Spyware / Malware / Virus Removal

It Started with Internet Speed Moniter

5 min read

Looking for the outcome? Ask AI

parker Topic Starter

Post #1December 24, 2007, 6:03 AM UTC

I noticed Internet Speed moniter running on my computer ealier, I did some reading about it and deleted a few files and tried some generic solutions. It seems that I am actually worse off now than when I started, I tried scanning with Windows Defender and a few other programs but they dont seem to think anything is wrong. Any help would be greatly aprreciated.

Here is the Hijackthis log–

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:46:35 PM, on 12/23/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Visioneer\OneTouch 4.0\OtService.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\winlogon .exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\System32\dlcccoms.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R3 - URLSearchHook: AOLSearchHook Class - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AOL Search\AOLSearch.dll
R3 - URLSearchHook: (no name) - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - (no file)
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
F3 - REG:win.ini: load=C:\WINDOWS\System32\vtsts.exe
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [WinLogon] winlogonb.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [ICQ Net] C:\WINDOWS\winlogon.exe -stealth
O4 - HKLM\..\Run: [alchem] C:\WINDOWS\alchem.exe
O4 - HKLM\..\Run: [Win Server Updt] C:\WINDOWS\wupdt.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [satmat] C:\WINDOWS\satmat.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [QUICKCARE] C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe /P QUICKCARE
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask .exe" -atboottime
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [nvchost] C:\WINDOWS\winlogon
O4 - HKLM\..\Run: [DLCCCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [dlccmon.exe] "C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe"
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu72.exe 61A847B5BBF72815308B2B27128065E9C084320161C4661227A755E9C2933154389A
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\RunServices: [WinLogon] winlogonb.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ESPN BottomLine] C:\Program Files\ESPN\BottomLine\bline.exe
O4 - HKCU\..\Run: [Morpheus] "C:\Program Files\StreamCast\Morpheus\Morpheus.exe" -min
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [QdrModule11] "C:\Program Files\QdrModule\QdrModule11.exe"
O4 - HKCU\..\Run: [WinAble] C:\Program Files\WinAble\winable.exe
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster .exe /S
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\BitTorrent_DNA\dna.exe"
O4 - HKCU\..\Run: [QdrPack11] "C:\Program Files\QdrPack\QdrPack11.exe"
O4 - HKCU\..\Run: [Router] C:\Program Files\Router\Router.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: WG111v2 Smart Wizard Wireless Setting.lnk = ?
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://testprep.princetonreview.com
O15 - Trusted Zone: http://*.princetonreview.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1C203F13-95AD-11D0-A84B-00A0247B735B} (Sheridan ActiveTreeView Control) - https://fa.1stglobal.com/GlobalAccess/sstree.cab
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.costcophotocenter.com/CostcoActivia.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1198438920557
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {89242969-422B-46BF-B0D5-6A7B7DC4D0E0} (NAS Finder Helper) - file://D:\html\nafcom.cab
O16 - DPF: {B020B534-4AA2-4B99-BD6D-5F6EE286DF5C} (Symantec Download Bridge) - https://a248.e.akamai.net/f/248/5462/2h/www…ol/SymDlBrg.cab
O16 - DPF: {E9C9692E-F93C-11D1-ABB0-0040054FC6FB} (ProtoView DataTable Control 6.5 (OLEDB)) - https://fa.1stglobal.com/GlobalAccess/pvdt60.cab
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: dlcc_device - Unknown owner - C:\WINDOWS\System32\dlcccoms.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: OneTouch 4.0 Monitor - Visioneer Inc - C:\Program Files\Visioneer\OneTouch 4.0\OtService.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

–
End of file - 11851 bytes

Rosty

Post #2December 24, 2007, 3:57 PM UTC

Hi,

welcome to What The Tech. My name is Rosty and I'm going to help you with your log.

I see Viewpoint is installed..

Viewpoint Manager is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad". This will change from what we know in 2006 read this article.

I suggest you remove the program now. Go to Start > Settings > Control Panel > Add/Remove Programs and remove the following programs if present:
Viewpoint
Viewpoint Manager
Viewpoint Media Player and anything thats viewpoint related!!

Please open HijackThis, click Do a scan only and place a check next to the following entries:

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R3 - URLSearchHook: AOLSearchHook Class - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AOL Search\AOLSearch.dll
R3 - URLSearchHook: (no name) - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - (no file)
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O4 - HKLM\..\Run: [WinLogon] winlogonb.exe
O4 - HKLM\..\Run: [ICQ Net] C:\WINDOWS\winlogon.exe -stealth
O4 - HKLM\..\Run: [alchem] C:\WINDOWS\alchem.exe
O4 - HKLM\..\Run: [Win Server Updt] C:\WINDOWS\wupdt.exe
O4 - HKLM\..\Run: [satmat] C:\WINDOWS\satmat.exe
O4 - HKLM\..\Run: [nvchost] C:\WINDOWS\winlogon
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu72.exe 61A847B5BBF72815308B2B27128065E9C084320161C4661227A755E9C2933154389A
O4 - HKLM\..\RunServices: [WinLogon] winlogonb.exe
O4 - HKCU\..\Run: [WinAble] C:\Program Files\WinAble\winable.exe

Close all other windows and browsers, except HijackThis, and click Fix Checked. Close HijackThis.

Please delete these files using Windows Explorer(if present):

C:\WINDOWS\winlogon .exe <– do not delete the one in the "system32 folder"!!!
C:\WINDOWS\alchem.exe
C:\WINDOWS\wupdt.exe
C:\WINDOWS\satmat.exe
C:\WINDOWS\mrofinu72.exe

and the following folder:
C:\Program Files\WinAble

Download ComboFix from Here or Here to your Desktop.

Double click combofix.exe and follow the prompts.
When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

Regards,

Rosty.

parker

Post #3December 24, 2007, 10:20 PM UTC

Thanks for the help, hope you are having a good holiday. First is the ComboFix log, then the HijackThis log.

ComboFix 07-12-21.4 - Parker 2007-12-24 14:23:41.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.226 [GMT -7:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Parker\Start Menu\Programs\Internet Speed Monitor
C:\Documents and Settings\Parker\Start Menu\Programs\Internet Speed Monitor\Check Now.lnk
C:\Documents and Settings\Parker\Start Menu\Programs\Internet Speed Monitor\Uninstall.lnk
C:\Program Files\inetget2
C:\Program Files\inetget2\WinTouchInstaller_channel1.exe
C:\Program Files\QdrDrive
C:\Program Files\QdrDrive\QdrDrive9.dll
C:\Program Files\QdrDrive\qdrloader.exe
C:\Program Files\QdrModule
C:\Program Files\QdrModule\dic.gz
C:\Program Files\QdrModule\kwd.gz
C:\Program Files\QdrModule\QdrModule11 .exe
C:\Program Files\QdrModule\QdrModule11.exe
C:\Program Files\QdrPack
C:\Program Files\QdrPack\dicts.gz
C:\Program Files\QdrPack\QdrPack11 .exe
C:\Program Files\QdrPack\QdrPack11.exe
C:\Program Files\QdrPack\trgts.gz
C:\Program Files\Temporary
C:\Program Files\Temporary\wininstall.exe
C:\WINDOWS\b122.exe
C:\WINDOWS\b128.exe
C:\WINDOWS\b138.exe
C:\WINDOWS\b148.exe
C:\WINDOWS\b151.exe
C:\WINDOWS\SYSTEM32\ststv.ini
C:\WINDOWS\SYSTEM32\ststv.ini2
C:\WINDOWS\system32\vtsts.dll
C:\WINDOWS\system32\xxyabbb.dll

.
((((((((((((((((((((((((( Files Created from 2007-11-24 to 2007-12-24 )))))))))))))))))))))))))))))))
.

2007-12-24 14:44 . 2007-12-24 14:44 319 –ahs—- C:\WINDOWS\SYSTEM32\ststv.ini2
2007-12-24 14:44 . 2007-12-24 14:47 319 –ahs—- C:\WINDOWS\SYSTEM32\ststv.ini
2007-12-24 14:43 . 2007-12-24 14:43 344,064 ——— C:\WINDOWS\SYSTEM32\vtsts.dll
2007-12-23 23:42 . 2007-07-30 19:19 271,224 –a—— C:\WINDOWS\SYSTEM32\mucltui.dll
2007-12-23 23:42 . 2007-07-30 19:19 30,072 –a—— C:\WINDOWS\SYSTEM32\mucltui.dll.mui
2007-12-23 22:46 . 2007-12-23 22:46 d——– C:\Program Files\Trend Micro
2007-12-23 22:41 . 2006-07-13 01:48 202,240 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\rmcast.sys
2007-12-23 22:37 . 2007-02-09 04:10 574,464 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\ntfs.sys
2007-12-23 22:18 . 2007-12-23 22:27 159,744 –a—— C:\WINDOWS\winlogon .exe
2007-12-23 15:38 . 2007-12-23 15:38 d——– C:\WINDOWS\SYSTEM32\LogFiles
2007-12-23 15:37 . 2007-12-24 14:45 d——– C:\Program Files\Windows Defender
2007-12-23 15:32 . 2007-12-23 20:57 143 –a—— C:\WINDOWS\SYSTEM32\mcrh.tmp
2007-12-23 14:24 . 2007-12-23 14:24 0 –a—-t- C:\WINDOWS\003036_.tmp
2007-12-22 15:08 . 2007-12-22 15:08 d——– C:\Documents and Settings\Parker\Application Data\Uniblue
2007-12-22 12:38 . 2007-12-22 12:50 d——– C:\Documents and Settings\Sherry\Application Data\Yahoo!
2007-12-22 12:08 . 2007-12-24 14:46 347,648 –a—— C:\WINDOWS\SYSTEM32\vtsts.exe
2007-12-22 09:45 . 2007-12-22 09:46 d——– C:\Documents and Settings\Parker\Application Data\Yahoo!
2007-12-22 08:39 . 2007-12-22 12:50 d——– C:\Documents and Settings\All Users\Application Data\Yahoo!
2007-12-21 19:56 . 2007-12-21 19:56 d——– C:\Documents and Settings\Parker\Application Data\acccore
2007-12-21 17:39 . 2007-12-21 17:39 d——– C:\Program Files\AOL Search
2007-12-21 17:38 . 2007-12-21 19:56 d——– C:\Documents and Settings\All Users\Application Data\AOL OCP
2007-12-21 17:37 . 2007-12-21 17:39 485 –ah—– C:\IPH.PH
2007-12-21 16:09 . 2004-08-03 22:58 5,504 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\mstee.sys
2007-12-21 16:08 . 2007-12-21 16:08 d——– C:\Program Files\Common Files\logishrd
2007-12-21 16:03 . 2007-12-21 17:24 d——– C:\Documents and Settings\All Users\Application Data\Skype
2007-12-14 13:02 . 2007-12-14 17:37 38 –a—— C:\WINDOWS\AviSplitter.INI
2007-11-30 20:47 . 2007-12-21 15:00 d——– C:\Program Files\Norton Security Scan
2007-11-28 13:50 . 2007-11-28 13:50 28,929 –a—— C:\syshgmq.exe
2007-11-28 13:50 . 2007-11-28 13:50 28,929 –a—— C:\sysgvkx.exe
2007-11-28 13:42 . 2007-11-28 13:42 28,929 –a—— C:\sysevyc.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-24 21:45 ——— d—–w C:\Program Files\QuickTime
2007-12-24 21:45 ——— d—–w C:\Program Files\Microsoft IntelliPoint
2007-12-24 21:45 ——— d—–w C:\Program Files\Dell Photo AIO Printer 924
2007-12-24 21:44 ——— d—–w C:\Program Files\MSN Messenger
2007-12-24 20:27 ——— d—–w C:\Documents and Settings\All Users\Application Data\Viewpoint
2007-12-24 06:15 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2007-12-23 00:25 ——— d—–w C:\Program Files\Common Files\GMT
2007-12-23 00:25 ——— d—–w C:\Program Files\Common Files\CMEII
2007-12-22 19:42 ——— d—–w C:\Program Files\Google
2007-12-22 19:40 ——— d—–w C:\Program Files\Common Files\AOL
2007-12-22 19:12 ——— d—–w C:\Program Files\Norton Internet Security
2007-12-22 19:09 805 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2007-12-22 19:09 60,800 —-a-w C:\WINDOWS\SYSTEM32\S32EVNT1.DLL
2007-12-22 19:09 123,952 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-12-22 19:09 10,740 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2007-12-22 19:09 ——— d—–w C:\Program Files\Symantec
2007-12-22 00:38 ——— d—–w C:\Documents and Settings\All Users\Application Data\AOL
2007-12-21 17:00 ——— d—–w C:\Documents and Settings\Parker\Application Data\BitTorrent
2007-12-19 20:55 ——— d—–w C:\Documents and Settings\Parker\Application Data\SopCast
2007-12-19 03:29 ——— d—–w C:\Program Files\dl_Cats
2007-12-07 08:35 ——— d—–w C:\Documents and Settings\Parker\Application Data\NewzToolz
2007-11-14 04:42 ——— d—–w C:\Documents and Settings\Parker\Application Data\Media Player Classic
2007-11-14 04:41 ——— d—–w C:\Program Files\Satsuki Decoder Pack
2007-11-13 03:20 ——— d—–w C:\Documents and Settings\Parker\Application Data\BitTorrent DNA
2007-11-10 23:08 ——— d—–w C:\Documents and Settings\Parker\Application Data\HorizonWimba
2007-11-10 10:21 ——— d—–w C:\Documents and Settings\Parker\Application Data\MixMeister Technology
2007-11-10 10:03 ——— d—–w C:\Program Files\NewzToolz
2007-11-09 10:00 ——— d—–w C:\Program Files\MSXML 4.0
2007-11-07 18:06 ——— d—–w C:\Program Files\Hewlett-Packard
2007-11-07 18:03 ——— d—–w C:\Program Files\HP
2007-11-03 15:16 ——— d—–w C:\Program Files\TVUPlayer
2007-11-01 16:36 ——— d—–w C:\Program Files\TVAnts
2007-10-31 19:56 ——— d—–w C:\Documents and Settings\Parker\Application Data\TVU Networks
2007-10-27 22:05 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-10-27 22:05 ——— d—–w C:\Program Files\NETGEAR
2007-10-12 09:00 490,008 —-a-w C:\WINDOWS\SYSTEM32\LVUI2.dll
2007-10-12 09:00 465,432 —-a-w C:\WINDOWS\SYSTEM32\LVUI2RC.dll
2007-10-12 08:57 416,280 —-a-w C:\WINDOWS\SYSTEM32\lvcodec2.dll
2007-10-12 08:57 195,096 —-a-w C:\WINDOWS\SYSTEM32\lvci1150.dll
2007-10-12 08:18 21,138 —-a-w C:\WINDOWS\SYSTEM32\Repository.reg
2007-10-01 21:49 542,088 —-a-w C:\WINDOWS\SYSTEM32\SymNeti.dll
2007-10-01 21:49 161,160 —-a-w C:\WINDOWS\SYSTEM32\SymRedir.dll
2007-09-19 15:27 60,968 —-a-w C:\Documents and Settings\Sherry\GoToAssistDownloadHelper.exe
2007-03-31 23:53 10,458 —-a-w C:\Program Files\INSTALL.LOG
2007-02-15 19:47 63,048 —-a-w C:\Documents and Settings\Sherry\Application Data\GDIPFONTCACHEV1.DAT
2006-06-27 14:53 63,048 —-a-w C:\Documents and Settings\Parker\Application Data\GDIPFONTCACHEV1.DAT
2002-08-29 15:00 557,128 —-a-w C:\Program Files\Common Files\dao360.dll
2001-11-05 16:30 165,376 —-a-w C:\Program Files\UNWISE.EXE
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{225FC575-E92E-49F2-8CC7-F9BFCF6480AF}]
C:\WINDOWS\SYSTEM32\moaa030425s.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22}]
2007-12-18 12:27 111968 –a—— C:\Program Files\AOL Search\AOLSearch.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5E07FA2C-9827-48E2-9FDA-922D09A0A44C}]
C:\WINDOWS\SYSTEM32\mo030414s.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DBE42DEE-A195-4F07-A336-DDC3122154D4}]
2007-12-24 14:43 344064 ——— C:\WINDOWS\System32\vtsts.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F85A4A62-8DBE-4D3C-9C1C-7CF1D3A3E1E1}]
C:\WINDOWS\SYSTEM32\lxkjeq.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56]
"ESPN BottomLine"="C:\Program Files\ESPN\BottomLine\bline.exe" []
"Morpheus"="C:\Program Files\StreamCast\Morpheus\Morpheus.exe" []
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-12-24 14:44]
"RealPlayer"="C:\Program Files\Real\RealPlayer\realplay.exe" [2007-12-24 14:45]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" []
"Aim6"="C:\Program Files\AIM6\aim6.exe" []
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" []
"QdrModule11"="C:\Program Files\QdrModule\QdrModule11.exe" []
"Uniblue RegistryBooster 2"="C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster .exe" []
"BitTorrent DNA"="C:\Program Files\BitTorrent_DNA\dna.exe" []
"QdrPack11"="C:\Program Files\QdrPack\QdrPack11.exe" []
"Router"="C:\Program Files\Router\Router.exe" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [2007-12-24 14:45]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-12-24 14:45]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2007-12-24 14:45]
"QuickTime Task"="C:\Program Files\QuickTime\qttask .exe" [2007-12-24 14:45]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 17:30]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" []
"HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2007-12-24 14:45]
"nvchost"="C:\WINDOWS\winlogon " []
"DLCCCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll" [2006-02-24 16:11]
"dlccmon.exe"="C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe" [2007-12-24 14:45]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-12-24 14:45]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2002-10-16 17:06:48]
WG111v2 Smart Wizard Wireless Setting.lnk - C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe [2007-10-27 15:05:21]

[HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\windows]
"load"=C:\WINDOWS\System32\vtsts.exe

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\System32\vtsts

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2007-12-24 21:42:30 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2007-10-23 14:52:18 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Sherry.job"
- C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exeh/TASK:
"2007-12-21 23:49:32 C:\WINDOWS\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-24 14:44:19
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-24 14:56:29 - machine was rebooted
.
2007-12-24 20:31:16 — E O F —
——————————————————————————————————————————————————————-

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:16:07 PM, on 12/24/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Visioneer\OneTouch 4.0\OtService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Microsoft IntelliPoint\ipoint .exe
C:\Program Files\Dell Photo AIO Printer 924\dlccmon .exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\MsnMsgr .Exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\System32\dlcccoms.exe
C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe
C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtWLan.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com/
R3 - URLSearchHook: AOLSearchHook Class - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AOL Search\AOLSearch.dll
F3 - REG:win.ini: load=C:\WINDOWS\System32\vtsts.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask .exe" -atboottime
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [nvchost] C:\WINDOWS\winlogon
O4 - HKLM\..\Run: [DLCCCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [dlccmon.exe] "C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ESPN BottomLine] C:\Program Files\ESPN\BottomLine\bline.exe
O4 - HKCU\..\Run: [Morpheus] "C:\Program Files\StreamCast\Morpheus\Morpheus.exe" -min
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [QdrModule11] "C:\Program Files\QdrModule\QdrModule11.exe"
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster .exe /S
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\BitTorrent_DNA\dna.exe"
O4 - HKCU\..\Run: [QdrPack11] "C:\Program Files\QdrPack\QdrPack11.exe"
O4 - HKCU\..\Run: [Router] C:\Program Files\Router\Router.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: WG111v2 Smart Wizard Wireless Setting.lnk = ?
O8 - Extra context menu item: &AOL; Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://testprep.princetonreview.com
O15 - Trusted Zone: http://*.princetonreview.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1C203F13-95AD-11D0-A84B-00A0247B735B} (Sheridan ActiveTreeView Control) - https://fa.1stglobal.com/GlobalAccess/sstree.cab
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.costcophotocenter.com/CostcoActivia.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1198438920557
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {89242969-422B-46BF-B0D5-6A7B7DC4D0E0} (NAS Finder Helper) - file://D:\html\nafcom.cab
O16 - DPF: {B020B534-4AA2-4B99-BD6D-5F6EE286DF5C} (Symantec Download Bridge) - https://a248.e.akamai.net/f/248/5462/2h/www…ol/SymDlBrg.cab
O16 - DPF: {E9C9692E-F93C-11D1-ABB0-0040054FC6FB} (ProtoView DataTable Control 6.5 (OLEDB)) - https://fa.1stglobal.com/GlobalAccess/pvdt60.cab
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: dlcc_device - Unknown owner - C:\WINDOWS\System32\dlcccoms.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: OneTouch 4.0 Monitor - Visioneer Inc - C:\Program Files\Visioneer\OneTouch 4.0\OtService.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

–
End of file - 9028 bytes

Rosty

Post #4December 25, 2007, 9:23 AM UTC last edited December 25, 2007, 9:24 AM UTC

Hi,

Thanks for the help, hope you are having a good holiday.

Thanks, hoping he same for you.

Open HijackThis, click do a scan only and place a check next to the following entries:

F3 - REG:win.ini: load=C:\WINDOWS\System32\vtsts.exe
O4 - HKLM\..\Run: [nvchost] C:\WINDOWS\winlogon
O4 - HKCU\..\Run: [QdrModule11] "C:\Program Files\QdrModule\QdrModule11.exe"
O4 - HKCU\..\Run: [QdrPack11] "C:\Program Files\QdrPack\QdrPack11.exe"
O16 - DPF: {89242969-422B-46BF-B0D5-6A7B7DC4D0E0} (NAS Finder Helper) - file://D:\html\nafcom.cab

Close all other wndows and browsers, except HijackThis, and click Fix Checked. Close HijackThis.

Next,
1. Please open Notepad

Click Start , then Run
Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
C:\WINDOWS\SYSTEM32\ststv.ini2
C:\WINDOWS\SYSTEM32\ststv.ini
C:\WINDOWS\SYSTEM32\vtsts.dll
C:\WINDOWS\winlogon .exe
C:\WINDOWS\003036_.tmp
C:\WINDOWS\SYSTEM32\vtsts.exe
C:\syshgmq.exe
C:\sysgvkx.exe
C:\sysevyc.exe

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{225FC575-E92E-49F2-8CC7-F9BFCF6480AF}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5E07FA2C-9827-48E2-9FDA-922D09A0A44C}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DBE42DEE-A195-4F07-A336-DDC3122154D4}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F85A4A62-8DBE-4D3C-9C1C-7CF1D3A3E1E1}]
[HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\windows]
"load"=-

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]

5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt
A new HijackThis log.

parker

Post #5December 27, 2007, 12:57 AM UTC

Many thanks again. Here are the new logs:

ComboFix Log–

ComboFix 07-12-21.4 - Parker 2007-12-26 16:42:28.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.270 [GMT -7:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Parker\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\sysevyc.exe
C:\sysgvkx.exe
C:\syshgmq.exe
C:\WINDOWS\003036_.tmp
C:\WINDOWS\SYSTEM32\ststv.ini
C:\WINDOWS\SYSTEM32\ststv.ini2
C:\WINDOWS\SYSTEM32\vtsts.dll
C:\WINDOWS\SYSTEM32\vtsts.exe
C:\WINDOWS\winlogon .exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\sysevyc.exe
C:\sysgvkx.exe
C:\syshgmq.exe
C:\WINDOWS\003036_.tmp
C:\WINDOWS\SYSTEM32\ststv.ini
C:\WINDOWS\SYSTEM32\ststv.ini2
C:\WINDOWS\SYSTEM32\vtsts.dll
C:\WINDOWS\SYSTEM32\vtsts.exe

.
((((((((((((((((((((((((( Files Created from 2007-11-27 to 2007-12-27 )))))))))))))))))))))))))))))))
.

2007-12-26 17:31 . 2007-12-26 17:31 319 –ahs—- C:\WINDOWS\SYSTEM32\ststv.ini2
2007-12-26 17:31 . 2007-12-26 17:33 319 –ahs—- C:\WINDOWS\SYSTEM32\ststv.ini
2007-12-26 17:30 . 2007-12-26 17:31 344,064 –a—— C:\WINDOWS\SYSTEM32\vtsts.dll
2007-12-25 09:40 . 2007-12-25 09:40 347,648 –a—— C:\WINDOWS\SYSTEM32\RCX23.tmp
2007-12-25 03:46 . 2007-12-25 03:46 d——– C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-12-25 03:33 . 2006-08-21 02:14 128,896 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\fltmgr.sys
2007-12-25 03:33 . 2006-08-21 02:14 23,040 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\fltmc.exe
2007-12-25 03:33 . 2006-08-21 05:21 16,896 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\fltlib.dll
2007-12-24 13:50 . 2007-07-09 06:09 584,192 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\rpcrt4.dll
2007-12-24 13:45 . 2006-06-22 03:47 181,248 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\rasmans.dll
2007-12-24 13:44 . 2007-10-29 15:43 1,287,680 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\quartz.dll
2007-12-23 23:42 . 2007-07-30 19:19 271,224 –a—— C:\WINDOWS\SYSTEM32\mucltui.dll
2007-12-23 23:42 . 2007-07-30 19:19 30,072 –a—— C:\WINDOWS\SYSTEM32\mucltui.dll.mui
2007-12-23 22:46 . 2007-12-23 22:46 d——– C:\Program Files\Trend Micro
2007-12-23 22:41 . 2006-07-13 01:48 202,240 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\rmcast.sys
2007-12-23 22:37 . 2007-02-09 04:10 574,464 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\ntfs.sys
2007-12-23 22:18 . 2007-12-23 22:27 159,744 –a—— C:\WINDOWS\winlogon .exe
2007-12-23 15:38 . 2007-12-23 15:38 d——– C:\WINDOWS\SYSTEM32\LogFiles
2007-12-23 15:37 . 2007-12-26 17:32 d——– C:\Program Files\Windows Defender
2007-12-23 15:32 . 2007-12-23 20:57 143 –a—— C:\WINDOWS\SYSTEM32\mcrh.tmp
2007-12-22 15:08 . 2007-12-22 15:08 d——– C:\Documents and Settings\Parker\Application Data\Uniblue
2007-12-22 12:38 . 2007-12-22 12:50 d——– C:\Documents and Settings\Sherry\Application Data\Yahoo!
2007-12-22 09:45 . 2007-12-22 09:46 d——– C:\Documents and Settings\Parker\Application Data\Yahoo!
2007-12-22 08:39 . 2007-12-22 12:50 d——– C:\Documents and Settings\All Users\Application Data\Yahoo!
2007-12-21 19:56 . 2007-12-21 19:56 d——– C:\Documents and Settings\Parker\Application Data\acccore
2007-12-21 17:39 . 2007-12-21 17:39 d——– C:\Program Files\AOL Search
2007-12-21 17:38 . 2007-12-21 19:56 d——– C:\Documents and Settings\All Users\Application Data\AOL OCP
2007-12-21 17:37 . 2007-12-21 17:39 485 –ah—– C:\IPH.PH
2007-12-21 16:09 . 2004-08-03 22:58 5,504 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\mstee.sys
2007-12-21 16:08 . 2007-12-21 16:08 d——– C:\Program Files\Common Files\logishrd
2007-12-21 16:03 . 2007-12-21 17:24 d——– C:\Documents and Settings\All Users\Application Data\Skype
2007-12-14 13:02 . 2007-12-14 17:37 38 –a—— C:\WINDOWS\AviSplitter.INI
2007-11-30 20:47 . 2007-12-21 15:00 d——– C:\Program Files\Norton Security Scan

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-27 00:32 347,648 —-a-w C:\WINDOWS\SYSTEM32\vtsts.exe
2007-12-27 00:32 ——— d—–w C:\Program Files\QuickTime
2007-12-27 00:32 ——— d—–w C:\Program Files\Microsoft IntelliPoint
2007-12-27 00:32 ——— d—–w C:\Program Files\Dell Photo AIO Printer 924
2007-12-27 00:31 ——— d—–w C:\Program Files\MSN Messenger
2007-12-24 20:27 ——— d—–w C:\Documents and Settings\All Users\Application Data\Viewpoint
2007-12-24 06:15 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2007-12-23 00:25 ——— d—–w C:\Program Files\Common Files\GMT
2007-12-23 00:25 ——— d—–w C:\Program Files\Common Files\CMEII
2007-12-22 19:42 ——— d—–w C:\Program Files\Google
2007-12-22 19:40 ——— d—–w C:\Program Files\Common Files\AOL
2007-12-22 19:12 ——— d—–w C:\Program Files\Norton Internet Security
2007-12-22 19:09 805 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2007-12-22 19:09 60,800 —-a-w C:\WINDOWS\SYSTEM32\S32EVNT1.DLL
2007-12-22 19:09 123,952 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-12-22 19:09 10,740 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2007-12-22 19:09 ——— d—–w C:\Program Files\Symantec
2007-12-22 00:38 ——— d—–w C:\Documents and Settings\All Users\Application Data\AOL
2007-12-21 17:00 ——— d—–w C:\Documents and Settings\Parker\Application Data\BitTorrent
2007-12-19 20:55 ——— d—–w C:\Documents and Settings\Parker\Application Data\SopCast
2007-12-19 03:29 ——— d—–w C:\Program Files\dl_Cats
2007-12-07 08:35 ——— d—–w C:\Documents and Settings\Parker\Application Data\NewzToolz
2007-11-14 07:26 450,560 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\jscript.dll
2007-11-14 04:42 ——— d—–w C:\Documents and Settings\Parker\Application Data\Media Player Classic
2007-11-14 04:41 ——— d—–w C:\Program Files\Satsuki Decoder Pack
2007-11-13 10:25 20,480 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-13 03:20 ——— d—–w C:\Documents and Settings\Parker\Application Data\BitTorrent DNA
2007-11-10 23:08 ——— d—–w C:\Documents and Settings\Parker\Application Data\HorizonWimba
2007-11-10 10:21 ——— d—–w C:\Documents and Settings\Parker\Application Data\MixMeister Technology
2007-11-10 10:03 ——— d—–w C:\Program Files\NewzToolz
2007-11-09 10:00 ——— d—–w C:\Program Files\MSXML 4.0
2007-11-07 18:06 ——— d—–w C:\Program Files\Hewlett-Packard
2007-11-07 18:03 ——— d—–w C:\Program Files\HP
2007-11-03 15:16 ——— d—–w C:\Program Files\TVUPlayer
2007-11-01 16:36 ——— d—–w C:\Program Files\TVAnts
2007-10-31 19:56 ——— d—–w C:\Documents and Settings\Parker\Application Data\TVU Networks
2007-10-30 10:16 3,058,688 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtml.dll
2007-10-29 22:43 1,287,680 —-a-w C:\WINDOWS\SYSTEM32\quartz.dll
2007-10-28 00:40 227,328 —-a-w C:\WINDOWS\SYSTEM32\wmasf.dll
2007-10-28 00:40 227,328 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wmasf.dll
2007-10-27 22:05 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-10-27 22:05 ——— d—–w C:\Program Files\NETGEAR
2007-10-26 03:36 8,454,656 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\shell32.dll
2007-10-12 09:00 490,008 —-a-w C:\WINDOWS\SYSTEM32\LVUI2.dll
2007-10-12 09:00 465,432 —-a-w C:\WINDOWS\SYSTEM32\LVUI2RC.dll
2007-10-12 08:57 416,280 —-a-w C:\WINDOWS\SYSTEM32\lvcodec2.dll
2007-10-12 08:57 195,096 —-a-w C:\WINDOWS\SYSTEM32\lvci1150.dll
2007-10-12 08:18 21,138 —-a-w C:\WINDOWS\SYSTEM32\Repository.reg
2007-10-11 06:13 96,256 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\inseng.dll
2007-10-11 06:13 659,456 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\wininet.dll
2007-10-11 06:13 615,424 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\urlmon.dll
2007-10-11 06:13 55,808 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\extmgr.dll
2007-10-11 06:13 532,480 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\mstime.dll
2007-10-11 06:13 474,112 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\shlwapi.dll
2007-10-11 06:13 449,024 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtmled.dll
2007-10-11 06:13 39,424 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\pngfilt.dll
2007-10-11 06:13 357,888 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\dxtmsft.dll
2007-10-11 06:13 251,392 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\iepeers.dll
2007-10-11 06:13 205,312 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\dxtrans.dll
2007-10-11 06:13 16,384 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\jsproxy.dll
2007-10-11 06:13 151,040 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\cdfview.dll
2007-10-11 06:13 146,432 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\msrating.dll
2007-10-11 06:13 1,494,528 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\shdocvw.dll
2007-10-11 06:13 1,054,208 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\danim.dll
2007-10-11 06:13 1,023,488 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\browseui.dll
2007-10-10 11:16 18,432 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\iedw.exe
2007-10-01 21:49 542,088 —-a-w C:\WINDOWS\SYSTEM32\SymNeti.dll
2007-10-01 21:49 161,160 —-a-w C:\WINDOWS\SYSTEM32\SymRedir.dll
2007-09-19 15:27 60,968 —-a-w C:\Documents and Settings\Sherry\GoToAssistDownloadHelper.exe
2007-03-31 23:53 10,458 —-a-w C:\Program Files\INSTALL.LOG
2007-02-15 19:47 63,048 —-a-w C:\Documents and Settings\Sherry\Application Data\GDIPFONTCACHEV1.DAT
2006-06-27 14:53 63,048 —-a-w C:\Documents and Settings\Parker\Application Data\GDIPFONTCACHEV1.DAT
2002-08-29 15:00 557,128 —-a-w C:\Program Files\Common Files\dao360.dll
2001-11-05 16:30 165,376 —-a-w C:\Program Files\UNWISE.EXE
.

((((((((((((((((((((((((((((( snapshot@2007-12-24_14.48.22.09 )))))))))))))))))))))))))))))))))))))))))
.
+ 2004-11-17 17:31:32 347,136 —-a-w C:\WINDOWS\$hf_mig$\KB873339\SP2QFE\hypertrm.dll
+ 2004-10-14 17:34:52 7,168 —-a-w C:\WINDOWS\$hf_mig$\KB873339\spmsg.dll
+ 2004-10-14 17:36:18 169,984 —-a-w C:\WINDOWS\$hf_mig$\KB873339\spuninst.exe
+ 2004-10-14 17:36:16 21,504 —-a-w C:\WINDOWS\$hf_mig$\KB873339\update\spcustom.dll
+ 2004-10-14 17:34:54 654,848 —-a-w C:\WINDOWS\$hf_mig$\KB873339\update\update.exe
+ 2004-10-28 01:28:18 721,920 —-a-w C:\WINDOWS\$hf_mig$\KB885835\SP2QFE\lsasrv.dll
+ 2004-10-28 01:15:16 448,128 —-a-w C:\WINDOWS\$hf_mig$\KB885835\SP2QFE\mrxsmb.sys
+ 2004-10-28 01:14:56 174,592 —-a-w C:\WINDOWS\$hf_mig$\KB885835\SP2QFE\rdbss.sys
+ 2004-10-14 18:34:52 7,168 —-a-w C:\WINDOWS\$hf_mig$\KB885835\spmsg.dll
+ 2004-10-14 18:36:18 169,984 —-a-w C:\WINDOWS\$hf_mig$\KB885835\spuninst.exe
+ 2004-10-14 18:36:16 21,504 —-a-w C:\WINDOWS\$hf_mig$\KB885835\update\spcustom.dll
+ 2004-10-14 18:34:54 654,848 —-a-w C:\WINDOWS\$hf_mig$\KB885835\update\update.exe
+ 2004-10-14 18:34:52 7,168 —-a-w C:\WINDOWS\$hf_mig$\KB885836\spmsg.dll
+ 2004-10-14 18:36:18 169,984 —-a-w C:\WINDOWS\$hf_mig$\KB885836\spuninst.exe
+ 2004-10-14 18:36:16 21,504 —-a-w C:\WINDOWS\$hf_mig$\KB885836\update\spcustom.dll
+ 2004-10-14 18:34:54 654,848 —-a-w C:\WINDOWS\$hf_mig$\KB885836\update\update.exe
+ 2004-09-29 22:31:17 134,912 —-a-w C:\WINDOWS\$hf_mig$\KB886185\SP2QFE\ipnat.sys
+ 2004-10-14 18:34:51 7,168 —-a-w C:\WINDOWS\$hf_mig$\KB886185\spmsg.dll
+ 2004-10-14 18:36:16 169,984 —-a-w C:\WINDOWS\$hf_mig$\KB886185\spuninst.exe
+ 2004-10-14 18:36:15 21,504 —-a-w C:\WINDOWS\$hf_mig$\KB886185\update\spcustom.dll
+ 2004-10-14 18:34:52 654,848 —-a-w C:\WINDOWS\$hf_mig$\KB886185\update\update.exe
+ 2004-10-13 16:21:24 1,694,208 —-a-w C:\WINDOWS\$hf_mig$\KB887472\SP2QFE\msmsgs.exe
+ 2004-10-14 18:34:52 7,168 —-a-w C:\WINDOWS\$hf_mig$\KB887472\spmsg.dll
+ 2004-10-14 18:36:18 169,984 —-a-w C:\WINDOWS\$hf_mig$\KB887472\spuninst.exe
+ 2004-10-14 18:36:16 21,504 —-a-w C:\WINDOWS\$hf_mig$\KB887472\update\spcustom.dll
+ 2004-10-14 18:34:54 654,848 —-a-w C:\WINDOWS\$hf_mig$\KB887472\update\update.exe
+ 2004-12-07 19:29:19 96,768 —-a-w C:\WINDOWS\$hf_mig$\KB888302\SP2QFE\srvsvc.dll
+ 2004-11-30 21:46:38 7,168 —-a-w C:\WINDOWS\$hf_mig$\KB888302\spmsg.dll
+ 2004-12-01 03:22:42 169,984 —-a-w C:\WINDOWS\$hf_mig$\KB888302\spuninst.exe
+ 2004-12-01 03:22:40 21,504 —-a-w C:\WINDOWS\$hf_mig$\KB888302\update\spcustom.dll
+ 2004-11-30 21:46:40 654,848 —-a-w C:\WINDOWS\$hf_mig$\KB888302\update\update.exe
+ 2005-04-22 05:18:52 57,344 —-a-w C:\WINDOWS\$hf_mig$\KB890046\SP2QFE\agentdpv.dll
+ 2005-05-17 00:26:30 17,920 —-a-w C:\WINDOWS\$hf_mig$\KB890046\SP2QFE\xpsp3res.dll
+ 2005-02-25 03:35:06 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB890046\spmsg.dll
+ 2005-02-25 03:35:06 209,632 —-a-w C:\WINDOWS\$hf_mig$\KB890046\spuninst.exe
+ 2005-02-25 03:35:06 22,240 —-a-w C:\WINDOWS\$hf_mig$\KB890046\update\spcustom.dll
+ 2005-02-25 03:35:06 718,048 —-a-w C:\WINDOWS\$hf_mig$\KB890046\update\update.exe
+ 2005-02-25 03:35:08 371,936 —-a-w C:\WINDOWS\$hf_mig$\KB890046\update\updspapi.dll
+ 2005-03-02 18:19:56 62,464 —-a-w C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\authz.dll
+ 2005-03-02 01:02:13 2,135,552 —-a-w C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntkrnlmp.exe
+ 2005-03-02 00:36:40 2,056,832 —-a-w C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
+ 2005-03-02 00:36:41 2,015,232 —-a-w C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntkrpamp.exe
+ 2005-03-02 01:04:22 2,179,456 —-a-w C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
+ 2005-03-02 18:19:56 577,024 —-a-w C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll
+ 2005-03-02 01:11:25 1,836,160 —-a-w C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\win32k.sys
+ 2005-03-02 18:19:56 291,328 —-a-w C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\winsrv.dll
+ 2005-02-25 02:35:06 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB890859\spmsg.dll
+ 2005-02-25 02:35:06 209,632 —-a-w C:\WINDOWS\$hf_mig$\KB890859\spuninst.exe
+ 2005-02-25 02:35:06 22,240 —-a-w C:\WINDOWS\$hf_mig$\KB890859\update\spcustom.dll
+ 2005-02-25 02:35:06 718,048 —-a-w C:\WINDOWS\$hf_mig$\KB890859\update\update.exe
+ 2005-02-25 02:35:08 371,936 —-a-w C:\WINDOWS\$hf_mig$\KB890859\update\updspapi.dll
+ 2004-11-30 21:46:38 7,168 —-a-w C:\WINDOWS\$hf_mig$\KB891781\spmsg.dll
+ 2004-12-01 03:22:42 169,984 —-a-w C:\WINDOWS\$hf_mig$\KB891781\spuninst.exe
+ 2004-12-01 03:22:40 21,504 —-a-w C:\WINDOWS\$hf_mig$\KB891781\update\spcustom.dll
+ 2004-11-30 21:46:40 654,848 —-a-w C:\WINDOWS\$hf_mig$\KB891781\update\update.exe
+ 2005-07-08 16:28:58 249,344 —-a-w C:\WINDOWS\$hf_mig$\KB893756\SP2QFE\tapisrv.dll
+ 2005-02-25 03:35:06 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB893756\spmsg.dll
+ 2005-02-25 03:35:06 209,632 —-a-w C:\WINDOWS\$hf_mig$\KB893756\spuninst.exe
+ 2005-07-08 02:27:08 30,720 —-a-w C:\WINDOWS\$hf_mig$\KB893756\update\arpidfix.exe
+ 2005-02-25 03:35:06 22,240 —-a-w C:\WINDOWS\$hf_mig$\KB893756\update\spcustom.dll
+ 2005-02-25 03:35:06 718,048 —-a-w C:\WINDOWS\$hf_mig$\KB893756\update\update.exe
+ 2005-02-25 03:35:08 371,936 —-a-w C:\WINDOWS\$hf_mig$\KB893756\update\updspapi.dll
+ 2005-04-28 19:35:02 1,286,144 —-a-w C:\WINDOWS\$hf_mig$\KB894391\SP2QFE\ole32.dll
+ 2005-04-28 19:35:01 74,752 —-a-w C:\WINDOWS\$hf_mig$\KB894391\SP2QFE\olecli32.dll
+ 2005-04-28 19:35:01 37,376 —-a-w C:\WINDOWS\$hf_mig$\KB894391\SP2QFE\olecnv32.dll
+ 2005-04-28 19:35:01 396,288 —-a-w C:\WINDOWS\$hf_mig$\KB894391\SP2QFE\rpcss.dll
+ 2005-02-25 03:35:06 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB894391\spmsg.dll
+ 2005-02-25 03:35:06 209,632 —-a-w C:\WINDOWS\$hf_mig$\KB894391\spuninst.exe
+ 2005-02-25 03:35:06 22,240 —-a-w C:\WINDOWS\$hf_mig$\KB894391\update\spcustom.dll
+ 2005-02-25 03:35:06 718,048 —-a-w C:\WINDOWS\$hf_mig$\KB894391\update\update.exe
+ 2005-02-25 03:35:08 371,936 —-a-w C:\WINDOWS\$hf_mig$\KB894391\update\updspapi.dll
+ 2005-05-26 23:26:50 10,752 —-a-w C:\WINDOWS\$hf_mig$\KB896358\SP2QFE\hh.exe
+ 2005-05-27 02:08:59 41,472 —-a-w C:\WINDOWS\$hf_mig$\KB896358\SP2QFE\hhsetup.dll
+ 2005-05-27 02:08:59 155,136 —-a-w C:\WINDOWS\$hf_mig$\KB896358\SP2QFE\itircl.dll
+ 2005-05-27 02:08:59 137,216 —-a-w C:\WINDOWS\$hf_mig$\KB896358\SP2QFE\itss.dll
+ 2005-02-25 03:35:06 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB896358\spmsg.dll
+ 2005-02-25 03:35:06 209,632 —-a-w C:\WINDOWS\$hf_mig$\KB896358\spuninst.exe
+ 2005-02-25 03:35:06 22,240 —-a-w C:\WINDOWS\$hf_mig$\KB896358\update\spcustom.dll
+ 2005-02-25 03:35:06 718,048 —-a-w C:\WINDOWS\$hf_mig$\KB896358\update\update.exe
+ 2005-02-25 03:35:08 371,936 —-a-w C:\WINDOWS\$hf_mig$\KB896358\update\updspapi.dll
+ 2005-06-11 00:17:13 57,856 —-a-w C:\WINDOWS\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
+ 2005-02-25 03:35:06 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB896423\spmsg.dll
+ 2005-02-25 03:35:06 209,632 —-a-w C:\WINDOWS\$hf_mig$\KB896423\spuninst.exe
+ 2005-06-29 23:54:32 30,720 —-a-w C:\WINDOWS\$hf_mig$\KB896423\update\arpidfix.exe
+ 2005-02-25 03:35:06 22,240 —-a-w C:\WINDOWS\$hf_mig$\KB896423\update\spcustom.dll
+ 2005-02-25 03:35:06 718,048 —-a-w C:\WINDOWS\$hf_mig$\KB896423\update\update.exe
+ 2005-02-25 03:35:08 371,936 —-a-w C:\WINDOWS\$hf_mig$\KB896423\update\updspapi.dll
+ 2005-05-10 23:51:10 75,776 —-a-w C:\WINDOWS\$hf_mig$\KB896428\SP2QFE\telnet.exe
+ 2005-02-25 03:35:06 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB896428\spmsg.dll
+ 2005-02-25 03:35:06 209,632 —-a-w C:\WINDOWS\$hf_mig$\KB896428\spuninst.exe
+ 2005-02-25 03:35:06 22,240 —-a-w C:\WINDOWS\$hf_mig$\KB896428\update\spcustom.dll
+ 2005-02-25 03:35:06 718,048 —-a-w C:\WINDOWS\$hf_mig$\KB896428\update\update.exe
+ 2005-02-25 03:35:08 371,936 —-a-w C:\WINDOWS\$hf_mig$\KB896428\update\updspapi.dll
+ 2005-06-15 17:42:35 297,984 —-a-w C:\WINDOWS\$hf_mig$\KB899587\SP2QFE\kerberos.dll
+ 2005-02-25 03:35:06 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB899587\spmsg.dll
+ 2005-02-25 03:35:06 209,632 —-a-w C:\WINDOWS\$hf_mig$\KB899587\spuninst.exe
+ 2005-06-29 23:54:32 30,720 —-a-w C:\WINDOWS\$hf_mig$\KB899587\update\arpidfix.exe
+ 2005-02-25 03:35:06 22,240 —-a-w C:\WINDOWS\$hf_mig$\KB899587\update\spcustom.dll
+ 2005-02-25 03:35:06 718,048 —-a-w C:\WINDOWS\$hf_mig$\KB899587\update\update.exe
+ 2005-02-25 03:35:08 371,936 —-a-w C:\WINDOWS\$hf_mig$\KB899587\update\updspapi.dll
+ 2005-06-10 04:06:01 139,528 —-a-w C:\WINDOWS\$hf_mig$\KB899591\SP2QFE\rdpwd.sys
+ 2005-02-25 03:35:06 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB899591\spmsg.dll
+ 2005-02-25 03:35:06 209,632 —-a-w C:\WINDOWS\$hf_mig$\KB899591\spuninst.exe
+ 2005-06-29 23:54:32 30,720 —-a-w C:\WINDOWS\$hf_mig$\KB899591\update\arpidfix.exe
+ 2005-02-25 03:35:06 22,240 —-a-w C:\WINDOWS\$hf_mig$\KB899591\update\spcustom.dll
+ 2005-02-25 03:35:06 718,048 —-a-w C:\WINDOWS\$hf_mig$\KB899591\update\update.exe
+ 2005-02-25 03:35:08 371,936 —-a-w C:\WINDOWS\$hf_mig$\KB899591\update\updspapi.dll
+ 2006-02-15 00:30:07 142,464 —-a-w C:\WINDOWS\$hf_mig$\KB900485\SP2QFE\aec.sys
+ 2005-10-12 23:12:25 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB900485\spmsg.dll
+ 2005-10-12 23:12:26 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB900485\spuninst.exe
+ 2005-10-12 23:12:25 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB900485\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB900485\update\update.exe
+ 2005-10-12 23:12:34 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB900485\update\updspapi.dll
+ 2005-09-01 01:44:04 19,968 —-a-w C:\WINDOWS\$hf_mig$\KB900725\SP2QFE\linkinfo.dll
+ 2005-09-23 03:18:20 8,452,608 —-a-w C:\WINDOWS\$hf_mig$\KB900725\SP2QFE\shell32.dll
+ 2005-09-02 23:53:41 474,112 —-a-w C:\WINDOWS\$hf_mig$\KB900725\SP2QFE\shlwapi.dll
+ 2005-09-01 01:44:05 291,840 —-a-w C:\WINDOWS\$hf_mig$\KB900725\SP2QFE\winsrv.dll
+ 2005-09-27 00:29:45 21,504 —-a-w C:\WINDOWS\$hf_mig$\KB900725\SP2QFE\xpsp3res.dll
+ 2005-02-25 03:35:06 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB900725\spmsg.dll
+ 2005-02-25 03:35:06 209,632 —-a-w C:\WINDOWS\$hf_mig$\KB900725\spuninst.exe
+ 2005-09-27 00:36:24 30,720 —-a-w C:\WINDOWS\$hf_mig$\KB900725\update\arpidfix.exe
+ 2005-02-25 03:35:06 22,240 —-a-w C:\WINDOWS\$hf_mig$\KB900725\update\spcustom.dll
+ 2005-02-25 03:35:06 718,048 —-a-w C:\WINDOWS\$hf_mig$\KB900725\update\update.exe
+ 2005-02-25 03:35:08 371,936 —-a-w C:\WINDOWS\$hf_mig$\KB900725\update\updspapi.dll
+ 2005-06-29 01:49:55 254,976 —-a-w C:\WINDOWS\$hf_mig$\KB901214\SP2QFE\icm32.dll
+ 2005-06-29 01:49:55 73,728 —-a-w C:\WINDOWS\$hf_mig$\KB901214\SP2QFE\mscms.dll
+ 2005-02-25 03:35:06 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB901214\spmsg.dll
+ 2005-02-25 03:35:06 209,632 —-a-w C:\WINDOWS\$hf_mig$\KB901214\spuninst.exe
+ 2005-02-25 03:35:06 22,240 —-a-w C:\WINDOWS\$hf_mig$\KB901214\update\spcustom.dll
+ 2005-02-25 03:35:06 718,048 —-a-w C:\WINDOWS\$hf_mig$\KB901214\update\update.exe
+ 2005-02-25 03:35:08 371,936 —-a-w C:\WINDOWS\$hf_mig$\KB901214\update\updspapi.dll
+ 2005-07-26 04:20:23 225,792 —-a-w C:\WINDOWS\$hf_mig$\KB902400\SP2QFE\catsrv.dll
+ 2005-07-26 04:20:23 625,152 —-a-w C:\WINDOWS\$hf_mig$\KB902400\SP2QFE\catsrvut.dll
+ 2005-07-26 04:20:23 110,080 —-a-w C:\WINDOWS\$hf_mig$\KB902400\SP2QFE\clbcatex.dll
+ 2005-07-26 04:20:24 498,688 —-a-w C:\WINDOWS\$hf_mig$\KB902400\SP2QFE\clbcatq.dll
+ 2005-07-26 04:20:24 60,416 —-a-w C:\WINDOWS\$hf_mig$\KB902400\SP2QFE\colbact.dll
+ 2005-07-26 04:20:24 195,072 —-a-w C:\WINDOWS\$hf_mig$\KB902400\SP2QFE\comadmin.dll
+ 2005-07-26 04:20:25 97,792 —-a-w C:\WINDOWS\$hf_mig$\KB902400\SP2QFE\comrepl.dll
+ 2005-07-26 04:20:27 1,267,200 —-a-w C:\WINDOWS\$hf_mig$\KB902400\SP2QFE\comsvcs.dll
+ 2005-07-26 04:20:28 540,160 —-a-w C:\WINDOWS\$hf_mig$\KB902400\SP2QFE\comuid.dll
+ 2005-07-26 04:20:28 243,200 —-a-w C:\WINDOWS\$hf_mig$\KB902400\SP2QFE\es.dll
+ 2005-07-25 23:42:35 8,704 —-a-w C:\WINDOWS\$hf_mig$\KB902400\SP2QFE\migregdb.exe
+ 2005-07-26 04:20:29 425,472 —-a-w C:\WINDOWS\$hf_mig$\KB902400\SP2QFE\msdtcprx.dll
+ 2005-07-26 04:20:31 945,152 —-a-w C:\WINDOWS\$hf_mig$\KB902400\SP2QFE\msdtctm.dll
+ 2005-07-26 04:20:31 161,280 —-a-w C:\WINDOWS\$hf_mig$\KB902400\SP2QFE\msdtcuiu.dll
+ 2005-07-26 04:20:39 66,560 —-a-w C:\WINDOWS\$hf_mig$\KB902400\SP2QFE\mtxclu.dll
+ 2005-07-26 04:20:40 91,136 —-a-w C:\WINDOWS\$hf_mig$\KB902400\SP2QFE\mtxoci.dll
+ 2005-07-26 04:20:40 1,285,632 —-a-w C:\WINDOWS\$hf_mig$\KB902400\SP2QFE\ole32.dll
+ 2005-07-26 04:20:40 74,752 —-a-w C:\WINDOWS\$hf_mig$\KB902400\SP2QFE\olecli32.dll
+ 2005-07-26 04:20:40 37,376 —-a-w C:\WINDOWS\$hf_mig$\KB902400\SP2QFE\olecnv32.dll
+ 2005-07-26 04:20:40 398,336 —-a-w C:\WINDOWS\$hf_mig$\KB902400\SP2QFE\rpcss.dll
+ 2005-07-26 04:20:40 101,376 —-a-w C:\WINDOWS\$hf_mig$\KB902400\SP2QFE\txflog.dll
+ 2005-07-26 04:20:40 11,776 —-a-w C:\WINDOWS\$hf_mig$\KB902400\SP2QFE\xolehlp.dll
+ 2005-02-25 03:35:06 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB902400\spmsg.dll
+ 2005-02-25 03:35:06 209,632 —-a-w C:\WINDOWS\$hf_mig$\KB902400\spuninst.exe
+ 2005-07-26 02:21:18 30,720 —-a-w C:\WINDOWS\$hf_mig$\KB902400\update\arpidfix.exe
+ 2005-02-25 03:35:06 22,240 —-a-w C:\WINDOWS\$hf_mig$\KB902400\update\spcustom.dll
+ 2005-02-25 03:35:06 718,048 —-a-w C:\WINDOWS\$hf_mig$\KB902400\update\update.exe
+ 2005-02-25 03:35:08 371,936 —-a-w C:\WINDOWS\$hf_mig$\KB902400\update\updspapi.dll
+ 2005-08-22 18:24:55 197,632 —-a-w C:\WINDOWS\$hf_mig$\KB905414\SP2QFE\netman.dll
+ 2005-02-25 03:35:05 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB905414\spmsg.dll
+ 2005-02-25 03:35:05 209,632 —-a-w C:\WINDOWS\$hf_mig$\KB905414\spuninst.exe
+ 2005-08-19 23:50:31 30,720 —-a-w C:\WINDOWS\$hf_mig$\KB905414\update\arpidfix.exe
+ 2005-02-25 03:35:05 22,240 —-a-w C:\WINDOWS\$hf_mig$\KB905414\update\spcustom.dll
+ 2005-02-25 03:35:05 718,048 —-a-w C:\WINDOWS\$hf_mig$\KB905414\update\update.exe
+ 2005-02-25 03:35:06 371,936 —-a-w C:\WINDOWS\$hf_mig$\KB905414\update\updspapi.dll
+ 2005-08-23 03:39:54 123,392 —-a-w C:\WINDOWS\$hf_mig$\KB905749\SP2QFE\umpnpmgr.dll
+ 2005-02-25 03:35:06 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB905749\spmsg.dll
+ 2005-02-25 03:35:06 209,632 —-a-w C:\WINDOWS\$hf_mig$\KB905749\spuninst.exe
+ 2005-08-23 01:01:30 30,720 —-a-w C:\WINDOWS\$hf_mig$\KB905749\update\arpidfix.exe
+ 2005-02-25 03:35:06 22,240 —-a-w C:\WINDOWS\$hf_mig$\KB905749\update\spcustom.dll
+ 2005-02-25 03:35:06 718,048 —-a-w C:\WINDOWS\$hf_mig$\KB905749\update\update.exe
+ 2005-02-25 03:35:08 371,936 —-a-w C:\WINDOWS\$hf_mig$\KB905749\update\updspapi.dll
+ 2006-03-17 04:46:31 8,454,656 —-a-w C:\WINDOWS\$hf_mig$\KB908531\SP2QFE\shell32.dll
+ 2006-03-17 01:05:35 28,672 —-a-w C:\WINDOWS\$hf_mig$\KB908531\SP2QFE\verclsid.exe
+ 2006-03-22 01:29:43 23,040 —-a-w C:\WINDOWS\$hf_mig$\KB908531\SP2QFE\xpsp3res.dll
+ 2005-10-12 23:12:25 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB908531\spmsg.dll
+ 2005-10-12 23:12:26 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB908531\spuninst.exe
+ 2005-10-12 23:12:25 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB908531\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB908531\update\update.exe
+ 2005-10-12 23:12:34 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB908531\update\updspapi.dll
+ 2006-03-23 05:53:08 143,360 —-a-w C:\WINDOWS\$hf_mig$\KB911562\SP2QFE\msadco.dll
+ 2005-10-12 23:12:25 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB911562\spmsg.dll
+ 2005-10-12 23:12:26 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB911562\spuninst.exe
+ 2005-10-12 23:12:25 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB911562\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB911562\update\update.exe
+ 2005-10-12 23:12:34 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB911562\update\updspapi.dll
+ 2006-01-04 04:18:34 68,096 —-a-w C:\WINDOWS\$hf_mig$\KB911927\SP2QFE\webclnt.dll
+ 2005-10-12 23:12:25 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB911927\spmsg.dll
+ 2005-10-12 23:12:26 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB911927\spuninst.exe
+ 2005-10-12 23:12:25 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB911927\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB911927\update\update.exe
+ 2005-10-12 23:12:34 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB911927\update\updspapi.dll
+ 2006-03-01 19:34:20 426,496 —-a-w C:\WINDOWS\$hf_mig$\KB913580\SP2QFE\msdtcprx.dll
+ 2006-03-01 19:34:20 956,416 —-a-w C:\WINDOWS\$hf_mig$\KB913580\SP2QFE\msdtctm.dll
+ 2006-03-01 19:34:20 161,280 —-a-w C:\WINDOWS\$hf_mig$\KB913580\SP2QFE\msdtcuiu.dll
+ 2006-03-01 19:34:20 66,560 —-a-w C:\WINDOWS\$hf_mig$\KB913580\SP2QFE\mtxclu.dll
+ 2006-03-01 19:34:20 91,136 —-a-w C:\WINDOWS\$hf_mig$\KB913580\SP2QFE\mtxoci.dll
+ 2006-03-01 19:34:20 11,776 —-a-w C:\WINDOWS\$hf_mig$\KB913580\SP2QFE\xolehlp.dll
+ 2005-10-12 23:12:25 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB913580\spmsg.dll
+ 2005-10-12 23:12:26 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB913580\spuninst.exe
+ 2005-10-12 23:12:25 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB913580\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB913580\update\update.exe
+ 2005-10-12 23:12:34 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB913580\update\updspapi.dll
+ 2006-05-19 13:46:40 112,128 —-a-w C:\WINDOWS\$hf_mig$\KB914388\SP2QFE\dhcpcsvc.dll
+ 2006-05-19 13:46:40 147,456 —-a-w C:\WINDOWS\$hf_mig$\KB914388\SP2QFE\dnsapi.dll
+ 2006-05-19 13:46:40 94,720 —-a-w C:\WINDOWS\$hf_mig$\KB914388\SP2QFE\iphlpapi.dll
+ 2005-10-12 23:12:25 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB914388\spmsg.dll
+ 2005-10-12 23:12:26 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB914388\spuninst.exe
+ 2005-10-12 23:12:25 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB914388\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB914388\update\update.exe
+ 2005-10-12 23:12:34 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB914388\update\updspapi.dll
+ 2006-05-05 10:16:39 454,400 —-a-w C:\WINDOWS\$hf_mig$\KB914389\SP2QFE\mrxsmb.sys
+ 2006-05-05 10:22:52 174,592 —-a-w C:\WINDOWS\$hf_mig$\KB914389\SP2QFE\rdbss.sys
+ 2005-10-12 23:12:25 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB914389\spmsg.dll
+ 2005-10-12 23:12:26 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB914389\spuninst.exe
+ 2005-10-12 23:12:25 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB914389\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB914389\update\update.exe
+ 2005-10-12 23:12:34 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB914389\update\updspapi.dll
+ 2006-03-17 01:08:10 262,656 —-a-w C:\WINDOWS\$hf_mig$\KB916595\SP2QFE\http.sys
+ 2005-10-12 23:16:49 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB916595\spmsg.dll
+ 2005-10-12 23:16:49 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB916595\spuninst.exe
+ 2005-10-12 23:16:49 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB916595\update\spcustom.dll
+ 2005-10-12 23:16:51 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB916595\update\update.exe
+ 2005-10-12 23:16:56 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB916595\update\updspapi.dll
+ 2006-04-20 12:18:35 360,576 —-a-w C:\WINDOWS\$hf_mig$\KB917953\SP2QFE\tcpip.sys
+ 2005-10-12 23:12:25 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB917953\spmsg.dll
+ 2005-10-12 23:12:26 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB917953\spuninst.exe
+ 2005-10-12 23:12:25 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB917953\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB917953\update\update.exe
+ 2005-10-12 23:12:34 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB917953\update\updspapi.dll
+ 2006-11-27 15:17:10 539,136 —-a-w C:\WINDOWS\$hf_mig$\KB918118\SP2QFE\msftedit.dll
+ 2006-11-27 15:17:10 433,664 —-a-w C:\WINDOWS\$hf_mig$\KB918118\SP2QFE\riched20.dll
+ 2005-10-12 23:12:25 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB918118\spmsg.dll
+ 2005-10-12 23:12:26 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB918118\spuninst.exe
+ 2005-10-12 23:12:25 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB918118\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB918118\update\update.exe
+ 2005-10-12 23:12:34 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB918118\update\updspapi.dll
+ 2006-06-01 19:39:42 163,840 —-a-w C:\WINDOWS\$hf_mig$\KB918439\SP2QFE\jgdw400.dll
+ 2006-06-01 19:39:42 27,648 —-a-w C:\WINDOWS\$hf_mig$\KB918439\SP2QFE\jgpl400.dll
+ 2005-10-12 23:12:25 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB918439\spmsg.dll
+ 2005-10-12 23:12:26 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB918439\spuninst.exe
+ 2005-10-12 23:12:25 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB918439\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB918439\update\update.exe
+ 2005-10-12 23:12:34 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB918439\update\updspapi.dll
+ 2006-10-12 13:54:18 42,496 —-a-w C:\WINDOWS\$hf_mig$\KB920213\SP2QFE\agentdp2.dll
+ 2006-10-12 13:54:18 57,344 —-a-w C:\WINDOWS\$hf_mig$\KB920213\SP2QFE\agentdpv.dll
+ 2006-10-12 11:54:07 256,512 —-a-w C:\WINDOWS\$hf_mig$\KB920213\SP2QFE\agentsvr.exe
+ 2006-10-16 10:29:15 248,320 —-a-w C:\WINDOWS\$hf_mig$\KB920213\SP2QFE\xpsp3res.dll
+ 2005-10-12 23:16:49 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB920213\spmsg.dll
+ 2005-10-12 23:16:49 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB920213\spuninst.exe
+ 2005-10-12 23:16:49 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB920213\update\spcustom.dll
+ 2005-10-12 23:16:51 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB920213\update\update.exe
+ 2005-10-12 23:16:56 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB920213\update\updspapi.dll
+ 2006-07-21 08:26:49 72,704 —-a-w C:\WINDOWS\$hf_mig$\KB920670\SP2QFE\hlink.dll
+ 2005-10-12 23:16:49 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB920670\spmsg.dll
+ 2005-10-12 23:16:49 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB920670\spuninst.exe
+ 2005-10-12 23:16:49 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB920670\update\spcustom.dll
+ 2005-10-12 23:16:51 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB920670\update\update.exe
+ 2005-10-12 23:16:56 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB920670\update\updspapi.dll
+ 2006-06-26 17:45:19 147,456 —-a-w C:\WINDOWS\$hf_mig$\KB920683\SP2QFE\dnsapi.dll
+ 2006-06-26 17:45:19 7,680 —-a-w C:\WINDOWS\$hf_mig$\KB920683\SP2QFE\rasadhlp.dll
+ 2005-10-12 23:12:25 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB920683\spmsg.dll
+ 2005-10-12 23:12:26 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB920683\spuninst.exe
+ 2005-10-12 23:12:25 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB920683\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB920683\update\update.exe
+ 2005-10-12 23:12:34 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB920683\update\updspapi.dll
+ 2006-06-22 05:22:04 69,120 —-a-w C:\WINDOWS\$hf_mig$\KB920685\SP2QFE\ciodm.dll
+ 2006-06-22 05:22:05 1,435,648 —-a-w C:\WINDOWS\$hf_mig$\KB920685\SP2QFE\query.dll
+ 2005-10-12 23:12:25 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB920685\spmsg.dll
+ 2005-10-12 23:12:26 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB920685\spuninst.exe
+ 2005-10-12 23:12:25 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB920685\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB920685\update\update.exe
+ 2005-10-12 23:12:34 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB920685\update\updspapi.dll
+ 2006-06-14 08:50:19 172,416 —-a-w C:\WINDOWS\$hf_mig$\KB920872\SP2QFE\kmixer.sys
+ 2006-06-14 08:50:19 6,272 —-a-w C:\WINDOWS\$hf_mig$\KB920872\SP2QFE\splitter.sys
+ 2006-06-14 09:17:04 82,944 —-a-w C:\WINDOWS\$hf_mig$\KB920872\SP2QFE\wdmaud.sys
+ 2005-10-12 23:12:25 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB920872\spmsg.dll
+ 2005-10-12 23:12:26 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB920872\spuninst.exe
+ 2005-10-12 23:12:25 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB920872\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB920872\update\update.exe
+ 2005-10-12 23:12:34 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB920872\update\updspapi.dll
+ 2007-05-17 11:25:21 549,888 —-a-w C:\WINDOWS\$hf_mig$\KB921503\SP2QFE\oleaut32.dll
+ 2005-10-12 23:12:25 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB921503\spmsg.dll
+ 2005-10-12 23:12:26 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB921503\spuninst.exe
+ 2005-10-12 23:12:25 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB921503\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB921503\update\update.exe
+ 2005-10-12 23:12:34 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB921503\update\updspapi.dll
+ 2006-08-16 12:08:32 100,352 —-a-w C:\WINDOWS\$hf_mig$\KB922819\SP2QFE\6to4svc.dll
+ 2006-08-16 10:13:39 225,664 —-a-w C:\WINDOWS\$hf_mig$\KB922819\SP2QFE\tcpip6.sys
+ 2005-10-12 23:16:49 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB922819\spmsg.dll
+ 2005-10-12 23:16:49 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB922819\spuninst.exe
+ 2005-10-12 23:16:49 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB922819\update\spcustom.dll
+ 2005-10-12 23:16:51 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB922819\update\update.exe
+ 2005-10-12 23:16:56 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB922819\update\updspapi.dll
+ 2006-08-14 12:00:42 332,928 —-a-w C:\WINDOWS\$hf_mig$\KB923414\SP2QFE\srv.sys
+ 2005-10-12 23:16:49 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB923414\spmsg.dll
+ 2005-10-12 23:16:49 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB923414\spuninst.exe
+ 2005-10-12 23:16:49 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB923414\update\spcustom.dll
+ 2005-10-12 23:16:51 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB923414\update\update.exe
+ 2005-10-12 23:16:56 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB923414\update\updspapi.dll
+ 2006-10-13 12:41:38 64,000 —-a-w C:\WINDOWS\$hf_mig$\KB923980\SP2QFE\nwapi32.dll
+ 2006-10-13 12:41:38 142,336 —-a-w C:\WINDOWS\$hf_mig$\KB923980\SP2QFE\nwprovau.dll
+ 2006-10-13 10:39:12 163,456 —-a-w C:\WINDOWS\$hf_mig$\KB923980\SP2QFE\nwrdr.sys
+ 2006-10-13 12:41:38 65,536 —-a-w C:\WINDOWS\$hf_mig$\KB923980\SP2QFE\nwwks.dll
+ 2005-10-12 23:16:49 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB923980\spmsg.dll
+ 2005-10-12 23:16:49 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB923980\spuninst.exe
+ 2005-10-12 23:16:49 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB923980\update\spcustom.dll
+ 2005-10-12 23:16:51 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB923980\update\update.exe
+ 2005-10-12 23:16:56 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB923980\update\updspapi.dll
+ 2006-08-17 12:37:49 726,528 —-a-w C:\WINDOWS\$hf_mig$\KB924270\SP2QFE\lsasrv.dll
+ 2006-08-17 12:37:49 337,408 —-a-w C:\WINDOWS\$hf_mig$\KB924270\SP2QFE\netapi32.dll
+ 2006-08-17 12:37:49 132,096 —-a-w C:\WINDOWS\$hf_mig$\KB924270\SP2QFE\wkssvc.dll
+ 2005-10-12 23:12:25 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB924270\spmsg.dll
+ 2005-10-12 23:12:26 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB924270\spuninst.exe
+ 2005-10-12 23:12:25 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB924270\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB924270\update\update.exe
+ 2005-10-12 23:12:34 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB924270\update\updspapi.dll
+ 2006-09-04 06:12:56 1,497,088 —-a-w C:\WINDOWS\$hf_mig$\KB924496\SP2QFE\shdocvw.dll
+ 2005-10-12 23:12:25 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB924496\spmsg.dll
+ 2005-10-12 23:12:26 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB924496\spuninst.exe
+ 2005-10-12 23:12:25 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB924496\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB924496\update\update.exe
+ 2005-10-12 23:12:34 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB924496\update\updspapi.dll
+ 2007-03-08 15:48:36 282,112 —-a-w C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\gdi32.dll
+ 2007-03-08 15:48:36 40,960 —-a-w C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\mf3216.dll
+ 2007-03-08 15:48:36 578,048 —-a-w C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll
+ 2007-03-08 13:49:49 1,843,968 —-a-w C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\win32k.sys
+ 2006-01-19 19:29:19 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB925902\spmsg.dll
+ 2006-01-19 19:29:19 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB925902\spuninst.exe
+ 2006-01-19 19:29:19 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB925902\update\spcustom.dll
+ 2006-01-19 19:29:19 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB925902\update\update.exe
+ 2006-01-19 19:29:19 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB925902\update\updspapi.dll
+ 2006-10-19 13:59:58 713,216 —-a-w C:\WINDOWS\$hf_mig$\KB926255\SP2QFE\sxs.dll
+ 2005-10-12 23:12:25 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB926255\spmsg.dll
+ 2005-10-12 23:12:26 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB926255\spuninst.exe
+ 2005-10-12 23:12:25 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB926255\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB926255\update\update.exe
+ 2005-10-12 23:12:34 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB926255\update\updspapi.dll
+ 2006-10-16 17:14:17 122,880 —-a-w C:\WINDOWS\$hf_mig$\KB926436\SP2QFE\oledlg.dll
+ 2005-10-12 23:16:49 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB926436\spmsg.dll
+ 2005-10-12 23:16:49 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB926436\spuninst.exe
+ 2005-10-12 23:16:49 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB926436\update\spcustom.dll
+ 2005-10-12 23:16:51 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB926436\update\update.exe
+ 2005-10-12 23:16:56 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB926436\update\updspapi.dll
+ 2006-12-26 13:18:55 536,576 —-a-w C:\WINDOWS\$hf_mig$\KB927779\SP2QFE\msado15.dll
+ 2006-12-26 13:18:55 180,224 —-a-w C:\WINDOWS\$hf_mig$\KB927779\SP2QFE\msadomd.dll
+ 2006-12-26 13:18:55 200,704 —-a-w C:\WINDOWS\$hf_mig$\KB927779\SP2QFE\msadox.dll
+ 2006-12-26 13:18:55 102,400 —-a-w C:\WINDOWS\$hf_mig$\KB927779\SP2QFE\msjro.dll
+ 2006-01-19 19:29:19 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB927779\spmsg.dll
+ 2006-01-19 19:29:19 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB927779\spuninst.exe
+ 2006-01-19 19:29:19 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB927779\update\spcustom.dll
+ 2006-01-19 19:29:19 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB927779\update\update.exe
+ 2006-01-19 19:29:19 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB927779\update\updspapi.dll
+ 2006-12-19 18:47:14 333,824 —-a-w C:\WINDOWS\$hf_mig$\KB927802\SP2QFE\wiaservc.dll
+ 2005-10-12 23:12:25 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB927802\spmsg.dll
+ 2005-10-12 23:12:26 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB927802\spuninst.exe
+ 2005-10-12 23:12:25 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB927802\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB927802\update\update.exe
+ 2005-10-12 23:12:34 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB927802\update\updspapi.dll
+ 2006-12-19 21:50:10 8,458,752 —-a-w C:\WINDOWS\$hf_mig$\KB928255\SP2QFE\shell32.dll
+ 2006-12-19 21:50:10 135,168 —-a-w C:\WINDOWS\$hf_mig$\KB928255\SP2QFE\shsvcs.dll
+ 2006-12-19 16:10:56 248,320 —-a-w C:\WINDOWS\$hf_mig$\KB928255\SP2QFE\xpsp3res.dll
+ 2006-01-19 19:29:19 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB928255\spmsg.dll
+ 2006-01-19 19:29:19 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB928255\spuninst.exe
+ 2006-01-19 19:29:19 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB928255\update\spcustom.dll
+ 2006-01-19 19:29:19 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB928255\update\update.exe
+ 2006-01-19 19:29:19 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB928255\update\updspapi.dll
+ 2005-10-12 23:12:25 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB928843\spmsg.dll
+ 2005-10-12 23:12:26 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB928843\spuninst.exe
+ 2005-10-12 23:12:25 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB928843\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB928843\update\update.exe
+ 2005-10-12 23:12:34 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB928843\update\updspapi.dll
+ 2007-05-16 15:32:55 86,528 —-a-w C:\WINDOWS\$hf_mig$\KB929123\SP2QFE\directdb.dll
+ 2007-05-16 15:32:55 683,520 —-a-w C:\WINDOWS\$hf_mig$\KB929123\SP2QFE\inetcomm.dll
+ 2007-05-16 15:32:56 1,314,816 —-a-w C:\WINDOWS\$hf_mig$\KB929123\SP2QFE\msoe.dll
+ 2007-05-16 15:32:56 510,976 —-a-w C:\WINDOWS\$hf_mig$\KB929123\SP2QFE\wab32.dll
+ 2007-05-16 15:32:56 85,504 —-a-w C:\WINDOWS\$hf_mig$\KB929123\SP2QFE\wabimp.dll
+ 2006-01-19 19:29:19 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB929123\spmsg.dll
+ 2006-01-19 19:29:19 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB929123\spuninst.exe
+ 2006-01-19 19:29:19 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB929123\update\spcustom.dll
+ 2006-01-19 19:29:19 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB929123\update\update.exe
+ 2006-01-19 19:29:19 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB929123\update\updspapi.dll
+ 2007-03-17 13:45:03 292,864 —-a-w C:\WINDOWS\$hf_mig$\KB930178\SP2QFE\winsrv.dll
+ 2005-10-12 23:12:25 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB930178\spmsg.dll
+ 2005-10-12 23:12:26 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB930178\spuninst.exe
+ 2005-10-12 23:12:25 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB930178\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB930178\update\update.exe
+ 2005-10-12 23:12:34 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB930178\update\updspapi.dll
+ 2007-02-05 20:19:14 185,344 —-a-w C:\WINDOWS\$hf_mig$\KB931261\SP2QFE\upnphost.dll
+ 2006-01-19 19:29:19 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB931261\spmsg.dll
+ 2006-01-19 19:29:19 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB931261\spuninst.exe
+ 2006-01-19 19:29:19 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB931261\update\spcustom.dll
+ 2006-01-19 19:29:19 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB931261\update\update.exe
+ 2006-01-19 19:29:19 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB931261\update\updspapi.dll
+ 2007-02-28 09:53:04 2,137,600 —-a-w C:\WINDOWS\$hf_mig$\KB931784\SP2QFE\ntkrnlmp.exe
+ 2007-02-28 09:15:56 2,059,392 —-a-w C:\WINDOWS\$hf_mig$\KB931784\SP2QFE\ntkrnlpa.exe
+ 2007-02-28 09:15:59 2,017,280 —-a-w C:\WINDOWS\$hf_mig$\KB931784\SP2QFE\ntkrpamp.exe
+ 2007-02-28 09:55:14 2,182,144 —-a-w C:\WINDOWS\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe
+ 2005-10-12 23:12:25 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB931784\spmsg.dll
+ 2005-10-12 23:12:26 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB931784\spuninst.exe
+ 2005-10-12 23:12:25 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB931784\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB931784\update\update.exe
+ 2005-10-12 23:12:34 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB931784\update\updspapi.dll
+ 2007-03-09 13:58:57 57,344 —-a-w C:\WINDOWS\$hf_mig$\KB932168\SP2QFE\agentdpv.dll
+ 2007-03-09 11:28:00 248,320 —-a-w C:\WINDOWS\$hf_mig$\KB932168\SP2QFE\xpsp3res.dll
+ 2006-01-19 19:29:19 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB932168\spmsg.dll
+ 2006-01-19 19:29:19 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB932168\spuninst.exe
+ 2006-01-19 19:29:19 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB932168\update\spcustom.dll
+ 2006-01-19 19:29:19 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB932168\update\update.exe
+ 2006-01-19 19:29:19 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB932168\update\updspapi.dll
+ 2007-04-16 16:07:27 986,112 —-a-w C:\WINDOWS\$hf_mig$\KB935839\SP2QFE\kernel32.dll
+ 2005-10-12 23:12:25 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB935839\spmsg.dll
+ 2005-10-12 23:12:26 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB935839\spuninst.exe
+ 2005-10-12 23:12:25 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB935839\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB935839\update\update.exe
+ 2005-10-12 23:12:34 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB935839\update\updspapi.dll
+ 2007-04-25 20:32:22 144,896 —-a-w C:\WINDOWS\$hf_mig$\KB935840\SP2QFE\schannel.dll
+ 2006-01-19 19:29:19 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB935840\spmsg.dll
+ 2006-01-19 19:29:19 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB935840\spuninst.exe
+ 2006-01-19 19:29:19 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB935840\update\spcustom.dll
+ 2006-01-19 19:29:19 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB935840\update\update.exe
+ 2006-01-19 19:29:19 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB935840\update\updspapi.dll
+ 2007-06-26 06:06:12 1,104,896 —-a-w C:\WINDOWS\$hf_mig$\KB936021\SP2QFE\msxml3.dll
+ 2005-10-12 23:12:25 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB936021\spmsg.dll
+ 2005-10-12 23:12:26 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB936021\spuninst.exe
+ 2005-10-12 23:12:25 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB936021\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB936021\update\update.exe
+ 2005-10-12 23:12:34 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB936021\update\updspapi.dll
+ 2007-04-23 10:14:23 364,160 —-a-w C:\WINDOWS\$hf_mig$\KB936357\SP2QFE\update.sys
+ 2006-01-19 19:29:19 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB936357\spmsg.dll
+ 2006-01-19 19:29:19 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB936357\spuninst.exe
+ 2006-01-19 19:29:19 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB936357\update\spcustom.dll
+ 2006-01-19 19:29:19 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB936357\update\update.exe
+ 2006-01-19 19:29:19 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB936357\update\updspapi.dll
+ 2007-06-26 15:16:01 851,968 —-a-w C:\WINDOWS\$hf_mig$\KB938127\SP2QFE\vgx.dll
+ 2005-10-12 23:12:25 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB938127\spmsg.dll
+ 2005-10-12 23:12:26 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB938127\spuninst.exe
+ 2005-10-12 23:12:25 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB938127\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB938127\update\update.exe
+ 2005-10-12 23:12:34 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB938127\update\updspapi.dll
+ 2007-06-13 11:26:03 1,033,216 —-a-w C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
+ 2005-10-12 23:12:25 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB938828\spmsg.dll
+ 2005-10-12 23:12:26 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB938828\spuninst.exe
+ 2005-10-12 23:12:25 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB938828\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB938828\update\update.exe
+ 2005-10-12 23:12:34 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB938828\update\updspapi.dll
+ 2007-06-19 13:37:21 282,112 —-a-w C:\WINDOWS\$hf_mig$\KB938829\SP2QFE\gdi32.dll
+ 2006-01-19 19:29:19 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB938829\spmsg.dll
+ 2006-01-19 19:29:19 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB938829\spuninst.exe
+ 2006-01-19 19:29:19 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB938829\update\spcustom.dll
+ 2006-01-19 19:29:19 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB938829\update\update.exe
+ 2006-01-19 19:29:19 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB938829\update\updspapi.dll
+ 2007-08-21 06:25:02 683,520 —-a-w C:\WINDOWS\$hf_mig$\KB941202\SP2QFE\inetcomm.dll
+ 2007-03-06 01:22:36 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB941202\spmsg.dll
+ 2007-03-06 01:22:41 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB941202\spuninst.exe
+ 2007-03-06 01:22:34 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB941202\update\spcustom.dll
+ 2007-03-06 01:22:59 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB941202\update\update.exe
+ 2007-03-06 01:23:51 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB941202\update\updspapi.dll
+ 2007-10-11 05:57:29 1,024,000 —-a-w C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\browseui.dll
+ 2007-10-11 05:57:29 151,040 —-a-w C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\cdfview.dll
+ 2007-10-11 05:57:30 1,054,208 —-a-w C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\danim.dll
+ 2007-10-11 05:57:30 357,888 —-a-w C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\dxtmsft.dll
+ 2007-10-11 05:57:30 205,824 —-a-w C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\dxtrans.dll
+ 2007-10-11 05:57:30 55,808 —-a-w C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\extmgr.dll
+ 2007-10-10 10:48:23 18,432 —-a-w C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\iedw.exe
+ 2007-10-11 05:57:31 251,904 —-a-w C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\iepeers.dll
+ 2007-10-11 05:57:31 96,256 —-a-w C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\inseng.dll
+ 2007-10-11 05:57:31 16,384 —-a-w C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\jsproxy.dll
+ 2007-10-30 09:55:21 3,065,856 —-a-w C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\mshtml.dll
+ 2007-10-11 05:57:36 449,024 —-a-w C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\mshtmled.dll
+ 2007-10-11 05:57:36 146,432 —-a-w C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\msrating.dll
+ 2007-10-11 05:57:37 532,480 —-a-w C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\mstime.dll
+ 2007-10-11 05:57:37 39,424 —-a-w C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\pngfilt.dll
+ 2007-10-11 05:57:39 1,498,112 —-a-w C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\shdocvw.dll
+ 2007-10-11 05:57:40 474,112 —-a-w C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\shlwapi.dll
+ 2007-10-11 05:57:40 617,984 —-a-w C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\urlmon.dll
+ 2007-10-11 05:57:41 666,112 —-a-w C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\wininet.dll
+ 2007-10-10 10:34:35 350,720 —-a-w C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\xpsp3res.dll
+ 2007-03-06 01:22:36 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB942615\spmsg.dll
+ 2007-03-06 01:22:41 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB942615\spuninst.exe
+ 2007-03-06 01:22:34 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB942615\update\spcustom.dll
+ 2007-03-06 01:22:59 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB942615\update\update.exe
+ 2007-03-06 01:23:51 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB942615\update\updspapi.dll
+ 2007-11-13 11:02:46 60,416 —-a-w C:\WINDOWS\$hf_mig$\KB942763\SP2QFE\tzchange.exe
+ 2007-03-06 01:22:36 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB942763\spmsg.dll
+ 2007-03-06 01:22:41 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB942763\spuninst.exe
+ 2007-03-06 01:22:34 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB942763\update\spcustom.dll
+ 2007-03-06 01:22:59 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB942763\update\update.exe
+ 2007-03-06 01:23:51 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB942763\update\updspapi.dll
+ 2007-11-14 07:18:03 450,560 —-a-w C:\WINDOWS\$hf_mig$\KB942840\SP2QFE\jscript.dll
+ 2007-03-06 01:22:36 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB942840\spmsg.dll
+ 2007-03-06 01:22:41 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB942840\spuninst.exe
+ 2007-03-06 01:22:34 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB942840\update\spcustom.dll
+ 2007-03-06 01:22:59 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB942840\update\update.exe
+ 2007-03-06 01:23:51 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB942840\update\updspapi.dll
+ 2007-11-13 08:47:45 20,480 —-a-w C:\WINDOWS\$hf_mig$\KB944653\SP2QFE\secdrv.sys
+ 2007-03-06 01:22:36 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB944653\spmsg.dll
+ 2007-03-06 01:22:41 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB944653\spuninst.exe
+ 2007-03-06 01:22:34 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB944653\update\spcustom.dll
+ 2007-03-06 01:22:59 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB944653\update\update.exe
+ 2007-03-06 01:23:51 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB944653\update\updspapi.dll
+ 2004-08-04 07:56:42 345,088 -c—-w C:\WINDOWS\$NtUninstallKB873339$\hypertrm.dll
+ 2004-10-14 17:36:18 169,984 -c—-w C:\WINDOWS\$NtUninstallKB873339$\spuninst\spuninst.exe
+ 2004-10-14 18:36:18 169,984 -c—-w C:\WINDOWS\$NtUninstallKB885835$\spuninst\spuninst.exe
+ 2004-10-14 18:36:18 169,984 -c—-w C:\WINDOWS\$NtUninstallKB885836$\spuninst\spuninst.exe
+ 2004-09-19 20:21:24 169,984 -c—-w C:\WINDOWS\$NtUninstallKB885884$\spuninst\spuninst.exe
+ 2004-08-04 06:04:50 134,912 -c—-w C:\WINDOWS\$NtUninstallKB886185$\ipnat.sys
+ 2004-10-14 18:36:16 169,984 -c—-w C:\WINDOWS\$NtUninstallKB886185$\spuninst\spuninst.exe
+ 2004-08-04 07:56:53 1,667,584 -c—-w C:\WINDOWS\$NtUninstallKB887472$\msmsgs.exe
+ 2004-10-14 18:36:18 169,984 -c—-w C:\WINDOWS\$NtUninstallKB887472$\spuninst\spuninst.exe
+ 2004-12-01 03:22:42 169,984 -c—-w C:\WINDOWS\$NtUninstallKB888302$\spuninst\spuninst.exe
+ 2004-08-04 07:56:45 96,768 -c—-w C:\WINDOWS\$NtUninstallKB888302$\srvsvc.dll
+ 2004-08-04 07:56:41 56,832 -c—-w C:\WINDOWS\$NtUninstallKB890859$\authz.dll
+ 2004-08-04 05:58:58 2,056,832 -c—-w C:\WINDOWS\$NtUninstallKB890859$\ntkrnlpa.exe
+ 2004-08-04 06:20:00 2,180,992 -c—-w C:\WINDOWS\$NtUninstallKB890859$\ntoskrnl.exe
+ 2005-02-25 02:35:06 209,632 -c—-w C:\WINDOWS\$NtUninstallKB890859$\spuninst\spuninst.exe
+ 2005-02-25 02:35:08 371,936 -c—-w C:\WINDOWS\$NtUninstallKB890859$\spuninst\updspapi.dll
+ 2004-08-04 07:56:46 577,024 -c—-w C:\WINDOWS\$NtUninstallKB890859$\user32.dll
+ 2004-08-04 06:17:40 1,835,904 -c—-w C:\WINDOWS\$NtUninstallKB890859$\win32k.sys
+ 2004-08-04 07:56:46 290,816 -c—-w C:\WINDOWS\$NtUninstallKB890859$\winsrv.dll
+ 2004-12-01 03:22:42 169,984 -c—-w C:\WINDOWS\$NtUninstallKB891781$\spuninst\spuninst.exe
- 2007-03-22 15:41:37 7,168 —-a-w C:\WINDOWS\assembly\GAC\IEExecRemote\1.0.5000.0__b03f5f7f11d50a3a\IEExecRemote.dll
+ 2007-12-25 10:24:00 8,192 —-a-w C:\WINDOWS\assembly\GAC\IEExecRemote\1.0.5000.0__b03f5f7f11d50a3a\IEExecRemote.dll
- 2007-03-22 15:41:33 32,768 —-a-w C:\WINDOWS\assembly\GAC\IEHost\1.0.5000.0__b03f5f7f11d50a3a\IEHost.dll
+ 2007-12-25 10:24:13 32,768 —-a-w C:\WINDOWS\assembly\GAC\IEHost\1.0.5000.0__b03f5f7f11d50a3a\IEHost.dll
- 2007-03-22 15:41:25 716,800 —-a-w C:\WINDOWS\assembly\GAC\Microsoft.JScript\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
+ 2007-12-25 10:24:59 720,896 —-a-w C:\WINDOWS\assembly\GAC\Microsoft.JScript\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
- 2007-03-22 15:41:25 299,008 —-a-w C:\WINDOWS\assembly\GAC\Microsoft.VisualBasic\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
+ 2007-12-25 10:24:15 299,008 —-a-w C:\WINDOWS\assembly\GAC\Microsoft.VisualBasic\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
- 2007-03-22 15:41:37 32,768 —-a-w C:\WINDOWS\assembly\GAC\Regcode\1.0.5000.0__b03f5f7f11d50a3a\RegCode.dll
+ 2007-12-25 10:24:45 32,768 —-a-w C:\WINDOWS\assembly\GAC\Regcode\1.0.5000.0__b03f5f7f11d50a3a\RegCode.dll
- 2007-03-22 15:41:39 299,008 —-a-w C:\WINDOWS\assembly\GAC\System.Data.OracleClient\1.0.5000.0__b77a5c561934e089\System.Data.OracleClient.dll
+ 2007-12-25 10:24:33 303,104 —-a-w C:\WINDOWS\assembly\GAC\System.Data.OracleClient\1.0.5000.0__b77a5c561934e089\System.Data.OracleClient.dll
- 2007-03-22 15:41:34 1,290,240 —-a-w C:\WINDOWS\assembly\GAC\System.Data\1.0.5000.0__b77a5c561934e089\System.Data.dll
+ 2007-12-25 10:24:49 1,294,336 —-a-w C:\WINDOWS\assembly\GAC\System.Data\1.0.5000.0__b77a5c561934e089\System.Data.dll
- 2007-03-22 15:41:34 1,699,840 —-a-w C:\WINDOWS\assembly\GAC\System.Design\1.0.5000.0__b03f5f7f11d50a3a\System.Design.dll
+ 2007-12-25 10:24:05 1,703,936 —-a-w C:\WINDOWS\assembly\GAC\System.Design\1.0.5000.0__b03f5f7f11d50a3a\System.Design.dll
- 2007-03-22 15:41:34 86,016 —-a-w C:\WINDOWS\assembly\GAC\System.DirectoryServices\1.0.5000.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
+ 2007-12-25 10:24:56 90,112 —-a-w C:\WINDOWS\assembly\GAC\System.DirectoryServices\1.0.5000.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
- 2007-03-22 15:41:35 466,944 —-a-w C:\WINDOWS\assembly\GAC\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a\System.Drawing.dll
+ 2007-12-25 10:24:31 466,944 —-a-w C:\WINDOWS\assembly\GAC\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a\System.Drawing.dll
- 2007-03-22 15:41:34 241,664 —-a-w C:\WINDOWS\assembly\GAC\System.EnterpriseServices\1.0.5000.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
+ 2007-12-25 10:24:20 241,664 —-a-w C:\WINDOWS\assembly\GAC\System.EnterpriseServices\1.0.5000.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
- 2007-03-22 15:41:34 64,000 —-a-w C:\WINDOWS\assembly\GAC\System.EnterpriseServices\1.0.5000.0__b03f5f7f11d50a3a\System.EnterpriseServices.Thunk.dll
+ 2007-12-25 10:24:20 66,560 —-a-w C:\WINDOWS\assembly\GAC\System.EnterpriseServices\1.0.5000.0__b03f5f7f11d50a3a\System.EnterpriseServices.Thunk.dll
- 2007-03-22 15:41:35 368,640 —-a-w C:\WINDOWS\assembly\GAC\System.Management\1.0.5000.0__b03f5f7f11d50a3a\System.Management.dll
+ 2007-12-25 10:24:43 372,736 —-a-w C:\WINDOWS\assembly\GAC\System.Management\1.0.5000.0__b03f5f7f11d50a3a\System.Management.dll
- 2007-03-22 15:41:35 241,664 —-a-w C:\WINDOWS\assembly\GAC\System.Messaging\1.0.5000.0__b03f5f7f11d50a3a\System.Messaging.dll
+ 2007-12-25 10:25:01 241,664 —-a-w C:\WINDOWS\assembly\GAC\System.Messaging\1.0.5000.0__b03f5f7f11d50a3a\System.Messaging.dll
- 2007-03-22 15:41:35 323,584 —-a-w C:\WINDOWS\assembly\GAC\System.Runtime.Remoting\1.0.5000.0__b77a5c561934e089\System.Runtime.Remoting.dll
+ 2007-12-25 10:24:36 323,584 —-a-w C:\WINDOWS\assembly\GAC\System.Runtime.Remoting\1.0.5000.0__b77a5c561934e089\System.Runtime.Remoting.dll
- 2007-03-22 15:41:36 131,072 —-a-w C:\WINDOWS\assembly\GAC\System.Runtime.Serialization.Formatters.Soap\1.0.5000.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
+ 2007-12-25 10:24:23 131,072 —-a-w C:\WINDOWS\assembly\GAC\System.Runtime.Serialization.Formatters.Soap\1.0.5000.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
- 2007-03-22 15:41:36 77,824 —-a-w C:\WINDOWS\assembly\GAC\System.Security\1.0.5000.0__b03f5f7f11d50a3a\System.Security.dll
+ 2007-12-25 10:24:29 77,824 —-a-w C:\WINDOWS\assembly\GAC\System.Security\1.0.5000.0__b03f5f7f11d50a3a\System.Security.dll
- 2007-03-22 15:41:36 126,976 —-a-w C:\WINDOWS\assembly\GAC\System.ServiceProcess\1.0.5000.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
+ 2007-12-25 10:24:51 126,976 —-a-w C:\WINDOWS\assembly\GAC\System.ServiceProcess\1.0.5000.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
- 2007-03-22 15:41:38 819,200 —-a-w C:\WINDOWS\assembly\GAC\System.Web.Mobile\1.0.5000.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
+ 2007-12-25 10:23:58 819,200 —-a-w C:\WINDOWS\assembly\GAC\System.Web.Mobile\1.0.5000.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
- 2007-03-22 15:41:36 57,344 —-a-w C:\WINDOWS\assembly\GAC\System.Web.RegularExpressions\1.0.5000.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
+ 2007-12-25 10:24:17 57,344 —-a-w C:\WINDOWS\assembly\GAC\System.Web.RegularExpressions\1.0.5000.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
- 2007-03-22 15:41:36 569,344 —-a-w C:\WINDOWS\assembly\GAC\System.Web.Services\1.0.5000.0__b03f5f7f11d50a3a\System.Web.Services.dll
+ 2007-12-25 10:24:12 573,440 —-a-w C:\WINDOWS\assembly\GAC\System.Web.Services\1.0.5000.0__b03f5f7f11d50a3a\System.Web.Services.dll
- 2007-03-22 15:41:36 1,245,184 —-a-w C:\WINDOWS\assembly\GAC\System.Web\1.0.5000.0__b03f5f7f11d50a3a\System.Web.dll
+ 2007-12-26 10:09:31 1,265,664 —-a-w C:\WINDOWS\assembly\GAC\System.Web\1.0.5000.0__b03f5f7f11d50a3a\System.Web.dll
- 2007-03-22 15:41:37 2,039,808 —-a-w C:\WINDOWS\assembly\GAC\System.Windows.Forms\1.0.5000.0__b77a5c561934e089\System.Windows.Forms.dll
+ 2007-12-25 10:24:26 2,052,096 —-a-w C:\WINDOWS\assembly\GAC\System.Windows.Forms\1.0.5000.0__b77a5c561934e089\System.Windows.Forms.dll
- 2007-03-22 15:41:37 1,335,296 —-a-w C:\WINDOWS\assembly\GAC\System.Xml\1.0.5000.0__b77a5c561934e089\System.Xml.dll
+ 2007-12-25 10:24:40 1,339,392 —-a-w C:\WINDOWS\assembly\GAC\System.Xml\1.0.5000.0__b77a5c561934e089\System.XML.dll
- 2007-03-22 15:41:35 1,216,512 —-a-w C:\WINDOWS\assembly\GAC\System\1.0.5000.0__b77a5c561934e089\System.dll
+ 2007-12-26 10:09:34 1,232,896 —-a-w C:\WINDOWS\assembly\GAC\System\1.0.5000.0__b77a5c561934e089\System.dll
+ 2007-12-26 10:10:31 61,440 —-a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a_fb9ecfed\CustomMarshalers.dll
+ 2007-12-26 10:11:53 3,391,488 —-a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_497e98ca\mscorlib.dll
+ 2007-12-26 10:11:38 1,470,464 —-a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\System.Design\1.0.5000.0__b03f5f7f11d50a3a_f965aaa4\System.Design.dll
+ 2007-12-26 10:10:45 90,112 —-a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a_64db1bb2\System.Drawing.Design.dll
+ 2007-12-26 10:11:44 835,584 —-a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a_7018cb44\System.Drawing.dll
+ 2007-12-26 10:11:06 3,018,752 —-a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\System.Windows.Forms\1.0.5000.0__b77a5c561934e089_f2557228\System.Windows.Forms.dll
+ 2007-12-26 10:11:22 2,088,960 —-a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\System.Xml\1.0.5000.0__b77a5c561934e089_8fad2192\System.Xml.dll
+ 2007-12-26 10:10:24 1,966,080 —-a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\System\1.0.5000.0__b77a5c561934e089_4abbdf35\System.dll
+ 2006-02-15 00:22:26 142,464 ——w C:\WINDOWS\Driver Cache\I386\aec.sys
+ 2006-03-17 00:33:10 262,784 ——w C:\WINDOWS\Driver Cache\I386\http.sys
+ 2006-06-14 08:47:45 172,416 ——w C:\WINDOWS\Driver Cache\I386\kmixer.sys
+ 2006-05-05 09:41:45 453,120 ——w C:\WINDOWS\Driver Cache\I386\mrxsmb.sys
+ 2007-02-28 09:08:48 2,136,064 ——w C:\WINDOWS\Driver Cache\I386\ntkrnlmp.exe
+ 2007-02-28 08:38:55 2,057,600 ——w C:\WINDOWS\Driver Cache\I386\ntkrnlpa.exe
+ 2007-02-28 08:38:57 2,015,744 ——w C:\WINDOWS\Driver Cache\I386\ntkrpamp.exe
+ 2007-02-28 09:10:57 2,180,352 ——w C:\WINDOWS\Driver Cache\I386\ntoskrnl.exe
+ 2006-06-14 08:47:46 6,400 ——w C:\WINDOWS\Driver Cache\I386\splitter.sys
+ 2006-06-14 09:00:45 82,944 ——w C:\WINDOWS\Driver Cache\I386\wdmaud.sys
- 2004-08-04 07:56:49 1,032,192 —-a-w C:\WINDOWS\explorer.exe
+ 2007-06-13 10:23:07 1,033,216 —-a-w C:\WINDOWS\explorer.exe
- 2001-07-16 20:57:00 1,069,056 —-a-w C:\WINDOWS\Help\SBSI\Training\orun32.exe
+ 2006-08-21 22:57:14 1,077,321 —-a-w C:\WINDOWS\Help\SBSI\Training\orun32.exe
- 2004-08-04 07:56:50 10,752 —-a-w C:\WINDOWS\hh.exe
+ 2005-05-26 23:22:01 10,752 —-a-w C:\WINDOWS\hh.exe
+ 2007-12-25 10:14:13 32,768 —-a-r C:\WINDOWS\Installer\{C04E32E0-0416-434D-AFB9-6969D703A9EF}\icon.exe
- 2003-02-21 02:19:32 253,952 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_isapi.dll
+ 2007-04-14 04:30:52 258,048 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_isapi.dll
- 2003-02-21 02:19:34 20,480 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_regiis.exe
+ 2004-07-15 08:49:18 20,480 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_regiis.exe
- 2003-02-21 02:19:38 32,768 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
+ 2004-07-15 08:49:26 32,768 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
- 2003-02-21 02:19:36 32,768 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe
+ 2007-04-14 04:30:52 32,768 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe
- 2003-02-21 02:09:08 77,824 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\CORPerfMonExt.dll
+ 2007-04-14 03:57:52 81,920 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\CORPerfMonExt.dll
- 2003-02-21 17:20:44 49,152 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\csc.exe
+ 2004-07-15 18:23:28 49,152 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\csc.exe
- 2003-02-21 17:21:00 626,688 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\cscomp.dll
+ 2004-07-15 18:23:44 626,688 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\cscomp.dll
- 2003-02-21 02:06:20 282,624 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\fusion.dll
+ 2004-07-15 07:24:30 282,624 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\fusion.dll
+ 2003-10-08 21:30:14 81,920 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\gacutil.exe
- 2003-02-21 14:24:38 7,168 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\IEExecRemote.dll
+ 2004-07-15 21:31:00 8,192 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\IEExecRemote.dll
- 2003-02-21 14:24:40 32,768 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\IEHost.dll
+ 2004-07-15 21:31:04 32,768 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\IEHost.dll
- 2003-02-21 02:09:40 196,608 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ilasm.exe
+ 2004-07-15 07:35:30 196,608 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ilasm.exe
- 2003-02-21 14:26:36 716,800 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Microsoft.JScript.dll
+ 2004-07-15 21:28:58 720,896 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Microsoft.JScript.dll
- 2003-02-21 14:26:38 299,008 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Microsoft.VisualBasic.dll
+ 2004-07-15 21:28:56 299,008 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Microsoft.VisualBasic.dll
- 2003-02-21 14:25:04 49,152 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\MigPol.exe
+ 2004-07-15 21:28:50 49,152 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\MigPol.exe
- 2003-02-21 14:25:04 49,152 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\MigPolWin.exe
+ 2004-07-15 21:28:50 49,152 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\MigPolWin.exe
- 2003-02-21 02:09:12 77,824 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscordbc.dll
+ 2004-07-15 07:32:44 86,016 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscordbc.dll
- 2003-02-21 02:09:12 233,472 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscordbi.dll
+ 2004-07-15 07:32:46 233,472 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscordbi.dll
- 2003-02-21 02:09:14 86,016 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorie.dll
+ 2007-04-14 03:57:58 86,016 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorie.dll
- 2003-02-21 02:06:32 311,296 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorjit.dll
+ 2007-04-14 03:56:30 315,392 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorjit.dll
- 2003-02-21 02:09:16 98,304 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorld.dll
+ 2007-04-14 03:58:00 102,400 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorld.dll
- 2003-02-21 14:26:34 2,088,960 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorlib.dll
+ 2007-04-14 03:50:46 2,142,208 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorlib.dll
- 2003-02-21 02:09:18 143,360 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorrc.dll
+ 2004-07-15 07:33:22 143,360 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorrc.dll
- 2003-02-21 02:09:18 81,920 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsec.dll
+ 2004-07-15 07:33:24 81,920 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsec.dll
- 2003-02-21 02:09:18 77,824 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsn.dll
+ 2007-04-14 03:58:02 77,824 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsn.dll
- 2003-02-21 02:07:34 2,494,464 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll
+ 2007-04-14 03:57:00 2,523,136 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll
- 2003-02-21 02:08:32 2,482,176 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
+ 2007-04-14 03:57:28 2,514,944 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
+ 2007-01-15 23:11:26 73,728 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\netfxupdate.exe
- 2003-02-21 02:09:30 90,112 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\PerfCounter.dll
+ 2004-07-15 07:34:50 94,208 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\PerfCounter.dll
- 2003-02-21 14:26:46 32,768 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\RegCode.dll
+ 2004-07-15 21:28:48 32,768 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\RegCode.dll
+ 2004-07-15 08:49:16 258,048 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SHADOW3544\_aspnet_isapi.dll
+ 2004-07-15 07:32:22 81,920 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SHADOW3544\_CORPerfMonExt.dll
+ 2004-07-15 07:24:30 282,624 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SHADOW3544\_fusion.dll
+ 2004-07-15 07:25:06 315,392 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SHADOW3544\_mscorjit.dll
+ 2004-07-15 21:29:02 2,138,112 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SHADOW3544\_mscorlib.dll
+ 2003-02-21 02:09:18 77,824 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SHADOW3544\_mscorsn.dll
+ 2004-07-15 07:26:52 2,510,848 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SHADOW3544\_mscorsvr.dll
+ 2004-07-15 07:28:34 2,502,656 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SHADOW3544\_mscorwks.dll
+ 2003-02-21 11:42:22 348,160 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SHADOW3544\_msvcr71.dll
+ 2004-07-15 07:34:50 94,208 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SHADOW3544\_PerfCounter.dll
- 2003-02-21 02:09:34 319,488 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SOS.dll
+ 2004-07-15 07:35:04 319,488 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SOS.dll
- 2003-02-21 14:26:38 1,290,240 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Data.dll
+ 2004-07-15 21:32:00 1,294,336 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Data.dll
- 2003-02-21 14:25:42 299,008 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Data.OracleClient.dll
+ 2004-07-15 21:31:14 303,104 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Data.OracleClient.dll
- 2003-02-21 14:26:42 1,699,840 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Design.dll
+ 2004-07-15 21:29:02 1,703,936 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Design.dll
- 2003-02-21 14:26:44 86,016 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.DirectoryServices.dll
+ 2004-07-15 21:28:54 90,112 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.DirectoryServices.dll
- 2003-02-21 14:26:46 1,216,512 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.dll
+ 2007-04-14 04:35:38 1,232,896 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.dll
- 2003-02-21 14:26:50 466,944 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Drawing.dll
+ 2004-07-15 21:28:58 466,944 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Drawing.dll
- 2003-02-21 14:26:50 241,664 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.EnterpriseServices.dll
+ 2004-07-15 21:28:56 241,664 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.EnterpriseServices.dll
- 2003-02-21 02:09:36 64,000 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.EnterpriseServices.Thunk.dll
+ 2004-07-15 07:35:12 66,560 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.EnterpriseServices.Thunk.dll
- 2003-02-21 14:26:52 368,640 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Management.dll
+ 2004-07-15 21:31:58 372,736 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Management.dll
- 2003-02-21 14:26:54 241,664 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Messaging.dll
+ 2004-07-15 21:31:12 241,664 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Messaging.dll
- 2003-02-21 14:26:56 323,584 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Runtime.Remoting.dll
+ 2004-07-15 21:28:58 323,584 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Runtime.Remoting.dll
- 2003-02-21 14:26:56 131,072 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Runtime.Serialization.Formatters.Soap.dll
+ 2004-07-15 21:31:54 131,072 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Runtime.Serialization.Formatters.Soap.dll
- 2003-02-21 14:26:58 77,824 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Security.dll
+ 2004-07-15 21:28:52 77,824 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Security.dll
- 2003-02-21 14:27:00 126,976 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.ServiceProcess.dll
+ 2004-07-15 21:28:54 126,976 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.ServiceProcess.dll
- 2003-02-21 14:27:02 1,245,184 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Web.dll
+ 2007-04-14 04:35:46 1,265,664 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Web.dll
- 2003-02-21 14:27:06 819,200 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Web.Mobile.dll
+ 2004-07-15 21:28:58 819,200 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Web.Mobile.dll
- 2003-02-21 14:24:18 57,344 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Web.RegularExpressions.dll
+ 2004-07-15 21:28:52 57,344 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Web.RegularExpressions.dll
- 2003-02-21 14:27:06 569,344 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Web.Services.dll
+ 2004-07-15 21:31:16 573,440 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Web.Services.dll
- 2003-02-21 14:27:08 2,039,808 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Windows.Forms.dll
+ 2004-07-15 21:32:02 2,052,096 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Windows.Forms.dll
- 2003-02-21 14:27:10 1,335,296 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.XML.dll
+ 2004-07-15 21:29:00 1,339,392 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.XML.dll
+ 2004-06-22 20:51:38 53,248 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe
- 2003-02-21 17:20:38 737,280 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\vbc.exe
+ 2004-07-15 18:23:20 737,280 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\vbc.exe
- 2003-02-21 12:04:18 1,032,192 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\VsaVb7rt.dll
+ 2004-07-15 15:15:14 1,032,192 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\VsaVb7rt.dll
- 2003-02-21 03:10:40 31,744 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\WMINet_Utils.dll
+ 2004-07-15 09:11:56 31,744 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\WMINet_Utils.dll
- 2004-08-04 07:56:41 41,984 —-a-w C:\WINDOWS\MSAGENT\agentdp2.dll
+ 2006-10-12 14:02:52 42,496 —-a-w C:\WINDOWS\MSAGENT\agentdp2.dll
- 2004-08-04 07:56:41 58,880 —-a-w C:\WINDOWS\MSAGENT\agentdpv.dll
+ 2007-03-09 13:46:24 57,344 —-a-w C:\WINDOWS\MSAGENT\agentdpv.dll
- 2004-08-04 07:56:47 256,512 —-a-w C:\WINDOWS\MSAGENT\agentsvr.exe
+ 2006-10-12 11:09:53 256,512 —-a-w C:\WINDOWS\MSAGENT\agentsvr.exe
- 2004-08-04 07:56:41 100,352 —-a-w C:\WINDOWS\SYSTEM32\6to4svc.dll
+ 2006-08-16 11:58:05 100,352 —-a-w C:\WINDOWS\SYSTEM32\6to4svc.dll
- 2004-08-04 07:56:41 56,832 —-a-w C:\WINDOWS\SYSTEM32\authz.dll
+ 2005-03-02 18:09:29 56,832 —-a-w C:\WINDOWS\SYSTEM32\authz.dll
- 2004-08-04 07:56:41 1,016,832 —-a-w C:\WINDOWS\SYSTEM32\browseui.dll
+ 2007-10-11 06:13:44 1,023,488 —-a-w C:\WINDOWS\SYSTEM32\browseui.dll
- 2004-08-04 07:56:41 229,888 —-a-w C:\WINDOWS\SYSTEM32\catsrv.dll
+ 2005-07-26 04:39:42 225,792 —-a-w C:\WINDOWS\SYSTEM32\catsrv.dll
- 2004-08-04 07:56:41 628,224 —-a-w C:\WINDOWS\SYSTEM32\catsrvut.dll
+ 2005-07-26 04:39:43 625,152 —-a-w C:\WINDOWS\SYSTEM32\catsrvut.dll
- 2004-08-04 07:56:41 150,528 —-a-w C:\WINDOWS\SYSTEM32\cdfview.dll
+ 2007-10-11 06:13:44 151,040 —-a-w C:\WINDOWS\SYSTEM32\cdfview.dll
- 2004-08-04 07:56:41 69,120 —-a-w C:\WINDOWS\SYSTEM32\ciodm.dll
+ 2006-06-22 05:06:29 69,120 —-a-w C:\WINDOWS\SYSTEM32\ciodm.dll
- 2004-08-04 07:56:41 110,080 —-a-w C:\WINDOWS\SYSTEM32\clbcatex.dll
+ 2005-07-26 04:39:43 110,080 —-a-w C:\WINDOWS\SYSTEM32\clbcatex.dll
- 2004-08-04 07:56:41 501,248 —-a-w C:\WINDOWS\SYSTEM32\clbcatq.dll
+ 2005-07-26 04:39:43 498,688 —-a-w C:\WINDOWS\SYSTEM32\clbcatq.dll
- 2004-08-04 07:56:41 62,464 —-a-w C:\WINDOWS\SYSTEM32\colbact.dll
+ 2005-07-26 04:39:43 60,416 —-a-w C:\WINDOWS\SYSTEM32\colbact.dll
- 2004-08-04 07:56:41 195,584 —-a-w C:\WINDOWS\SYSTEM32\Com\comadmin.dll
+ 2005-07-26 04:39:44 195,072 —-a-w C:\WINDOWS\SYSTEM32\Com\comadmin.dll
- 2004-08-04 07:56:41 611,328 —-a-w C:\WINDOWS\SYSTEM32\comctl32.dll
+ 2006-08-25 15:45:58 617,472 —-a-w C:\WINDOWS\SYSTEM32\comctl32.dll
- 2001-08-18 11:00:00 82,432 —-a-w C:\WINDOWS\SYSTEM32\COMREPL.DLL
+ 2005-07-26 04:39:44 97,792 —-a-w C:\WINDOWS\SYSTEM32\comrepl.dll
- 2004-08-04 07:56:41 1,251,840 —-a-w C:\WINDOWS\SYSTEM32\comsvcs.dll
+ 2005-07-26 04:39:44 1,267,200 —-a-w C:\WINDOWS\SYSTEM32\comsvcs.dll
- 2004-08-04 07:56:41 540,160 —-a-w C:\WINDOWS\SYSTEM32\comuid.dll
+ 2005-07-26 04:39:45 540,160 —-a-w C:\WINDOWS\SYSTEM32\comuid.dll
- 2004-08-04 07:56:41 1,053,696 —-a-w C:\WINDOWS\SYSTEM32\danim.dll
+ 2007-10-11 06:13:44 1,054,208 —-a-w C:\WINDOWS\SYSTEM32\danim.dll
- 2004-08-04 07:56:42 111,104 —-a-w C:\WINDOWS\SYSTEM32\dhcpcsvc.dll
+ 2006-05-19 12:59:41 111,616 —-a-w C:\WINDOWS\SYSTEM32\dhcpcsvc.dll
+ 2006-08-16 11:58:05 100,352 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\6to4svc.dll
+ 2006-10-12 14:02:52 42,496 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\agentdp2.dll
+ 2007-03-09 13:46:24 57,344 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\agentdpv.dll
+ 2006-10-12 11:09:53 256,512 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\agentsvr.exe
+ 2006-06-22 05:06:29 69,120 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\ciodm.dll
+ 2006-08-25 15:45:58 617,472 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\comctl32.dll
+ 2006-05-19 12:59:41 111,616 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\dhcpcsvc.dll
+ 2007-05-16 15:12:00 86,528 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\directdb.dll
+ 2006-06-26 17:37:10 148,480 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\dnsapi.dll
+ 2006-08-22 11:05:26 498,742 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\dxmasf.dll
+ 2007-06-13 10:23:07 1,033,216 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\explorer.exe
+ 2007-06-19 13:31:19 282,112 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\gdi32.dll
+ 2006-07-21 08:24:43 72,704 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\hlink.dll
+ 2007-08-21 06:15:44 683,520 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\inetcomm.dll
+ 2006-05-19 12:59:41 94,720 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\iphlpapi.dll
+ 2006-06-01 18:47:07 163,840 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\jgdw400.dll
+ 2006-06-01 18:47:07 27,648 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\jgpl400.dll
+ 2007-04-16 15:52:53 984,576 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\kernel32.dll
+ 2006-06-14 08:47:45 172,416 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\kmixer.sys
+ 2006-08-17 12:28:27 721,920 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\lsasrv.dll
+ 2007-03-08 15:36:28 40,960 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\mf3216.dll
+ 2006-11-01 19:17:45 927,504 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\mfc40u.dll
+ 2006-10-14 08:13:25 981,760 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\mfc42u.dll
+ 2006-05-05 09:41:45 453,120 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\mrxsmb.sys
+ 2006-12-26 13:07:23 536,576 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\msado15.dll
+ 2006-12-26 13:07:23 180,224 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\msadomd.dll
+ 2006-12-26 13:07:23 200,704 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\msadox.dll
+ 2006-11-27 14:54:06 539,136 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\msftedit.dll
- 2005-05-03 19:58:36 2,890,240 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\msi.dll
+ 2007-04-18 16:12:23 2,854,400 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\msi.dll
+ 2006-12-26 13:07:23 102,400 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\msjro.dll
+ 2007-05-16 15:12:08 1,314,816 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\msoe.dll
+ 2007-06-26 06:08:16 1,104,896 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\msxml3.dll
+ 2006-08-17 12:28:27 332,288 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\netapi32.dll
+ 2007-02-28 09:08:48 2,136,064 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\ntkrnlmp.exe
+ 2007-02-28 08:38:55 2,057,600 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\ntkrnlpa.exe
+ 2007-02-28 08:38:57 2,015,744 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\ntkrpamp.exe
+ 2007-02-28 09:10:57 2,180,352 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\ntoskrnl.exe
+ 2006-10-13 12:35:12 142,336 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\nwprovau.dll
+ 2007-05-17 11:28:05 549,376 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\oleaut32.dll
+ 2006-10-16 16:15:00 122,880 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\oledlg.dll
+ 2006-06-22 05:06:30 1,435,648 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\query.dll
+ 2006-06-26 17:37:10 8,192 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\rasadhlp.dll
+ 2006-05-05 09:47:57 174,592 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\rdbss.sys
+ 2006-11-27 14:54:06 433,152 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\riched20.dll
+ 2007-04-25 14:21:15 144,896 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\schannel.dll
+ 2006-12-19 21:52:18 134,656 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\shsvcs.dll
+ 2006-06-14 08:47:46 6,400 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\splitter.sys
+ 2006-08-14 10:34:41 332,928 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\srv.sys
+ 2006-08-21 16:52:08 246,814 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\strmdll.dll
+ 2006-10-19 13:56:32 713,216 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\sxs.dll
+ 2006-04-20 11:51:50 359,808 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\tcpip.sys
+ 2006-08-16 09:37:30 225,664 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\tcpip6.sys
+ 2007-04-23 10:32:54 364,160 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\update.sys
+ 2007-02-05 20:17:02 185,344 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\upnphost.dll
+ 2007-03-08 15:36:28 577,536 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\user32.dll
+ 2007-06-26 15:13:22 851,968 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\vgx.dll
+ 2007-05-16 15:12:12 510,976 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\wab32.dll
+ 2007-05-16 15:12:15 85,504 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\wabimp.dll
+ 2006-06-14 09:00:45 82,944 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\wdmaud.sys
+ 2006-12-19 18:16:47 333,824 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\wiaservc.dll
+ 2007-03-08 13:47:48 1,843,584 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\win32k.sys
+ 2007-03-17 13:43:01 292,864 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\winsrv.dll
+ 2006-08-17 12:28:27 132,096 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\wkssvc.dll
- 2004-09-23 01:46:16 5,550,080 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wmp.dll
+ 2007-04-30 15:20:24 5,537,792 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wmp.dll
- 2004-10-11 18:20:36 2,362,104 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wmvcore.dll
+ 2006-12-07 06:40:49 2,362,184 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wmvcore.dll
- 2004-08-04 07:56:42 148,480 —-a-w C:\WINDOWS\SYSTEM32\dnsapi.dll
+ 2006-06-26 17:37:10 148,480 —-a-w C:\WINDOWS\SYSTEM32\dnsapi.dll
- 2004-08-04 05:39:36 142,464 —-a-w C:\WINDOWS\SYSTEM32\DRIVERS\aec.sys
+ 2006-02-15 00:22:26 142,464 —-a-w C:\WINDOWS\SYSTEM32\DRIVERS\aec.sys
- 2004-08-04 06:01:19 124,800 —-a-w C:\WINDOWS\SYSTEM32\DRIVERS\fltmgr.sys
+ 2006-08-21 09:14:58 128,896 —-a-w C:\WINDOWS\SYSTEM32\DRIVERS\fltmgr.sys
- 2004-08-04 06:00:14 263,040 —-a-w C:\WINDOWS\SYSTEM32\DRIVERS\http.sys
+ 2006-03-17 00:33:10 262,784 —-a-w C:\WINDOWS\SYSTEM32\DRIVERS\http.sys
- 2004-08-04 06:04:50 134,912 —-a-w C:\WINDOWS\SYSTEM32\DRIVERS\ipnat.sys
+ 2004-09-29 22:28:37 134,912 —-a-w C:\WINDOWS\SYSTEM32\DRIVERS\ipnat.sys
- 2004-08-04 06:07:48 171,776 —-a-w C:\WINDOWS\SYSTEM32\DRIVERS\kmixer.sys
+ 2006-06-14 08:47:45 172,416 —-a-w C:\WINDOWS\SYSTEM32\DRIVERS\kmixer.sys
- 2004-08-04 06:15:16 451,456 —-a-w C:\WINDOWS\SYSTEM32\DRIVERS\mrxsmb.sys
+ 2006-05-05 09:41:45 453,120 —-a-w C:\WINDOWS\SYSTEM32\DRIVERS\mrxsmb.sys
- 2004-08-04 06:20:06 176,512 —-a-w C:\WINDOWS\SYSTEM32\DRIVERS\rdbss.sys
+ 2006-05-05 09:47:57 174,592 —-a-w C:\WINDOWS\SYSTEM32\DRIVERS\rdbss.sys
- 2004-08-04 08:01:08 139,400 —-a-w C:\WINDOWS\SYSTEM32\DRIVERS\rdpwd.sys
+ 2005-06-10 04:09:46 139,528 —-a-w C:\WINDOWS\SYSTEM32\DRIVERS\rdpwd.sys
- 2004-08-04 06:07:48 6,400 —-a-w C:\WINDOWS\SYSTEM32\DRIVERS\splitter.sys
+ 2006-06-14 08:47:46 6,400 —-a-w C:\WINDOWS\SYSTEM32\DRIVERS\splitter.sys
- 2004-08-04 06:14:45 336,256 —-a-w C:\WINDOWS\SYSTEM32\DRIVERS\srv.sys
+ 2006-08-14 10:34:41 332,928 —-a-w C:\WINDOWS\SYSTEM32\DRIVERS\srv.sys
- 2004-08-04 06:14:40 359,040 —-a-w C:\WINDOWS\SYSTEM32\DRIVERS\tcpip.sys
+ 2006-04-20 11:51:50 359,808 —-a-w C:\WINDOWS\SYSTEM32\DRIVERS\tcpip.sys
- 2004-08-04 06:07:45 223,616 —-a-w C:\WINDOWS\SYSTEM32\DRIVERS\tcpip6.sys
+ 2006-08-16 09:37:30 225,664 —-a-w C:\WINDOWS\SYSTEM32\DRIVERS\tcpip6.sys
- 2004-08-04 05:58:32 209,408 —-a-w C:\WINDOWS\SYSTEM32\DRIVERS\update.sys
+ 2007-04-23 10:32:54 364,160 —-a-w C:\WINDOWS\SYSTEM32\DRIVERS\update.sys
- 2004-08-04 06:15:04 82,944 —-a-w C:\WINDOWS\SYSTEM32\DRIVERS\wdmaud.sys
+ 2006-06-14 09:00:45 82,944 —-a-w C:\WINDOWS\SYSTEM32\DRIVERS\wdmaud.sys
- 2004-08-04 07:56:42 498,205 —-a-w C:\WINDOWS\SYSTEM32\dxmasf.dll
+ 2006-08-22 11:05:26 498,742 —-a-w C:\WINDOWS\SYSTEM32\dxmasf.dll
- 2004-08-04 07:56:42 357,888 —-a-w C:\WINDOWS\SYSTEM32\dxtmsft.dll
+ 2007-10-11 06:13:44 357,888 —-a-w C:\WINDOWS\SYSTEM32\dxtmsft.dll
- 2004-08-04 07:56:42 201,728 —-a-w C:\WINDOWS\SYSTEM32\dxtrans.dll
+ 2007-10-11 06:13:44 205,312 —-a-w C:\WINDOWS\SYSTEM32\dxtrans.dll
- 2004-08-04 07:56:42 243,200 —-a-w C:\WINDOWS\SYSTEM32\es.dll
+ 2005-07-26 04:39:45 243,200 —-a-w C:\WINDOWS\SYSTEM32\es.dll
- 2004-08-04 07:56:42 1,082,368 —-a-w C:\WINDOWS\SYSTEM32\esent.dll
+ 2005-10-20 22:20:03 1,082,368 —-a-w C:\WINDOWS\SYSTEM32\esent.dll
- 2004-08-04 07:56:42 55,808 —-a-w C:\WINDOWS\SYSTEM32\extmgr.dll
+ 2007-10-11 06:13:44 55,808 —-a-w C:\WINDOWS\SYSTEM32\extmgr.dll
- 2004-08-04 07:56:42 16,896 —-a-w C:\WINDOWS\SYSTEM32\fltlib.dll
+ 2006-08-21 12:21:06 16,896 —-a-w C:\WINDOWS\SYSTEM32\fltlib.dll
- 2004-08-04 07:56:49 22,528 —-a-w C:\WINDOWS\SYSTEM32\fltmc.exe
+ 2006-08-21 09:14:58 23,040 —-a-w C:\WINDOWS\SYSTEM32\fltmc.exe
- 2007-12-23 22:20:33 239,144 —-a-w C:\WINDOWS\SYSTEM32\FNTCACHE.DAT
+ 2007-12-25 11:13:55 239,144 —-a-w C:\WINDOWS\SYSTEM32\FNTCACHE.DAT
- 2004-08-04 07:56:42 278,016 —-a-w C:\WINDOWS\SYSTEM32\gdi32.dll
+ 2007-06-19 13:31:19 282,112 —-a-w C:\WINDOWS\SYSTEM32\gdi32.dll
- 2004-08-04 07:56:42 38,912 —-a-w C:\WINDOWS\SYSTEM32\hhsetup.dll
+ 2005-05-27 02:04:27 41,472 —-a-w C:\WINDOWS\SYSTEM32\hhsetup.dll
- 2001-08-18 11:00:00 77,850 —-a-w C:\WINDOWS\SYSTEM32\HLINK.DLL
+ 2006-07-21 08:24:43 72,704 —-a-w C:\WINDOWS\SYSTEM32\hlink.dll
- 2004-08-04 07:56:42 345,088 —-a-w C:\WINDOWS\SYSTEM32\hypertrm.dll
+ 2004-11-17 17:41:24 347,136 —-a-w C:\WINDOWS\SYSTEM32\hypertrm.dll
- 2004-08-04 07:56:42 253,952 —-a-w C:\WINDOWS\SYSTEM32\icm32.dll
+ 2005-06-29 01:46:00 254,976 —-a-w C:\WINDOWS\SYSTEM32\icm32.dll
- 2004-08-04 07:56:42 249,344 —-a-w C:\WINDOWS\SYSTEM32\iepeers.dll
+ 2007-10-11 06:13:44 251,392 —-a-w C:\WINDOWS\SYSTEM32\iepeers.dll
- 2004-08-04 07:56:42 678,400 —-a-w C:\WINDOWS\SYSTEM32\inetcomm.dll
+ 2007-08-21 06:15:44 683,520 —-a-w C:\WINDOWS\SYSTEM32\inetcomm.dll
- 2004-08-04 07:56:42 96,256 —-a-w C:\WINDOWS\SYSTEM32\inseng.dll
+ 2007-10-11 06:13:44 96,256 —-a-w C:\WINDOWS\SYSTEM32\inseng.dll
- 2004-08-04 07:56:42 94,720 —-a-w C:\WINDOWS\SYSTEM32\iphlpapi.dll
+ 2006-05-19 12:59:41 94,720 —-a-w C:\WINDOWS\SYSTEM32\iphlpapi.dll
- 2004-08-04 07:56:42 143,872 —-a-w C:\WINDOWS\SYSTEM32\itircl.dll
+ 2005-05-27 02:04:27 155,136 —-a-w C:\WINDOWS\SYSTEM32\itircl.dll
- 2004-08-04 07:56:42 134,144 —-a-w C:\WINDOWS\SYSTEM32\itss.dll
+ 2005-05-27 02:04:27 137,216 —-a-w C:\WINDOWS\SYSTEM32\itss.dll
- 2001-08-18 11:00:00 144,896 —-a-w C:\WINDOWS\SYSTEM32\JGDW400.DLL
+ 2006-06-01 18:47:07 163,840 —-a-w C:\WINDOWS\SYSTEM32\jgdw400.dll
- 2001-08-18 11:00:00 42,496 —-a-w C:\WINDOWS\SYSTEM32\JGPL400.DLL
+ 2006-06-01 18:47:07 27,648 —-a-w C:\WINDOWS\SYSTEM32\jgpl400.dll
- 2004-08-04 07:56:42 450,560 —-a-w C:\WINDOWS\SYSTEM32\jscript.dll
+ 2007-11-14 07:26:56 450,560 —-a-w C:\WINDOWS\SYSTEM32\jscript.dll
- 2004-08-04 07:56:42 15,872 —-a-w C:\WINDOWS\SYSTEM32\jsproxy.dll
+ 2007-10-11 06:13:44 16,384 —-a-w C:\WINDOWS\SYSTEM32\jsproxy.dll
- 2004-08-04 07:56:42 294,400 —-a-w C:\WINDOWS\SYSTEM32\kerberos.dll
+ 2005-06-15 17:49:30 295,936 —-a-w C:\WINDOWS\SYSTEM32\kerberos.dll
- 2004-08-04 07:56:42 983,552 —-a-w C:\WINDOWS\SYSTEM32\kernel32.dll
+ 2007-04-16 15:52:53 984,576 —-a-w C:\WINDOWS\SYSTEM32\kernel32.dll
- 2004-08-04 07:56:42 18,944 —-a-w C:\WINDOWS\SYSTEM32\linkinfo.dll
+ 2005-09-01 01:41:53 19,968 —-a-w C:\WINDOWS\SYSTEM32\linkinfo.dll
- 2004-08-04 07:56:42 721,920 —-a-w C:\WINDOWS\SYSTEM32\lsasrv.dll
+ 2006-08-17 12:28:27 721,920 —-a-w C:\WINDOWS\SYSTEM32\lsasrv.dll
- 2004-08-04 07:56:42 39,936 —-a-w C:\WINDOWS\SYSTEM32\mf3216.dll
+ 2007-03-08 15:36:28 40,960 —-a-w C:\WINDOWS\SYSTEM32\mf3216.dll
- 2001-08-18 11:00:00 924,432 —-a-w C:\WINDOWS\SYSTEM32\MFC40U.DLL
+ 2006-11-01 19:17:45 927,504 —-a-w C:\WINDOWS\SYSTEM32\mfc40u.dll
- 2004-08-04 07:56:42 1,024,000 —-a-w C:\WINDOWS\SYSTEM32\mfc42u.dll
+ 2006-10-14 08:13:25 981,760 —-a-w C:\WINDOWS\SYSTEM32\mfc42u.dll
- 2004-08-04 07:56:42 73,728 —-a-w C:\WINDOWS\SYSTEM32\mscms.dll
+ 2005-06-29 01:46:00 74,240 —-a-w C:\WINDOWS\SYSTEM32\mscms.dll
- 2003-02-21 02:06:24 155,648 —-a-w C:\WINDOWS\SYSTEM32\mscoree.dll
+ 2006-12-22 19:28:14 271,360 —-a-w C:\WINDOWS\SYSTEM32\mscoree.dll
- 2003-02-21 01:43:38 16,896 —-a-w C:\WINDOWS\SYSTEM32\mscorier.dll
+ 2004-07-15 06:34:06 16,896 —-a-w C:\WINDOWS\SYSTEM32\mscorier.dll
- 2004-08-04 07:56:43 425,472 —-a-w C:\WINDOWS\SYSTEM32\msdtcprx.dll
+ 2006-03-01 19:42:42 426,496 —-a-w C:\WINDOWS\SYSTEM32\msdtcprx.dll
- 2004-08-04 07:56:43 949,248 —-a-w C:\WINDOWS\SYSTEM32\msdtctm.dll
+ 2006-03-01 19:42:42 956,416 —-a-w C:\WINDOWS\SYSTEM32\msdtctm.dll
- 2004-08-04 07:56:43 161,280 —-a-w C:\WINDOWS\SYSTEM32\msdtcuiu.dll
+ 2006-03-01 19:42:42 161,280 —-a-w C:\WINDOWS\SYSTEM32\msdtcuiu.dll
- 2004-08-04 07:56:43 537,088 —-a-w C:\WINDOWS\SYSTEM32\msftedit.dll
+ 2006-11-27 14:54:06 539,136 —-a-w C:\WINDOWS\SYSTEM32\msftedit.dll
- 2004-08-04 07:56:43 3,003,392 —-a-w C:\WINDOWS\SYSTEM32\mshtml.dll
+ 2007-10-30 10:16:33 3,058,688 —-a-w C:\WINDOWS\SYSTEM32\mshtml.dll
- 2004-08-04 07:56:43 448,512 —-a-w C:\WINDOWS\SYSTEM32\mshtmled.dll
+ 2007-10-11 06:13:45 449,024 —-a-w C:\WINDOWS\SYSTEM32\mshtmled.dll
- 2005-05-03 19:58:36 2,890,240 —-a-w C:\WINDOWS\SYSTEM32\msi.dll
+ 2007-04-18 16:12:23 2,854,400 —-a-w C:\WINDOWS\SYSTEM32\msi.dll
- 2004-08-04 07:56:43 146,432 —-a-w C:\WINDOWS\SYSTEM32\msrating.dll
+ 2007-10-11 06:13:45 146,432 —-a-w C:\WINDOWS\SYSTEM32\msrating.dll
- 2004-08-04 07:56:43 530,432 —-a-w C:\WINDOWS\SYSTEM32\mstime.dll
+ 2007-10-11 06:13:45 532,480 —-a-w C:\WINDOWS\SYSTEM32\mstime.dll
- 2004-08-04 07:56:44 1,236,480 —-a-w C:\WINDOWS\SYSTEM32\msxml3.dll
+ 2007-06-26 06:08:16 1,104,896 —-a-w C:\WINDOWS\SYSTEM32\msxml3.dll
- 2003-12-11 18:15:48 1,230,336 —-a-r C:\WINDOWS\SYSTEM32\MSXML4.dll
+ 2007-05-08 22:03:04 1,275,392 —-a-w C:\WINDOWS\SYSTEM32\msxml4.dll
- 2004-08-04 07:56:44 66,560 —-a-w C:\WINDOWS\SYSTEM32\mtxclu.dll
+ 2006-03-01 19:42:42 66,560 —-a-w C:\WINDOWS\SYSTEM32\mtxclu.dll
- 2004-08-04 07:56:44 90,112 —-a-w C:\WINDOWS\SYSTEM32\mtxoci.dll
+ 2006-03-01 19:42:42 91,136 —-a-w C:\WINDOWS\SYSTEM32\mtxoci.dll
+ 2006-12-22 20:02:36 6,144 —-a-w C:\WINDOWS\SYSTEM32\MUI\0409\mscorees.dll
- 2004-08-04 07:56:44 332,288 —-a-w C:\WINDOWS\SYSTEM32\netapi32.dll
+ 2006-08-17 12:28:27 332,288 —-a-w C:\WINDOWS\SYSTEM32\netapi32.dll
- 2004-08-04 07:56:44 198,144 —-a-w C:\WINDOWS\SYSTEM32\netman.dll
+ 2005-08-22 18:29:46 197,632 —-a-w C:\WINDOWS\SYSTEM32\netman.dll
- 2004-08-04 05:58:58 2,056,832 —-a-w C:\WINDOWS\SYSTEM32\ntkrnlpa.exe
+ 2007-02-28 08:38:55 2,057,600 —-a-w C:\WINDOWS\SYSTEM32\ntkrnlpa.exe
- 2004-08-04 06:20:00 2,180,992 —-a-w C:\WINDOWS\SYSTEM32\ntoskrnl.exe
+ 2007-02-28 09:10:57 2,180,352 —-a-w C:\WINDOWS\SYSTEM32\ntoskrnl.exe
- 2004-08-04 07:56:44 144,384 —-a-w C:\WINDOWS\SYSTEM32\nwprovau.dll
+ 2006-10-13 12:35:12 142,336 —-a-w C:\WINDOWS\SYSTEM32\nwprovau.dll
- 2004-08-04 07:56:44 1,281,536 —-a-w C:\WINDOWS\SYSTEM32\ole32.dll
+ 2005-07-26 04:39:48 1,285,120 —-a-w C:\WINDOWS\SYSTEM32\ole32.dll
- 2004-08-04 07:56:44 553,472 —-a-w C:\WINDOWS\SYSTEM32\oleaut32.dll
+ 2007-05-17 11:28:05 549,376 —-a-w C:\WINDOWS\SYSTEM32\oleaut32.dll
- 2001-08-18 11:00:00 68,608 —-a-w C:\WINDOWS\SYSTEM32\OLECLI32.DLL
+ 2005-07-26 04:39:48 74,752 —-a-w C:\WINDOWS\SYSTEM32\olecli32.dll
- 2001-08-18 11:00:00 34,304 —-a-w C:\WINDOWS\SYSTEM32\OLECNV32.DLL
+ 2005-07-26 04:39:49 37,888 —-a-w C:\WINDOWS\SYSTEM32\olecnv32.dll
- 2001-08-18 11:00:00 117,760 —-a-w C:\WINDOWS\SYSTEM32\OLEDLG.DLL
+ 2006-10-16 16:15:00 122,880 —-a-w C:\WINDOWS\SYSTEM32\oledlg.dll
- 2007-12-23 22:27:09 54,822 —-a-w C:\WINDOWS\SYSTEM32\PERFC009.DAT
+ 2007-12-25 16:41:26 54,822 —-a-w C:\WINDOWS\SYSTEM32\PERFC009.DAT
- 2007-12-23 22:27:09 384,510 —-a-w C:\WINDOWS\SYSTEM32\PERFH009.DAT
+ 2007-12-25 16:41:26 384,510 —-a-w C:\WINDOWS\SYSTEM32\PERFH009.DAT
- 2004-08-04 07:56:44 39,424 —-a-w C:\WINDOWS\SYSTEM32\pngfilt.dll
+ 2007-10-11 06:13:45 39,424 —-a-w C:\WINDOWS\SYSTEM32\pngfilt.dll
- 2004-08-04 07:56:44 1,435,648 —-a-w C:\WINDOWS\SYSTEM32\query.dll
+ 2006-06-22 05:06:30 1,435,648 —-a-w C:\WINDOWS\SYSTEM32\query.dll
- 2004-08-04 07:56:44 8,192 —-a-w C:\WINDOWS\SYSTEM32\rasadhlp.dll
+ 2006-06-26 17:37:10 8,192 —-a-w C:\WINDOWS\SYSTEM32\rasadhlp.dll
- 2004-08-04 07:56:44 174,080 —-a-w C:\WINDOWS\SYSTEM32\rasmans.dll
+ 2006-06-22 10:47:18 181,248 —-a-w C:\WINDOWS\SYSTEM32\rasmans.dll
- 2004-08-04 07:56:44 431,616 —-a-w C:\WINDOWS\SYSTEM32\riched20.dll
+ 2006-11-27 14:54:06 433,152 —-a-w C:\WINDOWS\SYSTEM32\riched20.dll
- 2004-08-04 07:56:44 581,120 —-a-w C:\WINDOWS\SYSTEM32\rpcrt4.dll
+ 2007-07-09 13:09:42 584,192 —-a-w C:\WINDOWS\SYSTEM32\rpcrt4.dll
- 2004-08-04 07:56:44 395,776 —-a-w C:\WINDOWS\SYSTEM32\rpcss.dll
+ 2005-07-26 04:39:49 397,824 —-a-w C:\WINDOWS\SYSTEM32\rpcss.dll
- 2004-08-04 07:56:44 144,896 —-a-w C:\WINDOWS\SYSTEM32\schannel.dll
+ 2007-04-25 14:21:15 144,896 —-a-w C:\WINDOWS\SYSTEM32\schannel.dll
- 2004-08-04 07:56:45 1,483,264 —-a-w C:\WINDOWS\SYSTEM32\shdocvw.dll
+ 2007-10-11 06:13:45 1,494,528 —-a-w C:\WINDOWS\SYSTEM32\shdocvw.dll
- 2004-08-04 07:56:45 8,384,000 —-a-w C:\WINDOWS\SYSTEM32\shell32.dll
+ 2007-10-26 03:36:51 8,454,656 —-a-w C:\WINDOWS\SYSTEM32\shell32.dll
- 2004-08-04 07:56:45 473,600 —-a-w C:\WINDOWS\SYSTEM32\shlwapi.dll
+ 2007-10-11 06:13:45 474,112 —-a-w C:\WINDOWS\SYSTEM32\shlwapi.dll
- 2004-08-04 07:56:45 134,656 —-a-w C:\WINDOWS\SYSTEM32\shsvcs.dll
+ 2006-12-19 21:52:18 134,656 —-a-w C:\WINDOWS\SYSTEM32\shsvcs.dll
- 2004-08-04 07:56:57 57,856 —-a-w C:\WINDOWS\SYSTEM32\spoolsv.exe
+ 2005-06-10 23:53:32 57,856 —-a-w C:\WINDOWS\SYSTEM32\spoolsv.exe
- 2004-08-04 07:56:45 96,768 —-a-w C:\WINDOWS\SYSTEM32\srvsvc.dll
+ 2004-12-07 19:32:34 96,768 —-a-w C:\WINDOWS\SYSTEM32\srvsvc.dll
- 2004-08-04 07:56:45 246,302 —-a-w C:\WINDOWS\SYSTEM32\strmdll.dll
+ 2006-08-21 16:52:08 246,814 —-a-w C:\WINDOWS\SYSTEM32\strmdll.dll
- 2004-08-04 07:56:46 713,216 —-a-w C:\WINDOWS\SYSTEM32\sxs.dll
+ 2006-10-19 13:56:32 713,216 —-a-w C:\WINDOWS\SYSTEM32\sxs.dll
- 2004-08-04 07:56:46 246,272 —-a-w C:\WINDOWS\SYSTEM32\tapisrv.dll
+ 2005-07-08 16:27:56 249,344 —-a-w C:\WINDOWS\SYSTEM32\tapisrv.dll
- 2004-08-04 07:56:57 75,264 —-a-w C:\WINDOWS\SYSTEM32\telnet.exe
+ 2005-05-10 23:45:48 75,776 —-a-w C:\WINDOWS\SYSTEM32\telnet.exe
- 2004-08-04 07:56:46 101,376 —-a-w C:\WINDOWS\SYSTEM32\txflog.dll
+ 2005-07-26 04:39:49 101,376 —-a-w C:\WINDOWS\SYSTEM32\txflog.dll
+ 2007-11-13 11:31:11 60,416 —-a-w C:\WINDOWS\SYSTEM32\tzchange.exe
- 2004-08-04 07:56:46 118,272 —-a-w C:\WINDOWS\SYSTEM32\umpnpmgr.dll
+ 2005-08-23 03:35:42 123,392 —-a-w C:\WINDOWS\SYSTEM32\umpnpmgr.dll
- 2004-08-04 07:56:46 185,344 —-a-w C:\WINDOWS\SYSTEM32\upnphost.dll
+ 2007-02-05 20:17:02 185,344 —-a-w C:\WINDOWS\SYSTEM32\upnphost.dll
- 2004-08-04 07:56:46 601,088 —-a-w C:\WINDOWS\SYSTEM32\urlmon.dll
+ 2007-10-11 06:13:45 615,424 —-a-w C:\WINDOWS\SYSTEM32\urlmon.dll
- 2004-08-04 07:56:46 577,024 —-a-w C:\WINDOWS\SYSTEM32\user32.dll
+ 2007-03-08 15:36:28 577,536 —-a-w C:\WINDOWS\SYSTEM32\user32.dll
+ 2006-03-17 00:38:01 28,672 —-a-w C:\WINDOWS\SYSTEM32\verclsid.exe
- 2004-08-04 07:56:46 67,584 —-a-w C:\WINDOWS\SYSTEM32\webclnt.dll
+ 2006-01-04 03:35:05 68,096 —-a-w C:\WINDOWS\SYSTEM32\webclnt.dll
- 2004-08-04 07:56:46 333,312 —-a-w C:\WINDOWS\SYSTEM32\wiaservc.dll
+ 2006-12-19 18:16:47 333,824 —-a-w C:\WINDOWS\SYSTEM32\wiaservc.dll
- 2004-08-04 06:17:40 1,835,904 —-a-w C:\WINDOWS\SYSTEM32\win32k.sys
+ 2007-03-08 13:47:48 1,843,584 —-a-w C:\WINDOWS\SYSTEM32\win32k.sys
- 2004-08-04 07:56:46 656,384 —-a-w C:\WINDOWS\SYSTEM32\wininet.dll
+ 2007-10-11 06:13:45 659,456 —-a-w C:\WINDOWS\SYSTEM32\wininet.dll
- 2004-08-04 07:56:46 290,816 —-a-w C:\WINDOWS\SYSTEM32\winsrv.dll
+ 2007-03-17 13:43:01 292,864 —-a-w C:\WINDOWS\SYSTEM32\winsrv.dll
- 2004-08-04 07:56:46 132,096 —-a-w C:\WINDOWS\SYSTEM32\wkssvc.dll
+ 2006-08-17 12:28:27 132,096 —-a-w C:\WINDOWS\SYSTEM32\wkssvc.dll
- 2004-09-23 01:46:16 5,550,080 —-a-w C:\WINDOWS\SYSTEM32\wmp.dll
+ 2007-04-30 15:20:24 5,537,792 —-a-w C:\WINDOWS\SYSTEM32\wmp.dll
- 2004-10-11 18:20:36 2,362,104 —-a-w C:\WINDOWS\SYSTEM32\wmvcore.dll
+ 2006-12-07 06:40:49 2,362,184 —-a-w C:\WINDOWS\SYSTEM32\wmvcore.dll
- 2004-08-04 07:56:46 11,776 —-a-w C:\WINDOWS\SYSTEM32\xolehlp.dll
+ 2006-03-01 19:42:42 11,776 —-a-w C:\WINDOWS\SYSTEM32\xolehlp.dll
+ 2007-10-29 10:26:53 115,712 —-a-w C:\WINDOWS\SYSTEM32\xpsp3res.dll
- 2007-12-24 21:44:57 507,904 —-a-w C:\WINDOWS\Temporary Internet Files\Content.IE5\index.dat
+ 2007-12-27 00:31:44 589,824 —-a-w C:\WINDOWS\Temporary Internet Files\Content.IE5\index.dat
+ 2007-05-08 22:06:44 1,275,392 —-a-w C:\WINDOWS\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9848.0_x-ww_1b897e9a\msxml4.dll
+ 2007-04-18 17:36:40 82,432 —-a-w C:\WINDOWS\WinSxS\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a\msxml4r.dll
+ 2007-01-19 20:15:24 74,802 —-a-w C:\WINDOWS\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.9792.0_x-ww_08a6620a\atl.dll
+ 2007-01-19 20:15:24 995,383 —-a-w C:\WINDOWS\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.9792.0_x-ww_08a6620a\mfc42.dll
+ 2007-01-19 20:15:24 1,011,774 —-a-w C:\WINDOWS\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.9792.0_x-ww_08a6620a\mfc42u.dll
+ 2007-01-19 20:15:24 401,462 —-a-w C:\WINDOWS\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.9792.0_x-ww_08a6620a\msvcp60.dll
+ 2006-08-25 15:45:55 1,054,208 —-a-w C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22}]
2007-12-18 12:27 111968 –a—— C:\Program Files\AOL Search\AOLSearch.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CBC173CE-4736-4D6C-9625-20965B872E00}]
2007-12-26 17:31 344064 –a—— C:\WINDOWS\System32\vtsts.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56]
"ESPN BottomLine"="C:\Program Files\ESPN\BottomLine\bline.exe" []
"Morpheus"="C:\Program Files\StreamCast\Morpheus\Morpheus.exe" []
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-12-26 16:43]
"RealPlayer"="C:\Program Files\Real\RealPlayer\realplay.exe" [2007-12-26 17:31]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" []
"Aim6"="C:\Program Files\AIM6\aim6.exe" []
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" []
"Router"="C:\Program Files\Router\Router.exe" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [2007-12-26 17:32]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-12-26 17:32]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2007-12-26 17:32]
"QuickTime Task"="C:\Program Files\QuickTime\qttask .exe" [2007-12-26 17:32]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 17:30]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" []
"HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2007-12-26 17:32]
"DLCCCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll" [2006-02-24 16:11]
"dlccmon.exe"="C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe" [2007-12-26 17:32]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-12-26 17:32]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2002-10-16 17:06:48]
WG111v2 Smart Wizard Wireless Setting.lnk - C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe [2007-10-27 15:05:21]

[HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\windows]
"load"=C:\WINDOWS\System32\vtsts.exe

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\System32\vtsts

R2 EAPPkt;Realtek EAPPkt Protocol;C:\WINDOWS\system32\DRIVERS\EAPPkt.sys [2005-04-01 09:42]
R3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\wg111v2.sys [2005-04-21 12:33]
R3 SjyPkt;SjyPkt;C:\WINDOWS\System32\Drivers\SjyPkt.sys [2002-10-02 07:57]
S3 NMSCFG;NIC Management Service Configuration Driver;C:\WINDOWS\System32\drivers\NMSCFG.SYS [2002-05-03 09:30]
S4 hpt3xx;hpt3xx;C:\WINDOWS\system32\DRIVERS\hpt3xx.sys [2001-08-17 11:52]

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2007-12-26 23:59:37 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2007-10-23 14:52:18 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Sherry.job"
- C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exe
"2007-12-21 23:49:32 C:\WINDOWS\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-26 17:31:30
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.3156]
-> C:\WINDOWS\System32\vtsts.dll
.
Completion time: 2007-12-26 17:41:28 - machine was rebooted
C:\ComboFix2.txt … 2007-12-24 14:56
.
2007-12-26 10:13:31 — E O F —
—————————————————————————————————————————————————————————

And the HijackThis Log–

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:56:04 PM, on 12/26/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Visioneer\OneTouch 4.0\OtService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Dell Photo AIO Printer 924\dlccmon .exe
C:\Program Files\Microsoft IntelliPoint\ipoint .exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2 .exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe
C:\Program Files\MSN Messenger\MsnMsgr .Exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\System32\dlcccoms.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtWLan.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com/
R3 - URLSearchHook: AOLSearchHook Class - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AOL Search\AOLSearch.dll
F3 - REG:win.ini: load=C:\WINDOWS\System32\vtsts.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask .exe" -atboottime
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [DLCCCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [dlccmon.exe] "C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ESPN BottomLine] C:\Program Files\ESPN\BottomLine\bline.exe
O4 - HKCU\..\Run: [Morpheus] "C:\Program Files\StreamCast\Morpheus\Morpheus.exe" -min
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [Router] C:\Program Files\Router\Router.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: WG111v2 Smart Wizard Wireless Setting.lnk = ?
O8 - Extra context menu item: &AOL; Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://testprep.princetonreview.com
O15 - Trusted Zone: http://*.princetonreview.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1C203F13-95AD-11D0-A84B-00A0247B735B} (Sheridan ActiveTreeView Control) - https://fa.1stglobal.com/GlobalAccess/sstree.cab
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.costcophotocenter.com/CostcoActivia.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1198438920557
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {89242969-422B-46BF-B0D5-6A7B7DC4D0E0} (NAS Finder Helper) - file://D:\html\nafcom.cab
O16 - DPF: {B020B534-4AA2-4B99-BD6D-5F6EE286DF5C} (Symantec Download Bridge) - https://a248.e.akamai.net/f/248/5462/2h/www…ol/SymDlBrg.cab
O16 - DPF: {E9C9692E-F93C-11D1-ABB0-0040054FC6FB} (ProtoView DataTable Control 6.5 (OLEDB)) - https://fa.1stglobal.com/GlobalAccess/pvdt60.cab
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: dlcc_device - Unknown owner - C:\WINDOWS\System32\dlcccoms.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: OneTouch 4.0 Monitor - Visioneer Inc - C:\Program Files\Visioneer\OneTouch 4.0\OtService.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

–
End of file - 8820 bytes

Rosty

Post #6December 27, 2007, 8:22 AM UTC

Download and scan with SUPERAntiSpyware Free for Home Users

Double-click SUPERAntiSpyware.exe and use the default settings for installation.
An icon will be created on your desktop. Double-click that icon to launch the program.
If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here.)
Under "Configuration and Preferences", click the Preferences button.
Click the Scanning Control tab.
Under Scanner Options make sure the following are checked (leave all others unchecked):
- Close browsers before scanning.
- Scan for tracking cookies.
- Terminate memory threats before quarantining.
Click the "Close" button to leave the control center screen.
Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
On the left, make sure you check C:\Fixed Drive.
On the right, under "Complete Scan", choose Perform Complete Scan.
Click "Next" to start the scan. Please be patient while it scans your computer.
After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
Make sure everything has a checkmark next to it and click "Next".
A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
If asked if you want to reboot, click "Yes".
To retrieve the removal information after reboot, launch SUPERAntispyware again.
- Click Preferences, then click the Statistics/Logs tab.
- Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
- If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
- Please copy and paste the Scan Log results in your next reply.
Click Close to exit the program.

parker

Post #7December 30, 2007, 10:42 PM UTC

Sorry it took me so long to reply, the Scan took about 13 hours to complete. It seems that explorer.exe is using the majority of my CPU % (sometimes as much 95-99%). Here is the log-

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 12/30/2007 at 02:09 PM

Application Version : 3.9.1008

Core Rules Database Version : 3370
Trace Rules Database Version: 1365

Scan type : Complete Scan
Total Scan Time : 11:58:06

Memory items scanned : 452
Memory threats detected : 1
Registry items scanned : 6649
Registry threats detected : 8
File items scanned : 66510
File threats detected : 50

Adware.Vundo Variant
C:\WINDOWS\SYSTEM32\VTSTS.DLL
C:\WINDOWS\SYSTEM32\VTSTS.DLL
HKLM\Software\Classes\CLSID\{8F1F7CE6-407B-4AF0-B0E6-6DF4DFBE7AD2}
HKCR\CLSID\{8F1F7CE6-407B-4AF0-B0E6-6DF4DFBE7AD2}
HKCR\CLSID\{8F1F7CE6-407B-4AF0-B0E6-6DF4DFBE7AD2}\InprocServer32
HKCR\CLSID\{8F1F7CE6-407B-4AF0-B0E6-6DF4DFBE7AD2}\InprocServer32#ThreadingModel
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8F1F7CE6-407B-4AF0-B0E6-6DF4DFBE7AD2}

BearShare File Sharing Client
[BearShare] C:\DOCUMENTS AND SETTINGS\PARKER\DESKTOP\UNUSED DESKTOP SHORTCUTS\BEARSHARE.EXE
C:\DOCUMENTS AND SETTINGS\PARKER\DESKTOP\UNUSED DESKTOP SHORTCUTS\BEARSHARE.EXE
C:\DOCUMENTS AND SETTINGS\PARKER\DESKTOP\UNUSED DESKTOP SHORTCUTS\TVUPLAYER\BEARSHARE.EXE
C:\WINDOWS\Prefetch\BEARSHARE.EXE-0220BBB3.pf
C:\WINDOWS\Prefetch\BEARSHARE.EXE-093925A7.pf

Trojan.Vundo/Variant-Installer
[load] C:\WINDOWS\SYSTEM32\VTSTS.EXE
C:\WINDOWS\SYSTEM32\VTSTS.EXE
[load] C:\WINDOWS\SYSTEM32\VTSTS.EXE
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\VTSTS.EXE.VIR
C:\WINDOWS\SYSTEM32\RCX21.TMP
C:\WINDOWS\SYSTEM32\RCX23.TMP
C:\WINDOWS\Prefetch\VTSTS.EXE-331A9CCF.pf

Adware.Tracking Cookie
C:\Documents and Settings\Parker\Cookies\[removed][2].txt
C:\Documents and Settings\Parker\Cookies\[removed][2].txt
C:\Documents and Settings\Parker\Cookies\parker@tribalfusion[2].txt
C:\Documents and Settings\Parker\Cookies\parker@mediaplex[1].txt
C:\Documents and Settings\Parker\Cookies\parker@2o7[2].txt
C:\Documents and Settings\Parker\Cookies\parker@tacoda[1].txt
C:\Documents and Settings\Parker\Cookies\parker@advertising[2].txt
C:\Documents and Settings\Parker\Cookies\[removed][2].txt
C:\Documents and Settings\Parker\Cookies\[removed][1].txt
C:\Documents and Settings\Parker\Cookies\parker@adtech[1].txt
C:\Documents and Settings\Parker\Cookies\parker@atdmt[2].txt
C:\Documents and Settings\Parker\Cookies\parker@a[1].txt
C:\Documents and Settings\Parker\Cookies\parker@hitbox[1].txt
C:\Documents and Settings\Parker\Cookies\parker@cgi-bin[3].txt
C:\Documents and Settings\Parker\Cookies\parker@adrevolver[1].txt
C:\Documents and Settings\Parker\Cookies\parker@doubleclick[2].txt
C:\Documents and Settings\Parker\Cookies\[removed][1].txt
C:\Documents and Settings\Parker\Cookies\[removed][2].txt
C:\Documents and Settings\Parker\Cookies\[removed][1].txt
C:\Documents and Settings\Parker\Cookies\[removed][2].txt
C:\Documents and Settings\Parker\Cookies\parker@adserver[1].txt
C:\Documents and Settings\Parker\Cookies\parker@overture[1].txt
C:\Documents and Settings\Parker\Cookies\parker@adrevolver[3].txt
C:\Documents and Settings\Parker\Cookies\parker@zedo[1].txt
C:\Documents and Settings\Parker\Cookies\parker@questionmarket[2].txt
C:\Documents and Settings\Parker\Cookies\parker@interclick[2].txt
C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@adprofile[1].txt
C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@azjmp[2].txt
C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@cliks[1].txt
C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@offeroptimizer[2].txt
C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\[removed][2].txt
C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\[removed][2].txt
C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\[removed][2].txt

Adware.AdSponsor/ISM
C:\QOOBOX\QUARANTINE\C\PROGRAM FILES\QDRPACK\QDRPACK11 .EXE.VIR

Trojan.Unknown Origin
C:\QOOBOX\QUARANTINE\C\WINDOWS\B128.EXE.VIR

Adware.Vundo Variant/Rel
C:\WINDOWS\SYSTEM32\MCRH.TMP
C:\WINDOWS\SYSTEM32\STSTV.INI

Trace.Known Threat Sources
C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\Z8PFBPCE\med[1].gif
C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\WFK4CFNO\bkg6[1].png
C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\5FX8T5BJ\bkg7[1].gif

parker

Post #8January 6, 2008, 3:14 AM UTC

Im still having problems with explorer bogging down everything. Any new suggestions?

Rosty

Post #9January 6, 2008, 8:42 AM UTC

Hi, sorry for the delay! Please delete this folder using windows explorer: C:\QOOBOX\QUARANTINE and this files: C:\WINDOWS\SYSTEM32\VTSTS.EXE C:\WINDOWS\SYSTEM32\RCX21.TMP C:\WINDOWS\SYSTEM32\RCX23.TMP C:\WINDOWS\Prefetch\VTSTS.EXE-331A9CCF.pf C:\WINDOWS\SYSTEM32\VTSTS.DLL Reboot, perform another scan with SuperAnti-spyware and post the log togheter with a new HijackThis log.

parker

Post #10January 19, 2008, 5:51 AM UTC

Sorry for the delayed response, and thanks for all the help. Here are the logs.

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 01/18/2008 at 08:25 PM

Application Version : 3.9.1008

Core Rules Database Version : 3370
Trace Rules Database Version: 1365

Scan type : Complete Scan
Total Scan Time : 02:21:45

Memory items scanned : 407
Memory threats detected : 1
Registry items scanned : 6746
Registry threats detected : 8
File items scanned : 64376
File threats detected : 150

Adware.Vundo Variant
C:\WINDOWS\SYSTEM32\VTSTS.DLL
C:\WINDOWS\SYSTEM32\VTSTS.DLL
HKLM\Software\Classes\CLSID\{A12BD602-23BE-4B79-89EE-4BB6055A1AEE}
HKCR\CLSID\{A12BD602-23BE-4B79-89EE-4BB6055A1AEE}
HKCR\CLSID\{A12BD602-23BE-4B79-89EE-4BB6055A1AEE}\InprocServer32
HKCR\CLSID\{A12BD602-23BE-4B79-89EE-4BB6055A1AEE}\InprocServer32#ThreadingModel
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A12BD602-23BE-4B79-89EE-4BB6055A1AEE}

BearShare File Sharing Client
[BearShare] C:\DOCUMENTS AND SETTINGS\PARKER\DESKTOP\UNUSED DESKTOP SHORTCUTS\BEARSHARE.EXE
C:\DOCUMENTS AND SETTINGS\PARKER\DESKTOP\UNUSED DESKTOP SHORTCUTS\BEARSHARE.EXE
C:\DOCUMENTS AND SETTINGS\PARKER\DESKTOP\UNUSED DESKTOP SHORTCUTS\TVUPLAYER\BEARSHARE.EXE
C:\WINDOWS\Prefetch\BEARSHARE.EXE-093925A7.pf

Trojan.Vundo/Variant-Installer
[load] C:\WINDOWS\SYSTEM32\VTSTS.EXE
C:\WINDOWS\SYSTEM32\VTSTS.EXE
[load] C:\WINDOWS\SYSTEM32\VTSTS.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{21D7D692-4662-421F-93B0-877BC3820711}\RP1252\A0174118.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{21D7D692-4662-421F-93B0-877BC3820711}\RP1252\A0175118.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{21D7D692-4662-421F-93B0-877BC3820711}\RP1252\A0175157.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{21D7D692-4662-421F-93B0-877BC3820711}\RP1255\A0178199.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{21D7D692-4662-421F-93B0-877BC3820711}\RP1255\A0179199.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{21D7D692-4662-421F-93B0-877BC3820711}\RP1261\A0179405.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{21D7D692-4662-421F-93B0-877BC3820711}\RP1262\A0181446.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{21D7D692-4662-421F-93B0-877BC3820711}\RP1262\A0181475.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{21D7D692-4662-421F-93B0-877BC3820711}\RP1262\A0182475.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{21D7D692-4662-421F-93B0-877BC3820711}\RP1263\A0182502.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{21D7D692-4662-421F-93B0-877BC3820711}\RP1264\A0182598.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{21D7D692-4662-421F-93B0-877BC3820711}\RP1265\A0182622.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{21D7D692-4662-421F-93B0-877BC3820711}\RP1266\A0182669.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{21D7D692-4662-421F-93B0-877BC3820711}\RP1268\A0182707.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{21D7D692-4662-421F-93B0-877BC3820711}\RP1268\A0182738.EXE

Adware.Tracking Cookie
C:\Documents and Settings\Parker\Cookies\[removed][2].txt
C:\Documents and Settings\Parker\Cookies\parker@adlegend[2].txt
C:\Documents and Settings\Parker\Cookies\[removed][1].txt
C:\Documents and Settings\Parker\Cookies\parker@realmedia[1].txt
C:\Documents and Settings\Parker\Cookies\[removed][2].txt
C:\Documents and Settings\Parker\Cookies\parker@eroticlick[2].txt
C:\Documents and Settings\Parker\Cookies\parker@tribalfusion[2].txt
C:\Documents and Settings\Parker\Cookies\parker@sextracker[1].txt
C:\Documents and Settings\Parker\Cookies\parker@discounterectionpills[1].txt
C:\Documents and Settings\Parker\Cookies\[removed][2].txt
C:\Documents and Settings\Parker\Cookies\parker@clicktorrent[1].txt
C:\Documents and Settings\Parker\Cookies\parker@mediaplex[1].txt
C:\Documents and Settings\Parker\Cookies\parker@pornbits[2].txt
C:\Documents and Settings\Parker\Cookies\parker@2o7[2].txt
C:\Documents and Settings\Parker\Cookies\[removed][1].txt
C:\Documents and Settings\Parker\Cookies\parker@tacoda[1].txt
C:\Documents and Settings\Parker\Cookies\parker@advertising[2].txt
C:\Documents and Settings\Parker\Cookies\[removed][2].txt
C:\Documents and Settings\Parker\Cookies\[removed][1].txt
C:\Documents and Settings\Parker\Cookies\parker@casalemedia[1].txt
C:\Documents and Settings\Parker\Cookies\[removed][1].txt
C:\Documents and Settings\Parker\Cookies\[removed][1].txt
C:\Documents and Settings\Parker\Cookies\[removed]-sys[1].txt
C:\Documents and Settings\Parker\Cookies\parker@adtech[1].txt
C:\Documents and Settings\Parker\Cookies\[removed][2].txt
C:\Documents and Settings\Parker\Cookies\parker@atdmt[2].txt
C:\Documents and Settings\Parker\Cookies\parker@a[1].txt
C:\Documents and Settings\Parker\Cookies\parker@pornhost[2].txt
C:\Documents and Settings\Parker\Cookies\parker@ig[2].txt
C:\Documents and Settings\Parker\Cookies\parker@hitbox[2].txt
C:\Documents and Settings\Parker\Cookies\parker@cgi-bin[4].txt
C:\Documents and Settings\Parker\Cookies\parker@xxxtoob[2].txt
C:\Documents and Settings\Parker\Cookies\[removed][2].txt
C:\Documents and Settings\Parker\Cookies\[removed][2].txt
C:\Documents and Settings\Parker\Cookies\parker@fastclick[2].txt
C:\Documents and Settings\Parker\Cookies\parker@adrevolver[3].txt
C:\Documents and Settings\Parker\Cookies\parker@adbrite[1].txt
C:\Documents and Settings\Parker\Cookies\parker@doubleclick[1].txt
C:\Documents and Settings\Parker\Cookies\[removed][1].txt
C:\Documents and Settings\Parker\Cookies\parker@pornoinside[2].txt
C:\Documents and Settings\Parker\Cookies\parker@revsci[1].txt
C:\Documents and Settings\Parker\Cookies\parker@vidisex[2].txt
C:\Documents and Settings\Parker\Cookies\[removed][1].txt
C:\Documents and Settings\Parker\Cookies\[removed][1].txt
C:\Documents and Settings\Parker\Cookies\parker@trafficmp[2].txt
C:\Documents and Settings\Parker\Cookies\[removed][1].txt
C:\Documents and Settings\Parker\Cookies\parker@keybank.112.2o7[1].txt
C:\Documents and Settings\Parker\Cookies\[removed][1].txt
C:\Documents and Settings\Parker\Cookies\[removed][2].txt
C:\Documents and Settings\Parker\Cookies\[removed][1].txt
C:\Documents and Settings\Parker\Cookies\parker@518[1].txt
C:\Documents and Settings\Parker\Cookies\parker@adinterax[2].txt
C:\Documents and Settings\Parker\Cookies\[removed][1].txt
C:\Documents and Settings\Parker\Cookies\[removed][1].txt
C:\Documents and Settings\Parker\Cookies\parker@adserver[1].txt
C:\Documents and Settings\Parker\Cookies\parker@tradedoubler[1].txt
C:\Documents and Settings\Parker\Cookies\parker@overture[1].txt
C:\Documents and Settings\Parker\Cookies\[removed][2].txt
C:\Documents and Settings\Parker\Cookies\[removed][2].txt
C:\Documents and Settings\Parker\Cookies\parker@xxxstash[2].txt
C:\Documents and Settings\Parker\Cookies\parker@specificclick[1].txt
C:\Documents and Settings\Parker\Cookies\parker@adultfriendfinder[2].txt
C:\Documents and Settings\Parker\Cookies\parker@apmebf[1].txt
C:\Documents and Settings\Parker\Cookies\parker@adrevolver[1].txt
C:\Documents and Settings\Parker\Cookies\parker@bluestreak[2].txt
C:\Documents and Settings\Parker\Cookies\[removed][2].txt
C:\Documents and Settings\Parker\Cookies\parker@adultadworld[2].txt
C:\Documents and Settings\Parker\Cookies\parker@zedo[2].txt
C:\Documents and Settings\Parker\Cookies\parker@burstnet[2].txt
C:\Documents and Settings\Parker\Cookies\[removed][2].txt
C:\Documents and Settings\Parker\Cookies\parker@xxxporn[1].txt
C:\Documents and Settings\Parker\Cookies\[removed][2].txt
C:\Documents and Settings\Parker\Cookies\parker@s[1].txt
C:\Documents and Settings\Parker\Cookies\[removed][1].txt
C:\Documents and Settings\Parker\Cookies\[removed][1].txt
C:\Documents and Settings\Parker\Cookies\parker@spylog[2].txt
C:\Documents and Settings\Parker\Cookies\[removed][1].txt
C:\Documents and Settings\Parker\Cookies\[removed][2].txt
C:\Documents and Settings\Parker\Cookies\parker@dbcmedia[1].txt
C:\Documents and Settings\Parker\Cookies\parker@porntoob[2].txt
C:\Documents and Settings\Parker\Cookies\[removed][1].txt
C:\Documents and Settings\Parker\Cookies\[removed][2].txt
C:\Documents and Settings\Parker\Cookies\[removed][1].txt
C:\Documents and Settings\Parker\Cookies\parker@questionmarket[1].txt
C:\Documents and Settings\Parker\Cookies\parker@xcart[2].txt
C:\Documents and Settings\Parker\Cookies\[removed][1].txt
C:\Documents and Settings\Parker\Cookies\parker@list[2].txt
C:\Documents and Settings\Parker\Cookies\parker@serving-sys[1].txt
C:\Documents and Settings\Parker\Cookies\parker@ad[1].txt
C:\Documents and Settings\Parker\Cookies\parker@humornsex[2].txt
C:\Documents and Settings\Parker\Cookies\[removed][1].txt
C:\Documents and Settings\Parker\Cookies\[removed][1].txt
C:\Documents and Settings\Parker\Cookies\[removed][1].txt
C:\Documents and Settings\Parker\Cookies\parker@tjx.112.2o7[1].txt
C:\Documents and Settings\Parker\Cookies\[removed][1].txt
C:\Documents and Settings\Parker\Cookies\[removed][2].txt
C:\Documents and Settings\Parker\Cookies\[removed][2].txt
C:\Documents and Settings\Parker\Cookies\parker@yadro[2].txt
C:\Documents and Settings\Parker\Cookies\[removed][2].txt
C:\Documents and Settings\Parker\Cookies\[removed][2].txt
C:\Documents and Settings\Parker\Cookies\[removed][1].txt
C:\Documents and Settings\Parker\Cookies\[removed][2].txt
C:\Documents and Settings\Parker\Cookies\parker@cgi-bin[2].txt
C:\Documents and Settings\Parker\Cookies\parker@shakingmedia[2].txt
C:\Documents and Settings\Parker\Cookies\parker@AdRotator[3].txt
C:\Documents and Settings\Parker\Cookies\[removed][1].txt
C:\Documents and Settings\Parker\Cookies\parker@statcounter[1].txt
C:\Documents and Settings\Parker\Cookies\parker@interclick[1].txt
C:\Documents and Settings\Parker\Cookies\parker@1068097096[1].txt
C:\Documents and Settings\Parker\Cookies\[removed][2].txt
C:\Documents and Settings\Parker\Cookies\parker@xiti[1].txt
C:\Documents and Settings\Parker\Cookies\[removed][1].txt
C:\Documents and Settings\Parker\Cookies\parker@clicksor[1].txt
C:\Documents and Settings\Parker\Cookies\[removed][1].txt
C:\Documents and Settings\Parker\Cookies\[removed][1].txt
C:\Documents and Settings\Parker\Cookies\[removed][1].txt
C:\Documents and Settings\Parker\Cookies\[removed][2].txt
C:\Documents and Settings\Parker\Cookies\[removed][2].txt
C:\Documents and Settings\Parker\Cookies\parker@setanta.112.2o7[1].txt
C:\Documents and Settings\Parker\Cookies\parker@viavh1com.112.2o7[2].txt
C:\Documents and Settings\Parker\Cookies\[removed][2].txt
C:\Documents and Settings\Parker\Cookies\parker@azjmp[2].txt
C:\Documents and Settings\Parker\Cookies\[removed][2].txt
C:\Documents and Settings\Parker\Cookies\parker@rambler[1].txt
C:\Documents and Settings\Parker\Cookies\parker@pornenmeer[1].txt
C:\Documents and Settings\Parker\Cookies\[removed][1].txt
C:\Documents and Settings\Parker\Cookies\[removed][2].txt
C:\Documents and Settings\Parker\Cookies\parker@6229559[2].txt
C:\Documents and Settings\Parker\Cookies\[removed][2].txt

Adware.Vundo Variant/Rel
C:\WINDOWS\SYSTEM32\STSTV.INI

———————————————————————————————————————————————————————————–
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:38:41 PM, on 1/18/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Visioneer\OneTouch 4.0\OtService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2 .exe
C:\Program Files\Windows Defender\MSASCui .exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\dlcccoms.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com/
R3 - URLSearchHook: AOLSearchHook Class - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AOL Search\AOLSearch.dll
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask .exe" -atboottime
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [DLCCCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [dlccmon.exe] "C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [BearShare] "C:\Documents and Settings\Parker\Desktop\Unused Desktop Shortcuts\BearShare.exe" /pause
O4 - HKLM\..\Run: [iTunesHelper] "C:\Documents and Settings\Parker\Desktop\Unused Desktop Shortcuts\Extras\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ESPN BottomLine] C:\Program Files\ESPN\BottomLine\bline.exe
O4 - HKCU\..\Run: [Morpheus] "C:\Program Files\StreamCast\Morpheus\Morpheus.exe" -min
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [Router] C:\Program Files\Router\Router.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: WG111v2 Smart Wizard Wireless Setting.lnk = ?
O8 - Extra context menu item: &AOL; Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://testprep.princetonreview.com
O15 - Trusted Zone: http://*.princetonreview.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1C203F13-95AD-11D0-A84B-00A0247B735B} (Sheridan ActiveTreeView Control) - https://fa.1stglobal.com/GlobalAccess/sstree.cab
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.costcophotocenter.com/CostcoActivia.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1198438920557
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {89242969-422B-46BF-B0D5-6A7B7DC4D0E0} (NAS Finder Helper) - file://D:\html\nafcom.cab
O16 - DPF: {B020B534-4AA2-4B99-BD6D-5F6EE286DF5C} (Symantec Download Bridge) - https://a248.e.akamai.net/f/248/5462/2h/www…ol/SymDlBrg.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {E9C9692E-F93C-11D1-ABB0-0040054FC6FB} (ProtoView DataTable Control 6.5 (OLEDB)) - https://fa.1stglobal.com/GlobalAccess/pvdt60.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: dlcc_device - Unknown owner - C:\WINDOWS\System32\dlcccoms.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: OneTouch 4.0 Monitor - Visioneer Inc - C:\Program Files\Visioneer\OneTouch 4.0\OtService.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

–
End of file - 9294 bytes

Rosty

Post #11January 19, 2008, 7:44 AM UTC

Hi,

Please remove Combofix first, its outdated and I need to see a new log:

Click Start >> Run, and then type ComboFix /u and hit enter.

Next,

Download ComboFix from Here or Here to your Desktop.

Double click combofix.exe and follow the prompts.
When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

parker

Post #12February 10, 2008, 1:46 AM UTC

Hi again, I finally got around to your advice. I attached the two logs below. I am currently running my computer without running explorer.exe, as this program seems to use all of the CPU while running. Thanks for your help.

ComboFix 08-02.05.3 - Parker 2008-02-09 17:22:35.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.350 [GMT -7:00]
Running from: C:\WINDOWS\Temporary Internet Files\Content.IE5\I9L2394E\ComboFix[2].exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\vtsts.dll
C:\Documents and Settings\Parker\Application Data\ShoppingReport
C:\Documents and Settings\Parker\Application Data\ShoppingReport\cs\Config.xml
C:\Documents and Settings\Parker\Application Data\ShoppingReport\cs\db\Aliases.dbs
C:\Documents and Settings\Parker\Application Data\ShoppingReport\cs\db\Sites.dbs
C:\Documents and Settings\Parker\Application Data\ShoppingReport\cs\dwld\WhiteList.xip
C:\Documents and Settings\Parker\Application Data\ShoppingReport\cs\report\aggr_storage.xml
C:\Documents and Settings\Parker\Application Data\ShoppingReport\cs\report\send_storage.xml
C:\Documents and Settings\Parker\Application Data\ShoppingReport\cs\res1\WhiteList.dbs
C:\Documents and Settings\Parker\Desktop\Unused Desktop Shortcuts\Extras\iTunesHelper.exe
C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\QuickTime\qttask .exe
C:\Program Files\QuickTime\qttask .exe
C:\Program Files\QuickTime\qttask .exe
C:\Program Files\QuickTime\qttask .exe
C:\Program Files\QuickTime\qttask .exe
C:\WINDOWS\inf\MSView.inf
C:\WINDOWS\system32\ctfmon.exe.tmp
C:\WINDOWS\system32\RCX42.tmp
C:\WINDOWS\system32\rthbaxgv.dll
C:\WINDOWS\SYSTEM32\ststv.ini
C:\WINDOWS\SYSTEM32\ststv.ini2
C:\WINDOWS\system32\vtsts.dll
C:\WINDOWS\system32\vtsts.exe
C:\WINDOWS\winlogon.exe

.
((((((((((((((((((((((((( Files Created from 2008-01-10 to 2008-02-10 )))))))))))))))))))))))))))))))
.

2008-02-06 01:58 . 2008-02-06 01:58 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-02-06 01:58 . 2008-02-06 01:58 1,409 –a—— C:\WINDOWS\QTFont.for
2008-02-04 17:25 . 2008-02-04 17:25 d——– C:\WINDOWS\SYSTEM32\bak
2008-02-04 17:25 . 2008-02-04 17:25 d——– C:\WINDOWS\bak
2008-01-29 16:11 . 2008-01-29 16:11 d——– C:\Documents and Settings\Parker\Application Data\Zango
2008-01-29 02:29 . 2008-02-05 10:46 159,744 –a—— C:\WINDOWS\winlogon .exe
2008-01-28 21:20 . 2008-01-28 21:20 4,636,532 –a—— C:\WINDOWS\SYSTEM32\TmpA319187
2008-01-25 10:36 . 2008-01-25 10:48 d——– C:\Documents and Settings\Parker\Application Data\Ableton

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-10 00:30 ——— d—–w C:\Program Files\QuickTime
2008-02-08 22:00 ——— d—–w C:\Program Files\Norton Security Scan
2008-02-07 07:42 ——— d—–w C:\Documents and Settings\Parker\Application Data\NewzToolz
2008-02-05 15:19 ——— d—–w C:\Documents and Settings\Parker\Application Data\SopCast
2008-02-05 00:25 ——— d—–w C:\Program Files\SUPERAntiSpyware
2008-02-05 00:25 ——— d—–w C:\Program Files\MSN Messenger
2008-02-05 00:25 ——— d—–w C:\Program Files\Microsoft Works
2008-02-05 00:25 ——— d—–w C:\Program Files\Microsoft IntelliPoint
2008-02-05 00:25 ——— d—–w C:\Program Files\Dell Photo AIO Printer 924
2008-01-31 23:39 ——— d—–w C:\Program Files\Microsoft
2008-01-29 04:28 ——— d—–w C:\Program Files\Windows Defender
2008-01-29 04:25 ——— d—–w C:\Program Files\Common Files\Adaptec Shared
2008-01-25 08:43 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-01-19 15:31 ——— d—–w C:\Program Files\TVAnts
2008-01-19 04:01 ——— d—–w C:\Program Files\dl_Cats
2008-01-09 05:23 ——— d—–w C:\Program Files\Common Files\logishrd
2008-01-06 01:52 ——— d—–w C:\Documents and Settings\Parker\Application Data\Skype
2008-01-05 23:08 ——— d—–w C:\Documents and Settings\Parker\Application Data\skypePM
2008-01-01 01:57 32 —-a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-01-01 01:47 ——— d—–w C:\Program Files\Skype
2008-01-01 01:45 ——— d—–w C:\Documents and Settings\All Users\Application Data\Skype
2008-01-01 01:43 ——— d—–w C:\Program Files\Common Files\Skype
2007-12-29 23:23 ——— d—–w C:\Documents and Settings\Parker\Application Data\SUPERAntiSpyware.com
2007-12-29 23:23 ——— d—–w C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-12-29 23:22 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-12-27 09:43 ——— d—–w C:\Documents and Settings\Parker\Application Data\Apple Computer
2007-12-27 09:41 ——— d—–w C:\Program Files\iPod
2007-12-27 09:41 ——— d—–w C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-12-27 07:43 ——— d—–w C:\Program Files\Common Files\GMT
2007-12-25 10:46 ——— d—–w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-12-24 20:27 ——— d—–w C:\Documents and Settings\All Users\Application Data\Viewpoint
2007-12-24 05:46 ——— d—–w C:\Program Files\Trend Micro
2007-12-22 22:08 ——— d—–w C:\Documents and Settings\Parker\Application Data\Uniblue
2007-12-22 19:50 ——— d—–w C:\Documents and Settings\Sherry\Application Data\Yahoo!
2007-12-22 19:50 ——— d—–w C:\Documents and Settings\All Users\Application Data\Yahoo!
2007-12-22 19:42 ——— d—–w C:\Program Files\Google
2007-12-22 19:40 ——— d—–w C:\Program Files\Common Files\AOL
2007-12-22 19:12 ——— d—–w C:\Program Files\Norton Internet Security
2007-12-22 19:09 805 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2007-12-22 19:09 123,952 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-12-22 19:09 10,740 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2007-12-22 19:09 ——— d—–w C:\Program Files\Symantec
2007-12-22 16:46 ——— d—–w C:\Documents and Settings\Parker\Application Data\Yahoo!
2007-12-22 02:56 ——— d—–w C:\Documents and Settings\Parker\Application Data\acccore
2007-12-22 02:56 ——— d—–w C:\Documents and Settings\All Users\Application Data\AOL OCP
2007-12-22 00:39 ——— d—–w C:\Program Files\AOL Search
2007-12-22 00:38 ——— d—–w C:\Documents and Settings\All Users\Application Data\AOL
2007-12-21 17:00 ——— d—–w C:\Documents and Settings\Parker\Application Data\BitTorrent
2007-09-19 15:27 60,968 —-a-w C:\Documents and Settings\Sherry\GoToAssistDownloadHelper.exe
2007-03-31 23:53 10,458 —-a-w C:\Program Files\INSTALL.LOG
2007-02-15 19:47 63,048 —-a-w C:\Documents and Settings\Sherry\Application Data\GDIPFONTCACHEV1.DAT
2006-06-27 14:53 63,048 —-a-w C:\Documents and Settings\Parker\Application Data\GDIPFONTCACHEV1.DAT
2002-08-29 15:00 557,128 —-a-w C:\Program Files\Common Files\dao360.dll
2001-11-05 16:30 165,376 —-a-w C:\Program Files\UNWISE.EXE
.

—-a-w		   229,952 2008-01-12 17:45:43  C:\Documents and Settings\Parker\Desktop\Unused Desktop Shortcuts\Extras\iTunesHelper .exe
—-a-w			57,344 2007-12-24 05:26:09  C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy .exe
—-a-w			39,792 2008-01-07 18:14:09  C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl .exe
—-a-w			50,688 2007-12-24 05:25:57  C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind .exe
—-a-w			14,860 2008-02-05 17:46:35  C:\Program Files\Common Files\Real\Update_OB\realsched .exe
—-a-w		   155,648 2007-12-24 05:26:17  C:\Program Files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdupdate .exe
—-a-w		   517,768 2008-01-25 17:16:37  C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc .exe
—-a-w		   218,240 2007-12-23 22:32:31  C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt .exe
—-a-w		   425,984 2008-02-01 21:32:31  C:\Program Files\Dell Photo AIO Printer 924\dlccmon .exe
—-a-w			68,856 2007-12-22 19:41:55  C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier .exe
—-a-w			14,860 2008-02-05 17:46:32  C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2 .exe
—-a-w		   241,664 2007-12-22 22:59:21  C:\Program Files\HP\hpcoretech\hpcmpmgr .exe
—-a-w		   842,584 2008-01-20 17:54:01  C:\Program Files\Microsoft IntelliPoint\ipoint .exe
—-a-w		 5,674,352 2007-12-30 21:26:24  C:\Program Files\MSN Messenger\MsnMsgr .Exe
—-a-w		   661,504 2007-12-27 08:54:42  C:\Program Files\QuickTime\qttask			 .exe
—-a-w		   661,504 2007-12-27 07:03:22  C:\Program Files\QuickTime\qttask			.exe
—-a-w		   661,504 2007-12-27 05:08:15  C:\Program Files\QuickTime\qttask		   .exe
—-a-w		   661,504 2007-12-26 23:43:18  C:\Program Files\QuickTime\qttask		  .exe
—-a-w		   661,504 2007-12-25 16:39:59  C:\Program Files\QuickTime\qttask		 .exe
—-a-w		   661,504 2007-12-24 21:45:21  C:\Program Files\QuickTime\qttask		.exe
—-a-w		   661,504 2007-12-24 21:24:26  C:\Program Files\QuickTime\qttask	   .exe
—-a-w		   286,720 2008-01-13 20:12:33  C:\Program Files\QuickTime\qttask	  .exe
—-a-w		   192,512 2007-12-24 05:26:17  C:\Program Files\Qwest\QuickCare\bin\sprtcmd .exe
—-a-w		 1,003,520 2007-12-31 03:32:25  C:\Program Files\Real\RealPlayer\realplay .exe
—-a-w		   679,936 2007-12-24 05:26:17  C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD .exe
—-a-w			40,960 2008-01-16 13:31:29  C:\Program Files\ScanSoft\PaperPort\IndexSearch .exe
—-a-w			57,393 2007-12-24 05:26:17  C:\Program Files\ScanSoft\PaperPort\pptd40nt .exe
—-a-w		21,686,568 2008-01-07 18:03:43  C:\Program Files\Skype\Phone\Skype .exe
—-a-w		 1,318,912 2007-12-31 03:32:28  C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware .exe
—-a-w			67,264 2008-01-25 17:16:48  C:\Program Files\Symantec\LiveUpdate\ALUNOTIFY .EXE
—-a-w		   866,584 2008-01-27 00:28:05  C:\Program Files\Windows Defender\MSASCui .exe
—-a-w		   159,744 2008-02-05 17:46:38  C:\WINDOWS\winlogon .exe
—-a-w			15,360 2007-12-27 05:08:43  C:\WINDOWS\SYSTEM32\ctfmon .exe
—-a-w		   172,032 2007-12-24 05:26:18  C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\hpztsb10 .exe

– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
—-a-w 528,896 2008-02-04 20:56:08 C:\Program Files\Common Files\Real\Update_OB\bak\realsched.exe

—-a-w 398,336 2008-02-04 20:56:08 C:\Program Files\Hewlett-Packard\HP Software Update\bak\HPWuSchd2.exe

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{100EB1FD-D03E-47FD-81F3-EE91287F9465}]
C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22}]
2007-12-18 12:27 111968 –a—— C:\Program Files\AOL Search\AOLSearch.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [ ]
"ESPN BottomLine"="C:\Program Files\ESPN\BottomLine\bline.exe" [ ]
"Morpheus"="C:\Program Files\StreamCast\Morpheus\Morpheus.exe" [ ]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [ ]
"RealPlayer"="C:\Program Files\Real\RealPlayer\realplay.exe" [ ]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [ ]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [ ]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [ ]
"Router"="C:\Program Files\Router\Router.exe" [ ]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [ ]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [ ]
"Microsoft Works Update Detection"="C:\Program Files\Microsoft Works\WkDetect.exe" [ ]
"AdobeUpdater"="C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [ ]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [ ]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [ ]
"QuickTime Task"="C:\Program Files\QuickTime\qttask .exe" [ ]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [ ]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [ ]
"HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [ ]
"DLCCCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll" [2006-02-24 16:11 73728]
"dlccmon.exe"="C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe" [ ]
"iTunesHelper"="C:\Documents and Settings\Parker\Desktop\Unused Desktop Shortcuts\Extras\iTunesHelper.exe" [ ]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [ ]
"nvchost"="C:\WINDOWS\winlogon" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 16:38 39264]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2002-10-16 17:06:48 45056]
WG111v2 Smart Wizard Wireless Setting.lnk - C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe [2007-10-27 15:05:21 745472]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

R2 EAPPkt;Realtek EAPPkt Protocol;C:\WINDOWS\system32\DRIVERS\EAPPkt.sys [2005-04-01 09:42]
R2 OneTouch 4.0 Monitor;OneTouch 4.0 Monitor;"C:\Program Files\Visioneer\OneTouch 4.0\OtService.exe" [2005-01-26 11:39]
R3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\wg111v2.sys [2005-04-21 12:33]
R3 SjyPkt;SjyPkt;C:\WINDOWS\System32\Drivers\SjyPkt.sys [2002-10-02 07:57]
S3 NMSCFG;NIC Management Service Configuration Driver;C:\WINDOWS\System32\drivers\NMSCFG.SYS [2002-05-03 09:30]
S3 NMSSvc;Intel® NMS;C:\WINDOWS\System32\NMSSvc.exe [2002-05-03 09:29]
S4 hpt3xx;hpt3xx;C:\WINDOWS\system32\DRIVERS\hpt3xx.sys [2001-08-17 11:52]

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2008-02-09 03:00:01 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Sherry.job"
- C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exeh/TASK:
"2008-02-08 22:00:51 C:\WINDOWS\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-09 18:36:13
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtWLan.exe
.
**************************************************************************
.
Completion time: 2008-02-09 18:42:27 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-10 01:42:17
ComboFix2.txt 2007-12-27 00:42:20
ComboFix3.txt 2007-12-24 21:56:35
.
2008-01-25 01:26:30 — E O F —
———————————————————————————————————————————————————————————

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:42:51 PM, on 2/9/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Visioneer\OneTouch 4.0\OtService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe
C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtWLan.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com/
R3 - URLSearchHook: AOLSearchHook Class - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AOL Search\AOLSearch.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: ShoppingReport - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll (file missing)
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: AOL Search Enhancement - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AOL Search\AOLSearch.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll (file missing)
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask .exe" -atboottime
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [DLCCCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [dlccmon.exe] "C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Documents and Settings\Parker\Desktop\Unused Desktop Shortcuts\Extras\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [nvchost] C:\WINDOWS\winlogon
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ESPN BottomLine] C:\Program Files\ESPN\BottomLine\bline.exe
O4 - HKCU\..\Run: [Morpheus] "C:\Program Files\StreamCast\Morpheus\Morpheus.exe" -min
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [Router] C:\Program Files\Router\Router.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: WG111v2 Smart Wizard Wireless Setting.lnk = ?
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://testprep.princetonreview.com
O15 - Trusted Zone: http://*.princetonreview.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1C203F13-95AD-11D0-A84B-00A0247B735B} (Sheridan ActiveTreeView Control) - https://fa.1stglobal.com/GlobalAccess/sstree.cab
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.costcophotocenter.com/CostcoActivia.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1198438920557
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {89242969-422B-46BF-B0D5-6A7B7DC4D0E0} (NAS Finder Helper) - file://D:\html\nafcom.cab
O16 - DPF: {B020B534-4AA2-4B99-BD6D-5F6EE286DF5C} (Symantec Download Bridge) - https://a248.e.akamai.net/f/248/5462/2h/www…ol/SymDlBrg.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {E9C9692E-F93C-11D1-ABB0-0040054FC6FB} (ProtoView DataTable Control 6.5 (OLEDB)) - https://fa.1stglobal.com/GlobalAccess/pvdt60.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: dlcc_device - Unknown owner - C:\WINDOWS\System32\dlcccoms.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (file missing)
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: OneTouch 4.0 Monitor - Visioneer Inc - C:\Program Files\Visioneer\OneTouch 4.0\OtService.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

–
End of file - 10757 bytes

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

It Started with Internet Speed Moniter

✨ Ask AI

Ask AI