5309328152655\System.Runtime.Remoting.ni.dll
+ 2007-11-27 13:59:10 2,363,392 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\466017482568dd78800b34ca3dcf99e4\System.Runtime.Serialization.ni.dll
+ 2007-11-27 14:03:26 339,968 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\8d489cee2b0dac219dd01363140bf19d\System.Runtime.Serialization.Formatters.Soap.ni.dll
+ 2007-11-27 14:03:09 729,088 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Security\2409050f43cb17e664265e5cd29a475b\System.Security.ni.dll
+ 2007-11-27 14:00:32 17,534,976 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\75390ce0849a22440c0b68bc60de225d\System.ServiceModel.ni.dll
+ 2007-11-27 14:02:16 229,376 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\bb4c72a3aab7ba7ecbd347d3be370653\System.ServiceProcess.ni.dll
+ 2007-11-27 14:32:27 2,031,616 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Speech\f3fb7bcd8480e96c9db05509976467f0\System.Speech.ni.dll
+ 2007-11-27 14:18:25 684,032 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Transactions\946161a2b487e1dc6fc188c8f94ac66c\System.Transactions.ni.dll
+ 2007-11-27 14:32:40 2,306,048 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\10e5df087fba917a241932c33ae2fa68\System.Web.Mobile.ni.dll
+ 2007-11-27 14:26:49 237,568 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\0c73981ec3c78319f11b336e63c41aff\System.Web.RegularExpressions.ni.dll
+ 2007-11-27 14:26:40 1,941,504 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web.Services\9928304218943fdb333f4ef45a34968a\System.Web.Services.ni.dll
+ 2007-11-27 14:26:34 12,185,600 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\aba6f71f96b908be1ae19a2e3d970c16\System.Web.ni.dll
+ 2007-11-27 13:48:58 13,107,200 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\44b63a4553afc59e2105799794916770\System.Windows.Forms.ni.dll
+ 2007-11-27 14:32:53 2,994,176 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Workflow.Act#\0db9aee31d27403838db691571604356\System.Workflow.Activities.ni.dll
+ 2007-11-27 14:33:08 4,587,520 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Workflow.Com#\d05fbef582bdb5400e8c9145517abffd\System.Workflow.ComponentModel.ni.dll
+ 2007-11-27 14:33:29 2,101,248 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Workflow.Run#\78ee153957b1966b2d490f87421855d8\System.Workflow.Runtime.ni.dll
+ 2007-11-27 13:49:40 5,623,808 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\e8d990be2c40ca192d69b41834be7e5b\System.Xml.ni.dll
+ 2007-11-27 13:45:22 8,130,560 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\d51a58b0f66ae910beba3571e3923408\System.ni.dll
+ 2007-11-27 14:04:17 3,272,704 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP466.tmp\WindowsBase.dll
+ 2007-11-27 14:34:08 483,328 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\UIAutomationClient\d2dd2c38dc0c698310795244d63c01d1\UIAutomationClient.ni.dll
+ 2007-11-27 14:34:26 1,118,208 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\UIAutomationClients#\ee52009340075300abc7816e4634af37\UIAutomationClientsideProviders.ni.dll
+ 2007-11-27 14:27:01 50,688 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\UIAutomationProvider\0a894585155e1e59e9533e27b3713322\UIAutomationProvider.ni.dll
+ 2007-11-27 14:27:04 196,608 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\UIAutomationTypes\52399827206c1ec612b3493e298bf6b8\UIAutomationTypes.ni.dll
+ 2007-11-27 14:17:15 3,272,704 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\WindowsBase\8e80965b956c67e3323008f2e31ed2c3\WindowsBase.ni.dll
+ 2007-11-27 14:35:11 274,432 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\47e3eeb097652189b49c015118279fd0\WindowsFormsIntegration.ni.dll
+ 2007-11-27 14:01:52 380,928 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\WsatConfig\83a32e838087b01604ad25c7959b7b6c\WsatConfig.ni.exe
+ 2007-11-28 03:45:54 118,784 —-a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a_30243bde\CustomMarshalers.dll
+ 2007-11-28 03:44:30 61,440 —-a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a_f0065b51\CustomMarshalers.dll
+ 2007-11-28 03:46:20 8,908,800 —-a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_448d7fb4\mscorlib.dll
+ 2007-11-28 03:45:29 3,391,488 —-a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_457f13ff\mscorlib.dll
+ 2007-11-28 03:46:10 3,395,584 —-a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\System.Design\1.0.5000.0__b03f5f7f11d50a3a_a40dbfb0\System.Design.dll
+ 2007-11-28 03:45:17 1,470,464 —-a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\System.Design\1.0.5000.0__b03f5f7f11d50a3a_e6144c54\System.Design.dll
+ 2007-11-28 03:44:36 90,112 —-a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a_290096ea\System.Drawing.Design.dll
+ 2007-11-28 03:45:55 192,512 —-a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a_6341caf9\System.Drawing.Design.dll
+ 2007-11-28 03:46:13 2,244,608 —-a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a_ef089a77\System.Drawing.dll
+ 2007-11-28 03:45:22 835,584 —-a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a_f260a1f2\System.Drawing.dll
+ 2007-11-28 03:46:02 7,884,800 —-a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\System.Windows.Forms\1.0.5000.0__b77a5c561934e089_4226fbe7\System.Windows.Forms.dll
+ 2007-11-28 03:44:53 3,018,752 —-a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\System.Windows.Forms\1.0.5000.0__b77a5c561934e089_7429eaf6\System.Windows.Forms.dll
+ 2007-11-28 03:46:06 5,513,216 —-a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\System.Xml\1.0.5000.0__b77a5c561934e089_5ba6f380\System.Xml.dll
+ 2007-11-28 03:45:05 2,088,960 —-a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\System.Xml\1.0.5000.0__b77a5c561934e089_68b87d06\System.Xml.dll
+ 2007-11-28 03:44:24 1,966,080 —-a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\System\1.0.5000.0__b77a5c561934e089_0d761b87\System.dll
+ 2007-11-28 03:45:53 4,788,224 —-a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\System\1.0.5000.0__b77a5c561934e089_755a4680\System.dll
+ 2007-11-26 15:24:39 835,584 ——w C:\WINDOWS\assembly\temp\28DJOUZ5AG\System.Drawing.dll
+ 2007-11-26 15:23:04 1,953,792 ——w C:\WINDOWS\assembly\temp\6CINTY39EK\System.dll
+ 2007-11-26 15:24:06 2,088,960 ——w C:\WINDOWS\assembly\temp\HOTZ4AGLRW\System.Xml.dll
+ 2007-11-26 15:24:52 3,379,200 ——w C:\WINDOWS\assembly\temp\IPV17DIOTZ\mscorlib.dll
+ 2007-11-26 15:22:40 1,224,704 ——w C:\WINDOWS\assembly\temp\OV16CIOTZ5\System.dll
+ 2005-10-20 08:01:18 45,056 ——w C:\WINDOWS\Cache\MSDERelASP4\MSDEInstall.exe
+ 2004-04-25 15:41:54 1,494,280 ——w C:\WINDOWS\Cache\MSDERelASP4\Msi\InstMsi.exe
+ 2004-04-25 15:41:54 1,709,896 ——w C:\WINDOWS\Cache\MSDERelASP4\Msi\InstMsi20.exe
+ 2004-04-25 15:41:54 1,505,032 ——w C:\WINDOWS\Cache\MSDERelASP4\Msi\InstMsiW.exe
+ 2004-04-25 15:41:54 1,821,008 ——w C:\WINDOWS\Cache\MSDERelASP4\Msi\InstMsiW20.exe
+ 2004-11-29 08:06:00 348,160 ——w C:\WINDOWS\Cache\MSDERelASP4\msvcr71.dll
+ 2005-05-03 18:34:38 237,568 ——w C:\WINDOWS\Cache\MSDERelASP4\setup.exe
+ 2005-05-03 20:02:24 126,976 ——w C:\WINDOWS\Cache\MSDERelASP4\sqdedev.dll
+ 2005-05-03 20:02:26 35,840 ——w C:\WINDOWS\Cache\MSDERelASP4\sqlresld.dll
+ 2005-05-03 20:02:26 278,528 ——w C:\WINDOWS\Cache\MSDERelASP4\sqlsut.dll
+ 2005-05-03 20:02:22 192,512 ——w C:\WINDOWS\Cache\MSDERelASP4\sqlunirl.dll
+ 2006-02-15 00:22:26 142,464 ——w C:\WINDOWS\Driver Cache\i386\aec.sys
+ 2006-03-17 00:33:10 262,784 ——w C:\WINDOWS\Driver Cache\i386\http.sys
+ 2006-06-14 08:47:45 172,416 ——w C:\WINDOWS\Driver Cache\i386\kmixer.sys
- 2005-03-02 00:57:44 2,135,552 ——w C:\WINDOWS\Driver Cache\i386\ntkrnlmp.exe
+ 2007-02-28 09:08:48 2,136,064 ——w C:\WINDOWS\Driver Cache\i386\ntkrnlmp.exe
- 2005-03-02 00:34:40 2,056,832 ——w C:\WINDOWS\Driver Cache\i386\ntkrnlpa.exe
+ 2007-02-28 08:38:55 2,057,600 ——w C:\WINDOWS\Driver Cache\i386\ntkrnlpa.exe
- 2005-03-02 00:34:42 2,015,232 ——w C:\WINDOWS\Driver Cache\i386\ntkrpamp.exe
+ 2007-02-28 08:38:57 2,015,744 ——w C:\WINDOWS\Driver Cache\i386\ntkrpamp.exe
- 2005-03-02 00:59:53 2,179,328 ——w C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe
+ 2007-02-28 09:10:57 2,180,352 ——w C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe
+ 2006-06-14 08:47:46 6,400 ——w C:\WINDOWS\Driver Cache\i386\splitter.sys
+ 2006-06-14 09:00:45 82,944 ——w C:\WINDOWS\Driver Cache\i386\wdmaud.sys
+ 2004-12-03 08:26:26 356,352 —-a-w C:\WINDOWS\eSellerateEngine.dll
- 2004-08-03 21:56:50 1,032,192 —-a-w C:\WINDOWS\explorer.exe
+ 2007-06-13 10:23:07 1,033,216 —-a-w C:\WINDOWS\explorer.exe
+ 2007-03-06 01:22:41 213,216 -c—-w C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe
+ 2007-03-06 01:23:51 371,424 -c—-w C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\updspapi.dll
+ 2007-08-13 15:54:10 765,952 -c—-w C:\WINDOWS\ie7updates\KB938127-IE7\vgx.dll
+ 2007-08-13 15:39:00 123,904 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\advpack.dll
+ 2007-08-13 15:35:38 214,528 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\dxtrans.dll
+ 2007-08-13 15:54:10 131,584 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\extmgr.dll
+ 2007-08-13 15:36:26 61,952 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\icardie.dll
+ 2007-08-13 15:39:06 54,784 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\ie4uinit.exe
+ 2007-08-13 15:39:26 152,064 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\ieakeng.dll
+ 2007-08-13 15:39:54 229,376 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\ieaksie.dll
+ 2007-08-13 14:56:54 161,792 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\ieakui.dll
+ 2007-02-12 13:10:12 2,451,312 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\ieapfltr.dat
+ 2007-07-11 09:27:48 383,488 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\ieapfltr.dll
+ 2007-08-13 15:39:50 382,976 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\iedkcs32.dll
+ 2007-08-13 15:54:10 6,049,280 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\ieframe.dll
+ 2007-08-13 15:39:10 43,008 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\iernonce.dll
+ 2007-08-13 15:34:04 266,752 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\iertutil.dll
+ 2007-08-13 15:39:10 13,312 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\ieudinit.exe
+ 2007-08-13 15:43:56 622,080 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\iexplore.exe
+ 2007-08-13 15:54:10 27,136 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\jsproxy.dll
+ 2007-08-13 15:54:10 458,752 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\msfeeds.dll
+ 2007-08-13 15:54:10 50,688 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\msfeedsbs.dll
+ 2007-08-13 15:54:12 3,578,368 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\mshtml.dll
+ 2007-08-13 15:54:10 475,648 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\mshtmled.dll
+ 2007-08-13 15:44:26 192,000 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\msrating.dll
+ 2007-08-13 15:54:10 670,720 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\mstime.dll
+ 2007-08-13 15:44:06 101,376 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\occache.dll
+ 2007-03-06 01:22:41 213,216 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\spuninst\spuninst.exe
+ 2007-03-06 01:23:51 371,424 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\spuninst\updspapi.dll
+ 2007-08-13 15:44:30 105,984 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\url.dll
+ 2007-08-13 15:54:10 1,162,240 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\urlmon.dll
+ 2007-08-13 15:54:10 231,424 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\webcheck.dll
+ 2007-08-13 15:54:10 818,688 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\wininet.dll
- 2006-10-18 18:04:50 315,904 —-a-w C:\WINDOWS\inf\unregmp2.exe
+ 2007-06-26 19:10:26 317,440 —-a-w C:\WINDOWS\inf\unregmp2.exe
+ 2006-10-26 16:48:14 434,528 —-a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\DWTRIG20.EXE
+ 2006-10-27 12:07:36 17,891,112 —-a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\EXCEL.EXE
+ 2006-10-27 12:26:40 16,870,712 —-a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\MSO.DLL
+ 2006-10-27 12:04:10 9,581,360 —-a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\MSPUB.EXE
+ 2006-10-26 17:42:36 8,423,224 —-a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\OARTCONV.DLL
+ 2006-10-27 12:16:46 2,939,704 —-a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\OLMAPI32.DLL
+ 2006-09-15 13:25:18 3,611,416 —-a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\OUTLFLTR.DAT
+ 2006-10-27 12:16:48 12,813,096 —-a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\OUTLOOK.EXE
+ 2006-10-26 17:09:44 590,144 —-a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\PUBCONV.DLL
+ 2006-10-26 17:55:44 263,520 —-a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\SCNPST32.DLL
+ 2006-10-26 17:55:44 272,744 —-a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\SCNPST64.DLL
+ 2006-10-27 12:11:38 4,235,560 —-a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\WRD12CNV.DLL
+ 2006-10-27 12:11:36 21,264 —-a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\WRD12EXE.EXE
+ 2006-10-27 12:23:08 17,483,560 —-a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\WWLIB.DLL
+ 2006-10-26 18:13:08 14,674,216 —-a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\XL12CNV.EXE
- 2007-10-21 15:33:33 1,165,584 —-a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\accicons.exe
+ 2007-11-27 14:08:29 1,165,584 —-a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\accicons.exe
- 2007-10-21 15:33:36 20,240 —-a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\cagicon.exe
+ 2007-11-27 14:08:31 20,240 —-a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\cagicon.exe
- 2007-10-21 15:33:35 159,504 —-a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\inficon.exe
+ 2007-11-27 14:08:30 159,504 —-a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\inficon.exe
- 2007-10-21 15:33:35 184,080 —-a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\joticon.exe
+ 2007-11-27 14:08:30 184,080 —-a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\joticon.exe
- 2007-10-21 15:33:36 217,864 —-a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\misc.exe
+ 2007-11-27 14:08:31 217,864 —-a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\misc.exe
- 2007-10-21 15:33:36 18,704 —-a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\mspicons.exe
+ 2007-11-27 14:08:31 18,704 —-a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\mspicons.exe
- 2007-10-21 15:33:36 35,088 —-a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\oisicon.exe
+ 2007-11-27 14:08:32 35,088 —-a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\oisicon.exe
- 2007-10-21 15:33:35 845,584 —-a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe
+ 2007-11-27 14:08:30 845,584 —-a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe
- 2007-10-21 15:33:36 922,384 —-a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pptico.exe
+ 2007-11-27 14:08:30 922,384 —-a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pptico.exe
- 2007-10-21 15:33:36 272,648 —-a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pubs.exe
+ 2007-11-27 14:08:31 272,648 —-a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pubs.exe
- 2007-10-21 15:33:36 888,080 —-a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\wordicon.exe
+ 2007-11-27 14:08:31 888,080 —-a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\wordicon.exe
- 2007-10-21 15:33:35 1,172,240 —-a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\xlicons.exe
+ 2007-11-27 14:08:30 1,172,240 —-a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\xlicons.exe
+ 2007-11-26 14:25:33 29,926 —-a-r C:\WINDOWS\Installer\{A77F3C2D-50CC-4A29-A1FB-1E018BE4DCA2}\ARPPRODUCTICON.exe
+ 2007-11-27 13:23:47 32,768 —-a-r C:\WINDOWS\Installer\{C04E32E0-0416-434D-AFB9-6969D703A9EF}\icon.exe
+ 2007-11-26 14:25:57 29,926 —-a-r C:\WINDOWS\Installer\{EEECE229-49F6-4851-A73A-99B058221F8C}\ARPPRODUCTICON.exe

combofix log part #2

+ 2003-02-20 23:59:44 16,896 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\1033\alinkui.dll
+ 2003-02-21 00:55:06 94,208 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\1033\cscompui.dll
+ 2003-02-21 00:02:16 131,072 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\1033\vbc7ui.dll
+ 2003-02-21 02:04:20 155,648 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\1033\Vsavb7rtUI.dll
+ 2003-02-21 04:24:08 7,680 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Accessibility.dll
+ 2003-02-21 02:00:36 98,304 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\alink.dll
+ 2003-02-20 16:19:42 24,576 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_filter.dll
+ 2007-04-13 18:30:52 258,048 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_isapi.dll
+ 2003-02-20 16:19:22 40,960 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_rc.dll
+ 2004-07-14 22:49:18 20,480 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_regiis.exe
+ 2004-07-14 22:49:26 32,768 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
+ 2007-04-13 18:30:52 32,768 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe
+ 2002-07-29 08:11:50 219,136 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\c_g18030.dll
+ 2003-02-21 04:24:10 94,208 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\CasPol.exe
+ 2003-02-21 04:24:32 49,152 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ConfigWizards.exe
+ 2007-04-13 17:57:52 81,920 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\CORPerfMonExt.dll
+ 2004-07-15 08:23:28 49,152 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\csc.exe
+ 2004-07-15 08:23:44 626,688 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\cscomp.dll
+ 2003-02-21 04:24:34 12,288 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\cscompmgd.dll
+ 2003-02-21 04:24:36 33,792 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\CustomMarshalers.dll
+ 2003-02-21 01:12:24 28,672 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\cvtres.exe
+ 2003-02-21 07:21:40 524,288 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\diasymreader.dll
+ 2003-02-20 16:16:32 798,720 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\EventLogMessages.dll
+ 2004-07-14 21:24:30 282,624 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\fusion.dll
+ 2003-10-08 11:30:14 81,920 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\gacutil.exe
+ 2003-02-21 04:24:38 7,680 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\IEExec.exe
+ 2004-07-15 11:31:00 8,192 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\IEExecRemote.dll
+ 2004-07-15 11:31:04 32,768 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\IEHost.dll
+ 2003-02-21 04:24:40 4,608 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\IIEHost.dll
+ 2004-07-14 21:35:30 196,608 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ilasm.exe
+ 2003-02-21 04:24:42 15,872 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\InstallUtil.exe
+ 2003-02-20 16:22:24 40,960 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\InstallUtilLib.dll
+ 2003-02-21 04:24:44 26,112 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ISymWrapper.dll
+ 2003-02-21 04:24:52 40,960 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\jsc.exe
+ 2004-07-15 11:28:58 720,896 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Microsoft.JScript.dll
+ 2004-07-15 11:28:56 299,008 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Microsoft.VisualBasic.dll
+ 2003-02-21 04:24:54 28,672 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Microsoft.VisualBasic.Vsa.dll
+ 2003-02-21 04:25:02 6,144 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Microsoft.VisualC.Dll
+ 2003-02-21 04:24:58 32,768 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Microsoft.Vsa.dll
+ 2003-02-21 04:25:06 11,264 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
+ 2003-02-21 04:25:02 6,656 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Microsoft_VsaVb.dll
+ 2004-07-15 11:28:50 49,152 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\MigPol.exe
+ 2004-07-15 11:28:50 49,152 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\MigPolWin.exe
+ 2003-02-21 04:25:06 1,564,672 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorcfg.dll
+ 2004-07-14 21:32:44 86,016 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscordbc.dll
+ 2004-07-14 21:32:46 233,472 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscordbi.dll
+ 2007-04-13 17:57:58 86,016 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorie.dll
+ 2007-04-13 17:56:30 315,392 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorjit.dll
+ 2007-04-13 17:58:00 102,400 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorld.dll
+ 2007-04-13 17:50:46 2,142,208 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorlib.dll
+ 2003-02-20 15:43:52 131,072 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscormmc.dll
+ 2003-02-20 16:06:34 65,536 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorpe.dll
+ 2004-07-14 21:33:22 143,360 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorrc.dll
+ 2004-07-14 21:33:24 81,920 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsec.dll
+ 2007-04-13 17:58:02 77,824 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsn.dll
+ 2007-04-13 17:57:00 2,523,136 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll
+ 2003-02-20 16:09:24 9,216 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscortim.dll
+ 2007-04-13 17:57:28 2,514,944 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
+ 2003-02-21 01:42:22 348,160 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\msvcr71.dll
+ 2003-02-20 16:18:34 20,480 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mtxoci8.dll
+ 2003-02-20 15:43:36 22,528 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\MUI\0409\mscorsecr.dll
+ 2007-01-15 13:11:26 73,728 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\netfxupdate.exe
+ 2003-02-20 16:09:46 73,728 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ngen.exe
+ 2004-07-14 21:34:50 94,208 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\PerfCounter.dll
+ 2003-02-21 04:25:24 28,672 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\RegAsm.exe
+ 2004-07-15 11:28:48 32,768 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\RegCode.dll
+ 2003-02-21 04:25:30 12,288 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\RegSvcs.exe
+ 2004-07-14 22:49:16 258,048 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SHADOW2972\_aspnet_isapi.dll
+ 2004-07-14 21:32:22 81,920 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SHADOW2972\_CORPerfMonExt.dll
+ 2004-07-14 21:24:30 282,624 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SHADOW2972\_fusion.dll
+ 2004-07-14 21:25:06 315,392 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SHADOW2972\_mscorjit.dll
+ 2004-07-15 11:29:02 2,138,112 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SHADOW2972\_mscorlib.dll
+ 2003-02-20 16:09:18 77,824 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SHADOW2972\_mscorsn.dll
+ 2004-07-14 21:26:52 2,510,848 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SHADOW2972\_mscorsvr.dll
+ 2004-07-14 21:28:34 2,502,656 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SHADOW2972\_mscorwks.dll
+ 2003-02-21 01:42:22 348,160 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SHADOW2972\_msvcr71.dll
+ 2004-07-14 21:34:50 94,208 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SHADOW2972\_PerfCounter.dll
+ 2003-02-20 16:09:34 253,952 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\shfusion.dll
+ 2003-02-20 16:09:34 122,880 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\shfusres.dll
+ 2004-07-14 21:35:04 319,488 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SOS.dll
+ 2003-02-21 04:26:38 77,824 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Configuration.Install.dll
+ 2004-07-15 11:32:00 1,294,336 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Data.dll
+ 2004-07-15 11:31:14 303,104 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Data.OracleClient.dll
+ 2004-07-15 11:29:02 1,703,936 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Design.dll
+ 2004-07-15 11:28:54 90,112 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.DirectoryServices.dll
+ 2007-04-13 18:35:38 1,232,896 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.dll
+ 2003-02-21 04:26:48 65,536 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Drawing.Design.dll
+ 2004-07-15 11:28:58 466,944 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Drawing.dll
+ 2004-07-15 11:28:56 241,664 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.EnterpriseServices.dll
+ 2004-07-14 21:35:12 66,560 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.EnterpriseServices.Thunk.dll
+ 2004-07-15 11:31:58 372,736 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Management.dll
+ 2004-07-15 11:31:12 241,664 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Messaging.dll
+ 2004-07-15 11:28:58 323,584 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Runtime.Remoting.dll
+ 2004-07-15 11:31:54 131,072 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Runtime.Serialization.Formatters.Soap.dll
+ 2004-07-15 11:28:52 77,824 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Security.dll
+ 2004-07-15 11:28:54 126,976 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.ServiceProcess.dll
+ 2007-04-13 18:35:46 1,265,664 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Web.dll
+ 2004-07-15 11:28:58 819,200 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Web.Mobile.dll
+ 2004-07-15 11:28:52 57,344 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Web.RegularExpressions.dll
+ 2004-07-15 11:31:16 573,440 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Web.Services.dll
+ 2004-07-15 11:32:02 2,052,096 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Windows.Forms.dll
+ 2004-07-15 11:29:00 1,339,392 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.XML.dll
+ 2004-06-22 10:51:38 53,248 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe
+ 2004-07-15 08:23:20 737,280 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\vbc.exe
+ 2004-07-15 05:15:14 1,032,192 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\VsaVb7rt.dll
+ 2004-07-14 23:11:56 31,744 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\WMINet_Utils.dll
- 2005-09-23 11:28:58 55,488 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
+ 2007-04-13 00:21:18 58,712 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
- 2006-04-14 03:08:30 10,752 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_filter.dll
+ 2007-04-13 00:20:52 10,752 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_filter.dll
- 2005-09-23 11:28:32 8,192 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll
+ 2007-04-13 00:20:52 8,192 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll
- 2005-09-23 11:28:32 23,552 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Aspnet_perf.dll
+ 2007-04-13 00:20:52 23,552 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Aspnet_perf.dll
- 2005-09-23 11:28:32 70,656 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_rc.dll
+ 2007-04-13 00:20:50 75,264 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_rc.dll
- 2005-09-23 11:28:32 26,824 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe
+ 2007-04-13 00:20:52 32,608 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe
- 2005-09-23 11:28:32 29,896 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
+ 2007-04-13 00:20:52 33,632 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
- 2006-09-12 14:10:46 23,040 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe
+ 2007-04-13 00:20:52 32,600 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe
- 2005-09-23 11:28:32 503,808 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\AspNetMMCExt.dll
+ 2007-04-13 00:20:52 507,904 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\AspNetMMCExt.dll
- 2005-09-23 11:28:56 88,576 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CORPerfMonExt.dll
+ 2007-04-13 00:21:16 88,576 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CORPerfMonExt.dll
- 2005-09-23 11:28:38 4,608 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe
+ 2007-04-13 00:20:58 5,120 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe
- 2005-09-23 11:28:56 9,728 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IEExec.exe
+ 2007-04-13 00:21:16 9,728 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IEExec.exe
- 2005-09-23 11:28:56 224,952 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ilasm.exe
+ 2007-04-13 00:21:16 228,688 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ilasm.exe
- 2005-09-23 11:28:56 28,672 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
+ 2007-04-13 00:21:16 28,672 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
- 2005-09-23 11:28:48 413,696 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Engine.dll
+ 2007-04-13 00:21:10 413,696 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Engine.dll
- 2005-09-23 11:28:48 647,168 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Tasks.dll
+ 2007-04-13 00:21:10 647,168 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Tasks.dll
- 2005-09-23 11:28:48 745,472 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.JScript.dll
+ 2007-04-13 00:21:08 749,568 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.JScript.dll
- 2005-09-23 11:28:32 87,552 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MmcAspExt.dll
+ 2007-04-13 00:20:52 87,040 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MmcAspExt.dll
- 2005-09-23 11:28:56 800,768 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscordacwks.dll
+ 2007-04-13 00:21:18 802,304 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscordacwks.dll
- 2005-09-23 11:28:56 36,864 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorie.dll
+ 2007-04-13 00:21:16 36,864 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorie.dll
- 2005-09-23 11:28:56 326,144 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
+ 2007-04-13 00:21:16 326,656 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
- 2005-09-23 11:28:56 4,308,992 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll
+ 2007-04-13 00:21:16 4,308,992 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll
- 2005-09-23 11:28:56 102,400 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorpe.dll
+ 2007-04-13 00:21:16 102,912 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorpe.dll
- 2005-09-23 11:28:56 226,816 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvc.dll
+ 2007-04-13 00:21:18 227,328 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvc.dll
- 2005-09-23 11:28:56 66,240 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
+ 2007-04-13 00:21:18 68,952 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
- 2005-09-23 11:28:50 5,615,616 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
+ 2007-04-13 00:21:12 5,634,048 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
- 2005-09-23 11:28:56 96,440 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ngen.exe
+ 2007-04-13 00:21:16 99,152 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ngen.exe
- 2005-09-23 11:28:56 14,848 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\normalization.dll
+ 2007-04-13 00:21:18 15,360 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\normalization.dll
- 2005-09-23 11:28:50 136,192 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\peverify.dll
+ 2007-04-13 00:21:12 136,192 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\peverify.dll
- 2005-09-23 11:28:56 377,344 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\SOS.dll
+ 2007-04-13 00:21:18 382,464 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\SOS.dll
- 2005-09-23 11:28:56 110,592 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\sysglobl.dll
+ 2007-04-13 00:21:18 110,592 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\sysglobl.dll
- 2005-09-23 11:28:58 389,120 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.configuration.dll
+ 2007-04-13 00:21:18 413,696 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.configuration.dll
- 2005-09-23 11:28:56 2,878,976 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.dll
+ 2007-04-13 00:21:16 2,902,016 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.dll
- 2005-09-23 11:28:56 482,304 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.OracleClient.dll
+ 2007-04-13 00:21:18 482,304 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.OracleClient.dll
- 2005-09-23 11:28:56 716,800 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.SqlXml.dll
+ 2007-04-13 00:21:18 716,800 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.SqlXml.dll
- 2005-09-23 11:28:38 884,736 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Deployment.dll
+ 2007-04-13 00:20:58 888,832 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Deployment.dll
- 2005-09-23 11:28:56 5,050,368 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Design.dll
+ 2007-04-13 00:21:16 5,001,216 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Design.dll
- 2005-09-23 11:28:56 188,416 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.Protocols.dll
+ 2007-04-13 00:21:18 188,416 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.Protocols.dll
- 2005-09-23 11:28:56 3,018,752 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.dll
+ 2007-04-13 00:21:16 2,940,928 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.dll
- 2005-09-23 11:28:56 700,416 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Drawing.dll
+ 2007-04-13 00:21:16 577,536 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Drawing.dll
- 2005-09-23 11:28:56 258,048 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.dll
+ 2007-04-13 00:21:16 258,048 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.dll
- 2005-09-23 11:28:56 47,616 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Thunk.dll
+ 2007-04-13 00:21:18 47,616 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Thunk.dll
- 2005-09-23 11:28:56 114,176 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Wrapper.dll
+ 2007-04-13 00:21:18 114,176 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Wrapper.dll
- 2005-09-23 11:28:56 368,640 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Management.dll
+ 2007-04-13 00:21:16 372,736 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Management.dll
- 2005-09-23 11:28:56 299,008 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Remoting.dll
+ 2007-04-13 00:21:16 299,008 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Remoting.dll
- 2005-09-23 11:28:56 260,096 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Transactions.dll
+ 2007-04-13 00:21:18 260,096 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Transactions.dll
- 2006-09-12 14:11:12 5,029,888 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.dll
+ 2007-04-13 00:21:16 5,156,864 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.dll
- 2005-09-23 11:28:56 5,316,608 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Windows.Forms.dll
+ 2007-04-13 00:21:16 5,152,768 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Windows.Forms.dll
- 2005-09-23 11:28:56 2,035,712 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.XML.dll
+ 2007-04-13 00:21:16 2,027,520 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.XML.dll
- 2005-09-23 11:29:06 1,140,920 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe
+ 2007-04-13 00:21:28 1,166,672 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe
- 2005-09-23 11:28:30 1,306,624 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\VsaVb7rt.dll
+ 2007-04-13 00:20:50 1,330,688 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\VsaVb7rt.dll
- 2006-09-12 14:10:46 300,032 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\webengine.dll
+ 2007-04-13 00:20:52 406,016 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\webengine.dll
- 2004-08-03 21:56:42 41,984 —-a-w C:\WINDOWS\msagent\agentdp2.dll
+ 2006-10-12 14:02:52 42,496 —-a-w C:\WINDOWS\msagent\agentdp2.dll
- 2005-04-22 05:06:42 57,344 —-a-w C:\WINDOWS\msagent\agentdpv.dll
+ 2007-03-09 13:46:24 57,344 —-a-w C:\WINDOWS\msagent\agentdpv.dll
- 2004-08-03 21:56:48 256,512 —-a-w C:\WINDOWS\msagent\agentsvr.exe
+ 2006-10-12 11:09:53 256,512 —-a-w C:\WINDOWS\msagent\agentsvr.exe
- 2007-08-13 15:39:00 123,904 —-a-w C:\WINDOWS\system32\advpack.dll
+ 2007-08-20 10:04:34 124,928 —-a-w C:\WINDOWS\system32\advpack.dll
+ 2005-01-10 08:45:56 19,456 —-a-w C:\WINDOWS\system32\asapi.dll
+ 2006-07-13 23:53:50 39,936 —-a-w C:\WINDOWS\system32\CacheX.dll
+ 2005-05-03 21:02:26 20,480 —-a-w C:\WINDOWS\system32\DBmsLPCn.dll
- 2007-08-13 15:39:00 123,904 -c–a-w C:\WINDOWS\system32\dllcache\advpack.dll
+ 2007-08-20 10:04:34 124,928 -c–a-w C:\WINDOWS\system32\dllcache\advpack.dll
+ 2006-10-12 14:02:52 42,496 -c–a-w C:\WINDOWS\system32\dllcache\agentdp2.dll
- 2005-04-22 05:06:42 57,344 -c–a-w C:\WINDOWS\system32\dllcache\agentdpv.dll
+ 2007-03-09 13:46:24 57,344 -c–a-w C:\WINDOWS\system32\dllcache\agentdpv.dll
+ 2006-10-12 11:09:53 256,512 -c–a-w C:\WINDOWS\system32\dllcache\agentsvr.exe
+ 2007-05-16 15:12:00 86,528 -c–a-w C:\WINDOWS\system32\dllcache\directdb.dll
+ 2006-08-22 01:05:26 498,742 -c–a-w C:\WINDOWS\system32\dllcache\dxmasf.dll
- 2007-08-13 15:35:38 214,528 -c–a-w C:\WINDOWS\system32\dllcache\dxtrans.dll
+ 2007-08-20 10:04:34 214,528 -c–a-w C:\WINDOWS\system32\dllcache\dxtrans.dll
+ 2007-06-13 10:23:07 1,033,216 -c–a-w C:\WINDOWS\system32\dllcache\explorer.exe
- 2007-08-13 15:54:10 131,584 -c–a-w C:\WINDOWS\system32\dllcache\extmgr.dll
+ 2007-08-20 10:04:34 132,608 -c–a-w C:\WINDOWS\system32\dllcache\extmgr.dll
- 2006-10-14 13:43:18 27,648 -c–a-w C:\WINDOWS\system32\dllcache\FilterPipelinePrintProc.dll
+ 2007-03-22 17:24:58 28,160 -c–a-w C:\WINDOWS\system32\dllcache\FilterPipelinePrintProc.dll
+ 2007-06-19 13:31:19 282,112 -c–a-w C:\WINDOWS\system32\dllcache\gdi32.dll
+ 2007-08-20 10:04:34 63,488 -c–a-w C:\WINDOWS\system32\dllcache\icardie.dll
- 2007-08-13 15:39:06 54,784 -c–a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe
+ 2007-08-17 10:20:54 63,488 -c–a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe
- 2007-08-13 15:39:26 152,064 -c–a-w C:\WINDOWS\system32\dllcache\ieakeng.dll
+ 2007-08-20 10:04:34 153,088 -c–a-w C:\WINDOWS\system32\dllcache\ieakeng.dll
- 2007-08-13 15:39:54 229,376 -c–a-w C:\WINDOWS\system32\dllcache\ieaksie.dll
+ 2007-08-20 10:04:35 230,400 -c–a-w C:\WINDOWS\system32\dllcache\ieaksie.dll
- 2007-08-13 14:56:54 161,792 -c–a-w C:\WINDOWS\system32\dllcache\ieakui.dll
+ 2007-08-17 07:34:25 161,792 -c–a-w C:\WINDOWS\system32\dllcache\ieakui.dll
+ 2007-04-17 09:32:38 2,455,488 -c–a-w C:\WINDOWS\system32\dllcache\ieapfltr.dat
- 2007-07-11 09:27:48 383,488 -c–a-w C:\WINDOWS\system32\dllcache\ieapfltr.dll
+ 2007-08-20 10:04:35 383,488 -c–a-w C:\WINDOWS\system32\dllcache\ieapfltr.dll
- 2007-08-13 15:39:50 382,976 -c–a-w C:\WINDOWS\system32\dllcache\iedkcs32.dll
+ 2007-08-20 10:04:35 384,512 -c–a-w C:\WINDOWS\system32\dllcache\iedkcs32.dll
- 2007-08-13 15:54:10 6,049,280 -c–a-w C:\WINDOWS\system32\dllcache\ieframe.dll
+ 2007-08-20 10:04:37 6,058,496 -c–a-w C:\WINDOWS\system32\dllcache\ieframe.dll
- 2007-08-13 15:39:10 43,008 -c–a-w C:\WINDOWS\system32\dllcache\iernonce.dll
+ 2007-08-20 10:04:38 44,544 -c–a-w C:\WINDOWS\system32\dllcache\iernonce.dll
+ 2007-08-20 10:04:38 267,776 -c–a-w C:\WINDOWS\system32\dllcache\iertutil.dll
+ 2007-08-17 10:20:54 13,824 -c–a-w C:\WINDOWS\system32\dllcache\ieudinit.exe
- 2007-08-13 15:43:56 622,080 -c–a-w C:\WINDOWS\system32\dllcache\iexplore.exe
+ 2007-08-17 10:21:21 625,152 -c–a-w C:\WINDOWS\system32\dllcache\iexplore.exe
+ 2007-08-21 06:15:44 683,520 -c–a-w C:\WINDOWS\system32\dllcache\inetcomm.dll
- 2007-08-13 15:54:10 27,136 -c–a-w C:\WINDOWS\system32\dllcache\jsproxy.dll
+ 2007-08-20 10:04:39 27,648 -c–a-w C:\WINDOWS\system32\dllcache\jsproxy.dll
- 2006-07-05 10:55:01 984,064 -c–a-w C:\WINDOWS\system32\dllcache\kernel32.dll
+ 2007-04-16 15:52:53 984,576 -c–a-w C:\WINDOWS\system32\dllcache\kernel32.dll
+ 2006-06-14 08:47:45 172,416 -c–a-w C:\WINDOWS\system32\dllcache\kmixer.sys
+ 2006-08-17 12:28:27 721,920 -c–a-w C:\WINDOWS\system32\dllcache\lsasrv.dll
+ 2006-10-04 08:48:36 72,704 -c–a-w C:\WINDOWS\system32\dllcache\magnify.exe
+ 2007-03-08 15:36:28 40,960 -c–a-w C:\WINDOWS\system32\dllcache\mf3216.dll
- 2002-08-29 05:00:00 924,432 -c–a-w C:\WINDOWS\system32\dllcache\mfc40u.dll
+ 2006-11-01 19:17:45 927,504 -c–a-w C:\WINDOWS\system32\dllcache\mfc40u.dll
+ 2006-10-14 08:13:25 981,760 -c–a-w C:\WINDOWS\system32\dllcache\mfc42u.dll
+ 2006-12-26 13:07:23 536,576 -c–a-w C:\WINDOWS\system32\dllcache\msado15.dll
+ 2006-12-26 13:07:23 180,224 -c–a-w C:\WINDOWS\system32\dllcache\msadomd.dll
+ 2006-12-26 13:07:23 200,704 -c–a-w C:\WINDOWS\system32\dllcache\msadox.dll
+ 2007-08-20 10:04:39 459,264 -c–a-w C:\WINDOWS\system32\dllcache\msfeeds.dll
+ 2007-08-20 10:04:39 52,224 -c–a-w C:\WINDOWS\system32\dllcache\msfeedsbs.dll
+ 2006-11-27 14:54:06 539,136 -c–a-w C:\WINDOWS\system32\dllcache\msftedit.dll
- 2007-08-13 15:54:12 3,578,368 -c–a-w C:\WINDOWS\system32\dllcache\mshtml.dll
+ 2007-08-20 10:04:41 3,584,512 -c–a-w C:\WINDOWS\system32\dllcache\mshtml.dll
- 2007-08-13 15:54:10 475,648 -c–a-w C:\WINDOWS\system32\dllcache\mshtmled.dll
+ 2007-08-20 10:04:41 477,696 -c–a-w C:\WINDOWS\system32\dllcache\mshtmled.dll
- 2005-05-04 18:45:32 2,890,240 -c–a-w C:\WINDOWS\system32\dllcache\msi.dll
+ 2007-04-18 16:12:23 2,854,400 -c–a-w C:\WINDOWS\system32\dllcache\msi.dll
+ 2006-12-26 13:07:23 102,400 -c–a-w C:\WINDOWS\system32\dllcache\msjro.dll
+ 2007-05-16 15:12:08 1,314,816 -c–a-w C:\WINDOWS\system32\dllcache\msoe.dll
- 2007-08-13 15:44:26 192,000 -c–a-w C:\WINDOWS\system32\dllcache\msrating.dll
+ 2007-08-20 10:04:41 193,024 -c–a-w C:\WINDOWS\system32\dllcache\msrating.dll
- 2006-10-18 19:47:16 414,208 -c–a-w C:\WINDOWS\system32\dllcache\msscp.dll
+ 2006-12-04 13:21:50 414,720 -c–a-w C:\WINDOWS\system32\dllcache\msscp.dll
- 2007-08-13 15:54:10 670,720 -c–a-w C:\WINDOWS\system32\dllcache\mstime.dll
+ 2007-08-20 10:04:42 671,232 -c–a-w C:\WINDOWS\system32\dllcache\mstime.dll
- 2006-09-13 05:01:56 1,084,416 -c–a-w C:\WINDOWS\system32\dllcache\msxml3.dll
+ 2007-06-26 06:08:16 1,104,896 -c–a-w C:\WINDOWS\system32\dllcache\msxml3.dll
+ 2006-10-04 08:48:36 53,760 -c–a-w C:\WINDOWS\system32\dllcache\narrator.exe
- 2006-07-14 15:31:39 332,288 -c–a-w C:\WINDOWS\system32\dllcache\netapi32.dll
+ 2006-08-17 12:28:27 332,288 -c–a-w C:\WINDOWS\system32\dllcache\netapi32.dll
+ 2007-02-09 11:10:35 574,464 -c–a-w C:\WINDOWS\system32\dllcache\ntfs.sys
+ 2007-02-28 09:08:48 2,136,064 -c–a-w C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
+ 2007-02-28 08:38:55 2,057,600 -c–a-w C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
+ 2007-02-28 08:38:57 2,015,744 -c–a-w C:\WINDOWS\system32\dllcache\ntkrpamp.exe
+ 2007-02-28 09:10:57 2,180,352 -c–a-w C:\WINDOWS\system32\dllcache\ntoskrnl.exe
+ 2006-10-13 12:35:12 142,336 -c–a-w C:\WINDOWS\system32\dllcache\nwprovau.dll
- 2007-08-13 15:44:06 101,376 -c–a-w C:\WINDOWS\system32\dllcache\occache.dll
+ 2007-08-20 10:04:42 102,400 -c–a-w C:\WINDOWS\system32\dllcache\occache.dll
+ 2007-05-17 11:28:05 549,376 -c–a-w C:\WINDOWS\system32\dllcache\oleaut32.dll
- 2002-08-29 05:00:00 117,760 -c–a-w C:\WINDOWS\system32\dllcache\oledlg.dll
+ 2006-10-16 16:15:00 122,880 -c–a-w C:\WINDOWS\system32\dllcache\oledlg.dll
+ 2006-10-04 08:48:37 215,552 -c–a-w C:\WINDOWS\system32\dllcache\osk.exe
- 2006-10-14 13:44:44 671,744 -c–a-w C:\WINDOWS\system32\dllcache\PrintFilterPipelineSvc.exe
+ 2007-03-22 17:25:42 677,376 -c–a-w C:\WINDOWS\system32\dllcache\PrintFilterPipelineSvc.exe
+ 2006-11-27 14:54:06 433,152 -c–a-w C:\WINDOWS\system32\dllcache\riched20.dll
+ 2007-04-25 14:21:15 144,896 -c–a-w C:\WINDOWS\system32\dllcache\schannel.dll
- 2006-07-13 13:33:27 8,453,632 -c–a-w C:\WINDOWS\system32\dllcache\shell32.dll
+ 2007-10-26 03:36:51 8,454,656 -c–a-w C:\WINDOWS\system32\dllcache\shell32.dll
+ 2006-12-19 21:52:18 134,656 -c–a-w C:\WINDOWS\system32\dllcache\shsvcs.dll
+ 2006-06-14 08:47:46 6,400 -c–a-w C:\WINDOWS\system32\dllcache\splitter.sys
+ 2006-08-21 06:52:08 246,814 -c–a-w C:\WINDOWS\system32\dllcache\strmdll.dll
+ 2006-10-19 13:56:32 713,216 -c–a-w C:\WINDOWS\system32\dllcache\sxs.dll
+ 2006-10-04 13:33:38 35,840 -c–a-w C:\WINDOWS\system32\dllcache\umandlg.dll
- 2006-10-18 18:04:50 315,904 -c–a-w C:\WINDOWS\system32\dllcache\unregmp2.exe
+ 2007-06-26 19:10:26 317,440 -c–a-w C:\WINDOWS\system32\dllcache\unregmp2.exe
+ 2007-04-23 10:32:54 364,160 -c–a-w C:\WINDOWS\system32\dllcache\update.sys
+ 2007-02-05 20:17:02 185,344 -c–a-w C:\WINDOWS\system32\dllcache\upnphost.dll
- 2007-08-13 15:44:30 105,984 -c–a-w C:\WINDOWS\system32\dllcache\url.dll
+ 2007-08-20 10:04:42 105,984 -c–a-w C:\WINDOWS\system32\dllcache\url.dll
- 2007-08-13 15:54:10 1,162,240 -c–a-w C:\WINDOWS\system32\dllcache\urlmon.dll
+ 2007-08-20 10:04:42 1,152,000 -c–a-w C:\WINDOWS\system32\dllcache\urlmon.dll
+ 2007-03-08 15:36:28 577,536 -c–a-w C:\WINDOWS\system32\dllcache\user32.dll
+ 2006-10-04 08:48:37 50,176 -c–a-w C:\WINDOWS\system32\dllcache\utilman.exe
- 2007-08-13 15:54:10 765,952 -c–a-w C:\WINDOWS\system32\dllcache\VGX.dll
+ 2007-07-12 23:31:54 765,952 -c–a-w C:\WINDOWS\system32\dllcache\vgx.dll
+ 2007-05-16 15:12:12 510,976 -c–a-w C:\WINDOWS\system32\dllcache\wab32.dll
+ 2007-05-16 15:12:15 85,504 -c–a-w C:\WINDOWS\system32\dllcache\wabimp.dll
+ 2006-06-14 09:00:45 82,944 -c–a-w C:\WINDOWS\system32\dllcache\wdmaud.sys
- 2007-08-13 15:54:10 231,424 -c–a-w C:\WINDOWS\system32\dllcache\webcheck.dll
+ 2007-08-20 10:04:42 232,960 -c–a-w C:\WINDOWS\system32\dllcache\webcheck.dll
+ 2006-12-19 18:16:47 333,824 -c–a-w C:\WINDOWS\system32\dllcache\wiaservc.dll
+ 2007-03-08 13:47:48 1,843,584 -c–a-w C:\WINDOWS\system32\dllcache\win32k.sys
- 2007-08-13 15:54:10 818,688 -c–a-w C:\WINDOWS\system32\dllcache\wininet.dll
+ 2007-08-20 10:04:43 824,832 -c–a-w C:\WINDOWS\system32\dllcache\wininet.dll
+ 2007-03-17 13:43:01 292,864 -c–a-w C:\WINDOWS\system32\dllcache\winsrv.dll
+ 2006-08-17 12:28:27 132,096 -c–a-w C:\WINDOWS\system32\dllcache\wkssvc.dll
- 2006-10-14 17:21:58 580,352 -c–a-w C:\WINDOWS\system32\dllcache\XPSSHHDR.dll
+ 2007-03-23 03:07:54 583,504 -c–a-w C:\WINDOWS\system32\dllcache\XPSSHHDR.dll
- 2006-10-14 17:22:00 1,698,048 -c–a-w C:\WINDOWS\system32\dllcache\XpsSvcs.dll
+ 2007-03-23 03:07:56 1,683,280 -c–a-w C:\WINDOWS\system32\dllcache\XpsSvcs.dll
- 2004-08-03 19:39:38 142,464 —-a-w C:\WINDOWS\system32\drivers\aec.sys
+ 2006-02-15 00:22:26 142,464 —-a-w C:\WINDOWS\system32\drivers\aec.sys
+ 2005-02-23 15:40:26 11,264 —-a-w C:\WINDOWS\system32\drivers\asapiW2k.sys
- 2004-08-03 20:01:20 124,800 —-a-w C:\WINDOWS\system32\drivers\fltmgr.sys
+ 2006-08-21 09:14:58 128,896 —-a-w C:\WINDOWS\system32\drivers\fltmgr.sys
- 2004-08-03 20:00:14 263,040 —-a-w C:\WINDOWS\system32\drivers\http.sys
+ 2006-03-17 00:33:10 262,784 —-a-w C:\WINDOWS\system32\drivers\http.sys
- 2004-08-03 20:04:52 134,912 —-a-w C:\WINDOWS\system32\drivers\ipnat.sys
+ 2004-09-29 22:28:37 134,912 —-a-w C:\WINDOWS\system32\drivers\ipnat.sys
- 2004-08-03 20:07:50 171,776 —-a-w C:\WINDOWS\system32\drivers\kmixer.sys
+ 2006-06-14 08:47:45 172,416 —-a-w C:\WINDOWS\system32\drivers\kmixer.sys
+ 2005-07-13 13:55:22 171,008 —-a-w C:\WINDOWS\system32\drivers\MarvinBus.sys
+ 2006-05-08 21:27:22 426,624 —-a-w C:\WINDOWS\system32\drivers\MarvinUsb.sys
- 2004-08-03 20:15:10 574,592 —-a-w C:\WINDOWS\system32\drivers\ntfs.sys
+ 2007-02-09 11:10:35 574,464 —-a-w C:\WINDOWS\system32\drivers\ntfs.sys
+ 2005-02-09 09:59:00 14,165 —-a-w C:\WINDOWS\system32\drivers\Pclepci.sys
- 2004-08-03 20:07:48 6,400 —-a-w C:\WINDOWS\system32\drivers\splitter.sys
+ 2006-06-14 08:47:46 6,400 —-a-w C:\WINDOWS\system32\drivers\splitter.sys
- 2004-08-03 19:58:34 209,408 —-a-w C:\WINDOWS\system32\drivers\update.sys
+ 2007-04-23 10:32:54 364,160 —-a-w C:\WINDOWS\system32\drivers\update.sys
- 2004-08-03 20:15:06 82,944 —-a-w C:\WINDOWS\system32\drivers\wdmaud.sys
+ 2006-06-14 09:00:45 82,944 —-a-w C:\WINDOWS\system32\drivers\wdmaud.sys
- 2004-08-03 21:56:44 498,205 —-a-w C:\WINDOWS\system32\dxmasf.dll
+ 2006-08-22 01:05:26 498,742 —-a-w C:\WINDOWS\system32\dxmasf.dll
- 2007-08-13 15:35:38 214,528 —-a-w C:\WINDOWS\system32\dxtrans.dll
+ 2007-08-20 10:04:34 214,528 —-a-w C:\WINDOWS\system32\dxtrans.dll
- 2007-08-13 15:54:10 131,584 —-a-w C:\WINDOWS\system32\extmgr.dll
+ 2007-08-20 10:04:34 132,608 —-a-w C:\WINDOWS\system32\extmgr.dll
- 2004-08-03 21:56:44 16,896 —-a-w C:\WINDOWS\system32\fltlib.dll
+ 2006-08-21 12:21:06 16,896 —-a-w C:\WINDOWS\system32\fltlib.dll
- 2004-08-03 21:56:50 22,528 —-a-w C:\WINDOWS\system32\fltmc.exe
+ 2006-08-21 09:14:58 23,040 —-a-w C:\WINDOWS\system32\fltmc.exe
- 2007-10-21 17:45:23 276,560 —-a-w C:\WINDOWS\system32\FNTCACHE.DAT
+ 2007-11-27 14:21:10 296,456 —-a-w C:\WINDOWS\system32\FNTCACHE.DAT
- 2005-12-29 02:54:35 280,064 —-a-w C:\WINDOWS\system32\gdi32.dll
+ 2007-06-19 13:31:19 282,112 —-a-w C:\WINDOWS\system32\gdi32.dll
- 2007-08-13 15:36:26 61,952 —-a-w C:\WINDOWS\system32\icardie.dll
+ 2007-08-20 10:04:34 63,488 —-a-w C:\WINDOWS\system32\icardie.dll
- 2007-08-13 15:39:06 54,784 —-a-w C:\WINDOWS\system32\ie4uinit.exe
+ 2007-08-17 10:20:54 63,488 —-a-w C:\WINDOWS\system32\ie4uinit.exe
- 2007-08-13 15:39:26 152,064 —-a-w C:\WINDOWS\system32\ieakeng.dll
+ 2007-08-20 10:04:34 153,088 —-a-w C:\WINDOWS\system32\ieakeng.dll
- 2007-08-13 15:39:54 229,376 —-a-w C:\WINDOWS\system32\ieaksie.dll
+ 2007-08-20 10:04:35 230,400 —-a-w C:\WINDOWS\system32\ieaksie.dll
- 2007-08-13 14:56:54 161,792 —-a-w C:\WINDOWS\system32\ieakui.dll
+ 2007-08-17 07:34:25 161,792 —-a-w C:\WINDOWS\system32\ieakui.dll
- 2007-02-12 13:10:12 2,451,312 —-a-w C:\WINDOWS\system32\ieapfltr.dat
+ 2007-04-17 09:32:38 2,455,488 —-a-w C:\WINDOWS\system32\ieapfltr.dat
- 2007-07-11 09:27:48 383,488 —-a-w C:\WINDOWS\system32\ieapfltr.dll
+ 2007-08-20 10:04:35 383,488 —-a-w C:\WINDOWS\system32\ieapfltr.dll
- 2007-08-13 15:39:50 382,976 —-a-w C:\WINDOWS\system32\iedkcs32.dll
+ 2007-08-20 10:04:35 384,512 —-a-w C:\WINDOWS\system32\iedkcs32.dll
- 2007-08-13 15:54:10 6,049,280 —-a-w C:\WINDOWS\system32\ieframe.dll
+ 2007-08-20 10:04:37 6,058,496 —-a-w C:\WINDOWS\system32\ieframe.dll
- 2007-08-13 15:39:10 43,008 —-a-w C:\WINDOWS\system32\iernonce.dll
+ 2007-08-20 10:04:38 44,544 —-a-w C:\WINDOWS\system32\iernonce.dll
- 2007-08-13 15:34:04 266,752 —-a-w C:\WINDOWS\system32\iertutil.dll
+ 2007-08-20 10:04:38 267,776 —-a-w C:\WINDOWS\system32\iertutil.dll
- 2007-08-13 15:39:10 13,312 —-a-w C:\WINDOWS\system32\ieudinit.exe
+ 2007-08-17 10:20:54 13,824 —-a-w C:\WINDOWS\system32\ieudinit.exe
- 2004-08-03 21:56:44 678,400 —-a-w C:\WINDOWS\system32\inetcomm.dll
+ 2007-08-21 06:15:44 683,520 —-a-w C:\WINDOWS\system32\inetcomm.dll
- 2007-08-13 15:54:10 27,136 —-a-w C:\WINDOWS\system32\jsproxy.dll
+ 2007-08-20 10:04:39 27,648 —-a-w C:\WINDOWS\system32\jsproxy.dll
- 2006-07-05 10:55:01 984,064 —-a-w C:\WINDOWS\system32\kernel32.dll
+ 2007-04-16 15:52:53 984,576 —-a-w C:\WINDOWS\system32\kernel32.dll
+ 2003-11-04 20:40:24 30,208 —-a-w C:\WINDOWS\system32\lfbmp13n.dll
+ 2004-03-03 09:50:04 70,144 —-a-w C:\WINDOWS\system32\lfbmp13s.dll
+ 2003-11-13 20:41:54 393,216 —-a-w C:\WINDOWS\system32\LFCMP13n.DLL
+ 2004-03-03 09:50:04 409,600 —-a-w C:\WINDOWS\system32\LFCMP13s.DLL
+ 2002-09-24 08:12:46 79,360 —-a-w C:\WINDOWS\system32\lfeps13s.dll
+ 2003-11-04 17:37:46 73,728 —-a-w C:\WINDOWS\system32\lffax13n.dll
+ 2004-03-03 09:50:04 116,224 —-a-w C:\WINDOWS\system32\lffax13s.dll
+ 2002-09-24 08:12:46 74,752 —-a-w C:\WINDOWS\system32\lfgif13s.dll
+ 2003-11-04 20:40:24 278,016 —-a-w C:\WINDOWS\system32\LFJ2K13n.dll
+ 2004-03-03 09:50:04 283,648 —-a-w C:\WINDOWS\system32\LFJ2K13s.dll
+ 2004-03-03 09:50:04 59,904 —-a-w C:\WINDOWS\system32\lfpcd13s.dll
+ 2003-11-04 20:40:24 65,536 —-a-w C:\WINDOWS\system32\Lfpct13n.dll
+ 2004-03-03 09:50:04 105,984 —-a-w C:\WINDOWS\system32\lfpct13s.dll
+ 2004-03-03 09:50:04 65,536 —-a-w C:\WINDOWS\system32\lfpcx13s.dll
+ 2004-03-03 09:50:04 110,080 —-a-w C:\WINDOWS\system32\lfpsd13s.dll
+ 2003-11-04 20:40:24 24,576 —-a-w C:\WINDOWS\system32\lftga13n.dll
+ 2004-03-03 09:50:04 64,512 —-a-w C:\WINDOWS\system32\lftga13s.dll
+ 2003-11-04 20:40:24 143,360 —-a-w C:\WINDOWS\system32\lftif13n.dll
+ 2004-03-03 09:50:04 167,936 —-a-w C:\WINDOWS\system32\lftif13s.dll
+ 2003-11-06 18:27:22 76,800 —-a-w C:\WINDOWS\system32\Lfwmf13n.dll
+ 2004-03-03 09:50:04 80,896 —-a-w C:\WINDOWS\system32\lfwmf13s.dll
+ 2004-03-03 09:50:04 12,288 —-a-w C:\WINDOWS\system32\LMLRes.dll
+ 2004-03-03 09:50:04 884,736 —-a-w C:\WINDOWS\system32\LMUIRes.dll
- 2004-10-28 01:21:01 721,920 —-a-w C:\WINDOWS\system32\lsasrv.dll
+ 2006-08-17 12:28:27 721,920 —-a-w C:\WINDOWS\system32\lsasrv.dll
+ 2003-11-04 17:37:46 1,693,696 —-a-w C:\WINDOWS\system32\LTCLR13n.dll
+ 2004-03-03 09:50:04 2,079,232 —-a-w C:\WINDOWS\system32\LTCLR13s.dll
+ 2003-11-04 20:40:24 153,088 —-a-w C:\WINDOWS\system32\ltfil13n.DLL
+ 2003-11-04 17:37:46 453,120 —-a-w C:\WINDOWS\system32\ltkrn13n.dll
+ 2004-03-03 09:50:04 930,992 —-a-w C:\WINDOWS\system32\Ltr13n.dll
- 2004-08-03 21:56:52 72,704 —-a-w C:\WINDOWS\system32\magnify.exe
+ 2006-10-04 08:48:36 72,704 —-a-w C:\WINDOWS\system32\magnify.exe
- 2004-08-03 21:56:44 39,936 —-a-w C:\WINDOWS\system32\mf3216.dll
+ 2007-03-08 15:36:28 40,960 —-a-w C:\WINDOWS\system32\mf3216.dll
- 2002-08-29 05:00:00 924,432 —-a-w C:\WINDOWS\system32\mfc40u.dll
+ 2006-11-01 19:17:45 927,504 —-a-w C:\WINDOWS\system32\mfc40u.dll
- 2004-08-03 21:56:44 1,024,000 —-a-w C:\WINDOWS\system32\mfc42u.dll
+ 2006-10-14 08:13:25 981,760 —-a-w C:\WINDOWS\system32\mfc42u.dll
- 2002-01-04 23:48:16 974,848 —-a-w C:\WINDOWS\system32\mfc70.dll
+ 2002-01-05 01:48:16 974,848 —-a-w C:\WINDOWS\system32\MFC70.DLL
- 2002-01-04 23:36:38 964,608 —-a-w C:\WINDOWS\system32\mfc70u.dll
+ 2002-01-05 01:36:36 964,608 —-a-w C:\WINDOWS\system32\MFC70U.DLL
- 2003-03-18 17:20:00 1,060,864 —-a-w C:\WINDOWS\system32\mfc71.dll
+ 2004-05-14 03:07:12 1,060,864 —-a-w C:\WINDOWS\system32\MFC71.DLL
- 2003-03-18 17:12:12 1,047,552 —-a-w C:\WINDOWS\system32\mfc71u.dll
+ 2005-03-21 21:26:10 1,047,552 —-a-w C:\WINDOWS\system32\MFC71u.DLL
- 2007-09-27 19:19:40 18,089,592 —-a-w C:\WINDOWS\system32\MRT.exe
+ 2007-11-02 07:12:57 18,238,072 —-a-w C:\WINDOWS\system32\MRT.exe
- 2005-09-23 11:28:52 270,848 —-a-w C:\WINDOWS\system32\mscoree.dll
+ 2007-04-13 00:21:14 271,360 —-a-w C:\WINDOWS\system32\mscoree.dll
- 2007-08-13 15:54:10 458,752 —-a-w C:\WINDOWS\system32\msfeeds.dll
+ 2007-08-20 10:04:39 459,264 —-a-w C:\WINDOWS\system32\msfeeds.dll
- 2007-08-13 15:54:10 50,688 —-a-w C:\WINDOWS\system32\msfeedsbs.dll
+ 2007-08-20 10:04:39 52,224 —-a-w C:\WINDOWS\system32\msfeedsbs.dll
- 2004-08-03 21:56:44 537,088 —-a-w C:\WINDOWS\system32\msftedit.dll
+ 2006-11-27 14:54:06 539,136 —-a-w C:\WINDOWS\system32\msftedit.dll
- 2007-08-13 15:54:12 3,578,368 —-a-w C:\WINDOWS\system32\mshtml.dll
+ 2007-08-20 10:04:41 3,584,512 —-a-w C:\WINDOWS\system32\mshtml.dll
- 2007-08-13 15:54:10 475,648 —-a-w C:\WINDOWS\system32\mshtmled.dll
+ 2007-08-20 10:04:41 477,696 —-a-w C:\WINDOWS\system32\mshtmled.dll
- 2005-05-04 18:45:32 2,890,240 —-a-w C:\WINDOWS\system32\msi.dll
+ 2007-04-18 16:12:23 2,854,400 —-a-w C:\WINDOWS\system32\msi.dll
- 2007-08-13 15:44:26 192,000 —-a-w C:\WINDOWS\system32\msrating.dll
+ 2007-08-20 10:04:41 193,024 —-a-w C:\WINDOWS\system32\msrating.dll
- 2006-10-18 19:47:16 414,208 —-a-w C:\WINDOWS\system32\msscp.dll
+ 2006-12-04 13:21:50 414,720 —-a-w C:\WINDOWS\system32\msscp.dll
- 2007-08-13 15:54:10 670,720 —-a-w C:\WINDOWS\system32\mstime.dll
+ 2007-08-20 10:04:42 671,232 —-a-w C:\WINDOWS\system32\mstime.dll
- 2002-01-04 23:38:38 54,784 —-a-w C:\WINDOWS\system32\msvci70.dll
+ 2002-01-05 00:38:36 54,784 —-a-w C:\WINDOWS\system32\MSVCI70.DLL
- 2002-01-04 23:40:20 487,424 —-a-w C:\WINDOWS\system32\msvcp70.dll
+ 2003-03-26 04:58:30 487,424 —-a-w C:\WINDOWS\system32\MSVCP70.DLL
- 2003-03-18 16:14:52 499,712 —-a-w C:\WINDOWS\system32\msvcp71.dll
+ 2003-10-21 02:15:36 499,712 —-a-w C:\WINDOWS\system32\MSVCP71.DLL
- 2002-01-04 22:37:28 344,064 —-a-w C:\WINDOWS\system32\msvcr70.dll
+ 2003-02-04 03:08:00 344,064 —-a-w C:\WINDOWS\system32\MSVCR70.DLL
- 2003-02-21 00:42:22 348,160 —-a-w C:\WINDOWS\system32\msvcr71.dll
+ 2003-10-20 06:38:54 348,160 —-a-w C:\WINDOWS\system32\MSVCR71.DLL
- 2006-09-13 05:01:56 1,084,416 —-a-w C:\WINDOWS\system32\msxml3.dll
+ 2007-06-26 06:08:16 1,104,896 —-a-w C:\WINDOWS\system32\msxml3.dll
+ 2007-05-08 12:03:04 1,275,392 —-a-w C:\WINDOWS\system32\msxml4.dll
- 2006-09-01 09:08:02 1,334,032 —-a-w C:\WINDOWS\system32\msxml6.dll
+ 2007-05-15 12:43:10 1,320,800 —-a-w C:\WINDOWS\system32\msxml6.dll
+ 2003-02-20 15:43:36 4,096 —-a-w C:\WINDOWS\system32\mui\0409\mscoreer.dll
- 2005-09-23 11:29:00 6,144 —-a-w C:\WINDOWS\system32\mui\0409\mscorees.dll
+ 2006-12-22 10:02:36 6,144 —-a-w C:\WINDOWS\system32\mui\0409\mscorees.dll
- 2004-08-03 21:56:56 53,760 —-a-w C:\WINDOWS\system32\narrator.exe
+ 2006-10-04 08:48:36 53,760 —-a-w C:\WINDOWS\system32\narrator.exe
- 2006-07-14 15:31:39 332,288 —-a-w C:\WINDOWS\system32\netapi32.dll
+ 2006-08-17 12:28:27 332,288 —-a-w C:\WINDOWS\system32\netapi32.dll
- 2005-03-02 00:34:40 2,056,832 —-a-w C:\WINDOWS\system32\ntkrnlpa.exe
+ 2007-02-28 08:38:55 2,057,600 —-a-w C:\WINDOWS\system32\ntkrnlpa.exe
- 2005-03-02 00:59:53 2,179,328 —-a-w C:\WINDOWS\system32\ntoskrnl.exe
+ 2007-02-28 09:10:57 2,180,352 —-a-w C:\WINDOWS\system32\ntoskrnl.exe
- 2004-08-03 21:56:46 144,384 —-a-w C:\WINDOWS\system32\nwprovau.dll
+ 2006-10-13 12:35:12 142,336 —-a-w C:\WINDOWS\system32\nwprovau.dll
- 2007-08-13 15:44:06 101,376 —-a-w C:\WINDOWS\system32\occache.dll
+ 2007-08-20 10:04:42 102,400 —-a-w C:\WINDOWS\system32\occache.dll
- 2004-08-03 21:56:46 553,472 —-a-w C:\WINDOWS\system32\oleaut32.dll
+ 2007-05-17 11:28:05 549,376 —-a-w C:\WINDOWS\system32\oleaut32.dll
- 2002-08-29 05:00:00 117,760 —-a-w C:\WINDOWS\system32\oledlg.dll
+ 2006-10-16 16:15:00 122,880 —-a-w C:\WINDOWS\system32\oledlg.dll
- 2004-08-03 21:56:56 215,552 —-a-w C:\WINDOWS\system32\osk.exe
+ 2006-10-04 08:48:37 215,552 —-a-w C:\WINDOWS\system32\osk.exe
- 2007-11-03 10:34:37 67,336 —-a-w C:\WINDOWS\system32\perfc009.dat
+ 2007-11-27 14:38:52 78,642 —-a-w C:\WINDOWS\system32\perfc009.dat
- 2007-11-03 10:34:37 430,804 —-a-w C:\WINDOWS\system32\perfh009.dat
+ 2007-11-27 14:38:52 456,962 —-a-w C:\WINDOWS\system32\perfh009.dat
- 2006-10-14 13:43:38 124,416 —-a-w C:\WINDOWS\system32\prntvpt.dll
+ 2007-03-22 17:25:02 124,928 —-a-w C:\WINDOWS\system32\prntvpt.dll
+ 2004-03-10 22:26:10 406,016 —-a-w C:\WINDOWS\system32\PSDrvCheck.exe
- 2004-08-03 21:56:46 1,287,680 —-a-w C:\WINDOWS\system32\quartz.dll
+ 2005-08-30 03:54:26 1,287,168 —-a-w C:\WINDOWS\system32\quartz.dll
- 2004-08-03 21:56:46 431,616 —-a-w C:\WINDOWS\system32\riched20.dll
+ 2006-11-27 14:54:06 433,152 —-a-w C:\WINDOWS\system32\riched20.dll
- 2004-08-03 21:56:46 581,120 —-a-w C:\WINDOWS\system32\rpcrt4.dll
+ 2007-07-09 13:09:42 584,192 —-a-w C:\WINDOWS\system32\rpcrt4.dll
- 2004-08-03 21:56:46 144,896 —-a-w C:\WINDOWS\system32\schannel.dll
+ 2007-04-25 14:21:15 144,896 —-a-w C:\WINDOWS\system32\schannel.dll
- 2006-07-13 13:33:27 8,453,632 —-a-w C:\WINDOWS\system32\shell32.dll
+ 2007-10-26 03:36:51 8,454,656 —-a-w C:\WINDOWS\system32\shell32.dll
- 2004-08-03 21:56:46 134,656 —-a-w C:\WINDOWS\system32\shsvcs.dll
+ 2006-12-19 21:52:18 134,656 —-a-w C:\WINDOWS\system32\shsvcs.dll
- 2006-10-14 13:43:18 751,104 —-a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdrv.dll
+ 2007-03-22 17:24:50 762,880 —-a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdrv.dll
- 2006-10-14 13:42:40 131,584 —-a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll
+ 2007-03-22 17:24:34 131,584 —-a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll
- 2006-10-14 13:42:18 376,320 —-a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\unidrv.dll
+ 2007-03-22 17:24:06 376,832 —-a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\unidrv.dll
- 2006-10-14 13:42:28 510,464 —-a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\unidrvui.dll
+ 2007-03-22 18:03:54 749,568 —-a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\unidrvui.dll
- 2006-10-14 13:40:36 619,008 —-a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\unires.dll
+ 2007-03-22 18:03:58 761,344 —-a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\unires.dll
- 2006-10-14 17:22:00 1,698,048 —-a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\XpsSvcs.dll
+ 2007-03-23 03:07:56 1,683,280 —-a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\XpsSvcs.dll
- 2006-10-14 13:44:44 671,744 —-a-w C:\WINDOWS\system32\spool\prtprocs\w32x86\PrintFilterPipelineSvc.exe
+ 2007-03-22 17:25:42 677,376 —-a-w C:\WINDOWS\system32\spool\prtprocs\w32x86\PrintFilterPipelineSvc.exe
- 2006-10-14 14:12:14 737,792 —-a-w C:\WINDOWS\system32\spool\XPSEP\amd64\amd64\mxdwdrv.dll
+ 2007-03-22 17:53:16 746,496 —-a-w C:\WINDOWS\system32\spool\XPSEP\amd64\amd64\mxdwdrv.dll
- 2006-10-14 17:09:04 2,946,304 —-a-w C:\WINDOWS\system32\spool\XPSEP\amd64\amd64\xpssvcs.dll
+ 2007-03-22 17:59:24 2,932,224 —-a-w C:\WINDOWS\system32\spool\XPSEP\amd64\amd64\xpssvcs.dll
- 2006-10-14 14:12:14 737,792 —-a-w C:\WINDOWS\system32\spool\XPSEP\amd64\mxdwdrv.dll
+ 2007-03-22 17:53:16 746,496 —-a-w C:\WINDOWS\system32\spool\XPSEP\amd64\mxdwdrv.dll
- 2006-10-14 17:09:04 2,946,304 —-a-w C:\WINDOWS\system32\spool\XPSEP\amd64\xpssvcs.dll
+ 2007-03-22 17:59:24 2,932,224 —-a-w C:\WINDOWS\system32\spool\XPSEP\amd64\xpssvcs.dll
- 2006-10-14 13:43:18 751,104 —-a-w C:\WINDOWS\system32\spool\XPSEP\i386\i386\mxdwdrv.dll
+ 2007-03-22 17:24:50 762,880 —-a-w C:\WINDOWS\system32\spool\XPSEP\i386\i386\mxdwdrv.dll
- 2006-10-14 17:22:00 1,698,048 —-a-w C:\WINDOWS\system32\spool\XPSEP\i386\i386\xpssvcs.dll
+ 2007-03-23 03:07:56 1,683,280 —-a-w C:\WINDOWS\system32\spool\XPSEP\i386\i386\xpssvcs.dll
- 2006-10-14 13:43:18 751,104 —-a-w C:\WINDOWS\system32\spool\XPSEP\i386\mxdwdrv.dll
+ 2007-03-22 17:24:50 762,880 —-a-w C:\WINDOWS\system32\spool\XPSEP\i386\mxdwdrv.dll
- 2006-10-14 17:22:00 1,698,048 —-a-w C:\WINDOWS\system32\spool\XPSEP\i386\xpssvcs.dll
+ 2007-03-23 03:07:56 1,683,280 —-a-w C:\WINDOWS\system32\spool\XPSEP\i386\xpssvcs.dll
- 2004-08-03 21:56:46 246,302 —-a-w C:\WINDOWS\system32\strmdll.dll
+ 2006-08-21 06:52:08 246,814 —-a-w C:\WINDOWS\system32\strmdll.dll
- 2004-08-03 21:56:48 713,216 —-a-w C:\WINDOWS\system32\sxs.dll
+ 2006-10-19 13:56:32 713,216 —-a-w C:\WINDOWS\system32\sxs.dll
+ 2007-11-27 13:13:11 78,912 —-a-w C:\WINDOWS\system32\thsswhfh.dll
+ 2007-07-18 12:42:22 60,416 —-a-w C:\WINDOWS\system32\tzchange.exe
+ 2006-02-28 09:57:10 118,784 —-a-w C:\WINDOWS\system32\UDFLib.dll
- 2004-08-03 21:56:48 35,840 —-a-w C:\WINDOWS\system32\umandlg.dll
+ 2006-10-04 13:33:38 35,840 —-a-w C:\WINDOWS\system32\umandlg.dll
+ 2004-01-30 12:07:46 245,408 —-a-w C:\WINDOWS\system32\unicows.dll
- 2004-08-03 21:56:48 185,344 —-a-w C:\WINDOWS\system32\upnphost.dll
+ 2007-02-05 20:17:02 185,344 —-a-w C:\WINDOWS\system32\upnphost.dll
- 2007-08-13 15:44:30 105,984 —-a-w C:\WINDOWS\system32\url.dll
+ 2007-08-20 10:04:42 105,984 —-a-w C:\WINDOWS\system32\url.dll
- 2007-08-13 15:54:10 1,162,240 —-a-w C:\WINDOWS\system32\urlmon.dll
+ 2007-08-20 10:04:42 1,152,000 —-a-w C:\WINDOWS\system32\urlmon.dll
+ 2003-02-21 02:16:08 49,152 —-a-w C:\WINDOWS\system32\URTTEMP\regtlib.exe
- 2005-03-02 18:09:30 577,024 —-a-w C:\WINDOWS\system32\user32.dll
+ 2007-03-08 15:36:28 577,536 —-a-w C:\WINDOWS\system32\user32.dll
- 2004-08-03 21:56:58 50,176 —-a-w C:\WINDOWS\system32\utilman.exe
+ 2006-10-04 08:48:37 50,176 —-a-w C:\WINDOWS\system32\utilman.exe
- 2007-08-13 15:54:10 231,424 —-a-w C:\WINDOWS\system32\webcheck.dll
+ 2007-08-20 10:04:42 232,960 —-a-w C:\WINDOWS\system32\webcheck.dll
- 2004-08-03 21:56:48 333,312 —-a-w C:\WINDOWS\system32\wiaservc.dll
+ 2006-12-19 18:16:47 333,824 —-a-w C:\WINDOWS\system32\wiaservc.dll
- 2005-10-06 00:05:59 1,839,488 —-a-w C:\WINDOWS\system32\win32k.sys
+ 2007-03-08 13:47:48 1,843,584 —-a-w C:\WINDOWS\system32\win32k.sys
- 2007-08-13 15:54:10 818,688 —-a-w C:\WINDOWS\system32\wininet.dll
+ 2007-08-20 10:04:43 824,832 —-a-w C:\WINDOWS\system32\wininet.dll
- 2005-09-01 01:41:54 291,840 —-a-w C:\WINDOWS\system32\winsrv.dll
+ 2007-03-17 13:43:01 292,864 —-a-w C:\WINDOWS\system32\winsrv.dll
- 2004-08-03 21:56:48 132,096 —-a-w C:\WINDOWS\system32\wkssvc.dll
+ 2006-08-17 12:28:27 132,096 —-a-w C:\WINDOWS\system32\wkssvc.dll
- 2006-10-18 19:47:20 10,834,432 —-a-w C:\WINDOWS\system32\wmp.dll
+ 2007-06-11 20:51:12 10,834,944 —-a-w C:\WINDOWS\system32\wmp.dll
- 2005-05-17 00:25:35 15,360 —-a-w C:\WINDOWS\system32\xpsp3res.dll
+ 2007-10-29 10:26:53 115,712 —-a-w C:\WINDOWS\system32\xpsp3res.dll
- 2006-10-14 17:21:58 580,352 —-a-w C:\WINDOWS\system32\XPSSHHDR.dll
+ 2007-03-23 03:07:54 583,504 —-a-w C:\WINDOWS\system32\XPSSHHDR.dll
- 2006-10-14 17:22:00 1,698,048 —-a-w C:\WINDOWS\system32\XpsSvcs.dll
+ 2007-03-23 03:07:56 1,683,280 —-a-w C:\WINDOWS\system32\XpsSvcs.dll
+ 2007-11-28 12:36:42 16,384 —-atw C:\WINDOWS\Temp\Perflib_Perfdata_228.dat
+ 2007-11-28 12:35:57 16,384 —-atw C:\WINDOWS\Temp\Perflib_Perfdata_5c0.dat
+ 2007-05-08 12:06:44 1,275,392 —-a-w C:\WINDOWS\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9848.0_x-ww_1b897e9a\msxml4.dll
+ 2007-04-18 07:36:40 82,432 —-a-w C:\WINDOWS\WinSxS\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a\msxml4r.dll
+ 2007-01-19 20:15:24 74,802 —-a-w C:\WINDOWS\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.9792.0_x-ww_08a6620a\atl.dll
+ 2007-01-19 20:15:24 995,383 —-a-w C:\WINDOWS\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.9792.0_x-ww_08a6620a\mfc42.dll
+ 2007-01-19 20:15:24 1,011,774 —-a-w C:\WINDOWS\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.9792.0_x-ww_08a6620a\mfc42u.dll
+ 2007-01-19 20:15:24 401,462 —-a-w C:\WINDOWS\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.9792.0_x-ww_08a6620a\msvcp60.dll
- 2007-10-19 23:10:59 258,048 —-a-w C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
+ 2007-11-27 13:37:41 258,048 —-a-w C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
- 2007-10-19 23:10:59 114,176 —-a-w C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
+ 2007-11-27 13:37:41 114,176 —-a-w C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0019C3E2-DD48-4A6D-ABCD-8D32436323D9}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2FF16551-D133-4251-AB91-AB71D4F7960A}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6AA3809C-6261-456F-8FCA-43FE39ADC5E9}]
2007-11-21 21:27 36352 –a—— C:\WINDOWS\system32\efcywtq.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A282E5A0-C970-48CB-BE0D-A305961C60F1}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A8DFE9AD-D27F-4C1E-ACF3-25401BA2ADBD}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}]
2007-11-28 15:16 145984 –a—— C:\WINDOWS\system32\mrduczhy.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C95C6848-DCD6-4850-BA5B-57E6E3F9589C}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FD9DD278-B93B-4E11-B628-FCD1074B8C1B}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{11A69AE4-FBED-4832-A2BF-45AF82825583}"= C:\WINDOWS\system32\mrduczhy.dll [2007-11-28 15:16 145984]

[HKEY_CLASSES_ROOT\clsid\{11a69ae4-fbed-4832-a2bf-45af82825583}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="nwiz.exe" [2007-09-17 01:07 C:\WINDOWS\system32\nwiz.exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-06-29 12:08]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 18:20]
"avast!"="C:\PROGRA~1\ALWILS~1\AVAST4~1\ashDisp.exe" [2007-10-25 18:20]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2006-11-23 15:10]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2006-12-05 22:55]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-10-19 20:16]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-11-02 18:36]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-04 00:56 C:\WINDOWS\system32\rundll32.exe]
"PinnacleDriverCheck"="C:\WINDOWS\system32\PSDrvCheck.exe" [2004-03-11 01:26]
"USB2Check"="RUNDLL32.exe" [2004-08-04 00:56 C:\WINDOWS\system32\rundll32.exe]
"USBToolTip"="C:\Program Files\Pinnacle\Shared Files\\Programs\USBTip\USBTip.exe" [2006-06-01 03:37]
"ecb86ff5"="C:\WINDOWS\system32\yvnodqen.dll" [2007-11-27 16:15]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:56]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 10:17]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
hp psc 2000 Series.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe [2003-04-06 11:37:10]
hpoddt01.exe.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-04-06 12:06:58]

[hklm\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{6AA3809C-6261-456F-8FCA-43FE39ADC5E9}"= C:\WINDOWS\system32\efcywtq.dll [2007-11-21 21:27 36352]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efcywtq]
efcywtq.dll 2007-11-21 21:27 36352 C:\WINDOWS\system32\efcywtq.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mrduczhy]
mrduczhy.dll 2007-11-28 15:16 145984 C:\WINDOWS\system32\mrduczhy.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\rwamkvhc]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\fcccb.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders , digest.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Saad^Start Menu^Programs^Startup^.protected]
path=C:\Documents and Settings\Saad\Start Menu\Programs\Startup\.protected
backup=C:\WINDOWS\pss\.protectedStartup
????

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearFlix]
C:\Program Files\BearFlix\BearFlix.exe /pause

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
2001-07-09 13:50 155648 –a—— C:\WINDOWS\System32\\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pop up Blocker]
C:\Program Files\Pop up Blocker\pd.exe Minimize

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinAntiVirus Pro 2007]
C:\Program Files\WinAntiVirus Pro 2007\WinAV.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ServiceLayer"=3 (0x3)
"SavRoam"=2 (0x2)
"LiveUpdate"=3 (0x3)
"gusvc"=3 (0x3)


.
Contents of the 'Scheduled Tasks' folder
"2007-11-23 17:04:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-11-28 10:33:00 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 2200 series#1162675951.job"
- C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe4-I
"2007-11-03 12:00:57 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 2200 series#1194091219.job"
- C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe4-I
"2007-11-28 12:38:44 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-28 15:39:27
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-28 15:45:12 - machine was rebooted
C:\ComboFix2.txt … 2007-11-25 17:53
.
— E O F —

Hijackthis log…


Logfile of HijackThis v1.99.1
Scan saved at 6:45:21 PM, on 28/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Alwil Software\Avast 4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast 4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Pinnacle\Shared Files\Programs\MediaServer\PMSHost.exe
C:\Program Files\Alwil Software\Avast 4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast 4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\PROGRA~1\ALWILS~1\AVAST4~1\ashDisp.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Safari\Safari.exe
C:\Documents and Settings\Mehreen\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - (no file)
O2 - BHO: (no name) - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Control Popups in Internet Explorer - {41353F8B-78CE-48A5-BE44-153ED293D192} - C:\PROGRA~1\POPUPP~1\PopLib.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\AVAST4~1\ashDisp.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [USB2Check] RUNDLL32.EXE "C:\WINDOWS\system32\PCLECoInst.dll",CheckUSBController
O4 - HKLM\..\Run: [USBToolTip] "C:\Program Files\Pinnacle\Shared Files\\Programs\USBTip\USBTip.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: PD - {1173A4DB-B5A8-4CB2-A646-09245DC2C589} - C:\Program Files\Pop up Blocker\pd.exe
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: PopupPopper Control Panel - {3E94F358-9537-4BBA-8D12-D7F8A0136973} - C:\Program Files\PopupPopper\SiteList.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O11 - Options group: Tabbed Browsing
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {37A273C2-5129-11D5-BF37-00A0CCE8754B} (TTestGenXInstallObject) - http://asp.mathxl.com/wizmodules/testgen/i…GenXInstall.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase4009.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1188839955832
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…/sysreqlab2.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1188841528977
O16 - DPF: {95D88B35-A521-472B-A182-BB1A98356421} (Pearson Installation Assistant 2) - http://asp.mathxl.com/books/_Players/PearsonInstallAsst2.cab
O16 - DPF: {E473A65C-8087-49A3-AFFD-C5BC4A10669B} (Quantum Streaming IE Player Class) - http://mvnet.xlontech.net/qm/fox/06101102/qsp2ie06101001.cab
O16 - DPF: {EEC9DBCC-04AD-4A1B-BEA7-C6DAD9515D5A} (Pearson MyEconLab Player Control) - http://asp.mathxl.com/books/_Players/EconPlayer.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast 4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast 4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast 4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast 4\ashWebSv.exe" /service (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MSSQL$PINNACLESYS - Unknown owner - C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe" -sPINNACLESYS (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - C:\Program Files\Pinnacle\Shared Files\Programs\MediaServer\PMSHost.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SQLAgent$PINNACLESYS - Unknown owner - C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlagent.EXE" -i PINNACLESYS (file missing)
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

combofix log….

Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.165 [GMT 3:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Mehreen\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\Program Files\WinAntiVirus Pro 2007\WinAV.exe
C:\WINDOWS\system32\awttqpn.dll
C:\WINDOWS\system32\bhiobhuc.dll
C:\WINDOWS\system32\bjsdsvmp.ini
C:\WINDOWS\system32\efcayvu.dll
C:\WINDOWS\system32\efcywtq.dll
C:\WINDOWS\system32\enhdghls.exe
C:\WINDOWS\system32\fcccb.dll
C:\WINDOWS\system32\jrekrlfq.dll
C:\WINDOWS\system32\kdivllyl.dll
C:\WINDOWS\system32\lyllvidk.ini
C:\WINDOWS\system32\mpoaglyy.dll
C:\WINDOWS\system32\mrduczhy.dll
C:\WINDOWS\system32\neqdonvy.ini
C:\WINDOWS\system32\pmvsdsjb.dll
C:\WINDOWS\system32\ponpo.bak1
C:\WINDOWS\system32\ponpo.bak2
C:\WINDOWS\system32\ponpo.ini2
C:\WINDOWS\system32\rbhmupdj.exe
C:\WINDOWS\system32\wtpkxnny.exe
C:\WINDOWS\system32\yvnodqen.dll
C:\WINDOWS\system32\yxslifqj.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\VundoFix Backups
C:\VundoFix Backups\addmorefiles.txt
C:\VundoFix Backups\PageHistory.txt.bad
C:\VundoFix Backups\rwamkvhc.dll.bad
C:\VundoFix Backups\rwamkvhc.dllbox.bad
C:\VundoFix Backups\umspkwra.dll.bad
C:\VundoFix Backups\umspkwra.dllbox.bad
C:\VundoFix Backups\WebHistory.txt.bad
C:\VundoFix Backups\wlffvvcg.dll.bad
C:\VundoFix Backups\ymmhxdat.dll.bad
C:\WINDOWS\system32\awttqpn.dll
C:\WINDOWS\system32\bhiobhuc.dll
C:\WINDOWS\system32\bjsdsvmp.ini
C:\WINDOWS\system32\efcayvu.dll
C:\WINDOWS\system32\efcywtq.dll
C:\WINDOWS\system32\enhdghls.exe
C:\WINDOWS\system32\jrekrlfq.dll
C:\WINDOWS\system32\kdivllyl.dll
C:\WINDOWS\system32\lyllvidk.ini
C:\WINDOWS\system32\mpoaglyy.dll
C:\WINDOWS\system32\mrduczhy.dll
C:\WINDOWS\system32\mrduczhy.dllbox
C:\WINDOWS\system32\neqdonvy.ini
C:\WINDOWS\system32\pmvsdsjb.dll
C:\WINDOWS\system32\ponpo.bak1
C:\WINDOWS\system32\ponpo.bak2
C:\WINDOWS\system32\ponpo.ini2
C:\WINDOWS\system32\rbhmupdj.exe
C:\WINDOWS\system32\utstv.ini
C:\WINDOWS\system32\utstv.ini2
C:\WINDOWS\system32\vtstu.dll
C:\WINDOWS\system32\wtpkxnny.exe
C:\WINDOWS\system32\yvnodqen.dll
C:\WINDOWS\system32\yxslifqj.dll

.
((((((((((((((((((((((((( Files Created from 2007-10-28 to 2007-11-28 )))))))))))))))))))))))))))))))
.

2007-11-28 17:00 48,128 –a—— C:\WINDOWS\system32\drivers\61883.sys
2007-11-27 16:54 d——– C:\Program Files\MSXML 6.0
2007-11-27 16:23 d——– C:\Program Files\MSXML 4.0
2007-11-26 20:15 153,088 –a—— C:\Program Files\UNWISE.EXE
2007-11-26 20:14 196,608 –a—— C:\WINDOWS\system32\MarvinUsb.ax
2007-11-26 20:14 73,728 –a—— C:\WINDOWS\system32\PCLECoInst.dll
2007-11-26 20:00 41 –a—— C:\WINDOWS\system32\blue.SITENAME
2007-11-26 18:49 2,653,888 –a—— C:\WINDOWS\system32\LTRDG13n.OCX
2007-11-26 18:49 534,192 –a—— C:\WINDOWS\system32\LTRVW13N.OCX
2007-11-26 18:49 466,624 –a—— C:\WINDOWS\system32\LTRPR13n.DLL
2007-11-26 18:49 401,408 –a—— C:\WINDOWS\system32\pvmjpg30.dll
2007-11-26 18:49 194,248 –a—— C:\WINDOWS\system32\LTRFD13n.DLL
2007-11-26 18:48 185,856 –a—— C:\WINDOWS\system32\lfpng13s.dll
2007-11-26 18:48 82,432 –a—— C:\WINDOWS\system32\msxml4r.dll
2007-11-26 18:48 44,544 –a—— C:\WINDOWS\system32\msxml4a.dll
2007-11-26 18:46 233,472 –a—— C:\WINDOWS\system32\DiskIO.dll
2007-11-26 18:46 184,320 –a—— C:\WINDOWS\system32\RALMain.dll
2007-11-26 18:46 126,976 –a—— C:\WINDOWS\system32\AVIPrAx.dll
2007-11-26 18:46 73,728 –a—— C:\WINDOWS\system32\MMAviAx.dll
2007-11-26 18:46 32,768 –a—— C:\WINDOWS\system32\MLPagAx.dll
2007-11-26 18:45 1,013,248 –a—— C:\WINDOWS\system32\Ltwvc13n.dll
2007-11-26 18:45 306,352 –a—— C:\WINDOWS\system32\Ltrio13n.dll
2007-11-26 18:41 26,624 –a—— C:\WINDOWS\system32\PSDrvCheck.JP
2007-11-26 18:41 26,624 –a—— C:\WINDOWS\system32\PSDrvCheck.IT
2007-11-26 18:41 26,624 –a—— C:\WINDOWS\system32\PSDrvCheck.FR
2007-11-26 18:41 26,624 –a—— C:\WINDOWS\system32\PSDrvCheck.ES
2007-11-26 18:41 26,624 –a—— C:\WINDOWS\system32\PSDrvCheck.DE
2007-11-26 18:41 16,896 –a—— C:\WINDOWS\system32\PSDrvCheck.NL
2007-11-26 18:41 16,896 –a—— C:\WINDOWS\system32\PSDrvCheck.KO
2007-11-26 18:30 33,340 –a—— C:\WINDOWS\system32\dbmsqlgc.dll
2007-11-26 18:30 24,576 –a—— C:\WINDOWS\system32\dbmsgnet.dll
2007-11-26 18:27 d——– C:\Program Files\Microsoft SQL Server
2007-11-26 18:24 d——– C:\WINDOWS\Cache
2007-11-26 18:24 765,952 –a—— C:\WINDOWS\system32\msvcp71d.dll
2007-11-26 18:24 544,768 –a—— C:\WINDOWS\system32\msvcr71d.dll
2007-11-26 17:31 d——– C:\Program Files\SmartSound Software
2007-11-26 17:31 d——– C:\Documents and Settings\All Users\Application Data\SmartSound Software Inc
2007-11-26 17:28 196,096 –a—— C:\WINDOWS\system32\macd32.dll
2007-11-26 17:28 138,752 –a—— C:\WINDOWS\system32\mase32.dll
2007-11-26 17:28 136,192 –a—— C:\WINDOWS\system32\mamc32.dll
2007-11-26 17:28 84,992 –a—— C:\WINDOWS\system32\ATL70.DLL
2007-11-26 17:28 57,856 –a—— C:\WINDOWS\system32\masd32.dll
2007-11-26 17:28 27,648 –a—— C:\WINDOWS\system32\ma32.dll
2007-11-26 17:27 41,219 –a—— C:\WINDOWS\RSETPATH.exe
2007-11-26 17:24 d——– C:\WINDOWS\Downloaded Installations
2007-11-26 17:24 65,536 –a—— C:\WINDOWS\system32\MFC71DEU.DLL
2007-11-26 17:24 61,440 –a—— C:\WINDOWS\system32\MFC71ITA.DLL
2007-11-26 17:24 61,440 –a—— C:\WINDOWS\system32\MFC71FRA.DLL
2007-11-26 17:24 61,440 –a—— C:\WINDOWS\system32\MFC71ESP.DLL
2007-11-26 17:24 57,344 –a—— C:\WINDOWS\system32\MFC71ENU.DLL
2007-11-26 17:24 49,152 –a—— C:\WINDOWS\system32\PCLEGetGuid.dll
2007-11-26 17:24 49,152 –a—— C:\WINDOWS\system32\MFC71KOR.DLL
2007-11-26 17:24 49,152 –a—— C:\WINDOWS\system32\MFC71JPN.DLL
2007-11-26 17:24 45,056 –a—— C:\WINDOWS\system32\MFC71CHT.DLL
2007-11-26 17:24 40,960 –a—— C:\WINDOWS\system32\MFC71CHS.DLL
2007-11-26 17:21 d——– C:\Documents and Settings\All Users\Application Data\Pinnacle Studio
2007-11-26 17:07 d——– C:\Program Files\Pinnacle
2007-11-26 17:07 d——– C:\Documents and Settings\All Users\Application Data\Pinnacle
2007-11-26 16:17 d——– C:\Program Files\Ares
2007-11-24 19:15 d——– C:\Program Files\Western Digital Technologies
2007-11-24 18:30 d——– C:\Program Files\SpywareBlaster
2007-11-23 21:10 d——– C:\Documents and Settings\Administrator\WINDOWS
2007-11-23 18:29 53,248 –a—— C:\WINDOWS\system32\Process.exe
2007-11-23 18:29 51,200 –a—— C:\WINDOWS\system32\dumphive.exe
2007-11-22 18:10 d——– C:\Documents and Settings\Mehreen\Phone Browser
2007-11-22 18:00 d——– C:\Program Files\Common Files\PCSuite
2007-11-22 18:00 d——– C:\Program Files\Common Files\Nokia
2007-11-22 17:57 d——– C:\Program Files\PC Connectivity Solution
2007-11-22 17:57 d——– C:\Program Files\Nokia
2007-11-22 17:57 65,536 –a—— C:\WINDOWS\system32\nmwcdcocls.dll
2007-11-22 01:16 d——– C:\Temp
2007-11-22 01:16 d——– C:\Program Files\AviSynth 2.5
2007-11-22 01:15 d——– C:\Program Files\Winnydows
2007-11-21 16:35 68,008 –ah—– C:\WINDOWS\system32\mlfcache.dat
2007-11-19 15:13 d——– C:\Program Files\iTunes
2007-11-19 15:13 d——– C:\Program Files\iPod
2007-11-19 15:11 d——– C:\Program Files\QuickTime
2007-11-19 15:10 d——– C:\Program Files\Common Files\Apple
2007-11-15 22:22 d——– C:\Program Files\Safari
2007-11-08 12:10 d——– C:\Program Files\PSP ISO Compressor
2007-11-03 18:37 d——– C:\Program Files\PopupPopper
2007-11-03 13:35 d——– C:\Documents and Settings\All Users\Application Data\nView_Profiles
2007-11-03 11:34 d——– C:\Program Files\Cricket 2004
2007-11-03 10:42 d——– C:\Program Files\Common Files\LightScribe
2007-11-03 10:40 d——– C:\Program Files\Common Files\Ahead
2007-11-02 16:26 d——– C:\Documents and Settings\Mehreen\Application Data\CyberLink
2007-11-02 16:26 d——– C:\Documents and Settings\All Users\Application Data\CyberLink
2007-11-02 16:17 d——– C:\MyWorks
2007-11-02 16:15 d——– C:\Program Files\CyberLink
2007-11-02 02:16 152,848 –a—— C:\WINDOWS\system32\comdlg32.OCX
2007-11-02 02:15 d——– C:\Program Files\Bit Che
2007-11-02 02:15 124,688 –a—— C:\WINDOWS\system32\mswinsck.ocx
2007-11-01 20:48 138,893 –a—— C:\WINDOWS\system32\nvapps.xml
2007-11-01 20:47 356,352 –a—— C:\WINDOWS\system32\NVUNINST.EXE
2007-11-01 20:46 d——– C:\NVIDIA
2007-11-01 12:44 d——– C:\Program Files\SystemRequirementsLab
2007-10-30 20:43 d——– C:\Program Files\iDump
2007-10-29 17:22 26,624 –a—— C:\WINDOWS\system32\drivers\aavmker4.sys
2007-10-29 17:21 95,608 –a—— C:\WINDOWS\system32\AvastSS.scr
2007-10-29 17:21 93,264 –a—— C:\WINDOWS\system32\drivers\aswmon.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-28 03:37 ——— d—–w C:\Documents and Settings\Mehreen\Application Data\uTorrent
2007-11-27 14:08 ——— d—–w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-11-26 15:44 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-11-26 13:30 ——— d—–w C:\Program Files\LimeWire
2007-11-24 15:29 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-22 15:10 ——— d—–w C:\Documents and Settings\Mehreen\Application Data\PC Suite
2007-11-22 15:10 ——— d—–w C:\Documents and Settings\Mehreen\Application Data\Nokia
2007-11-22 15:10 ——— d—–w C:\Documents and Settings\All Users\Application Data\PC Suite
2007-11-21 15:58 ——— d—–w C:\Documents and Settings\Mehreen\Application Data\LimeWire
2007-11-19 12:11 ——— d—–w C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-11-03 12:01 82,380 —-a-w C:\WINDOWS\system32\drivers\AFS2K.SYS
2007-11-01 22:43 ——— d—–w C:\Program Files\DivX
2007-11-01 17:46 ——— d—–w C:\Program Files\Common Files\InstallShield
2007-10-29 14:21 ——— d—–w C:\Program Files\Alwil Software
2007-10-27 14:32 ——— d—–w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-10-27 12:36 77,703 —-a-w C:\WINDOWS\system32\drivers\klif.cab
2007-10-26 09:25 ——— d—–w C:\Program Files\Windows Live Safety Center
2007-10-26 09:05 ——— d—–w C:\Program Files\Net2Phone CommCenter
2007-10-26 07:32 ——— d—–w C:\Program Files\Java
2007-10-26 07:06 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2007-10-25 16:05 94,416 —-a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-10-25 16:03 23,152 —-a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-10-25 16:01 42,912 —-a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-10-25 07:09 ——— d—–w C:\Documents and Settings\Mehreen\Application Data\DivX
2007-10-24 19:53 ——— d—–w C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-10-24 13:46 ——— d—–w C:\Program Files\Warcraft III
2007-10-24 13:18 ——— d—–w C:\Program Files\Windows Defender
2007-10-23 15:50 ——— d—–w C:\Documents and Settings\All Users\Application Data\Trend Micro
2007-10-22 15:38 ——— d—–w C:\Program Files\Trend Micro
2007-10-22 15:33 805 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2007-10-22 15:33 8,014 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2007-10-22 15:33 136,248 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-10-22 15:33 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2007-10-22 15:20 ——— d—–w C:\Documents and Settings\All Users\Application Data\McAfee
2007-10-22 14:46 ——— d—–w C:\Documents and Settings\Mehreen\Application Data\SiteAdvisor
2007-10-22 14:24 ——— d—–w C:\Program Files\Windows Media Connect 2
2007-10-22 12:50 ——— d—–w C:\Documents and Settings\Mehreen\Application Data\Command & Conquer 3 Tiberium Wars
2007-10-21 17:38 ——— d—–w C:\Program Files\Creative
2007-10-21 15:30 ——— d—–w C:\Program Files\MSBuild
2007-10-21 15:30 ——— d—–w C:\Program Files\Microsoft Works
2007-10-21 15:26 ——— d—–w C:\Program Files\Microsoft.NET
2007-10-21 15:22 ——— d—–w C:\Program Files\Microsoft Visual Studio 8
2007-10-21 15:08 ——— d—–w C:\Program Files\Reference Assemblies
2007-10-21 13:26 ——— d—–w C:\Program Files\Windows Live
2007-10-21 13:25 ——— d—–w C:\Documents and Settings\All Users\Application Data\WindowsLiveInstaller
2007-10-20 17:19 ——— d—–w C:\Documents and Settings\Mehreen\Application Data\Apple Computer
2007-10-19 23:14 ——— d—–w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-10-19 18:09 ——— d—–w C:\Program Files\uTorrent
2007-10-19 18:07 ——— d—–w C:\Program Files\Common Files\Adobe
2007-10-19 15:47 ——— d—–w C:\Program Files\Xplosiv
2007-10-19 13:46 ——— d—–w C:\Program Files\CCleaner
2007-10-03 15:45 ——— d—–w C:\Program Files\Apple Software Update
2007-10-03 15:45 ——— d—–w C:\Documents and Settings\All Users\Application Data\Apple
2007-09-12 03:15 98,304 —-a-w C:\WINDOWS\System32CmdLineExt.dll
2007-09-11 01:56 126,976 —-a-w C:\WINDOWS\War3Unin.exe
2006-11-04 07:32 0 —-a-w C:\Program Files\Common Files\err.log
.

((((((((((((((((((((((((((((( snapshot_2007-11-28_15.42.04.71 )))))))))))))))))))))))))))))))))))))))))
.
+ 2004-08-03 20:10:12 48,128 -c–a-w C:\WINDOWS\system32\dllcache\61883.sys
+ 2004-08-03 20:10:12 38,912 -c–a-w C:\WINDOWS\system32\dllcache\avc.sys
+ 2004-08-03 20:10:12 38,912 —-a-w C:\WINDOWS\system32\drivers\avc.sys
- 2007-11-27 14:38:52 78,642 —-a-w C:\WINDOWS\system32\perfc009.dat
+ 2007-11-28 12:42:25 78,642 —-a-w C:\WINDOWS\system32\perfc009.dat
- 2007-11-27 14:38:52 456,962 —-a-w C:\WINDOWS\system32\perfh009.dat
+ 2007-11-28 12:42:26 456,962 —-a-w C:\WINDOWS\system32\perfh009.dat
+ 2007-11-28 14:53:55 16,384 —-atw C:\WINDOWS\Temp\Perflib_Perfdata_59c.dat
+ 2007-11-28 14:54:07 16,384 —-atw C:\WINDOWS\Temp\Perflib_Perfdata_77c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0019C3E2-DD48-4A6D-ABCD-8D32436323D9}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06B6ECE1-C3BF-4C89-8C48-5D7CC358E2E6}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2FF16551-D133-4251-AB91-AB71D4F7960A}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6AA3809C-6261-456F-8FCA-43FE39ADC5E9}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A282E5A0-C970-48CB-BE0D-A305961C60F1}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A8DFE9AD-D27F-4C1E-ACF3-25401BA2ADBD}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C95C6848-DCD6-4850-BA5B-57E6E3F9589C}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FD9DD278-B93B-4E11-B628-FCD1074B8C1B}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="nwiz.exe" [2007-09-17 01:07 C:\WINDOWS\system32\nwiz.exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-06-29 12:08]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 18:20]
"avast!"="C:\PROGRA~1\ALWILS~1\AVAST4~1\ashDisp.exe" [2007-10-25 18:20]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2006-11-23 15:10]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2006-12-05 22:55]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-10-19 20:16]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-11-02 18:36]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-04 00:56 C:\WINDOWS\system32\rundll32.exe]
"PinnacleDriverCheck"="C:\WINDOWS\system32\PSDrvCheck.exe" [2004-03-11 01:26]
"USB2Check"="RUNDLL32.exe" [2004-08-04 00:56 C:\WINDOWS\system32\rundll32.exe]
"USBToolTip"="C:\Program Files\Pinnacle\Shared Files\\Programs\USBTip\USBTip.exe" [2006-06-01 03:37]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:56]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 10:17]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
hp psc 2000 Series.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe [2003-04-06 11:37:10]
hpoddt01.exe.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-04-06 12:06:58]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efcywtq]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mrduczhy]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\rwamkvhc]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\vtstu.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Saad^Start Menu^Programs^Startup^.protected]
path=C:\Documents and Settings\Saad\Start Menu\Programs\Startup\.protected
backup=C:\WINDOWS\pss\.protectedStartup
????

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearFlix]
C:\Program Files\BearFlix\BearFlix.exe /pause

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
2001-07-09 13:50 155648 –a—— C:\WINDOWS\System32\\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pop up Blocker]
C:\Program Files\Pop up Blocker\pd.exe Minimize

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinAntiVirus Pro 2007]
C:\Program Files\WinAntiVirus Pro 2007\WinAV.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ServiceLayer"=3 (0x3)
"SavRoam"=2 (0x2)
"LiveUpdate"=3 (0x3)
"gusvc"=3 (0x3)

S3 ctlsb16;Creative SB16/AWE32/AWE64 Driver (WDM);C:\WINDOWS\system32\drivers\ctlsb16.sys

.
Contents of the 'Scheduled Tasks' folder
"2007-11-23 17:04:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-11-28 10:33:00 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 2200 series#1162675951.job"
- C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe4-I
"2007-11-03 12:00:57 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 2200 series#1194091219.job"
- C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe4-I
"2007-11-28 14:56:53 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-28 18:40:24
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-28 18:43:17 - machine was rebooted
C:\ComboFix2.txt … 2007-11-28 15:45
C:\ComboFix3.txt … 2007-11-25 17:53
.
— E O F —

Hijackthis log…


Logfile of HijackThis v1.99.1
Scan saved at 10:19:17 PM, on 28/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Alwil Software\Avast 4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast 4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Pinnacle\Shared Files\Programs\MediaServer\PMSHost.exe
C:\Program Files\Alwil Software\Avast 4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast 4\ashWebSv.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\PROGRA~1\ALWILS~1\AVAST4~1\ashDisp.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\Mehreen\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: (no name) - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Control Popups in Internet Explorer - {41353F8B-78CE-48A5-BE44-153ED293D192} - C:\PROGRA~1\POPUPP~1\PopLib.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\AVAST4~1\ashDisp.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [USB2Check] RUNDLL32.EXE "C:\WINDOWS\system32\PCLECoInst.dll",CheckUSBController
O4 - HKLM\..\Run: [USBToolTip] "C:\Program Files\Pinnacle\Shared Files\\Programs\USBTip\USBTip.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: PD - {1173A4DB-B5A8-4CB2-A646-09245DC2C589} - C:\Program Files\Pop up Blocker\pd.exe
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: PopupPopper Control Panel - {3E94F358-9537-4BBA-8D12-D7F8A0136973} - C:\Program Files\PopupPopper\SiteList.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O11 - Options group: Tabbed Browsing
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {37A273C2-5129-11D5-BF37-00A0CCE8754B} (TTestGenXInstallObject) - http://asp.mathxl.com/wizmodules/testgen/i…GenXInstall.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase4009.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1188839955832
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…/sysreqlab2.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1188841528977
O16 - DPF: {95D88B35-A521-472B-A182-BB1A98356421} (Pearson Installation Assistant 2) - http://asp.mathxl.com/books/_Players/PearsonInstallAsst2.cab
O16 - DPF: {E473A65C-8087-49A3-AFFD-C5BC4A10669B} (Quantum Streaming IE Player Class) - http://mvnet.xlontech.net/qm/fox/06101102/qsp2ie06101001.cab
O16 - DPF: {EEC9DBCC-04AD-4A1B-BEA7-C6DAD9515D5A} (Pearson MyEconLab Player Control) - http://asp.mathxl.com/books/_Players/EconPlayer.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast 4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast 4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast 4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast 4\ashWebSv.exe" /service (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MSSQL$PINNACLESYS - Unknown owner - C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe" -sPINNACLESYS (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - C:\Program Files\Pinnacle\Shared Files\Programs\MediaServer\PMSHost.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SQLAgent$PINNACLESYS - Unknown owner - C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlagent.EXE" -i PINNACLESYS (file missing)
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

combofix log…


ComboFix 07-11-19.4B - Mehreen 2007-11-28 22:13:20.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.135 [GMT 3:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Mehreen\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\Documents and Settings\Saad\Start Menu\Programs\Startup\.protected
C:\WINDOWS\pss\.protectedStartup
C:\WINDOWS\system32\vtstu.dll
.

((((((((((((((((((((((((( Files Created from 2007-10-28 to 2007-11-28 )))))))))))))))))))))))))))))))
.

2007-11-28 17:00 48,128 –a—— C:\WINDOWS\system32\drivers\61883.sys
2007-11-27 16:54 d——– C:\Program Files\MSXML 6.0
2007-11-27 16:23 d——– C:\Program Files\MSXML 4.0
2007-11-26 20:15 153,088 –a—— C:\Program Files\UNWISE.EXE
2007-11-26 20:14 196,608 –a—— C:\WINDOWS\system32\MarvinUsb.ax
2007-11-26 20:14 73,728 –a—— C:\WINDOWS\system32\PCLECoInst.dll
2007-11-26 20:00 41 –a—— C:\WINDOWS\system32\blue.SITENAME
2007-11-26 18:49 2,653,888 –a—— C:\WINDOWS\system32\LTRDG13n.OCX
2007-11-26 18:49 534,192 –a—— C:\WINDOWS\system32\LTRVW13N.OCX
2007-11-26 18:49 466,624 –a—— C:\WINDOWS\system32\LTRPR13n.DLL
2007-11-26 18:49 401,408 –a—— C:\WINDOWS\system32\pvmjpg30.dll
2007-11-26 18:49 194,248 –a—— C:\WINDOWS\system32\LTRFD13n.DLL
2007-11-26 18:48 185,856 –a—— C:\WINDOWS\system32\lfpng13s.dll
2007-11-26 18:48 82,432 –a—— C:\WINDOWS\system32\msxml4r.dll
2007-11-26 18:48 44,544 –a—— C:\WINDOWS\system32\msxml4a.dll
2007-11-26 18:46 233,472 –a—— C:\WINDOWS\system32\DiskIO.dll
2007-11-26 18:46 184,320 –a—— C:\WINDOWS\system32\RALMain.dll
2007-11-26 18:46 126,976 –a—— C:\WINDOWS\system32\AVIPrAx.dll
2007-11-26 18:46 73,728 –a—— C:\WINDOWS\system32\MMAviAx.dll
2007-11-26 18:46 32,768 –a—— C:\WINDOWS\system32\MLPagAx.dll
2007-11-26 18:45 1,013,248 –a—— C:\WINDOWS\system32\Ltwvc13n.dll
2007-11-26 18:45 306,352 –a—— C:\WINDOWS\system32\Ltrio13n.dll
2007-11-26 18:41 26,624 –a—— C:\WINDOWS\system32\PSDrvCheck.JP
2007-11-26 18:41 26,624 –a—— C:\WINDOWS\system32\PSDrvCheck.IT
2007-11-26 18:41 26,624 –a—— C:\WINDOWS\system32\PSDrvCheck.FR
2007-11-26 18:41 26,624 –a—— C:\WINDOWS\system32\PSDrvCheck.ES
2007-11-26 18:41 26,624 –a—— C:\WINDOWS\system32\PSDrvCheck.DE
2007-11-26 18:41 16,896 –a—— C:\WINDOWS\system32\PSDrvCheck.NL
2007-11-26 18:41 16,896 –a—— C:\WINDOWS\system32\PSDrvCheck.KO
2007-11-26 18:30 33,340 –a—— C:\WINDOWS\system32\dbmsqlgc.dll
2007-11-26 18:30 24,576 –a—— C:\WINDOWS\system32\dbmsgnet.dll
2007-11-26 18:27 d——– C:\Program Files\Microsoft SQL Server
2007-11-26 18:24 d——– C:\WINDOWS\Cache
2007-11-26 18:24 765,952 –a—— C:\WINDOWS\system32\msvcp71d.dll
2007-11-26 18:24 544,768 –a—— C:\WINDOWS\system32\msvcr71d.dll
2007-11-26 17:31 d——– C:\Program Files\SmartSound Software
2007-11-26 17:31 d——– C:\Documents and Settings\All Users\Application Data\SmartSound Software Inc
2007-11-26 17:28 196,096 –a—— C:\WINDOWS\system32\macd32.dll
2007-11-26 17:28 138,752 –a—— C:\WINDOWS\system32\mase32.dll
2007-11-26 17:28 136,192 –a—— C:\WINDOWS\system32\mamc32.dll
2007-11-26 17:28 84,992 –a—— C:\WINDOWS\system32\ATL70.DLL
2007-11-26 17:28 57,856 –a—— C:\WINDOWS\system32\masd32.dll
2007-11-26 17:28 27,648 –a—— C:\WINDOWS\system32\ma32.dll
2007-11-26 17:27 41,219 –a—— C:\WINDOWS\RSETPATH.exe
2007-11-26 17:24 d——– C:\WINDOWS\Downloaded Installations
2007-11-26 17:24 65,536 –a—— C:\WINDOWS\system32\MFC71DEU.DLL
2007-11-26 17:24 61,440 –a—— C:\WINDOWS\system32\MFC71ITA.DLL
2007-11-26 17:24 61,440 –a—— C:\WINDOWS\system32\MFC71FRA.DLL
2007-11-26 17:24 61,440 –a—— C:\WINDOWS\system32\MFC71ESP.DLL
2007-11-26 17:24 57,344 –a—— C:\WINDOWS\system32\MFC71ENU.DLL
2007-11-26 17:24 49,152 –a—— C:\WINDOWS\system32\PCLEGetGuid.dll
2007-11-26 17:24 49,152 –a—— C:\WINDOWS\system32\MFC71KOR.DLL
2007-11-26 17:24 49,152 –a—— C:\WINDOWS\system32\MFC71JPN.DLL
2007-11-26 17:24 45,056 –a—— C:\WINDOWS\system32\MFC71CHT.DLL
2007-11-26 17:24 40,960 –a—— C:\WINDOWS\system32\MFC71CHS.DLL
2007-11-26 17:21 d——– C:\Documents and Settings\All Users\Application Data\Pinnacle Studio
2007-11-26 17:07 d——– C:\Program Files\Pinnacle
2007-11-26 17:07 d——– C:\Documents and Settings\All Users\Application Data\Pinnacle
2007-11-26 16:17 d——– C:\Program Files\Ares
2007-11-24 19:15 d——– C:\Program Files\Western Digital Technologies
2007-11-24 18:30 d——– C:\Program Files\SpywareBlaster
2007-11-23 21:10 d——– C:\Documents and Settings\Administrator\WINDOWS
2007-11-23 18:29 53,248 –a—— C:\WINDOWS\system32\Process.exe
2007-11-23 18:29 51,200 –a—— C:\WINDOWS\system32\dumphive.exe
2007-11-22 18:10 d——– C:\Documents and Settings\Mehreen\Phone Browser
2007-11-22 18:00 d——– C:\Program Files\Common Files\PCSuite
2007-11-22 18:00 d——– C:\Program Files\Common Files\Nokia
2007-11-22 17:57 d——– C:\Program Files\PC Connectivity Solution
2007-11-22 17:57 d——– C:\Program Files\Nokia
2007-11-22 17:57 65,536 –a—— C:\WINDOWS\system32\nmwcdcocls.dll
2007-11-22 01:16 d——– C:\Temp
2007-11-22 01:16 d——– C:\Program Files\AviSynth 2.5
2007-11-22 01:15 d——– C:\Program Files\Winnydows
2007-11-21 16:35 68,008 –ah—– C:\WINDOWS\system32\mlfcache.dat
2007-11-19 15:13 d——– C:\Program Files\iTunes
2007-11-19 15:13 d——– C:\Program Files\iPod
2007-11-19 15:11 d——– C:\Program Files\QuickTime
2007-11-19 15:10 d——– C:\Program Files\Common Files\Apple
2007-11-15 22:22 d——– C:\Program Files\Safari
2007-11-08 12:10 d——– C:\Program Files\PSP ISO Compressor
2007-11-03 18:37 d——– C:\Program Files\PopupPopper
2007-11-03 13:35 d——– C:\Documents and Settings\All Users\Application Data\nView_Profiles
2007-11-03 11:34 d——– C:\Program Files\Cricket 2004
2007-11-03 10:42 d——– C:\Program Files\Common Files\LightScribe
2007-11-03 10:40 d——– C:\Program Files\Common Files\Ahead
2007-11-02 16:26 d——– C:\Documents and Settings\Mehreen\Application Data\CyberLink
2007-11-02 16:26 d——– C:\Documents and Settings\All Users\Application Data\CyberLink
2007-11-02 16:17 d——– C:\MyWorks
2007-11-02 16:15 d——– C:\Program Files\CyberLink
2007-11-02 02:16 152,848 –a—— C:\WINDOWS\system32\comdlg32.OCX
2007-11-02 02:15 d——– C:\Program Files\Bit Che
2007-11-02 02:15 124,688 –a—— C:\WINDOWS\system32\mswinsck.ocx
2007-11-01 20:48 138,893 –a—— C:\WINDOWS\system32\nvapps.xml
2007-11-01 20:47 356,352 –a—— C:\WINDOWS\system32\NVUNINST.EXE
2007-11-01 20:46 d——– C:\NVIDIA
2007-11-01 12:44 d——– C:\Program Files\SystemRequirementsLab
2007-10-30 20:43 d——– C:\Program Files\iDump
2007-10-29 17:22 26,624 –a—— C:\WINDOWS\system32\drivers\aavmker4.sys
2007-10-29 17:21 95,608 –a—— C:\WINDOWS\system32\AvastSS.scr
2007-10-29 17:21 93,264 –a—— C:\WINDOWS\system32\drivers\aswmon.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-28 03:37 ——— d—–w C:\Documents and Settings\Mehreen\Application Data\uTorrent
2007-11-27 14:08 ——— d—–w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-11-27 13:13 78,912 —-a-w C:\WINDOWS\system32\thsswhfh.dll
2007-11-26 15:44 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-11-26 13:30 ——— d—–w C:\Program Files\LimeWire
2007-11-24 15:29 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-24 12:14 3,404 —-a-w C:\WINDOWS\system32\tmp.reg
2007-11-23 06:39 71,232 —-a-w C:\WINDOWS\system32\tlraeddc.exe
2007-11-22 15:10 ——— d—–w C:\Documents and Settings\Mehreen\Application Data\PC Suite
2007-11-22 15:10 ——— d—–w C:\Documents and Settings\Mehreen\Application Data\Nokia
2007-11-22 15:10 ——— d—–w C:\Documents and Settings\All Users\Application Data\PC Suite
2007-11-21 15:58 ——— d—–w C:\Documents and Settings\Mehreen\Application Data\LimeWire
2007-11-19 12:11 ——— d—–w C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-11-03 12:01 82,380 —-a-w C:\WINDOWS\system32\drivers\AFS2K.SYS
2007-11-01 22:43 ——— d—–w C:\Program Files\DivX
2007-11-01 17:46 ——— d—–w C:\Program Files\Common Files\InstallShield
2007-10-29 14:21 ——— d—–w C:\Program Files\Alwil Software
2007-10-27 14:32 ——— d—–w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-10-27 12:36 77,703 —-a-w C:\WINDOWS\system32\drivers\klif.cab
2007-10-26 09:25 ——— d—–w C:\Program Files\Windows Live Safety Center
2007-10-26 09:05 ——— d—–w C:\Program Files\Net2Phone CommCenter
2007-10-26 07:32 ——— d—–w C:\Program Files\Java
2007-10-26 07:06 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2007-10-25 16:05 94,416 —-a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-10-25 16:03 23,152 —-a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-10-25 16:01 42,912 —-a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-10-25 15:24 815,480 —-a-w C:\WINDOWS\system32\aswBoot.exe
2007-10-25 07:09 ——— d—–w C:\Documents and Settings\Mehreen\Application Data\DivX
2007-10-24 19:53 ——— d—–w C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-10-24 13:46 ——— d—–w C:\Program Files\Warcraft III
2007-10-24 13:18 ——— d—–w C:\Program Files\Windows Defender
2007-10-23 17:20 81,984 —-a-w C:\WINDOWS\system32\bdod.bin
2007-10-23 15:50 ——— d—–w C:\Documents and Settings\All Users\Application Data\Trend Micro
2007-10-22 15:38 ——— d—–w C:\Program Files\Trend Micro
2007-10-22 15:33 805 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2007-10-22 15:33 8,014 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2007-10-22 15:33 61,064 —-a-w C:\WINDOWS\system32\S32EVNT1.DLL
2007-10-22 15:33 136,248 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-10-22 15:33 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2007-10-22 15:20 ——— d—–w C:\Documents and Settings\All Users\Application Data\McAfee
2007-10-22 14:46 ——— d—–w C:\Documents and Settings\Mehreen\Application Data\SiteAdvisor
2007-10-22 14:24 ——— d—–w C:\Program Files\Windows Media Connect 2
2007-10-22 12:50 ——— d—–w C:\Documents and Settings\Mehreen\Application Data\Command & Conquer 3 Tiberium Wars
2007-10-21 17:38 ——— d—–w C:\Program Files\Creative
2007-10-21 15:30 ——— d—–w C:\Program Files\MSBuild
2007-10-21 15:30 ——— d—–w C:\Program Files\Microsoft Works
2007-10-21 15:26 ——— d—–w C:\Program Files\Microsoft.NET
2007-10-21 15:22 ——— d—–w C:\Program Files\Microsoft Visual Studio 8
2007-10-21 15:08 ——— d—–w C:\Program Files\Reference Assemblies
2007-10-21 13:26 ——— d—–w C:\Program Files\Windows Live
2007-10-21 13:25 ——— d—–w C:\Documents and Settings\All Users\Application Data\WindowsLiveInstaller
2007-10-20 17:19 ——— d—–w C:\Documents and Settings\Mehreen\Application Data\Apple Computer
2007-10-19 23:14 ——— d—–w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-10-19 18:09 ——— d—–w C:\Program Files\uTorrent
2007-10-19 18:07 ——— d—–w C:\Program Files\Common Files\Adobe
2007-10-19 15:47 ——— d—–w C:\Program Files\Xplosiv
2007-10-19 13:46 ——— d—–w C:\Program Files\CCleaner
2007-10-03 20:36 25,600 —-a-w C:\WINDOWS\system32\WS2Fix.exe
2007-10-03 15:45 ——— d—–w C:\Program Files\Apple Software Update
2007-10-03 15:45 ——— d—–w C:\Documents and Settings\All Users\Application Data\Apple
2007-09-16 23:10 356,352 —-a-w C:\WINDOWS\system32\nvudisp.exe
2007-09-16 22:07 81,920 —-a-w C:\WINDOWS\system32\nvwddi.dll
2007-09-16 22:07 81,920 —-a-w C:\WINDOWS\system32\nvmctray.dll
2007-09-16 22:07 8,491,008 —-a-w C:\WINDOWS\system32\nvcpl.dll
2007-09-16 22:07 753,664 —-a-w C:\WINDOWS\system32\nvcplui.exe
2007-09-16 22:07 6,746,112 —-a-w C:\WINDOWS\system32\nvoglnt.dll
2007-09-16 22:07 6,344,704 —-a-w C:\WINDOWS\system32\nvdisps.dll
2007-09-16 22:07 5,783,040 —-a-w C:\WINDOWS\system32\nv4_disp.dll
2007-09-16 22:07 466,944 —-a-w C:\WINDOWS\system32\nvshell.dll
2007-09-16 22:07 45,056 —-a-w C:\WINDOWS\system32\nvmccsrs.dll
2007-09-16 22:07 442,368 —-a-w C:\WINDOWS\system32\nvappbar.exe
2007-09-16 22:07 425,984 —-a-w C:\WINDOWS\system32\keystone.exe
2007-09-16 22:07 364,544 —-a-w C:\WINDOWS\system32\nvapi.dll
2007-09-16 22:07 36,864 —-a-w C:\WINDOWS\system32\nvcodins.dll
2007-09-16 22:07 36,864 —-a-w C:\WINDOWS\system32\nvcod.dll
2007-09-16 22:07 307,200 —-a-w C:\WINDOWS\system32\nvexpbar.dll
2007-09-16 22:07 3,551,232 —-a-w C:\WINDOWS\system32\nvvitvs.dll
2007-09-16 22:07 3,334,144 —-a-w C:\WINDOWS\system32\nvgames.dll
2007-09-16 22:07 286,720 —-a-w C:\WINDOWS\system32\nvnt4cpl.dll
2007-09-16 22:07 229,376 —-a-w C:\WINDOWS\system32\nvmccs.dll
2007-09-16 22:07 2,371,584 —-a-w C:\WINDOWS\system32\nvwss.dll
2007-09-16 22:07 188,416 —-a-w C:\WINDOWS\system32\nvmccss.dll
2007-09-16 22:07 155,716 —-a-w C:\WINDOWS\system32\nvsvc32.exe
2007-09-16 22:07 147,456 —-a-w C:\WINDOWS\system32\nvcolor.exe
2007-09-16 22:07 1,703,936 —-a-w C:\WINDOWS\system32\nvwdmcpl.dll
2007-09-16 22:07 1,626,112 —-a-w C:\WINDOWS\system32\nwiz.exe
2007-09-16 22:07 1,478,656 —-a-w C:\WINDOWS\system32\nview.dll
2007-09-16 22:07 1,339,392 —-a-w C:\WINDOWS\system32\nvdspsch.exe
2007-09-16 22:07 1,150,976 —-a-w C:\WINDOWS\system32\nvmobls.dll
2007-09-16 22:07 1,019,904 —-a-w C:\WINDOWS\system32\nvwimg.dll
2007-09-12 03:15 98,304 —-a-w C:\WINDOWS\System32CmdLineExt.dll
2007-09-11 01:56 126,976 —-a-w C:\WINDOWS\War3Unin.exe
2007-09-05 20:22 289,144 —-a-w C:\WINDOWS\system32\VCCLSID.exe
2006-11-04 07:32 0 —-a-w C:\Program Files\Common Files\err.log
.

((((((((((((((((((((((((((((( snapshot_2007-11-28_15.42.04.71 )))))))))))))))))))))))))))))))))))))))))
.
+ 2004-08-03 20:10:12 48,128 -c–a-w C:\WINDOWS\system32\dllcache\61883.sys
+ 2004-08-03 20:10:12 38,912 -c–a-w C:\WINDOWS\system32\dllcache\avc.sys
+ 2004-08-03 20:10:12 38,912 —-a-w C:\WINDOWS\system32\drivers\avc.sys
- 2007-11-27 14:38:52 78,642 —-a-w C:\WINDOWS\system32\perfc009.dat
+ 2007-11-28 12:42:25 78,642 —-a-w C:\WINDOWS\system32\perfc009.dat
- 2007-11-27 14:38:52 456,962 —-a-w C:\WINDOWS\system32\perfh009.dat
+ 2007-11-28 12:42:26 456,962 —-a-w C:\WINDOWS\system32\perfh009.dat
+ 2007-11-28 14:53:55 16,384 —-atw C:\WINDOWS\Temp\Perflib_Perfdata_59c.dat
+ 2007-11-28 14:54:07 16,384 —-atw C:\WINDOWS\Temp\Perflib_Perfdata_77c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="nwiz.exe" [2007-09-17 01:07 C:\WINDOWS\system32\nwiz.exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-06-29 12:08]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 18:20]
"avast!"="C:\PROGRA~1\ALWILS~1\AVAST4~1\ashDisp.exe" [2007-10-25 18:20]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2006-11-23 15:10]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2006-12-05 22:55]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-10-19 20:16]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-11-02 18:36]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-04 00:56 C:\WINDOWS\system32\rundll32.exe]
"PinnacleDriverCheck"="C:\WINDOWS\system32\PSDrvCheck.exe" [2004-03-11 01:26]
"USB2Check"="RUNDLL32.exe" [2004-08-04 00:56 C:\WINDOWS\system32\rundll32.exe]
"USBToolTip"="C:\Program Files\Pinnacle\Shared Files\\Programs\USBTip\USBTip.exe" [2006-06-01 03:37]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:56]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 10:17]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
hp psc 2000 Series.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe [2003-04-06 11:37:10]
hpoddt01.exe.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-04-06 12:06:58]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Saad^Start Menu^Programs^Startup^.protected]
path=C:\Documents and Settings\Saad\Start Menu\Programs\Startup\.protected
backup=C:\WINDOWS\pss\.protectedStartup
????

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearFlix]
C:\Program Files\BearFlix\BearFlix.exe /pause

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
2001-07-09 13:50 155648 –a—— C:\WINDOWS\System32\\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pop up Blocker]
C:\Program Files\Pop up Blocker\pd.exe Minimize

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinAntiVirus Pro 2007]
C:\Program Files\WinAntiVirus Pro 2007\WinAV.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ServiceLayer"=3 (0x3)
"SavRoam"=2 (0x2)
"LiveUpdate"=3 (0x3)
"gusvc"=3 (0x3)

S3 ctlsb16;Creative SB16/AWE32/AWE64 Driver (WDM);C:\WINDOWS\system32\drivers\ctlsb16.sys

.
Contents of the 'Scheduled Tasks' folder
"2007-11-23 17:04:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-11-28 10:33:00 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 2200 series#1162675951.job"
- C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe4-I
"2007-11-03 12:00:57 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 2200 series#1194091219.job"
- C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe4-I
"2007-11-28 14:56:53 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-28 22:16:48
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-28 22:17:57
C:\ComboFix2.txt … 2007-11-28 18:43
C:\ComboFix3.txt … 2007-11-28 15:45
.
— E O F —

done, running avast antivirus!

here is a new HJT LOG,

Logfile of HijackThis v1.99.1
Scan saved at 7:21:57 AM, on 29/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Alwil Software\Avast 4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast 4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Pinnacle\Shared Files\Programs\MediaServer\PMSHost.exe
C:\Program Files\Alwil Software\Avast 4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast 4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\PROGRA~1\ALWILS~1\AVAST4~1\ashDisp.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Safari\Safari.exe
C:\Documents and Settings\Mehreen\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Control Popups in Internet Explorer - {41353F8B-78CE-48A5-BE44-153ED293D192} - C:\PROGRA~1\POPUPP~1\PopLib.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\AVAST4~1\ashDisp.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [USB2Check] RUNDLL32.EXE "C:\WINDOWS\system32\PCLECoInst.dll",CheckUSBController
O4 - HKLM\..\Run: [USBToolTip] "C:\Program Files\Pinnacle\Shared Files\\Programs\USBTip\USBTip.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: PD - {1173A4DB-B5A8-4CB2-A646-09245DC2C589} - C:\Program Files\Pop up Blocker\pd.exe
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: PopupPopper Control Panel - {3E94F358-9537-4BBA-8D12-D7F8A0136973} - C:\Program Files\PopupPopper\SiteList.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O11 - Options group: Tabbed Browsing
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {37A273C2-5129-11D5-BF37-00A0CCE8754B} (TTestGenXInstallObject) - http://asp.mathxl.com/wizmodules/testgen/i…GenXInstall.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase4009.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1188839955832
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…/sysreqlab2.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1188841528977
O16 - DPF: {95D88B35-A521-472B-A182-BB1A98356421} (Pearson Installation Assistant 2) - http://asp.mathxl.com/books/_Players/PearsonInstallAsst2.cab
O16 - DPF: {E473A65C-8087-49A3-AFFD-C5BC4A10669B} (Quantum Streaming IE Player Class) - http://mvnet.xlontech.net/qm/fox/06101102/qsp2ie06101001.cab
O16 - DPF: {EEC9DBCC-04AD-4A1B-BEA7-C6DAD9515D5A} (Pearson MyEconLab Player Control) - http://asp.mathxl.com/books/_Players/EconPlayer.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast 4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast 4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast 4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast 4\ashWebSv.exe" /service (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MSSQL$PINNACLESYS - Unknown owner - C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe" -sPINNACLESYS (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - C:\Program Files\Pinnacle\Shared Files\Programs\MediaServer\PMSHost.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SQLAgent$PINNACLESYS - Unknown owner - C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlagent.EXE" -i PINNACLESYS (file missing)
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe